AOS
The runtime that bounds what an agent may do
An agent runtime and safety layer over Linux. Agents are supervised like processes. It starts them, bounds what they may run, records every attempt including the refusals, and can stop all of them at once.
Why it exists
A capability that only holds while the layer above it behaves correctly is not a capability. AOS refuses a path in its own process, so it would refuse it just the same if Carl were wrong or compromised.
What it is meant to be
- Agents are real Linux processes, not rows in a database
- The audit log is the only durable state, folded back on start
- A start record carries the process start time as well as the pid, so recovery never adopts a stranger
- Holds no opinion about whether work is worth doing, on purpose
- One command stops every agent at once
Current milestone
Phases 0 to 3a are done and checked against real processes: supervision, crash recovery, adoption of orphaned processes, the daemon over a real socket, the policy gate, and a file capability server. The command runner is next and is the harder half.
- CompleteSupervision and recovery
- CompleteThe daemon, and adopting orphans
- CompleteThe policy gate
- CompleteA file capability server
- PLANNEDThe command runner
Long term direction
A runtime any ME system can host agents on, where what an agent may touch is enforced somewhere the agent cannot reach.