CarsinOS

One place to run assistants, approve risky work, schedule jobs, connect channels, manage memory, and see exactly what happened.

Download the Windows beta · Install guide · Release notes · Security

---

The simple version

CarsinOS turns a pile of AI scripts, agents, tools, and chat connections into an operation you can actually supervise.

• Tell it what needs doing. Create work from Boards, Calendar, chat, or a connected channel.
• Keep humans in control. High-risk actions stop for an explicit approve-or-deny decision.
• Know what happened. Runbooks, event history, receipts, and recovery state make work auditable.
• Keep the control plane local. The Windows beta bundles a token-authenticated gateway on 127.0.0.1.

No mystery daemon on somebody else's server. No silent tool execution. No guessing which assistant did what.

_{Mission Control's Runbooks view: active work, approval waits, completed runs, and blocked work in one place.}

One local control plane

CarsinOS is built around one deliberately boring rule: the operator stays in the loop. Mission Control makes intent visible, the gateway enforces runtime boundaries, approval gates pause risky actions, and the audit trail records the result.

Surface	What it gives you
Mission Control	A desktop command center for work, agents, approvals, schedules, channels, memory, tools, and system health.
Assistant routing	Named agents with provider/model ordering, roles, workspaces, tool posture, and per-lane memory.
Approvals + Focus	One operator queue for decisions, broken connections, circuit breakers, and other work that needs a human.
Boards + Runbooks	Turn a task card into executable work, then follow each step, decision, wait, and result.
Calendar + wakeups	Run scheduled jobs, heartbeats, check-ins, learning reviews, and job-watch routines.
Channels + connectors	Route assistant work through supported chat channels and imported tools without hiding connection state.
Local memory	Per-agent memory notes, local retrieval, bounded prompt injection, and explicit routing controls.
Safety + recovery	Token auth, loopback defaults, scoped tools, audit events, checksummed backups, and tested restore paths.

See the system, not just the pitch

Human approval before high-risk action	Schedules and assistant wakeups
Agents, roles, providers, and routing	Work that stays tied to execution

The screenshots use deterministic demo data from the release QA suite. They show real Mission Control surfaces, not concept art.

Get CarsinOS

Windows public beta — easiest path

The v0.1.0-beta prerelease contains the Windows x64 MSI, checksum file, release manifest, and SBOM.

1. Open the v0.1.0-beta release.
2. Download CarsinOS-Mission-Control-v0.1.0-beta-windows-x64.msi and SHA256SUMS.txt.
3. Verify the MSI before opening it:

$Installer = 'C:\Path\To\CarsinOS-Mission-Control-v0.1.0-beta-windows-x64.msi'
$Expected = '<SHA-256 from the matching SHA256SUMS.txt>'
$Actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $Installer).Hash
if ($Actual -ne $Expected.ToUpperInvariant()) { throw 'MSI checksum mismatch.' }

Published MSI SHA-256:

b125cb12ce6d082a1e96e6d66bc5acdc0c6b0b87ebcde14bd96648420ae4ae2e

Then follow the Windows install, backup, and restore guide.

Run from source

You need a Rust toolchain. Node.js is also required when running or building Mission Control from source.

Start the gateway:

Generate a unique token and keep it local. The prompt below avoids placing the token directly in the command or shell history:

git clone https://github.com/EmergentKnowledgeGroup/CarsinOS.git
cd CarsinOS
read -rsp "Gateway token: " CARSINOS_GATEWAY_TOKEN && printf '\n'
export CARSINOS_GATEWAY_TOKEN
cargo run -p carsinos-gateway

Check that it is healthy:

curl --fail --show-error \
  -H "Authorization: Bearer ${CARSINOS_GATEWAY_TOKEN}" \
  http://127.0.0.1:18789/api/v1/health

Or use the one-click launcher for the gateway plus Mission Control:

powershell -ExecutionPolicy Bypass -File .\scripts\one_click_launch.ps1

./scripts/one_click_launch.sh

Windows users can also double-click scripts\one_click_launch.cmd. The launcher prompts for Desktop or Web mode, auto-generates a token when you leave the prompt blank, reclaims stale repo-owned processes, shifts web ports when needed, and writes logs under runtime/oneclick-state/logs/.

Launcher options and macOS source packaging

PowerShell accepts -Web / -Tauri, -GatewayPort, -UiPort, -Token, -StateDir, and -CargoTargetDir. On macOS, the Finder launcher is scripts/one_click_launch.command.

To create a local macOS app bundle from source:

cargo run -p carsinos-cli -- package-macos --release

The bundle is written to target/dist/carsinOS.app by default. macOS packaging is a source-build path; the public beta distribution is Windows x64.

Public-beta boundaries

This is a real public prerelease, not a claim of finished-product maturity.

• Windows x64 desktop is the supported beta experience. Narrow/mobile Cockpit layouts are not a supported target.
• The MSI is unsigned. Windows may show an unknown-publisher or reputation warning; verify the checksum first.
• The beta is local-only. Its bundled gateway listens on loopback. Do not expose it publicly.
• There is no auto-updater. New releases require an intentional download and install.
• State survives uninstall. Durable state lives outside the MSI directory. Verified backups exclude credentials, so secrets must be re-entered after restore.
• Extended provider/channel/scheduler soak coverage was not part of this release gate. See the release notes for the exact evidence and residual risks.

Architecture

CarsinOS is a Rust workspace with a TypeScript/React Mission Control frontend and a Tauri desktop shell.

Mission Control (React + Tauri)
          │
          │ token-authenticated HTTP + WebSocket
          ▼
CarsinOS gateway (Rust, loopback by default)
          │
          ├── assistants + provider routing
          ├── approvals + audit events
          ├── schedules + runbooks + boards
          ├── channels + connector registry
          ├── scoped tools + browser capability
          └── SQLite state + local memory + backups

Key workspace areas:

• apps/mission-control/ — Mission Control web UI and Tauri desktop package
• crates/carsinos-gateway/ — authenticated API, WebSocket events, orchestration, and runtime policy
• crates/carsinos-storage/ — SQLite migrations, state, provenance, and recovery surfaces
• crates/carsinos-providers/ — model-provider adapters and auth policy
• crates/carsinos-channels/ — channel adapters and routing
• crates/carsinos-tools/ — scoped local and network tool execution
• scripts/ — launchers, release packaging, security gates, backup, and lifecycle proof

Security model

The beta favors explicit boundaries over invisible convenience:

• loopback gateway by default
• bearer-token bootstrap for the packaged desktop app
• operator approval gates for high-risk actions
• allowlisted filesystem roots, executable binaries, and network targets
• keychain-backed secret references rather than plaintext credentials in state
• structured audit events, run receipts, backups, and recovery checks
• per-PR security and Mission Control quality gates on protected main

Please report suspected vulnerabilities privately according to SECURITY.md. Do not open a public issue containing exploit details, credentials, or personal data.

Important runtime configuration

Variable	Purpose
CARSINOS_GATEWAY_BIND	Gateway address; defaults to 127.0.0.1:18789.
CARSINOS_GATEWAY_TOKEN	Static bearer token; generated at startup when omitted.
CARSINOS_STATE_DIR	Override the durable state directory.
CARSINOS_AUTH_MODE	static_bearer or jwt.
CARSINOS_PUBLIC_BIND_ALLOWED	Explicit opt-in required for a non-loopback source deployment.
CARSINOS_TOOL_ALLOWED_ROOTS	Filesystem roots available to file and execution tools.
CARSINOS_TOOL_ALLOWED_BINARIES	Executable allowlist for tool.exec.
CARSINOS_TOOL_NETWORK_POLICY	allowlist or deny_all for web tools.
CARSINOS_OPERATOR_ALLOWLIST	Operators allowed to make approval decisions.
CARSINOS_SECRET_STORE	keychain or test-only/in-memory secret storage.
CARSINOS_LOCAL_MEMORY_ENABLED	Enables local memory retrieval.
CARSINOS_LOG_FORMAT	compact, text, pretty, or json.

Public binds additionally require the repository's TLS/proxy safety controls. The packaged beta does not support public hosting.

Build and verify

cargo fmt --all -- --check
cargo test --workspace --locked

Mission Control:

cd apps/mission-control
npm ci
npm run typecheck
npm run lint
npm run test:unit
npm run build

Security and release verification:

scripts/security_pr_gate.sh
scripts/security_nightly_deep_scan.sh
scripts/security_killswitch_drill.sh
scripts/security_secret_lifecycle_drill.sh

Security artifacts are written under runtime/security/reports/. GitHub's protected main branch requires the security PR gate and Mission Control quality gate before merge.

Documentation map

I want to…	Start here
Install, back up, or restore the beta	Windows beta guide
See exactly what shipped	v0.1.0-beta release notes
Audit the public release evidence	Public release checklist
Understand the security posture	Security policy and threat model package
Contribute through the required workflow	Git and PR workflow
Understand autonomy guardrails	Autonomy guardrails and observability

Contributing

CarsinOS is public and auditable. Issues and focused pull requests are welcome. Before opening a PR:

1. Read CONTRIBUTING.md and the maintainer-oriented docs/GIT_PR_WORKFLOW.md.
2. Keep changes narrowly scoped and include tests for behavior changes.
3. Run the relevant Rust, Mission Control, and security checks.
4. Include the verification commands and results in the PR description.

Please use SECURITY.md instead of public issues for vulnerabilities.

License

CarsinOS is available under the MIT License.

---

Local AI should still feel like your system.
Inspect it. Approve it. Recover it. Own it.