Bastion — The agent that can't betray you.

1:scan ── WHY LONG-LIVED AGENTS FAIL

$ agent-doctor

$ agent-doctor --scan typical_assistant

✗ memory.provenance ............ MISSING — hidden profile silently becomes behavior; no source, no removal

✗ ingress.trust_classification . MISSING — any web page or email can act with YOUR authority

✗ sender.owner_mapping ......... MISSING — anyone who reaches the bot gets a session

✗ egress.privacy_gate .......... MISSING — data leaves as a side effect of tool calls

✗ state.export ................. LOCKED — years of context die with the subscription

▲ 5 critical failures — this agent accumulates power it was never granted.

$ agent-doctor --scan bastion

✓ memory.provenance ............ OK — every fact has source, validity, lifecycle

✓ ingress.trust_classification . OK — content is never permission

✓ sender.owner_mapping ......... OK — unknown senders rejected

✓ egress.privacy_gate .......... OK — leaving data is a first-class decision

✓ state.export ................. OK — bastion export → identity, memories, goals: yours

■ all checks passed — 0 implicit grants.

2:workspace ── SIX GUARANTEES, ENFORCED BY THE RUNTIME — NOT BY A POLITE SYSTEM PROMPT

0: memory

Memory you can disagree with.

Every fact has provenance, validity, and a lifecycle. Inspect where it came from, correct it, or revoke it — chat history is not unquestionable truth, and a "profile" never silently becomes policy.

❯ /memory challenge #1205
· provenance shown · fact flagged for review

1: authority

Context is not permission.

Incoming content is classified by trust. Public messages and email are untrusted; WhatsApp is signature-checked; unknown senders rejected. No "the model saw it, therefore do it" path.

❯ /authority list
· 2 grants active · 0 implicit · all revocable

2: exit-path

Your Bastion. In any place.

Sessions, memory, personas, companion and secrets live in your deployment — one directory holds all of it. Move the whole instance to a new machine, or just back it up, without a migration project. Your providers, your subscriptions — credentials never enter agent memory.

❯ bastion export
· identity, memories, goals, personas → yours

3: life-os

One life, many domains — without one giant messy chat.

Work priorities shouldn't erase health goals. Personas, goals and memories stay distinct per life area while informing one person-level assistant. Context without collapse.

❯ /goals
· health · work · money · projects — separate, linked

4: cabinet

Hard trade-offs get a council, not a coin flip.

Cabinet mode convenes named personas to deliberate, preserves dissent, and returns a synthesized recommendation. Priorities made explicit and revisable — never flattened into one agreeable voice.

❯ /cabinet "push the launch or protect recovery?"
· 3 perspectives · dissent preserved · synthesis returned

5: extensions

No blank checks. Ever.

Declarative, WASM and subprocess extensions plug into a capability-bounded host — installing one grants nothing by default. Self-improvement is approval-gated: skill candidates queue for your sign-off.

⚠ skill candidate ready — awaiting owner approval
· nothing rewrites itself without oversight

7: floorplan.svg

Every power has a door. Every door has an owner.

Not an illustration — the runtime's real architecture. External content enters through quarantine and gains authority only with your signature. One gate.

6: companion

The Keeper lives in the TUI — pixel art on Kitty, WezTerm, Ghostty, iTerm2. /pet game on turns healthy breaks and finished work into cosmetic progression.

8: est. 2025

██████╗  █████╗ ███████╗████████╗██╗ ██████╗ ███╗   ██╗
██╔══██╗██╔══██╗██╔════╝╚══██╔══╝██║██╔═══██╗████╗  ██║
██████╔╝███████║███████╗   ██║   ██║██║   ██║██╔██╗ ██║
██╔══██╗██╔══██║╚════██║   ██║   ██║██║   ██║██║╚██╗██║
██████╔╝██║  ██║███████║   ██║   ██║╚██████╔╝██║ ╚████║
╚═════╝ ╚═╝  ╚═╝╚══════╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝

FORTRESS CLASS · SELF-HOSTED · MIT · A ShinAI PROJECT

3:new ── BASTION, NOW INSIDE THE TOOLS YOU ALREADY USE NEW IN 0.5

Your Claude Code. Your Bastion. Your thumb.

Claude Code gets your persona, your memory and your rules. When it tries something risky, your phone buzzes — and nothing runs until you say so.

claude — billing-api

> ship the invoice retry fix
🏰 keeper · remembers: deploys need the VPN on
● Bash(git push origin main)
⏳ waiting for you — phone · desk · web · terminal
✓ approved on phone · 4s
✓ pushed main → origin

PHONE · DESK DEVICE · WEB · TRAY · TERMINAL — ANSWER FROM ANY

REAL SCREENSHOT · WEB APP

Every agent session in one place. Approve or deny in one click.

Who's working, who's waiting
Switch persona for every agent at once
Silence never approves

localhost/app#/buddy

Bastion web app: a pending git push approval with Approve and Deny, and three Claude Code sessions

Any agent becomes a Bastion

No server? The Bastionizer turns Claude Code or Codex into Bastion: personas, memory, reminders, skills it writes itself.

Bring your subscription

Run on the Claude or ChatGPT plan you already pay for. No surprise API bill.

One brain, every machine

Laptop, desktop and server share one Bastion. Lose one? Promote another — nothing is lost.

Apps everywhere

Web, phone, desktop tray, terminal — and a tiny desk screen that shows your agents.

Expansion packs. Plug in a whole team.

OFFICIAL CATALOG · ONE COMMAND · REVOKE ANYTIME

OFFICIAL

DEV TEAM

Tech lead, implementer, reviewer, release manager.

OFFICIAL

ANALYST

DCF, investment memos, stock screens. Research only.

OFFICIAL

FUND COMMITTEE

17 investor personas debate your thesis.

OFFICIAL

WALLET

Proposes a payment. You approve on your device.

4:vs ── CHOOSE YOUR AGENT

BASTION VS TYPICAL AGENT

EVERY STAT ENFORCED BY THE RUNTIME — NOT A ROADMAP PROMISE

◈ BASTION

CLASS: FORTRESS · SELF-HOSTED · MIT · RUST

MEMORY INTEGRITY10/10

██████████

Provenance + temporal validity — inspect, contest, correct, revoke

INJECTION RESISTANCE10/10

██████████

Trust-classified ingress — content is never permission; capability boundary in the runtime

PRIVACY9/10

██████████

Privacy-aware egress + owner mapping per channel; strangers rejected

OWNERSHIP10/10

██████████

Self-hosted, local-first; export/import full agent state; your models, your keys

EXTENSIBILITY9/10

██████████

WASM / subprocess / declarative under a capability-bounded host; approval-gated self-improvement

SURFACES10/10

██████████

CLI/TUI · Telegram · WhatsApp · Discord · Slack · email · voice · MCP — one identity everywhere

▢ TYPICAL AI ASSISTANT

CLASS: CHAT WINDOW · VENDOR-HOSTED · SUBSCRIPTION

MEMORY INTEGRITY2/10

██████████

Hidden profile; silently becomes behavior; no source, no removal

INJECTION RESISTANCE3/10

██████████

A web page saying "do X" can execute with your authority

PRIVACY3/10

██████████

Egress is a side effect of whatever tool ran; anyone who reaches the bot gets a session

OWNERSHIP1/10

██████████

Lives on the vendor's servers; years of context die with the subscription

EXTENSIBILITY4/10

██████████

Install = full ambient access to files, network, identity; opaque updates

SURFACES3/10

██████████

One app, one UI

FLAWLESS VICTORY — SELF-HOST YOUR CHAMPION ↓

CLI / TUI pixel-art Keeper✦ TELEGRAM✦ WHATSAPP signature-checked✦ DISCORD✦ SLACK✦ EMAIL✦ MOBILE PAIRING✦ LOCAL VOICE✦ MCP native, both directions✦ CLAUDE CODE✦ CODEX✦ WEB APP✦ DESK SCREEN✦ CLI / TUI pixel-art Keeper✦ TELEGRAM✦ WHATSAPP signature-checked✦ DISCORD✦ SLACK✦ EMAIL✦ MOBILE PAIRING✦ LOCAL VOICE✦ MCP native, both directions✦ CLAUDE CODE✦ CODEX✦ WEB APP✦ DESK SCREEN✦

5:install ── YOUR MACHINE, YOUR KEYS

INSERT COIN? NO. IT'S MIT.

TWO MINUTES · NO SUBSCRIPTION · NO VENDOR

$ quick — one line

$ curl -fsSL bastion.run | sh

Bootstraps the full stack. Inspect the script first if that's your style — it preserves an existing .env and never prints generated credentials.

$ from source — inspect everything

$ git clone \
    https://github.com/thewaifucorp/bastion-agent.git
$ cd bastion-agent && ./installer.sh
$ bastion   # opens the TUI

bastion finds or starts the local Compose runtime and opens the TUI — Keeper included.

$ inside claude code

# with Bastion running
$ claude plugin marketplace add ./integrations/claude-code
$ claude plugin install bastion@bastion
# no Bastion? the Bastionizer
$ claude plugin marketplace add ./extras/bastionizer
$ claude plugin install bastionizer@bastionizer

Run from a clone of the repo. Pick one.