{"slug": "veda-the-first-agentic-hobby-os-needs-contribution", "title": "Veda, the First Agentic Hobby OS Needs Contribution", "summary": "Veda, described as the first agentic hobby operating system, has published a contribution guide asking developers to help build the project. The guide, released under GPL-3.0-only by copyright holder Vahid Mohammadi, requires contributors to build on an x86-64 Linux machine with KVM and to run `cargo orchestration` commands such as `doctor`, `clippy`, and `test --ui` before opening a pull request. Contributors must branch from an up-to-date `main` of their fork, make one change with its tests and documentation, and report vulnerabilities privately rather than in an issue.", "body_md": "|  | \n|  | `1` | `+`<!-- SPDX-FileCopyrightText: © 2026 Vahid Mohammadi --> | \n|  | `2` | `+`<!-- SPDX-License-Identifier: GPL-3.0-only --> | \n|  | `3` | `+` | \n|  | `4` | `+`# Contributing to Veda | \n|  | `5` | `+` | \n|  | `6` | `+` Thank you for helping build Veda. This guide covers how to propose a | \n|  | `7` | `+` change, the standards every change meets, and how changes are tested and | \n|  | `8` | `+` reviewed. [Developing](documentation/DEVELOPING.md) has the commands in | \n|  | `9` | `+` full, [Coding conventions](documentation/CODING.md) the rules the code | \n|  | `10` | `+` follows, and [Architecture](documentation/ARCHITECTURE.md) the design. | \n|  | `11` | `+` | \n|  | `12` | `+`**Contents:** [Before you start](#before-you-start) · [Making a change](#making-a-change) · [Engineering standards](#engineering-standards) · [Testing](#testing) · [Documentation](#documentation) · [Commits](#commits) · [Pull requests](#pull-requests) · [Reporting a vulnerability](#reporting-a-vulnerability) · [Licence](#licence) | \n|  | `13` | `+` | \n|  | `14` | `+`## Before you start | \n|  | `15` | `+` | \n|  | `16` | `+`- **Found a bug?** Open an issue with the steps, what happened and what | \n|  | `17` | `+`  you expected, the commit (`git rev-parse --short HEAD`) and what | \n|  | `18` | `+` `cargo orchestration doctor` says. Attach the log: | \n|  | `19` | `+` `target/veda/serial.log` after `script`, `shot` or `test`, the file | \n|  | `20` | `+` `cargo orchestration run --serial FILE` writes, or `VEDA/LOGS/` on a live | \n|  | `21` | `+`  system's stick. | \n|  | `22` | `+`- **Planning more than a fix?** Open an issue first for a new service, | \n|  | `23` | `+`  protocol or application, a change to who may do what, or a new | \n|  | `24` | `+`  dependency or port. Agreeing on the approach saves rework. | \n|  | `25` | `+`- **Have a question?** Open an issue. | \n|  | `26` | `+`- **Found a vulnerability?** Report it privately, never in an issue; see | \n|  | `27` | `+` [Reporting a vulnerability](#reporting-a-vulnerability). | \n|  | `28` | `+` | \n|  | `29` | `+` To set up, follow the [quick start](README.md#quick-start): Veda builds on | \n|  | `30` | `+` an x86-64 Linux machine with KVM, and the toolchain and the driver VM's | \n|  | `31` | `+` Linux are built once. | \n|  | `32` | `+` | \n|  | `33` | `+`## Making a change | \n|  | `34` | `+` | \n|  | `35` | `+` 1. **Branch** from an up-to-date `main` of your fork. | \n|  | `36` | `+` 2. **Make one change**, with its tests and documentation. In a new | \n|  | `37` | `+`   checkout, run a `cargo orchestration` command (such as `doctor`) before | \n|  | `38` | `+`   Cargo itself, so that Cargo builds the crates Veda patches | \n|  | `39` | `+`   ([Builds](documentation/DEVELOPING.md#builds)). | \n|  | `40` | `+` 3. **Iterate** on what you changed: | \n|  | `41` | `+` | \n|  | `42` | `+` ``` bash | \n|  | `43` | `+`   cargo test -p vnetstack                                           # one crate's unit tests, on the host | \n|  | `44` | `+`   cargo orchestration script verification/ui/firewall-question.vts  # one GUI script, headless | \n|  | `45` | `+`   cargo orchestration run --cmdline run=settings                    # boot with an application started | \n|  | `46` | `+` ``` | \n|  | `47` | `+` | \n|  | `48` | `+` 4. **Check everything** before you open a pull request: | \n|  | `49` | `+` | \n|  | `50` | `+` ``` bash | \n|  | `51` | `+`   cargo fmt --all --check         # formatting, as rustfmt.toml sets it | \n|  | `52` | `+`   cargo orchestration clippy      # Clippy over every crate as Veda builds it, warnings as errors | \n|  | `53` | `+`   cargo orchestration test --ui   # unit tests, systest inside Veda, then every GUI and agent script | \n|  | `54` | `+` ``` | \n|  | `55` | `+` | \n|  | `56` | `+`## Engineering standards | \n|  | `57` | `+` | \n|  | `58` | `+` Veda is an operating system: its code handles other programs' data and | \n|  | `59` | `+` people's files, and has to keep working when something around it fails. | \n|  | `60` | `+` Every change meets these standards; [Coding conventions](documentation/CODING.md) | \n|  | `61` | `+` has the detailed rules. | \n|  | `62` | `+` | \n|  | `63` | `+`### Security | \n|  | `64` | `+` | \n|  | `65` | `+`- **Trust nothing from outside the process.** Check IPC messages, files, | \n|  | `66` | `+`  network data and what people type before using them. Malformed input | \n|  | `67` | `+`  returns an error, never a panic. | \n|  | `68` | `+`- **Decide by identity.** A service gives each caller only what it needs, | \n|  | `69` | `+`  judged by the identity the registry gives each connection, which a | \n|  | `70` | `+`  process cannot forge ([Who may do what](documentation/NETWORKING.md#who-may-do-what) | \n|  | `71` | `+`  is an example). | \n|  | `72` | `+`- **Bound what others can grow.** Every queue, table and buffer that | \n|  | `73` | `+`  another process can fill has a limit, so that one process cannot starve | \n|  | `74` | `+`  the rest. | \n|  | `75` | `+`- **Fail closed.** Defaults are the safe choice (the firewall starts in | \n|  | `76` | `+`  stealth mode), and what is stored is checked again when it is read back. | \n|  | `77` | `+`- **Keep secrets secret.** Keys and passwords stay out of logs and the | \n|  | `78` | `+`  agent's state, and are never shown or returned once saved. | \n|  | `79` | `+`- **Proven cryptography.** Use RustCrypto and rustls, not code of your | \n|  | `80` | `+`  own; [Libraries](documentation/DEPENDENCIES.md) records each exception | \n|  | `81` | `+`  and why. | \n|  | `82` | `+`- **Leave consent to the system.** An application's agent actions declare | \n|  | `83` | `+`  their real risk and run the code the keyboard and mouse run | \n|  | `84` | `+`  ([Consent and safety](documentation/AGENT.md#consent-and-safety)). | \n|  | `85` | `+`- **` unsafe` only where nothing else will do,** each block with a | \n|  | `86` | `+` `// SAFETY:` comment saying why it is sound. | \n|  | `87` | `+` | \n|  | `88` | `+`### Reliability | \n|  | `89` | `+` | \n|  | `90` | `+`- **Expect failure.** Services restart when they crash, and the driver VM | \n|  | `91` | `+`  when its Linux does: a client reconnects and restores what the restart | \n|  | `92` | `+`  lost, as `vui` registers an application with the agent again. | \n|  | `93` | `+`- **Answer in time.** An application's frame never waits on slow work, | \n|  | `94` | `+`  which goes to a thread ([The `vui` toolkit](documentation/DEVELOPING.md#the-vui-toolkit)), | \n|  | `95` | `+`  and a call to a peer that may hang, such as a driver, has a deadline | \n|  | `96` | `+`  (`set_timeout`). | \n|  | `97` | `+`- **Say what failed.** Errors are a crate's own enum implementing | \n|  | `98` | `+` `Display`, in words a person can act on: what failed, and on what. | \n|  | `99` | `+` | \n|  | `100` | `+`### Code | \n|  | `101` | `+` | \n|  | `102` | `+`- **Proven libraries first.** Use a mature crate where one fits | \n|  | `103` | `+`  ([What a library must fit](documentation/DEPENDENCIES.md#what-a-library-must-fit)). | \n|  | `104` | `+`  A new dependency goes in `[workspace.dependencies]` with its reason; a | \n|  | `105` | `+`  library that is wrong becomes a port, and the fix goes upstream. | \n|  | `106` | `+`- **Write like the code around it**: its naming, comment density and | \n|  | `107` | `+`  idioms. What depends on the processor architecture stays in `arch/` | \n|  | `108` | `+`  ([Architectures](documentation/CODING.md#architectures)). | \n|  | `109` | `+`- **Explain why.** Public items have doc comments, every module a `//!` | \n|  | `110` | `+`  overview, and comments say why the code is as it is. | \n|  | `111` | `+`- **Keep a change whole and small.** No unrelated renames or reformatting | \n|  | `112` | `+`  beside a fix, and nothing left that the change made unused. | \n|  | `113` | `+`- **Mind the emulator.** Without KVM, QEMU runs Veda 5 to 20 times slower | \n|  | `114` | `+`  than native code: keep hot loops lean | \n|  | `115` | `+`  ([Performance](documentation/CODING.md#performance)), and measure what a | \n|  | `116` | `+` `perf` change claims, before and after. | \n|  | `117` | `+` | \n|  | `118` | `+`## Testing | \n|  | `119` | `+` | \n|  | `120` | `+` A change is finished when it is tested where it could break: | \n|  | `121` | `+` | \n|  | `122` | `+`\\| What changed \\| Test it with \\| Run it with \\| | \n|  | `123` | `+`\\|--------------\\|--------------\\|-------------\\| | \n|  | `124` | `+`\\| Logic: parsing, protocols, state, maths \\| Unit tests beside the code \\| `cargo test -p <crate>` \\| | \n|  | `125` | `+`\\| The kernel, services, the POSIX layer, the standard library \\| `systest`, and the C and Rust test programs \\| `cargo orchestration test` \\| | \n|  | `126` | `+`\\| Applications, the shell, devices, recovery \\| A GUI script in `verification/ui` \\| `cargo orchestration script FILE` \\| | \n|  | `127` | `+`\\| What the agent does \\| An agent script in `verification/agent` \\| `cargo orchestration script FILE` \\| | \n|  | `128` | `+` | \n|  | `129` | `+`- **A fix comes with the test that catches it,** checked to fail without | \n|  | `130` | `+`  the fix. | \n|  | `131` | `+`- **Deterministic and offline.** Tests talk to stand-ins (a server on the | \n|  | `132` | `+`  host, one for Deepgram, a video decoder, a microphone) and wait on log | \n|  | `133` | `+`  lines rather than fixed delays. What needs the real Internet or Deepgram | \n|  | `134` | `+`  goes in `verification/real/`, run by hand. | \n|  | `135` | `+`- **No flaky tests.** A test that fails now and then has a bug, in it or | \n|  | `136` | `+`  in the code: find it rather than retrying. | \n|  | `137` | `+`- **Break things on purpose.** Crashes, restarts and pulled cables have | \n|  | `138` | `+`  scripts, so that recovery is tested like any other feature. | \n|  | `139` | `+`- **A new crate with host tests** goes in `HOST_TESTED` | \n|  | `140` | `+`  (`orchestration/src/runner.rs`); a test fails until it is there. | \n|  | `141` | `+` | \n|  | `142` | `+`[Scripts and tests](documentation/DEVELOPING.md#scripts-and-tests) covers | \n|  | `143` | `+` the scripts, whose language `orchestration/src/script.rs` documents. | \n|  | `144` | `+` | \n|  | `145` | `+`## Documentation | \n|  | `146` | `+` | \n|  | `147` | `+`- **Update what you change.** A change to behaviour, a command, a protocol | \n|  | `148` | `+`  or a limit updates the document that describes it, in the same pull | \n|  | `149` | `+`  request. | \n|  | `150` | `+`- **Write as the documents do**: plain, precise British English in short | \n|  | `151` | `+`  sentences; tables for reference; commands, code and paths in backticks; | \n|  | `152` | `+`  a link rather than a repetition; no emojis. | \n|  | `153` | `+`- **Retake pictures with their scripts.** The README's screenshots come | \n|  | `154` | `+`  from `documentation/screenshots.vts`, Interceptor's from | \n|  | `155` | `+` `documentation/interceptor.vts`. | \n|  | `156` | `+` | \n|  | `157` | `+`## Commits | \n|  | `158` | `+` | \n|  | `159` | `+` Each commit message is one line: | \n|  | `160` | `+` | \n|  | `161` | `+```` text | \n|  | `162` | `+` type(scope): description | \n|  | `163` | `+```` | \n|  | `164` | `+` | \n|  | `165` | `+`- **type**: one of the table below. | \n|  | `166` | `+`- **scope**: what changed, as one lowercase word: a component (`kernel`, | \n|  | `167` | `+` `firewall`, `shell`, `drivervm`), or `repo` for the whole repository. | \n|  | `168` | `+`- **description**: imperative and lowercase (\"add\", not \"added\" or | \n|  | `169` | `+`  \"adds\"), without a full stop, the whole line 72 characters at most. | \n|  | `170` | `+`- **Nothing else**: no body or footer. The pull request explains. | \n|  | `171` | `+` | \n|  | `172` | `+`\\| Type \\| For \\| | \n|  | `173` | `+`\\|------\\|-----\\| | \n|  | `174` | `+`\\| `feat` \\| A new capability \\| | \n|  | `175` | `+`\\| `fix` \\| A bug fix \\| | \n|  | `176` | `+`\\| `perf` \\| Faster or smaller, behaving the same \\| | \n|  | `177` | `+`\\| `refactor` \\| Restructured, behaving the same \\| | \n|  | `178` | `+`\\| `test` \\| Tests alone \\| | \n|  | `179` | `+`\\| `docs` \\| Documentation alone \\| | \n|  | `180` | `+`\\| `build` \\| The build, the toolchain or the ports \\| | \n|  | `181` | `+`\\| `chore` \\| Upkeep: removals, lint fixes, licence headers \\| | \n|  | `182` | `+`\\| `style` \\| Formatting alone \\| | \n|  | `183` | `+` | \n|  | `184` | `+```` text | \n|  | `185` | `+` feat(firewall): add a firewall that asks when an application listens | \n|  | `186` | `+` fix(videos): handle decoder restarts and lengthen vgl's fence wait | \n|  | `187` | `+` perf(glsl): preprocess shaders in linear time | \n|  | `188` | `+```` | \n|  | `189` | `+` | \n|  | `190` | `+` Every commit builds and passes the tests, so that `git bisect` works, and | \n|  | `191` | `+` the history stays linear: rebase on `main`, never merge it into your | \n|  | `192` | `+` branch. | \n|  | `193` | `+` | \n|  | `194` | `+`## Pull requests | \n|  | `195` | `+` | \n|  | `196` | `+` Open a pull request against `main` from a branch of your fork, and say: | \n|  | `197` | `+` | \n|  | `198` | `+`- **What and why**: the problem, and how the change solves it. | \n|  | `199` | `+`- **How you tested it**: the commands and scripts you ran, and what you | \n|  | `200` | `+`  could not test (hardware you do not have, say). | \n|  | `201` | `+`- **What it looks like**, for a visible change: a screenshot | \n|  | `202` | `+`  (`cargo orchestration shot`, or a script's `shot`). | \n|  | `203` | `+` | \n|  | `204` | `+` Before asking for a review: | \n|  | `205` | `+` | \n|  | `206` | `+`- [ ] `cargo fmt --all --check` and `cargo orchestration clippy` pass | \n|  | `207` | `+`- [ ] `cargo orchestration test --ui` passes | \n|  | `208` | `+`- [ ] New behaviour has tests, and a fix the test that catches it | \n|  | `209` | `+`- [ ] The documents that describe the change are up to date | \n|  | `210` | `+`- [ ] New files start with their licence header | \n|  | `211` | `+`- [ ] Commits follow the format, on an up-to-date `main` | \n|  | `212` | `+` | \n|  | `213` | `+` Reviews look at correctness and security first, then tests, clarity and | \n|  | `214` | `+` fit. Answer a question in the code when the next reader would ask it too | \n|  | `215` | `+`(a comment, a better name), and fold changes into the commits they belong | \n|  | `216` | `+` to rather than adding commits that fix earlier ones. Reviews are about the | \n|  | `217` | `+` code: be specific, and be kind. | \n|  | `218` | `+` | \n|  | `219` | `+`## Reporting a vulnerability | \n|  | `220` | `+` | \n|  | `221` | `+`> [!CAUTION] | \n|  | `222` | `+`> Never report a vulnerability in a public issue. | \n|  | `223` | `+` | \n|  | `224` | `+` Report it privately through GitHub's | \n|  | `225` | `+`[private vulnerability reporting](https://github.com/vahmoh25/Veda/security/advisories/new) | \n|  | `226` | `+`(the **Security** tab, **Report a vulnerability**): what you found, how to | \n|  | `227` | `+` reproduce it, and what it exposes. Where that button is missing, open an | \n|  | `228` | `+` issue that asks for a private contact, without details. | \n|  | `229` | `+` | \n|  | `230` | `+` A vulnerability is anything that crosses a boundary Veda draws: a process | \n|  | `231` | `+` reaching what its capabilities do not give it, a caller doing what its | \n|  | `232` | `+` identity does not allow, the agent acting without consent, traffic the | \n|  | `233` | `+` firewall should stop, or the driver VM reaching memory the IOMMU should | \n|  | `234` | `+` keep from it. | \n|  | `235` | `+` | \n|  | `236` | `+`## Licence | \n|  | `237` | `+` | \n|  | `238` | `+` Veda is under the [GNU General Public License, version 3](LICENSE) only. | \n|  | `239` | `+` By contributing, you license your contribution under it (or under the MIT | \n|  | `240` | `+` licence, for the driver VM's renderer, as [Licensing](documentation/LICENSING.md) | \n|  | `241` | `+` says). | \n|  | `242` | `+` | \n|  | `243` | `+`- **Every new file** starts with its SPDX header, with your name and the | \n|  | `244` | `+`  year the file is first published | \n|  | `245` | `+`  ([Licence headers](documentation/CODING.md#licence-headers) has the form | \n|  | `246` | `+`  for each kind of file): | \n|  | `247` | `+` | \n|  | `248` | `+` ``` rust | \n|  | `249` | `+` // SPDX-FileCopyrightText: © 2026 Your Name | \n|  | `250` | `+` // SPDX-License-Identifier: GPL-3.0-only | \n|  | `251` | `+` ``` | \n|  | `252` | `+` | \n|  | `253` | `+`  To a file you change substantially, you may add a line of your own | \n|  | `254` | `+`  below those there. `cargo orchestration test` checks every file. | \n|  | `255` | `+`- **Code from elsewhere is not copied in.** Third-party software is a port | \n|  | `256` | `+`  (`implementation/ports/`): its release, pinned by its SHA-256, with a | \n|  | `257` | `+`  small, explained patch | \n|  | `258` | `+`  ([Updating a port](implementation/ports/README.md#updating-a-port)), and | \n|  | `259` | `+`  its licence in [Licensing](documentation/LICENSING.md). |", "url": "https://wpnews.pro/news/veda-the-first-agentic-hobby-os-needs-contribution", "canonical_source": "https://github.com/vahmoh25/Veda/commit/e272c19af15ef1d0b7d932e2c4308cfecbd82d81", "published_at": "2026-10-16 22:53:40+00:00", "updated_at": "2026-10-16 23:24:46.033755+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools"], "entities": ["Veda", "Vahid Mohammadi", "cargo orchestration", "KVM", "GPL-3.0-only"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/veda-the-first-agentic-hobby-os-needs-contribution", "markdown": "https://wpnews.pro/news/veda-the-first-agentic-hobby-os-needs-contribution.md", "text": "https://wpnews.pro/news/veda-the-first-agentic-hobby-os-needs-contribution.txt", "jsonld": "https://wpnews.pro/news/veda-the-first-agentic-hobby-os-needs-contribution.jsonld"}}