Astrid

Software should compose without inheriting each other's authority.

---

Astrid is an operating-system project for software built from WebAssembly capsules. Today it runs as a portable user-space runtime on macOS and Linux; the direction is a standalone operating system. This release is the hosted runtime, not a bootable OS image.

Run components in a sandbox, connect them through typed interfaces, and give each principal its own capabilities and durable state. Install, upgrade, and remove capsules while the runtime is running.

Use it to build agent systems, tools, services, or your own distribution. Astrid does not choose a product, model provider, agent loop, or user interface for you.

Agents make the problem urgent: a model can choose what to do, but that should not make the model the authority that permits it. Astrid separates those jobs. The same foundation serves software without an LLM—components can be replaced and composed without putting application policy into the kernel.

• Compose behavior: capsules communicate through an event bus and versioned interfaces; the kernel routes requests rather than owning application logic.
• Make authority explicit: filesystem, network, process, and IPC access are checked at runtime boundaries, not entrusted to prompts.
• Keep state portable: content-addressed storage, deduplication, and recovery back principal-owned data. Mount it through macOS FSKit or Linux FUSE.

Get started · Write a capsule · Read the Book · Release notes

Quick start

Install Astrid using one of the options below, then start an uncomposed runtime—no model account or distribution required:

astrid --version
astrid start
astrid status
astrid capsule list
astrid stop

status reports the running daemon; a fresh uncomposed runtime has no product capsules. stop shuts it down and retires its working state into astrid.volume. Starting again restores the working projection.

Next, build your first capsule, or choose a distribution you trust with astrid init --distro <source>. A distribution supplies the capsule composition and configuration; Astrid does not select one implicitly. See initial setup for repository, local-manifest, and signed-bundle inputs.

Start with the Book for the architecture or the Contributor Handbook to contribute.

Why Astrid exists

Agent frameworks put trust in the prompt. Astrid puts it in the runtime. An agent is untrusted code executing on your machine with access to your files, your network, and your credentials. Telling it to behave is not a security boundary. An OS-grade boundary is.

• Cryptographic capability model. Every file path, network host, and tool is a signed ed25519 grant scoped to a resource pattern, principal-bound, expiry-checked, and globally revocable. No grant, no access.
• WASM sandbox with no ambient authority. Capsules run in Wasmtime with no syscalls, no file descriptors, and no host memory. Every external effect is a capability-checked host call over a WIT-typed ABI.
• The kernel is dumb. It instantiates an event bus, loads capsules, and routes IPC bytes under a capability ACL. It has no LLM handles, no conversation state, and no tool registry. All intelligence lives in capsules, so a capsule bug cannot corrupt shared kernel state.
• Per-principal everything. Each identity gets isolated capsule access, KV data, secrets, home directory, quotas, and audit chain. One principal can never read another's namespace, and it fails closed if the caller cannot be resolved.
• Signed, hash-linked audit chain. Each entry seals the hash of the one before it and is signed. Break the chain and the tampering shows.
• Live capsule lifecycle. Install, upgrade, and remove capsules on a running daemon. No restart.

How it works

Frontends (the CLI, the HTTP gateway, Discord, and so on) are uplinks: protocol clients that connect to the daemon over a Unix domain socket and speak in IPC events. There is no Frontend trait. An uplink publishes events and receives responses like any other bus participant.

flowchart TB
    CLI[CLI] -->|IPC events over Unix socket| Kernel
    HTTP[HTTP gateway] -->|IPC events| Kernel
    Discord[Discord] -->|IPC events| Kernel
    Uplinks[Other uplinks] -->|IPC events| Kernel

    subgraph Runtime[Astrid]
        Kernel[Kernel: astrid-daemon<br/>dumb event router<br/>event bus - capability ACL - audit chain - Wasmtime sandbox]
        Capsules[WASM Component capsules: wasm32-unknown-unknown<br/>providers - orchestrators - tools - fs - http - sessions - registry - identity]
    end

    Kernel -->|capability-checked host calls<br/>astrid:* WIT ABI| Capsules

This is the beginning of the README. Read the rest at the original. Read the full README ↗