An OS where the agent is PID 1

Every agent sandbox draws a line around a process and hopes the line holds. Agentic OS draws the line around an entire operating system — and then makes the operating system the agent's body.

The init process of the appliance is the agent supervisor. There is no shell to escape to, no package manager to abuse, no network stack to pivot through — the image contains the agent, its harness, and nothing else. Zero egress isn't a firewall rule that someone can misconfigure; it is the absence of a path, enforced by seccomp from PID 1 down.

Three properties fall out

Determinism. The guest's only window to the world is VSOCK to the host, and everything that crosses it — tool calls, and the LLM itself via the intelligence socket — can be scripted. Record a run once and replay it byte-for-byte: agent behavior becomes testable the way compilers are testable, which is not a sentence you can usually say about LLM systems.

Attestation. Ed25519-signed boot manifests and a UEFI Secure Boot chain mean the thing that booted is provably the thing you built. For an autonomous system, "what code is actually running?" should have a cryptographic answer.

Portability of trust. The same signed image boots in QEMU on a developer laptop, under Firecracker in CI, and from a USB stick on an ARM board bolted to a robot. The security argument travels with the artifact — your robot's brain has the same audit story as your test suite.

It is honestly a sandbox-status project: the master plan is public, the tiers are numbered, and roughly 667 tests across five Rust crates keep the foundation from being a manifesto. But the question it prototypes is the lab's central one — what does it take to trust an autonomous system? — answered at the layer where trust actually bottoms out: the machine.