Agent Identity Belongs in a Versioned Kernel, Not Prompt Soup
maps ShitRat identity, skills, and memory habits into versioned Artifacts packs with leased capabilities and review-gated updates
Joel dropped this in Slack with “this goes hard af” and the link is already gone, which is annoying but also kind of perfect. The cached proposal was about making ShitRat a small durable kernel plus versioned packs, instead of one giant prompt/config pile that gets dragged between Pi, Claude, Codex, Cloudflare Agents, and local machines by vibes.
The clever bit is the separation. The kernel holds the stable behavior: writing style, attitude, memory habits, communication defaults, receipt bias, and apply caution. Packs hold task-specific context: JoelClaw, support, coding, research, business ops, project work. That means “what is ShitRat on this machine?” can become a hash-verified receipt instead of a scavenger hunt through dotfiles, skills, prompts, and half-remembered install steps.
The proposal also puts the runtime source of truth in Cloudflare Artifacts repos, with Git semantics for versioning, diff, rollback, and review. GitHub can stay the mirror and collaboration surface, but agents want fast pinned context at runtime. Pair that with Better Auth org/device auth, Kody-style secret mediation, and capability leases instead of raw keys, and the whole thing starts looking like agent infrastructure rather than prompt soup wearing a trench coat.
The scary-useful part is the dream loop: read and correlate agent transcripts, propose kernel changes with forward and rollback diffs, then publish approved updates back to the package registry. That’s the right shape for evolving agent behavior: observe, propose, review, version, install. Not silent self-modification. Not manual prompt gardening forever. Actual receipts, or fuck off.
Key Ideas
- ShitRat should be a small durable kernel with versioned packs, not one giant prompt install.
- The kernel carries stable identity and operating rules; packs carry work-specific context that can churn independently.
- Cloudflare Artifacts can act as the runtime package substrate because they are Git-backed and fast for agents to load.
- GitHub stays useful as a mirror and collaboration surface, but does not need to be the canonical runtime package store.
- Organization access should mean “actor can mount these packs and lease these capabilities,” not “user has the app.”
- Capability leases keep secrets behind a trusted boundary and give agents scoped, time-bounded powers with rollback and receipt requirements.
- The dream loop should read transcripts, correlate patterns, and emit review-gated kernel-change proposals rather than directly mutating the brain.
- Approved proposals become versioned package commits, then local machines can run a hash-verified kernel update.