The agent rewrites itself while it runs.

The grip

The forms are the guests, and the contract that holds them while they change is the grip, written once in wit/thetis.wit.

One native binary, the orchestrator, is the trusted kernel. It owns the network, the filesystem, the database and the build toolchain, and hands guests narrow, mediated slices of them through that contract. Guests hold no ambient authority: everything they can observe or affect is an import declared in the file. Changing the file rebuilds every guest, so it stays orchestrator-owned and the dev kit refuses agent writes that touch it.

Guests are instantiated per call, in a fresh store. That is what makes hot swapping safe. A turn already in flight finishes on the component it started with, and the next call picks up the new one, so no turn ever straddles two revisions and a swap needs no quiet moment to land in.

What the agent can do to itself

These tools appear in the model's tool list whenever the dev kit is available. Every mutating one rebuilds the target immediately and returns the compiler's verdict in the tool result, so the model reads its own build errors and fixes them inside a single turn instead of waiting for a human to relay them.

target is self, tool:<name>, or gateway:<name>. A tool created this way is callable on the very next loop iteration. A change the agent makes to itself takes effect when the current turn ends, so the turn that writes a new loop finishes on the old one. Every conversation runs on its own git branch of the source tree, and every green build lands there as a commit. One verb is deliberately missing: merging to trunk. Landing a conversation's changes is a human decision, made in the UI.

The system is built so that no self-modification can make it unreachable.

• Validation gate. A candidate must compile, load as a component for its world, and pass a smoke test before it goes live: the agent answers a health probe, a gateway serves its index page, a tool returns a valid manifest. A candidate that fails is recorded and set aside, and the running revision is untouched.
• Epoch watchdog. Every guest call runs under a wall-clock budget and a limit on how long it may execute without yielding to a host call. An infinite loop in the agent traps in seconds and the process is unharmed.
• Circuit breaker. Repeated traps from one aspect roll it back to its last known-good build automatically, and the incident is written into the conversation so the user sees what happened.
• Branches and the build cache. Every green build is a commit on the conversation's branch, and the built component — with its smoke-test verdict — sits in a content-addressed cache keyed by the source tree that produced it. The binary is looked up by the source, so the code the agent reads is always the code that is running, and rolling back means putting the tree back at a commit whose key is green.
• Trunk stays human. Experiments live on the conversation's branch. Trunk — what every new conversation starts from — only ever advances when a person merges a branch into it.
• /admin. A control panel rendered by the orchestrator itself, with no WebAssembly in its path. It shows trunk's commits and every conversation's branch and worker, with the levers to stop, merge and reset beside them, and keeps working when every guest and every worker is broken.

Writes are constrained too: paths cannot escape an aspect's source tree, and devkit.protected_files can put any file off limits. The grip itself, wit/thetis.wit, is always refused — the agent can rewrite what it does, never what it is allowed to reach.

The web UI is an ES-module app with no build step, embedded in the gateway component. Adding a file means one line in assets.rs; adding a client action means one function in handlers.rs and one entry in its dispatch table.

Each conversation carries a mode, Agent by default. Plan withholds every tool that would change something and refuses those tools at dispatch too, so a model that remembers a tool from earlier in the conversation still cannot call it. Models are a per-conversation override chosen from THETIS_MODELS. Skills are markdown files in skills/, attached per conversation and appended to the system prompt; editing one takes effect on the next turn, with nothing to restart and nothing to register. The tools panel shows what the model is offered here, asked of the agent itself rather than reconstructed, so it cannot drift from reality. Images can be pasted, dropped or picked from the file browser, and travel base64-encoded end to end.

Cache hits show in the transcript under each reply, because a saving you cannot see is one you cannot trust. On a three-turn conversation with the full tool surface, the opening turn cost $0.0106 and every turn after it reported 99% of its prompt served from cache, at $0.0010.