AegisOS: what an AI system can promise when the network disappears

Offline changes the meaning of a correct answer

An online assistant can often ask a remote service for a current document, a permission decision, or a model response. A disconnected system has to work with what it already possesses. Its answer may be correct relative to the local evidence and still be outdated relative to the wider organization. Treating that difference as an exceptional network error hides a central property of the system.

AegisOS is a Rust workspace exploring local identity, protected evidence, event history, retrieval, and communication across constrained links. The inspected implementation includes a per-node signed timeline and a lexical evidence retriever, alongside interfaces for local model and embedding runtimes. Those code paths establish concrete implementation material. They do not establish field reliability, resistance to every adversary, or performance across every transport suggested by the architecture.

The useful question is what the system can truthfully tell an operator while disconnected. It can identify the local evidence searched, preserve source provenance, record an action, and distinguish locally accepted work from remotely acknowledged work. It cannot infer that an unreachable authority has issued no revocation or that an unseen source revision does not exist.

Make the local answer carry its boundary

The AegisAI answer structure includes citations with source identifiers, input hashes, run hashes, snippets, and retrieval scores. It also records how many evidence items were searched and whether the mode was lexical or semantic. These fields are useful because the answer is more than a generated string: it has an inspectable relationship to the local evidence collection.

The initial lexical path searches material available through the local vault and returns an insufficient-evidence response when it finds no relevant support. Lexical overlap remains a limited relevance signal. A grounded flag or a nonzero score should not be interpreted as proof that every generated sentence is correct, especially when a model synthesis path is added. A citation can be genuine while supporting only part of an answer.

For an illustrative equipment question, the response should identify the manual revision and the last successful synchronization of its catalog. If that revision is not known to be current, say so in the answer's operational context. “Supported by the local copy” is a meaningful statement. “Current organization-wide procedure” requires a stronger freshness claim that the disconnected node may be unable to establish.

A signed timeline records history without deciding truth

The timeline implementation stores events with an event identifier, a previous-event hash, a payload hash, node and operator identifiers, a trust domain, a timestamp, a source service, and a signature. Verification recomputes event identifiers and checks the chain and signatures. This can reveal certain modifications to the presented history and bind events to a device key.

A valid signature does not establish that an event's payload accurately describes the world. A compromised authorized endpoint can sign a false observation. A locally valid chain also does not, by itself, reveal that its tail was removed before inspection; that requires an independently known head or another continuity mechanism. These limits belong in the threat model rather than being hidden beneath the word immutable.

The timestamp needs similar care. A disconnected clock can drift, and a wall-clock value is not a global ordering guarantee. Preserve local sequence relationships and observation time separately where possible. If two nodes report conflicting events, their signatures tell us who asserted each event. A domain-specific reconciliation policy must still determine whether both observations can coexist or whether an operator needs to resolve them.

Transport acceptance is not application completion

Constrained communication introduces several acknowledgments that are easy to collapse into one green check. A message can be accepted into a local queue, handed to a transport, received by a peer, verified, and finally applied by the destination application. Those states have different meanings, and failure between any two can leave the sender uncertain.

The Bundle Protocol specification is useful background for understanding communication designed around intermittent connectivity. This article does not claim AegisOS implements that protocol. The design lesson applied here is to make delayed delivery explicit and to avoid treating a stable end-to-end connection as a universal assumption.

An illustrative event envelope should bind an operation identifier to its payload, scope, and intended destination. A receiving application needs an idempotency policy so that retransmission does not repeat a non-repeatable action. A transport's deduplication window is not enough if the application can restart or process an event through another route. Durable application identity has to survive those changes.

1{
2  "operationId": "synthetic-op-018",
3  "state": "queued-locally",
4  "destination": "authorized-peer",
5  "payloadRevision": "revision-4",
6  "acknowledgments": {
7    "transportReceived": false,
8    "applicationApplied": false
9  }
10}

Reconnection is a reconciliation workflow

When a node reconnects, it should not simply upload everything and declare itself current. It needs to exchange enough state to identify missing events, verify received material, apply retention rules, and resolve changes in authorization. The order matters. Newly received policy can affect whether queued evidence may still be released.

Consider a synthetic case where a source was available when a node went offline and revoked before it reconnected. The node may have generated a local answer during the partition. The system cannot undo information already observed, but it can prevent further release under the updated policy, invalidate derived caches, and preserve the decision history for review. The accepted offline exposure window must have been a deliberate product decision.

Conflict resolution should be defined per data type. A set of independent observations may merge naturally. Two competing edits to an authoritative procedure may require review. Choosing the newest timestamp for every conflict assumes synchronized clocks and a domain in which later always means preferable. Neither assumption follows from having a mesh transport. The synchronization interface should surface unresolved conflicts rather than burying them in a generic success count.

Test the boundary between simulation and field behavior

Start with deterministic tests for altered payloads, broken event links, duplicate operations, missing source revisions, and interrupted writes. Then introduce controlled network loss, duplicate delivery, delayed acknowledgments, clock skew, and node restart. Each experiment needs an expected state transition and an invariant, such as “an operation is applied at most once under this receiver's durable deduplication contract.”

Hardware and field testing answer additional questions: power loss behavior, storage durability, radio interference, device resource limits, and operator interpretation. A passing simulated transport test is not evidence about those conditions. Report which links were real, which failures were injected, which devices were used, and which conclusions are limited to the test environment. Do not combine them into an unsupported device-count or deployment claim.

For local AI, evaluate retrieval and answer behavior under deliberately incomplete evidence snapshots. A useful system should expose its boundary when the required document is absent, rather than becoming more confident because no contradictory evidence is available locally. That is the research direction AegisOS makes concrete: preserving a usable, inspectable account of what a disconnected node knows, what it has done, and what still requires confirmation.

Operator-facing states deserve testing alongside protocol states. Ask whether a reader can distinguish a local observation from a synchronized fact without inspecting a log. If the interface uses the same confirmation label for both, the implementation can preserve the distinction internally while still encouraging the wrong operational decision.