Built from the kernel up.
Every permission is a capability — an unforgeable token derived from something you granted on purpose. There's no ambient authority to escalate into, and no sandbox wall to route around, because there's nothing outside the capability to escape to.
A heterogeneous scheduler places work across CPU, GPU, and NPU the way a kernel schedules threads. Agents run in parallel instead of queued behind each other, and a custom grammar engine keeps tool calls well-formed without slowing anything down.
Every agent, every model, everything the system has learned about how you work stays local — encrypted at rest, functional with no connection at all. Cloud models are a choice you make, never a dependency you inherit.