deepstrick

Agent OS microkernel for cross-language agent runtimes.

Comment

DeepStrike

An Agent OS microkernel for dynamic workflows, governed tools, replayable sessions, and cross-language agent runtimes.

Inspiration

DeepStrike turns an agent "harness" into a kernel primitive.

Modern agents increasingly solve hard tasks by writing a small workflow: classify the work, fan out to sub-agents, verify outputs, loop until done, and synthesize a final answer. In a script, that harness is powerful but fragile: state lives in process memory, governance is ad hoc, recovery is hard, and every language has to reimplement the same semantics.

DeepStrike moves the control plane into deepstrike-core, a pure Rust state machine. Host SDKs still own all real I/O: LLM calls, tools, files, worktrees, network, long-term memory, and storage. The kernel decides when and whether effects may happen; the host executes approved effects and feeds observations back.

What it does

DeepStrike is an Agent OS microkernel. It doesn’t replace your LLM provider or tool stack—it owns the control plane that makes long-running, multi-agent work safe, replayable, and consistent across languages.

You get:

  • Dynamic workflow scheduler — Declarative DAGs plus runtime SubmitNodes. First-class Loop, Classify, Tournament, Reduce, fan-out, synthesize, and verifier patterns.
  • Unified syscall governance — Tool calls, sub-agent spawn, workflow growth, and memory writes share one gate: allow / deny / ask-user / rate-limit / quota.
  • Context VM — Four-slot rendering, pressure-driven compression, handle paging for large tool results, prompt-cache-aware prefixes, and a governed knowledge lifecycle.
  • Sub-agent isolation — Roles, capability filters, worktree / read-only / remote isolation, process lineage, contracts, and handoffs.
  • Replay and recovery — Append-only SessionLog, provider replay envelopes, kernel observations, workflow resume, wake-by-session, OS snapshots, and repair utilities.
  • Memory as an OS device — Kernel-validated write/query memory, DreamStore integration, idle consolidation, and write quotas.
  • Provider routing — Kernel carries a model hint; the host resolves OpenAI, Anthropic, Gemini, DeepSeek, Kimi, Qwen, GLM, Minimax, Ollama, or a custom provider.
  • Cross-language runtime — One kernel ABI across Node.js, Python, Rust, and WASM.
LLM emits a plan or tool request
        ↓
deepstrike-core decides: schedule, gate, budget, compress, snapshot
        ↓
Host SDK executes: provider, tools, files, worktrees, stores
        ↓
Observations return to the kernel and SessionLog

How we built it

We borrowed OS design language—not to enlarge scope, but to force a clean boundary.

OS concept Agent OS counterpart
Syscall trap Every side effect enters one trap: Invoke, Spawn, WriteMemory, SubmitNodes…
Process / TCB Each agent run is a Task Control Block; sub-agents are child tasks
Scheduler Ready / Running / Suspended / Done + budget ledger
Virtual memory Context partitions + handle table + page-in/out
Signals / IPC Runtime signals into state; reactive blackboard
Security module Governance pipeline: Allow / Deny / Gate / RateLimited
Job scheduler Workflow DAG nodes spawn through the same gate

Architecture:

  1. deepstrike-core (Rust) — Pure state machine. No HTTP, no filesystem, no LLM clients. Owns scheduling, syscall disposition, context rendering, workflow DAGs, budgets, and observations.
  2. Host SDKs — Node, Python, Rust, and WASM run the interpreter loop: call the provider, execute tools, persist SessionLog, talk to stores and sandboxes.
  3. Provider + ExecutionPlane — Vendor protocols and concrete tool I/O stay outside the kernel, so credentials never mix into control flow.

Around the core we also shipped an eight-level Research Brief Studio curriculum (sourced Q&A → memory → skills → signals → governance → loop → workflow DAG → editorial room) and capability benchmark adapters (BFCL / GAIA) so progress is measured by task completion, not only unit tests.

Challenges we ran into

  1. Harness semantics drifted across languages — The same creator–verifier / fan-out–synthesize patterns were reinvented per SDK with different failure axes. We had to lift attempt loops and verdicts into shared contracts instead of host folklore.

  2. Context is not a chat log — Naive truncation breaks tool-call / tool-result pairing and can kill a run at the provider. Compression and rendering had to respect atomic turn units, not raw message counts.

  3. Determinism vs. “smart” policy — Embeddings and LLM judges are useful, but the kernel must stay pure and replayable. Semantic scores belong on the host and re-enter as journaled facts.

  4. Governance without killing autonomy — One gate for tools, spawn, memory, and workflow growth is strict. Getting ask-user and quotas right without turning every agent into a permission dialog was a constant tension.

  5. Recovery that actually works — Interruptions and long workflows need more than “restart the script.” SessionLog + snapshots had to reconstruct control flow, not just dump text.

  6. Memory that isn’t fake recall — Early stores ranked by insertion order and ignored the query. Making memory a real OS device meant redesigning ranking, lifecycle, and consolidation—not exposing a search() stub.

Accomplishments that we're proud of

  • A real kernel/host split that holds across Node, Python, Rust, and WASM with one ABI
  • Workflows as kernel objects — gated spawn, budgets, reducers, milestones, and dynamic DAG growth
  • Syscall-level governance — one policy surface instead of per-tool if-statements
  • Replayable sessions — recovery and audit as first-class features
  • Context VM engineering — four-slot rendering, compression, handle paging, and knowledge budgets
  • A composition-first 8-level live curriculum, validated against real providers
  • Packages shipping on npm, PyPI, crates.io, and WASM

What we learned

  • The harness is the product. Durable fan-out, verify, loop, and synthesize matter more than clever prompts alone.
  • OS analogies work when they constrain design. Syscall, TCB, VM, and scheduler force ownership boundaries; they fail as marketing metaphors that expand scope.
  • Correctness before clever policy. Utility-driven compression and ranking only help after pairing invariants, budget closure, and lifecycle bugs are fixed.
  • Cross-language parity is a discipline. If semantics live in the host, they drift. If they live in a pure kernel, SDKs stay thin and honest about I/O.
  • Agents need evidence chains. SessionLog turns “the model said something” into a reconstructible run—essential for debug, eval, and resume.

What's next for DeepStrike

  • Smarter, still-deterministic kernel policies — utility-aware compression, relevance-driven eviction, fairer DAG scheduling, and signal admission without breaking replay
  • Harness & memory redesigns end-to-end — AttemptLoop semantics (run health vs. verdict) and MemoryRecord lifecycle with real query-aware recall
  • Post-ABI-v2 replay lab — mechanical replay, recall probes, and judge-based eval as a continuous reliability bed
  • Capability benchmark expansion — deeper BFCL / GAIA (and beyond) so progress is measured under governance, not only by unit green
  • Richer collaboration primitives — stronger ReactiveSession, contracts, handoffs, and run-group budgets for multi-peer workloads
  • Production hardening — more OS profiles, sandbox planes, and operator-facing snapshots for long-running agents

Tagline (optional for the submission header)

Control flow in a Rust kernel. Real I/O in the host SDK. Agents that can fan out, verify, recover—and still be governed.

Built With

Share this project:

Updates