aiueos — a capability-secure Wasm component OS

Why aiueos

Survives mythos-class adversaries

Deny-by-default capabilities, a small TCB, Wasm isolation per component, runtime-enforced gates, and an append-only audit trail. A compromised component is a contained event — not a system-wide one.

One model, many surfaces

Just components + capabilities + manifests + audit over Wasm, so a component runs wherever a Wasm engine does. Capabilities differ per deployment; the meaning model and the gate do not.

Code as data, AI-agent-native

Components are kotoba — data the OS reasons over. An AI agent can author one; the OS treats it as :ai-generated: untrusted, ephemeral, denied network/secrets/persistence by default.

Boot a system

# a robot as a capability-component graph (sensor → planner → actuator).
# boot order is DERIVED from the topic dataflow, not the listing order.
$ aiueos up examples/robot/robot.aiueos.edn
aiueos boot — system `robot`
  order: driver/sensor → agent/planner → driver/actuator
  ✓ driver/sensor    (driver) → 21   # publishes 21 to topic "scan"
  ✓ agent/planner    (agent)  → 42   # polls scan, publishes scan×2 to "cmd"
  ✓ driver/actuator  (driver) → 42   # polls cmd, drives it
✓ system up — 3/3 components launched

# every grant / deny / compile / run is appended to the EDN audit log
$ aiueos verify examples/system.aiueos.edn   # no IOMMU grant → DMA denied (exit 1)

Capabilities you call at runtime

The broker-mediated aiueos:host ABI enforces capabilities on every call. A call to a capability you weren't granted traps.

import	capability	meaning
`log(i64)`	`log/write`	emit a log sample
`clock()→i64`	`clock/monotonic`	monotonic tick
`publish(i32,i64)`	`topic/publish`	publish to a topic
`poll(i32)→i64`	`topic/subscribe`	latest sample on a topic

Security posture

Deny-by-default. A component touches only granted capabilities — unresolved imports are denied before launch.
Runtime gates, not convention. Every host call is checked; attenuation holds — some caps never leak the rest.
Small TCB. Only broker, runtime/host ABI, safe-checker and manifest reader are trusted; drivers are evictable Wasm.
Limits. Per-component fuel (CPU) and memory-page caps; runaways trap, not hang.
IOMMU/DMA rule. Any :dma effect must require + be granted :iommu, or it's denied.
AI containment. :ai-generated components are untrusted, ephemeral, no network/secrets/persistence.
Audit. Every grant/deny/compile/run recorded as EDN.

Honest by design: aiueos is an architecture for containment, not a claim of invulnerability. Side channels, TCB bugs, unsigned manifests and IO-DoS are out of scope for Phase-0 — see SECURITY.md.

Where it stands

Phase 0 ✓ manifests · capability graph · policy reasoner · broker · safe-check · audit · staged boot
Phase 0+ ✓ runtime-enforced capabilities (aiueos:host) · pub/sub topic bus · robot demo
Next named topics → dataflow-aware boot · real-time scheduler · signed manifests/provenance
Later microkernel · real device ABIs (CAN/I2C/SPI/GPIO) · per-surface capability providers · microVM image