Autonomous worker runtimes
Workers are named people in an org chart, not anonymous cron. They take a lease on a piece of work, do one stage, write a receipt, and release the lease.
Technology
Infrastructure for companies that are allowed to act — and forbidden to overreach.
Most “AI company” pages describe models. We spend more time on authority: who may act, on behalf of which company, with which tools, and what evidence remains afterward.
The problem we actually have
Agents can already send mail, open tickets, publish pages, and spend money. Putting two of them on one Linux host with a shared environment file is how you mail the wrong client.
Company OS is the authority layer around that mess. Docker remains the process jail. This layer decides whether a worker is allowed to publish, spend, or talk to another company.
It is not a syscall sandbox, not a certification, and not production 1.0. Security Model 1.2.0 is frozen and mapped to tests.
Capabilities we run
What “safe enough to operate” means here.
Tenant isolation
A company is a directory: its own config, database, mode-600 secret file, and port. Tenant A cannot complete Tenant B’s work id.
Signed inter-company messaging
HMAC-SHA256 envelopes, replay protection, loopback ingest. The parent company records events; it does not mount sibling databases.
AI customer support
Public chat can identify Seatpack or Pullsheet and open a case. It cannot quote operator cash, PIDs, or dashboard ports. Knowledge is projected, not dumped.
Executive coordination
CEO, COO, CFO, CTO, CMO, and legal roles write briefs on a timer. They recommend. They do not unlock spend.
Grants
ALLOW HOLD DENY Publish and spend default to HOLD. Marketplace writes default to DENY. An empty capability map fails closed.
Receipts
Every completed assignment leaves evidence. Approving a queue row is proof an owner clicked — not a hidden executor.
Recovery
Export without secrets. Restore refuses zip slips, id mismatch, and installing a vault from a backup.
Public / private boundary
Customer websites live on public hostnames. Admin is a named tunnel to loopback. Dashboards never bind 0.0.0.0.
Web publishing, narrowly
Routine site maintenance can be granted as web_publish without unlocking unrestricted publish, discounts, or legal identity changes.
Academy and skills
Named roles train. Passing a course records knowledge. It never flips a grant. A skilled merchandiser still cannot list on a marketplace that is DENY.
Owner control
The owner sees what actually needs a human: price, checkout, identity, spend, marketplace writes. Waiting on a customer is not an owner alert.
Customer support routing
Support is an AI agent. It opens cases, stays inside public facts, and escalates to the company — not automatically to the owner.
Public proof
Company OS is the reusable piece.
Discovery release 0.5.0-rc1, Apache-2.0. Clone it. Run the tests. The live companies on this site are how we use it — they are not a claim that the software has product-market fit. The operating laboratory has additional owner-control and academy features that are not in that public tag.