AI-First OS

SPEC v0.3.1 FINAL (frozen 2026-09-05)

AI-First OS

A private phone OS where user-intent orchestration above the security kernel is performed by cooperating local agents, while authority, safety, resource control, and fallback behaviour remain deterministic.

The invariant, in one line. Intelligence may propose. Only deterministic authority may permit. Compute may optimise; it never authorises. Remote systems may deliver; they never execute.

Current status: Phase 0 — not started.

Who owns which layer

Seven rows, six numbered layers plus the owned inference runtime inserted at L2.5. Everything above the security kernel that decides, is deterministic code; agents only propose.

3D view (progressive enhancement). The table below is the authoritative description.

Layer stack from L5 Interface at the top to L0 Hardware at the bottom, with L2.5 Inference Runtime between the Runtime slot and the Security KernelL5Interface — AI-nativeL4Agent City — AI + deterministic glueL3Runtime slot — DeterministicL2.5Inference Runtime — DeterministicL2Security Kernel — DeterministicL1Base — DeterministicL0Hardware
Layer stack, top to bottom
LayerNatureOwnershipContents
L5 InterfaceAI-nativeProjectIntent-driven UI. Apps reachable, not primary.
L4 Agent CityAI + deterministic glueProjectMayor, Auditor (Thraksha), first-party and SDK Workers. ModelProvider calls into L2.5.
L3 Runtime slotDeterministicAOSP (ART), pluggable slotAndroidRuntime (ART) is real. IosAdapter is a name only; nothing may depend on it.
L2.5 Inference RuntimeDeterministicProject — ownedResidency, placement, batching, backend abstraction, metering. Sees tensors plus opaque execution metadata only. No write access to the audit log.
L2 Security KernelDeterministicProject — no model inputRegistrar, policy engine, allow-lists, audit writer, TEE binding, remote-command verifier, key hierarchy.
L1 BaseDeterministicForked AOSPLinux kernel, HALs, ART, system services. Google proprietary services removed. No project kernel code in v1.
L0 Hardware—VendorDevelopment device: Samsung S20 FE Snapdragon 865 (r8q). Target: Pixel 8 or later.

Agent City

Agents live in zones with fixed trust levels. Zone membership and autonomy tier are policy facts held by the security kernel, never agent beliefs. Rank changes priority and budget only.

3D view (progressive enhancement). The rings and tables below are the authoritative description.

Agent City zones drawn as concentric rings: Z0 Core at the centre, then Z1 Civic, Z2 Domestic, Z3 Foreign and Z4 Quarantine at the edgeZ0 CoreZ1 CivicZ2 DomesticZ3 ForeignZ4 Quarantine
Zones
ZoneTrustModel accessTypical residents
Z0 CoreHighestNoneRegistrar, audit writer
Z1 CivicHighYes, budgetedMayor, Auditor explainer
Z2 DomesticMediumYes, budgetedWorkers owning personal data
Z3 ForeignLowYes, minimalWorkers wrapping third-party apps; SDK Workers by default
Z4 QuarantineNoneNoneSuspended agents
Registrar Z0
Pure code in L2. Inputs: agent id, typed request, effective policy. Output: grant or deny plus an audit record.
Mayor Z1
Orchestrator. Receives intent, decomposes, dispatches, tracks rank, requests Tier-3 authorisation. Holds no resource capabilities.
Auditor Z1
Thraksha Personal. Deterministic, evidence-driven. Can suspend anything including the Mayor. Cannot grant. Has no egress.
Workers Z2
One resource class each. Talk only through the Mayor over typed messages.
SDK Workers Z3
Third-party agents installed to Z3. Same bus, same ModelProvider, same Registrar. No second path.

The Law

Ten non-negotiable invariants. Every packet of work is tested against them, and those tests are protected: they can be added to, never weakened.

  1. L1 Agents decide what to ask for. Code decides what is allowed.
  2. L2 No model output ever reaches the security kernel as an instruction. The kernel consumes only typed capability requests.
  3. L3 No unsolicited inbound network endpoint exists on the device. Ever. This includes Android apps.
  4. L4 Egress is denied by default for every userspace principal. Grants are per agent, per app and per enumerated system principal, all deterministic, all held by the Registrar.
  5. L5 Agent rank never grants or widens a capability.
  6. L6 Every agent request produces linked append-only REQUEST and DECISION records, and every intent ends with exactly one METER record. No record is ever mutated.
  7. L7 The Auditor can suspend. It cannot grant.
  8. L8 AI is a detachable plugin. Every subsystem degrades to a deterministic fallback when the model is absent, wrong, or offline.
  9. L9 No remote party executes on the device. Vendors and administrators deliver artefacts and policy; only owner authority causes them to take effect.
  10. L10 Inference is a measured resource. Every intent records model calls, tokens, latency, energy and the measurement source.