The bottom of the iceberg is not a bigger model — it is a loop. A language model on its own answers once and stops; an agent is that same model placed inside a cycle where it can choose a tool, see what the tool returned, and decide what to do next, over and over, until it declares itself finished. Everything below runs in the open: the model picks the actions, but the tools are ordinary JavaScript functions in this file, the arithmetic is done by a parser rather than by the model's own guesswork, and every thought, call and observation is printed as it happens.
These are real functions, executed locally. The model never computes the answers itself — it decides which tool to call and with what arguments, which is exactly the division of labour that makes agents useful and, occasionally, dangerous.
The loop is startlingly simple: send the goal plus a description of the available tools, read the model's reply, and if that reply asks for a tool, run it and send the result back as the next message in the same conversation. The model is instructed to answer only in a small JSON object containing either an action or a final answer, and the page parses that object defensively — a malformed reply is not a crash, it is just another observation ("your last message was not valid JSON"), which the model then usually fixes by itself. Nothing the model says is executed as code: arithmetic goes through a hand-written recursive-descent parser rather than eval, because a language model's output is untrusted input and treating it otherwise is how agent demos become security incidents. A hard step limit bounds the loop, since an agent with no ceiling can spend real money in a cycle it cannot see it is stuck in. What makes this the deepest layer is not intelligence but agency — every layer above answers a question, and this one takes actions in the world and then reacts to what came back.