Veda: The Agentic-Native Operating System

Veda is an operating system with a voice agent built in. Say "Hey Veda, switch my wallpaper to the dunes" and it does the work in any application, through the same code as your keyboard and mouse. It asks you first before anything that is hard to undo.

The system is written in Rust and lives in this repository: the UEFI bootloader, a capability-based microkernel, the system services, the window system, the toolkit and the applications. Where a proven, widely used library exists, Veda uses it rather than its own: TCP/IP, TLS and cryptography (smoltcp, rustls, RustCrypto), image codecs (zune, qoi, fast_image_resize) and math (libm, glam, rand). Veda runs on x86-64 PCs and in QEMU.

Why agentic-native

Operating systems were designed for a person at a keyboard. An assistant added later has to read the screen, imitate clicks or use the few applications that have an API, and the system cannot hold it to anything. In Veda, the agent is a first-class user of the system:

• Part of the system. The agent is a system service, started at boot and restarted if it fails. It sleeps until you say its name, click the ring on the taskbar or press Super+Space.
• Native in every application. Applications declare their actions (typed parameters and a risk level) and report what they show as JSON. The agent calls those actions, which run the same code as the keyboard and mouse: no screen scraping, no simulated clicks. The built-in applications offer more than 100 actions.
• Consent enforced by the system. Every action is routine, sensitive or destructive. The agent service, not the language model, holds the last two until you allow them. Only the desktop shell can answer (init tells every service which program is calling), so nothing the agent reads in a document can approve anything.
• Real context. Each conversation starts with the time, the open windows, every application's actions, what the agent knows about you and how your last conversation ended. Before acting, it reads the applications' current state.
• Memory you control. It remembers only what you tell it plainly (your name, the people in your life, how you like things done), never its own guesses. The memory stays on your computer, and Settings shows and forgets any part of it.
• Voice first. You can interrupt it at any time. Echo cancellation and an echo gate keep it from hearing itself, and other sound drops 20 dB during a conversation. Asleep, it listens with a voice detector that runs locally, so no audio leaves the computer while nobody speaks.
• The intelligence is a setting. Speech recognition, the language model and the voice come from Deepgram's Voice Agent API, with the audio opted out of Deepgram's model improvement. The model (OpenAI's gpt-4.1-mini by default), the voice and even the agent's name are chosen in Settings.

How the agent works

1. Listening. Asleep, the agent runs a voice detector on the computer. Speech it hears goes to Deepgram's recogniser, with the agent's name as a key term. A sentence that starts or ends with the name ("Hey Veda, …", "…, Veda?") wakes the agent, and the rest of the sentence is its first request.
2. Conversation. Waking opens a Deepgram Voice Agent session with the agent's instructions, context and functions. Deepgram handles turn-taking, the language model and the voice; Veda's audio service carries the sound both ways.
3. Action. The model calls the agent's 17 functions (windows, files, volume, Wi-Fi, wallpaper, notifications, timers and reminders, memory, the system and its programs) and, through use_app and read_app, every application's actions and state. Each call returns a structured result.
4. Consent. A call that needs your OK waits in the agent's window, or in a notification, saying exactly what will happen and to what. It runs only if you allow it within three minutes. Sensitive actions can be allowed for good; destructive ones are asked about every time.

The agent covers the design in full: the protocols, the voice pipeline, consent, memory and testing.

The operating system

• Microkernel. vkernel handles only isolation, scheduling, memory and IPC: capability handles with rights, channels that carry messages and handles, VMOs, events, futexes and interrupt objects. It supports SMP with x2APIC, tickless timers and XSAVE.
• Supervised services. Drivers, the file system, the window system, audio, networking and the agent are user-space processes. init restarts the window system, the shell, audio, networking and the agent if they crash, so the desktop comes back on its own.
• Linux's drivers in a VM. Veda drives only its disks (virtio-blk, AHCI, NVMe). Linux drives everything else in the driver VM, on Veda's own hypervisor (VMX with EPT, no emulated hardware). Devices go to it whole, their DMA confined and their interrupts remapped by Veda's IOMMU driver. A crashed driver takes down only the VM, which Veda resets and restarts. See the driver VM.
• Desktop. A compositing window manager with server-side decorations, shadows, animations, snapping and an Alt+Tab switcher with live thumbnails. It composes on the GPU with Intel graphics and on the processor elsewhere; once Linux drives the display, every frame is flipped whole at the vertical blank. The shell has a taskbar, a searchable start menu, desktop icons, a calendar and notifications.
• Toolkit. vui is an immediate-mode toolkit: widgets, menus, dialogs, vector icons and anti-aliased text in Inter and JetBrains Mono. Every vui application is agent-compatible.
• 3D graphics. OpenGL ES 3.0 with GLSL ES 1.00 and 3.00, in Rust (vgl, vglsl), every call checked as the specification requires. It renders on the GPU through Mesa in the driver VM (Intel's iris; virgl on the host's GPU under QEMU), or on a multi-threaded software renderer. Interceptor shows it off, full screen: a bay city with its traffic, physically based lighting, shadows, bloom and 4x multisampling.
• Networking. A network service with IPv4 and IPv6, DHCP, DNS, TCP, UDP and ICMP, and a Wi-Fi service that joins WPA2, WPA3 and open networks with management frame protection, remembers them, reconnects and roams. Linux's drivers only move frames and never see a password. Applications get TLS 1.3 and 1.2 from vtls, with certificates checked against Mozilla's roots. See Networking.
• Audio. A mixing service with echo-cancelled recording and ducking, built for the agent's conversations as much as for music.
• Video. FFmpeg and dav1d, ported to Veda, decode the common formats (AV1, VP9, H.264, HEVC and more) in a sandboxed process that reaches nothing but the file it is given: a damaged file that crashes or hangs it costs a moment, not the video. Pictures come through shared memory and are shown in time with the sound, timed to the screen's refresh. See Architecture.
• Storage. The home directory has its own disk. It is saved half a second after changes stop, alternating between two checksummed slots, so an interrupted save never damages the previous one. The agent's memory and key live in a private directory that only the agent can open.
• C and GCC. The image includes GCC 16, binutils and musl: write a C program in the Terminal, compile it and run it, in QEMU or on a PC. C programs are static executables whose system calls go to vposix, a POSIX layer in Rust. A cross compiler also builds C and C++ programs for Veda on the development machine. See C on Veda.
• Rust's standard library. The toolchain builds Rust from its release, with Veda among the compiler's targets: programs that use the standard library (threads, files, processes, panics with backtraces) run on Veda, where it stands on the C library. See Rust on Veda.

Screenshots