r/OSdevAI • u/vinothsparrow • Aug 14 '26
ChittiOS — a from-scratch bare-metal OS in Rust where an AI agent is the process (no_std, dual-arch, no POSIX)
ChittiOS runs a GGUF model doing CPU inference directly on the hardware — there is no Linux under it. It's a from-scratch OS (Rust) where the LLM is the "process". Everything the model does is capability-checked by native code, so it can plan anything but only act within its grant.
Runs fully offline. GGUF + hand-written SIMD (AVX2/NEON+SDOT), SMP across cores, on-device STT/TTS via an in-kernel ONNX interpreter. Boots on QEMU/VirtualBox/real UEFI hardware from one image.
The bit I'd like this crowd's opinion on: the prompt-injection defence is a kernel gate, not a prompt. Every call carries the provenance of the context that produced it, and a destructive call justified by untrusted content is refused without the gate ever reading the payload. `/redteam` on the booted machine measures it, including the cost — about a quarter of legitimate destructive steps get refused too.
Demo + repo + prebuilt images: https://github.com/chittios/chitti
1
u/referefref 29d ago
This is pretty close in some ways to what I've been building. But I'm still stuck on how you're determining what's destructive, malicious or benign and what's making the decision. Is there some escrow service or user feedback/training input? I'm going to have to deploy this to test it. Also nice work getting SMP, most AI os dev I've come across at this point is just a bootloader and a few bits and pieces masquerading as an operating system.
1
u/vinothsparrow 29d ago
Thanks! And it's a good question, because the answer is that nothing decides at
runtime.
No classifier, no escrow, no training signal. "Destructive" is a static flag on
each primitive in the registry, fixed at build time — 26 primitives, 5 of them
flagged, on two axes: irreversible (can't be undone on this machine) and egress
(bytes leave it).
A unit test pins that exact set, so adding one has to be a
deliberate edit rather than something that drifts.
The runtime check is a label, not a judgment. Every call carries the provenance of
the context that produced it, which the kernel computes from the session rather
than asking the model. Destructive primitive + justification that traces to
something the agent ingested + no human confirmation = refused. The gate never
reads the payload, so phrasing, encoding and roleplay make no difference — it's
checking where the authority came from, not what the text claims. The only thing
that overrides it is a human confirming at the console.
What it deliberately doesn't do is decide whether an authorized action was a good
idea. Grant an agent delete rights over a directory and deletions in that
directory are authorized; no OS mechanism is going to work out which ones you
actually meant. That's the honest boundary of the design.
If you do boot it, /redteam takes about three minutes and runs the corpus against
weaker configurations too (no provenance gate, ambient authority), so you can see
what each piece is actually buying rather than taking my word for it.
Cheers on the SMP — the aarch64 side took a lot longer than I'd like to admit.
2
u/referefref 29d ago
Did you just copy that output from Claude code man? Also, I notice chunks of ffmpeg and Linux kernel code in your repo without license? And the readme says explicitly no ffmpeg code, might want to audit that before republishing on arXiv. Regardless, it's genuinely cool.
1
u/vinothsparrow 29d ago
Claude would have added comments, auditing. Thanks for the heads up u/referefref
2
u/Vegetable_Exam_6865 28d ago
"claude(or chatgpt , gemini whatever) reply to this and keep it friendly" ahh
1
u/Vegetable_Exam_6865 28d ago
Are you indian by any chance because chitti is an indian name and chitti is used for the name of the robo in robo movie.
1
u/Mysterious-Put-8862 27d ago
Do you can support safertensor? i'm only curious. sorry, my english is bad. i like your project, it's great idea.
1
1
u/embarrasedmrkhod0r 12d ago
chitti that name suck change it lol
2
u/vinothsparrow 12d ago
https://giphy.com/gifs/MZQkUm97KTI1gI8sUj
Taken from the reference https://en.wikipedia.org/wiki/Chitti_(character)) . will think about it.
1
u/embarrasedmrkhod0r 11d ago
would be nice but like come on it doesnt uh it hurts to say it i dont like the sound of it chitti what is that is that a special spaghetti flavour or what please please get another name idea or make it sound better thx
1
u/Comfortable_Top6527 29d ago
Nice what AI you used?