See it run
A real boot, start to finish
The shell coming up, a hosted model answering a question by calling a tool, the audit log, the hardware underneath, and an image decoded in-kernel — recorded from the running OS, not a mockup.
A bare-metal OS, built from scratch in Rust — no POSIX, no libc, no ELF. A tiny language model runs on the silicon, and a capability-checked, audited ABI means it can plan anything and only do what it was granted.
The core idea
The model’s output is an untrusted plan. It never causes a side effect directly — it is parsed, grammar-constrained, capability- and taint-checked, and only then executed by deterministic native code. Above the line: stochastic. Below: deterministic.
A tiny on-device LLM proposes an action as grammar-shaped tool calls.
Grammar-validated, capability-checked, taint-checked, and audited — every call.
Only vetted primitives touch memory, disk, network, and the screen.
Delegation only ever narrows authority · a skill is bounded by its install-time grant, forever · prompt-injection-as-privilege-escalation is refused at the OS boundary.
See it run
The shell coming up, a hosted model answering a question by calling a tool, the audit log, the hardware underneath, and an image decoded in-kernel — recorded from the running OS, not a mockup.
What’s inside
Everything is hand-built for bare metal — no host OS underneath any of it.
CPU LLM inference on GGUF models — architecture-dynamic loaders (Qwen hybrid, Gemma), every mainstream quant plus sub-2-bit packs, hand-written SIMD kernels, split across every core. No cloud, no host.
An in-kernel browser: HTML + CSS/flexbox layout, paint, forms, SVG, text selection and clipboard, and its own small JavaScript engine.
Three decoders and a player, each validated frame-for-frame against FFmpeg and libvpx — 1080p30 on bare metal, with HLS over the network.
Speech-to-text and text-to-speech through an in-kernel ONNX interpreter, fully offline — or a hosted provider if you configure one.
An unforgeable capability ABI with a scope gate and an append-only audit log. Authority is always intersection(requested, granted).
A full TCP/IP stack with real certificate verification against an embedded root store — pure Rust, no ring, built to run no_std.
A tmux-style compositor: a resizable grid of up to eight panes, tabs you drag between them, a status bar on any edge, mouse, an editor, themes + wallpapers.
Installable, signed agent packages (SOUL + skills + manifest) from a public registry, plus sandboxed wasm apps — notes, paint, slides, chess, games.
Connect Model Context Protocol servers over HTTP/JSON-RPC — each remote tool registers as a native agent tool, taint-tracked.
Drive the shell agent from external inboxes — Telegram live, Discord/Slack next. Every DM runs on a fresh model context.
An ACPI AML evaluator drives the embedded controller for battery and AC state, a real power button, S5 poweroff, and suspend/resume that puts USB, the NIC and audio back.
The panel picks the resolution: EDID → loader → kernel, with KMS backends for virtio-gpu and VMSVGA, and display settings stored per monitor.
WPA2 against the published 802.11i vectors, CCMP against RFC 3610’s own packet vector, the 802.11 data path and the join sequencer — all verified off-hardware. The radios are the part that still needs a laptop.
AHCI, NVMe, virtio, USB mass storage and SD/eMMC over SDHCI — with ext4 read/write, FAT, exFAT and NTFS read.
Intel HDA, virtio-snd and legacy codecs, plus USB Audio Class over an isochronous endpoint — stereo WAV and MP3, with software volume and mute.
Hubs enumerated to the full five tiers USB allows, so a drive behind a dock behind a monitor is found — plus CDC-ECM and RNDIS tethering.
Real hardware
Nothing is pinned to an emulator. Devices are found the way real firmware finds them — ACPI and PCIe, EDID, HID report descriptors, device trees — and degrade gracefully when a facility is absent. Marked wip where the code exists but the hardware hasn’t confirmed it yet.
Get started
One image per architecture on theReleases page — no account, no installer. Or build it from source. It is still in active development, so run it in a VM or off a USB stick, not on a machine whose data you care about.
chitti-x86_64.iso for a PC ·chitti-aarch64.img for ARM# each image ships a .sha256 beside it sha256sum -c chitti-x86_64.sha256 # Linux shasum -a 256 -c chitti-x86_64.sha256 # macOS # a truncated download boots into a failure that # looks like a broken OS, not a broken transfer
# in QEMU (it is a hybrid ISO) qemu-system-x86_64 -M q35 -cpu max -m 2G \ -cdrom chitti-x86_64.iso -serial stdio # or write it to a USB stick (⚠ erases the target) sudo dd if=chitti-x86_64.iso of=/dev/sdX bs=4M status=progress
# a GPT disk image with its own ESP: it boots # itself, so it needs UEFI firmware and a drive cp /usr/share/AAVMF/AAVMF_VARS.fd . qemu-system-aarch64 -M virt -cpu max -m 2G \ -drive if=pflash,format=raw,readonly=on,\ file=/usr/share/AAVMF/AAVMF_CODE.fd \ -drive if=pflash,format=raw,file=AAVMF_VARS.fd \ -drive if=none,id=hd,format=raw,\ file=chitti-aarch64.img \ -device virtio-blk-pci,drive=hd -serial stdio # easier: UTM on an Apple-silicon Mac — new VM, # Virtualize, attach the .img as a drive
# no model is bundled — a GGUF is far too large # for a release asset. Point it at a hosted one: /model remote http://host:port [name] # or load one off any mounted disk /model load /path/to/file.gguf # or fetch one, then load it /http -O <url>
git clone https://github.com/chittios/chitti cd chitti make run ARCH=aarch64 # QEMU + HVF on Apple Silicon make image ARCH=x86_64 # build a bootable ISO make test # in-kernel unit suite
/help # searchable command browser /about # version and build /disks # what storage was found /network dhcp # get an address # in a VM: set the pointer to USB Tablet and the # keyboard to USB, and enable EFI
Honest status
It’s early and audacious. Here’s what actually runs on the metal right now:
* in progress — not finished yet.