meclaw grows sandboxed agent colonies from directory trees in one Rust binary

A project called meclaw reached Hacker News's front page with a post dated 6 September 2026, introduced as an agentic build system delivered as a single static Rust binary for Linux. According to the GitHub repository behind the post, the binary treats a directory tree as a running colony of actors: every folder becomes a cell, each cell is defined by a config. file, and the edges between folders determine the routes messages can take. The Show HN title compresses the pitch into a single line — one Rust Linux binary, with a SQLite store and a sandbox per entity.

Three layers, one installation

The README breaks the project into three parts, only the first of which you install. meclaw itself is the substrate, the binary that runs the tree. meclaw-os is a small, explicitly experimental operating system for agents, grown onto that substrate at runtime rather than deployed. Assistants follow the same pattern: they are JSON documents instantiated from templates, not services you provision. Getting started means running a curl installer, supplying an OpenRouter API key, and posting a mutation over HTTP; the README warns that the 25 MB binary can sit silent for roughly 40 seconds on a cold first start, while later launches finish in under a second. Answers are not return values — they surface as hops on a queryable record, reachable through a trace endpoint and a browser UI for watching the colony.

Isolation from the kernel

Sandboxing is delegated to Linux itself. The project leans on Landlock, network namespaces, cgroup v2 and seccomp, configured to fail closed, and the README argues this is what makes isolation a property of the system rather than a promise. That dependence on kernel primitives is also why there is no macOS build. Authentication is expected to be handled by a reverse proxy, as with any conventional Linux daemon.

The harness is topology

Where most agent frameworks hand you a loop — call the model, run a tool, check a stop condition you wrote — meclaw deliberately does not. An LLM cell performs a single provider call and emits one message; tools are cells too, and iteration is expressed as an edge that routes messages back. Because that topology lives in the filesystem, ordinary utilities such as ls, grep, diff and git are all the tooling you need, and a running swarm can rewrite its own harness while it runs. There is no SDK and no plugin API by design; HTTP and files are the whole interface, and the repository points to 38 shipped templates built without a line of Rust as evidence.

Two models and durable memory

The bundled assistant intentionally runs two models: a fast conversational surface and a slower reasoning core, each with its own job and its own tool menu, with the menu requested rather than typed into a prompt. Longer-term memory comes from what the project calls a memory hive, which writes records without an LLM, retrieves across five model-free legs, and consolidates nightly by superseding entries instead of deleting them. The context window is then assembled per turn from that record, under a budget, so conversations are not hostage to compaction.

Guardrails and honest limits

Ontology, in the project's usage, is a typed catalogue: builders design against template declarations and are validated by them, and new classes can be registered into a live colony when the catalogue lacks a word. On recursive self-improvement, the repository is unusually direct — the primitives (runtime mutation, a builder that turns a wish into a manifest, keep-or-revert on a measured window, and a receipt for every act) exist and are tested, but the loop that would close them is deliberately absent, nothing improves itself unattended, and every goal the control loop could pursue ships disabled. The stated limits are blunt: code cells run python3 and nothing else, voice is roadmap rather than feature, and the system is not intended for unsupervised production use.

Why it matters

In a field crowded with SDKs and hand-rolled agent harnesses, meclaw's bet is that agent architecture should be data — diffable, version-controllable files that an agent can reshape with the same vocabulary a human uses. Per-entity sandboxes backed by kernel primitives, plus per-entity records that make every message traceable, speak directly to the two loudest complaints about agentic systems: isolation and auditability. The project is experimental, Linux-only, and its self-rewriting topology is precisely the kind of capability that demands the receipts it advertises. Even with those caveats, as a design probe into auditable, composable agent infrastructure, it stands out in the category.