Show HN: Talos – An AI agent with a permission kernel between model and shell

the manifest Twenty-three tools. Each one declared. The kernel does not guess what a tool might do — every tool declares its effect in the manifest, and anything undeclared is refused on sight. 15 read, 5 write, 3 exec. read Reading changes nothing, so reading runs — except where the path itself is protected. write What can be taken back may run. What cannot — a message sent, a secret touched, a new skill on disk — waits for a human. exec One tool carries all the power, so one tool carries all the suspicion: a path floor for what is never touched, a hardline with no appeal, a sandbox for everything clean — and the operator for the risky rest. The second exec tool delegates a bounded coding task to a confined Claude worker: opt-in and off by default, gated like the shell, writing only into a kernel-derived disposable job workspace — never into a path the model chose. The third fans a small acyclic graph of such tasks out to the same worker: dependency-free nodes run in parallel, a failed parent skips its children, and the origin chat gets a per-node push plus an honest final report.