The model proposes. The core decides.
Sidged is your personal intelligence, built as an operating system. Models suggest. A small core decides what may run, and what may leave your device.
Watch it workSidged is your personal intelligence, built as an operating system. Models suggest. A small core decides what may run, and what may leave your device.
Watch it workTwo steps where a model suggests, four where the core decides.
Send Ben a message, but fix the photo first.
Sent, signed and logged.
Your models run on your own device. Nothing leaves it without passing one guarded gate.
Anything that matters waits for your OK, in a window no model can fake.
Every decision is signed and chained, so you can check it later.
Most agents are a prompt and a set of rules wrapped around a model that holds the keys.
Sidged takes the keys away from the model. It may suggest anything. Only the core can act.
Your devices work together, and none is trusted just for being a member. An edge that misbehaves or drifts from its measured image is cut off and replaced by a fresh one.
An edge joins only with your approval, bound to its image digest and its own did:key. Pair with a signed QR invite, a passkey or a Swiss E‑ID.
Edges authenticate each other. Every message is a signed envelope carrying its grant, checked against your Cedar policy, default deny.
Each edge logs the decision before it acts. If the log fails, the message is refused.
In local mode the mesh is off: no listening, no connection to any peer.
The first call to a cloud model for a kind of task waits for your OK.
Data you mark local-only and every secret are refused at the gate, always.
Each request is anonymised, checked for where it may go, and signed in a privacy report.
For the people who will read the code.
Layer 3 SDG-L4
A declarative view per task, composed from a vetted component catalogue instead of model-written code. Approvals and the kill switch stay with the core, behind a Unix socket checked with SO_PEERCRED.
Layer 2 SDG-L0..L7
Rust security core with plan verifier, grants, Cedar information-flow control and the privacy gateway; an on-device model ensemble that proposes; WebAssembly modules; signed records.
Layer 1 SDG-L8
Drivers, scheduler, namespaces, isolation. The classic userland goes away; the stack boots on bare metal, in a VM, as a host service or an OCI container.
| Primitive | Replaces | In Sidged |
|---|---|---|
| Identity | User accounts and ambient UIDs | Ed25519 did:key identities for owner, devices, agents and services |
| Capability | Apps, syscalls, raw IPC | A typed descriptor declaring inputs, outputs, effects, data classes, residency, cost and whether it is consequential |
| Grant | Ambient permissions | Attenuable, holder-bound capability tokens with budgets, use limits and expiry, evaluated with Cedar |
| Plan | Scripts, small apps, agent loops | A declarative graph with bounded map and CEL, guaranteed to terminate and verified before it runs |
| View | Windows and UI toolkits | A declarative interface per task with no foreign code, plus trusted UI only the core draws |
| Record | File system and app databases | Content-addressed, signed dCBOR objects with data class, provenance, residency and retention |
| Module | Packages, drivers, libraries | Signed WASI 0.3 components with a manifest and no ambient authority |
Models propose intents, views and plans. The deterministic core decides.
Every call needs a verified, unexpired, holder-bound token and a permit from your policy.
Model, tool, web and peer output stays data until the verifier has checked it.
Consequential steps wait for your approval in trusted UI.
All egress passes the privacy gateway and leaves a signed privacy report.
Generated code runs in the WebAssembly sandbox with at most the rights of its task.
Local mode opens no listening socket and sends nothing to the internet.
The Rust core stays small. Everything else is an isolated module.
Every effect lands in a signed, hash-chained audit log.
local-only are refused for every remote destination; secrets.* never reach egress, even with an owner permit.CH, EU, CH-EU, unrestricted); a destination the gateway cannot place is a refusal.sdg.pii/1, no model or network involved.| Threat | Mechanism |
|---|---|
| Prompt injection | Inputs stay data until the static verifier and Cedar information-flow policy have checked the plan |
| Faulty actuation | A worker that hallucinates a capability or breaks the flow policy is culled and replaced |
| Supply chain | Deterministic training data, pinned base models, SHA-256 provenance manifests |
| Exfiltration | Fail-closed residency, core-checked anonymisation, secrets never on an egress path |
| Spoofed approval | Approvals only over a kernel-verified socket from a separate approver identity |
| Tampering | An Ed25519-signed SHA-256 hash chain written before every allow or deny |
A mapping and a self-assessment, not a certification.
# build and test the workspace
cargo test --manifest-path runtime/Cargo.toml --workspace --locked
# keys, policy, catalogue and a signed root grant
sidged init --workspace ~/sidged
# model -1, planner, verifier, swarm queue, signed result
sidged task "Write a polite project status email to Alex" --workspace ~/sidged
# check the hash chain and every signature
sidged log verify audit.log --public <key>Specifications are drafts under CC BY 4.0; runtime, schemas and code under Apache 2.0. No certification programme exists.