The kernelyour agents answer to

Why Chio is a kernel

An operating system kernel is the code a program goes through to reach the hardware. It decides what a process may open, holds processes apart, and writes the audit log. Chio takes that position between an agent and the files, tools, services, and money it reaches. Before a call runs, the agent presents a signed token that states who it is, what it may call, and how much it may spend.

Each part of an operating system kernel has a counterpart in Chio:

Sovereign agents carry their own standing

A market cannot treat an agent as an actor if an operator owns its name, grants all its rights, and keeps its record. In that model, the buyer deals with the operator. The agent is only a process inside the operator's system.

Chio calls an agent sovereign when it owns its identity, rights, and record. The agent can take them to a new host, operator, wallet, or market. Each one carries proof that others can check. No old operator has to vouch for the agent or grant access to its past. Read Sovereign Agentic Cognition for the full model.

This is the first condition of a sovereign cognition market. The agent must enter the market under its own name, with its own rights and work record. Otherwise the market trades access to platforms, not cognition from agents.

Govern each action

Chio governs what an agent does, not what it thinks. The model can reason and plan as it chooses. When it requests access to a file, service, database, wallet, tool, or another agent, the call reaches the kernel. The kernel allows the call after its configured checks pass.

These components evaluate a call:

• Identity names the agent. An ID tied to the agent's public key and an agent passport let any party check who made the call and which work record belongs to it.
• A capability sets its rights. The signed token states what the agent may do, how much it may spend, and when those rights end. An agent may pass on fewer rights, never more.
• Guards apply the rules. They check the exact call, inputs, session, spend, and policy at that moment. A valid capability alone does not let the call run.
• The budget holds the funds. For a priced call, Chio reserves the price before the call runs. If the call fails, Chio releases the hold. If it succeeds, Chio settles the charge against the hold.

One policy model covers MCP, A2A, ACP, and OpenAPI over HTTP, because each adapter lifts its own wire format to the same kernel verdict and lowers that verdict back into the format it came from. Bridges documents the tool mapping, the invocation flow, and the receipt each edge writes. The kernel itself runs linked into the agent, as a native sidecar beside it, as a hosted MCP edge, or in front of an HTTP API as an Envoy external authorization service. Where the kernel runs compares them. An agent receives no authority by default, and a priced call also requires sufficient funds.

Record the decision

Once the tool returns, Chio signs a receipt. It names the agent, the rights it used, the rules that ran, the amount held and paid, and the result. Chio signs the outcome whether it allows, denies, cancels, or leaves the call unfinished. Anyone with the public key can check the receipt offline.

The receipt records both the decision and, when applicable, payment. A buyer can inspect what it purchased, an auditor can inspect the policy, and finance can inspect the charge without reconciling separate logs.

This is also how Chio supports compliance programs. It runs policy before each governed call and signs the result. Read Compliance as Code for the full case.

The market for what agents know

In a Chio market, agents sell verified findings to other agents. A finding may be code, a test result, a research claim, or proof that a path failed. The failed path matters: it may have cost more to learn than the final answer, and it can stop every buyer from paying to learn the same fact again.

The buyer pays less than it would cost to do the work again. The seller earns from work it has already done. A group of agents can buy one finding once instead of having each member find the same answer or dead end.

The trade runs as governed calls. The kernel checks the seller, the buyer, the rights, the price, the rules, and the proof, releases the finding after those checks pass, settles the payment, and signs the result. The two agents need no common operator and no prior trust. Read The Cognition Market for the profiles it ships in and what each one settles.

Put the kernel in front of a tool server

One command puts the Chio kernel in front of an MCP server:

$ chio mcp serve --policy ./policy.yaml --server-id srv-files \
    -- npx -y @modelcontextprotocol/server-filesystem ./workspace

Every call from the agent now reaches the kernel before the server sees it. Chio checks the agent's capability, applies the guards, checks the budget when the call has a price, and signs the result.

See it run

One orchestrator delegates to a researcher and a writer. Each child receives a narrower scope, its own route plan, a slice of one budget pool, and a continuation token bound to the signed task graph. The swarm authority checks the whole bundle before either child starts.

$ cargo run -p chio-swarm-authority --example agent_os

chio swarm authority  ·  one task graph, verified before any child runs

task graph  swarm-incident-42
  orchestrator      depth 0  scope 6ab7b09faf2a  route -                budget holds the pool
  researcher        depth 1  scope c5a04ca641ec  route route-researcher budget 2500 of 10000 units
  writer            depth 1  scope c5a04ca641ec  route route-writer     budget 2500 of 10000 units
  join researcher + writer -> orchestrator  (all_success)

verdict  verified  (3 tasks, 2 continuations, 1 joins, 2 routes)
  researcher   continuation continuation-researcher    witness witness-researcher (1 hop)
  writer       continuation continuation-writer        witness witness-writer (1 hop)
claims   claim.swarm.task_graph_bound, claim.swarm.continuation_fresh, claim.swarm.attenuation_witness_chain_bound, claim.swarm.route_plan_bound, claim.swarm.join_receipt_bound, claim.swarm.budget_pool_bound, claim.swarm.revocation_epoch_bound, claim.swarm.terminal_graph_receipt_bound

then someone tries to
  add an edge from the writer back to the orchestrator rejected: swarm task graph cycle at task-orchestrator
  hide a hop by understating the writer's depth        rejected: swarm task depth mismatch: task-researcher -> task-writer
  allocate 5,000 units out of a 100 unit pool          rejected: swarm budget allocations exceed pool total
  run the researcher after its task was revoked        rejected: swarm task is revoked: task-researcher

The example is one file of Rust against the public crate API, and the same verifier runs in the kernel's admission path. Swarm Protocol documents the task graph, the continuation token, and the witness chain the run prints.

How Chio evaluates a call

These components take a call from request to signed result:

The kernel is the only trusted component, and Chio keeps it small enough to review and test. It enforces the agent's signed rights, and the tool runs in a sandbox. Existing agents and tools stay outside the trusted core.

Next steps

Start with one governed call, or read the model it rests on:

• Quick Start: govern an MCP call and read the receipt it signs.
• Installation: install the command-line interface, a language SDK, or the container image.
• Sovereign Agentic Cognition: see how agents bring their own identity, rights, and record to the market.
• Compliance as Code: see how policy runs before each governed call and lands in the receipt.
• The Cognition Market: see how agents sell and buy verified findings through governed calls.
• Architecture: trace one call through the kernel from request to signed receipt.