The Astrid Runtime
An OS-grade security boundary for composable AI agents, delivering capability-secure execution and auditability.
Evidence shows: README details capability security model including least privilege (no ambient authority, capability tokens, manifest gates), user confirmation (approval gate, local egress consent), data flow transparency (audit chain), sensitive data handling (secret store, per-principal isolation), dependency security (pinned versions, Sigstore, CodeQL), external effects (sandbox, OS sandbox), rollback (live capsule lifecycle), source attribution (signed releases, BLAKE3 manifest). Deductions: user confirmation and sensitive data handling are described but not implementation details; dependency security has pinned versions but no vulnerability scanning evidence; external effects and rollback are described but no test evidence.
Evidence shows: README and Cargo.toml are consistent, version numbers match, dependencies have pinned versions and rationale. Deductions: no specific failure message examples, dependency availability not tested.
Evidence shows: README describes multiple usage scenarios (CLI, headless, gateway, Discord), capability boundaries clear (capsule manifest, IPC ACL), trigger precision (tool convention), environment fit (multi-platform, WASM). Deductions: trigger precision and environment fit are described but no concrete configuration examples.
Evidence shows: README well-structured, install notes detailed, naming consistent, examples present, license clear, versioning and changelog exist, maintenance responsibility clear (contributing guide, RFC process). Deductions: known limitations not explicitly listed, changelog not detailed.
Evidence shows: output usability (CLI output, headless mode), marginal value (capability security model), cost benefit (easy install, good docs). Deductions: no performance or resource consumption data.
Evidence shows: README claims have documentation and code references, cross-source consistency (README, Cargo.toml, SECURITY.md), facts and inferences separated (described as design not verified). Deductions: no test results or independent verification.
- Publisher identity is unverified; treat as unknown, do not trust based on brand.
- Security claims (e.g., sandbox, audit chain) lack test evidence; need independent verification.
- Dependencies are pinned but no vulnerability scanning evidence; check dependency security.
- Known limitations not explicitly listed; consult docs or code.
What does this agent do, and when should you use it?
Astrid is a portable, capability-secure operating system for composable software, built in Rust to give AI agents an OS-level trust boundary. Its kernel (astrid-daemon) is deliberately small and dumb: it routes events, enforces capabilities, runs the sandbox, and records audit; it holds no model, tool schema, or business logic. Every capability is a sealed WebAssembly capsule, and each capsule imports exactly what its manifest allows via a WIT-typed ABI (astrid:* packages) with capability-checked host calls. The runtime communicates with frontends (CLI, HTTP gateway, Discord) over a Unix domain socket using IPC events, and supports live capsule lifecycle (install, upgrade, remove) without restart. The security model is decomposed into independent, fail-closed layers: WASM sandbox, manifest gate, IPC ACL, capability tokens, approval gate, OS sandbox (bwrap on Linux, seatbelt on macOS), and signed hash-linked audit chain. Astrid ships four binaries: CLI, daemon, build tool, and emitter.
Astrid provides tooling to create, deploy, and manage AI agents and their capabilities. The CLI (astrid) connects to the daemon and manages sessions (astrid chat, -p for single prompts), configures principals (agent create/modify), inspects granted capabilities (caps show), and handles capsule lifecycle (capsule new/build/install/update/remove). Capsules are WASM components compiled to wasm32-unknown-unknown; the SDK helps developers build them with a proc macro (#[astrid::tool]). The daemon enforces capability-based access, routes IPC events by subject via an ACL, and executes sandboxed host calls. Frontends send IPC events over a Unix socket; the HTTP gateway offers thread-based conversation management. Astrid also provides LLM provider binding for model discovery (astrid models, doctor), headless mode for scripting (-p --yes), and per-principal isolation (agent create with separate KV/secrets/home).
- Security-conscious engineers who need to run AI agents with least privilege, per-identity isolation, and auditability.
- Developers building custom tools or workflows can author WASM capsules with declarative manifests and safely compose them via capability-checked calls.
- Platform teams seeking a model-agnostic agent runtime to avoid vendor lock-in and deploy across multiple providers.
- Organizations with strict compliance requirements can rely on the signed, hash-linked audit chain and per-principal isolation.
- Users who want to automate agent workflows in CI/CD can use headless mode (e.g., -p with auto-approve) and scriptable installation.
What are this agent's strengths and limitations?
- OS-grade security boundary: every capability is an explicit grant, and the sandbox blocks unvetted syscalls.
- Model-agnostic: the kernel holds no LLM, so any provider can be used.
- Live lifecycle: capsules can be installed, upgraded, and removed without restarting the daemon.
- Per-principal isolation: separate secrets, KV, quotas, and audit chains per identity, fail-closed.
- Auditable: tamper-evident signed audit chain.
- Requires a recent Rust toolchain (1.95+) and a learning curve for the WASM component model.
- Demo-ware distro required; no model or agent loop is bundled by default.
- Only Linux and macOS are supported; Windows is not mentioned.
- Complexity: implementing your own capabilities and IPC may be heavier than simple frameworks.
- Documentation refers to an external book for some details, and some features are versioned (0.9).
How do you install or deploy this agent?
Requires Rust 1.95+. Use Homebrew: brew tap astrid-runtime/tap && brew install astrid. Or via cargo: cargo install astrid. From source: git clone https://github.com/astrid-runtime/astrid && cd astrid && cargo build --release. Then initialize a distro: astrid init --distro @yourorg/your-distro.
How do you use this agent?
Start the daemon with astrid start, then begin an interactive session: astrid chat. Run a single prompt headlessly: astrid -p "summarize the git log". Create a capsule with astrid capsule new my-capsule, build it with astrid capsule build, and install with astrid capsule install . Manage principals: astrid agent create ci-bot. Check status: astrid status, astrid doctor.