{"id":"68734315-2bcf-4f97-bc20-55ee97448546","slug":"zkos-labs-bastion","kind":"skill","name":"bastion","summary":"A programmable Trust Runtime for autonomous AI systems. Durable execution, policy enforcement, verifiable provenance, and multi-chain trust orchestration.","owner":"zkos-labs","repoUrl":"https://github.com/zkos-labs/bastion","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":3,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-05-07T19:52:28.000Z","addedAt":"2026-10-21T17:19:10.303Z","logoUrl":"https://avatars.githubusercontent.com/u/263369112?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["writing"],"tags":[],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-25T20:42:16.667Z","sample":false,"url":"https://conduits.dev/tools/zkos-labs-bastion","language":"TypeScript","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Bastion\n\n> **The Programmable Trust Runtime for Autonomous Systems.**\n\n[![npm](https://img.shields.io/npm/v/@zkos-labs/bastion-agentique?label=bastion-sdk)](https://www.npmjs.com/package/@zkos-labs/bastion-agentique)\n[![npm](https://img.shields.io/npm/v/@zkos-labs/bastion-web2?label=web2-sdk)](https://www.npmjs.com/package/@zkos-labs/bastion-web2)\n\n> ⚠️ **Alpha Software** - APIs and runtime behavior may change before the first stable release.\n> This document marks what ships today vs. what is planned. **No component is on mainnet with\n> real value:** production deployment is gated behind an external security audit - see\n> [`docs/MAINNET_READINESS.md`](docs/MAINNET_READINESS.md) and [`docs/EVM_READINESS.md`](docs/EVM_READINESS.md).\n\n**Status legend:** ✅ shipped & tested · 🟡 partial / not fully wired · 🚧 planned / stubbed\n\nFor endpoint-level technical documentation, see [`docs/OVERVIEW.md`](docs/OVERVIEW.md).\n\n---\n\n## Overview\n\nBastion is a **Programmable Trust Runtime** for AI agents, autonomous systems, and enterprise applications.\n\nRather than building security, policy, and blockchain logic into every application, Bastion provides a unified runtime that orchestrates identity, policy, privacy, durable execution, and verifiable trust across multiple execution environments.\n\nDevelopers define **trust requirements**.\n\nBastion determines **how those requirements are enforced**.\n\nToday, the shipped core is a **transaction firewall**: agents submit intended actions, Bastion\nevaluates them against programmable policy, simulates them, applies human-in-the-loop review when\nrequired, and writes a verifiable audit record. The broader runtime (durable workflows,\nconfidential compute, cross-chain settlement) is under active development - see the roadmap below.\n\n---\n\n## Why Bastion?\n\nAI agents can reason.\n\nProduction systems require trust.\n\nAutonomous workflows must survive failures, prevent duplicate actions, enforce organizational policies, preserve privacy, and provide verifiable audit trails.\n\nBastion provides the runtime that makes autonomous systems safe to deploy in production.\n\n**Bastion is an open-source community project developed by ZKOS Labs.** The core Trust Runtime is released under Apache 2.0. It is free to use, modify, self-host, and redistribute. There are no protocol fees, tokens, ICOs, or mandatory hosted services. Any developer, agent framework, or blockchain network can integrate Bastion without permission or licensing costs.\n\nThe hosted Bastion sidecar is provided as a convenience for developers who do not wish to self-host. A small number of compute-intensive operations such as transaction simulation, policy updates, human overrides, and circuit breaker operations are subject to usage limits and optional usage-based pricing after a generous free tier.\n\nDevelopers who self-host Bastion retain full functionality without any platform fees. Hosted pricing exists solely to operate and maintain the public infrastructure. Community members can also support ongoing development through GitHub Sponsors.\n\n---\n\n## Core Capabilities\n\n| Capability | Status |\n| --- | --- |\n| Programmable policy engine | ✅ |\n| Transaction simulation & verification | ✅ |\n| Human-in-the-loop approvals | ✅ |\n| Verifiable trust ledger | ✅ |\n| TypeScript SDK | ✅ |\n| AI agent identity & delegation | 🟡 |\n| Multi-chain execution planning | 🟡 |\n| Web2 API policy gateway | 🟡 |\n| MCP server | 🟡 |\n| Dashboard & monitoring | 🟡 |\n| Durable workflow execution | 🚧 design phase - see [Epic A](docs/IMPLEMENTATION_PLAN.md#phase-1-durable-workflow-engine--epic-a-1700-loc-2-3-weeks) |\n| Confidential policy verdicts (ERC-8354) | 🚧 draft — see [`docs/ERCS.md`](docs/ERCS.md) |\n| Unclonable agent credentials (ERC-8380) | 🚧 draft — see [`docs/ERCS.md`](docs/ERCS.md) |\n| Secrets management (Vault) | 🚧 planned - see [Epic E](docs/IMPLEMENTATION_PLAN.md#phase-3-secrets-management--epic-e-500-loc-1-week) |\n| General-purpose policy (OPA) | 🚧 planned - see [Epic F](docs/IMPLEMENTATION_PLAN.md#phase-2-general-purpose-policy--epic-f-600-loc-1-week) |\n\n---\n\n## How Bastion Composes Existing Standards\n\nBastion orchestrates - it does not replace - the Ethereum ecosystem's trust primitives.\n\n| Standard | Provides | Bastion Adds |\n|----------|---------|-------------|\n| ERC-4337 | Smart accounts | Policy-aware execution, recovery, multi-chain routing |\n| ERC-7579 | Wallet modules | Trust modules, policy validators, execution planning |\n| ERC-8004 | Agent identity | Runtime authorization and cross-standard orchestration |\n| ERC-8126 | Agent verification | Automatic policy decisions from verification results |\n| EAS | Attestations | Lifecycle orchestration and execution evidence |\n| Sign Protocol | Cross-chain attestations | Runtime-generated portable trust records |\n| Lit Protocol | Key management | Confidential execution policies |\n| EigenLayer | Shared trust | Runtime coordination using cryptoeconomic trust |\n| Pact Network | Payment refunds | Auto-insured outbound API calls for agent payments |\n| trustless-ai / agent-ercs | ERC-8004, ERC-8263, ERC-8281, ERC-8299 | Standard agent identity, anchor proofs, OCP/WYRIWE provenance - recompute-able |\n| ERC-8354 (draft) | Confidential agent policy verdicts | ZK proof that a committed (secret) policy allows an action — `IConfidentialPolicyVerdict` |\n| ERC-8380 (draft) | Unclonable agent execution credentials | Single-use ZK-nullifier capability so a cloned agent can't replay a credential |\n\nSee [`docs/COMPETITIVE_LANDSCAPE.md`](docs/COMPETITIVE_LANDSCAPE.md) for the full competitive analysis.\n\nBastion composes with the [trustless-ai](https://github.com/trustless-ai) ERC stack and [confidential-agent-policy-verdicts](https://github.com/zexoverz/confidential-agent-policy-verdicts) for the full confidentiality spectrum: secret organizational policies (ZK) layered with transparent programmable trust rules (Bastion). See [`docs/TRUSTLESS_AI_INTEGRATION.md`](docs/TRUSTLESS_AI_INTEGRATION.md).\n\n---\n\n## Architecture\n\n```text\nApplications\n    │\nAI Agents · DAEMON · Enterprise Systems\n    │\n──────────── Bastion Runtime ────────────\nIdentity Runtime            🟡  ERC-8004, ERC-8126, DID/VC\nPolicy Runtime              ✅  OPA + Runtime Rules\nWallet Runtime              🚧  ERC-4337, EIP-7702, ERC-7579\nDurable Workflow Engine     🚧\nConfidential Verdicts       🚧  ERC-8354 (draft)\nUnclonable Credentials      🚧  ERC-8380 (draft)\nTrust Ledger                ✅  EAS, Sign Protocol\nExecution Planner           🟡  EVM (Monad, Sepolia, Base, Celo, zkSync, Robinhood)\nSettlement Router           🚧  Ethereum, Pact Network\n─────────────────────────────────────────\n    │\nEthereum · Monad · Base · Celo · zkSync · Robinhood · Pact Network\n```\n\nSee [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for the complete capability architecture with Bastion's proprietary runtime layer, composable infrastructure mapping, and data flow diagrams.\n\n---\n\n## Multi-Chain by Design\n\nDifferent execution environments serve different purposes.\n\n| Capability                    | Network  | Status |\n| ----------------------------- | -------- | ------ |\n| On-chain policy + audit       | EVM (Monad, Sepolia, Base, Celo, zkSync, Robinhood) | 🟡 contracts written & tested; testnet-only, mainnet 🚧 behind audit gate |\n| Confidential policy verdicts  | EVM      | 🚧 ERC-8354 (draft) — see [`docs/ERCS.md`](docs/ERCS.md) |\n| Unclonable agent credentials  | EVM      | 🚧 ERC-8380 (draft) — see [`docs/ERCS.md`](docs/ERCS.md) |\n| Trust anchoring & settlement  | Ethereum, Solana | 🟡 per-chain sim wired (`settlement:\"ethereum\" | \"base\" | \"celo\" | \"zksync\" | \"robinhood\" | \"monad\" | \"polygon\" | \"arbitrum\" | \"solana\"`) |\n| Payment guarantees            | Pact Network | 🚧 planned - on-chain refunds for x402 agent payments |\n\n> **Retired:** the legacy Solana on-chain Anchor audit program and Arcium are\n> archived (see [`docs/ARCHIVE.md`](docs/ARCHIVE.md)). Solana *settlement*\n> (RPC-based simulation via `TrustAdapter`) is active — Bastion is multichain\n> (EVM + Solana), not EVM-only.\n\nApplications interact with Bastion-not individual blockchains.\n\n---\n\n## Trust Lifecycle\n\nEvery workflow follows the same trust pipeline:\n\n```text\nIdentity\n    ↓\nPolicy Evaluation\n    ↓\nPrivacy Enforcement\n    ↓\nExecution Planning\n    ↓\nVerification\n    ↓\nSettlement\n```\n\nThis ensures every action is deterministic, auditable, and policy-compliant.\n\n---\n\n## Features\n\n| Component            | Purpose                                 | Status |\n| -------------------- | --------------------------------------- | ------ |\n| Policy Runtime       | Rules, approvals, limits, governance    | ✅ |\n| Transaction Firewall | Transaction validation and simulation   | ✅ |\n| Trust Ledger         | Verifiable audit records                | ✅ |\n| Identity Runtime     | Agent identity, delegation, credentials | 🟡 |\n| Execution Planner    | Multi-chain routing                     | 🟡 |\n| Web2 Gateway         | Secure API mediation                    | 🟡 |\n| MCP Server           | Native AI agent integration             | 🟡 |\n| Dashboard            | Monitoring and policy management        | 🟡 |\n\n---\n\n## Getting Started\n\n```bash\ngit clone https://github.com/zkos-labs/bastion.git\ncd bastion\n\n# Build the Rust workspace\ncargo build --release\n\n# Run the Bastion sidecar (the trust runtime HTTP service)\ncargo run --release -p bastion-sidecar\n```\n\nDashboard:\n\n```bash\npnpm --filter bastion-dashboard dev\n```\n\nSDK:\n\n```bash\nnpm install @zkos-labs/bastion-agentique viem\n```\n\n---\n\n## Example\n\n**Available today** - simulate and policy-check an agent transaction through the firewall, and\nregister an agent identity:\n\n```typescript\nimport { BastionSidecar, BastionEVMClient } from \"@zkos-labs/bastion-agentique\";\n\nconst sidecar = new BastionSidecar({ baseUrl: \"https://bastion-agentique.fly.dev\" });\n\n// Simulate + policy-check an EVM transaction (returns Pass / Block / PendingHITL)\nconst decision = await sidecar.simulateEvm({ chain: \"base\", to, data, value, from });\n\n// Read/write on-chain policy + audit via viem\nconst evm = new BastionEVMClient({ publicClient, walletClient, chain });\nconst count = await evm.getEntryCount();\n```\n\n**Unified runtime facade (🟡 shipped in the SDK, thin composition)** - a single `execute()` call\nwhere developers declare trust guarantees instead of choosing infrastructure:\n\n```typescript\nimport { Bastion, BastionSidecar } from \"@zkos-labs/bastion-agentique\";\n\nconst bastion = new Bastion({ sidecar });\n\nconst result = await bastion.execute({\n  action: \"swap\",\n  settlement: \"ethereum\",  // \"ethereum\" | \"base\" | \"celo\" | \"zksync\" | \"robinhood\" | \"monad\"\n  transaction,             // EVM tx params\n});\n// result.decision → \"pass\" | \"block\" | \"pending_hitl\"\n```\n\n`execute()` composes the existing firewall primitives (policy evaluation, per-chain EVM\nsimulation, audit) behind one call - it adds no new backend. The cross-chain settlement\n**router/planner** is still minimal (chain selection + simulation); true execution planning\nremains 🚧.\n\n---\n\n## Roadmap\n\n* ✅ Programmable policy engine + transaction firewall (EVM simulation)\n* ✅ Verifiable trust ledger (EIP-712 on-chain audit)\n* 🟡 Agent identity, delegation & multi-chain planning\n* 🟡 Web2 API policy gateway (rate / budget / cost / time rules enforced, wired into the sidecar) + MCP integration\n* 🟡 Unified `execute()` runtime facade (shipped in the SDK; settlement planner still minimal)\n* 🚧 Durable workflow runtime\n* 🚧 Confidential policy verdicts (ERC-8354, draft) + unclonable agent credentials (ERC-8380, draft)\n* 🚧 Ethereum trust anchoring & settlement router (post-audit)\n* 🚧 Zero-knowledge policy enforcement · decentralized identity · trust marketplace\n\nSee [`docs/ROADMAP.md`](docs/ROADMAP.md) for detail, [`docs/IMPLEMENTATION_PLAN.md`](docs/IMPLEMENTATION_PLAN.md) for the complete implementation plan (~5,780 LOC across 7 epics), [`docs/VISION.md`](docs/VISION.md) for the long-form vision, and [`docs/COMPETITIVE_LANDSCAPE.md`](docs/COMPETITIVE_LANDSCAPE.md) for the ecosystem analysis.\n\n---\n\n## Contributing\n\nContributions are welcome.\n\nPlease open an issue to discuss new features, architecture proposals, or bug reports before submitting large pull requests. See [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md).\n\n---\n\n## Support\n\nBastion is an open-source community project sustained by the community.\nIf Bastion helps your team deploy autonomous agents safely, consider:\n\n- **[GitHub Sponsors](https://github.com/sponsors/zkos-labs)** - one-time or monthly donation\n- **Star the repo** - helps others discover the project\n\n---\n\n## License\n\nApache-2.0\n\n---\n\n**Built by zkOS Labs**\n\n**Bastion is the programmable Trust Runtime for the agentic internet. It provides the identity, policy, execution, and observability layer that autonomous systems rely on to act safely across programmable networks.**\n\nWhile agent frameworks determine **what** autonomous systems do, Bastion determines **how** those actions are executed safely, verifiably, and under programmable trust policies.\n\nBastion is foundational trust infrastructure for agentic applications.\n"}