maiden — agents that outlive the process

The folder is the agent

Instructions, tools, connections, subagents, schedules — each one a file, named by where it sits.

The state is a file too

Each turn is written to disk before the next one starts. Resuming is a read, not a replay.

Sandboxed by construction

Tools run inside wasm — no disk, no environment, no network it was not granted. What a tool may reach is two lines of agent.toml.

Nothing to operate

One static Rust binary. No workflow engine, no state database, no queue, no gateway.

One folder. Two front doors.

assistant/ thread main

$maiden run ./assistant "what needs me today?"

calendar.today mcp 184ms

github.reviews mcp 340ms

triage.rank wasm 12ms

Two reviews are waiting — api-gateway#218

since Tuesday and billing#77 from this

morning. The build is red on test_refunds.

saved .maiden/state/main.json

$kill -9 $(pgrep maiden)the process is gone

$maiden run ./assistant "and the second one?"

resumed .maiden/state/main.json 6 messages

billing#77 — Dana asked for a second pair

of eyes on the proration change.

maiden serve ./assistant :8080

what needs me today?

Two reviews are waiting — api-gateway#218 since Tuesday and billing#77 from this morning. The build is red on test_refunds.

server restarted

and the second one?

billing#77 — Dana asked for a second pair of eyes on the proration change. Two files, opened four hours ago.

Everything is a file.

An agent is a directory. What it knows, what it can reach and what it remembers are the files inside it — each one named by where it sits, not by a registry you keep in sync.

assistant/

agent.tomlthe model, and what each tool may do

instructions.mdwho it is, on every turn

sandbox.tomlthe container it works inside

skills/

triage.mda procedure, read only when it's relevant

escalate.md

connections/

linear.tomlan MCP server, joining the registry as linear

subagents/

researcher/another agent folder, callable as researcher

schedules/

digest.tomlwork it starts by itself, on a cron

evals/

triage.tomla prompt, and what the answer must contain

tools/

rank.wasmyour own compute, sandboxed

Including what it can do.

You add a file, it gains an ability. Same four files as above — here is what each one buys. Only the last is code.

connections/linear.toml

Every tool that MCP server exposes, callable by name — your tracker, your calendar, your mail. This is where most capability comes from.

a URL and a token

sandbox.toml

A container it can work inside, with bash, read, write, glob and grep. Anything you can script, it can now do.

three lines

subagents/researcher/

A second agent with its own instructions, tools and thread. You call it like a tool and get back one answer, not a transcript.

another folder

tools/rank.wasm

Compute you own and trust — parsing, ranking, scoring. Rust or JavaScript, compiled to wasm, reachable only through the arguments you hand it.

two commands

Including what it remembers.

The thread is a file you can open, diff and copy to another machine. Recovery reads that snapshot rather than replaying a log, so a finished tool call never fires twice.

turn 1model call, three toolswritten

turn 2model call, one toolwritten

process killed

turn 3six messages read backresumed

.maiden/state/main.json
{
  "history": [ … ],
  "state":   { "memory.notes": [ … ] },
  "usage":   { "turns": 3 }
}

Agents that
outlive the
process.

One folder. Two front doors.

Everything is a file.

Including what it can do.

Including what it remembers.

And nothing else to run.

Write the folder.