Loading repository data…
gryszzz / repository
Governed AI agent runtime with a local-first desktop app + CLI. Chat with any model (Claude, OpenAI, Groq, Ollama, LM Studio); every action passes Intent → Proposal → Commit through signed capability writs, risk-gated approvals, and a replayable hash-chained ledger. Watch it think in the Mind graph. Cognition proposes; the runtime governs.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
Immersive, local-first GUI — chat, multi-skill runtime, live runs, the 3D Mind reasoning view, audit + replay. Connect any model (Claude, OpenAI, Ollama / LM Studio, any OpenAI-compatible adapter); your keys never leave your machine.
macOS Apple silicon · macOS Intel · Windows .msi · Linux .AppImageUnsigned; one-time "Open anyway". Or build from source (below).
Terminal, scriptable, server. No Rust, no clone, no compile.
Selected from shared topics, language and repository description—not editorial ratings.
matakartal /
Agent-native, governed AI runtime for Rust, Python, and TypeScript — native providers, MCP, tools, routing, memory, budgets, audit, and containment.
76/100 health
macOS badge = Apple silicon; Intel build here. Or one line: curl -fsSL …/scripts/get.sh | sh (auto-detects).
All downloads come from the latest stable release — the single official production download source (release notes + checksums there). Nightly dev builds are separate and clearly marked.
# Debian / Ubuntu (Fedora: dnf install webkit2gtk4.1-devel openssl-devel …)
sudo apt update && sudo apt install -y libwebkit2gtk-4.1-dev build-essential \
curl wget file libssl-dev libayatana-appindicator3-dev librsvg2-dev
Desktop app — same commands on every platform:
git clone https://github.com/gryszzz/open-thymos
cd open-thymos/thymos/clients/desktop
npm install
npm run dev # hot-reloading dev window
npm run build # installer → .dmg (macOS) · .msi (Windows) · .AppImage (Linux)
CLI + runtime — from source:
cd open-thymos/thymos
cargo run -p thymos-server # runtime on http://localhost:3001
cargo run -p thymos-cli -- shell # interactive governed shell
Cognition proposes. The runtime governs. The ledger records.
A model cannot call a tool, mutate state, spend budget, delegate authority, or erase history not by convention, by runtime semantics. Every effect passes through a typed proposal, a signed capability writ, a policy trace, and an append-only execution ledger.
Intent → Proposal → Commit
| Stage | Type | Authority |
|---|---|---|
Intent | Emitted by cognition | None — content-addressed, no execution rights |
Proposal | Compiled by the runtime | Bound to a signed Writ + policy trace |
Commit | Written to the ledger | The only record that mutates world state |
If "the model just did what?!" is an unacceptable failure mode for you, this is the kernel that makes agent actions authorized, auditable, and replayable instead of trust-the-prompt. Concretely:
thymos audit <run-id> renders that whole trail for a human — the
artifact an auditor actually wants.What it is not (yet): a turnkey product. It's a reference kernel — see STATUS.md for the honest line between what's enforced-and-tested and what's still gated (Postgres on the HTTP path, live-model CI proofs run in CI).
OpenThymos treats cognition as untrusted input. The runtime enforces this structurally:
If a proposal reaches the tool boundary, it was already authorized by a writ, cleared by the compiler, and permitted by the policy engine. The ledger records everything that happened and everything that was refused.
The compiler is a pure function:
(Intent, Writ, World, ToolRegistry, PolicyEngine) → Proposal
A proposal is one of three outcomes:
RequireApproval { channel, reason }. Written to the ledger as PendingApproval.Deny failed. Written to the ledger as Rejection.Only a Staged proposal executes. Only a Commit mutates world state.
These are invariants, not goals. They are checked structurally by the runtime, recorded in the ledger, and verifiable by replay.
| Guarantee | |
|---|---|
| I | A valid ledger can be folded into the same world projection under the recorded commit sequence. |
| II | Cognition cannot execute tools or mutate state directly. The provider boundary is enforced at the type level. |
| III | Only staged proposals may reach the tool boundary. Only commits may mutate projected world state. |
| IV | Tool scopes, budgets, time windows, effect ceilings, tenant boundaries, and delegation bounds are checked before execution. |
| V | Policy decisions are recorded as proposal traces and cannot be erased by a client surface. |
These make the guarantees above structural rather than aspirational. Each is in the runtime today and covered by tests:
Read / Write / External / Irreversible) exceeds the
writ's effect ceiling — before the tool runs. A read-only writ cannot drive
an external or irreversible tool even when the tool name is in scope.intent_id, the
policy_trace that authorized it, and a policy_set_hash of the active rule
set — so a permitted action's why lives in the ledger, not just its what.(trajectory, seq)
invariant inside an immediate transaction, so concurrent writers cannot fork
a trajectory's chain.External / Irreversible tool executes at most once per
content-addressed proposal — retries and re-approvals return the prior commit.