Astrid

// Overview

Astrid is an operating-system project for software built from WebAssembly components it calls capsules. It ships today as a portable user-space runtime for macOS and Linux — a daemon plus a CLI, not a bootable OS image — with a standalone operating system as the longer-term direction. Capsules run in a Wasmtime sandbox, talk to each other over an event bus through versioned typed interfaces, and can be installed, upgraded and removed while the daemon keeps running.

The design premise is that an agent is untrusted code running on your machine with access to your files, your network and your credentials, and that telling it to behave is not a security boundary. So authority is separated from intelligence: the kernel holds no LLM handles, no conversation state and no tool registry, and instead instantiates the event bus, loads capsules and routes IPC under a capability ACL. Every file path, network host and tool is a signed ed25519 grant that is scoped to a resource pattern, bound to a principal, expiry-checked and globally revocable — no grant, no access.

Isolation is per-principal rather than per-process: each identity gets its own capsule access, key-value data, secrets, home directory, quotas and audit chain, and a lookup that cannot resolve the caller fails closed. Actions are recorded in a hash-linked audit chain where each entry seals and signs the hash of the one before it, so tampering is detectable. Astrid deliberately does not pick a product, model provider, agent loop or user interface for you; a curated bundle of capsules, called a distro, supplies those choices and is pinned by BLAKE3 hash in a `Distro.lock`.

// What it does

• WebAssembly capsules run in Wasmtime with no syscalls, no file descriptors and no host memory — every external effect is a capability-checked host call over a WIT-typed ABI
• Signed ed25519 capability grants scoped to a resource pattern, bound to a principal, expiry-checked and globally revocable
• Per-principal isolation of capsule access, KV data, secrets, home directory, quotas and audit chain, failing closed when the caller cannot be resolved
• Hash-linked, signed audit chain in which each entry seals the hash of its predecessor
• Live capsule lifecycle: install, upgrade and remove capsules on a running daemon with no restart
• Content-addressed durable state with deduplication and recovery, mountable through macOS FSKit or Linux FUSE
• Distros — curated capsule bundles pinned by BLAKE3 hash in a Distro.lock so the same input reproduces the same fleet

// Getting started

Install the runtime, start an uncomposed daemon to confirm it works, then compose it by initialising a distro. A fresh uncomposed runtime carries no product capsules and needs no model account.

brew tap astrid-runtime/tap
brew install astrid

cargo install astrid

# or from source
git clone https://github.com/astrid-runtime/astrid
cd astrid && cargo build --release   # binary at ./target/release/astrid

astrid --version
astrid start
astrid status
astrid capsule list
astrid stop

astrid init --distro @yourorg/your-distro          # repository distro
astrid init --distro ./Distro.toml                  # local manifest
astrid init --distro ./bundle.shuttle --offline     # signed bundle, no network
astrid init --distro @yourorg/your-distro --yes     # non-interactive defaults

astrid          # CLI uplink (TUI, headless, capsule and agent management)
astrid-daemon   # kernel: capsule loading, IPC routing, capability enforcement
astrid-build    # capsule compiler and packager
astrid-emit     # stdio-to-bus bridge

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Run an agent's tools as sandboxed capsules so a prompt injection cannot reach a file, host or credential that was never granted
• Host several identities on one runtime and keep each one's data, secrets and quotas provably separate
• Produce a tamper-evident record of what an autonomous system actually did, via the signed hash-linked audit chain
• Ship a reproducible fleet of components as a hash-pinned distro that colleagues can install, upgrade and revoke without restarting the daemon

// How Astrid compares

Astrid alongside other open-source code sandboxes & isolation tools AI/TLDR tracks, ranked by GitHub stars.