The appliance is a Linux VM. Inside it the KOS console runs natively as a service, the harness CLIs are installed locally, and Cortex with its services runs as podman containers. Commercial ships Linux only. The macOS development box has the same shape with the containers in podman machine. Windows is not a target. Every object cites its backing file.
appliance/appliance.yml (service roles) + appliance/bin/kos (operator)local-cortex/console/app/main.py under a systemd unit (install.sh lane; launchd on the Mac dev box), deployment_contract.py profile nativeopenkai, omp, node runtime; optional claude-code, codex), app/harness.py support tiers~/.openkai/.env is owned by OpenKaiappliance/Containerfile.{cortex,db} + per-role stagesdb (pgvector 0.8.2 on Postgres 18), migrate, cortex-api, project-bootstrap, graph-worker, embed-worker, pdf-worker; Cortex vendored as a hash-pinned wheel; only loopback ports published<project>_kos-control:/appliance.env (bin/kos CONTRACT_KEYS, schema 2)KOS_DB_PASSWORD, KOS_CORTEX_ADMIN_TOKEN…), KOS_EDITION, KOS_VERSION, KOS_SOURCE_REVISION, volume names, db tuning keys (KOS_DB_*); the console reads the tokens it needs from its runtime env, never from the browserkos-control, kos-state, kos-config, kos-secrets, kos-graphs, kos-models, kos-home-*lifecycle.operation in the control volume (CAS: build, up, down, backup, restore, upgrade, abandon, prune)up leaves up:claimed for the next command's recoveryapp/edition.py, baked at build (KOS_EDITION ∈ {dev, open-source, commercial}):z, linger, subuid/subgidinstall.sh (host lane) + M1/M3/M12kos; preflights old engines, stale ports, machine sizing (Mac)dist/release.sh, scripts/release/*, RELEASE_MANIFEST.jsonkos build from a clean checkout (dev)kos backup / kos restore (appliance/bin/kos) + the console state directorypg_dump -Fc of both databases + volume manifests; the ONLY sanctioned direct-Postgres path (E021 lifecycle boundary), never --no-owner/--no-privilegesdeployment_contract.py (KAIDERA_CONSOLE_RUNTIME=native), .agents/docker-compose.cortex.yml, launchd agents, podman machine (Fedora CoreOS guest, never Apple Container)Links. Appliance —hosts→ NativeConsole · Appliance —hosts→ HarnessInstall · Appliance —runs→ ServiceRole[7] · NativeConsole —spawns→ HarnessInstall (PTY) · NativeConsole —reads→ Contract · ServiceRole —configured by→ Contract · ServiceRole —persists in→ VolumeSet · LifecycleOperation —mutates→ VolumeSet (CAS) · Edition —gates→ Provider list · HostFamily —hosts→ Appliance · HostBootstrap —installs→ NativeConsole · HostBootstrap —installs→ HarnessInstall · PackageChannel —ships→ Appliance · BackupSnapshot —restores into→ Appliance · DevProfile —is→ Appliance (same shape).
Actions. installer (host bootstrap) · kos build | up | down | doctor | backup | restore | upgrade | prune | abandon | contract-migrate | admin-bootstrap (services) · systemctl --user (console, beat) · openkai / omp / claude / codex (harness lanes, spawned by the console).
| Lane | Tier | Who installs | Support |
|---|---|---|---|
openkai | primary, first-party | the appliance installer, pinned release | supported; the default lane |
omp | supported | the appliance installer | supported until OpenKai is mature |
claude-code | optional | the customer, with their own subscription | supported when present locally |
codex | optional | the customer, with their own subscription | supported when present locally |
Every lane is a local child process of the console with a real PTY, so the terminal surface is the same for all of them and nothing is reconstructed from parsed output.