A bare-metal OS, built from scratch in Rust — no POSIX, no libc, no ELF. A tiny language model runs on the silicon, and a capability-checked, audited ABI means it can plan anything and only do what it was granted.
The core idea
The model’s output is an untrusted plan. It never causes a side effect directly — it is parsed, grammar-constrained, capability- and taint-checked, and only then executed by deterministic native code. Above the line: stochastic. Below: deterministic.
A tiny on-device LLM proposes an action as grammar-shaped tool calls.
Grammar-validated, capability-checked, taint-checked, and audited — every call.
Only vetted primitives touch memory, disk, network, and the screen.
Delegation only ever narrows authority · a skill is bounded by its install-time grant, forever · prompt-injection-as-privilege-escalation is refused at the OS boundary.
What’s inside
Everything is hand-built for bare metal — no host OS underneath any of it.
CPU LLM inference on GGUF models with hand-written SSE2/AVX2/NEON kernels, SMP across cores. No cloud, no host.
An in-kernel browser: HTML + CSS/flexbox layout, paint, forms, SVG, and its own small JavaScript engine.
A baseline + High/CABAC decoder & player, validated bit-exact against ffmpeg — decoding on bare metal.
Speech-to-text and text-to-speech through an in-kernel ONNX interpreter. Talk to the OS, fully offline.
An unforgeable capability ABI with an append-only audit log. Authority is always intersection(requested, granted).
A full TCP/IP stack with real certificate verification — pure Rust, no ring, built to run no_std.
A tmux-style compositor: panes, tabs, mouse, an editor, syntax highlighting — and installable themes + wallpapers.
Installable, signed agent packages (SOUL + skills + manifest) from a public registry, plus sandboxed wasm “apps”.
Connect Model Context Protocol servers over HTTP/JSON-RPC — each remote tool registers as a native agent tool, taint-tracked.
Drive the shell agent from external inboxes — Telegram live, Discord/Slack next. Every DM runs on a fresh model context.
Dual-arch from one codebase; discovers hardware like real firmware. Boots on QEMU, VirtualBox, and UEFI metal.
Get started
Grab a prebuilt image, or build from source. It’s still in active development, so use it at your own risk.
# download from the Releases page: # chitti-aa64.img (Apple Silicon / ARM, UEFI) # chitti.iso (x86_64 PC) # write to USB (⚠ erases the target): sudo dd if=chitti-aa64.img of=/dev/rdiskN bs=4m # …or attach it to an EFI-enabled VM
git clone https://github.com/chittios/chitti cd chitti make run ARCH=aarch64 # QEMU + HVF on Apple Silicon make image ARCH=x86_64 # build a bootable ISO make test # in-kernel unit suite
Honest status
It’s early and audacious. Here’s what actually runs on the metal right now:
* in progress — not finished yet.