Yana AI 🐰

Created by Vũ Văn Tâm · Vietnam

Models propose. Yana decides. Humans stay in charge.

Yana is the control plane between an AI and real power. A model can say what it
wants to do. Yana decides whether that is allowed, and a person can always stop it.

Model        proposes an action
   |
Authority    is this agent allowed to ask?
   |
Capability   what exact power is this?  (a small, fixed set)
   |
Policy       may it happen now?  rules first, then a human
   |
Executor     performs only the permitted operation

Any model goes through the same path: Claude, GPT, Gemini, DeepSeek, or one
running on your own machine. Skills teach an agent how to work; only a
capability can grant permission to act.

System structure

Component	What it does	Where	Status
Yana Studio	Desktop workspace for working with AI on a real project.	`tools/yana-studio`	Live
Runtime (`yana-rt`)	Rust engine: one turn loop and one authority contract for local and cloud models, 19 providers.	`src/`	Live
Governance	Capability manifests, human approval, hash-chained audit log, core-lock integrity, and Giám Thị, an independent watcher that can halt every session.	`core/`	Live
Harness adapters	Claude Code, Codex, Cursor and Antigravity, governed through generated hooks, rules and gates. Enforcement strength differs per host.	`adapters/`	Live, varies by host
Knowledge layer	100 agents and 2,026 skills that teach agents how to work. They grant no permissions.	`core/agents`, `core/skills`	Live
Yana OS	Local management plane: agent identity, autonomy levels, quotas, health, quarantine.	`src/os`	In development
Yana Wheelbot	Robotics platform on ESP32-S3, in its own repository.	`yana-wheelbot`	Experimental

Live means shipped and in use. In development means real code exists but is
not feature-complete. Experimental means opt-in and not independently verified.

yana-rt has 39 subcommands. Zero Python dependency. This is the source-defined count across feature builds, including feature-gated ones.

core/
├── hooks/    # 66 PreToolUse / PostToolUse / Stop hooks
├── rules/    # 71 enforced rules
├── agents/   # 100 specialist agents
├── skills/   # 2,026 skills
└── config/
    └── core-lock.json    # SHA-256 manifest — 287 core files pinned

Yana Studio

One window for the things you switch between when working with AI on a project:

Files and editor: open a real folder, search across it, edit with CodeMirror. Saves detect outside changes before overwriting.
Terminals: real PTY sessions in tabs, or a grid of up to 12.
Git: read-only status, worktrees and diffs.
Chat: streamed through yana-rt, with local or cloud models under the same authority path as everything else.
Governance telemetry: what was allowed, what was blocked, and why.

Download from the latest release
or yana.vutam.link.

Platform	Installer
macOS, Apple Silicon	`.dmg` or `.zip`
Windows	`.exe`, x64 or ARM64
Linux	`.deb` or `.AppImage`

Each release lists its own assets, so check that your platform is there, and verify
against SHA256SUMS when provided. The macOS build is ad-hoc signed and not
notarized (no Apple Developer membership yet), so Gatekeeper warns on first
launch; docs/MACOS_INSTALL.md shows the two official ways to open it.

Command line

pip install yana-ai    # Python CLI
yana-ai install        # add Yana's hooks and rules to your repo
yana-ai doctor .       # check that everything is wired
cargo install yana-rt  # native runtime, no Python needed

Needs Python 3.11+ (or Rust), Git, and one supported harness. All commands are in
COMMANDS.md. Yana is not published to npm, see VERSIONING.md.

What protects you, and where it stops

Audit log: hash-chained, so editing or deleting a line is detectable. It is tamper-detectable, not tamper-proof.
Core-lock: a SHA-256 manifest detects changed, deleted or injected files in core/.
Human gate: force-push, publish, deploy and delete need confirmation in the current session; earlier approval does not carry over.
Giám Thị: opt-in, runs outside any AI session, and on a finding locks every later tool call until a person removes the lock.
Limits: guard-destructive.sh matches command strings, not a full shell parse, so a deliberately crafted command can slip past it. Browser-only web deployments without the Rust runtime are not fully governed. Details: known limitations.

ARCHITECTURE.md · PHILOSOPHY.md · ROADMAP.md · CHANGELOG.md · CONTRIBUTING.md · SECURITY.md · Acknowledgements · Lineage

Built by one person, no team, no funding: Vũ Văn Tâm, Vietnam ·
yana.vutam.link · [email protected] · Apache 2.0

Yana-AI