AOS Community Edition is the open distribution of Unicity AOS, an agent operating system meant to give agents an inspectable, composable environment. It owns the Community Edition product surface: the aos command-line interface, an HTTP API, distribution manifests, first-party capsules, provider and model configuration, and Unicity Audit.
The installer places the aos command, its pinned runtime, and 21 Community Edition capsules under a product-owned ~/.aos root. aos init provisions from those local, product-versioned capsule assets and also runs offline, and re-running the installer performs a coordinated upgrade without rewriting a standalone runtime installation. Each release publishes checksums, Sigstore bundles, build-provenance attestations, and a runtime-compatibility.toml pinning the exact runtime release and WIT commit; a runtime-compatibility gate and an upgrade and self-heal gate must both pass before a tag can publish.
AOS owns its product command roots — init, status, migrate, update, distro, mcp, daemon, and serve-health — while every other runtime root passes through the CLI unchanged, arguments, exit codes, and signals included, so the supported surface stays aos . On Unix, aos daemon foreground replaces the AOS process with the bundled persistent daemon so a process supervisor keeps direct signal and exit-status ownership.
aos mcp serve is the shared Model Context Protocol edge. A client that supports MCP form elicitation keeps presenting its own constrained approval forms; when a client does not, the default --interaction auto mode uses a local decision surface — AppKit on macOS, a native Windows dialog, or Pinentry on Linux — that accepts only a single boolean or the fixed AOS approval enum. Arbitrary strings, password-shaped fields, and URL elicitations are never collected through it.
Capsules are general user-space building blocks that compose into harnesses, meta-harnesses, connectors, services, or other systems. Forge ships as construction tooling so a fresh agent can inspect the running system, learn the capsule model, identify a capability gap, and build and verify a least-privilege capsule. Forge also installs a meta-harness skill that treats an agent’s instructions, memory, skills, harness code, tools, capsules, traces, and evaluations as an improvable user-space world.
Features
- Single command surface: aos covers product roots such as init, status, migrate, update, distro, mcp, and daemon, with other runtime verbs passed through unchanged
- Pinned capsule set: 21 Community Edition capsules installed from local, product-versioned assets, including an offline aos init
- Forge: OS construction tooling that walks an agent from inspecting the running system to building and verifying a least-privilege capsule
- Meta-harness skill: instructions for building a governed meta-harness out of an agent’s own memory, skills, tools, traces, and evaluations
- MCP edge: aos mcp serve with client-side approval forms or a native local decision surface on macOS, Windows, and Linux
- Principal separation: provisioning with --principal and --target-principal keeps the authenticated operator distinct from the target environment
- Signed release channels: stable, dev, nightly, or an exact version, each fail-closed until its signed metadata is published
- Runtime import: a documented allowlist, integrity checks, and recovery behaviour for copying compatible state from a standalone runtime installation without changing the source
