This mirrors a lot of what I saw while experimenting with constrained agent runtimes. Notes here if helpful: https://github.com/nullclaw/nullclaw