An agent is a loop with tools, and systemd decides how often it runs — cheat sheet

# what the agent can do, and how long it may loop
grep -v '^#' /etc/inbox-agent/agent.env
sudo journalctl -u inbox-agent -o cat | grep ': tool '

# how the unit runs
systemctl show inbox-agent -p Type -p Restart -p User -p DynamicUser -p ProtectSystem -p NoNewPrivileges -p RuntimeMaxUSec -p NRestarts
systemd-analyze security inbox-agent.service --no-pager | tail -1
systemctl list-timers inbox-agent.timer

# a periodic job
#   service: Type=oneshot, no [Install], RuntimeMaxSec=
#   timer:   OnCalendar=*:0/15, Persistent=true, WantedBy=timers.target
sudo systemctl disable --now inbox-agent.service
sudo systemctl enable --now inbox-agent.timer
sudo systemctl start inbox-agent.service     # one pass now; waits for it to finish

# confinement
#   DynamicUser=yes  StateDirectory=NAME  ProtectSystem=strict  ProtectHome=yes  PrivateTmp=yes  NoNewPrivileges=yes
ls -ld /var/lib/inbox-agent /var/lib/private/inbox-agent
sudo systemd-run --wait --pipe -p DynamicUser=yes -p ProtectSystem=strict touch /etc/x   # Read-only file system

# the lab's scripted model
curl -s 127.0.0.1:11500/_requests | jq length