ostk (kernel)
The central coordinator of the ostk ecosystem. Spawns as a background daemon, virtualizes workspace filesystem boundaries, and orchestrates local agent activities.
License: AGPL-3.0 | Interface: Socket / IPC | Core: Rust (tokio)
OVERVIEW
ostk is the binary that runs when you execute ostk boot. It loads your GPG/Ed25519 identity, opens the shared workspace database, spins up the IPC sockets, and spawns internal drivers. It provides the CLI interface (ostk tack, ostk ps) and acts as the gatekeeper supervising all agent tools. Note that ostk do is deprecated; one-shot prompts are instead routed through ostk tack --run.
OS-LEVEL PROCESS SANDBOXING
To prevent untrusted agent tools or generated code from damaging the host operating system, ostk runs commands inside platform-native sandboxes based on your HUMANFILE capability pins:
macOS Seatbelt
Spawns subprocesses using sandbox-exec, compiling dynamic scheme rules. It strictly restricts read/write operations to the project folder and blocks arbitrary sockets.
Linux Landlock
Applies thread-level kernel restrictions restricting filesystem traversal. Processes cannot walk outside the root workspace path even if run with high shell privileges.
VFS NAMESPACES
The optional VFS projects selected kernel registries at stable, inspectable paths. It is an observation surface, not a transparent overlay that hides ordinary workspace writes:
- Stable namespaces: Selected tasks, decisions, fleet, process, journal, memory, and driver state can be queried with ordinary file tools.
- Projection-specific coverage: Each namespace documents which registry it reflects and how it rebuilds.
- Normal workspace: Source files and Git remain ordinary local files; VFS visibility does not grant audit or CAS guarantees to native writes.
OPTIMISTIC CONCURRENCY & WAL JOURNALING
When multiple agent instances or tools run simultaneously in the same workspace, they coordinate through the daemon to avoid race conditions:
Optimistic Concurrency Control (OCC)
Kernel-mediated fs_ops CAS edits compare expected text under a target-file lock. One match can commit directly; zero matches can consult recorded generation history for a safe merge; ambiguous or overlapping intent returns without writing.
Write-Ahead Logging (WAL)
Kernel-mediated CAS file mutations append their audit row before generation, shadow, and byte updates and fail closed if that record cannot be written. Other verbs have different audit timing; native and raw-shell workspace writes remain outside this guarantee.