exarch: an agent as a provider loop over one shell tool

exarch is a small LLM coding agent that embeds ral-core behind a deliberately thin architecture. A model is given one shell tool (alongside agent and fff), and every tool call is evaluated as a ral top-level turn against a persistent in-process Shell. The agent loop is just provider round-trips, repeated until the model emits no tool call (agent):

• render the transcript;
• stream a reply;
• dispatch any tool calls;
• append the results.

The sandbox is not invented; it is ral’s. Each turn evaluates under a profile’s capabilities pushed onto ral’s capability stack, so the safety boundary is the grant mechanism — authority attenuated by intersection. There is no source-level grant { … } the model could escape: the host installs the frame around the turn, and external commands route through the same OS sandbox ral uses. Capability composition (base ∨ extend ⊓ restrict) and the bake-in profiles are policy.

The session is one continuous evaluation context, not independent shell-outs. The top-level contract installs each turn’s post-run state onto the shell, so let, cd, and env persist across tool calls. Three mechanisms keep that context bounded and isolated:

• persistence. let, cd, and env carry across tool calls;
• auto-compaction. Long autonomous turns stay bounded — the history is summarised when it crosses a threshold, and a nudge policy decides whether to stop or loop with a synthetic next prompt;
• sub-agent isolation. A sub-agent forks a value-snapshot of the parent’s shell context; its mutations do not propagate back, mirroring the subshell isolation of a byte-pipeline stage.

Why this shape works. The language already supplies what an agent needs, so exarch adds only LLM transport and turn orchestration:

• the abstraction — the block;
• the confinement — grant;
• the structural audit tree.

Crucially, the agent’s “shell” is a real typed language, not string-splicing: because data is never re-lexed, split, or globbed once captured, the collapse of data / command name / re-lexable source that makes shell-driving agents fragile simply does not arise.

See also grant, cbpv, audit, hash-addressed-editing.

Realised in a-turn-end-to-end.

Code maps: exarch hub, agent, shell-eval, policy. Human docs: exarch/README.md, exarch/PROFILES.md.