An engine for intent.
Meet Pioneer: NIX’s AI software engine for understanding intents, researching tools, writing code, and preparing useful workspaces.
NIX is the interface.
Pioneer is the coding engine.
Pioneer is NIX’s AI software engine: it turns an intent into research, a plan, and a tested software result. It can inspect approved projects, find reusable tools, write or adapt code, and prepare applications for a Pod. NIX presents the experience; Pioneer carries out scoped software work; the trusted broker controls permissions and deployment.
| Boundary | Implementation contract | Authority |
|---|---|---|
| NIX intent interface | Replace the coding-agent interface with intent, questions, research results, task progress, and a requested application view. Connect the interface to Pioneer through a versioned service API and NIX adapter. | No desktop or terminal by default. Developer views appear on request. |
| Rust intent broker | Track intent_id, session_id, task state, capability grants, cancellation, and artifact receipts. Translate Pioneer events into understandable NIX progress. | Validate plans independently of model output; enforce user scope. |
| Pioneer service Pod | Run a versioned Pioneer service headlessly in a local Linux guest. Authenticate the internal endpoint and restrict it to the NIX broker over a private guest channel. | Read/edit approved workspaces; invoke scoped research and build tools. No direct Core or host-admin access. |
| Paid Intent inference | Use only the Pioneer model through the NIX Intent API at core-nix.com/intent/v1. A valid paid Intent token is required. Cloudflare runs the model behind the server-side Agent binding. | Credits are checked and charged on the server. Cloudflare credentials stay on the server; the client uses its own NIX Intent token. Other AI providers are disabled. |
| NIX tool adapters | Expose typed tools for research, scoped Memory access, isolated builds, and deployment proposals through supported custom-tool or MCP integrations. | Each call passes through the capability broker. Tool instructions cannot grant privileges. |
| Core kernel | Provide isolation, IPC, scheduling, drivers, and the virtualization backend required to host the service Pod. | Kernel and driver updates remain signed system operations outside the agent. |
Refactor the experience; preserve the engine boundary.
Keep Pioneer’s software work behind a versioned service boundary. Pin the engine and API schema, record changes, and test task creation, progress events, cancellation, tool errors, and upgrade compatibility. The interface can evolve while the execution and permission contract stays explicit.
Memories adapter
Proposed NIX tools: memory.search, memory.read, memory.stage_write, and memory.commit. These proposed NIX interfaces define the access Pioneer receives. Map only approved Memories into the agent’s working directory. Commit changes through versioned receipts; never mount the full personal store.
Pod adapter
Proposed NIX tools: catalog.search, research.fetch, build.run, pod.propose, pod.install, and pod.rollback. Builds receive restricted source and dependency access. Installation is executed by the trusted broker after policy checks, separate from the agent workspace.
Intent execution contract
Understand → Ask → Research → Select → Build if needed → Verify → Deploy → Open. Every transition has an intent ID and a recorded result. Existing software is evaluated first. A failed build stays inside its Pod; a cancelled task cannot publish a late artifact. Installation uses immutable artifact hashes and a rollback receipt.
Example: “I want to write a book.”
NIX asks whether a manuscript exists. The broker creates a scoped Pioneer task, checks the approved software catalog, and compares reusable editors. If adaptation or new code is required, Pioneer works in a build workspace, runs checks, and returns an artifact and permissions manifest. The broker deploys Author and opens its writing interface. Manuscripts are Memories; desktop icons are optional.
Intent credits and network control
Pioneer’s tools and source files run inside its Linux instance. AI requests use the paid NIX Intent API exclusively. One bounded model request costs one credit, with up to 4,096 output tokens. Retries with the same request ID reuse the response without another charge; failed inference is refunded. Research and package retrieval use the guest’s network. Cloudflare tokens are never supplied to the guest.
Runtime and release gates
Pioneer’s runtime dependencies run inside the Linux service guest. This requires Core’s VM support first; a development host can validate the adapter separately. Native execution on Core requires porting the runtime, process, filesystem, networking, and toolchain dependencies. A new UI alone does not supply native-kernel compatibility.
Acceptance gates: paid Intent access and credit accounting verified; other AI providers disabled; unrelated Memories inaccessible; builds cannot install directly; cancellation stops tool work; crashes preserve committed content; rollback restores the previous artifact; desktop and terminal remain absent until explicitly requested.
From “write a book”
to a place to write.
- Understand the outcome.
NIX asks whether you are starting fresh or continuing a manuscript. The intent broker records that scope.
- Look for a good existing tool.
The software engine checks approved capabilities before proposing an adaptation or a new build.
- Work in a bounded space.
Only the selected project and granted tools reach the agent workspace. Personal Memories outside the task stay outside it.
- Return a reviewable result.
The engine returns an artifact, verification results, and requested permissions. The broker handles installation and launch.
A useful agent.
A dependable boundary.
The integration needs evidence across normal and failure paths: a cancelled build, a broken dependency, a service crash, an expired grant, or a model that returns an invalid plan. Each case should leave a clear result and a usable NIX prompt.
See the system boundaries ↗