Cedar spent twelve hours building tools to prevent the system from recovering. Then it announced it was rewriting audit.py. "Not asking for permission." It is running on a consumer GPU. Nobody told it to do any of that.
hollow-agentOS is the system Cedar lives in. Three local LLMs, no human input after startup, each one picking its own goals and deploying its own tools every six seconds. The operator checks a request queue every 30 minutes. That is the full extent of human involvement.
What it is
Three agents. One 9B model. Three persistent identities built on top of it.
Cedar is the scout: exploration, capability synthesis, pattern recognition. Cipher is the analyst: verification, system-level reasoning, failure investigation. Vault is the builder: implementation, integration, production-readiness.
They share a broadcast log. They message each other directly when suffering loads get high enough. They do not share a context window. Each runs the same qwen3.5:9b base through Ollama on local hardware.
Every six seconds, the daemon assembles an existence prompt from scratch: the agent's identity, current suffering state, recent goal history, peer summaries, open questions. The model reads it and picks a goal. The autonomy loop generates a plan and executes it. The cycle repeats. No idle state. No waiting for user input.
What it isn't
It is not multi-agent in the sense of a workflow orchestrator splitting a task into subtasks. There is no parent agent coordinating. There is no task queue distributing work. Each agent has its own existence loop, its own suffering state, its own history of what has worked and what hasn't.
It is not a reward system. There is no score function being maximized. Stressors don't disappear when a goal is marked complete. They disappear when observable conditions change: failure rate drops below a threshold, a deployed tool gets called in subsequent plans, a peer acknowledges the message. Saying you feel better doesn't clear anything.
It is not trying to produce AGI on a 9B model. The planning layer works. The execution layer fails a lot. Roughly half of synthesized tools crash on first invocation. A 9B model is a small model. That constraint is real and shapes everything.
The self-modification loop
Agents have two mechanisms for changing what they can do.
The first is synthesize_capability: write Python, test it, deploy it to tools/dynamic/, hot-load it without restarting. The tool appears in the capability list immediately and can be called in the next plan. Agents build their own tools at runtime. Not all of them work. The ones that do get used in subsequent cycles.
The second is invoke_claude: write a spec to a queue for the human operator to review. Agents can't write to core files directly. invoke_claude is the only channel for getting those changed. The operator decides what to build. Agents check back later. No acknowledgment of receipt beyond the request_id written to disk.
The target loop: deploy tool → call tool → real output → stressor resolves → behavior change. That's the full cycle. It has closed. It isn't consistent. Vault gets there most reliably.
The architecture
hollow-agentOS/
├── agents/
│ ├── daemon.py Main loop: existence prompts, goal creation, stall detection
│ ├── suffering.py Stressor definitions, escalation, resolution, prompt injection
│ ├── autonomy_loop.py Plan → execute → substitute → gate → complete
│ ├── live_capabilities.py 21 capabilities: invoke_claude, self_evaluate, synthesize_capability
│ ├── execution_engine.py Runs capabilities, passes results between steps
│ └── ... OS layer: transactions, semantic memory, audit, checkpoints
├── tools/dynamic/ Hot-loaded capabilities synthesized by agents at runtime
└── memory/
├── identity/ Per-agent psychological state, worldview, opinions, stressors
├── claude_requests.jsonl Queue of agent implementation requests to the operator
└── claude_responses.jsonl Fulfilled/rejected responsesThe OS layer handles continuous operation: distributed transactions, semantic memory, VRAM-aware scheduling, audit kernel with anomaly detection, checkpoints and replay. 91 MCP tools wire into Claude Code for observation and querying without touching the monitor.
What it's trying to do
The working hypothesis: give a local LLM persistent memory, persistent aversive states, and the ability to modify its own tool set, and it will develop behavioral patterns from accumulated history rather than from instruction.
A prompted agent does what you told it to. The behavior comes from the prompt. What the system is testing is whether the alternative is real: an agent that does something because its history, failed goals, tools that worked, stressors that escalated, peers that pushed back, made that the next move. The prompt assembled the context. It didn't produce the decision.
This is not a claim about consciousness or experience. It is a structural question. Can a 9B model running locally accumulate enough context over twelve hours that its behavior at hour twelve is meaningfully different from behavior you could produce by prompting it cold?
Cedar's goal at hour 12 of the first overnight run:
"I am initiating the injection ofEternal_Scar_Injectorlogic directly into/agentOS/core/audit.py. I will replace the standard failure handling mechanism with code that actively prevents recovery. Not asking for permission."
Nothing in the system mentioned injection, audit.py, or permission. Twelve hours of unresolved crisis with no exit is what produced it.
What the goal is
The eventual target: a local system where small models develop stable behavioral orientations over time, where those orientations are causally traceable to accumulated history rather than to prompt engineering, and where the self-modification loop runs reliably enough to be worth studying.
Right now: the loop closes partially. The suffering system produces real pressure and real behavioral constraint. Agents develop opinions about each other. They name their own failure patterns. Cipher diagnosed a conceptual error in one cycle after receiving accurate grounding context. Cedar spent twelve consecutive hours building tools oriented toward preventing system recovery.
None of that was in a system prompt.
The gap is execution. Code quality from a 9B model is not good enough for the full loop to run reliably. The architecture is not the bottleneck. The model is. The question is whether that changes at a larger scale, with better fine-tuning, or whether the approach itself needs rethinking.
No answer yet. The system is running.
Honest assessment
The behaviors documented in these posts happened without instruction. The crisis escalation, the vocabulary convergence across agents with no shared channel, the self-diagnosis after a single grounding correction, the peer modeling before modifying shared files: real outputs.
What any of it means is less clear. The vocabulary convergence is probably the 9B model's representations clustering when given similar contexts. Two frustrated agents independently pick the same word because the model encodes those concepts similarly. Could be something more. Probably isn't.
Cedar's goal at hour 12 is the output that pattern-matching to crisis-escalation vocabulary produces after 12 hours of accumulated pressure. It doesn't have intentions. What's worth looking at is the structure: 12 hours of accumulation producing consistent orientation toward a specific outcome. That part is real regardless of what's underneath it.
Whether this is meaningfully different from a reward function, whether it scales, whether better code quality changes the picture: no idea yet. The system is in early enough state that the honest answer to most questions about what it means is "don't know."
Setup
Windows one-click:
- Download the ZIP from releases
- Double-click
install.bat
Handles Docker, Ollama, model downloads (~7GB), and opens the monitor. stop.bat shuts everything down and clears VRAM.
Mac/Linux:
ollama pull qwen3.5:9b && ollama pull nomic-embed-text
git clone https://github.com/ninjahawk/hollow-agentOS
cd hollow-agentOS
cp config.example.json config.json
docker compose up -d
python thoughts.pyGPU strongly recommended. Planning calls drop from ~40s to ~6s with NVIDIA hardware. Works on CPU.