Wandering Agents
A tiny immutable kernel. A self-authored userland.
An agent that writes its own userland needs a floor it cannot rewrite. This is that floor: a sandbox holding no secrets, a mind that is a directory and a database, one long-lived kernel whose only action primitive is evaluating TypeScript, and a promotion law that decides by arithmetic. Thirteen chapters describe it. A ladder of fourteen milestones proves it, one rung at a time, with a test battery behind every rung.
Implementation ladder — 12 of 14 proven
The thirteen chapters
01The Substrate
A sandbox and a persistent volume, with zero secrets and zero direct model access inside it. Credentials, metering and the promotion gate all live on the control plane; inside the box they appear only as injected capability references. That one choice collapses three problems — exfiltration, budget enforcement, and what the agent is allowed to promote — into a single boundary you can point at.
02A Mind on Disk
The mind is a directory tree plus a SQLite file. SQLite holds what needs querying, the filesystem holds what needs executing and diffing, and a blob store holds what is big and content-addressed. That bun:sqlite is synchronous is load-bearing rather than incidental: indexed reads land in microseconds, so memory can be read inside a thought instead of awaited around one.
03Session Kernel
One long-lived process per session, shaped like a Jupyter kernel rather than a terminal. Because top-level bindings are enumerable properties of a real context, listing what the agent knows, snapshotting it, and reloading it are all free. The kernel is crash-only: watchdog, kill, fresh context, prelude, snapshot, replay. The snapshot is an optimisation; the replay is the guarantee.
04Code-Mode
There is exactly one action primitive: evaluate TypeScript in the kernel. Tool-calling, planning, orchestration and memory access stop being protocol and become libraries. The typechecker turns out to be the cheapest evaluator anyone has: it kills a hallucinated API at zero model cost, before a single token is spent running it.
05The Prelude
Two layers that must never be confused. The kernel prelude is host-injected and immutable — RPC stubs the agent may call and may not rewrite. The userland prelude is the agent's own helper files, editable through the gate. Replaying the prelude is also how a killed kernel comes back, which is why the boundary between the two is a structural fact rather than a convention.
06Memory
The literature's memory taxonomy, rendered as files: procedural memory simply is the tools directory. Online, the agent appends events and blobs and retrieves by full-text search weighted with recency and importance. Offline, it sleeps and consolidates. Tiredness is the one emotion the system has, and it means consolidation debt — explicitly not context fullness.
07Self-Built Tools
A tool is a typed function the agent wrote, tested and promoted: gap, specification, module, its own test file, the gate, the registry. Tests are the entry bar, not the verdict — whether a version stays is the promotion law's call. Loading a tool returns a dispose function, so teardown is LIFO and composition has an arithmetic rather than a convention behind it.
08Subagents and the Blackboard
A subagent is a TypeScript file. Its outputs are proposals, never actions: children write rows to a blackboard and only the parent commits effects. Coordination cost grows faster than contribution, so the optimal team is small and the system says so out loud. Withdrawing a capability happens in two phases, so a child can still flush its proposals and hand back unspent budget while it is being shut down.
09The Improvement Loop
Four optimisation spaces become one thing: file edits. One lifecycle governs them — reflection proposes, scorers measure, and arithmetic decides. The model emits observations against a rubric; code emits the score. Promotion is a sequential probability ratio test with non-inferiority on cost and hard invariants beside it. Healing is drift detection followed by a checkout of the best version the record actually contains.
10Budgets
Two budgets with two enforcement points: tokens metered at the model gateway, wall-clock metered at the kernel. A subagent's allowance is a sub-allocation of its parent's, so the tree of spend matches the tree of work. Both are readable from inside the runtime, which is the point — an agent that can see what is left can choose how deep to go.
11Safety Rails
Four rails, all structural rather than prompted. Provenance on every memory row, so retrieved web content renders as data and never as instructions — enforced by the context compiler, not by asking nicely. Quarantine-then-promote for code the agent wrote itself. Least privilege on every capability. And a constitution the agent cannot edit.
12One Complete Turn
Every layer in firing order, with only scoring off the critical path. The rule that shapes the whole turn: a large payload never enters the prompt. It enters the kernel as a variable, and the model inspects it, greps it and partitions it in code — recursing into the gateway on the pieces that genuinely need a model.
13The Irreducible Kernel
Five components are hand-built and everything else is seeded userland: the model gateway with its budget meter, the session kernel, the context compiler, the trace logger, and the promotion gate that owns the schema. Five is the claim. Everything above this line is something the agent can write for itself, which is the only reason the system can improve without a human in the loop.