Rust

Policy as compiled code

AgentOS had to make AI agents follow rules they could not talk their way around, so I put the rules in compiled code. The database layer and the hook binary are around 200,000 lines each. The hook binary runs under the coding agents' own command-line tools and turns policy into refusals. A refusal is a typed value that can only name a command the system sanctions, so the compiler stops an agent from ever being told to run a command that does not exist.

a command that does not exist

When two hook source files grew too large, I had them split into domain modules under a symbol-parity check. See Why long agent runs fail.

I put invariants in types wherever the compiler can enforce them.

A tool harness at the core of an agent runtime

Agent Swarm needed every agent action to pass the same safety machinery, so I made the tool harness the core of the runtime. It is about 95,000 lines across 23 crates, plus a 23,000-line persona launcher. Agents message each other over Redis Streams with signed envelopes and a crash-recoverable inbox. See Tools are the platform and A coding agent that never holds the keys.

The tool owns one step

• A tool with golden and attack fixturesbuilds
• A tool missing eitherbuild fails

Real-time voice that cannot stall

Helix needed real-time voice that could not stall a conversation. The voice engine is asynchronous Rust on Tokio with almost no unsafe code, about 62,000 lines, beside about 232,000 in the collaboration control plane. The Linux end of the Teams media bridge is Rust too; it presents a call to the engine as an ordinary audio source and sink. A Rust MCP server holds the meeting actions, binds each one to a single digital employee and mints that employee's tokens on the server. See A self-hosted colleague in a Teams call and A meeting attendee that will not fake it.

Golden vectors

Rust half · the voice engine's end

C# half · the media bridge's end

A memory service I could secure and extend

FAFOHive began as my Rust re-implementation of an open-source session-memory plugin (TypeScript, AGPL-3.0), written without its code, because I wanted session memory inside a service I could secure and extend. It is now about 137,000 lines and the authenticated endpoint every agent in my estate connects to. See A code explainer that is not allowed to invent.

session memory, re-implemented in Rust without the plugin's code

a tree-sitter code graph in PostgreSQL

an Axum transport with fail-closed token introspection

the governed gateway to third-party tools, outermost

One function trait, many places to run

FAFO Core and Function Forge started as a Python FastAPI prototype, and I had it rebuilt in Rust once everything else began to run on it. The core crate, about 45,000 lines, runs one asynchronous function trait under a generic conductor. The model-facing gateway generates its tool routing from YAML at build time, and Function Forge renders new function crates from Handlebars templates and registers them at link time, so a function that is not fully wired fails the build. The API integration platform is about 20,000 lines across five crates. See Tools that build tools, under governance and Closed by evidence.

Lifecycle

Batching

Location

A synchronous hot loop

Inference Fabric had one hot loop that decided GPU throughput, and I chose synchronous Rust for it. The token-aware broker, about 24,000 lines in four crates, runs that loop on a single owner. Across six services the fabric is about 108,000 lines of Rust. The inference runtime drives TensorRT-LLM across a C++ boundary, and the analytics engine launches CUDA kernels from Rust through the driver API, with a CPU reference for every kernel. See A message broker that understands tokens.

The broker loop

1one owner on blocking threads, crossbeam channels between them; nothing to schedule, easy to prove

Services that wait on I/O

Many small tasks on Tokio: the voice engine, the Axum transports, the services that spend their time waiting.

Unsafe code fenced into one module

The Capabilities model mixes Rust with a custom CUDA decoder, so I fenced the unsafe code. The workspace is thirteen crates and about 45,000 lines, and every unsafe block sits in one FFI module over CUDA. See A hundred tokens instead of forty-two thousand and Bit-identical across batch compositions.

Layout tests fail the build if the Rust and C views of a shared struct disagree.