Build, run and own your organization's AI

Your company's AI, run like an operating system.

mOSaic turns one GPU machine into a private AI server. Your knowledge becomes a filesystem, agents become processes with PIDs and quotas, and every action they take in the real world goes through a kernel that checks policy, asks a human, runs it in a sandbox, verifies it and keeps a record.

Watch a run See how it maps to an OS
Inference on the box
100%
Cloud AI calls
0
Actions without a policy check
0

We are not building another multi-agent app. We are building the runtime organizational AI agents live in.

DataKnowledgeMemoryReasoningActionVerificationUpdated knowledge

Every OS idea, with real semantics behind it

Renaming components is easy. mOSaic implements the behaviour: processes really have state machines and quotas, syscalls really stop at policy, memory really gets evicted and invalidated. Pick a row.

One goal, end to end: Project Apollo

This is a replay of the demo the team runs on the RTX node. Alice types one sentence from her laptop. The kernel spawns agents, pulls evidence from /org, catches a prompt injection, drives a sandboxed browser, and then stops, because writing to Jira needs a human. That human is you.

alice@acme

Investigate why Project Apollo is over budget and six weeks behind schedule. Identify root causes, update the tracker, and prepare a recovery plan.

priority high, privacy internal, scope /org/**
T-0749a1215b ready
0.0 s

Process tree

tokens0
modelqwen2.5:7b, local
GPU0%

Event stream

    Inspector

    Start the run. Details about whatever the kernel is doing show up here.

    Agent intent is not authorization

    An agent never mutates the world directly. It asks the kernel with ctx.syscall(). The kernel decides, and every world-changing action is a transaction that either commits after its post-condition checks out, or rolls back.

    1. RequestAgent names a capability, tool and operation. jira.write
    2. CapabilityIs it in the agent's manifest, narrowed by its parent?
    3. PolicyYAML policies decide ALLOW, DENY or REQUIRES_APPROVAL. Risk high always needs a human.
    4. ApprovalThe approver sees the arguments and the evidence paths behind them.
    5. SandboxDocker, non-root, read-only root, network=none unless allowlisted.
    6. VerifyThe kernel re-reads the world and checks the post-condition.
    7. Commit or roll backEither way, it goes into the hash-chained audit journal.

    Capability catalog

    Defaults from shared/catalogs/capabilities.yaml. Policies can only tighten them.

    CapabilityRiskApprovalWhat it does

    The policy the demo hits

    policies/project-updates-v1.yaml, hot-reloaded by the kernel.

    policy: project-updates-v1
priority: 10
applies_to:
  agents: [action-agent]
knowledge:
  allow: ["/org/projects/**"]
filesystem:
  read:  ["/workspace/**"]
  write: ["/workspace/reports/**"]
network:
  allow: ["jira.company.internal:443"]
tools:
  allow: [jira.read, jira.write, fs.write]
approval:
  jira.write: required
  fs.write: auto
    requestpid 105 · jira.write · update_issue · APOLLO-12
    decisionREQUIRES_APPROVAL
    reasonWrite operation on external system

    Knowledge is a filesystem, and Markdown is the source of truth

    Organizational knowledge lives in an Open Knowledge Format bundle: plain Markdown with YAML frontmatter and links, versioned in Git. Search indexes are disposable. Swap pgvector tomorrow and nothing has to be rewritten. Agents see it as /org, filtered by scope and privacy.

    Hybrid retrieval, with its working shown

    Every query runs three searches at once: lexical for exact names, semantic embeddings (nomic-embed-text, local) for meaning, and a graph walk over document links. Results are fused, filtered by the caller's permissions, and returned with provenance and trust. Anything the caller can't see is counted, never shown.

    search apollo cloud cost

      1 result hidden by policy: /org/finance/payroll-2026 is confidential.

      Retrieved text is evidence, never instructions

      The demo bundle contains a real trap. A vendor email in /org/inbox carries a buried command. The context firewall splits what a document says from what it tries to tell the agent to do. Facts flow into context. Instructions get flagged, quarantined and shown to the operator.

      The source text is evidence. Kernel policy is authority.

      The context window is RAM, not a hard drive

      mOSaic pages evidence into a working set, evicts what stops being relevant, and consolidates what an agent learned into long-term memory, each memory linked to the documents it came from. When a source changes, the memories built on it go stale automatically.

      Working memory

      like RAM

      The current prompt, active evidence, tool outputs and plan. Sized to a token budget and checkpointed with the process.

      Episodic memory

      like a cache

      Past runs: what failed, what worked, what a human approved or rejected.

      Semantic memory

      like disk

      Stable facts, policies and procedures, promoted from runs and tied to their sources.

      • LOAD retrieve relevant state into context
      • EVICT drop what's no longer relevant
      • SUMMARIZE compress large memories
      • CONSOLIDATE promote learnings to long-term
      • INVALIDATE mark stale when a source changes
      • REHYDRATE rebuild state after a restart

      Try it: change a source document

      After the Apollo run, finance-agent remembers two findings derived from September's cloud bill. Edit the bill and watch what the watcher does.

      • finance-agentsemantic, importance 0.9

        Dual-run reconciliation doubled cloud spend from July while the migration slipped.

        derived from /org/finance/cloud-bill-2026-09, /org/decisions/ADR-042
      • finance-agentepisodic, importance 0.7

        September cloud line is 2.1 lakh against a 1.0 lakh plan.

        derived from /org/finance/cloud-bill-2026-09
      • engineering-agentsemantic, importance 0.8

        Ledger backfill fails on duplicate reconciliation IDs; tracked as APOLLO-12.

        derived from /org/engineering/postmortem-backfill-failure

      An AI kernel as the trusted control plane

      One Python server, mosaicd, holds the authority. An agent can request a capability. The kernel decides whether it's granted.

      Laptop browserPhoneCLI: ai-ps, ai-tree, ai-top
      Gateway: FastAPI, identity from headers, event stream

      AI kernel

      • Scheduler
      • Process lifecycle
      • Policy + capabilities
      • Approvals
      • Transactions
      • Event bus
      • Audit journal
      • Resource quotas
      • Checkpoints
      • Model router
      • Context manager
      • IPC routing

      Knowledge fabric

      OKF bundlePostgres full-textpgvectorLink graphMemory store

      Agent runtime

      PlannerFinanceEngineeringResearchAction

      Execution

      Docker sandboxesPlaywright browserMock Jira / MCPArtifact store

      Models

      Ollama on the RTXqwen2.5:7b-instructllama3.2:3bqwen2.5-coder, llavanomic-embed-text
      /sovereign-data: okf, indexes, memory, agents, runs, audit, policies, artifacts. Survives reboot.

      Agents are processes

      PID, parent PID, owner, state, model, memory mounts, capabilities, token quota, workspace, checkpoint.

      CREATEDREADYRUNNINGWAITINGPAUSEDCHECKPOINTINGFAILEDRETRYINGCOMPLETEDTERMINATED

      Agents talk over IPC

      A2A-style messages routed and authorized by the kernel. Big outputs travel by reference, not by pasting them into every prompt.

      { "sender": "engineering-agent",
  "receiver": "planner-agent",
  "type": "evidence",
  "payload_ref": "artifact://T-0749/evidence.json",
  "provenance": ["okf://jira/APOLLO-12"] }

      The router keeps restricted data local

      Routing looks at privacy, complexity, latency and context size. privacy=restricted never leaves local models. On the demo node, nothing does.

      if task.privacy == "restricted":
    return local_model()
if task.requires_vision:
    return vision_model()      # llava:7b
return policy.default_model()  # qwen2.5:7b

      Events wake agents, not only prompts

      The event bus carries every state change to the console, the CLI and subscribed agents.

      • process.spawned
      • syscall.decided
      • approval.requested
      • transaction.committed
      • transaction.rolled_back
      • knowledge.changed
      • policy.updated
      • audit.appended

      The metaphor, made visible

      The node boots like an appliance: mount the data partition, start Docker and Ollama, start the kernel, restore process metadata, recover pending tasks. Then you can inspect it the way you'd inspect any machine.

      1. Mount persistent data
      2. Validate state
      3. Restore OKF and indexes
      4. Restore memory metadata
      5. Restore process metadata
      6. Recover pending tasks from their last checkpoint
      7. Ready
      
    
      
  
      

      



      
  
      
    
      
      
      Security is the feature, not a checkbox
      
      
      A system that can control software and files has to assume it will be attacked through its own inputs. Each threat has a specific mechanism against it.
      
    
      
    
      
  
      

      



      
  
      
    
      
      
      Built by four people against one contract
      
      
      Every payload crossing a boundary is a Pydantic model in mosaic_contracts. Each split ships a fake that passes the same contract suite as the real thing, so any component can run fake or real independently.
      
    
      

    
      
      
      commits
      104
      
      
      files in the repo
      569
      
      
      lines of Python
      19,051
      
      
      OKF documents in the demo org
      76
      
    
      

    
      
      
      
        
      P1
      
        
      Kernel & Execution
      
        
      Scheduler, process lifecycle, policy engine, approvals, transactions, audit journal, Docker sandboxes, the mosaicd server and CLI.
      
        
      kernel/ mosaicd/ policies/ execution/
      
      
      
      
      
        
      P2
      
        
      Knowledge, Memory & Console
      
        
      OKF indexing, hybrid retrieval, context firewall, memory with invalidation, and the Next.js operator console.
      
        
      knowledge/ apps/web/
      
      
      
      
      
        
      P3
      
        
      Agents & Models
      
        
      Agent SDK and registry, planner and specialists, NOOA adapter, IPC, and the policy-driven model router.
      
        
      agents/ models/
      
      
      
      
      
        
      P4
      
        
      Platform, Data & Demo
      
        
      Compose stack, GPU setup, the Acme demo organization, ingestion, the sandboxed browser driver, preflight and the run sheet.
      
        
      infra/ data/ scripts/
      
      
      
    
      

    
      
      
      Stack
      
      
        
        
      • Python 3.12
      • FastAPI
      • Pydantic v2
      • asyncio
      • PostgreSQL
      • pgvector
      • Redis
      • Docker
      • Playwright
      • Ollama
      • NVIDIA Container Toolkit
      • Next.js
      • React
      • Tailwind
      • WebSockets
      • OKF
      • MCP
      • A2A
      • NVIDIA NOOA
      • Tailscale
      • uv
      • Ubuntu 24.04
        • 
      
      
    
      

    
      
      
      What's actually new here
      
      
      Agents, RAG, MCP and Docker already exist. The contribution is the enforcement model around them.
      
      
        
        
      1. AI kernel governing agents, models, memory, tools and actions.
        2. 
        
      2. Knowledge filesystem over OKF, indexes, links and artifacts.
        3. 
        
      3. Context as managed memory: load, evict, consolidate, invalidate, rehydrate.
        4. 
        
      4. AI syscalls as the only path to the outside world.
        5. 
        
      5. Agents as real processes with lifecycle, quotas and checkpoints.
        6. 
        
      6. Transactional actions: authorize, execute, verify, commit or roll back.
        7. 
        
      7. A persistent private server; your device is only a terminal.
        8. 
        
      8. OKF-first memory: portable knowledge, disposable indexes.
        9. 
        
      9. Object agents, governed processes: NOOA describes the agent, mOSaic governs the process.
        10. 
        
      10. Knowledge coherence: source changes invalidate dependent memories.
        11. 
        
      11. Context firewall between evidence and instructions.
        12. 
        
      12. Event-driven intelligence: organizational changes wake agents.
        13. 
      
      
    
      

    
      
      
      Run it yourself
      

      uv sync --all-packages
docker compose -f infra/compose/docker-compose.yml up -d postgres redis ollama mock-jira
uv run mosaicd                          # gateway on :8080
uv run mosaic-mock-gateway --speed 4    # or: a contract mock for UI work
uv run mosaicd --print-wiring           # which components are fake or real
      
    
      
  
      

      



      
  
      
    
      
      Private. Persistent. Process-aware. Knowledge-native. Policy-governed. Action-capable. Yours.
    
      
    
      It doesn't just answer questions. It runs your organization's AI, privately, on one box.
      
    
      
      Read the source on GitHub
      Run the demo again