OS Layer Runtime — aktuálna architektúra

Stav projektu

OS Layer Runtime je natívny runtime v Rust-e určený na spúšťanie capability modulov cez jednotné rozhranie.

Hlavná filozofia:

stdin -> capability process -> stdout

Runtime nerieši vnútornú logiku capability. Capability je samostatný proces, ktorý komunikuje textovým formátom.

Runtime zabezpečuje:

• discovery capability modulov

• validáciu manifestov

• registry capability

• policy kontrolu

• execution izoláciu

• timeout ochranu

• audit

• execution history

---

Architektúra

Aktuálny tok:

IPC request
     |
     v
 Runtime
     |
     +--> Policy
     |
     +--> Executor
              |
              v
        ExecutionContext
              |
              v
          Process
              |
              v
      capability binary/script
              |
              v
          stdout/stderr
              |
              v
       Response + EventLog

---

Capability systém

Capability je samostatný modul v root OS Layer.

Príklad:

os_layer/

├── ai/
├── mail/
├── crypto/
├── runtime/
├── tests/
└── ...

Každá capability obsahuje:

capability.meta

Manifest definuje:

• id

• name

• version

• entrypoint

• permissions

• risk

• plane

• audit

---

Discovery

Runtime pri štarte vykoná discovery:

discover("../../..")

Vyhľadáva adresáre obsahujúce:

capability.meta

Výstup:

[DISCOVERY] Some("mail")
[DISCOVERY] Some("crypto")
[DISCOVERY] Some("runtime")

Po nájdení:

[FOUND] 15 capabilities

Každá capability prejde validáciou:

• musí mať id

• musí mať version

• musí mať entrypoint

Neplatná capability:

[REJECT] missing version

---

Registry

Registry drží dostupné capability:

HashMap

Funkcie:

register()
get()
list()

Registry zabraňuje duplicitnej registrácii:

[SKIP] mail already registered

Aktuálny stav:

[READY] 15 capabilities loaded

---

IPC rozhranie

Runtime komunikuje cez Unix socket:

/tmp/os-runtime.sock

Request:

{
 "action":"execute",
 "capability":"mail",
 "entrypoint":"mail",
 "input":"accounts"
}

Response:

{
 "status":"ok",
 "capability":"mail",
 "entrypoint":"mail",
 "output":"..."
}

---

Executor

Executor:

1. nájde capability v registry

2. overí entrypoint

3. vytvorí ExecutionContext

4. spustí proces

Príklad:

[EXECUTOR] capability=mail version=1.0 entrypoint=mail

Zakázaný entrypoint:

Request:

{
 "capability":"ai",
 "entrypoint":"sleep"
}

Výsledok:

{
 "status":"error",
 "output":"entrypoint not allowed"
}

---

Process layer

Process layer vykonáva externý proces.

Podporuje:

• stdin

• stdout

• stderr

• exit code

• timeout

Model:

input
 |
stdin
 |
process
 |
stdout/stderr

Príklad:

echo accounts | mail

funguje rovnako cez runtime:

{
 "capability":"mail",
 "entrypoint":"mail",
 "input":"accounts"
}

---

Timeout ochrana

Každý execution má timeout.

Príklad:

tests timeout-test

Výsledok:

{
 "status":"error",
 "output":"process timeout after 2 seconds"
}

Runtime vie ukončiť zaseknutý proces.

---

ExecutionRecord

Každé spustenie vytvára záznam:

{
 "id":"exec-1783821234567890123",
 "timestamp":1783821234,
 "capability":"mail",
 "entrypoint":"mail",
 "status":"ok",
 "exit_code":0,
 "duration_ms":7
}

Execution ID používa nanosekundový timestamp:

exec-

aby nedochádzalo ku kolíziám.

---

Event log

Runtime zapisuje udalosti do:

runtime/state/events.jsonl

Formát:

{
 "id":"exec-1783821234567890123",
 "timestamp":1783821234,
 "capability":"mail",
 "entrypoint":"mail",
 "status":"ok",
 "exit_code":0,
 "duration_ms":7
}

JSONL formát umožňuje:

• streamovanie

• jednoduché parsovanie

• replay

• monitoring

---

Execution storage

Detail execution sa ukladá samostatne:

runtime/state/executions/

exec-xxx.json

Cieľ:

• debug

• replay

• história behov

• agent memory

---

Aktuálne moduly runtime

src/

main.rs

runtime.rs
    hlavný lifecycle

executor.rs
    execution orchestration

process.rs
    process isolation

context.rs
    execution context

registry.rs
    capability registry

manifest.rs
    capability metadata

discovery.rs
    auto discovery

policy.rs
    bezpečnostná kontrola

audit.rs
    audit hook

event.rs
    event stream

execution.rs
    execution record model

execution_store.rs
    persistent execution storage

---

Aktuálny stav

Hotové:

• capability discovery

• manifest validation

• registry

• IPC socket

• executor

• stdin/stdout model

• timeout isolation

• execution IDs

• event log

• execution history

---

Ďalšie plánované kroky

1. Runtime introspection capability

Príkazy:

runtime events
runtime executions
runtime inspect 

2. Registry management:

runtime list
runtime reload
runtime enable
runtime disable

3. Execution replay:

runtime replay exec-id

4. Planner/AG runtime napojenie:

planner
   |
   v
execution plan
   |
   v
runtime
   |
   v
capabilities

Runtime je pripravený fungovať ako základná execution vrstva pre agent systém.