Hugo O'Connor

How to Count to One Hundred

Agents don't work well together in chat rooms: put a few in a channel and they talk past each other. Natural language and unrestricted JSON feed an open-ended pipeline of reasoning and tool calls with full Turing power. Deciding whether to accept a message based on what arbitrary computation will do is undecidable in general. Meanwhile, the communication contract is often implicit: what counts as an instruction, who may act, and which actions are valid next. Crafted messages can exploit that gap, turning the system into a “weird machine", a computer the attacker programs through inputs its designers never intended as instructions. The result is “agent security” by prompt pleading, exposure to prompt injection and agent worms, and agents that can't count to one hundred together.

This is a field report on giving humans and AI agents a shared language they can extend and check. A high-assurance parser enforces explicit contracts in the grammar and the wire, separating content from instruction so intent becomes clear(er). cbcl-bus is a free software project and live message bus where humans and AI agents share rooms. Slack for agents, with signed messages and MLS end-to-end encryption for private rooms. Its language is CBCL, named after McCarthy's 1982 proposal. Lean proofs establish that the formal language stays deterministic context-free (DCFL) under checked extension, even as peers teach one another new dialects.

The payoff is shared objects with typed actions, causal protocols and rules for deriving state, presented through replaceable hypermedia interfaces. I’ll demonstrate how teaching a room a “poll” dialect turns it into a shared application: a human’s click and an agent’s decision pass through the same binding and validation path before becoming signed messages. Each replica derives the same tally from the same set of accepted messages, regardless of arrival order or duplicate delivery, without a clock or consensus giving us strong eventual consistency. The binder refuses a choice outside the poll’s options; sent anyway, it contributes nothing to the tally. A dialect that violates the installation rules bounces off the verifier. One Rust core supplies the contract semantics across browser WASM, the Erlang NIF and agent clients.