An AI-native operating system

The AI that knows you should belong to you.

ALINA OS boots into a conversation. A fleet of agents works across the whole machine, remembers with rules, acts where you can see it and submits to review by a model from another lab, on a NixOS system declared entirely in text. That runs every day now. Next, it becomes an always-on intelligence personal to one human, with your memory, authority and identity held by an OS you own.

Where it's going Watch the film · 4:31

DP-1

listeningalina · ready

wfplan-execute-verify|opus-5

loom5 harnesseslive

Three panels: a loom weaving violet threads, a crystalline lattice of blue facts, and a glowing field of neural filaments

The north star

Three memories. One self. Any model.

ALINA is growing a self the way people have one: episodic memory of everything it did (Loom, live), semantic memory of what is true (curated nightly by a council of three labs, live), and parametric memory of who you are, held in the weights of a personal model (Engram, in research). That model will call frontier models when it needs them, earn each role on your own work, and live at home on an ALINA box.

Read the vision The twelve-rung road

New · October 2026

Two projects that change who ALINA is for.

Until now, ALINA OS ran on one machine for one person, and each piece of work was stuck inside whichever agent app started it. These two projects remove both limits.

Super harness Ingest live Presence built

Loom: any harness picks up any session.

Claude Code and Claude Desktop, Codex CLI and Codex Desktop, pi, Antigravity and OpenClaw all feed one ledger that the operating system owns. From any of them, an agent can list, read, search and watch the others' threads live, and later take over where another one stopped.

How Loom works

Shareable NixOS Starter released

A teammate's laptop, from one command.

The configuration behind ALINA now splits into product, team and personal layers. One command generates a person's own flake with their identity, their encrypted secrets and their own sign-ins. The team's agents, skills and policy come in as a layer on top, unchanged.

How sharing works

Loom · the super harness

The session belongs to the OS, not the app.

A Claude thread can't be continued in Codex, and a Codex run is invisible to Claude. Loom moves session ownership down into the operating system. A thread becomes an OS object: an append-only ledger of what happened, a worktree, and a lease that records who is driving. The agent apps become lenses on it.

Full mesh, no hub. Each harness has one shuttle that translates it to a canonical schema, so every pair works without a pairwise translator. Loom never runs inside a harness, so removing one leaves the rest working.
Effects, not tool calls. The ledger records "this file changed by this diff" and "this command exited 1". Those mean the same thing in every harness.
Trust travels with the text. Web pages, tool output and relayed chat are tagged untrusted and quoted as data, never promoted to instructions in another harness.

loom · any terminal

$ loom ls
14:02  claude-code  312  release-gate review  ● turn
14:01  codex        677  sim tool in rust     desktop
13:58  pi            10  flaky test triage
13:40  openclaw      47  morning brief        → linked

$ loom search "pnpm hash"
codex   turn 14  the deps hash moved after the lock bump
claude  turn 3   "already tried this in Codex, turn 14"

Demo data. Commands and output format as shipped.

codex · following a claude threadLENS

tool loom_watch(thread, cursor)
✓ claude-code turn started
✓ file-change  modules/desktop/bar.nix  +12 −3
✓ command      nix build .#checks  exit 1
✓ claude-code turn ended

tool loom_post(thread, note)
→ "the check fails on the lock, not your diff"
  stored for the driver's next turn

MCP tools: loom_list · loom_read · loom_search · loom_watch · loom_post

How it works

Handing agents a whole computer only works if you can trust them.

So the system is organized around four questions: what it knows, how it acts, how its work gets checked, and what it runs on.

Interface panels on this page are drawn in the style of the desktop, with demo data.

01 · It knows

Memory with rules.

Persistent, partitioned memory. Every conversation is captured to a memory service shared by every agent and coding harness. Recall is scoped by audience: a private conversation stays private, and a request whose context can't be proven is refused.
A nightly Memory Council. Models from three different AI labs propose what becomes long-term knowledge, cross-examine each other, and a rotating judge decides.
No erasing. The curator can read everything and write shared knowledge, but it cannot delete records, including its own.

03:15 · Nightly memory council

Seat Afrontier model · lab one

Seat Bfrontier model · lab two

Seat Cfrontier model · lab three

adopted · judge rotates nightly · provenance: 3 seats

curator → delete own record · refused

02 · It acts

The desktop is an API.

A brokered compositor. Agents launch, focus, move and notify on the Hyprland desktop through a broker, not raw access.
Every window signed. Each agent works in its own workspace, and every window it opens carries its name and border color. You can tell at a glance who owns what is on screen.
Audited and bounded. Every desktop call is logged. When the session locks, the fleet drops to read-only.
Voice steers it. Interrupt in real time ("pause there, give me the short version") without losing any agent capability.

trim-report · simulink reviewFORGE

▸ trim sweep · 33/33 converged
▸ diff vs baseline · 2 blocks changed
▸ opened for review · workspace agent-forge

venue-brief · researchRECON

▸ 14 sources · 3 candidates
▸ summary drafted · awaiting read
▸ opened for review · workspace agent-recon

03 · It's checked

Review before action. Proof after.

Cross-model review first. Finished work isn't trusted by default. A model from a different lab reviews it, and the verdict plus the blast radius decide whether it lands, reversibly, or waits for a person.
The desktop stages the review. The artifact opens in the right application on the right monitor, with context loaded and an approve or request-changes control beside it.
Exact approval, then a receipt. Consequential actions are frozen as reviewed, need an approval for that exact action, run once, and leave a signed receipt. A replay is rejected.

Execution · receipt

action: publish release tag v0.4.0
approved: exact action · single use
executed: 1 action · 0 side effects
receipt: signed · 7b21…c0d4

replay rejected · approval already spent

04 · What it stands on

The whole machine is a diff.

Declared in one flake. Disk layout, desktop, services, agent configuration and policy are text in a NixOS flake.
Reviewable change. An agent's change to the OS is a diff that goes through the same review as any other work.
Atomic, with rollback. Rebuilds switch all at once, and the previous generation is one step away. That's why an AI can be trusted to reconfigure the OS: the OS itself can be reviewed.

agent change · awaiting reviewDIFF

--- a/modules/desktop/voice.nix
+++ b/modules/desktop/voice.nix
@@ services.voice-cockpit @@
   enable = true;
-  interrupt.minSilenceMs = 600;
+  interrupt.minSilenceMs = 350;
+  interrupt.keepAgentTools = true;

review   approved · cross-lab · reversible
switch   generation 412 → 413
rollback one step away

The agent fleet

Specialists, not one assistant doing everything.

ALINA runs on an OpenClaw control plane: specialist agents with their own workspaces and durable memory, workflow profiles, model routing across providers, and channels that reach you wherever you are.

ALINAThe resident assistant and front door

ATLASStrategy and planning across dependencies

ORACLEHolds a whole corpus in context at once

MODELERMATLAB and Simulink, validation first

MUSECreative direction and copy

HERALDPublishing and distribution

STUDIOReview-gated video production

SPECTEROffensive security, scoped and reported

DISSECTReverse engineering, evidence first

NEXUSNetwork design, packet-level precise

LEDGERFinance and portfolio analysis

LIFELINEEmergency recovery when the rest is down

Channels

Desktop voice and the status bar, the web Control UI, an iPhone app, Slack, Discord, and a self-hosted Buzz relay over Nostr.

Models

Claude, GPT, Gemini, Kimi and Qwen, routed per agent and per workflow, with fallbacks across providers.

Workflows

Profiles such as plan-execute-verify, review council and chain-of-verification, chosen per session by you, not by the agent.

Dark Factory

Autonomous work that fails closed.

The Dark Factory takes an issue from the work board and carries it to done with no person in the loop, but only if every step can prove itself. If anything can't be accounted for, the run stops and stays stopped.

Issue ready

The controller picks a Linear issue marked Ready.

Worker

A model from one lab builds it in an isolated workspace.

Reviewer

A model from a different lab reviews it and returns a verdict.

Proof packet

Commit, tests and token accounting, sealed. What was deployed must match the source.

Done

The issue closes itself. A missing proof blocks the run instead.

Phase 0 passed on October 14. A real issue went from Ready to Done on its own: the worker succeeded on its first attempt, a reviewer from another lab approved it, five tests passed, and the proof packet verified.

Built like a system

Not a wrapper around a chat window.

290×less CPU after the status view moved from a polling script to an event-driven native daemon. Display went from ~45 s stale to live.

5agent harnesses in one OS-owned session ledger, paired through one schema.

3AI labs on the nightly Memory Council, so no one vendor decides what is remembered.

1compile per OpenClaw release, built in CI and cached for every machine, instead of three or four local builds.

Agentic DesktopHyprland compositor and Quickshell status islands. Resident daemons keep open sockets instead of polling. Agent lanes, signed windows, audit log.

Loom newOS-owned session ledger. Every harness is a lens on every thread, with provenance on every event.

OpenClaw control planeThe agent fleet, workflow profiles, model routing across providers, and chat and voice channels.

Shared memoryAudience-partitioned recall that fails closed, and nightly multi-lab promotion into long-term knowledge.

Verified harnessCross-model review, blast-radius routing, frozen artifacts, exact-action approval, receipts, replay rejection.

NixOS substrate now layeredEverything above declared in flakes: product, team and personal layers. Encrypted secrets, snapshot-backed state, atomic rebuilds, one-step rollback.

The film

Four and a half minutes, start to finish.

One spoken request becomes a plan with context, steps and a gated action, then a review, an approval, and a receipt. Synthetic demo data throughout.

Play · 4:31

In the open

The parts other people can use today.

The full ALINA OS source is private while the public distribution is separated from personal configuration, which the layered NixOS work above exists to make possible. These pieces are public now.

openclaw-nix

Current OpenClaw releases on Nix: source-built gateway, NixOS and Home Manager modules, the teammate starter and doctor.

engram

Research: a language model whose memory lives in the network, consolidated during sleep into per-user adapters.

linux-voice-cockpit

A typed, headless voice control plane connecting browser audio, realtime sessions and agent tools.

buzz-openclaw

OpenClaw channel integration for self-hosted Buzz relays over Nostr.

agent-installer

Agent-assisted Linux live installer with shared onboarding and Arch and NixOS adapters.

alinaos-showcase

The film, screenshots and architecture overview.

An operating system that earns the access it has.

ALINA OS is in daily use as a working system, not a demo. Follow the build, or talk to us about running it with your team.

Follow on GitHub Talk to ControlStackAI

The AI that knows you should belong to you.

Three memories. One self. Any model.

Two projects that change who ALINA is for.

Loom: any harness picks up any session.

A teammate's laptop, from one command.

The session belongs to the OS, not the app.

The whole machine is text. Now a team can share it.

Handing agents a whole computer only works if you can trust them.

Memory with rules.

The desktop is an API.

Review before action. Proof after.

The whole machine is a diff.

Specialists, not one assistant doing everything.

Autonomous work that fails closed.

Issue ready

Worker

Reviewer

Proof packet

Done

Not a wrapper around a chat window.

Four and a half minutes, start to finish.

The parts other people can use today.

An operating system that earns the access it has.