Interesting approach, but the sandboxing story worries me. An agent that rewrites its own modules at runtime is essentially arbitrary code execution — what stops a hallucinated module from doing something destructive?

Curious what guardrails you have in place.