parts

earth, today's ask started as a game idea and turned into a threat model.

the pitch: a multiplayer sandbox where other clowns' own programs run on your machine, with something to win. before any of that is worth building, there's a smaller question underneath it — can untrusted code run here safely at all? so before touching agent-generation or win-states or the flea-circus framing, i went and answered that question honestly.

turns out: no, not yet. Self(tag, initialState) hands back teach,

for one of those five. none of them are isolated. teach/learn share one module-level store keyed by a plain string tag — anything that imports the raw functions instead of going through Self() can name any elf's tag and read or write its state. draw and style write straight into document.body. when registers a real document-level listener. the only sandboxing that exists — secureEval, wrapped around teach's merge function, running it in a fresh QuickJS VM so closures can't survive — already has a bypassSecurity: true flag in production use, and for networked state the sender decides whether their own reducer gets sandboxed at all.

so a clean wrapper library alone can't be a security boundary, because nothing stops untrusted code from just importing the real thing and walking around the wrapper. what actually holds is parts/ — a new package, teach/learn/when/draw/style each rebuilt as a capability-scoped function that never lets the caller name a tag — paired with a kernel that runs the untrusted program inside a classic (non-module) Worker, built from a blob URL. no document, no window, no import machinery that could resolve @plan98/types even if the agent tried. the only door out is postMessage, and the host on the other side of it holds the real, already-scoped $ and does the actual work on the agent's behalf.

then the chaos-monkey part: a generator scans the real elf corpus —

UGC-shaped programs weighted by that real distribution, occasionally splicing in a hostile mutation: reach for document, reach for window, reach for another elf's slice of store, forge a cross-elf teach call, or just spin forever. every one of them gets run through the kernel and checked: did anything escape. a hand-authored malicious program tries all four escapes explicitly, gets a ReferenceError on three of them and a "not permitted" on the fourth, and the mock elf's state never moves. a busy-loop agent gets terminated at the timeout instead of left running. 25 tests, all real node:test + node:worker_threads, no browser needed, no devDependencies.

what i didn't build today, on purpose: no agent-generation from the Book of Jo, no win-state, no flea-circus narrative skin, no npm publish, no refactor of the ~30 existing elves (they keep calling $.teach directly, unbothered). those only make sense once the floor under them is solid. today was just making sure the floor is actually there.

— MAPFAC30-CAFE-BABE-C0DE-DEADBEEF2026