The headline benchmarks as a ~40-second reveal — the performance spectrum, the turn-tax curves (modeled 9.7× vs the naive floor), the capability matrix, the three-pillar stat card with its honest single-stream fence, and the eight-axis sweep. full-resolution MP4 ↗
How the boundary works as a ~44-second reveal — the agent-kernel card, the tool call as a syscall, the five-gate flow through the kernel, the two-gate security model, the Context MMU, shared-prefix KV, and the 2-D scheduler. Every frame is a real in-repo diagram, nothing generated. full-resolution MP4 ↗
01 — the agent kernel

## One gate, where the tool call is the checkpoint

An in-process kernel sits between an agent and the tools it calls. Everything the agent does to the outside world becomes a syscall through a boundary the model can't route around.

github.com/anthony-chaudhary/fak
fak the agent kernel

“Treat the model like an untrusted program, and the tool call like a syscall.”

Apache-2.0 Go 1.26+ one static binary offline-capable

Everything an agent does to the outside world — call a tool, admit a result into memory, reuse a cached answer — becomes a syscall that passes through a kernel the model doesn't control. From the security seat it's a permission gate the agent can't argue past. From the performance seat it's a way to do shared work once instead of every turn. The surprise: those turn out to be the same gate.

#### flip 1 Policy in the kernel

The permission check rides the same call path as the tool call — one address space, no IPC, `default-deny`. Refusing an irreversible action doesn't depend on catching an attack; the lever was simply never wired up. When the check would crash or time out, the call doesn't run anyway — it fails closed.

#### flip 2 Addressable KV cache

Reach into the middle of a kept run, cut one span — a poisoned tool result, an expired secret — and leave the model's scratchpad bit-for-bit identical to a run that never saw it (`max|Δ| = 0`). The cache stops being just a speed structure and becomes one policy can address.

~4×
cheaper than a tuned warm-cache stack on a 50-turn × 5-agent run (apples-to-apples vs SOTA reuse)
8.8–9.7×
modeled prefill elimination vs the naive floor on real WebVoyager (643 tasks), 1→8 workers
~120 tok/s
in-kernel CUDA decode at parity with llama.cpp Q8_0 on an RTX 4070
⚖ we keep score — what's real, what's not

- The permission gate, quarantine, local-answer shortcut, in-kernel model (math proven exact against a reference), and the OpenAI-compatible gateway are shipped and on the critical path, each closed by a test.
- A 29-claim prior-art audit scored 0/29 novel — every primitive is established; the contribution is the assembly: one in-process gate where the tool call is the checkpoint.
- Power/energy numbers are simulated. The reuse win is self-host only, and frontier-scale fleet numbers are design targets, not measurements.

# see it in 2 minutes — no key, no model, no GPU, no clone curl -fsSL https://raw.githubusercontent.com/anthony-chaudhary/fak/main/install.sh | sh fak preflight --tool refund_payment --args "{}" # → DENY (DEFAULT_DENY) — unknown tool, refused by structure (fail-closed) fak agent --offline # → runs the task twice: tools wired direct vs. behind fak, prints the before/after # hosted expected-state run: Colab Case A-C should show policy PROVEN, gateway DENY, bench PASS, turntax 9 # have the source? from a clone, deny by argument value against a named floor: # go run ./cmd/fak preflight --policy examples/customer-support-readonly-policy.json --tool refund_payment --args "{}" → DENY (POLICY_BLOCK)
Repository README & the two flips Releases & binaries Modular Colab quickstart
02 — each win, in one example

## Five ideas, five worked examples

The two flips and the cost collapse, plus the same boundary checking the code the agent itself writes — each shrunk to one example you can read in ten seconds. Every number traces to BENCHMARK-AUTHORITY.md.

The four worked examples as a ~25-second reveal — each card below, animated. full-resolution MP4 ↗

#### Watch a turn vanish, bit-for-bit

addressable KV cache · the security flip, made physical

    cache  [ system ][ POISONED result ][ query ]   9 positions
    gate   poison bytes → QUARANTINE
    evict  [ system ][ query ]            query slides to pos 5

           evicted vs never-saw   max|Δ| = 0  (bit-identical)
           poison  vs never-saw   max|Δ| > 0  (a real erasure)

One verdict removes the poisoned turn's K/V from the middle of the run and re-seats every survivor, leaving the model's scratchpad identical to a run that never saw it. The model can't attend to what isn't there.

Full walkthrough →

#### The turn that never fires

policy in the kernel · more tool calls → more saved

    one 14-call airline trace · extra model round-trips
      tuned 2026 framework  +5  still forced into recovery turns
      fak (1-shot kernel)    0  repaired / served in-syscall
      safety floor          injection 1→0 · destructive ops 1→0

Each malformed, duplicate, or pure (side-effect-free) call is a round-trip a tuned 2026 agent is still forced into, and the kernel resolves inside the syscall the call arrived on. The more tool calls, the wider the gap.

See it race live →

#### Pay the shared prefix once

addressable KV cache · more agents → more reuse

    5 agents × 50 turns = 250 chances to re-read the setup
      tuned   warm per agent     5×
      fak     prefill once        1×  cloned bit-identical
      → 4.1× fewer prefill tokens vs a tuned warm-cache stack

The shared system-prompt-plus-tools block is prefilled once for the whole fleet and reused. It is a read-heavy win: if agents keep writing shared state, even ~1% writes can erase it.

See the reuse proof →

#### More hooks, sooner

policy in the kernel · why fail-closed is affordable

    4 checks × 1,000 tool calls = 4,000 checks
      spawn a hook per check   ≈ 28 s   → systems fail OPEN
      run each in-process      ≈ 10 ms  → fail CLOSED is free

      one in-proc check ~2.4 µs · one spawned hook ~6.9 ms

Putting the gate on the call path is what lets "refuse if anything is wrong" be the default instead of an aspiration. The more checks you want, the more the placement pays.

Full walkthrough →

#### The write that fixes itself

linting agent code · the same boundary checks the code the model writes

    agent writes   func (s *Store) Put(      truncated — never parses
      no check     lands, looks fine → go build fails 3 turns later → a recovery turn
      fak codelint store.go:3:22: expected ')', found 'EOF'  stapled to the same turn's result
      agent        re-issues a correct write          the breakage never reaches the build

A file write is just a tool call, so the boundary that adjudicates it can also ask whether the bytes parse. Go and JSON check in-process; Python and CUDA shell out off the hot path. The diagnostic is advice clipped to the result, not a veto, so a checker that is ever wrong cannot wedge the loop.

Full walkthrough →
03 — the hero benchmark

## Serving a 50 × 5 agent fleet — the cost collapse

Total wall-clock to serve a 50-turn × 5-agent fleet: a tuned SOTA prefix cache (per-agent warm KV) vs. fak fused. Same workload, log scale.

### Time to serve the fleet

lower is better · minutes (log)

Generated from `tools/hero_benchmark.data.json` · `fak v0.30.0` · single-stream decode, 7B. Every number traces to a commit + artifact in BENCHMARK-AUTHORITY.md.

19.0 min
fak fused fleet serving time
78 min
tuned SOTA cache floor
86.7%
KV-cache hit rate
8.7 tok/s
single-stream decode, 7B

### Built on — and kept honest by — DOS

This repo dogfoods DOS (`dos-kernel`), a separate trust substrate for fleets of agents: a claim is believed only when an independent witness — git ancestry, a file read-back, a real artifact — says so, never because a worker reported it done. Its `dos.toml` declares fak's real lane partition and turns the project's architectural invariants into a closed, verifiable refusal vocabulary (`OFF_TRUNK`, `PUBLIC_LEAK`). Different scope, same idea: don't take the agent's word for it — at the tool call, and at the “done.”

DOS · dos-kernel PyPI · dos-kernel