Backbay Industries

Backbay Industries builds infrastructure for autonomous systems.

We are interested in agent swarms, decentralized software, runtime control, security, and trust.

We make autonomous systems more reliable, governable, and real.

A policy engine, an EDR, and a signed audit chain in one binary. An agent's tool_call sits in the same event taxonomy as a kernel-level file_access, process_exec, or network_flow — one policy engine evaluates them all, and defaults fail closed. Every verdict ships an Ed25519 receipt, content-hashed into a per-session causal graph that threads agent identity through downstream OS events.

Ships as a Rust crate, TypeScript SDK, Python package, Go module, CLI, macOS and Linux desktop agents, and an enterprise control plane. Plugins for Claude Code, Cursor, and OpenClaw.

MCP tells an agent how to call a tool. Chio proves what it was allowed to do, what it cost, and what happened. A capability kernel where authority arrives as a signed, expiring, budgeted grant that can be narrowed on delegation but never widened, every call is metered against that budget, and every decision settles into a forgery-resistant receipt.

Security-critical semantics are mechanically verified across six proof lanes — Lean 4, Aeneas, Creusot, Kani, TLA+/Apalache, and differential tests — against a published assumption boundary.

An open specification for what an agent may do at runtime — filesystem access, network egress, tool usage, secret detection — without prescribing how those controls are enforced. That separation makes policy portable across runtimes, frameworks, and languages. Core spec, four conformant SDKs (Rust, TypeScript, Python, Go), JSON Schemas, and the h2h CLI.

Autonomous detection and live response in one Rust runtime. Twelve detector families evaluate kernel, cloud, and infrastructure telemetry on a hot path measured in microseconds. Findings are deposited as signed, decaying pheromones: weak signals from unrelated detectors accumulate on a shared target, evaporate when nothing reinforces them, and escalate only once independent sources agree. The swarm is the runtime, not a training-time optimizer wrapped around a static classifier.

Destructive response routes through a deterministic policy gate requiring a signed governance receipt, and fails closed.

Chio integrations — Claude Code · Cursor · Codex · OpenCode · OpenClaw · bridge · conformance · examples

Apache-2.0 across the board. backbay.io · connor@backbay.io