bastion v0.9 — self-hosted life os
✓ runtime local · ✓ keys yours · ✓ memory contestable · ✓ authority explicit
THE AGENT THAT CAN'T BETRAY YOU. LIFE OS // trustworthy by design

# One agent for your whole life — health, work, money, projects — that stays useful for years without becoming unreviewable, irreversible, or owned by a vendor. # Most agents ask for the keys. Bastion never needs them.

$ curl -fsSL bastion.run | sh ▶ PRESS START
1:scan ── WHY LONG-LIVED AGENTS FAIL
$ agent-doctor
$ agent-doctor --scan typical_assistant
✗ memory.provenance ............ MISSING — hidden profile silently becomes behavior; no source, no removal
✗ ingress.trust_classification . MISSING — any web page or email can act with YOUR authority
✗ sender.owner_mapping ......... MISSING — anyone who reaches the bot gets a session
✗ egress.privacy_gate .......... MISSING — data leaves as a side effect of tool calls
✗ state.export ................. LOCKED — years of context die with the subscription
▲ 5 critical failures — this agent accumulates power it was never granted.

$ agent-doctor --scan bastion
✓ memory.provenance ............ OK — every fact has source, validity, lifecycle
✓ ingress.trust_classification . OK — content is never permission
✓ sender.owner_mapping ......... OK — unknown senders rejected
✓ egress.privacy_gate .......... OK — leaving data is a first-class decision
✓ state.export ................. OK — bastion export → identity, memories, goals: yours
■ all checks passed — 0 implicit grants.
2:workspace ── SIX GUARANTEES, ENFORCED BY THE RUNTIME — NOT BY A POLITE SYSTEM PROMPT
0: memory
Memory you can disagree with.

Every fact has provenance, validity, and a lifecycle. Inspect where it came from, correct it, or revoke it — chat history is not unquestionable truth, and a "profile" never silently becomes policy.

❯ /memory challenge #1205
· provenance shown · fact flagged for review
1: authority
Context is not permission.

Incoming content is classified by trust. Public messages and email are untrusted; WhatsApp is signature-checked; unknown senders rejected. No "the model saw it, therefore do it" path.

❯ /authority list
· 2 grants active · 0 implicit · all revocable
2: exit-path
Yours. With the receipts.

Sessions, memory, personas and skills live in your deployment. Your providers, your subscriptions — credentials never enter agent memory. Full state exports and imports with the CLI.

❯ bastion export
· identity, memories, goals, personas → yours
3: life-os
One life, many domains — without one giant messy chat.

Work priorities shouldn't erase health goals. Personas, goals and memories stay distinct per life area while informing one person-level assistant. Context without collapse.

❯ /goals
· health · work · money · projects — separate, linked
4: cabinet
Hard trade-offs get a council, not a coin flip.

Cabinet mode convenes named personas to deliberate, preserves dissent, and returns a synthesized recommendation. Priorities made explicit and revisable — never flattened into one agreeable voice.

❯ /cabinet "push the launch or protect recovery?"
· 3 perspectives · dissent preserved · synthesis returned
5: extensions
No blank checks. Ever.

Declarative, WASM and subprocess extensions plug into a capability-bounded host — installing one grants nothing by default. Self-improvement is approval-gated: skill candidates queue for your sign-off.

⚠ skill candidate ready — awaiting owner approval
· nothing rewrites itself without oversight
7: floorplan.svg
Every power has a door. Every door has an owner.

Not an illustration — the runtime's real architecture. External content enters through quarantine and gains authority only with your signature. One gate.

ROOM 01 MEMORY (contestable) ROOM 02 AUTHORITY (explicit) ROOM 03 CHANNELS QUARANTINE external content SINGLE GATE UNDER YOUR DOMAIN
6: companion

The Keeper lives in the TUI — pixel art on Kitty, WezTerm, Ghostty, iTerm2. /pet game on turns healthy breaks and finished work into cosmetic progression.

8: est. 2025 
██████╗  █████╗ ███████╗████████╗██╗ ██████╗ ███╗   ██╗
██╔══██╗██╔══██╗██╔════╝╚══██╔══╝██║██╔═══██╗████╗  ██║
██████╔╝███████║███████╗   ██║   ██║██║   ██║██╔██╗ ██║
██╔══██╗██╔══██║╚════██║   ██║   ██║██║   ██║██║╚██╗██║
██████╔╝██║  ██║███████║   ██║   ██║╚██████╔╝██║ ╚████║
╚═════╝ ╚═╝  ╚═╝╚══════╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝
FORTRESS CLASS · SELF-HOSTED · MIT · A ShinAI PROJECT
3:vs ── CHOOSE YOUR AGENT

BASTION VS TYPICAL AGENT

EVERY STAT ENFORCED BY THE RUNTIME — NOT A ROADMAP PROMISE
◈ BASTION
CLASS: FORTRESS · SELF-HOSTED · MIT · RUST
MEMORY INTEGRITY10/10
██████████
Provenance + temporal validity — inspect, contest, correct, revoke
INJECTION RESISTANCE10/10
██████████
Trust-classified ingress — content is never permission; capability boundary in the runtime
PRIVACY9/10
██████████
Privacy-aware egress + owner mapping per channel; strangers rejected
OWNERSHIP10/10
██████████
Self-hosted, local-first; export/import full agent state; your models, your keys
EXTENSIBILITY9/10
██████████
WASM / subprocess / declarative under a capability-bounded host; approval-gated self-improvement
SURFACES10/10
██████████
CLI/TUI · Telegram · WhatsApp · Discord · Slack · email · voice · MCP — one identity everywhere
▢ TYPICAL AI ASSISTANT
CLASS: CHAT WINDOW · VENDOR-HOSTED · SUBSCRIPTION
MEMORY INTEGRITY2/10
██████████
Hidden profile; silently becomes behavior; no source, no removal
INJECTION RESISTANCE3/10
██████████
A web page saying "do X" can execute with your authority
PRIVACY3/10
██████████
Egress is a side effect of whatever tool ran; anyone who reaches the bot gets a session
OWNERSHIP1/10
██████████
Lives on the vendor's servers; years of context die with the subscription
EXTENSIBILITY4/10
██████████
Install = full ambient access to files, network, identity; opaque updates
SURFACES3/10
██████████
One app, one UI
FLAWLESS VICTORY — SELF-HOST YOUR CHAMPION ↓
4:install ── YOUR MACHINE, YOUR KEYS

INSERT COIN? NO. IT'S MIT.

TWO MINUTES · NO SUBSCRIPTION · NO VENDOR
$ quick — one line 
$ curl -fsSL bastion.run | sh

Bootstraps the full stack. Inspect the script first if that's your style — it preserves an existing .env and never prints generated credentials.

$ from source — inspect everything 
$ git clone \
    https://github.com/thewaifucorp/bastion-agent.git
$ cd bastion-agent && ./installer.sh
$ bastion   # opens the TUI

bastion finds or starts the local Compose runtime and opens the TUI — Keeper included.