Inspiration
AI assistants can explain what to do on a computer, but a trustworthy Mac agent must do more than generate plausible text. It needs to know exactly which resource the user authorized, keep durable state across relaunches, avoid duplicate side effects, and verify that an action really happened.
I built Atlas to explore what a private, native Mac agent could feel like if permission, recovery, and verification were part of the product from the beginning. The interface is one conversation, while the complexity underneath is handled by a structured capability runtime.
What it does
Atlas is a chat-first AI agent for macOS 27. The user asks for an outcome in natural language, and Atlas selects a small Apple Foundation Models profile for that request. The model can respond and propose a capability, but it cannot run the capability or grant itself access.
Atlas shows the exact action and scope when review is required, binds an opaque resource grant, evaluates central policy, runs a typed native capability, independently verifies the result, records revisioned task state and append-only events, and returns the verified result to the conversation.
The current technical preview includes exact security-scoped file inspection, on-device Apple Intelligence and an explicit Private Cloud Compute route, durable tasks and relaunch recovery, scoped local memory, versioned read-only skills, foreground automations, reviewed one-time reminders projected to verified macOS local notifications, bounded verified web research in nonpersistent WebKit, read-only Calendar access through EventKit, authenticated page-watch state, controlled MCP discovery through a bundled loopback server, and schema-validated natural-language automation and skill drafts.
How I built it
Atlas is divided into framework-independent domain and runtime modules plus Apple-specific adapters. Canonical task state is separate from chat. Every mutation is revision-checked, and explicit task states distinguish interrupted, recoverable, awaiting-user-action, completed, failed, and cancelled work.
SwiftData stores tasks, runs, steps, attempts, events, checkpoints, conversation projections, memory, skills, automation state, browser watches, and MCP configuration. Security-scoped bookmarks persist exact file access without making raw paths into authority. SQLite FTS5 provides local memory retrieval, while Core Spotlight receives only optional user-reviewed redacted summaries.
Apple Foundation Models is isolated behind a model adapter. Atlas composes one dynamic profile per request and exposes only a proposal tool with compact capability metadata. Concrete executors, bookmarks, browser grants, credentials, policy, and persistence never enter the model session.
Web research uses exact-host grants and isolated WebKit reads. Search snippets are navigation rather than evidence. Atlas reads a bounded, host-diverse source set, verifies each page digest, and allows synthesis only from those source-bound excerpts.
How I used Codex and GPT-5.6
I used Codex throughout the build rather than only for initial scaffolding. GPT-5.6 helped turn a 31-page product concept into milestone acceptance criteria, research risky Apple APIs, design the runtime and permission boundaries, implement difficult concurrency and recovery paths, and perform adversarial security reviews.
The work was split into independent research, implementation, test, and review lanes where possible. Each milestone was completed as a narrow vertical slice, then validated with focused tests, the full regression suite, and Swift 6 strict-concurrency checks before the next dependency layer was integrated.
Codex was especially valuable for tracing cross-system authority. The web workflow evolved from a simple search-page reader into a bounded pipeline where provider links are navigation, article pages are independently read and verified, citations are checked, and webpage text can never change Atlas policy.
Codex and GPT-5.6 were development tools. Atlas's application runtime uses Apple Foundation Models; GPT-5.6 does not run inside the app.
Challenges
The hardest problem was preserving a simple chat experience without collapsing runtime state into chat text. Other difficult areas included deterministic crash recovery without repeating completed work, persisting exact file access safely, keeping model tool calls proposal-only, preventing memory, skills, webpages, and MCP metadata from becoming authority, handling cancellation without accepting late results, and building browser interaction without giving a model JavaScript, selectors, credentials, or unrestricted browser control.
Accomplishments
Atlas currently executes 229 strict-concurrency tests: 223 pass, six explicitly gated live probes are skipped, and zero fail. It reconstructs interrupted work from canonical checkpoints, does not rerun completed work, scopes and revokes memory and skills, and produces web answers from bounded verified article evidence instead of raw search snippets. Unsupported high-risk surfaces fail closed and are documented honestly.
What I learned
The useful abstraction for an agent is not a giant tool list. It is a small capability proposal followed by trusted resource binding, central policy, explicit effects, verification, and durable recovery. Local-first also does not mean treating every local artifact the same: transcripts, memory, task state, indexes, and permissions need different trust and lifecycle rules.
What's next
The next step is a controlled alpha with a signed SMAppService automation helper, isolated external MCP transports, a Keychain credential vault, signed-app EventKit permission testing, complete migration and notarization matrices, larger performance corpora, and a distributable judge build. Atlas will continue to expand through typed, permission-scoped capabilities rather than unrestricted shell or desktop control.
Built With
- appkit
- apple-foundation-models
- codex
- core-spotlight
- eventkit
- gpt-5.6
- macos-27
- model-context-protocol
- private-cloud-compute
- sqlite-fts5
- swift-6
- swiftdata
- swiftui
- usernotifications
- webkit
- xcode-27-beta