The Linux that keeps the record.
Every change has a reason, a record, and a way back. On a Zethro machine that holds for a person and for an agent alike. Two products, one discipline. An operating system that explains its own lines, and a supervisor that gives agents rights which only ever narrow.
$ zc run --profile build.zon -- make
cell 7f3a paths: src rw, /usr ro net: none budget: 20 min, 4 GiB
cell 7f3a denied connect api.example.com:443 (no net capability)
cell 7f3a ended cause: exit 0 changed: 14 files ledger: 2,311 entries, sealed
$ zc diff 7f3a # what it wants to write to your tree
$ zc merge 7f3a # only after you have read it
$ zethro why /etc/ssh/sshd_config.d/zethro.conf
07-security HD-07, R-SEC-03 commit a89e5cc increment D05.1Two products, one discipline
Zethro OS
A Debian Linux distribution built from a specification. Every package, file and firewall line cites the requirement that put it there. Six-question installer, hardened by default, reproducible images, a signed repository, update with undo. Server and desktop editions. Zethro OS →
Zethro Core
A supervisor for agents. Each agent runs in a cell, with user and mount namespaces, Landlock, seccomp, cgroups. Its rights are capabilities handed down by its parent and narrowed, never widened. Everything it does goes into a hash-chained, signed ledger you can replay; its writes land in an overlay you merge after reading the diff. Zethro Core →
What the record gives you
Sandboxes keep agents in. Zethro tells you what they did, proves it, and lets you take it back.
A signed, replayable record
Every boundary crossing of a cell is an entry in a per-cell hash chain, sealed with Ed25519 and ML-DSA-65. Replay a ledger against a new model or policy and diff the outcome.
Rights that only narrow
A cell spawns sub-cells with a subset of its own capabilities, paths, exec, network, secrets, models and budgets. A request to hand down more is refused and recorded.
Nothing lands unseen
Writes go to the cell's overlay. zc diff shows them, and zc merge applies the hash you approved, only under paths the cell may write.
Limits as rights
CPU, memory, processes, wall time, network bytes, tokens and money are capabilities with a ceiling. The cell stops at exhaustion and the ledger names the cause.
A system that explains itself
zethro why answers for any file, package or port with the requirement, the rule, the commit and the increment that put it there.
A way back
Updates record what they replace and reverse on request. Cells roll back to any snapshot, fork from one, and are replayed from the ledger alone.
One seat for the whole machine
A panel in the terminal or the browser with the state of the host, disks, network, services, the last attestation, pending updates, and the same way of working you already have. Say what you want, see the plan, approve, watch it run, read the ledger line it left. Every action goes through a cell, so the panel is a client, never a second door.
Every agent on one page
A card per running cell with its name, host, task and a traffic light, green working, amber waiting for you, red stopped. Click one and its console is on the right, scrollable, with a box to answer it. Ten agents become a list, not ten windows.
Built the way it asks you to build
The specification comes before the code, the test before the implementation, and the evidence after. A lint refuses a line without a rule to cite. Every candidate image is installed and verified automatically, on both firmwares, with and without encryption, fresh and updated from the previous release, before a release is signed. Two images built from one commit are identical.
Core is written in Zig against the Debian kernel, links four C libraries from Debian packages and nothing else, and ships as one package. Its security chapter names thirty-three escape techniques; each one is a test that must fail inside a cell.
- Base
- Debian Linux, current stable release, amd64
- Language
- Zig 0.17, no Python, no shell in the product
- Isolation
- user, mount, pid, net, ipc, uts namespaces; Landlock ABI 6; seccomp; cgroup v2
- Signatures
- Ed25519 and ML-DSA-65 ledger seals; OpenPGP repository
- Network
- no route without a capability; relay with server-name checks
- Models
- local or remote, per role, keys never enter a cell
- Licence
- open source, both products
Who it is for
Engineers running agents
Give a coding agent your tree with write rights on one directory, no network, twenty minutes. Read the diff. Merge or drop.
Operators of fleets
Every host declares its state and attests to it. Drift is a diff, not a surprise. The ledger is the change record an auditor accepts.
Policy and compliance
"What did the agent do, under whose authority, and can it be reversed" has a signed answer, per action, without trusting the agent or the vendor.