AgentOS

The deciding trait is the approval gate. An agent proposes a change, shadows it, and waits for a person to approve before anything applies, which is a different rhythm from watching a coding agent edit and hoping. If you have ever wanted to read the plan before the machine acts on it, this is that instinct taken seriously.

What you trade away is reach. It is a harness for building governed agents, not something that opens your repository and starts fixing tests today. Pick it when the governance is the point. Pick Aider when the work is the point.

The risk is the effect boundary. There is no ambient I/O by design, so every external action exists as a declared effect with an adapter behind it. That is what makes the forensic story work. It also caps capability at whatever somebody has already written, and the row records no browser and no git operations, which are two of the things a coding agent spends most of its day doing.

What it does right is refusing to pretend otherwise. The absence is stated as a design position rather than discovered on week three.

1. Determinism is the architecture rather than a feature of it. A single-threaded kernel that reconstructs a world from its event log gives forensic reproducibility, which is rare here, and also explains why concurrency is absent. 2. The typed control plane covers schemas, modules, routing, secrets and manifests as declared artefacts, so the shape of a system is inspectable instead of emergent.

2. No evaluation accompanies any of this, and none is required, since nothing asserts a capability number. The reproducibility claim is the one a reader should test first, because every other property rests on it.

Infrastructure with no business attached to it. Two hundred stars is early interest rather than traction, there is no paid edition and no console, and nobody can churn from something they were never billed for. The asset, if one appears, is the governance model, and governance models get copied faster than they get bought.

Moat: none yet. Likely acquirer: a compliance-minded platform vendor who wants the receipt idea and hires the author to get it. Likely path: quiet single-maintainer upkeep. Position: watch it, do not build a company on it.

The receipt trail is the part my auditors would like: each external action returns a signed record, which is more evidence than most suppliers on this board produce voluntarily. That is also where the enterprise story ends. No administrative console, no single sign-on, no directory sync, so identity stays with whoever holds the laptop.

It does not execute unattended, so it never becomes a pipeline step I can measure or gate a release on. Onboarding means teaching an engineer a control plane rather than a command. Not yet.

The licence is honest and a fork stays viable, so the ownership floor is high and the Rust source is mine to compile. Past that it gets frustrating. I cannot attach a server I already run, so every tool I want becomes an adapter I write myself. And local weights are not supported, which for a project built on total reproducibility is a strange omission, since my own hardware is the most reproducible part of the setup.

Still readable, still permissive. Grudging respect for the discipline, and a wish list two items long.