Exostrate

The agent hypervisor

Ship autonomous AI like you ship containers: governed, isolated, and auditable.

Agents are powerful. They are also unbounded processes with API keys, network access, and behaviour you never fully specified. Exostrate is the control plane that makes agent autonomy safe to scale: a unified container, registry, and governance hypervisor that turns unpredictable agents into version-controlled, policy-bound, cryptographically-audited workloads.

One all-Rust core · local sandbox · Kubernetes · bare-metal KVM

Why now

The industry shipped agents without an operating system. Teams are duct-taping notebooks, cron jobs, and prod secrets into “agent infra” and hoping it holds.

Meanwhile the workloads exploded. Long-horizon reasoning, self-spawning swarms, and 24/7 autonomous services all need compute, isolation, memory, and guardrails that actually hold.

Containers had Docker. Clusters had Kubernetes. Agents have Exostrate.

The pitch in one breath

Package it. Push it. Lease it. Govern it.
One plane, fail-closed by default.

// 01 · author

Package

An agent becomes an ExoChart.

A versioned, templated bundle describing the agent: runtime, dependencies, code, and the policy it must run under. Our Helm, for agents.

// 02 · registry

Push

Provenance recorded, not promised.

Pushed to a Git-coupled registry that records an immutable content digest and its Git provenance. Content-addressed and traceable to the commit; byte-reproducible where build inputs are pinned.

// 03 · runtime

Lease

It runs inside an isolated box.

Leased into its own runtime with partitioned compute, encrypted persistence, default-deny networking, and a hard token budget. At TTL the box is torn down.

// 04 · trust

Govern

Every action watched, every action provable.

Watch it execute in real time, authorize every side-effecting move, prove every prompt and tool call against a tamper-evident ledger. Kill it instantly if it steps out of line.

The mental model

Exostrate treats an agent the way a container platform treats an image: a versioned, content-addressed artifact governed at every boundary it cannot bypass.

Containers had
Agents have
Docker image
ExoChart, the packaged agent
A container registry
ExoRegistry, Git-coupled and content-addressed
Kubernetes / a scheduler
The Exostrate control plane
A running container
A lease, a time-bounded and isolated runtime grant
What makes it unfair

Eight capabilities, each enforced at a boundary the agent cannot route around.

// 01 · ExoCharts

GitOps for agents.

A versioned, templated package for an entire agent: runtime, dependencies, policy, and code. `exo push` records an immutable content digest and its Git provenance, so a deployed agent is reproducible to the digest and traceable to the commit. Deploy like Helm; roll back like Git.

// ExoChart · ExoRegistry
// 02 · Every agentic method

Job, Service, Session, Batch, Workflow, Reactive, Swarm, Fleet.

Modes compose from primitives (spawn, fork, join, gate) into workflow DAGs, map-reduce joins, and best-of-N tournaments. Hierarchical budgets bound a swarm’s total spend at the root, so over-budget children are refused and a swarm can’t blow past its grant. Runaway loops hit the kill-switch.

// spawn · fork · join · gate
// 03 · Isolation

It assumes the agent is hostile.

Every lease ships with default-deny networking, encrypted persistence, dropped capabilities, read-only root, and cgroup-v2 limits, under a wall-clock deadline. Tiered by trust: first-party code runs under OS namespaces; untrusted code drops into a microVM or a confidential-computing TEE, its memory encrypted in use and admitted only after remote attestation.

// LeaseProvider seam
// 04 · The audit trail

Evidence-grade by design.

Every prompt, thought, tool call, and budget event is written to a tamper-evident, hash-chained ledger that detects tampering and reordering, supports deterministic replay of recorded execution from captured prompts, model outputs and tool results, and supports GDPR crypto-shredding without breaking the chain. Mapped to SOC 2, ISO 27001, HIPAA, GDPR, the EU AI Act, and the NIST AI RMF.

// hash-chained ledger
// 05 · Location-transparent access

One endpoint. The broker routes the rest.

Agents call one endpoint; the model broker routes to an in-cluster model or any external provider, Anthropic or OpenAI-compatible, with keys the agent never sees, token budgets it can’t exceed, and DLP that redacts sensitive data before it leaves the boundary. Tools and MCP servers cross the same chokepoint.

// model · tool · data brokers
// 06 · Live oversight

Govern the execution, not just the result.

The agent streams a structured transcript (think → plan → model → tool → observe → reflect) that the console renders live, while a per-action policy engine authorizes every side-effecting move. High-risk action routes to a human approval gate; prompt injection is screened inline.

// PDP / PEP · approval gate
// 07 · Durable execution

Exactly-once within transactional boundaries.

A per-run write-ahead journal gives exactly-once replay within supported transactional boundaries, and fencing tokens prevent split-brain double-runs. A Raft-replicated HA control plane, checkpoint/restore, and live migration are the stubbed backends behind it.

// journal · fencing tokens
// 08 · Sovereign-ready

Air-gapped, attestable, provable.

Air-gapped egress refusal and a multi-level-security (Bell-LaPadula) label lattice for classified estates, plus a compliance-control map. An enforced supply-chain gate (signature, attestation, SBOM/CVE) and attestation-gated key release run fail-closed. FIPS / post-quantum / HSM crypto is the stubbed backend.

// MLS lattice · supply-chain gate
Architecture

Six planes. One trust asymmetry.

The container boundary (egress, brokers, syscalls) is enforced outside the agent’s control and holds even against a hostile agent. The in-loop SDK streams the agent’s reported reasoning, but security never depends on its cooperation: if the SDK is absent or lying, the box still contains it.

// 01

Control plane

Render charts, run admission, schedule, and reconcile desired versus actual state.

// 02

Data / registry plane

Store ExoCharts as content-addressed artifacts with Git provenance.

// 03

Runtime plane

Provision the isolated box on a node and run the agent inside it.

// 04

Broker plane

The mandatory chokepoint for all outbound access to models, tools, and data.

// 05

Trust plane

Identity, access control, runtime guardrails, and the immutable audit ledger.

// 06

In-loop plane

A thin SDK/sidecar that streams the agent’s reported reasoning; advisory, never trusted.

Every stakeholder

The same plane, in each of their words.

Engineer
“Push an agent like a container, and it just runs: isolated, budgeted, observable.”
Security
“The agent is contained whether it cooperates or not. Fail-closed. Provable.”
Compliance
“Every action, immutably logged and replayable. Mapped to your frameworks.”
CFO
“Hard token and spend budgets, per agent, per tenant. No runaway bills.”
CTO
“The operating system for autonomous AI, across every cloud and your own metal.”
One core, many environments

The same ExoChart. The same governance. Only the driver changes.

Cloud, bare metal, and a laptop differ only behind four swappable seams: LeaseProvider, Registry, ModelProvider, and KeyProvider.

TargetRuntimePersistenceKeysRegistry
AWS / Azure KubernetesPod + NetworkPolicyEncrypted PVC (CSI + KMS)AWS KMS / Azure Key VaultECR / ACR
On-prem KVMFirecracker microVMdm-crypt + Ceph / iSCSIVault / HSMHarbor / zot
Dev / single hostcgroups + namespacesLocal encrypted volumeLocal keyLocal store
Who it’s for

Platform teams

Drowning in bespoke agent infra. One hypervisor, every workload.

Enterprise & regulated

Finance, healthcare, defense: compliance and control that pass audit.

Sovereign & classified

Air-gapped, attestable, provable operation end to end.

AI-native product teams

Ship swarms and long-horizon agents to production with guarantees, not hope.

What runs today

The full lifecycle runs on a single Linux host: package, push, admit, isolate, run a real agent under budget, watch it execute, intervene, and audit it.

Cloud-scale schedulers and hardware-security backends (Kubernetes-apply and Firecracker drivers, an external OCI registry, KMS/Vault/HSM, Raft-HA, TEE hardware validation) are factored out behind clean trait seams: the same core, a swapped implementation. Written entirely in Rust as one cargo workspace, Exostrate is explicit about the line between what is implemented and tested and the production seams stubbed behind a trait, so a technical reader knows exactly what to rely on.

The DSI stack

Two products, one platform.

Exostrate governs the agents themselves, packaging, isolating, budgeting, and auditing the runtime. Pathiqa governs how those agents reach an enterprise’s data. Together they close the loop from the runtime to the record, grounded in the same research programme.

// this product

Exostrate

The agent hypervisor. Ship autonomous agents like containers, governed, isolated, lease-bound, and cryptographically auditable across cloud and bare metal.

You are here
// product

Pathiqa

The infrastructure layer between AI agents and enterprise data. It resolves context, governs access, and records every action to an immutable ledger.

Explore Pathiqa →// research

Research

The formal foundations beneath both products: agent governance and control, proof-carrying authority, design and reliability, and organisational adoption.

Read the research →
Access

Fail-closed. Provable. Sovereign.

Exostrate is the operating system for autonomous AI. New engagements begin with a short briefing.

Request a briefing