# Megastart: your agents, a system built on Chio Inspect this project before choosing integration points. Build a local system that carries a repair mission through research, implementation, independent tests and review, and owner-approved publication. Use https://chio.computer/docs/megastart and its complete source download at https://chio.computer/examples/megastart.zip. The public kernel source is https://github.com/backbay-labs/chio. Use the pinned revision and Cargo.lock in the reference; do not invent APIs or CLI commands. ## Start with the working host Install the downloaded application with `cargo install --locked --features native-agents --path .`, then run `megastart`. The complete paired CLI release also exposes `chio megastart`. Do not assume an older installed CLI includes that command: inspect its help. Use Apple Silicon macOS with the supported sandbox, Node.js 22.19 or newer, npm, Git, and Rust 1.94.1. In the console choose My native agents. Connect Claude Code, Hermes, Codex, or Pi, then use one agent for every role or mix agents. The terminal preparation command is `megastart connect hermes` (or claude / codex / pi). Preparation uses pinned public integrations; reuse their restricted launchers rather than inventing another adapter framework. Hermes installs a private managed Python runtime and independently locked agent and launcher environments. Claude Code uses the existing Claude login; ask the operator to run `claude auth login` locally if needed. The managed host is pinned separately from the personal installation. Hermes, Codex, and Pi use the existing native ChatGPT login. If absent, ask the operator to run `codex login` locally. Never print, copy, or retain credentials in artifacts, prompts, worker environments, or recordings. Do not switch to API billing if authentication or account capacity fails. Preserve native agent identity. Choose the supplied project or a directory containing lib.rs and tests.rs. Native sessions read source and identified handoffs, and write only their own output artifacts through Chio. The trusted host performs compilation and immutable regression tests. Do not fall back to unconfined execution. Keep the deterministic reference as a separate acceptance mode, available with the default feature set. ## Preserve the architecture Retain one mission coordinator, three swarm coordinators, and two workers per swarm. Research produces identified findings and failure evidence. Implementation explores separate candidates. Review independently runs immutable tests and assesses the exact candidate. Dependent stages wait for retained inputs. The host owns credentials, executors, state, and isolation. Chio admits submitted operations under scoped worker authority. Workers share a single persistent 64-invocation allowance for native missions (six for the reference). Restarting must not mint a new budget. The reference uses one-hop grants from the mission authority. Coordinators schedule work; they do not extend the shared-budget delegation chain. ## Build an operator experience Use the mission service for both CLI and browser actions. Keep event identities stable across reconnects. Display real process and operation state; never simulate worker activity. A disconnected console must say it is disconnected. Keep progress, findings, test results, candidate source, review, and approval available without asking the user to read storage files or copy digests between commands. Use `megastart status`, `megastart review`, and `megastart resume` for human operation. Keep `status --json` for automation. Approval must bind to the displayed candidate; changed bytes invalidate its publication decision. Noninteractive approval requires the explicitly inspected candidate digest. ## Demonstrate refusal and recovery Run `megastart exercise` in its separate reference mission. Also qualify the selected native agents on the same requirements; a reference run does not prove that a native host submitted a refused call. Demonstrate: - A native worker attempts a write outside its output grant, receives a signed refusal, and an independent resource check confirms no change. - Shared capacity is consumed across workers; an extra request produces no effect. - A real interrupted handoff resumes by verifying and reusing original receipts and effects, without repeating completed operations. - An unresolved operation stops for reconciliation rather than automatic replay. - Unapproved publication leaves no release; approval publishes the exact candidate. - Generated code cannot read host-only files, inherit credentials, or open network connections; candidate-local output remains possible. Also complete an all-Hermes mission and Hermes-to-Codex-to-Pi handoffs. Retain mission, assignment, native session, bridge request, receipt, and artifact identity. A final agent message alone cannot establish completion: require verified delivery and a matching signed write receipt for the exact artifact. ## Retain inspectable evidence Export with `megastart export`. Verify with the reference verifier and a separately selected trusted public key. The package must exclude private keys, credentials, and the original database. Separate application observations from signed kernel decisions and independent resource checks. Do not claim completeness or trusted identity merely because signatures verify. ## Report the result Report the commands actually run, configured execution mode, mission outcome, source changes and test results, receipt and artifact locations, refusal and recovery results, publication decision, and unresolved failures. Identify any unsupported project layout or platform. Do not report a failed model call, compiler failure, or synthetic reference run as a successful model-driven repair. ## Operate through Herdr Chio is the modern Rust kernel for agentic operating systems. Herdr supplies the operator workspace; Megastart schedules assignments; existing native agents do the work; the host owns isolation and credentials. Keep these responsibilities visible in the architecture and in the actual implementation. Build the included `herdr/` Rust plugin and link its manifest with Herdr. Use its Open Chio mission action to start or attach the private host. Reuse the versioned operator state/events/actions, owner-only descriptor, shared allowance, and exact candidate approval. Never create an independent plugin quota or receipt signer. The current panes observe restricted headless native sessions. Do not label them interactive agent terminals. Qualify PTY input/resize/interruption through the restricted launcher before offering that mode. Never register bare native resume commands or pass Herdr's control socket to workers. Verify opening the same mission in the browser preserves its identity, allowance, receipts, and candidate. Close/reopen the terminal view without stopping the host or issuing replacement authority. On disconnection, disable actions and inspect retained state before retrying any unconfirmed mutation. Demonstrate a real Hermes-to-Codex-to-Pi handoff and clearly identify the separate refusal exercise. Finish with the reviewed candidate, trusted test evidence, exact local publication decision, and independently verified evidence package.