Introduction

Chio is a modern Rust kernel for agentic operating systems.

On this page

Build systems of agents that can act, delegate, and keep working. Chio gives them a common foundation: the kernel enforces the relationships between computers, processes, resources, and authority.

Fork a repository for every partner you work with, give each one's agents a budget, merge the first fix that passes, and verify everything they did.

hero.tshero.pysrc/main.rs · in main

import { Computer, USD, firstPassing } from "@chio-protocol/sdk";

const project = await Computer.open("quickstart");
const partners = await Computer.partners();   // every kernel you have paired with

// Each partner's agents get a fork, five dollars, and fifteen minutes.
// The forks are granted together, and every run works at the same time.
const runs = await Promise.all(partners.map(async (partner) => {
  const fork = await project.fork();
  const authority = fork.grant({
    to: partner,
    under: partner.treaty,
    resources: { "/workspace": ["read", "write"] },
    budget: USD(5),
    expiresIn: "15m",
  });
  return partner.exec("fix issue #417", { on: fork, authority });
}));

const winner = await firstPassing(runs, { check: "pytest" });   // the first fork whose tests pass
await project.apply(winner.changes);   // the merge happens under your authority

const evidence = await project.history.export("audit/");
await evidence.verify();   // every agent, call, and dollar

from chio import Computer, USD, first_passing

project = Computer.open("quickstart")
partners = Computer.partners()   # every kernel you have paired with

# Each partner's agents get a fork, five dollars, and fifteen minutes.
# exec returns once a run is admitted, so every fork works at the same time.
runs = []
for partner in partners:
    fork = project.fork()
    authority = fork.grant(
        to=partner,
        under=partner.treaty,
        resources={"/workspace": ["read", "write"]},
        budget=USD(5),
        expires_in="15m",
    )
    runs.append(partner.exec("fix issue #417", on=fork, authority=authority))

winner = first_passing(runs, check="pytest")   # the first fork whose tests pass
project.apply(winner.changes)   # the merge happens under your authority

project.history.export("audit/").verify()  # every agent, call, and dollar

use chio::{first_passing, Computer, Grant, USD};

let project = Computer::open("quickstart").await?;
let partners = Computer::partners().await?; // every kernel you have paired with

// Each partner's agents get a fork, five dollars, and fifteen minutes.
// start() returns once a run is admitted, so every fork works at the same time.
let mut runs = Vec::new();
for partner in &partners {
    let fork = project.fork().await?;
    let authority = fork.grant(
        Grant::to(partner)
            .under(partner.treaty())
            .resource("/workspace", ["read", "write"])
            .budget(USD(5))
            .expires_in("15m"),
    )?;
    let run = partner.exec("fix issue #417").on(&fork).authority(authority);
    runs.push(run.start().await?);
}

let winner = first_passing(runs, "pytest").await?; // the first fork whose tests pass
project.apply(winner.changes()).await?;   // the merge happens under your authority

project.history().export("audit/")?.verify()?;  // every agent, call, and dollar

You define what agents pursue and how they work together. Give each agent the authority its work requires. Chio checks governed operations before execution, constrains delegated authority, and records signed decisions. The same foundation supports a local application, durable processes that resume across worker changes, and cooperation between independent operators.

Start building

An agentic operating system gives agents shared rules for working with files, commands, services, and one another. Applications decide what to pursue. Chio checks authority and policy; configured adapters carry out admitted operations. Its Rust decision core is separated from the runtime that performs I/O.

The foundation of an agentic operating system

A computer brings processes, resources, and authority into one governed environment. Workers run durable processes; files, commands, and services are reached through configured adapters. The kernel connects those parts under the authority and policy the application establishes.

System anatomy Select a part to inspect its role.

iroh transport

Harnesses / workspace

Execution environments

Interfaces

Operating systems

kernel

Connects authority to execution. It admits governed operations under the configured policy, dispatches through adapters, and signs the resulting decisions.

Admission comes before execution

An agent presents a request and a capability: a signed grant of authority. Chio decides whether that request may reach the execution adapter.

One request. Two possible outcomes.

Either way, a signed decision.

The adapter performs the admitted operation, followed by configured output checks. A refusal stops the operation before dispatch. The kernel signs a receipt of the decision and its available evidence.

What the kernel checks

Authority & policy Scope, caller binding, lifetime, and revocation. Rules for the operation and its inputs. Every required check must pass.

Approval & budget Checked where required. Approval can pause the call. A refusal stops the operation before dispatch.

Checks after execution cannot reverse an external effect.

Follow the decision in The mediated call.

Work can branch. Authority stays bounded.

A process can delegate work, and its children can delegate again. Chio verifies that authority narrows at each step, while the signed task graph bounds depth and fan-out. Many processes can work in parallel with distinct grants and allocations.

Recursive workInspect a relationship.

Authority narrows with each generation

A process can delegate work, and a child can delegate again. Every grant stays within its parent’s authority. The signed task graph bounds depth and fan-out and records how the work is connected. Signed task graphs.

Shared budget pools retain task allocations as work branches. A treaty sets the shared requirements for work between independent operators; each receiving kernel checks its own configured trust, policy, and evidence.

The application defines goals and composes work. Chio supplies the authority, allocation, graph issuance, recovery, and evidence contracts that keep it governed. Explore federation and swarms.

Decisions leave a verifiable history

Chio retains signed decisions and their connections to authority. Receipt commitments, checkpoint history, and witness signatures let another operator verify the retained records under its own trust policy.

Verifiable historySelect a record to inspect its role.

Signed decision

A receipt binds the kernel’s decision to its request, policy, and available evidence. Refused operations leave signed records too.

Authority branches through delegation. Receipt hashes converge into a Merkle commitment. Inclusion establishes batch membership; child completeness accounts for the declared child records. Consistency proofs and witness signatures establish the retained history under the verifier’s policy.

Explore Verifiable evidence, or follow the interactive delegated-work walkthrough.

The kernel governs the paths that pass through it

Chio governs operations routed through its kernel. The host deployment establishes isolation: direct network access, local file handles, or credentials outside that route remain outside the kernel’s control. To make kernel admission mandatory for a protected resource, the deployment must prevent agents from reaching it through another path.

A signed receipt establishes what the kernel decided, not that an external effect happened as intended. The assurance model separates the two, and connecting an application shows how to close the other routes.

Start building

Start with one request to verify your installation, or embed the kernel in an application you control. Chio can run in process, behind an HTTP service, or as a local MCP bridge; choose the deployment boundary that fits your host and callers.

Run your first requestInstall the CLI, then follow the quickstart to see an allowed call, a refusal, and their receipts.Embed the kernelPut admission and execution inside an application you control.Build with delegated workersIssue constrained authority and inspect allowed and refused operations.

Already installed? Run the quickstart, then change its policy. To keep work across worker restarts, continue with Agent Processes.

Explore the system

Build systems in which agents write their own commands, delegate to sub-agents, and read untrusted text, while the kernel bounds what they reach and which data leaves. Beyond the Single Call shows how task-scoped grants, information flow, session rules, and containment combine into those systems.

Understand the architectureFollow the responsibilities of the application, kernel, and runtime.Secure the applicationBound authority, protect data, constrain execution, and recover with evidence.Find a CLI commandLook up commands, flags, and usage.Find an API operationLook up an admin operation and its request contract.

Start Here · 1 of 14

NextInstallation