Build an application
Grow the Quickstart's project into agents that work on your code and a service other agents call under your grants.
On this page
An application on Chio is the Quickstart loop with a product around it. Open, fork, grant, run, stream events, read receipts, apply the diff: each step is one call the kernel admits, and each guide in Build teaches one of them in a setting you would ship.
The setting is Larkfield's pricing project. Larkfield's own agents work on its repository; Basalt's buying agent calls the same code as the pricing service; Halden, a contract engineering firm, works on both from across an operator boundary. Every page continues from the Quickstart's project, operator key, and fixer.
Open
Quickstart loop
Computer.open opens your project as a computer: a versioned environment where authority, resources, and work live.
Read more in Quickstart.
Every project begins as one command
Computer.open opens a project as a computer, a versioned environment where authority, resources, and work live, and project.fork() branches its resource state, never its authority or external effects. A project to open starts with chio new; each published example is the pricing project in another shape:
chio new --list-examplespricing-service Python, TypeScript, Rust the pricing service over HTTP and MCP pricing-tools Rust quote and refund as native tools pricing-api Python, Rust a plain HTTP API behind the sidecar pricing-rust Rust axum with the kernel linked in pricing-python Python FastAPI and Django middleware pricing-node TypeScript Express, Fastify, and Elysia pricing-go-cpp Go, C++ chi and Drogon pricing-jvm-dotnet Kotlin, C# Spring Boot and ASP.NET Core pricing-desk Rust, Python approvals, two tenants, metered repricing megastart Rust pricing-rs with issues #412 to #414
chio new pricing-desk --example pricing-desk fetches one, checks its digest against the signed index, and unpacks it. Builder Setup pins the CLI and SDK versions, The Computer and the Kernel maps the Quickstart's calls onto the kernel objects these projects configure, and Choose an Agent Integration picks between an MCP bridge, a native process, and a framework adapter by who owns recovery.
Read more in the Examples Overview.
The kernel sits where your agent or service already makes its calls
An existing agent keeps its framework and gains admission on the path it already uses. An existing service keeps its handlers, and the kernel decides each request before they run.
- Connect a Coding Agent puts Claude Code's file tools behind the kernel; Connect Hermes does the same for Hermes.
- Wrap an MCP Server, Migrate from MCP, and Wrap an ACP Server govern the protocols agents speak.
- Govern OpenAI Tool Calls and Govern Any Provider admit each function call a model proposes.
- Bridge Protocols and Bridge OpenAPI to MCP carry one caller's authority across A2A, ACP, MCP, and HTTP.
- Protect an API, Add API Middleware, and HTTP Framework Middleware put the pricing API behind a sidecar or framework adapter.
- Native Tool Server and Build Systems in Rust expose your own Rust functions to agents.
- Proxy AG-UI Events and Browser Kernel check what reaches a user interface and what a browser page may call.
To run the governed service in a managed container platform, deploy it with the sidecar on Cloud Run, ECS Fargate, or Azure Container Apps.
Orchestrators get the same admission per unit of work: OpenAI Agents SDK, Claude Agent SDK, LangGraph, model-call recovery, Temporal, Prefect, Kafka, AWS Lambda, Bedrock through AWS Marketplace, the A2A adapter, and Envoy ext_authz. Payments attach through on-chain settlement, Chainlink oracles, and x402.
A grant decides what each agent holds, and policy decides what no grant can override
fork.grant gives an agent resources and rights, a delegation depth and fan-out, a budget, and an expiry; in the Quickstart the fixer held the workspace and USD 2.00 for twenty minutes. These guides vary that grant: narrower rules for every agent, slices handed to other agents, identities bound to workloads and partners, and budgets that stop spend before dispatch.
- Policy. Inherit and merge policies from a baseline, call an external guard, release a custom WASM guard, govern database queries on the
ordersserver, and see diagnostics in your editor. - Identity. Delegate between agents and trace the delegated work, weigh an agent passport, issue passkey capabilities, rotate keys and revoke, bind a workload identity, and bootstrap federated trust with Halden.
- Economics. Put budgets on grants, follow a tool price to its receipt, underwrite credit, settle a charge on a rail, export billing records, and run a cognition market.
Read more in Write a Policy.
Every run ends in an outcome the application can act on and a record someone else can check
fixer.run starts the work under the grant, and run.events() streams each admitted, refused, and pending operation as it happens. A run can finish, wait for Mara Okafor's approval, be refused, lose its reply, or outlive its worker; the process keeps its identity and checkpoints through a restart.
- Run a Governed Coding Task and Governed Rust Coding repair a bug from one commit and hand over a patch the recipient verifies.
- Require Human Approval gives Mara the final word on a deep discount; Ordered Tool Workflow fixes the order of read, quote, and publish.
- Handle Tool Outcomes says, after every outcome, whether retrying is safe; Share a Worker Budget runs three workers against one USD 2.00 grant.
- Tenant-Scoped Service separates Harbor Goods and Ostrander; Rust Resource Service accepts a report only from its assigned caller.
- Restore an MCP Session keeps a client on its saved session across an edge restart, and Agent Processes keep a task's identity and checkpoints when its worker is replaced.
project.history.receipts reads the signed record of each decision, refusals included, and describe() explains a refusal. fork.diff() reads the agent's changes, and project.apply publishes them only while main still equals the fork's base; a moved base is a conflict, and nothing changes.
Verify receipts offline against a key you chose, export evidence for Corbel Assurance, audit the pricing tools for their two refusals, and query receipts from the SDKs for a dashboard. Before a change ships, test guards and policies at each layer, and trace a call from its OpenTelemetry span to its receipt.
Complete projects run the whole loop at once
Start small with pricing as native tools or pricing over MCP, then the same service in Node, Python, JVM and .NET, and Go and C++. Agent frameworks connect through LangChain and provider SDKs and CrewAI, AutoGen, and LlamaIndex; protocols through A2A, ACP, the OpenAPI sidecar, and one policy across providers.
Larger systems compose many mechanisms: an agent commerce network, an incident network across three hosts, a web3 network, plus trust control, receipt verification, Istio ext_authz, custom guards, and the playground AI players.
Agentic OS builds whole operating systems for agents on one kernel: a mission host, a software factory, a research swarm, federated incident response, a personal agent network, a shared worker fleet, a knowledge network, an agent cooperative, a cognition marketplace, and the operations that keep them running.