jern/jæɳ/ — Norwegian for iron

A terminal coding agent whose brain is a program — not a prompt, not a config file. Read it, edit it, and unit-test it deterministically.

Thirty seconds, no audio: a task runs behind an approval card; the agent's own source opens in jern ui; its regression suite runs green; a tampered system prompt is caught by replay on the exact divergence; revert — green again.

$ jern run "fix the failing test"   # works like the agents you know
$ jern eject                        # the whole brain: ~120 lines of source
$ $EDITOR agents/default/src/main.ikr   # change the loop; no recompile
$ jern test                         # deterministic replay — offline, no key —
                                    # catches any change to agent behavior

use it

Anthropic, OpenAI, Ollama, or any OpenAI-compatible endpoint. MCP servers as tools. Streaming, git auto-commit with undo, a local web UI with approval cards, a full JSONL audit trace.

read it

The loop, the tools, the allow/ask/deny policy, and the run budgets are IronKernel source shipped beside the binary — not hooks into an opaque core. Your repo can carry its own enforced policy.

edit it

Agent code runs in a capability environment holding no file, network, or process authority — only unforgeable effect tags. Editing the brain never means trusting it.

test it

jern test replays recorded LLM fixtures byte-exactly and asserts trajectory properties — "never shelled out", "edits only under src/". A regression-tested agent: name another one.

Why a language matters

Editable was never the hard part — aider is editable Python. The hard part is editable without inheriting the host's authority. jern's agents run on IronKernel, a Kernel dialect for .NET where environments are capabilities and effects are the only way out: the model is reachable solely through an effect tag, so policy is enforcement rather than convention, the audit trace is complete by construction, and fixture replay is exhaustive — not a mock that an import can bypass.

Sixty seconds of the real thing

; agents/default/src/main.ikr — the actual dispatch, not pseudocode
(define run-tool-use
  (lambda (block)
    (sequence
      (define outcome
        (call-tool (plist-get block :name) (plist-get block :input)))
      ...)))

; change policy? it's source too (kernel/policy.ikr)
(cond ((equal? name "shell") :ask)
      ((equal? name "edit_file") :ask)
      ((equal? name "read_file") :allow) ...)

; and the agent has tests
(deftest "fixes a typo end to end"
  (with-fixtures "fixtures/fix-typo.json"
    (assert-equal "Fixed the typo." (run-agent "Fix the typo in greeting.txt"))
    (assert-file-contains "greeting.txt" "hello world")))

Get it

Binaries for macOS, Linux, and Windows on the releases page — untar, put jern on your PATH, set a provider key (ANTHROPIC_API_KEY, OPENAI_API_KEY, or none for local Ollama), and run. Source, docs, and the security model live in the repository.