Sealed
Built, and withheld.
The parts exist in the shipped package and are not joined. Nothing is missing except the connection, and the connection is the point.
The sealed
What it can do,
and does not.
Nothing in the list below is available today. Each entry is a seam the published code already has, a capability leaning on it, and the one condition that would let it through. Not a roadmap - a list of things held shut.
02 The legend
Three states.
Read the word,
not the colour.
A capability on this page is in exactly one of three states, and the state is written on it. Colour is the second channel and never the only one.
No entry here carries a date. It carries a condition, because a date can be missed quietly and a condition cannot.
In containment
Running, under restriction.
It works right now, inside a limit that was chosen rather than discovered. The limit is a constant, a ceiling or a missing call site, and it is named on the card.
Released
Out, and documented.
Shipped in 0.1.2 and written down. Every released seal
below links into the docs so you can go and check it.
There is a fourth state and it is not decorative. A seal that is abandoned is marked Broken and left on this page, with the reason. Deleting a promise is worse than admitting it was dropped.
03 The seals
Eight things
pressing
on the door.
These are ordered by how close they are to opening, not by how impressive they sound. The first card is the nearest.
Each one is grounded in the published 0.1.2 package -
a constant, a function signature, a field that is not there. You can
open the source and find the seam. That is the whole claim.
The unread ledger
Sealed
The library scores every agent it keeps. LibraryEntry
records uses, wins, losses and generation, and
reliable() retires one that has lost more than it won.
Then describe_for_planner() renders name and role,
twenty-five lines at most, and the record stays behind. The planner
is never shown the score it is standing on.
Opens when
the planner is handed the record the library already keeps, instead of a list of names.
The uneven hands
In containment
execute_agent already takes an effort and a model per
agent, and _child_env writes both into the subprocess.
AgentSpec carries name, role, instructions, capability
and depends_on, and no model field at all. One grade - simple,
standard or deep - is applied to every call in the run, including
the one doing the hard part.
Opens when
a plan can name a model per agent instead of one grade for the whole run.
The second face
Sealed
events.py is about eighteen hooks that do nothing -
plan_ready, wave_started, agent_finished, council_convened,
answer_judged, spend_updated and the rest - written so the pipeline
can run with no terminal attached. handle_task never
prints. The guard already vets fastapi, starlette, uvicorn and
flask. Nothing but the terminal is listening.
Opens when
something other than the CLI subscribes to the events the pipeline already emits.
The sealed eyes
In containment
A generated agent never opens the file you named. The main process
reads it first - an extension allowlist, five files, a hundred
thousand bytes each, .env never touched - and the text
travels with the task. The guard refuses open() only
for writing, so reading already passes the inspector. No helper
offers it. The module's own docstring says otherwise, and the
docstring is wrong.
Opens when
a runtime helper offers the agent the reading the guard already permits.
The silent archive
Sealed
save_run() writes every finished run down in full: the
task, the answer, the grade, the agents built and reused, the
failures, the cost. The only code that reads those files prints
them. Memory is eight turns held in RAM, and the last answer clipped
to 2,500 characters on a follow-up. It remembers everything and
learns from none of it.
Opens when
a past run can inform the next one instead of only being printed to you.
The remembered team
In containment
Reuse works one agent at a time. lookup(name) resolves
a single file by exact name, and no plan is persisted anywhere -
the run log writes the team into prose, read back only to show you.
So the task you planned yesterday is planned again from scratch
today, and the same four agents are met as strangers.
Opens when
a whole plan is saved and matched, not only the agents inside it.
The larger host
In containment
MAX_AGENTS = 4 is read from the environment at import
time, and the plan is bounded by it. waves() computes
the graph for any number of agents and does not care what the number
is. Four is the ceiling that was set, not the ceiling that was
found. Nesting stays shut by construction: an assembled agent
imports nothing from AgentGod, so it cannot raise a team of its own.
Opens when
a run above four agents is exercised rather than merely constructible.
The cage unbuilt
In containment
Agents are validated before they run, not held while they run. This
is static validation, not a sandbox. The interpreter is already a
parameter - execute_agent takes one, the tests pass one
in, and the orchestrator passes none at any of its four call sites.
And _child_env starts from dict(os.environ),
so a child inherits the whole parent environment, unfiltered.
Opens when
a container replaces static validation as the boundary.
04 Released
Five seals
have opened.
These five are what an opened seal looks like. They are in the published package, and that is the only reason the eight above are worth watching.
Every one of them links into the docs, where the constants and the flags are written out. A released seal that cannot be checked is a promise with a better word on it.
The package, published
Released
pip install AgentGOD. The prerequisites are Python 3.10
or newer and one Anthropic key, and the key check is the only thing
that can stop it starting - every other setting has a default.
Proof
Version
Read it
0.1.2 on PyPI, three releases so far, four runtime dependencies, two console commands that are the same program. Nobody has run the install on a clean machine.
The run, stage by stage
ReleasedA task is graded, a team is written as source, read before it runs, executed in waves, merged, put to a council on deep tasks and checked back against the request.
Proof
One module per stage -
Read it
planner.py, generator.py, codeguard.py, executor.py - with waves() computing the graph and handle_task wiring them without printing. COUNCIL = auto, TASK_REVISIONS = 1. This is what the published code contains. No task was executed against the API to write this page.
The cage, as built
ReleasedGenerated code is parsed before it can become a process. It is checked against a fixed package allowlist, a standard-library blocklist and six banned calls. This is static validation, not a sandbox.
Proof
81 vetted packages. 13 blocked standard-library modules. Six banned calls:
Read it
eval, exec, compile, __import__, input, breakpoint. open() is refused for writing and permitted for reading. Treat the task string as a trust boundary.
The library, and what is free
ReleasedAn agent kept after a run comes back by name and carries a win and loss record. The commands that read the library need no key and no network.
Proof
Read it
LibraryEntry stores uses, wins, losses, generation, built_for, runtime and last_used, and reliable() retires an agent at three losses unless it has won at least as often. Seventeen offline verbs and eleven slash commands, all reading local disk with the key check skipped.
One command line, one set of dials
Released
A flag and a .env key are the same setting, reached two
ways. The exit codes are fixed, so a script can read the outcome
without reading the output.
Proof
Thirteen flags, rendered from the shipped parser itself.
Read it
apply() implements each by writing the matching environment variable: --model sets MODEL, --effort sets LLM_EFFORT. Nineteen tunable variables, each with a default, and a real environment variable outranks the .env file. EXIT_OK = 0, EXIT_FAILURE = 1, EXIT_USAGE = 2, EXIT_INTERRUPTED = 130.
Held under containment.
Every capability on this page is in one of three states, and moves between them on a condition rather than a date. A cancelled one is marked broken and left where it is.
Stand where
they open.
No seal here has a date, and none will be given one. Access is how you are standing there when a condition is met instead of hearing about it afterwards.