Node
A repo, a venture, a concern. It declares its parent, its children and its domain in one small config file. Work happens inside the domain or it doesn't happen at all.
Kernel
The agent OS that runs my life.
Kernel is the runtime underneath much of my work. Every domain becomes a node run by its own scoped AI operator — on a charter, a heartbeat of scheduled autonomy, and permissions enforced by the machine rather than promised by a prompt. You set direction and approve what matters. Kernel runs the operation.
The problem
Capability outran control.
Hand an agent real tools — your inbox, your repos, your money — and the interesting question stops being what it can do and becomes what it is allowed to do. Today that answer is usually a paragraph in a system prompt asking it nicely.
A paragraph is not a control. So you delegate the reversible work, keep the consequential work, and the whole arrangement sits under a ceiling. The ceiling is not the model's ability. It is how much you can afford to trust it.
The model
One assistant doesn't scale. A hierarchy does.
Kernel is fractal. The top of the tree is a node. Every domain of work under it is a node. Each one is run by its own operator — a scoped AI agent that reads that node's charter, works inside that node's declared domain, and has no reach outside it. Same structure at every depth, which is why adding the tenth domain costs about what the second one did.
Charter
The node's rules: who holds authority, what the node is for, what its operator may decide alone. Policies and standard procedures cascade down from the top. A child may tighten them. It can never relax them.
Operator
A persistent AI operator per node, plus short-lived helpers spawned for one bounded order and torn down after. They report up. They don't reach sideways.
Heartbeat
Scheduled autonomy instead of a chat window. The node wakes on a cadence, does its round, and leaves a record of what it decided and why.
The beat
Autonomy on a schedule, not on demand.
An operator doesn't sit waiting to be prompted. It wakes on its cadence and works a fixed loop, and the loop is the same at every node.
-
Sense
Read the portfolio, the queue, repo state and recent memory.
-
Roll up
Dispatch a scoped operator into each child node to refresh its interface, confined to that child's domain.
-
Brief
Compose the day's brief, folding every child's interface into one document.
-
Queue
Append anything that needs your signature to the queue. Never execute it.
-
Commit
Write the brief and the queue into the repo, so the record is versioned like everything else.
-
Deliver
Send it to your phone over Telegram, where you can steer it or approve what's waiting.
Every step of the loop is recorded as it happens, so a completed run leaves a verifiable chain of what it did and why.
Permissions
Three tiers, and only one of them needs you.
Every action an operator can take is classified before it runs. The classification is the whole contract: full autonomy inside it, a human signature at its edge, and a short list of things with no path at all.
Tier 0
Act, no ask
Read and research. Draft anything. Commit and push your own repos. Open draft pull requests. Build a site without publishing it. Run the beat. Dispatch a child operator. This is most of the work, and it happens without you.
Tier 1
Stage for a signature
Anything outward, irreversible or committing: a message to a third party, a publish to production, spending money, destructive git. These get written into a queue with your name on them and wait there. They are staged, never executed.
Tier 2
No path
Reading or writing secrets. Irreversible bulk deletes. Carrying private-context data into an outward action. Not gated behind an approval — simply not reachable.
- Notify you on Telegram Tier 0
- Commit and push your repos Tier 0
- Build a site, unpublished Tier 0
- Email a third party Tier 1
- Publish a site to production Tier 1
- Spend money on your behalf Tier 1
- Read or write secrets Tier 2
Permissions narrow on the way down. A child node's scope is a restriction of its parent's, so a node can never grant itself something its parent withheld.
Enforcement
“Won't” becomes “can't.”
The difference between a policy and a control is what happens when the agent decides otherwise. In Kernel the decision never reaches the tool. Five mechanisms, all of them shipped and running.
-
A verdict on every tool call
The guardrail sits in front of the runtime, not inside the prompt. Every single tool call gets a verdict — allow, stage or deny — before it executes, and the verdict is written to the log either way.
-
An operating-system sandbox
Each beat runs inside a kernel sandbox — a macOS Seatbelt profile, and a default-deny Landlock ruleset on Linux. It cannot read the governance key or write the governance corpus. The syscall fails; there is nothing to talk it out of.
-
A floor no node can lower
A node declares its own governance profile and may loosen the classes it's permitted to loosen. Underneath sits a floor nothing can move: changing governance always needs approval, and secret access, out-of-domain writes, force-pushes and catastrophic shell are always denied. In the app that floor rides every setting, including the most permissive one.
-
A signature that isn't on the machine
Approving a governance change takes an Ed25519 signature or a passkey — Face ID on your phone, over a relay that only forwards the challenge. Even a fully compromised host can't forge it, because the key was never there. The app states it plainly: changing your Kernel's rules requires your Touch ID, and software can't approve them.
-
A log that notices tampering
Every beat appends to a keyed, append-only event log: each guardrail verdict, each dispatch, each staged item. Signed head checkpoints are committed to git, so version history stands outside as a witness against a quiet rewrite.
What ships
A runtime and an app, not a service you rent.
Kernel installs on your machine and runs there. Your nodes, your repos and your documents stay on hardware you control; the hosted piece holds accounts and grants, never content. That isn't a promise in a privacy policy, it's where the files are.
The runtime
One compiled, self-contained binary. It seats an agent into a node, rules on the guardrail before every tool call, keeps the event log, and runs the beat on a schedule. Around sixty CLI verbs, built for both Apple Silicon and Intel, and it upgrades and rolls back in place.
The desktop app
A Mac app that gets you from sign-in to a working install without a terminal, then stays resident as the place you work: the node tree, a scoped agent console per node, and the approvals. It brings its own inference or drives the coding harness you already use.
The console
Accounts, invitations, node ownership, machine tokens, releases. It holds metadata and grants and nothing else — and a node you weren't granted answers with a 404 rather than a 403, so its existence never leaks either.
Status
Where it actually is.
Kernel runs a real operation today, with the enforcement layer merged and live rather than sitting on a roadmap. Several of the projects on this site are nodes under it. Someone outside the machine can be granted a single node and work inside it without getting a copy of anything else.
It is not a finished product. No price, no open signup, no customers to point at. I'm still finding out what it's like to run an operation this way before I ask anyone else to run theirs this way. If you want to see it work, ask.