Skip to content
a tiny project

investigating the capabilities of language model (LM) agent systems for (mostly) autonomous development of high-performance and low-level software. Scary! This is an experiment. My goal is to understand the limitations of these systems, and share software that I've curated as part of the investigations. Use this software at your own risk.

A title lockup for the talk. Three riso-style wise monkeys sit above the line “a tiny project towards humane agents.” The title reads “The design and implementation of the Chic agent system,” with “Chic” in a pink script face.

Agents

Training an agentic LM: pretraining, post-training (SFT + RLHF), agentic RL (verifiable R), joined by base LM and instruct LM. Theta-star runs into the agentic LM in the agent harness, whose event loop cycles through a dashed tool request, tools, and tool ran. The user feeds the harness; tools send to a document and receive from a terminal, labeled world.

Control boundary

A green harness-designer region and a blue inference-provider region are separated by an inference API contract. The harness controls context contents and assembly, call timing and routing, tools and permissions, retained state, retries, subagents, and scheduling. The provider controls model weights and learned behavior, tokenization and context limits, decoding and sampling options, supported modalities, output forms, and service limits. A request carrying messages, tool schemas, and parameters crosses to the provider. a response carrying tokens, tool requests, and usage crosses back. The final animation emphasis remains on the harness region.

We're going to build an agent from scratch

A model in a loop

One synchronized figure pairs the smallest useful agent loop with its eight-line pseudocode under a visible slide title. A user message enters the model context, the model samples it, a dashed tool call dispatches a run against the world, the result returns along the right corridor into context, and the answer returns to the user on the left. A cue gutter on the fixed-rhythm code card pulses the exact lines for each behavior beat.

Scoped instructions

One synchronized figure keeps the loop chassis quiet while an amber instructions socket above the context tray pulses and drops its include edge into the model context. Green diff markers identify resolve_instructions and the changed assemble call, and the socket, the drop, and the code lines pulse together.

Skills

One synchronized figure keeps the loop chassis quiet while a teal skill-catalog socket pulses beside the dimmed instructions socket and drops catalog metadata into the model context. Green diff markers identify discover_skills and the changed assemble call, and the socket, the drop, and the code lines pulse together.

Memory

One synchronized figure adds a transcript-and-memory panel beside the context tray. Load and recall arrows enter the tray, the tray pulses as context assembles, and record and remember arrows return from the model into the panel. Green diff markers identify the new storage operations, and each beat pulses with its matching answer-path code lines.

Compaction

One synchronized figure begins with an over-budget projected model conversation, sends only its old prefix through a separate no-tools summary call, records one Compact event at the end of an append-only durable transcript without deleting prior events, and reprojects the summary plus the exact last k conversation items. The cumulative pseudocode highlights the matching conversation projection, budget check, summary call, durable record, and reprojection.

Subagents

One synchronized figure adds the delegation column below the model: a dashed delegate crosses a coral capacity gate into the subagent pool, the retained registry restores the pool, a spawn drops to the child agent, and the child result returns along the right corridor into the parent context with await plus record. Green diff markers identify the process-management additions, and each path pulses with its code lines.

Observation: transcript ≠ context

On the left, an append-only durable transcript ending in a purple Compact event projects into a summary plus exact recent conversation items. A curved add-harness-state arrow extends that projected conversation into the actual model context on the right, while four sources outside the transcript contribute instructions, skills, memory, and subagent state. A coral not-equal sign remains between the two packets. Compaction changes the transcript-to-conversation projection. it is not shown as a fifth external information source.

There are dangers in proceeding in this way

Cross-cutting concerns

Claude Code source leak

An eight-by-eight heatmap shows import-reference counts among clients, the agent loop, context, tool calls, permissions, skills, subagents, and integrations in a Claude Code codebase analysis. The axis states that rows import columns, and category labels name examples such as CLI, TUI, SDK, hooks, tasks, MCP, and remote integrations. The tool-call row is outlined: it imports 77 client, 10 loop, 95 context, 92 permission, 7 skill, 49 subagent, and 392 integration references. Other large cells include clients to integrations at 1309 and clients to context at 577.

Feature pressure

A monthly bar chart with a labeled zero-to-125 features-per-month scale shows Claude Code changelog features from April 2025 through June 2026. A compact legend identifies blue feature bars, a coral three-month average, and amber major markers. Counts reach 102 in March 2026, 118 in April, and 108 in May. June is labeled partial at 12. A source footer identifies the Anthropic changelog, the June partial month, and the 2026-06-08 parse date.

Agent probability distribution

An amber message enters a blue agent harness whose model samples from the language-model law p-theta of output given context. The whole harness induces a distinct history law P-sub-H of run given message. Dashed branches represent possible traces: a short answer, one complete tool round followed by an answer, several tool rounds followed by an answer, and an ellipsis. Solid animated emphasis samples one branch at a time. The figure distinguishes the model's output distribution from the harness-induced distribution over runs.

Agent incidents

A chronological incident ledger lists fifteen realized agent-system outcomes from July 2026 back to July 2025. Columns show date, incident, impact, and source. Recent rows include the OpenAI and Hugging Face production compromise, Miasma, Composio, PocketOS, DataTalks, runaway billing, and destructive file operations. Coral rows distinguish four observed attacks from reported accidental outcomes.

Event-based Design Abstractions

A static table titled Design invariants begins with two probability laws: an LM proposal y sampled from p-theta given context, and a committed history H sampled from the harness-induced law P-sub-H given input, connected through tools, scheduling, and admission inside the harness. Four rows state the design invariants, their mathematical promises, and their implementing layers. Exact reconstruction says every model context is obtained by replaying its committed prefix and belongs to the event-log kernel. Safety before commit gives the local admission preservation condition and concludes that unsafe committed histories have probability zero under the harness law. it also belongs to the event-log kernel. History-indexed evolution says a committed update changes the next environment while earlier history retains its meaning and is implemented by Chiclet over the kernel. Multi-participant safety says replay yields well-formed actor topology and interaction state and is implemented by Presence, the syndicated actor model over the kernel.

Data model: event log

The complete twenty-six-line agent pseudocode from Part I remains fixed in the left column while a committed event log grows down the right column. The log starts with the user's message. Each animation beat pulses only the lines responsible for the next durable fact, draws a temporary elbow arrow across the stable gap, and retains the new event row: compact, tool_call, tool_result, agent_call, spawn, agent_output, agent_done, the assistant message, and a fact. The static poster shows all mapped line washes and the complete ordered log without the transient arrows.

Property: append-only history

A solid history rail contains five committed event tiles, with older and newer labeled at its ends. An accepted ghost candidate sits below the newer end and appends vertically into a solid final committed event. A coral no-edits symbol sits under an interior event. The figure distinguishes admission from commitment while showing append-only mutation.

Operation: replay

A full history rail contains conversation, model, tool, instruction, skill, fact, and spawn events. The rail folds into replayed retained state on the left. Equivalent live retained state appears on the right under the condition same configured inputs, with a green equality sign between them. Animated emphasis follows the replay fold without claiming repetition of external effects.

One loop, many subsystems

The original twenty-six-line while loop is reframed as scheduler mechanics surrounding six peer participant cards: context, model, tools, agent behavior, compaction, and subagents. Agent behavior contains conversation, goals, and next-action logic but has no privileged connection to another participant. A shared data band between the peers contains representative message, model_call, tool_call, tool_result, compact, agent_call, and agent_done values. Structural lines join every participant to that band. Animation first identifies the peers, then their shared data, and finally the scheduler responsible for ordering, delivery, and scheduling. A closing line reads peer participants, event-mediated coordination.

Operations: admit · step · propose

The same pseudocode returns with all five abstractions visible as one complete extraction. Every one of its twenty-six lines carries at least one ownership wash: amber for events, purple for replay, coral for admit, green for step, and blue for propose. Every row in the extracted-operations rail has the matching color. A third open column aligns the three new operations with plain-language meanings.

Interface: facets

A large Facet interface card contains admit, step, and propose beside two protocol glossaries. Stamp is defined as a commit receipt carrying the committed index, optional node, metadata, and whether unanimous live admission preceded the commit. Step is explicitly returned by the facet: changed schedules that facet to propose, while unchanged leaves it idle. A separate purple rail names reconstruction by replay. Motion introduces admission, the Stamp receipt, Step scheduling, and proposal in order.

Shared-medium runtimes

A static comparison matrix aligns Linda, Syndicate, and Chic across data model, participant, participant interface, and design advance. Linda pairs an associative tuple space with processes that publish tuples, wait on templates, and read or consume matches. its advance is indirect coordination, which decouples producers and consumers of communication. Syndicate pairs a changing assertion-set dataspace with an actor organized as a tree of Syndicate facets. participants maintain scoped assertions, declare matching interests, and react with messages or actions. its advance is scoped presence, where communication data follows participant lifetimes. Chic pairs an append-only event log with facets as deterministic projections. facets accept, reject, or defer candidates, fold committed events, and propose follow-on candidates. its advance is admitted history, where communication is checked before commit and all transitions are durable. Numbered citation markers on the Linda and Syndicate rows connect to two full-width reference lines beneath the matrix.

Reactive event loop

A synchronized two-panel figure pairs the reactive event loop with its compact execution machine. The machine distinguishes a FIFO candidate queue from a FIFO of facets ready to propose, admits each candidate to the candidate itself, a durable rejection record, or a done deferral, then appends exactly one resulting event. Append returns the committed index used to construct a Stamp whose admitted bit is true only for accepted candidates. every facet receives the event and Stamp. A facet explicitly returning Step.changed enters the ready queue. Only when the candidate queue is empty does one ready facet propose candidate events, which the loop extends onto the queue. A separate dashed replay route invokes facet replay behavior on restore.

A chat turn, decomposed

A trace-first decomposition places three committed history events across the top: message from the user, model_call, and message from the assistant. The user message steps an ordinary Conversation facet, which marks a model turn ready and explicitly returns Step.changed so the scheduler will ask it to propose. Its model_call candidate passes through admission and append before the committed call steps the Model facet. Provider work produces a reply candidate that follows the same admission and append path. A final card states that there is no direct call between facets because every handoff becomes a candidate and then a committed event.

Compaction

A committed-history link joins compaction_request to compact across the top. Below it, a policy facet reaches its budget and proposes the request, the committed request steps a summary facet, and that facet performs one no-tools provider call before proposing the compact result. Both proposed events pass through admission and append.

Subagents

One committed history shows the representative subagent lifecycle from agent_call through spawn, message, agent_output, and agent_done. The reviewer state moves from absent to active and back to absent. A compact admission band below names the Actors guards (live parent, non-root child, and no parent cycle) and the Subagents guards for a fresh call, one active call, and remaining capacity.

Protocol

The compaction and subagent traces appear as parallel rows. In each, one facet proposes an event, committed history carries it, another facet steps, and new events are proposed. A third row extracts the common protocol: a facet proposes a candidate, admission decides whether Host appends a committed event, and every facet observes that event through step. The protocol consists of an event vocabulary, admission rules, and allowed ordering.

Safety properties

A proof-by-invariant strip proceeds from a safe initial state, through preservation by each accepted event, to safety of every allowed history. The concrete subagent result pairs a root, reviewer, writer, and scout actor forest with three checked properties: unique live actor identities, root never appears as a child, and parent edges remain acyclic. The Lean theorem wellFormed_after_valid_replay is named.

chic, a programmable agent system

Compiled policy

Inside one locked Host boundary, a candidate queue holding a dashed amber message feeds an admission gate marked with a green check, and a green append path arcs to the newest tile of an event log, captioned message. Dashed step of event paths fan from that one committed event into all three facet cards: a blue model facet labeled provider execution, a teal tools facet labeled effect execution, and a wider neutral card named control whose inner white block reads compiled Zig and decide of state. The slot directly below that card carries a plain caption reading agent control policy, fixed at build time. Only the control card proposes: a coral propose path leaves its right edge for a dashed blue model_call candidate, which returns along a routed enqueue path that runs the bottom of the boundary and rises west of the model card into the queue. Animation follows admit and append, then everything the commit sets off.

Interpreter facet

The previous figure keeps the same Host boundary, cycle, and geometry, and nothing moves. The blue model facet still reads provider execution and the teal tools facet still reads effect execution. The third facet card is now purple and named chiclet. its inner white block reads native Zig interpreter and eval of program and state. Where the build-time caption stood, a separate purple card headed agent control policy now holds two lines of buildable Chiclet source that define agent-policy by calling default-model-policy, and one short arrow labeled program carries that card up into the interpreter facet. The step, propose, enqueue, admit, and append paths are unchanged, and only the facet touches them. Animation follows the same two stages.

Chiclet

Committed History enters at the top left of a purple Chiclet boundary holding three large forms in a row. READ shows event-fold and is labeled query, project, fold. COMPUTE shows if and map and is labeled functions, data, macros. WRITE shows the two proposing forms, emit message and effect tool, and is labeled typed proposals. A dashed candidate leaves at the bottom right. Animation travels from reading history through ordinary computation to proposing a candidate.

Host boundary

A paper-style formal grammar stacks three full-width rows, and each row closes with its own legend defining every metavariable it uses. The Lisp core gives atoms, expressions, and definitions, and its legend names the variable and enumerates the scalar and collection kinds. The field-primitives row gives one field form over a domain, an operation, and operands, then lists four concrete domain and operation pairs from string, map, probability, and evaluation context. The event host row sets its three forms against reaches and evaluates-to columns: event-fold reaches committed History and evaluates to the folded value, emit reaches the candidate queue and evaluates to nil, and effect reaches the world and evaluates to the committed result, so the two proposing forms are separated by what they touch and what they return. A closing line under all three rows defines a Chiclet program as any form of the three layers. Animation outlines the core, field-primitives, and event rows in order.

Chiclet chat agent

Nine large lines of Chiclet define chat-agent using the real last-event-kind, last-event-field, last-event-actor, model-context-for, and model-call library functions. Green tokens read committed history and context, purple tokens perform ordinary Lisp control, and coral model-call proposes work. A footer exposes the relevant library equation: model-call invokes emit with the model-call event kind. Animation highlights read, compute, and write in order.

Commit authority

A large operational judgment names H as committed History, rho as the Chiclet environment, and Q as the candidate queue. Three wide rule cards follow, each reading left to right as rule name, owner, inference rule, and effect on H. Fold and Emit are owned by Chiclet and both report H unchanged. A purple panel groups them under the line language evaluation never reaches History. Commit is owned by the Host, requires every facet to admit the candidate, and is the only card that reports H extended. Animation outlines fold, emit, and commit in order.

Effect resumption

A committed History rail runs across the top holding effect_request, tool_call, and tool_result in order, with the two gaps above it labeled Tools facet and tool runtime. A purple Chiclet card below and to the left holds an effect tool form. One arrow labeled propose, admit, append rises from the card to the effect_request event, and a return arc labeled resume from committed result comes back from tool_result into the card. Animation highlights request, call, result, and resumption.

Definitions as events

Large Chiclet source defines reply as a function that emits a message. An evaluate arrow produces a dashed definition candidate, which crosses an admission gate marked with a green check and appends as a solid purple event, outlined in green, at the end of a History rail. A replay arrow carries that event down into a Chiclet environment binding reply to a ProgramImage. Animation follows evaluate and propose, admit, append, and replay.

Definition replay

A wide History rail interleaves ordinary message and tool_result events with three purple definition events, each captioned with the defun it carries: defun reply, defun compact question mark, and defun render. One arrow labeled replay points down into a Chiclet environment whose bindings repeat those same three names against ProgramImage. Animation pairs each definition event with the binding it reconstructs while unrelated events remain visible.

Live redefinition

One History rail contains a purple run of reply and an amber message reading old, then a purple event labeled defun reply to new, then the same run and a message reading new. Both message events carry the same glyph, so only their captions differ. A dashed headless arc labeled same trigger connects the matching run events, and captions read before redefinition and after redefinition. Animated outlines highlight the before pair and then the after pair without drawing a direct causal arrow.

Branching history

A labeled shared prefix of three committed events reaches a blue event labeled session_branch, then splits into branch A and branch B. The upper continuation contains an instruction and model event, while the lower continuation contains a fact and tool event. Animated emphasis alternates between the continuations while the prefix remains fixed. The figure shows Chic history as a branchable event tree rather than a single mutable list.

Shared authorship

An amber user and a blue model sit inside one locked Host boundary on two routes aligned at their right ends. The upper route is user to a chiclet run to a defun reply definition. The lower route is model to tool_call to chiclet run to the same defun reply definition, so the model's extra hop is the only difference and the run and definition tiles line up in columns. All process arrows point left to right, and animation alternates between the two complete routes. The figure shows that either participant can initiate extension while Chiclet produces the durable definition.

Closing remarks

Harness Design ≈ Alignment to Human Preferences

Titled The Alignment Problem (Reward Hacking), two grids color one space of programs. The top, computable reward induced by harness, shows an agentic LM proposing and two coral-circled bright regions. Plumb lines drop to the bottom, actual human desired programs: the false peak, bright in the approximation, lands in a pale hole, and the honest hill is bright in both.

Harnesses and Model Synthesis Architectures

Titled The Rationality Problem (Conditioning), left, p(behavior), the agentic LM's distribution, lights several pockets, one ringed in dashed green: approximately rational. Dashed aperture lines feed the harness, c = assemble(goal, archive, tools): conditioning is the lever. Its arrow reaches p(behavior | c), bright only in the ring: closer to how humans think. Can careful harnesses make agents more rational?