The appliance architecture: an OS whose init process is an agent

Sandboxing an agent usually means wrapping a process. Agentic OS inverts the frame: give the agent an entire operating system — and isolate the operating system.

The guest is a from-scratch Linux image that boots in under 30 ms into agentd, the PID-1 supervisor: an epoll reactor around a pure-logic reconciler driving five state machines, with cgroup v2, namespaces, seccomp BPF, and Landlock enforcing the interior walls. The agent harness runs the plan-act-observe loop as a supervised child. There is no network stack worth escaping to — zero egress is a property of the image, not a firewall rule.

The host runs the sandbox: QEMU or Firecracker lifecycle, virtio-fs mounts, and the VSOCK bridge that is the guest's only window. Two things cross it. MCP servers on the host are materialized as ordinary CLI tools inside the guest, so the agent uses fetch-page like any Unix command while the host applies rate limits and audit at the boundary. And the LLM itself arrives via the intelligence socket — either a live provider or a scripted mock, which is the architecture's quiet superpower: a recorded intelligence script makes an agent run deterministic and replayable, byte for byte.

The trust chain closes the loop: Ed25519-signed boot manifests and a UEFI Secure Boot chain mean the artifact that boots is the artifact you built. The same image runs in a VM on your desk or from a USB stick on an ARM single-board computer — the robot brain and the CI sandbox are one build target.

The design doc's thesis, compressed: when the agent is PID 1, containment stops being a policy and becomes the platform.