AN AGENT-NATIVE OS EXPERIMENTFIELD NOTES / 001 — OCT 2026
The OS is the harness.
Keep the loop. Give everything else a better home.
Unharnessed is an agent-native operating system research prototype built on NixOS. Let the model reason. Let the OS own the permissions, the audit, and the undo.
“No harness” doesn’t mean no structure. It means putting structure where it belongs.
The irreducible part of an agent harness is a loop: call the model, run an action, return the result, and stop. The rest—memory, permissions, scheduling, secrets, recovery—already has a natural home in an operating system.
Unharnessed explores that boundary. A small loop and four primitives sit on top of NixOS. The model chooses what to do. The OS decides what it can touch.
For coding, lightweight scaffolding already goes a long way. General desktop work is less settled. That’s why this design prefers structured state and accessibility trees, with pixels as a fallback.
Models are brains. Harnesses are hands. The OS owns the self.
02 / THE INTERFACEFOUR TOOLS. NOTHING ELSE.
A small surface. A whole computer.
Every tool call crosses the same boundary. Every action leaves a record.
THE UNIX INTERFACE
One command. Inside the fence.
Run a shell command as the agent’s dedicated Unix user, inside bubblewrap. A writable workspace. A read-only system. No host secrets and no network inside the shell sandbox.
The shell is subject to the rules—not an escape hatch around them.
● ● ●ILLUSTRATIVE TRACE
intent → sh
command → ls /work
scope → sandbox
result → workspace files
ledger → recorded
↳
A desktop that doesn’t fight you for focus. The agent operates its own headless compositor, under a separate user. A watch-and-take-over VNC view is planned for hardware.
The harness jobs don’t disappear. They move downstairs.
Responsibility
Its OS-side home
Prototype status
Permissions
Unix user · bubblewrap · nftables
VM tested
Audit
Intent + result ledger
VM tested
Undo
NixOS test activation + health probe
VM tested
Secrets
systemd credentials · isolated runtime login
VM tested
Resource limits
systemd slice · token budget · turn limit
Implemented
Memory & continuity
Loom + ai-memory context reconstruction
Planned
Scheduling & wakeups
systemd timers + desktop events
Integration planned
03 / TWO WAYS TO REASONSAME FENCE. SAME LEDGER.
Choose the driver. Keep the boundaries.
The backend changes who runs the loop. It doesn’t change what the model can touch.
PATH A[↗]
The bare API loop
alina-loopd calls the model directly. Four client tools, a token budget, and credentials that stay outside the model’s shell.
Loop owner
alina-loopd
Billing
API usage, with a budget cap
Tested with
A scripted model endpoint
PATH B[⌘]
A vendor CLI runtime
Keep the vendor’s compaction and session handling. Disable native tools. Expose the same four primitives through alina-mcp.
Loop owner
Vendor CLI, starting with Claude Code
Billing
Vendor subscription, where supported
Tested with
A stand-in CLI using real MCP calls
Claude Code adapter implemented; live-model validation is still ahead. Codex via its app-server is planned. Each runtime gets its own isolated login and configuration.
04 / AUTHORITY & UNDONOT A PROMPT-BASED PROMISE.
Give it room to act. Not room to escape.
A gate the shell can walk around isn’t a gate.
The dedicated user, private desktop, sandbox mounts, egress rules and resource caps apply outside the model’s reasoning. Secrets stay with the loop. Messages to people go into an approval queue.
Intent is logged before execution; the result is logged after. If the ledger can’t be written, mutating actions are refused.
01 / PROPOSE
Request a candidate.
The agent names a proposal, never an arbitrary path for root to run.
02 / TEST
Let the broker act.
A privileged broker resolves the candidate, activates it temporarily, and probes its health.
03 / RECOVER
Keep it or roll back.
A failed probe restores the prior system. A successful test stays active until reboot.
Durable changes are intended to flow through the Nix flake. The prototype uses pre-built candidates; building from commits and promoting a system to the boot default are not built yet.
05 / THE PROOF, SO FARREPORTED 17 OCTOBER 2026
TWO NIXOS VMS / SCRIPTED MODEL
Small loop. Testable claims.
The prototype exercises the tool boundary, desktop interaction, credentials, outbound queue and rollback in a two-VM NixOS test.
9reported verification groups in the prototype write-up
These results are from the author’s prototype report, not an independent audit or a live-model benchmark. They don’t establish complete isolation under every workload.
Actual VM capture: text entered by act, observed by see.
✓ Request shape +
Scripted model calls carried the credential, adaptive thinking, fallback configuration and exactly the four tool definitions.
✓ Act, then see +
Typed text was recovered in the window title, the accessibility tree and a screenshot.
✓ Inside the shell sandbox +
Tests found no access to the operator’s seat, credentials, input device, ledger or network. Process-memory and cross-process root-path probes were denied.
✓ Outside the shell sandbox +
The agent user could reach the allowed model endpoint, but not the outside server or the operator’s seat. The egress rule did not constrain root.
✓ Secret handling +
The test credential did not appear in tool output or transcripts and was supplied at runtime, not stored in the Nix store.
✓ Candidate rollback +
A failing candidate was rolled back. A healthy candidate stayed active, and the agent loop continued running.
✓ Outbound approval queue +
An email request remained pending. Nothing reached the outside server. A dispatcher for approved items is still planned.
✓ Vendor runtime boundary +
A stand-in Claude CLI used real MCP calls with only the four tools exposed. Its login was readable by the runtime but inaccessible to the model’s shell, including through process root paths.
✓ Intent and result ledger +
Every exercised tool call had an intent entry and a result entry. All four primitives appeared in the ledger.
06 / THE WORK AHEADPROTOTYPE ≠ FINISHED SYSTEM
The boundary works in a test. Now make it useful.
The next test is real work, with real models, measured against the tools we already use.
01
Put a real model in the loop.
Add a hosted-API egress proxy, enforce a budget, and validate live API and vendor-runtime behavior.
NEXT
02
Give work a memory.
Rebuild each turn’s context from Loom and ai-memory, so tasks can outlive a session.
PLANNED
03
Take the seat to hardware.
Add the Hyprland adapter and VNC observation/takeover. Decide the compositor and seat layout.
PLANNED
04
Make change reproducible.
Build broker candidates from flake commits and safely promote healthy systems to the boot default.
PLANNED
05
Measure against the familiar.
Run the same tasks through Unharnessed, Claude Code and Codex. Compare success, tokens and cost.
PLANNED
OPEN QUESTION Keep the agent-native machine dedicated to experimentation, or consider production duties only after its isolation is proven?
