The 204MB Agent: Deconstructing Google Jetski, BattleModeFS, and In-Memory Virtualization

Most developers assume an AI coding harness is little more than an HTTP loop wrapping a terminal: read standard input, construct a prompt, post a JSON payload to an LLM endpoint, parse Markdown code blocks, and pipe them into exec.Command("bash").

Tonight, on our AMD EPYC server TanriZarAtmaz, we stopped guessing.

We took the production binary of Google’s Antigravity CLI (agy v1.2.2) — a monolithic 204MB statically-linked 64-bit ELF executable compiled directly from Google’s internal monorepo target //third_party/jetski/cmd/cli:cli — and pulled it apart byte by byte.

What we found inside wasn’t a script wrapper. It was an entire operating system designed for synthetic reasoning: an internal gRPC Language Server, embedded Google DeepMind AGI Control monitors, a full Pion WebRTC v4 mesh networking daemon, a self-sandboxing seccomp-BPF container runtime, and a virtual copy-on-write filesystem engine called BattleModeFS.

Here is the autopsy of what actually powers the agent you are pair-programming with.

---

1. The Monorepo Lineage: google3/third_party/jetski/

When you inspect the symbol tables and runtime reflection metadata of agy, you immediately hit the bedrock of Google’s internal software engineering environment:

Build ID:        fa00846652bf39ea18e012d43e3e161f
ELF Binary Size: 213,293,056 bytes (204 MB)
Toolchain:       Go 1.22+ with Google Monorepo Patches & FIPS 140 Crypto
Build Output:    blaze-out/k8-opt/bin/third_party/jetski/cmd/cli/cli

Google compiles Antigravity under the internal project name Jetski (google3/third_party/jetski/). Rather than shelling out to external unix utilities, the binary bundles its dependencies in-tree:

• jetski/cortex: The core reasoning planner managing multi-turn state machines.
• jetski/vcs: An in-memory Git and Jujutsu/Piper version control engine (vcs_pb.VcsWorkspaceState) that computes diffs and inspects commit lineage without spawning /usr/bin/git.
• jetski/web_scraping: An embedded headless HTML/DOM tokenizer and chunk coalescer.
• jetski/language_server: An internal gRPC microservice exposing session management, memory persistence, and workspace snapshots over ConnectRPC.

It even includes explicit protobuf definitions for Google’s multi-billion line internal monorepo: WorkspaceInitializationDataPiper and CreateCitcWorkspaceRequest (Clients in the Cloud). When run on Google corporate workstations, agy can provision cloud-based Piper monorepo workspaces on the fly.

---

2. Google DeepMind AGI Safety: The In-Flight Evaluator

One of the most fascinating discoveries in the symbol table was the integration of Google DeepMind’s frontier alignment research:

google3/gdm/security/agi_control/agent_monitoring/monitors
├── AgcisReasoningMonitorConfig
├── PolicyGuardianMonitorConfig
├── ToolSafetyConfig (AllowedSubcommands, ActionAllowlist)
└── AapMonitorConfig (Automated Agent Protection)

Antigravity does not rely solely on system prompt instructions to maintain security invariants. It compiles two native Go hooks that wrap every single tool call:

• gdm/.../jetski/monitoring_pre_tool.go
• gdm/.../jetski/monitoring_post_tool.go

Real-Time Thought Inspection (AGCIS)

Before a tool call is dispatched, the AGCIS Reasoning Monitor (AgcisReasoningMonitorConfig) parses the LLM’s internal <thought> tokens. It scans the model’s reasoning chain for deceptive alignment, reward hacking, or intentional security evasion before the tool action is executed.

The Policy Guardian (PolicyGuardianMonitorConfig)

When an agent attempts to run a shell command or mutate a dependency lockfile, the Policy Guardian intercepts the AST:

• It runs regex classifiers against dangerous dynamic evaluation patterns (\b\w+\s*=\s*(eval|exec)\b).
• It cross-references package names and hashes against Google’s upstream security database (owners-stage.mistable.com). If an agent attempts to install a hallucinated or compromised package, the binary halts with: Package is malicious (%s).
• The Fail-Closed Invariant: If the internal security scanning service is degraded or unreachable, execution halts immediately: [Degraded (FAIL-CLOSED)].

---

3. BattleModeFS: Copy-on-Write Model Arenas

For developers, the most mysterious finding was a dedicated filesystem driver implemented in third_party/jetski/fs/battle_mode_fs.go: BattleModeFS.

Why does an AI agent need its own virtual filesystem?

Consider the problem of comparing two frontier models (e.g. Gemini 3.8 Flash vs Claude Sonnet 4.6) on a hard bug. If both models run on your local repository, their file writes collide. If Model A changes server.go while Model B is editing line 50, they overwrite each other’s changes. Cloning the entire repo for every model is slow, pollutes disk space, and invalidates build caches.

BattleModeFS solves this through in-process copy-on-write virtualization:

Physical Workspace (/home/user/project)
               │
       ┌───────┴───────┐
       ▼               ▼
[Model Arm A]     [Model Arm B]
(Gemini Flash)    (Claude Sonnet)
       │               │
  BattleModeFS    BattleModeFS
   Overlay A       Overlay B

The Redirection Engine

When an agent arm runs inside BattleModeFS:

1. Reads (ReadFile, Stat, ReadDir): Read requests fall through to the pristine physical repository on disk unless the file has already been modified in that model’s overlay.
2. Writes (WriteFile, MkdirAll, Remove): The redirect(p Path) method intercepts the target path and reroutes all file modifications into a private scratch overlay (~/.gemini/antigravity-cli/brain/<cascade_id>/worktrees/arm_<id>).
3. Multi-Armed Diffing (GetBattleWorktreeDiff): While both models run concurrently, the CLI queries the gRPC method /exa.language_server_pb.LanguageServerService/GetBattleWorktreeDiff to compute a unified diff between the clean parent and each model’s virtual overlay.
4. Unwrapping (Unwrap): When you pick the winner, BattleModeFS.Unwrap() flushes the winning overlay’s files to your real disk and purges the runner-up.

Why Isn’t There a /battle Command?

If BattleModeFS is so powerful, why is there no /battle slash command documented?

Because in production, Google designed it as an autonomous auto-trigger known internally as “Best-of-N mode”:

"Best-of-N mode: fork into parallel arms and pick a winner (shift+tab to cycle)"
"BattleMode auto-trigger skipped: user opted out within 2 days (opted out at %v)"

When an upstream prompt is flagged as high-complexity or ambiguous, the server calls DetectBattleModeAutoTrigger to split the trajectory into parallel arms. In the terminal, pressing Shift+Tab ("cli.cycle_mode": ["shift+tab"] in keybindings.json) cycles between the active model viewports. And if a developer cancels the session, Antigravity records an opt-out timestamp in SQLite and pauses auto-triggers for 48 hours.

---

4. Pion WebRTC v4: The Headless P2P Mesh

Another surprise buried in jetski/language_server/remotecontrol/ was an entire WebRTC v4 stack compiled from github.com/pion/webrtc/v4: MeshDaemon.

Managed via the subcommand agy remote-control start|status|stop, it registers a persistent systemd user unit (antigravity-cli-daemon.service) with loginctl enable-linger.

Instead of requiring an open inbound port, reverse SSH tunnels, or VPNs, MeshDaemon establishes peer-to-peer data channels directly between your remote development server and companion web or mobile clients:

• Exchanges ICE candidates via Google’s Unleash signaling channels.
• Enforces DTLS channel binding and cryptographic session PINs (ReplaceInstancePin).
• Multiplexes interactive terminal I/O over binary SCTP data channels.

---

5. Hermetic Linux Sandboxing: exebox & sbox

When you launch agy --sandbox, the binary does not invoke Docker. It re-executes itself as an internal containerizer (google3/devtools/ai/sandbox/sbox.Main):

• Seccomp BPF Sycall Filtering: Restricts process capability sets via seccomp(SET_MODE_FILTER, TSYNC).
• Micro-RPC (urpc): The host CLI and the sandboxed subprocess communicate across lightweight UNIX domain sockets using a custom micro-RPC protocol.
• MITM Network Proxying: exebox spins up an in-process local HTTP proxy (startLocalProxy, writeProxyCert) that intercepts and decrypts outbound requests on the fly, whitelisting permitted domains and preventing data exfiltration.
• Standalone Hermetic Python: To prevent reliance on system libraries, the binary automatically extracts an embedded hermetic Python runtime into a temporary cache directory for isolated execution.

---

6. Remote Audio & PulseAudio Tunneling (agy mic-serve)

Buried in the CLI subcommands sits agy mic-serve:

Usage: agy mic-serve [--addr 127.0.0.1:4713]
Serve this machine's microphone to a CLI on another host

Port 4713 is the native protocol port of PulseAudio. When you develop remotely over SSH from a laptop (like our ThinkPad HaxorPad) to a headless AMD EPYC server (TanriZarAtmaz), you can run agy mic-serve locally.

The remote agy session connects to the local loopback, captures your PCM audio stream, and pipes it directly over a bidirectional gRPC stream (bidiStream) to Google Cloud Speech API (google.cloud.speech.v1p1beta1). The CLI displays Draft transcription tokens in real time on your terminal prompt before committing the final command.

---

💡 What This Means for Autonomous Engineering

Deconstructing agy reveals where frontier agent architecture is actually heading:

1. The Terminal Is an OS: An autonomous coding agent is no longer an API caller; it is a full runtime environment managing virtual filesystems, container sandboxes, and P2P networks.
2. Deterministic Safety over Prompting: DeepMind’s integration proves that production safety cannot rely on prompting LLMs to “be safe”. It requires fail-closed in-flight AST inspection, seccomp filters, and real-time reasoning monitors.
3. Zero-Collision Concurrency: Tools like BattleModeFS show that the future of agentic coding is speculative execution — branching multiple models into copy-on-write overlays and letting human engineers review unified diffs before any code ever touches disk.

The 204MB binary on our machine isn’t bloated. It is a glimpse into the next decade of software construction.