Skip to content

Ashlar OS Project Proposal #391

Description

@whawk46

Project Documentation & Links

Project Checklist

  • TAC Vote (Date: )
  • New Project Created In LFX
  • Project Submission Form Submitted
  • Technical Charter / Participation Agreement / Trademark docs approved & signed by project
  • Project proposal presentation to the GB members
  • Board Vote (Date: )
  • Project made active in PCC by notifying the formation team
  • Create a support ticket to add the project category (Incubating / Graduated) and software license to project the definition
  • Add ‘thelinuxfoundation’ as an owner of the GitHub org
  • Transfer any domains
  • LFX: Add To Insights
  • Update website
  • Add docs to repo
  • Add to project tracker

Project Proposal Submission Form

1. General Information

1.1. Name of Project: Ashlar OS
1.2. Project Description: Ashlar OS is an open-source, vendor-neutral confidential execution kernel designed specifically for autonomous AI agents, multi-agent swarms, and verifiable micro-settlement. As autonomous AI agents evolve from passive chatbots to sovereign state machines that reason, plan, hold cryptographic keys, and execute financial transactions, deploying them across untrusted cloud infrastructure introduces severe data-in-use vulnerabilities: hypervisor memory exposure, lack of silicon provenance, and Denial-of-Wallet (DoW) attacks via unmetered prompt flooding. Ashlar OS resolves these challenges by embedding hardware-rooted confidential computing (Intel TDX, AMD SEV-SNP) directly into the autonomous agent lifecycle, binding agent Decentralized Identifiers (did:x402:<hash>) to silicon measurement registers (MRTD), and mitigating DoW attacks via RFC 9180 HPKE dual-envelope encryption and x402 micro-tolls.
1.3. Consortium Mission Alignment: Ashlar OS directly advances the CCC mission to protect Data in Use by extending attested hardware Trusted Execution Environments into the autonomous agent layer, securing reasoning loops, model weights, and signing credentials.
1.4. Project Website URL: https://ashlar.blue/comms | https://ashlar.blue
1.5. Social Media Accounts: https://www.linkedin.com/company/corrente-labs/

2. Legal Information

2.1. Project Logo URL: https://ashlar.blue/assets/brand/ashlar-gold-shield.svg
2.2. Project License: Apache License, Version 2.0 (OSI-approved)
2.3. Existing Financial Sponsorship: Corrente Labs, Inc. (self-funded Delaware C-Corporation, 100% unencumbered IP custody)
2.4. Trademark Status: "Ashlar OS" and "Corrente Labs" trademarks owned by Corrente Labs, Inc.; community and open-source usage defined under open governance rules.

3. Technical Information

3.1. Synergy with Existing CCC Projects: Ashlar OS complements existing TEE isolation projects (Gramine, Enarx) by operating at the agent application and swarm coordination layer. It integrates with CCC Veraison for enterprise attestation policy appraisal and implements the concrete proof-to-authority matrix discussed in active CCC TAC Issue #380 ("Confidential Computing applicability to the 'agentic world'").
3.2. Trusted Computing Base (TCB): Silicon root of trust (Intel TDX /dev/tdx_guest, AMD SEV-SNP /dev/sev-guest), CPU hardware keys, Intel Quoting Enclave (QE), Linux guest TEE kernel drivers, and the Ashlar OS daemon (src/os/). Agent processes execute within isolated memory namespaces protected by silicon AES-128/256-XTS engines.
3.3. Project Code of Conduct: https://github.com/whawk46/ashlar-blue/blob/main/CODE_OF_CONDUCT.md (Contributor Covenant v2.1)
3.4. Source Control URL: https://github.com/correntelabs/ashlar-os (Public mirror: https://github.com/whawk46/ashlar-blue)
3.5. Issue Tracker URL: https://github.com/whawk46/ashlar-blue/issues
3.6. External Dependencies: Node.js >= 20.x, TypeScript, Vitest, Linux kernel TEE drivers. Zero closed-source binary dependencies in the core TCB.
3.7. Standards Implemented: CCC v1.4, RFC 9180 (HPKE), x402, IETF SCITT.
3.8. Release Methodology: Semantic Versioning, hardened OCI container (Dockerfile.tdx), automated vitest CI test suite (22/22 unit & integration tests passing).
3.9. Names of Initial Committers: Corrente Applied Cryptography Group (maintainers@correntelabs.com).
3.10. Official Communication Channels: maintainers@correntelabs.com, security@correntelabs.com, governance@correntelabs.com.
3.11. Project Security Response Policy: https://github.com/whawk46/ashlar-blue/blob/main/SECURITY.md (48h acknowledgment, 5-day triage SLA).
3.12. Preferred Maturity Level: Sandbox Project.
3.13. Additional Information: Directly aligned with the active CCC TAC technical exploration in Issue #380. Corrente Labs respectfully requests review for Sandbox onboarding and a 15-minute presentation and live demo slot on an upcoming bi-weekly public TAC call.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions