Veda 发布首个智能体原生操作系统：Rust 微内核集成 AI 代理实现全系统级自然语言操控

Veda: The Agentic-Native Operating System

Veda is an operating system with an AI agent built into it — not an assistant added to a desktop, but a part of the system that every application is made to work with. You talk to it the way you would talk to someone in the room — "Hey Veda, switch my wallpaper to the dunes" — and it does the work through the same operations as your keyboard and mouse, in any application, and asks you before anything that is hard to undo.

Everything is written from scratch in Rust and lives in this repository: the UEFI bootloader, a capability-based microkernel, the drivers, the system services, the window system, the toolkit and the applications. A few mature crates provide the TCP/IP engine, TLS and cryptography (smoltcp, rustls, RustCrypto). Veda runs on x86-64 PCs and in QEMU.

Why agentic-native

Operating systems were designed for a person at a keyboard. An assistant added to one later usually has to read the screen, imitate clicks or make do with the few applications that offer an API, and the system has no say in what it does. Veda turns this around: the agent is a first-class user of the system, and the system is built so that its work is reliable, visible and safe.

• The agent is part of the system. It is a system service, started at boot and restarted if it fails, present as a small ring on the taskbar and asleep until you call it — by its name, with a click on the ring or with Super+Space.
• Every application speaks to it natively. Agent support is part of the application platform: an application describes its actions, with typed parameters and a risk level, reports what it shows as structured state, and carries out actions through the same code as the keyboard and mouse — so the window shows the result exactly as if you had done it. No screen scraping, no simulated clicks. The built-in applications offer more than 70 actions between them, from writing in a document to starting a race.
• The system holds the agent to your consent. Every action is routine, sensitive or destructive. Routine actions just happen; the others wait for your OK. The agent service enforces this, not the language model: the call is held until you answer, only the desktop shell can answer (the system knows each program by the identity init attaches to its connections), and nothing the agent reads in a document or an application can approve anything.
• It works from real context. Every conversation starts with what the agent needs to help: the time, the windows on the screen, every application's actions, what you have told it about yourself and how your last conversation ended. While it works it reads the applications' state, so it acts on what is really there.
• Your memory stays yours. It remembers what you tell it plainly — your name, the people in your life, how you like things done — never its own guesses. That memory is kept on your computer, and Settings shows all of it and forgets any of it.
• Voice comes first. Conversations happen in real time: interrupt the agent and it stops and listens. The audio system is built for it — echo cancellation and an echo gate so that the agent never hears itself, and other sound turned down while it talks with you. While it sleeps, a voice detector on the computer listens for speech, so that nothing leaves the computer while nobody speaks.
• The intelligence is a setting. Speech recognition, the language model and the voice come from Deepgram's Voice Agent platform, with the audio opted out of Deepgram's model improvement; the model, the voice and even the agent's name are chosen in Settings.

How the agent works

 ┌───────────────────────────────────────────────────────────────────────┐
 │ You: voice, keyboard, mouse                                           │
 ├───────────────────────────────────┬───────────────────────────────────┤
 │ Agent service                     │ Desktop shell                     │
 │  conversation (Deepgram Voice     │  the ring and the agent's window  │
 │  Agent) · name listener · memory  │  consent requests · notifications │
 │  worker: functions and consent    │                                   │
 ├───────────────────────────────────┴───────────────────────────────────┤
 │ Applications: actions · state · invoke (the agentapp protocol)        │
 ├───────────────────────────────────────────────────────────────────────┤
 │ Services: windows · files · audio · network · Wi-Fi · launcher        │
 ├───────────────────────────────────────────────────────────────────────┤
 │ vkernel: capabilities · IPC · isolation · scheduling                  │
 └───────────────────────────────────────────────────────────────────────┘

1. Listening. Asleep, the agent runs a voice detector on the computer. When someone speaks, the speech goes to a recogniser that knows the agent's name; a sentence that calls it ("Hey Veda, …", "…, Veda?") wakes it, and what was said with the name is the first thing it hears.
2. Conversation. Waking opens a Deepgram Voice Agent session with the agent's instructions, the context above and its functions. Deepgram takes care of turn-taking, the language model and the voice; Veda's audio service carries the sound both ways.
3. Action. The model calls the agent's own functions — windows, files, volume, Wi-Fi, wallpaper, notifications, timers and reminders, memory, the system and its running programs — and, through use_app and read_app, every application's actions and state. The agent service runs each call and answers with a structured result.
4. Consent. A call that needs your OK is held and shown in the agent's window (or as a notification while the window is closed), saying exactly what will happen and to what. Allow it and it runs; decline it, or let it expire, and it does not. Sensitive actions can be allowed for good; destructive ones are asked about every time.

The agent describes the design in full: the protocols, the voice pipeline, consent, memory and how the agent is tested.

（注：更多技术实现细节与完整 API 文档请查阅原项目 README）