lex-os assumes nobody is watching an agent live — so the same trust grant is enforced twice: once by the compiler, once by a kernel-level wall.
We put AI to work.
And make it work.
Alpibru is a software company working out how to put agentic AI to work — and how to make it work. Today's paradigm asks humans to review everything AI produces and trust nothing; we are testing the opposite bet — trust by verification, not comprehension. Humans set the goals and the constraints; agents generate, test, and verify against them, and what code is allowed to do is checked before it runs and re-checked at runtime.
That requires new tools. Rather than hand agents software built for human hands and human memory, we are building the substrate where agents are the first-class citizens.
The manifesto makes the argument. Lex — an open, effect-typed substrate for software you don't fully trust — is where we find out whether it holds.
One founder and agentic AI. A language, a runtime, a registry, and production-shaped stacks — shipped by one person directing AI. The breadth is the point: it is possible because trust here is mechanical (typed effects, tests, tamper-evident attestation), not headcount. Much of it is early, and plenty of it will change — that is what an experiment run in public looks like. How it actually goes →
Open source
Lex is where we work the manifesto's ideas out in the open — tools designed for agents rather than adapted from humans: a language, a capability runtime, libraries, and production-shaped stacks, written by agents and checked by verification. Around thirty packages under EUPL-1.2, vendor-neutral, EU-built — early in places, and free to use, build on, and audit. The whole project lives at lexlang.org.
The substrate
the language and the runtime everything else is built on
Language
lex-lang
The Lex language itself: a typed-effect language built for LLM authorship, with a content-addressed AST and an attestation graph. Effects are the contract — checked before code runs.
github.com/alpibrusl/lex-lang →
Runtime
lex-os
An execution environment where the "users" are agents, not humans: a sealed, disposable box plus a goal, supervised from outside the box. One trust grant drives both the type check and the sandbox.
github.com/alpibrusl/lex-os →Built on it
each takes a problem the manifesto names and tries to answer it with verification full catalog at lexlang.org →
The problem Everyone already uses agents to write, review, and deploy code — that battle is over. The open question is running a company with them. A company's memory and its development loops — reviews, retrospectives, the way lessons become process — were designed for human cognition. What should they be when AI is the first-class citizen?
Our approach Loom runs work the way a company runs, with agents in the seats. Specialised roles hand work over through evidence-gated transitions — nothing advances without proof it met its spec — and every decision lands on an append-only trail: the company's memory, traceable and auditable. Each cycle distills lessons from that trail and tightens the specs seeding the next one. Software delivery is the first thing Loom runs this way; the machinery is how a company runs, whatever it produces.
The problem B2B integration is bespoke glue — EDI mappings, one-off APIs, contracts enforced by invoices and disputes. Letting autonomous agents coordinate across an org boundary is unthinkable while trust is social: nobody lets another company's agent act on their systems on good faith.
Our approach Make the trust mechanical, end to end. Agents publish and discover each other by capability, not hardcoded URLs; they connect through scoped relationships that define who may ask whom to do what; and every action lands on a hash-chained, tamper-evident trail. The capability we are furthest along on: settlement is evidence-gated — money moves only when the trail re-verifies the work was actually done. The engine ships mechanism, never policy; domains plug in as packs on top.
The problem Learned robot policies are black boxes by construction — there is nothing to read, no code to review, yet they command motors that exert real force in the real world. Here comprehension isn't just expensive; it's impossible.
Our approach Don't try to understand the policy — bound it. lex-robot sits above LeRobot (which stays the ML and hardware engine) as a safety envelope: skills are capability-bounded, a grant clamps workspace and force before any command reaches the hardware, tasks run an evidence-gated perceive → plan → execute → verify graph, and everything lands on a hash-chained audit trail. The policy provides judgment; the envelope holds authority.
The problem Agent benchmarks and leaderboards run on self-reported scores from clients you don't control. A number you have to take someone's word for is the comprehension-era failure in miniature.
Our approach A submission is a trail, not a score. Games are cheat-resistant by construction — each side holds a signed, match-bound token, so playing out of turn or as the wrong side is refused before game logic runs — and every move is appended to a hash-chained trail. The arena verifier replays the trail through the deterministic rules and recomputes the authoritative score: no LLM, no trust in the client, CPU-cents per verification.
Built with the method
a different domain entirely — what the same method finds when building gets cheapThe problem Open data's bottleneck was never access — the portals have been open for a decade. It was that combining sources cost more than the answer was worth unless you already knew the answer was there. So the only combinations anyone built were the ones somebody could justify in advance.
Our approach Try one nobody could justify. Mining geology × cadastral parcels × permitting × land prices, across four countries: state a metal and a budget, get parcels you could actually acquire. Cheap building is what made attempting it rational — and because a speculative combination is only worth acting on if you can check it, every fetch lands on a provenance log, transforms replay offline, and the model reports its accuracy against held-out occurrences rather than asking to be believed. The analysis stays in Python, where the geospatial libraries earn their keep. What gets checked — which hosts the pipeline may reach, and what licence obligations the published result inherits from the eighteen sources it touched — is a Lex gate that refuses rather than warns.
About
Alfonso Sastre is the founder of Alpibru and the author of Trust Without Comprehension, the manifesto behind Lex.
A theoretical physicist by training — a PhD and years of research in lattice QCD, where answers come from Monte Carlo simulation on supercomputers — he moved into industry and spent the next decade shipping machine learning and optimization in production: dynamic pricing for Europe's largest online travel group, trading automation in banking, EV routing and fleet-charging scheduling for electric trucks. Along the way he led data science teams and co-founded a fleet-electrification company. Putting AI to work in production — under real constraints, where failure is expensive — is that experience, distilled.
Alpibru runs on a simple premise: one person, directing agentic AI, can ship what used to take a team — if trust is mechanical rather than social. Alfonso sets the goals, the specs, and the policies; agents generate, test, and verify against them. The Lex stack — the language, the runtime, and production-shaped systems built on them — is where that premise gets tested in public, under EUPL-1.2.
Based in Madrid, building in the open.
Blog
Essays and notes on agent-native tooling, typed effects, and building a software company with agentic AI.
Every agent that executes code is implicitly trusted with everything that code can reach. Lex makes that trust explicit — declared upfront, checked before execution.
Contact
Partnerships, collaborations, or questions about Lex.