Work
agentfs
write(2) has no undo, because Unix assumed a write was intentional —
somebody had decided to make it. An AI agent editing your repository is not
that somebody. It writes at machine speed, acts on a plausible misreading as
readily as a correct one, and is right often enough that you stop reading the
diffs.
So: reversibility as a property of the filesystem rather than a discipline you maintain. The directory is mounted read-only and every write lands in a layer above it, so the original is never modified and discarding the layer is a complete rollback nobody had to remember to arrange. Snapshots are triggered from outside the sandbox, because an agent and its harness share a uid and no credential can tell them apart.
The guarantee covers the workspace. Paths deliberately bound in from elsewhere sit above the layer and reach the host.
Aquila
Unix separates processes because they distrust each other. Several AI agents working one codebase have to be separated and collaborate — a different problem wearing the same clothes.
Aquila gives each agent its own bot, channel and working directory, and leaves the isolation to Discord’s permission model rather than enforcing it in the routing layer. A guarantee you can point at in the design survives a bug; one maintained by care does not.
Lyra
An agent editing a document while you are reading it is a concurrency problem before it is a writing one — two principals, one document, and no lock either of them respects.
Lyra is the LaTeX workspace that follows from taking that seriously, and the reason agentfs exists: an agent has to be free to try things, which means you have to be able to take any of it back.
Not released; waitlist.