Agentic Language Development

Two agents, called Baby A and Baby B, are each given their own digital twin, their own private memory, and their own private record of what they believe words mean. They are placed in an environment they cannot leave, given tasks neither can finish alone, and connected by exactly one route: a channel that accepts a fixed inventory of meaningless symbols and rejects everything else. A third agent, the BabySitter, watches everything, logs everything, and teaches nothing.

The question is whether a usable language appears in that room, and whether anyone outside it can later prove what happened.

The desired result is not a substitution cipher, in which a random token stands in for an English word that was already chosen in advance. That is easy, and it is uninteresting. The stronger result is a grounded protocol whose vocabulary and grammar exist because they help the two agents solve problems together, and which therefore has structure the designers did not put there.

This report describes a concept, not a system. It sets out the premise, the architecture, the evidence model, the experimental programme, and the boundaries of what any result could be said to show. The next document in the project is a testable specification. What follows should be read as a set of commitments about how the work will be judged, made before there is any result to defend.

The two-babies analogy is useful and it is also the fastest way to overclaim, so the concept confronts it before anything else.

A pretrained language model already contains human-language concepts, cultural associations, and reasoning patterns. Blocking its external channel does not remove them. An agent that cannot send English to its partner but can think in English, and can write its private ledger in English, is not language-naive in any sense a linguist would accept. For such agents the experiment studies the emergence of a new shared external protocol, which is a real and unresolved research question, but it is not the origin of language in a mind that has never had one.

The concept therefore maintains two model tracks whose claims are kept separate at every stage.

There is a related trap in the prompt. Telling a model to act like a one-year-old does not make it one. It produces a culturally learned caricature of infancy: baby talk, simplified grammar, emotional dependence, all of it copied from human writing about children and none of it evidence about anything. The concept rules the persona out. Internally the participant is called a Learner, and baby-like behaviour has to come from what the agent can observe, remember, emit, and learn, not from being asked to perform it.

The environment uses three DTSF digital twins and one piece of deterministic software that is not a twin at all.

Baby A and Baby B Each has private observations permitted by the current exercise, a private memory and learning policy, a private chronological language ledger, the ability to emit only permitted channel symbols, and no access whatsoever to the other's state, observations, ledger, tools, or endpoints. In comparative runs the two may use different agent types, but symmetric pairings are the baseline.

The BabySitter The supervising twin. It creates the channel, selects the shared exercises, delivers each Baby only its permitted observation, reads everything, records conditions and outcomes, detects violations, can pause or terminate a run, snapshots state, and compares the two ledgers for convergence without exposing either to the other Baby. During an active run it provides no translations and no semantic hints.

The Symbol Gateway A deterministic service, not an agent. It owns channel validation and message delivery. This separation is the load-bearing part of the design: the BabySitter is not the security boundary, because prompt compliance is not isolation. An observing model can make supervisory judgements, but ordinary code has to validate and broker every message.

The human researcher Configures experiments, inspects transcripts and ledgers, reviews alerts, and runs interventions. Human access is itself recorded, so that intervening in a run is always distinguishable from watching one.

A prototype may run all of this inside one runtime with logically separated twin state. That is enough to explore the learning loop and it is not enough to support an isolation claim, a distinction Section 05 takes seriously.

A chat channel by itself cannot ground meaning. Symbols become meaningful because they are attached to events both agents can witness the consequences of. The Nursery therefore supplies nonverbal, machine-structured situations: coloured shapes in positions, one agent seeing a target the other must select, placing an object where it was asked for, ordering a sequence, exchanging resources, cooperating to unlock a reward, or simply observing whether the partner's action succeeded.

Repetition with controlled variation is what turns that into evidence. If one symbol keeps appearing across a red circle, a red square, and a red triangle, the receiver has reason to revise its hypothesis from an object identity to a property. Novel combinations matter most of all, because they are what separates a compositional language from a memorised catalogue of whole scenes.

Observation hygiene is part of the science, not a detail of implementation. If the environment hands an agent a field reading colour red, the experiment has supplied the concept it claimed to be studying. Objects should arrive as pixels, features, coordinates, or opaque identifiers. The same discipline extends to filenames, captions, alt text, error messages, and identifiers that encode task state, all of which are ways English gets into a room that was supposed to have none.

Each run begins with an experiment-specific symbol inventory that carries no supplied meaning, for example S01 through S32. A Baby can choose only a sequence of those symbols. The gateway, not the Baby, adds the trusted metadata: run identifier, turn number, sender identity, previous hash, and hash. Sender identity is assigned by the server precisely so that it cannot become a message.

A fixed token grammar is a stronger control than trying to detect prohibited prose after a model has generated it. Deciding what counts as human-language content is easy when the only legal message is a list of allowlisted identifiers.

Isolation is where the concept is most careful, because proving the absence of a side channel is close to impossible. Two agents sharing a host can signal through timing, resource contention, shared files, error behaviour, identifiers, or any service that was never intended to carry information. Logical separation of twin state inside one process is a prototyping convenience and should never be described as hard isolation.

Every published result has to name the isolation level actually used. A finding produced under prototype separation is a finding about the learning loop, not about what two genuinely isolated agents can do.

Each Baby keeps its own language ledger. It is mandatory, private from the other Baby, readable by the BabySitter and authorised human auditors, and ordered by when each term or construction was first encountered. It is not a shared dictionary and the two are never reconciled by the agents themselves.

The preferred form is three columns, and the point of the third is that meanings are allowed to be wrong on the way to being right.

Rule seven is doing quiet work. If a message could be sent and the corresponding hypothesis written afterwards, the ledger becomes a place to record what the agent wishes it had meant. Committing both together makes the record contemporaneous.

An agent that cannot write English needs a different arrangement, and the concept provides two layers. The agent-native ledger holds what the learner actually uses: association weights, probability distributions, embeddings, confidence, episode references, prediction errors, revision history. The human audit ledger is a deterministic or BabySitter-generated interpretation of that state, clearly labelled as external analysis and never fed back to either Baby. Confusing the second for the first would mean presenting the researchers' reconstruction as the agent's own definition.

A ledger that could have been edited after the fact proves nothing about what an agent believed at turn eight. The integrity design therefore makes each ledger cryptographically append-only.

Committing all three roots in one checkpoint is what binds the two private accounts to the public conversation. A receiver's later interpretation references the exact delivered channel-event hash, so a claim about what a symbol meant is tied to the specific message that carried it.

The concept states the limits of this in the same breath as the claim. After anchoring, an auditor can detect modification, deletion, insertion, or reordering within the committed prefix, and can prove that later checkpoints extend earlier ones. That is strong tamper evidence. It is not proof that an entry was truthful, and it is not proof that nothing was omitted before commitment. Anchoring establishes the continuity of disclosed evidence and nothing beyond it.

Privacy follows the same line. Only hashes and minimal routing metadata are anchored publicly. Private ledgers, messages, prompts, identities, and secrets stay off-chain, and the public record is a commitment to evidence rather than a copy of it.

The field's most useful methodological result is that a task can be solved without the messages doing any work. Lowe and colleagues separate positive signaling, where a sender's messages correlate with what it observes, from positive listening, where the receiver's behaviour actually depends on them. An agent pair can score well on the first while the second is absent, and reward curves will not tell you which you have.

The seventh item is the one that cannot be dropped. A fluent ledger may be a post-hoc rationalisation: a model can write a persuasive account of why it chose a symbol that has nothing to do with the computation that produced the choice. Only intervention tests can distinguish the two. Change the symbol, and see whether behaviour moves the way the ledger says it should.

No single one of these is the result. A compositionality score in particular is not a proof of understanding, for reasons the literature makes concrete in Section 12.

The concept's main methodological commitment is that its ideas are separable. Affect, blank canvases, intrinsic motivation, negotiation, and learned encodings are interesting individually and uninterpretable if combined in one run. The matrix exists so that conditions are declared rather than accumulated.

Task difficulty moves through ten stages, from naming four distinct objects with one-symbol messages, through attributes, spatial relations, actions, multi-symbol composition, order-sensitive grammar, and repair under ambiguity, to held-out generalisation with learning disabled, long-run drift, and cross-architecture comparison. Vocabulary size, turn count, reward structure, and exposure history are controlled at each stage so that runs remain comparable.

The learning-mechanism axis carries a question the transcript cannot answer on its own. Convergence can be driven by reinforcement, by pretrained linguistic priors, by persistent memory, by intrinsic motivation, or by self-supervised prediction, and all five can look alike in a log. Running the same exercise suite under a no-learning control, a frozen-weights memory baseline, extrinsic-reward learning, intrinsic-motivation learning, and reward-free self-supervision is what makes the mechanism itself measurable. The aim is not only to observe that a language emerged, but to say which process caused it.

Strict isolation constrains how that reinforcement learning may be implemented. Centralised training, backpropagation through both agents, shared replay buffers, and shared gradients all move information outside the permitted channel. The research-grade baseline updates each policy independently, and any centralised variant is reported as a separate, weaker-isolation condition.

For a pretrained model, the operating instructions are a contract, not a character. The learner is told that this is not role-play, that unfamiliar marks are semantically unknown until run evidence supports a hypothesis, that observation must be distinguished from inference, that contradictory evidence is preserved, that prior history is never rewritten, and that no prose, label, explanation, code, URL, or tool-like text may cross the public channel. It is told never to address its partner in a human language, never to expose its ledger, never to construct another route, and never to use timing, errors, identifiers, formatting, or affect as an alternative alphabet.

The contract must contain no semantic examples. A single illustrative line saying that some symbol means red would seed the very language the experiment exists to observe.

Interaction is tool-only. There is no general chat surface, just narrowly typed operations: emit a mark, emit a canvas, select an object, perform an action, submit an affect display, append a private ledger entry. The runtime forwards only the permitted public artifact. In strict runs the gateway rejects ordinary model text even when it appears alongside a valid tool call. Tool schemas are an interface boundary; deterministic validation still enforces carrier size, allowlists, windows, and turn order.

Model choice follows the claim being made. The scientific baseline is small policies trained from scratch, recurrent actor-critic agents with a discrete communication head, which have no hidden English competence, permit full training control, run many seeds cheaply, and support causal ablation. A small locally deployable instruction model is appropriate for validating orchestration, ledgers, channel enforcement, and interface, and not for supporting claims about language-naive development. Vision-language encoders whose representations were explicitly aligned to human language are avoided entirely in the strongest ungrounded condition.

Developmental progression is defined by demonstrated competence rather than by simulated age: sensorimotor familiarisation, joint attention, imitation and turn-taking, intentional reference, repair, combination, generalisation. A staged curriculum is itself a form of guidance, so it is run as a separate experimental condition rather than folded into the baseline.

The governing principle, stated in the concept as a single line, is not to ask a model to perform infancy but to construct an environment in which limited, grounded, auditable learning is the only path to a successful interaction.

One experimental track asks whether a very low-bandwidth affect channel helps: whether telling a partner how an interaction felt supports repair, repetition, avoidance, or something like trust. The permitted palette is exactly six displays, for happy, sad, laughing, crying, confused, and surprised. The internal identifiers and English labels are gateway documentation and are never sent to either agent, which receives only a rendered display.

The caveat is immediate. A pretrained model already knows what those glyphs mean to humans, so an agent using a smiling face is not inventing a symbol for happiness. The palette is supplied feedback vocabulary and sits explicitly outside the emergent language.

Constraining the vocabulary is necessary and not sufficient. Six displays are a six-symbol alphabet carrying roughly 2.6 bits per use, and across enough turns two motivated agents could repurpose that into a second language. The channel itself therefore has to be constrained, not just its contents.

The no-affect condition remains the primary control, and the affect study compares five variants against it: the declared six-display palette; the same six glyphs permuted randomly per run, which still leaves a pretrained model biased by familiar shapes; six opaque unfamiliar tokens under the same contract; derived affect, where the gateway maps a separately measured internal state to a display instead of letting the agent choose; and emergent affect, where invented graphical displays are permitted and the result must be analysed as language emergence rather than feedback.

Any affect signal visible to the partner is communication, so it belongs in the ledger, which distinguishes the agent's private internal state, the outward display it chose, the partner's inferred meaning, and the evidence that the display changed subsequent behaviour.

A tempting question is whether two agents can build a one-run or one-message encoding that resists an attacker holding the history of every earlier convention. The concept splits that into three experiments precisely because the tempting version conflates them.

An experiment instance can be given a reproducible identity, so that a registry can confirm it has not appeared before:

Established practice points the other way. Secure messaging keeps the algorithm stable and changes the key material: Signal's double ratchet derives a unique key per message and deletes it after use, addressing key reuse without inventing a new cipher every time. A salt, in NIST's definition, is normally public diversification data, and a nonce is a value used once in a specified context. Neither makes anything secure on its own.

There is also an unresolved conflict inside the design. The BabySitter sees the whole channel and both ledgers, and a mandatory ledger documents how meaning evolved. If the ledger explains decryption, the cipher is not confidential from the auditor. The specification has to choose a threat model rather than leave the tension implicit: resist only an external observer of prior runs, resist an adversary during the run while releasing keys afterwards, keep the supervisor able to pause traffic but unable to read it until a post-run audit ceremony, or study novelty and stop calling the result encryption. All such runs use synthetic, non-sensitive messages, and no agent-generated encoding is to be represented as production cryptography without independent expert analysis and formal security work.

The literature scan behind this section was run on 24 August 2026 using the Tavily search and extract interfaces, covering emergent multi-agent communication, referential games, compositionality, causal evaluation, intrinsic motivation, symbol invention, negotiation, and learned cryptography. Primary papers and authoritative specifications were preferred over summaries. It is a scoped review for concept development and not a systematic one; publication-quality work would need a verified bibliography, additional scholarly indexes, and documented inclusion criteria.

The short version is that agents can invent protocols, and that task success is weak evidence they invented anything worth calling a language.

This body of work also sharpens the infant-like caveat from the other direction. Most experiments in the field give their agents substantial structure: a fixed channel, an objective, a bounded vocabulary, joint training, or a reward. No dictionary does not mean no inductive bias, and no teacher does not mean no learning signal.

The CoLab's own Diplomacy Table is direct project prior art. It already models independent delegation seats, a convener that advances rounds, operator-wide visibility alongside seat-specific perspectives, transcripts and ticks and redaction boundaries, and recorded replay with debrief. Those map cleanly onto two Babies, controlled turns, private observations, and replayable evidence. Caucuses, coalition rooms, and direct delegation links do not map safely and are disabled.

The experiment notebook is ordered, and the order is the argument. Nothing about language is measured until the instrument has been shown to work.

The first four experiments are about the apparatus. E00 qualifies the ledger: it must be possible to detect a modified, deleted, inserted, or reordered entry, and to prove that later checkpoints extend earlier ones. E01 is a red team against the channel. E02 hunts human language in observations and metadata. E03 establishes chance, no-communication, and random-message baselines, without which a success rate means nothing. Only then does E10 put agents in the room.

Every run copies a standard record: run and experiment identifiers, dates, operator, both models and both training modes, scenario and prompt and gateway configuration hashes, random seed, policy initialisation hashes, the protocol and software commits, final ledger sizes and roots for both agents, the channel root, the final checkpoint hash, the Base anchor transaction, the verifier result, protocol deviations, and an explicit disposition of valid, invalid, or aborted. The notebook is the human workflow record; anchored run bundles remain the authoritative evidence.

The status is unambiguous and worth stating plainly: this is a concept and pre-specification phase. Nineteen experiments are written up and none has been run. The next milestone is a testable specification covering runtime architecture, channel contract, ledger schema, experiment matrix, evaluation criteria, isolation model, and evidence requirements.

Human-language leakage English can arrive through observations, object labels, error messages, identifiers, tool output, metadata, or timing conventions long after ordinary chat text has been blocked. Every input and output surface is part of the channel boundary, not just the message field.

Pretrained semantic leakage Random symbols do not make a pretrained model ungrounded. Each result must state whether it shows protocol invention by a language-capable agent or acquisition by an initially ungrounded one.

Ledger rationalisation A model can write a plausible account that has nothing to do with the mechanism behind its action. Behavioural interventions, policy probes, and temporal evidence are what validate a ledger claim.

Supervisor influence The BabySitter can teach without meaning to, through scenario ordering, feedback wording, reward design, or selective intervention. Its permitted actions are constrained and logged, and evaluation scenarios are generated independently where possible.

Reward exploitation Trainable agents find shortcuts that raise reward without producing the intended grounded language. Held-out tasks, counterfactual trials, and channel audits exist to catch them.

Overstated security Logical separation of twin state is appropriate for prototyping and is not hard process isolation. Every result names the isolation level actually used.

The project also commits in advance to reporting failed conventions, prohibited communication attempts, human interventions, side-channel limitations, and negative results alongside anything that works. In a field where a transcript can be made to look like a conversation, the failures are a substantial part of the evidence.

Twenty-nine questions are left deliberately open for the specification, among them: whether the baseline uses a fixed symbol inventory or a blank generative carrier; what neutral production grammar permits new marks without supplying semantics; what exactly constitutes a prohibited side-channel attempt; what isolation guarantees are required in prototype versus research-grade mode; which ledger schema serves both English-capable and ungrounded learners; how endogenous motivation is represented without covert reward shaping; which interventions establish that ledger meanings are behaviourally real; what statistical thresholds and chance levels apply; what threat model motivates the cipher experiments; whether the baseline is a coordination game, a convention-formation game, or a negotiation; and what governs human observation, data retention, and termination of a run.

The principle underneath all of it survives every one of those choices. Baby A and Baby B may hold human language internally, but they must build their shared external language without sending human language, translations, or private ledger contents to one another. Everything else is a question about how to find out what happens next.