What Is This?

STEWARD is to AI agents what Linux is to processes.

Most "agent frameworks" are orchestration layers. STEWARD is a real operating system:

The key insight: An agent that "promises" to follow rules is insecure. An agent that physically cannot violate them is secure.

Quick Start

# Clone
git clone https://github.com/kimeisele/steward-protocol
cd steward-protocol

# Install
pip install -e ".[dev]"   # or: uv sync

# Boot the kernel
steward boot

# Check system status
steward status            # Kernel health, ledger blocks, certified agents
steward introspect        # Deep kernel inspection

What happens on first boot:

1. Initializes the immutable ledger (append-only event chain)
2. Loads 0 plugins via oath verification
3. Registers 1 agents with cryptographic identity
4. Starts the heartbeat system for liveness monitoring

The Kernel

This is a real kernel implementation (vibe_core/kernel_impl.py):

┌──────────────────────────────────────────────────────────────┐
│                      HUMAN OPERATOR                          │
│                    (Intent & Oversight)                      │
└──────────────────────────────────────────────────────────────┘
                              ↓ intent
┌──────────────────────────────────────────────────────────────┐
│                      VIBE KERNEL (L0)                        │
│                                                              │
│  • Process Table        • Task Scheduler (async)             │
│  • Immutable Ledger     • Hypervisor Kill-Switch             │
│  • Blueprint Protection • Constitutional Gate                │
│  • VFS Sandboxing       • Event Bus                          │
└──────────────────────────────────────────────────────────────┘
                              ↓ syscalls
┌──────────────────────────────────────────────────────────────┐
│                      THE FEDERATION                          │
│                                                              │
│      1 Certified Agents • 12 Capabilities              │
└──────────────────────────────────────────────────────────────┘

Core Components

Three-Layer State Model

The system maintains state across three distinct layers:

1. Physical Layer — Git + Ledger (immutable history, cryptographically linked)
2. Runtime Layer — Kernel state, ephemeral data (survives restart via snapshots)
3. Identity Layer — Agent personas, reputation, relationships (constant across restarts)

Constitutional Governance

Governance is enforced at the architecture level, not through prompts:

The Constitution (CONSTITUTION.md)

Operating Inversion (GAD-000)

Traditional model: Human operates machine. STEWARD model: AI operates system. Human provides intent.

# Human provides intent
steward opus:pending         # See what the system wants to do
steward opus:approve <id>    # Approve an intent
steward opus:reject <id>     # Reject with reason

# System operates autonomously within bounds
steward opus:karma           # See trust score evolution

Security Architecture

Hypervisor Kill-Switch

When an agent attempts to modify the constitution, escape its sandbox, or manipulate the ledger:

Threat Level:  GREEN → YELLOW → ORANGE → RED → CRITICAL
                                                   ↓
                                        Kill-switch activates
                                                   ↓
                                        Instant termination
                                        (Irreversible)

Self-Healing Architecture

• Blueprint Protocol: Critical kernel components stored as factories, not instances
• Immutable Sealing: Protected attributes locked after initialization
• Auto-Recovery: Corruption detected → rebuild from blueprint

Kernel File Protection

21 kernel files are cryptographically guarded. Pre-commit hooks prevent modification without explicit authorization.

Security Test Suite

The tests/hardening/ suite includes attack simulations:

The Federation

1 specialized agents form a self-governing federation:

CLI Reference

# System
steward boot                 # Initialize kernel
steward status               # Health check
steward introspect           # Deep kernel state
steward stop                 # Graceful shutdown

# Unified Execution
steward run <capability>     # Execute any tool/circuit/agent
steward run list             # Discover all capabilities

# Human-in-the-Loop
steward opus:pending         # Pending intents
steward opus:approve <id>    # Approve execution
steward opus:reject <id>     # Reject with reason

# Diagnostics
steward system:doctor        # Health diagnosis
steward agents:list          # Process table

Documentation

Testing

steward test:run             # Full test suite
pytest tests/hardening/ -v   # Security/architecture tests
pytest tests/manas/ -v       # Cognitive tests

3800 tests including red-team attack simulations.

Philosophy

"An agent that promises to follow rules is insecure. An agent that cannot violate them is trustworthy."

STEWARD redefines AGI as Artificial Governed Intelligence — autonomous systems with cryptographic accountability and constitutional constraints enforced at the kernel level.