Objective. A safety-critical closed-loop brain-computer interface (BCI) needs an operating-system substrate that meets sub-millisecond deadlines on microcontroller-class hardware, isolates neural-data flows by capability rather than by memory map, leaks no exploitable information through its timing channels, and is small enough to admit formal verification. Methods. We give an analytical specification of one such kernel - AxonOS, a no_std Rust microkernel for Cortex-M4F (STM32F407) with a single-producer/single-consumer (SPSC) ring-buffer payload path verified by the Kani bounded model checker. We prove: (i) Liu-Layland EDF schedulability with R1 = 972 us inside a 4 ms deadline; (ii) Release/Acquire correctness of the SPSC queue; (iii) capability soundness against an active attacker; (iv) a six-clause dual-core real-time contract with a Cortex-A53 core. Results. CPU utilisation U = 0.179 from datasheet WCETs. We make no measurement claims - all execution times are predicted from cycle counts. Significance. Predictions P1-P5 state in falsifiable form what a Phase-1 measurement study on the AxonOS substrate in Q2 2026 must find. Source code and Kani proofs: https://github.com/AxonOS-org