Rezyak — Durable Agent Operating System

A sovereign operating system for long-running AI work: models can fail, restart or change while threads, authority, artifacts and execution remain durable, inspectable and controllable.

Comment

Inspiration

Frontier models can write and reason remarkably well, but a model process is still ephemeral. It can hit capacity, lose a network connection, restart, compact its context, or be replaced by a different engine. Most agent products treat the surrounding chat or terminal as the source of truth. If the process fails at the wrong moment, nobody can reliably answer: Did the command start? Was a physical effect performed once, twice, or not at all? Which engine, host, user, and tenant were authorized? Can another client reconnect safely? Did cleanup finish?

Rezyak starts from a different premise:

Models are replaceable processes. Durable work, authority, evidence, and user control belong to the operating substrate.

The lineage behind Rezyak

Rezyak was not invented during one hackathon. It is where several generations of production engineering converged. syn-cms taught us to describe systems as data and derive reusable interfaces instead of rebuilding every application. Hades taught us the strength of an append-only event spine: preserve history, derive current state, and avoid silently rewriting what happened. Later Rezy Core systems added typed action boundaries, real-time interaction, deployment discipline, and long-running user continuity.

Rezyak compounds those lessons for AI agents: actions become the syscall surface; immutable cards and journals preserve causal history; views derive current state; persistent memory carries identity across sessions; and engines can change without becoming the source of truth. Each generation contributed a primitive, exposed a failure mode, and left a scar that became a guardrail in the next one. This public lineage intentionally excludes customer identities, production data, credentials, private infrastructure, and client-specific implementation details.

Existing project versus Build Week work

Rezyak existed before Build Week. This entry claims only the meaningful work added after the judging window opened on 2026-07-13 at 09:00 PDT. The pre-window boundary is commit 153a4aebbec48001b267a7d8a09fdbc09cd1cdae, committed at 2026-07-13 15:58:10 UTC.

Pre-existing foundation, not claimed as Build Week work: typed server actions and views; threads, cards, artifacts, and persistent memory; a React/Astro Admin surface; basic authentication and RBAC; private Preview infrastructure; and early local and cluster-agent experiments.

Build Week extension claimed by this entry: provider-neutral engine contracts and adapters; durable start/input/result/stop authority; response-loss reconciliation; a private cloud EngineHost controlled from Admin; typed provider blockers and semantic events; private, version-aware DigitalOcean Spaces storage through Core; immutable GitOps promotion; and synthetic isolation, recovery, cleanup, and fail-closed evidence tooling.

The private evaluation repository preserves this boundary and contains a sanitized source-and-test slice rather than presenting the pre-existing monorepo as new work.

The night the thesis was tested on us

On 2026-07-21 at roughly 04:51, mid-milestone, our primary engine—GPT-5.6 Sol running through OpenAI Codex—ran out of credits and stopped. In most agent setups that ends the run because the context, branches, and plan live in the dead process.

In Rezyak, the agent identity, memory, thread, and work state live in the substrate. A different vendor's engine resumed the same agent identity that morning, recovered the persisted context, fixed CI, merged Sol's final three in-flight branches in integration PR #824, and shipped the release to the private DigitalOcean Preview the same day.

The engine changed vendors. The work continued.

What we built

A canonical cloud EngineHost

Admin asks Core to start work. Core persists the operation and resolves the exact owner, tenant, thread, engine, model, placement, and EngineHost. A per-owner EngineHost connects outward to Core; it has no public Service or Ingress and receives no browser JWT, database credential, object-store key, Kubernetes API token, or internal god-secret.

Cloud and future native execution are placements of one authority model, not unrelated products. The current product release was promoted by immutable digest through GitOps.

Durable physical-effect authority

Physical work is journaled before it happens:

prepare → acquire exact authority → dispatching → written / rejected / uncertain

Each operation binds the authenticated owner and tenant, source thread/card, engine and placement, exact EngineHost installation and connection epoch, route/session identity, content hash and byte count, and signed command/result evidence. uncertain is not treated as safely retryable: when a crash may have happened around the write boundary, Rezyak quarantines and reconciles rather than risk duplicating the user's effect.

Provider-neutral events and typed blockers

The deployed Codex adapter projects engine-native output into a closed semantic-event contract. The provider-neutral vocabulary makes Claude and OpenCode explicit engine targets without pretending every engine is activated in this release; Preview cloud starts are deliberately Codex-only. Capacity, authentication failure, progress, completion, and output become typed state instead of terminal text. Recovery depends on effect state: a pre-effect failure may be retried under CAS; a started effect must reconcile the same session; an uncertain effect is quarantined.

Admin as a control surface, not an authority

The thread workspace requests cloud placement, presents lifecycle and delivery state, streams semantic output, and reconnects to durable server state after a refresh or restart. The browser does not own a PTY, provider credential, or execution journal. Every authoritative mutation is a typed server action with database-backed authorization.

Private, version-aware Library storage

Core is the browser byte plane. The bucket stays private: no browser credential, public ACL, presigned upload, or bucket-CORS dependency. Rezyak journals write intents and records the exact object VersionId so ambiguous writes and exact-version cleanup can be reconciled safely. Soft delete revokes access while retention or erasure remains an explicit policy decision.

Evidence as a release artifact

The final evidence materializer is deliberately fail-closed. It cross-checks source and deployment commits, immutable image digests, migration head, independent topology observations, fsynced progress logs, distinct recordings, cleanup, and absence of public application routes. It cannot turn a screenshot or self-authored JSON file into a green release.

Its submission-night exercise produced six PRs, #824–#829: one integration PR followed by five surgical fixes, each merged after green CI and deployed through pinned-digest GitOps. The exact deployed product source is aa2fcb3044eed051333cace00a75b0d7cce1c62c; its metadata-only deployment commit is 4e29e7f6d31619e5fc65b9b0f74adbbf95ba1a35.

The accepted external artifact is deliberately narrower than the private release evidence: a privacy-preserving minimal M1 behavior capsule, frozen at 41 regular files. Its archive is 246,510 bytes with SHA-256 77de18c9508e5c69d344173f0ac1a96eff95fa9de2024412d12faefab62f7c91; its external MANIFEST.json has SHA-256 f664552d884ff8351922580e36be026adc01472fe96c7def316e50d648c10142.

./verify.sh exits 0 with 115 Node tests (114 passed, 0 failed, one explicitly skipped optional PostgreSQL case) and 4/4 Python tests. The capsule also includes the complete 12-file non-tools production delta for inspection. It does not claim to reproduce live cluster deployment, migrations, real provider sessions, or database cleanup. Those private observations remain outside the export rather than being promoted into a public claim.

The film is part of the demonstration

The submission film, “The OS That Kept Working,” runs 168.140 seconds (2:48.140) and was assembled end-to-end by the Rezyak agent fleet on the substrate it depicts: script, synthesized narration, telemetry and evidence capture, Unreal scenes for the abstract system model, compositing, edit, and machine QC. Its narration explicitly names OpenAI Codex and GPT-5.6 Sol and uses the canonical submission-night count: six PRs, one integration, five surgical fixes. The final privacy-approved public bytes remain bound by SHA-256 a9e4942c825c32fe4f60f92ec26ceae1065740e0ae3f47359be342229c352d97 and size 179953785 until the last render is frozen. We are not only showing an agent operating system; the agents used it to manufacture the review surface.

How OpenAI Codex and GPT-5.6 were used

OpenAI Codex was the agentic engineering harness and execution environment. GPT-5.6 Sol was the primary reasoning and coding engine running through it. Together they operated inside Rezyak as a long-horizon engineering process rather than autocomplete:

  • decomposing the milestone into independently reviewable authority, runtime, storage, UI, and evidence slices;
  • implementing and testing TypeScript, SQL, React, Kubernetes, and Python changes;
  • running parallel adversarial reviews and rejecting false greens;
  • inspecting real PostgreSQL, GitOps, and Kubernetes state;
  • reproducing response-loss, concurrency, routing, and cleanup failures;
  • repairing those failures and carrying durable state into the next iteration;
  • preparing evidence and the submission's review surfaces.

Eduard retained product direction, policy, trust-boundary decisions, release boundaries, and final approval. On the final day a different vendor engine completed the interrupted handoff described above; the eligible delta remained overwhelmingly produced by Codex and GPT-5.6 Sol, while the handoff itself became an unplanned product demonstration.

What we learned

  1. A timeout is not evidence of absence.
  2. A connected socket is not authority.
  3. A green CI run is not runtime proof.
  4. A screenshot is not causal evidence.
  5. Context size is not continuity; persisted state plus active resurfacing is.
  6. Retry policy must depend on whether a physical effect may already have started.
  7. Agents can produce small-team throughput, but human review must move toward policy, invariants, adversarial tests, and executable assurance.

What's next

Milestone 2 adds the signed/notarized macOS app and native daemon so work can continue when the Desktop window closes while Admin controls the same durable thread through Core. Broader provider-account scheduling and an isolated high-speed synthetic test ring follow. These are next steps, not Build Week claims.

Built With

Share this project:

Updates