CorvinOS – self-hosted OS for AI agents, compliance built into the runtime

CorvinOS — The Operating System for AI Organizations

Apache-2.0 · The self-hosted agentic OS

The agentic OS you actually own. EU-compliant by design.

A self-hosted operating system for AI agents: it runs the engines, personas, workflows and runtime-forged tools, meets your users on every messenger, drives a real browser, and keeps a hash-chained audit of it all — with compliance built into the architecture, not bolted on.

Star on GitHub

Quick Start →

0

Messaging bridges

∞

Engines detected

0

Compliance frameworks

0%

Self-hosted

The command center

The chat runs the whole OS

The chat isn't a demo window — it's the shell. Personas, engines, workflows, the Forge, RAG, agentic compute and the A2A mesh are all reachable from one prompt. And you can drive it end‑to‑end by voice: speak a request, CorvinOS transcribes it, routes it, does the work, and speaks the answer back — tuned to how you listen. And you don't even need the console open: every messaging bridge is a full control surface, so you can run the whole OS straight from a Telegram, WhatsApp or Signal thread.

Voice on

Voice in · voice out

Run it hands‑free

Hit the mic and talk. Speech is transcribed locally by default — the audio is deleted the moment it returns, and only metadata ever touches the audit chain.

🎙️

Speak“Rank Q2 cohorts by retention.” — captured from any bridge.

✎

TranscribeLocal Whisper by default, OpenAI as fallback. Runs before the engine even wakes.

⎇

RouteA persona and engine are picked for the turn — your overrides always win.

⚡

ActOne turn can reach every layer: Forge, workflows, RAG, agentic compute, A2A.

🔊

Speak backAnswer is spoken through a listener‑tuned voice — jargon and depth to taste.

One prompt reaches every layer

🎭

Personas Many minds, one runtime — routed per turn.

⚙️

Engines Claude, Codex, OpenCode & local models.

🔀

Workflows Multi-step AWP pipelines, on demand or scheduled.

🔨

Forge Schema-bound tools & skills, built at runtime.

📚

RAG Grounded answers over your own documents.

🧮

Agentic Compute Sweeps & tuning without spending tokens.

🔗

A2A mesh Signed task envelopes across teams.

🛡️

Audit Every step on a hash-chained spine.

Regulatory compliance

Built in, not bolted on.

Every compliance mechanism is a structural design constraint. There is no "compliance mode" you can accidentally leave off.

EU AI Act Art. 50

Bot Disclosure

One-time AI-nature disclosure per user, structurally locked. Cannot be disabled via configuration.

GDPR Art. 6 & 7

Consent Gate

Deny-by-default consent for transcript sharing. Per-user, TTL-capped, re-validated at consume time.

GDPR Art. 30 & 32

Hash-Chained Audit

Every event appends to a SHA-256-linked chain. Tampering invalidates it. Offline-verifiable.

EU AI Act Art. 14

Data Residency

Compliance-zone routing and egress lockdown structurally prevent data from leaving the permitted zone.

EU AI Act 2026 GDPR ISO/IEC 42001 NIST AI RMF

Agentic Compute

Compute that adapts to any problem

That's Agentic Compute: the worker owns the loop, the model owns the framing. The agent says what to optimise and when to stop; a sandboxed worker picks the strategy that fits the problem and turns the crank — from a quick tune to a Bayesian search over an 8 GB dataset, and never a raw byte in the context window.

01

Frame itThe model submits one job — what to optimise, the parameter space, and the stopping rule.

02

Run itA sandboxed worker evaluates combinations in parallel and streams Top-K progress back.

03

Read itThree model calls total — submit, poll, read. Zero tokens spent while the loop turns.

3 model calls / sweep up to 16 parallel SHA-256 audited

compute_run bayesian · GP + EI

sweep · learning_rate × n_estimators · 4 parallel

w0

w1

w2

w3

4/100

iterations

↓ 0.900

best loss

● sha-256

N iterations run in the worker — the model is idle until the result returns.

grid

Exhaustive coverage

Evaluates every combination in the grid. Pre-generated at submit — deterministic and fully reproducible.

random

Broad sampling

Uniform samples per batch from continuous ranges. One seed per run, stored for reproducibility.

bayesian

Fewest evaluations

A Gaussian-Process surrogate picks the highest Expected-Improvement points — finds a good region in the fewest runs.

Recursive delegation · the ACS run

It keeps working until the answer is good enough

A manager engine plans the task, delegates pieces to parallel worker runs, scores every result, and iterates toward a loss target. The point of the recursion is adaptation: where a capability is missing, a worker forges the tool or skill it needs at runtime — so the same flow can tune a model, run a backtest, or analyse an 8 GB dataset straight from a prompt.

★ MANAGER · claude-sonnet-4-6

loss — · idle

ITER 1 queued loss 0.82

W-A★ sub-mgr↳ spawnsSW-B1 · hermesSW-B2 · hermesW-C ⚒ forge.create_tool()

ITER 2 queued loss 0.51

W-DW-EW-F ✦ skill.create()

ITER 3 queued loss 0.12

W-GW-HW-Iuses forged tool + skill

★ sub-manager · recursion ⚒ forge tool · mid-run, shared ✦ skill · injected next turn manager sonnet · workers haiku · confidential hermes

Forge and SkillForge run inside the loop. A worker calls forge.create_tool() and the tool is instantly available to every later worker; another calls skill.create() and the skill is injected on the next turn. That runtime generation is the adaptation engine — how a plain-language question turns into a working analysis over data far too big for any context window.

The manager never touches your data. Every spawn passes the data gate, so only clean, redacted summaries flow back up the tree — bounded by a shrinking budget.

max_depth max_total_workers max_wall_time

The data firewall

Query 8 GB. Leak nothing.

Register a dataset once. The same file is presented two ways — a redacted snapshot to the model, the real bytes to the sandbox.

To the model

→A 22-char opaque data_handle

→Schema + redacted sample, capped at 4,000 tokens

→Stats via HyperLogLog & P5/P95 — never raw extremes

To the sandbox tool

→The real file path, read-only-bound into bwrap

→Every row readable — pandas.read_csv(path) just works

→Structured queries & SQL sources via the DSI protocol

PII redaction: drop redact pseudonymize mask-partial aggregate-only hash

Point it at the databases you already run — the model queries them by name over the DSI protocol, and the raw rows never move.

🐘PostgreSQL 🐬MySQL / MariaDB ❄️Snowflake 🔷BigQuery 🔴Redshift ☁️Amazon S3 🟦Azure Blob 📊Delta Lake + CSV · Parquet · GCS

Workflows & packaging · AWP

Describe the outcome. Ship the whole thing as one file.

You never draw the boxes and arrows. You describe an outcome in plain language — the manager delegates the run, and the execution graph discovers itself. Save that graph as a repeatable workflow, then export everything it needs — logic, tools, skills, personas and data bindings — into a single portable .awpkg bundle.

1 You describe it

“Every Monday, pull our Stripe MRR, flag the biggest churn drivers and post the summary to #finance.”

natural language · no config

›

2 The run discovers the graph

ACS workflow graph · branch → 3 outputs

›

3 Saved as a workflow

weekly-mrr-brief cron · Mon 9:00

1fetch Stripe MRR

2analyse churn drivers

3format summary

4deliver → #finance

repeatable · schedulable · replayable

DAG Replay

Freezes the exact graph the run discovered — same nodes, same order — for a faithful re-run.

AWP Template

Generalises the graph into a reusable blueprint with parameters — point it at new inputs and run again.

Recursion Graph

A whole agentic-compute delegation tree — sub-managers, workers and their iteration loops — captures as one .awpkg, ready to re-run the sweep.

The .awpkg format

Everything the workflow needs, in one archive

An .awpkg is a signed ZIP — the whole capability, not just the recipe. Install it into any tenant with one command and the tools, skills, personas and delegation logic all light up together. It declares; the runtime installs — no scripts, no binaries, eight fail-closed checks before a single byte is extracted.

weekly-mrr-brief-1.1.0.awpkg (ZIP)

├─ manifest.yaml id · version · perms

├─ workflows/ *.awp.yaml

├─ tools/ code.*.json

├─ skills/ /SKILL.md

├─ personas/ *.yaml

├─ data/ defaults.yaml

└─ README.md shown by inspect

corvin pkg build corvin pkg install

Delegation & workflow logic

The full AWP topology — agent steps, parallel fan-out/fan-in and recursive delegation_loop nodes — plus triggers and delivery targets.

Forge tools

Every custom tool the run built, each pinned to a sandbox with network: deny unless the manifest grants it.

SkillForge skills

Reusable skill bodies, linted before install and injected into the workers' future turns.

Cowork personas

The roles the workers assume — so the packaged team behaves the same on any machine.

Data bindings, not data

RAG-provider and datasource references travel; secret names are declared but their values stay in the vault — never in the package.

permissions: network / compute / secrets SemVer + dependencies hash-chained audit

Organization mesh · A2A protocol (L38)

Your datacenter. The whole org just asks.

Run CorvinOS on one machine in your datacenter — it's just another node in the mesh, the one that happens to do the heavy agentic compute over your confidential data. Every team pairs with every other over A2A: no hub, no center. Anyone sends plain-language tasks, answers flow back, but the raw data never leaves the building.

● request in ● answer out ● team ↔ team mesh ⚿ HMAC-paired · consent-gated peer-to-peer · no central server

Every connection is a Friendship Token — a shared HMAC key exchanged out-of-band. No platform sits in the middle; each node authenticates the other and audits every envelope on its own hash chain.

HMAC-SHA256 mutual auth purpose-limited per-origin rate limit data-classification cap tamper-evident audit instant revoke

Adapts & evolves

It grows into your setup

CorvinOS isn't a fixed product you conform to. It learns how you like to work, it builds the capabilities it's missing while it runs, and it opens cleanly to whatever else you need to plug in.

layer stack + extension

🔌 acme.crm-connector extension

🧩 mcp: notion · slack · github mcp

🔨 forged tools & skills runtime

PROTECTED CORE

🔒 corvin.audit · redaction · policy locked

🔒 corvin.engines · personas · voice locked

🎧

Adapts to you

Voice & Profile tunes how each listener is spoken to — vocabulary, jargon level, depth — and personas route every turn to the right voice, tools and engine. Your overrides always win.

🌱

Evolves itself

Hit a gap and a worker forges the tool and writes the skill — at runtime, mid-task. Each one persists and is instantly available to every later turn, so the system keeps getting more capable the more you use it.

🧩

Open & extensible

Install external MCP servers from the catalog, add vendor layers through the Extension API, or drop in custom compute engines. The corvin.* core stays cryptographically locked — an extension can add a guardrail, never weaken one.

Platform features

Everything for production AI agents

From multi-channel messaging to runtime tool generation, CorvinOS ships production-grade infrastructure out of the box.

Seven Bridges

Native daemons for Discord, Telegram, WhatsApp, Slack, Email, Teams and Signal. Hot-reload settings, per-chat profiles, rate limiting.

Runtime Tool Generation

Forge generates schema-bound, sandboxed tools at runtime via MCP with a four-scope workspace hierarchy.

Runtime Skill Learning

SkillForge injects markdown skills into future turns, with automatic grading, promotion gates and an injection linter.

Multi-Engine Support

Swap between Claude Code, Codex, OpenCode, local Hermes/Ollama and GitHub Copilot — no bridge changes. Adaptive Haiku/Sonnet model selection built in.

Conversation Memory

FT

[truncated for AI cost control]