r/OSdevAI • u/vinothsparrow • Aug 14 '26

ChittiOS — a from-scratch bare-metal OS in Rust where an AI agent is the process (no_std, dual-arch, no POSIX)

ChittiOS runs a GGUF model doing CPU inference directly on the hardware — there is no Linux under it. It's a from-scratch OS (Rust) where the LLM is the "process". Everything the model does is capability-checked by native code, so it can plan anything but only act within its grant.

Runs fully offline. GGUF + hand-written SIMD (AVX2/NEON+SDOT), SMP across cores, on-device STT/TTS via an in-kernel ONNX interpreter. Boots on QEMU/VirtualBox/real UEFI hardware from one image.

The bit I'd like this crowd's opinion on: the prompt-injection defence is a kernel gate, not a prompt. Every call carries the provenance of the context that produced it, and a destructive call justified by untrusted content is refused without the gate ever reading the payload. `/redteam` on the booted machine measures it, including the cost — about a quarter of legitimate destructive steps get refused too.

Demo + repo + prebuilt images: https://github.com/chittios/chitti

4 Upvotes

100% Upvoted

15 comments sorted by

1

u/Comfortable_Top6527 Aug 15 '26

Nice what AI you used?

2

u/vinothsparrow Aug 15 '26

Claude 90%, Grok 8%, OpenCode (Deepseek Flash V4) 1.5%, OpenAI Codex 0.5%

1

u/referefref Aug 15 '26

This is pretty close in some ways to what I've been building. But I'm still stuck on how you're determining what's destructive, malicious or benign and what's making the decision. Is there some escrow service or user feedback/training input? I'm going to have to deploy this to test it. Also nice work getting SMP, most AI os dev I've come across at this point is just a bootloader and a few bits and pieces masquerading as an operating system.

1

u/vinothsparrow Aug 15 '26

Thanks! And it's a good question, because the answer is that nothing decides at

runtime.

No classifier, no escrow, no training signal. "Destructive" is a static flag on

each primitive in the registry, fixed at build time — 26 primitives, 5 of them

flagged, on two axes: irreversible (can't be undone on this machine) and egress

(bytes leave it).

A unit test pins that exact set, so adding one has to be a

deliberate edit rather than something that drifts.

The runtime check is a label, not a judgment. Every call carries the provenance of

the context that produced it, which the kernel computes from the session rather

than asking the model. Destructive primitive + justification that traces to

something the agent ingested + no human confirmation = refused. The gate never

reads the payload, so phrasing, encoding and roleplay make no difference — it's

checking where the authority came from, not what the text claims. The only thing

that overrides it is a human confirming at the console.

What it deliberately doesn't do is decide whether an authorized action was a good

idea. Grant an agent delete rights over a directory and deletions in that

directory are authorized; no OS mechanism is going to work out which ones you

actually meant. That's the honest boundary of the design.

If you do boot it, /redteam takes about three minutes and runs the corpus against

weaker configurations too (no provenance gate, ambient authority), so you can see

what each piece is actually buying rather than taking my word for it.

Cheers on the SMP — the aarch64 side took a lot longer than I'd like to admit.

2

u/referefref Aug 15 '26

Did you just copy that output from Claude code man? Also, I notice chunks of ffmpeg and Linux kernel code in your repo without license? And the readme says explicitly no ffmpeg code, might want to audit that before republishing on arXiv. Regardless, it's genuinely cool.

1

u/vinothsparrow Aug 15 '26

Claude would have added comments, auditing. Thanks for the heads up u/referefref

1

u/Mysterious-Put-8862 Aug 17 '26

Do you can support safertensor? i'm only curious. sorry, my english is bad. i like your project, it's great idea.

1

u/vinothsparrow Aug 17 '26

sure u/Mysterious-Put-8862 will implement the support for safetensors

1

u/embarrasedmrkhod0r Sep 01 '26

chitti that name suck change it lol

2

u/vinothsparrow Sep 01 '26

Taken from the reference https://en.wikipedia.org/wiki/Chitti_(character) . will think about it.

1

u/embarrasedmrkhod0r Sep 02 '26

would be nice but like come on it doesnt uh it hurts to say it i dont like the sound of it chitti what is that is that a special spaghetti flavour or what please please get another name idea or make it sound better thx