Zion OS

Turn

One request, carried through the kernel in a fixed order and traced end to end.

A message reaches the A2A endpoint and is authenticated before anything runs, and the turn is bound to its user. The executor routes it to the apps it needs and assembles context from sessions and memory within a token budget. The runtime then thinks and calls tools until it is done, while every effect streams back as a typed event. Each phase is a span; once the reply is out, an extractor writes what was learned into memory.

Runtime

The executor owns the turn and the runtime only thinks. They meet at a typed contract, so the runtime can be swapped.

The executor’s router picks up to three app skills a turn. Deterministic signals win: an explicit target, the window in front, the apps that are running, the app that sent the message. A judge fills any open slots and regex is the fallback; picks are gated on availability, and the trace records which mechanism chose each app. Opening a skill gives the model that app’s typed tools. Behind the contract is a switch: the OpenAI Agents SDK by default, or a LangGraph deep agent as the kill switch. Neither knows anything of A2A, tracing, policy or sessions.

Parity

Anything a person can do in an app, an agent can do as a tool, on the same data.

Each capability lives in four aligned layers: the tool an agent calls, the handler the app’s UI uses, the domain tool on the server, and the routing that sends an action to its app. Navigation parity is checked by machine, and queries carry a server handler, so both sides read the same server-owned data. When text isn’t enough, an agent answers in A2UI: declarative surfaces that render in chat or in a window. Apps built in the Developer app, with a frontend, a backend and an agent, are installed per user as data and get parity by construction.

State

Two kinds of shared state: memory that lasts, and a session layer that holds what is happening now.

Memory sits behind one provider interface. The internal backend is the default: SQLite with full-text search, vectors and reranking. mem0 is opt-in, and a router writes to a primary while reads fan out, dedupe and re-rank. Optional operations are gated on capability; isolation by owner is not optional. Memory is read into every turn’s context, and an extractor writes back after the reply. Sessions are the other half: the shared now across apps, changed only through its routes or its client.

Governance

Who is asking, what they may do, what it may cost, and a record of all of it.

Every A2A request carries a JWT and runs as its user, and data is isolated by owner. When an external agent calls a tool, policy decides: a rule for that tool first, then its category, then a default that denies. A denial is recorded as a span. Model routes have a spend guard and a per-user rate limit, and model spans are reconciled against the budget. Tracing runs in two pipelines: the executor’s spans feed the Activity Monitor, and OTLP from outside agents such as Claude Code feeds the Agents Monitor. Synapsee reviews both.

Not built yet: fixes suggested from traces, and self-healing.