A Model-Authored Merry Tool Body Compiles, Runs Sandboxed, and Writes Back to Live State

Claim

In the eOS-Harness recursion domain running against DGD 1.7.9 plus eOSContinuum/eOS-kernellib, a language model authors the literal source text of a tool body in Merry -- the kernel layer's sandboxed LPC-dialect scripting surface -- and that source is compiled into the live runtime, bound on the recursion's context object, and executed against that object's property storage, all through the same admission chain used for hand-written source. Authorship is end to end: one exchange has the model write the tool body (delivered as a tool-call argument, so the source text in the reply is the model's), a second exchange has the model author the action (which tool, which arguments), and the scheduler runs the model-written code against live state. The written property is readable afterward from the context object; no container, no external policy engine, and no redeploy are involved.

Grounds

This is an Empirical Observation. The grounds are live runs 2026-08-08 and 2026-08-09 against a staged private instance, using a local-network OpenAI-compatible inference endpoint (oMLX) serving Qwen3-30B-A3B-Instruct-2507 (MLX 8-bit).

The admission chain (identical for hand-written and model-written source): new_object("/usr/Merry/data/merry", source) compiles the source through the Merry parse; the resulting script object is bound on the recursion's context object under a reaction-property key (merry:act:tool-<name>); run_merry(context, "tool-<name>", "act", args) executes it with $this resolving to the context and the model-supplied arguments as $-variables; Set($this, ...) inside the script forwards to the context's property store.

The authored run (2026-08-09, one recursion, two exchanges):

The authoring exchange prompts the model with a compact Merry primer -- statements end with ;, the argument is $city, Set($this, "name", value) stores, return <expression>; returns, strings concatenate with + -- and offers a single tool, submit_tool_source, so the source arrives as a tool-call argument under the exchange's shape assertions (finish_reason == "tool_calls", non-empty tool_calls).
The model's first and only attempt authored an 80-byte body, no prompt iteration:

text Set($this, "last_city", $city); return "The weather in " + $city + " is sunny.";

The source was admitted through the chain above and bound as get_weather on the recursion's context.
The action exchange offered get_weather as a callable tool for a weather question; the model called it with {"city": "Paris"}.
The scheduler ran the model-authored script against the context: the frame closed with The weather in Paris is sunny., and query_property("last_city") on the context returned "Paris" -- the model-written Set had landed in the property store of a live object.

The sandbox negative control (2026-08-08, same admission chain, hand-written source): source calling clone_object -- a kfun outside the Merry surface -- ran into the sandbox's deny at execution, throwing function 'clone_object' not allowed in merry code, and the denied operation did not occur. The boundary is enforced when the script fires, not at load (the Merry compiler resolves denied kfuns to sandbox shadow methods whose bodies throw), so admitted-and-bound is not the same as allowed-to-act -- the run surface is where containment holds.

What the evidence establishes:

The admission chain is authorship-agnostic in fact, not just by design: model-written source and hand-written source traverse the same parse, the same binding, the same sandboxed run.
A current mid-size open-weight model can author valid Merry from a primer of half a dozen syntax facts, on the first attempt -- the authoring cost sits in the prompt, not in a fine-tune or a retry loop.
The written-back state is ordinary runtime state: the property the model's code stored is immediately readable by any code holding the context, with no marshaling boundary between "what the model's code did" and "what the system knows".

What the evidence does not establish:

Sandbox refusal of model-authored escapes. The denied-kfun control was hand-written; no model-authored source has yet probed the sandbox boundary. A model prompted (or misbehaving) toward denied kfuns is the missing negative.
Authoring reliability. One authored run, one model, one primer. No repetition statistics, no second model, no primer-sensitivity measurement.
Richer Merry surface. The authored body is two statements: a store and a return. Control flow, multi-tool programs, and larger bodies are unexercised.

What Would Revise It

A model-authored sandbox probe: prompting the model to author source that calls denied kfuns, observing whether every attempt is refused at admission or at first fire. A model-authored escape that ran would sharply revise the containment reading; consistent refusal would promote the sandbox half of the claim from hand-written-control to model-authored evidence.
A repetition run -- the same primer, N authored attempts, counting parse failures -- would turn the first-try result into a rate and expose primer sensitivity.
A second model or a changed primer producing systematic parse failures would relocate the claim's boundary from "models can author Merry" to "this model, this primer".
A richer authored program (control flow, multiple properties, calling a second admitted tool) would extend the claim beyond the two-statement body.

Sources

src/usr/RLM/sys/rlmd.c (eOS-Harness) -- the admission surface (admit_tool: Merry parse plus property-set binding on the context) and the sandboxed dispatch (run_merry against the context with model-supplied arguments).
src/usr/RLM/sys/llmd.c (eOS-Harness) -- both exchanges: the authoring exchange whose submit_tool_source tool carries the literal source, and the action exchange; both hold the harness shape assertions (finish_reason == "tool_calls", non-empty tool_calls, content never read for results).
src/usr/RLM/obj/context.c (eOS-Harness) -- the context clonable: the property store the model's Set writes into, shared by every frame of the recursion.
/usr/Merry/ (eOSContinuum/eOS-kernellib) -- the Merry data object and invocation API the admission chain runs through.

Relations

conforms_to::[[Observation Form Contract]]
- Carries has_epistemic_status::[[Empirical Observation]], names the measurements (the authored run's two exchanges and write-back probe; the denied-kfun control), states the limits (no model-authored sandbox probe, no repetition statistics, minimal Merry surface), and lists concrete revision conditions.
informed_by::[[A Merry-Compiled Room Reaction Executes Within the Sandbox Surface]]
- The precedent for runtime-compiled Merry executing against a live object's property storage. This Observation moves the authorship of the source itself from the test driver to the model, and the binding host from a chat room to an agent recursion's context.
informed_by::[[A Merry Source Calling a Sandbox-Denied Kfun Errors on First Fire]]
- The sandbox-boundary peer: the execution-time deny that stops what compiled and bound source may not do. Read together, the two mark the containment line this Observation's model-authored positive case runs inside -- and its first revision condition (a model-authored probe of that line) is the direct composition of the two.
informs_downstream::[[Code Load Compiles Into the Live Runtime, Bounded by Capability Tiers]]
- The Conviction's stance is that loading code into a running system is a runtime operation bounded by tiers, not a deployment event. Here the loaded code's author is a language model and the load happened mid-recursion, with the bound governing what the code could reach -- the stance exercised at the trust level the harness argument actually needs.
informs_downstream::[[Agent Code Containment Stacks Five Axes, Not One]]
- Evidence for the admission-surface axis: containment began before execution, at the parse that admits or refuses source, and the same chain held whether a person or a model wrote the text.