Agentic Nexus Operating Layer & Interface System Architecture
A system software stack for AI Agents.
中文版 · Website · Get Started · User Guide · Contribute
ANOLISA is a multi-component system software stack for AI Agent workloads. Built on existing operating system kernels and infrastructure, it provides context management, Skills delivery, workspace recovery, security, and observability for Agent applications, frameworks and platforms. Users can carry out tasks in a native terminal that preserves a familiar Shell experience, and enable system-level optimizations for their Agents' runtime environments. Developers can extend the stack through AW's open architecture by integrating their own system software optimized for Agent workloads into ANOLISA.
ANOLISA vs. Agentic OS: Agentic OS describes a class of operating systems designed for AI Agent workloads. Our community takes a neutral and open approach to exploring this direction; ANOLISA is the core system software stack in the Agentic OS architecture we design.
ANOLISA offers three ways to get started: use a preinstalled image to experience the full capabilities of an Agentic OS; install the system software stack on an existing OS to extend it into an Agentic OS; or connect an existing Agent application, framework, or harness to enable configurable system-level optimizations.
In a ready-to-use preinstalled system environment, you can use familiar Shell workflows in cosh and call system tools and Skills through natural language. After installing and configuring the relevant components, you can also use Agent Semantic Layer capabilities such as context compression, workspace snapshots and recovery, security, and observability. Container base images provide a starting point for building your own Agent runtime environment.
The Images and cloud services catalog lists available images, their preinstalled software, download or pull addresses, and cloud service entry points. Vendors and community contributors can add image or cloud service entries and usage instructions to the catalog.
Developers of Agent platforms and Agent runtime infrastructure can preinstall ANOLISA packages in Agent, sandbox, or business images. See the base image catalog and package installation guide.
If you already run a supported Linux system, you can install ANOLISA's system software stack to add runtime capabilities for Agent workloads. You can install cosh, OS Skills, and the Agent Semantic Layer components you need, use cosh as the terminal entry point, and configure model access and the relevant services.
First read the installation guide to check platform requirements, then install the packages and configure the services. Follow the cosh first-use guide to begin using the terminal.
If you want to keep using an existing Agent application, framework, or harness, you can enable ANOLISA's headless system capabilities in its runtime environment through adapters and plugins. You can continue using the Agent's interface, model account, and workflow.
For the currently available workflow, see installation and adapter integration.
ANOLISA is a system software stack that enhances Agent applications, frameworks, and harnesses without replacing them.
When Agents plan tasks and call tools, they also need their runtime environments to provide context management, Skill discovery, action constraints, and execution records. ANOLISA improves an Agent's working environment in the following ways:
- Keep context for useful information. Tool output compression shortens lengthy results. Persistent memory lets Agents retrieve and reuse information across sessions, reducing repeated reads.
- Find system Skills for the task. Agents can consult OS instructions and discover and read the Skills they need for a task.
- Constrain actions and recover workspace changes. Security policies and underlying isolation mechanisms constrain Agent actions. Workspace snapshots let users inspect file changes and roll them back when needed.
- Understand how a task ran. You can inspect an Agent's model and tool calls, trajectories, and Token usage to investigate task failures and analyze runtime costs.
We welcome OS vendors and distribution communities to adopt and help develop ANOLISA, integrating it into existing distributions or incorporating it into their Agentic OS architecture from the outset.
Enterprise Agent governance platform developers and sandbox service providers can also preinstall ANOLISA in their runtime environments to provide context management, security, and observability for the Agent workloads they host.
agentsight-demo-en-ebpf-cover-1080p.mp4Observability: Observe an Agent run Inspect model and tool calls, execution trajectories, and Token usage. Reproduction guide |
tokenless-context-efficiency-hd.mp4Context compression: See tool output compression Try Tokenless and inspect tool output compression and changes in Token usage. Reproduction guide |
skill-ledger-demo-en-with-cover.mp4Security: Detect Skill file changes Use Qoder to check Skill file changes and inspect rescan results. Reproduction guide |
ANOLISA's components are organized into the User Entrypoint Layer, AW Unified Stack Layer, and Agent Semantic Layer. See the glossary for each layer's role.
| Component | What it adds |
|---|---|
| cosh (cosh-ng) | An AI-native terminal that preserves a familiar Shell experience, letting users call tools and Skills through natural language to complete tasks. |
| OS Skills | An OS handbook for AI Agents, covering system administration, monitoring, security, DevOps automation, and more. |
| Component | What it adds |
|---|---|
| AW | A unified architecture connecting Agent frameworks with extensible AI-native system software. |
| Component | What it adds |
|---|---|
| Tokenless | Reduce AI Agent Token usage through tool output compression, tool schema simplification, command rewriting, and other techniques. |
| Agent Memory | Store persistent memories that Agents can retrieve and reuse in later sessions. |
| SkillFS | Organize Skills into stable filesystem views for Agents to discover and read on demand. |
| Workspace Checkpoint (ws-ckpt) | Create Agent workspace snapshots so users can compare file differences and roll back changes when needed. |
| Agent Security Core | OS-level security kernel for AI Agents. |
| AgentSight | Observe Agent execution through trajectories, LLM calls, and Token usage. |
ANOLISA CLI manages component installation and lifecycle. ktuner inspects Linux kernel parameters, provides tuning recommendations, and can apply or roll back kernel parameter changes. See Installation for each component's supported platforms.
Within ANOLISA's AW Unified Stack Layer, AW connects Agents to the system software that supports them. Developers can build adapters for Agents that AW does not yet support, or create system software optimized for Agent workloads and expose its capabilities to ANOLISA through the Provider protocol. The existing Agent application or framework continues to manage its models, interface, and permissions.
AW currently integrates command safety checks and tool-content optimization, and can correlate AgentSight execution records through optional configuration. The existing operating system, kernel, and sandbox provide the underlying resources and isolation mechanisms. ANOLISA is designed for environments including AI PCs and cloud desktops, Agent applications and frameworks, Agent platforms, and Agent runtime infrastructure.
This example enables safety checks and context optimization in one configuration.
Before running it, follow AW installation
to install the Linux Preview version of aw-all-in-one and set AW_PREFIX and
PATH. Then start sec-core using the security backend setup.
CI packages require a Linux x86_64 system with glibc 2.39 or later. You also need
Qoder CLI 1.1.64 or later, installed and signed in.
Run the following commands as the user who normally runs Qoder to create a new
anolisa.yaml and start the Agent. The socket path below connects to the local
trial backend in the security guide. If you are connecting to another existing
security backend, set AW_SEC_SOCKET to that service's actual socket path.
export AW_HOME="$HOME/aw"
export AW_SEC_SOCKET=/run/aw-preview-sec/daemon.sock
install -d -m 700 "$AW_HOME" "$AW_HOME/workspace"
aw config init --prefix "$AW_PREFIX" \
--config "$AW_HOME/anolisa.yaml" --state-dir "$AW_HOME/anolisa-state" \
--qoder "$(command -v qodercli)" \
--provider sec-core+tokenless --socket "$AW_SEC_SOCKET"
aw validate --config "$AW_HOME/anolisa.yaml"
cd "$AW_HOME/workspace"
aw run --config "$AW_HOME/anolisa.yaml" --agent qoderFor tool calls covered by the configuration, sec-core performs safety checks
before the tool executes. After a tool succeeds, Tokenless attempts to compress
supported text results. Once the Agent has called a tool, open another terminal,
set the same PATH and AW_HOME as the terminal used to start the Agent, and run
the following commands to inspect execution records:
aw status --config "$AW_HOME/anolisa.yaml"
aw inspect --config "$AW_HOME/anolisa.yaml" --jsonAfter exiting the Agent, run aw stop --config "$AW_HOME/anolisa.yaml" to stop
the local AW service. Then stop the security backend with the command appropriate
to how you started it. See the AW user guide
for other Agent integrations, rule configuration, and observability integration.
Choose a guide for the integration you want to build:
- Agent and framework integration — learn how to connect AW to an Agent application's or framework's native execution flow.
- Provider development and protocol — learn how to expose your system software to ANOLISA through the Provider protocol.
- SDK guide — learn how to call component capabilities from application code.
| Goal | Start here |
|---|---|
| Install, configure, and use components | User Guide · Installation · Troubleshooting |
| Embed a component capability in an application | SDK guide |
| Connect an Agent or framework to AW | AW integration |
| Develop and distribute an AW Provider | Provider development and protocol · Provider implementations |
| Contribute to ANOLISA | Contribution guide · Component chapters |
The repository contains runtime components, distribution tooling, evaluation tools, and retained legacy implementations. When a component's source moves to another directory, its commands, package names, and release tags stay the same.
| Directory | Contents |
|---|---|
src/ |
Runtime components, including AW, cosh-ng, and components providing observability, security, memory, and sandbox capabilities. Each component keeps its own build and test entry points. |
providers/ |
AW Provider collaboration space. Each Provider implementation has its own workspace, examples, and contract tests. |
distribution/ |
Distribution tooling and images. anolisa/ owns the installation CLI, component manifests, and packaging resources; docker/ defines the integrated ANOLISA image. |
benchmark/ |
Cross-component evaluation runners: ClawEval, SWE, and Terminal Bench. Component-specific benchmarks stay with their components. |
deprecated/ |
Retained legacy implementations and their archived documentation. |
scripts/ |
Repository-wide build, packaging, and validation scripts. |
tests/ |
Repository-wide regression checks and test orchestration. Component tests remain local to each component. |
contribute/ |
Component contribution guides, linked from the contribution guide at the repository root. |
docs/ |
User and developer guides, source-build instructions, and shared documentation assets. |
specs/ |
Contribution standards, component onboarding, and documentation rules. |
website/ |
Public website source and generators. Generated output is not a second documentation source. |
.github/ |
CI, release workflows, component routing metadata, and ownership. |
Before changing files, read AGENTS.md for repository rules, component
locations, and build/test commands, then read the component's scoped AGENTS.md
when present. See CONTRIBUTING.md for the contribution workflow.
When moving source code, update .github/components.json and the paths used by
build, release, ownership configuration, and documentation entry points. Keep
the component's commands, package names, and release tags unchanged.
Scan with DingTalk to join the ANOLISA community.
- Open an issue if you encounter a problem or want the project to support a new Agent use case.
- Read CONTRIBUTING.md before submitting a pull request.
- Report vulnerabilities through the Security Policy.
ANOLISA is released under the Apache License 2.0.
User Guide · Troubleshooting · Build from Source · Changelog · For Agents
Security references for Agent Security Core: AARM registry entry (Aligned) · OWASP Agentic Top 10 control mapping.
Blaze has moved to its standalone repository, blaze-rs.
| Term | Meaning |
|---|---|
| ANOLISA | A multi-component system software stack for AI Agent workloads. |
| Agentic OS | A form of operating system designed for AI Agent workloads. |
| User Entrypoint Layer | cosh provides terminal interaction for users; OS Skills provides OS instructions for Agents. |
| AW Unified Stack Layer | AW connects Agent applications and frameworks above this layer with extensible system software below it. |
| Agent Semantic Layer | Components providing context management, memory, Skills delivery, workspace recovery, security, and observability. |
