Nexus OS

The Governed Agentic AI Operating System

Local-first. Air-gappable. Post-quantum ready. Built in Rust.

Architecture | Quick Start | Features | Audit Status | Docs

Nexus OS is an AI agent operating system where agents are first-class citizens with cryptographic identities, governed autonomy, and the ability to evolve. It runs entirely on your hardware — no cloud dependency, no data leaving your machine, air-gappable. Every action is hash-chained, every decision auditable, every agent sandboxed.

┌──────────────────────────────────────────────────────────────────────┐
│                        Nexus OS v10.6.0                              │
│                                                                      │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐            │
│  │ Coder    │  │ Research │  │ Security │  │ DevOps   │  ...55     │
│  │ Agent    │  │ Agent    │  │ Agent    │  │ Agent    │  agents    │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬─────┘            │
│       │              │              │              │                  │
│  ┌────▼──────────────▼──────────────▼──────────────▼─────┐           │
│  │              Nexus Conductor (Orchestration)           │           │
│  │       A2A Protocol  ·  MCP Protocol  ·  Swarm          │           │
│  └───────────────────────┬────────────────────────────────┘           │
│                          │                                            │
│  ┌───────────────────────▼────────────────────────────────┐           │
│  │                   Governance Kernel                     │           │
│  │  Capability ACL · HITL Gates · Fuel Metering            │           │
│  │  OWASP 10/10 · Ed25519 Consent · PII Redaction          │           │
│  │  Hash-Chain Audit · WASM Sandbox · Cedar Policies        │           │
│  └───────────────────────┬────────────────────────────────┘           │
│                          │                                            │
│  ┌───────────────────────▼────────────────────────────────┐           │
│  │                    LLM Providers (15)                    │           │
│  │  Ollama · OpenAI · Claude · Gemini · Groq · DeepSeek    │           │
│  │  NVIDIA NIM · OpenRouter · Mistral · Cohere · Fireworks  │           │
│  │  Together · Perplexity · Flash (llama.cpp) · + Mock      │           │
│  └────────────────────────────────────────────────────────┘           │
│                                                                      │
│  Rust Kernel (326K LOC) · Tauri 2.0 Shell · React/TS Frontend (65K)  │
└──────────────────────────────────────────────────────────────────────┘

Why Nexus OS?

Features

Governance and Security

OWASP Agentic Top 10 — All 10 defenses implemented and tested (62 dedicated tests)
Ed25519 consent signing — Tier2+ approvals are cryptographically non-repudiable
Post-quantum ready — Ed25519 + X25519 with ML-DSA/ML-KEM roadmap (nexus-crypto)
Prompt firewall — 20 injection patterns, PII redaction, output filtering
Cedar-inspired policies — Declarative capability rules with formal evaluation
HITL consent gates — 4 tiers (Tier0-3) with configurable approval counts
Hash-chained audit — Tamper-evident, append-only, cryptographically verifiable
Checkpoint-rollback — 3-level recovery: memory, execution, side-effect compensation

Agent Intelligence

Cognitive loop — Perceive, reason, plan, act, reflect, learn cycle
Darwin Core — Adversarial arena, swarm coordination, evolutionary strategies
Capability measurement — 4-vector scoring with gaming detection
Predictive routing — Model selection optimized for latency, cost, and task complexity
Memory subsystem — 4 types (working, episodic, semantic, procedural) with SQLite, GC, rollback, ACL
55 prebuilt agents across 7 autonomy levels (L0-L6)

Protocols and Integration

MCP — JSON-RPC 2.0 client with subprocess tool discovery
A2A — Agent-to-agent discovery, task delegation, status tracking
OpenAI-compatible REST API — Chat completions, tool calls, SSE streaming
Messaging adapters — Slack, Discord, Matrix, Telegram, WhatsApp, Webhook
Migration tool — Import from CrewAI and LangGraph

Infrastructure

Token economy — Wallets, fuel metering, delegation contracts, tier gating
Software factory — Project creation, build pipeline, quality gates
Marketplace — Ed25519 signed packages with verification pipeline
World simulation — Virtual filesystem sandbox with dry-run and risk assessment
Collaboration protocol — Multi-agent sessions with voting and consensus

Governed Self-Improvement

5-stage pipeline — Observer, Analyzer, Proposer, Validator, Applier
10 hard invariants — Governance kernel immutable, HITL Tier3 required, audit chain integrity
DSPy/OPRO prompt optimizer — Variant generation, safety keyword enforcement, cosine similarity scoring
Config optimizer — 8 tunable parameters with bounded step-size adjustments
Policy optimizer — Cedar policy refinement (can only narrow, never broaden)
Behavioral envelope — Drift Bounds Theorem (D* = alpha/gamma) bounds agent drift
Simplex guardian — Verified-safe baseline with barrier certificate switching
182 tests + 7,424 property-generated cases

Desktop and Local-First

Flash inference — llama.cpp via FFI, GGUF loading, speculative decoding
15 LLM providers — All with real HTTP calls, automatic failover
Voice pipeline — Push-to-talk, Whisper transcription, Web Speech API
Browser automation — Playwright integration with URL allowlist and financial blocking
Computer control — Screen capture, input execution, governance-gated at L4+
86 frontend pages — Full management UI for every subsystem

Flash Inference — Run Any Open-Source Model Locally

Built-in local inference via llama.cpp, supporting 60+ model architectures through GGUF format. Run Qwen, DeepSeek, Llama, Mistral, Gemma, Phi, and more — all governed with the same security pipeline as cloud providers.

397B model verified running in 32 GB systemd memory cage via mmap SSD streaming. No GPU required.

Every inference call passes through: capability check, fuel reserve, adversarial arena, PII redaction, output firewall, hash-chained audit trail.

Quick Start

Prerequisites

OS: Linux (Ubuntu 22.04+), macOS, or Windows 10+
Rust: 1.75+ (curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh)
Node.js: 18+ (nvm install 18)
Ollama (optional): curl -fsSL https://ollama.ai/install.sh | sh

Build and Run

git clone https://gitlab.com/nexaiceo/nexus-os.git
cd nexus-os

# Build workspace
cargo build --workspace

# Build frontend
cd app && npm ci && npm run build && cd ..

# Run in development mode
cd app && npm run tauri dev

Server Deployment (Docker)

# One-command start — serves UI + API on port 8080
docker compose up -d

# With local LLM inference via Ollama
docker compose --profile with-ollama up -d

# Verify
curl http://localhost:8080/health

See docs/DEPLOYMENT.md for Kubernetes/Helm, air-gapped, and HA deployment.

Post-Audit Status

Independent audit completed 2026-03-31. Every metric verified by inspecting source code.

Tauri Commands .... 675     Agents ............ 55
Rust Crates ....... 66      Frontend Pages .... 86
Rust Tests ........ 4,877   Frontend Tests .... 352
LLM Providers ..... 15      OWASP Score ....... 10/10
Production TODOs .. 0       Production Stubs .. 0

Security and Governance

OWASP Agentic Top 10 — Complete Coverage

Capability-Based Access Control

Agent: coder-agent (L3)
Capabilities:
  file.read(scope: /workspace/*), file.write(scope: /workspace/*)
  llm.query(provider: ollama, model: codestral)
Denied:
  network.external, file.write(scope: /system/*), process.execute(elevated: true)
Fuel: 10,000 units/session
HITL: Required for file.delete, process.execute

Project Structure

nexus-os/
├── kernel/          110K lines — governance, cognitive loop, actuators, audit
├── app/src-tauri/     34K lines — 675 Tauri commands across 19 domain modules
├── app/src/           65K lines — 86 React pages, 352 tests
├── connectors/        23K lines — LLM (15 providers), messaging (6 channels), web, social
├── crates/            55K lines — memory, crypto, self-improve, A2A, MCP, simulation, ...
├── agents/            19K lines — 10 agent crates + 55 prebuilt manifests
├── sdk/               10K lines — agent-facing API wrapping kernel
├── distributed/        9K lines — P2P, ghost protocol, mesh
├── protocols/          8K lines — HTTP gateway, OpenAI-compat API, MCP client
├── marketplace/        5K lines — Ed25519 signing, SQLite registry
├── enterprise/         7K lines — auth, tenancy, integrations, metering, telemetry
└── cli/                6K lines — CLI tools, packager

Data sovereignty	Send everything to the cloud	100% local-first, air-gappable
Agent safety	Trust the agent, hope for the best	WASM sandbox, capability ACL, fuel limits
Agent identity	Anonymous function calls	Ed25519 cryptographic identity per agent
Audit trail	Logs (deletable, mutable)	Hash-chained audit trail (tamper-evident)
Human oversight	Optional, bolted on	HITL consent gates built into kernel
Agent evolution	Static prompts forever	Darwinian evolution: agents mutate, compete, improve
Compliance	"We're working on it"	EU AI Act conformity, OWASP Agentic 10/10
Performance	Python + Electron	Rust kernel + Tauri 2.0 (5MB binary vs 100MB+)
Vendor lock-in	Pick one cloud provider	15 LLM providers, 200+ models, swap freely or go offline
Security standard	Ad-hoc	OWASP Agentic Top 10 — all 10 defenses with 62 tests

Gemma 2 2B	2B	Dense	—	9.93
Qwen3.5-35B-A3B	35B (3B active)	MoE	—	8.36
Qwen3.5-397B-A17B	397B (17B active)	MoE	32 GB	0.26

Feature completeness	10/10	23 features, all real implementations, 0 stubs
Rust test coverage	10/10	4,877 tests, 0 failures, every crate tested
Frontend test coverage	9/10	352 tests, 86/86 pages (100% coverage)
Build health	10/10	fmt clean, clippy clean, 0 compile warnings
Error handling	9/10	0 production unwrap/expect in kernel + Tauri
Code organization	9/10	31K monolith split into 18 domain modules
Command wiring	10/10	0 phantom commands, 0 unwired frontends
Security posture	10/10	OWASP 10/10, Ed25519 signing, unsafe_code = forbid
Overall	9.5/10

1	Goal Hijacking	GoalIntegrityGuard — SHA-256 hash + drift detection	7
2	Tool Poisoning	ToolPoisoningGuard — output scan + rate limit + audit	5
3	Privilege Escalation	PrivilegeEscalationGuard — L4+ hard-gate	5
4	Delegated Trust	DelegationNarrowing — capability subset enforcement	5
5	Injection Cascade	CascadeGuard — inter-agent scan + chain depth	5
6	Memory Poisoning	MemoryWriteValidator — sanitize + rate limit	8
7	Supply Chain	RuntimePackageVerifier — Ed25519 load-time verification	7
8	Cascading Failures	CircuitBreakerManager — Closed/Open/HalfOpen	5
9	Insecure Logging	SecureLogger — PII/credential redaction + hash chain	5
10	Insufficient Monitoring	AnomalyMonitor — spike detection + auto-suspend	5

Architecture	System design, component diagrams, data flow
Security Policy	Vulnerability reporting, security model
SOC 2 Type II Controls	43 controls mapped with code references and test evidence
NIST 800-53 Mapping	73 controls across 15 families with implementation details
EU AI Act Conformity	Article-by-article compliance mapping
Singapore AI Governance	IMDA Model Framework and PDPA alignment
Threat Model	Adversarial threat analysis
Privacy Design	Privacy-by-design principles
Changelog	Version history and release notes
Self-Improvement	Governed self-improvement pipeline, 10 hard invariants
Deployment Guide	Docker, Kubernetes/Helm, air-gapped installation
Contributing	How to contribute

Most Popular

nexus-os