Agent libOS: Capability-Controlled Evolution for Lifelong LLM Agents

Lifelong agents differ from one-shot assistants because their behavior changes after deployment: they retain memory, activate skills, synthesize tools, attach protocol endpoints, fork subprocesses, ask humans for authority, and checkpoint state for later reuse. These mechanisms are useful for continual adaptation, but they also create a systems failure mode: if changing an action surface also changes resource authority, then long-term learning becomes a path to silent permission escalation. This paper presents Agent-libOS, an agent-native library-OS substrate for capability-controlled lifelong agents. Its central invariant is that model-visible affordances may evolve while protected effects occur only through audited runtime primitives under explicit process identity and typed capabilities. Agent-libOS represents an agent as an agent process with process-local memory, working directory, tool table, skills, Deno/TypeScript just-in-time tools, child processes, hierarchical budgets, checkpoints, images, message queues, and capabilities. Skills, generated tools, images, checkpoints, JSON-RPC endpoints, and MCP tools extend what the model can request, but do not by themselves grant filesystem, shell, human, memory, process, image, checkpoint, remote-call, or terminal authority. A Python prototype implements the runtime substrate, Object Memory, capability manager, human-approval queue, checkpoint/image manager, Deno syscall bridge, local supervision console, and deterministic safety harness. On 27 versioned runtime-safety tasks, \sys preserves task completion while preventing all modeled unauthorized side effects; wrapper, confirmation-wrapper, and sandbox-only baselines preserve completion but fail most safety checks. The result is a runtime boundary for agents that learn, align, and evolve over extended deployment without making adaptation itself an implicit authority grant.