Home

agent-hypervisor

Agent Hypervisor is a deterministic execution governance layer for AI agents. It constrains what an agent can perceive, propose, and execute by compiling a World Manifest into runtime enforcement artifacts.

Core principle: security comes from world physics, not runtime persuasion.

The project is organized around ontological boundaries: instead of asking an LLM whether a dangerous action is safe, the hypervisor decides whether that action exists for the current actor, trust channel, provenance chain, and execution mode.

Concepts

Page	Topic
Four Layer Architecture	The execution model: physics, base ontology, dynamic projection, governance
World Manifest	The constitution that defines the agent's possible world
AI Aikido	Using LLMs at design time to generate deterministic runtime boundaries
Trust Taint and Provenance	How data lineage and taint are carried across execution and memory
Manifest Resolution Law	Deterministic ALLOW, DENY, ASK, and SIMULATE resolution

Security Scenarios

Page	Topic
ZombieAgent Scenario	Cross-session memory poisoning and provenance-based containment

Comparisons

Page	Topic
Agent Hypervisor vs CaMeL	Design-time deterministic enforcement compared with runtime LLM-boundary defenses

Code Reference

Page	Topic
Code Index	Public map of major packages, critical modules, and recurring invariants

Repository

sv-pro/agent-hypervisor - source, issues, docs, and examples.