From kernel to day-2 ops
ActantOS Stage 1 shipped the self-host Enforcement Kernel (Quiet Open-Core v1.2.0): intercept → decide → allow / deny / approval_required → evidence.
Stage 2 Agent Runtime Control Plane is now complete under the same ship rule: built and tests pass = done. No design-partner gate.
What Stage 2 adds
| Surface | What you get |
|---|---|
| Operator visibility | Session/decision filters; ops metrics rates; kill-switch and budget home on /v1/metrics/usage and /dashboard/metrics |
| Policy operations | Bundle upload/activate; dry-run against a stored bundle without promoting it; risk-rules read/update |
| Multi-channel approvals | Web + optional Slack, plus webhook notify and decide path for non-web approvers |
| Federated identity | Optional OIDC bearer tokens for operator routes (ACTANTOS_OIDC_*) |
| Hosted path | Single-tenant Docker Compose with /health/live and /health/ready — see product docs/HOSTED.md |
Still future (Stage 3)
- Firecracker / gVisor multi-tenant isolation
- WORM audit productization
- Full SIEM connectors
- Commercial multi-tenant managed SaaS packaging
Those stay roadmap until they are built and tested the same way.
How to try it
git clone https://github.com/kotobuki09/actantos-releases.git
cd actantos-releases/actantosd
npm run quickstart # portable first test (Node 22+)
# or: docker compose up -d --build # persistent self-host
Then open operator surfaces:
/dashboard— sessions, decisions, filters, approvals, audit/dashboard/metrics— rates, kill switch, budgets/dashboard/policy— bundles, dry-run, risk rules
Links
- How to use at work: /blog/how-to-use-actantos-at-work
- Roadmap / capability matrix: /roadmap
- Operator visibility: /platform/operator-visibility
- v1 kernel story: /v1
- Changelog: /changelog
- GitHub: actantos-releases
Stage 1 governs the tool call. Stage 2 makes day-2 operation real. Install it. Run the tests. Use the dashboards.