01 AOS-ARCH-009
Entity-first, not app-centric
A typed graph of people, projects, tasks, documents, events and devices — typed edges carry source and confidence. UI is assembled around current work, not an icon grid.
How it works
Durable semantics above replaceable providers.
Agent OS owns the entities, actions, history, authority and delivery semantics that applications currently fragment. Micro-apps assemble the needed interface; Agent Mesh carries the same objects across direct, off-grid and delayed paths.
The premise
Apps become views. The work becomes the system.
Today identity, actions, interfaces and history are fragmented by application. Agent OS keeps one object graph and lets many views, agents, micro-apps and replaceable providers operate on it.
App-first
Mail Chat Notes Tasks Calendar Files
Identity, actions and history are fragmented by application.
becomes
App-last
Document Task Person
Project
Event Message Agent plan One object graph. Many views and replaceable providers.
The vision core
Six pillars.
02 AOS-PROD-018
Interfaces are generated and malleable
Text, Shortcut-style blocks and declarative source produce safe micro-apps that render across AI answers, documents, notifications, widgets, wearables and focused modes.
03 AOS-ARCH-009
Global history with undo
An append-only semantic event log records navigation, documents, actions, agents, delivery and external effects. Search, replay, undo and compensate where safe.
04 AOS-ARCH-024
Local-first and peer-capable
Data remains authoritative on user-controlled devices. Agent Mesh adds direct, off-grid and delay-tolerant paths without changing entity or action semantics.
05 AOS-ARCH-010
Agents on a capability model
Agents extract, link, propose interfaces and invoke typed actions only through explicit grants, previews, budgets and receipts.
06 ARCH-022
Config ↔ GUI ↔ API mirroring
Anything exposed graphically is represented through inspectable schemas and actions so CLI, TUI, scripts, settings, micro-apps and agents stay aligned.
Architecture
Seven layers, explicit contracts.
Kernel policy stays minimal. Drivers, compatibility, graphics, entity services, micro-apps, connectivity policy and agents live in isolated user-space domains behind versioned contracts.
L6 Product · shell, entities, agents, history, sync from scratch
L5 Compatibility · Starnix (Linux/Android userspace) as-is
L4 Camera · capture + HDR+ + tuning wrap / tune
L3 Telephony · pre-certified module (demo brick) as-is
L2 GPU · Magma driver port
L1 Board bring-up · drivers, power island port
L0 Fuchsia fork · Zircon, DFv2, FIDL, Magma fork
All contracts between layers are FIDL — which is what makes the emulator (Track A) and real hardware (Track B) interchangeable above the contract boundary. Most demo-brick hardware is as-is (pre-certified modules), which is why it ships years before a custom device.
Identity · Global Account
One account for everything. Your data stays yours.
Agent OS treats identity as a system-wide primitive, not a per-app afterthought. One Global Account carries your login, payments and data everywhere — across native apps and websites — while your personal data physically stays with you, not vendors. A vendor gets only an opaque UUID and the specific access you grant. AOS-PROD-014
“iCloud as it should be.”
Global end-to-end login
Log into an app once and the matching website recognizes you — the same identity spans native and web, not two separate accounts.
Local-first personal storage
Your data is end-to-end encrypted and lives with you. You share individual "sectors" selectively; vendors never hold the store, only the handles you grant.
Vendors get a UUID, nothing more
A vendor sees an opaque per-user identifier and the specific access you allow — not your name, inbox, or profile. Custody stays on your side.
Universal payments, built in
One system-wide way to pay every app. No per-vendor card entry, no re-authorizing a checkout you already trust.
A notification hub, not OTP email
An OS-level hub replaces OTP email and SMS: granular, revocable, rich-content, with trust tiers — every subscription visible in one place.
Global nicknames
Pseudonymous, un-squattable identifiers. You are reachable and consistent across the system without handing anyone your real identity.
Deeper than Sign in with Apple.
The same instinct Apple had — a unified way to pay and authorize — taken to its conclusion, without the gate.
- Open
- No paid developer account gates adoption — any vendor can integrate.
- Web + native
- Spans the browser and native apps, not just one vendor’s ecosystem.
- Custody inverts
- Local-first and GDPR-native: your data stays with you, not routed through the vendor’s account.
- One consent surface
- See and revoke every grant and notification subscription in a single system-wide place.
- Anti-phishing
- Credentials never touch a vendor’s servers, so they can’t be stolen from one.
- Pseudonymous by design
- Identity is opaque by default, not an afterthought bolted onto a real-name account.
Micro-apps · Text-to-interface
The interface you need should not require another app.
Describe a missing interface, inspect the proposed data and authority, then install a small declarative micro-app. It can appear inside an AI answer, document, notification, lock screen, wearable, dashboard or full-screen mode. AOS-PROD-018
01
Describe
Ask for an outcome in ordinary language: data, explanation, triggers, actions and where the interface should appear.
02
Inspect
Agent OS produces an explicit plan, provider list, data flow and capability diff before anything is installed or executed.
03
Edit
Switch freely between natural language, Shortcut-style blocks and declarative source without changing semantics.
04
Reuse
One micro-app instance renders as an AI response card, document block, notification, widget, watch glance or focused mode.
UV today
Personal risk, safe-until time, hourly chart and sunscreen actions.
Project overnight
Tasks, commits, messages and blocked decisions in one interactive brief.
Travel disruption
Evidence, alternative routes, refund and share actions.
Agent Mesh inbox
Pending, relayed, delivered and expired off-grid bundles.
Micro-apps are safe to generate because the runtime accepts signed manifests over trusted components and typed actions — not arbitrary code with ambient filesystem, network or identity access. AOS-ARCH-026
Agent Mesh · Peer-to-peer
Connectivity is a system policy, not a messaging-app choice.
Address a person, project or device. Agent OS chooses direct Wi-Fi, Bluetooth, LoRa, an optional gateway or delayed physical carriage from deadline, privacy, region, energy and trust. AOS-ARCH-024
1 Direct Local IP or Wi-Fi Direct for large, fast payloads.
2 Nearby BLE for discovery, consent and small exchanges.
3 Off-grid LoRa for short messages, coordinates, receipts and hashes.
4 Delayed Encrypted store-and-forward through devices and fixed relays.
5 Gateway Optional Internet, LoRaWAN or satellite bridge without content authority.
One encrypted envelope and receipt model survives changes in transport and connectivity. LoRa is only one provider below it.
The rules that hold it together
Four invariants.
One object, many surfaces
AOS-ARCH-009A person is not five contacts. A project is not a folder plus a chat plus a board plus a calendar — it is one entity, rendered as a card, table, timeline, map, micro-app or agent context.
One action model, many callers
AOS-ARCH-010The same typed action can be invoked from a button, micro-app, command palette, script or agent under explicit authority — with no private backdoor to state.
Replaceable providers and transports
AOS-ARCH-024Storage, data, actions, rendering, radio and hardware backends can change while entity and action semantics stay stable. Foreign types stop at adapters.
Evidence before promises
AOS-BRIEFClaims, experiments, risks and acceptance gates constrain implementation and every public support statement. No assumption becomes a requirement just because it appeared in a spec.
Go deeper
Read the source specs.
Use it first.
For people who create and change things — not the mass market. Join the waitlist to hear when the first builds open up.