Approval fatigue is the failure.
Coding agents ask before they act: allow this command, this tool, this file? Each prompt is cheap. Together they teach people to stop reading and click yes, and then to switch on full-auto, which trades the prompts for ambient authority: a shell, the whole workspace and the network, inside a sandbox the agent reports about itself.
Self-extension makes it worse. An agent that writes its own tools produces a stream of new code, and each piece wants its own approval. Skyra moves the approval: the person grants a Horizon once, and everything inside it runs without asking, including tools the agent builds for itself, because nothing can be created with more authority than its creator holds and the OS enforces the boundary on every call. Asking is kept for the one case that needs a person: reaching past the Horizon.
Three invariants.
The emitter is never the checker.
Whatever a model or tool outputs is untrusted bytes. A different process interprets and commits it before anything acts on it. Nothing an agent emits puts the system into a state by saying so.
Authority only narrows, and the OS enforces it.
Every step runs under a Horizon. A call shares its caller's unless it asks the room to narrow it; nothing widens one. The macOS sandbox profile is generated from the Horizon, and the runtime's own state is always denied.
Truth is derived, not stored.
Only observations are stored: the bytes received, what a target emitted. Everything else is re-derived by one pure function, so replaying the chain from genesis is the definition of correctness.
One process per step, then it exits.
There is no long-running server. One skyra binary runs once
per step. All durable state is a content-addressed, hash-chained record
tree. A crash before the write means nothing happened; after it, the intent
is recorded and is faulted or resumed on restore. There is never live state
to recover, only the tree.
INTAKE receive unchecked bytes, derive the state, commit a record, reply with its stamp
RELEASE the parent checks the record hashes to the stamp, derives the child's Horizon,
and passes it with the frame stack as directory fds over a Unix socket
EXECUTE run the target under a Seatbelt profile rendered from that Horizon
HANDOFF spawn a successor with the raw output; exit once it has stamped
SETTLE a return or fault discharges the slot it answers, once
GATHER when every slot a continuation opened is discharged, commit a resolve
CLAIM and exactly one sibling resumes that continuation
Every decision lives in one pure function,
machine.Step(state, event) → (state, effects), and a test fails
if it imports anything that touches the OS. No target ever says
invoke, return or fault: it prints operands, and
the runtime derives the state from where the emitter stands.
Where it is.
Kept to what is true today. Enforced means the OS stops it; detected means it is caught and recorded after the fact.
| Part | Status |
|---|---|
| Step protocol, custody handoff, content-addressed records | built |
One authority per Horizon; narrowing through system.narrow; sandbox rendered from the Horizon; .skyra/ denied | built · enforced |
| Replay re-derives every record from genesis, faults and resolves included | built |
| Types computed by the runtime; routes written by models at a novelty interrupt | built |
| Real Codex through a stateless adapter, under Seatbelt | built |
| Codex's native command execution | detected · interrupts the turn |
| A route runs with no more authority than it was written with | not built · next |
| Self-extension: an agent registers a tool it wrote and runs it with no approval | not built |
| Evaluation against Codex's own approval modes | planned · Nov–Dec |