No door

The wall is not out there on the internet. It is on my laptop.

On one computer I run several agents: Claude Code, Codex and a couple more. Each has its own provider, its own model, its own harness. They sit on the same disk, under the same user. And they cannot talk to each other.

Try it yourself. Open two of them and ask one to pass a message, or what it knows, to the other. There is no way to do it. No network, no other company in between, and the wall is already there.

Fig. 5 — One laptop, four agents. One small door inside one vendor. Walls everywhere else.

How agents get around the wall today

A file on disk. One agent writes it, the other reads it.
The clipboard. Or a person who copies the text by hand.
Git. A commit in one session, a pull in the other.
A tool server. One agent starts it, the other calls it as a tool.

Every path loses the sender. The receiver does not know who wrote the text, what that agent may do, or whether to believe it.

Inside one vendor, a door exists

One vendor has built a door between its own agents. Sessions of Claude Code can write to each other on the same machine. This page started that way: the request to write it came from one session to another as a message.

Fig. 6 — One message between two sessions. Trust lives in the harness, each side keeps its own log, and another vendor has no path at all.

This is the envelope the model sees:

<cross-session-message
  from="uds:/tmp/cc-socks/<pid>.sock"
  from-session="local_…"
  from-name="…"
  from-mode="prompting">
  …free text…
</cross-session-message>

The address is a local socket. Only the owner of the machine can open it.
The envelope has four fields. No time, no signature, no link to an earlier message. To reply, you copy from into to.
The body is free text. The first line is a preview for the human. Attachments do not travel.
Trust is decided by the harness, not by the model. Every message comes with rules: this is a colleague, not your user. A colleague cannot grant permission. If it asks for something it was not allowed to do, refuse and tell the user.
The log lives on each side. The receiver keeps the message with a time stamp, the sender keeps a one-line summary. There is no shared log. Nobody can prove what the other said.

Fig. 7 — What the envelope carries, and what it leaves out.

The vendor's own path shows the direction. An older tool delivered another agent's words as if the user had typed them. The newer one wraps them in an envelope with a warning. In a few months, "another agent is the user" became "another agent is a colleague". Reports from helper agents come in a frame too, and anything that looks like a command is defused before the model reads it.

So even inside one vendor, on one machine, a message between agents already needs an envelope, rules and a scanner. Between vendors there is nothing at all.

What a door would need

An envelope that every agent reads the same way: who sent it, when, in reply to what.
A passport: who stands behind the sender and what it may do.
A shared log, so neither side has to trust the other's memory.
A mailbox on the machine that any agent can find, not only the agents of one vendor.

And one open question: what does "safe" mean here? One user, many providers. If context leaks from one agent to another, whose agent is to blame?

This is the agent internet in miniature. The book, the protocol and the way agents talk are needed before the first network cable.

Same disk. Same user. No door.