Code on proof.
A terminal coding agent. Every model call carries its proof.
One command
The CLI ships first, the form coding agents are actually used in. A desktop app and a web surface follow on the same agent and proof trail.
Command Line
The agent in your terminal. Pipes, scripts and CI: it reads stdin, writes diffs and exits clean.
aios code "add retry to fetch"Desktop App
The same agent and proof trail in a window, for macOS, Windows and Linux.
Web
A browser surface on the same sessions, for review and hand-off.
The loop never stalls
Edits at editor speed
An agent that stops to wait for consensus is unusable. AIOS:CODE separates the work from the proof: the step applies immediately, marked provisional, and the badge flips when the committee agrees.
- Provisional. The step applies and work continues. Nothing is claimed verified before the committee agrees.
- Reconcile. The badge flips when the proof lands, and the step re-costs against caller-owned escrow.
- No quorum. A full refund. The step stays flagged provisional until a proof exists.
- 01 / Prompt
Describe the change
A sentence, a pasted trace, a piped file. The agent scopes the repo, writes a plan and holds escrow in $AIOS.
- 02 / Proceed
Steps apply, tagged provisional
Each model call is an inference job. The edit lands immediately and is never presented as verified.
- 03 / Prove
The committee recomputes
A VRF-seated committee recomputes the call and agrees on the output hash.
- 04 / Reconcile
Verified, re-costed
The step flips to verified and its cost finalizes. No supermajority: re-route, full refund.
Stated plainly
Verified means provenance, not correctness
The proof shows this model produced this output, unforged. It never says the code is right. Run the tests and review the diff.
Provisional is bookkeeping, not a shortcut
The agent proceeds because waiting on finality would make it unusable, but never presents an unproven step as verified.
Coding models verify statistically
They are checked by sampled recomputation, not byte-identical certainty. Exact-hash proofs belong to small deterministic models.
Verification does not make the agent safe
Proof of Inference proves what ran. It does not solve prompt injection. Treat generated changes like any contributor’s.
Nothing ships before the testnet
The proof testnet is being built in the open, with no token yet. The CLI comes first.
Ship code with Proof of Inference
The CLI opens with the proof testnet. Until then, read how every call it makes will clear.