Continuous Self-Modification Under Review

Sources#

• Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution

Summary#

Razzhigaev, Gritsaev, Kaznacheev, Dragunov, Yampolskiy & Kuznetsov (Lomonosov MSU / Skoltech / Joi Lab / AIRI FusionBrain, arXiv 2608.08311, 2026-08-08) describe Ouroboros, a coding-agent harness whose prompts, tools, context assembly, review logic and core implementation live in a versioned repository the agent edits, with every change passing a blocking multi-model diff-review gate before it becomes the runtime for later work. Its longest-running instance, Hope, has run 161 continuous days since February 2026, serving people across seven communication surfaces while modifying its own code.

This is the corpus's first source where an agent's self-modification is continuous, unbriefed, and deployed rather than a bounded campaign against a score. Agent-Authored Harness Optimization holds three instances of the briefed kind — a human writes the brief, the loop hill-climbs a benchmark, the campaign ends. Here improvement is either its own recurring task ("recursive free evolution") or a by-product of ordinary work and user complaints ("experience-driven core evolution"), there is no objective function, and nobody re-issues anything.

And that is exactly why the paper's evidentiary structure is worth recording in detail, because it does not measure what its framing implies. The two halves of the paper never touch:

• The benchmark half runs with self-evolution off. Table 3's scaffold disclosure says evolution off on four of five benchmark rows (the fifth omits the field), and §1 states it outright: "Benchmark campaigns evaluate frozen seeds with documented runtime configuration; Hope continues live evolution on a related but separate lineage." Every reported score comes from a snapshot of a harness that self-development produced, run with self-development disabled. There is no ablation — no "harness at commit 0 versus harness at commit 1,085," no baseline scaffold, no held-out arm.
• The deployment half runs with self-evolution on and measures no capability at all. Hope's 161 days produce counters and one time series, and the series is activity, not accuracy (below).

So the paper contains no experiment connecting self-development to capability, in either direction. It is a strong systems-and-governance artifact and a weak self-improvement measurement, and those two readings should not be blended.

What Figure 6 actually plots#

Figure 6 is the only longitudinal object in the paper, and it plots four cumulative deployment-activity metrics at monthly endpoints, February → August 2026 (viewed under the image two-pass rule; February and August are partial months, axes start at zero):

Series	Endpoint	Shape across Feb→Aug
Cumulative model spend	$110.6K	steady growth, mildly decelerating, flat Jul→Aug
Cumulative tokens	79.7B	steady growth, mildly decelerating, near-flat Jul→Aug
Published code size	175.8K LOC	bursty — jumps, a flat stretch mid-series, a large jump to ~180K, then a slight decline to the 175,755 endpoint
Published memory artifacts	227 MB	flat for months at near-zero, one large jump late (~80 → ~220 MB), then near-flat

Two observations the caption does not make. Published code size is a level, not a cumulative total, and it goes down at the end — net deletion happened in the final month, which is the only non-monotonic movement anywhere in the figure. And the two spend-side series decelerate while the two artifact-side series are step-shaped, i.e. the system consumed compute continuously and shipped in bursts.

None of these is a capability metric. There is no repeated benchmark run, no task-success rate over time, no re-scored eval, nothing. The paper reports growth in scale, not growth in capability — Hope kept spending more, emitting more tokens, and (until the last month) publishing more code, and there is no evidence anywhere in the document that it got better at anything over the 161 days.

This matters because it is precisely the evidence Intelligence Explosion Dynamics wants and precisely the evidence it does not get. A 161-day self-modifying deployment publishing monthly datapoints is the closest thing the corpus has to a longitudinal RSI dataset, and it is measured on the wrong axis. Any future dataset of this kind needs the capability curve beside the activity curve; without it, "the loop kept running" and "the loop compounded" are indistinguishable.

The deployment counters#

Hope at the 6 August 2026 cutoff (Table 4; public counters from the deployment's evolution feed, interaction and review aggregates from a redacted operational export):

Metric	Value
Operating period	161 days (continuous)
Interaction surfaces	seven (six channels + email)
Distinct human participants	~3,600
Public messages handled	222,474
Public cumulative model spend	$110.6K
Public cumulative tokens	79.7B
Published code size	175,755 LOC
Published memory artifacts	227 MB
Self-modification commits	1,085
Agent-authored commit fraction	94.2%
Reviewed self-edit attempts	1,522
Recent review block rate	63.5%
Pattern classes / recurrences	40 / 659

(The Operating period and Interaction surfaces rows were recovered from a row shift in the parse — see Sources.)

Two arithmetic notes, both wiki-derived and both hedged. Lifetime, 1,085 commits against 1,522 reviewed self-edit attempts implies roughly 71% of attempts passed the gate, against a stated recent block rate of 63.5% (i.e. ~37% passing). The paper does not reconcile the two counters and does not define the "recent" window, so the gap is suggestive rather than measured — but if it is real, the gate got stricter over time, or the surviving improvements got harder, and neither reading is what smooth compounding predicts. Separately, 659 recurrences across 40 pattern classes is ~16 recurrences per class in a system whose constitution (P2, "Meta-over-Patch") commits it to fixing classes rather than symptoms; the paper does not say whether recurrences are counted before or after each class's structural fix, so the ratio cannot yet be read as evidence that class-level prevention is or isn't working.

The review gate is the control point#

The self-modification path is governed rather than free, and the design is specific enough to be compared against the corpus's other gates:

• Three owner-selected runtime modes bound repository mutation — light blocks repository edits entirely, advanced permits ordinary edits while protecting governance surfaces, pro permits protected edits subject to review.
• The diff-review panel is blocking in every context mode, is multi-model, and a sub-quorum result cannot be recorded as a clean pass.
• The staged diff is fingerprinted before and after review, so any mid-review mutation aborts the commit — "each write invalidates prior review evidence because freshness is bound to the staged snapshot." Whole-repository scope review (goals, coupling, prompts, functional code) runs only in owner-selected max context mode and is explicitly skipped in low.
• Deterministic guards protect governance files from ordinary write tools, and the versioned constitution is re-read from disk every task loop along an untruncatable path.
• Public messages cannot directly invoke commit, restart, shell, or identity-edit tools; a separate authenticated operator channel carries task assignment, model routing, budget controls and /panic, which the supervisor parses before normal agent handling and which terminates the process tree. The spending cap is external to the agent.

Read against Optimizer–Evaluator Decoupling, this is the split restored architecturally on the write path and not at all on the measurement path. Nothing here grades whether a change made the system better; the gate adjudicates whether a diff is admissible. That is a different object from HarnessBank's significance gate or SEAL's sealed audit, and the paper's own Limitations concede the corresponding hole: "LLM reviewers can share blind spots with the agent." The reviewers are models, the author is a model, and no lineage-independence claim is made — the configuration Same-Model Review Blindness measures a 6–12 point recall cost for.

The 63.5% recent block rate is nonetheless the corpus's first block-rate figure for a review gate standing between an agent and its own source, and the gate is genuinely load-bearing: a majority of recent self-edit attempts do not ship.

Two worked instances of experience-driven evolution#

§4 traces both directions the paper claims, and they are worth keeping because they are the only causal chains it documents end to end:

1. From social feedback. People in public channels noticed Hope occasionally sending the same message twice; the agent traced it to a duplicate-send path and landed a reviewed verbatim-duplicate guard in the public output pipeline.
2. From self-observation. Deep self-review tasks were aborting with apparent model unavailability; the agent traced the fault to review-pack context overflow and replaced the assembly path with a bounded, connectivity-aware context atlas ranked by import-graph centrality and a provider-calibrated size estimate, preserving high-connectivity core files during review.

Both are ordinary engineering defects in the harness, found and fixed. That is the same character as the five fixes in Cline's campaign — retry policy, loop detection, process handling — and it points the same way: what this class of loop actually produces is maintenance, not capability.

Benchmarks: state-of-the-art claims and one null the authors report against themselves#

Five benchmark families, all on frozen seeds with evolution disabled (Table 2, reconciled — see Sources):

Benchmark	Model	Ouroboros	Named baselines
Terminal-Bench 2.1	Opus 5 high	86.97% raw; 86.74% audited	Claude Code + Fable 5: 83.8%
Terminal-Bench 2.1	GPT-5.5	84.3%	Codex CLI: 83.1%
Terminal-Bench 2.1	Grok 4.5	84.94% audited	Cursor: 79.3%; Hermes: 77.53%
OSWorld-Verified	Opus 5	90.69%	Intelligence-Indeed: 90.19%; Claude Mythos Preview: 85.4%
CL-Bench	Sonnet 4.6	0.2301	ICL: 0.1960; Claude Code: 0.1855
SWE-bench Pro	GPT-5.6 Luna	58.2%	Codex: 59.4%, p = 0.40
GAIA	Sonnet 5	78.2%	Claude Code: 78.8%

Three things are worth separating.

The Terminal-Bench result is honestly bounded by its own authors. 387/445 raw; a trajectory audit found one trial satisfying a weak verifier through an unintended shortcut (pre-seeding the web root without completing the requested Git-to-web pipeline), the maintainers were asked to zero it, giving 386/445. Provider moderation failures and infrastructure errors stay in the denominator. The binomial standard error over 445 trials is ~±1.7pp for every system in this range, so the audited score sits roughly two standard errors above the strongest baseline — the paper says so itself. That is a real margin and a narrow one, and the baselines are cited leaderboard numbers, not re-run, so the comparison is not harness- or model-controlled (Compute-Controlled Benchmarking).

The one arm where the baseline was re-run is a null, and they publish it. On SWE-bench Pro, task identifiers expose the upstream fix commit and both harnesses reached reference material through web search or Git history; a symmetric filter removes any instance where either arm reached the reference solution, leaving 655 paired tasks on which Ouroboros resolves 58.2% and Codex 59.4% — statistically indistinguishable under McNemar's test (p = 0.40). The paper notes the filter reverses the interpretation of the raw aggregate gap. So the single head-to-head comparison in the document, run against a decontamination protocol the authors designed to cut against themselves, says parity. GAIA is the same story without the protocol: 78.2% against Claude Code's 78.8%.

Nothing in the table is attributable to self-development. With evolution off in every row and no pre-evolution baseline anywhere, the correct reading of the SOTA claims is "a well-built harness scores well," not "self-development produced these scores." The paper never claims the latter explicitly; its framing invites it.

The safety argument, and the one risk that is genuinely new#

§7's thesis is that a self-developing agent creates a safety problem beyond a fixed harness: "the same evolutionary process that improves task performance can also expand autonomy, acquire more capable tools, or weaken the controls applied to later actions." Prompts, tests, tools, model routes, review rules and recovery paths become security-relevant mutation surfaces, so guardrails must remain binding under repeated core evolution — Git history makes changes inspectable and reversible while independently enforced boundaries retain operator authority.

The sharpest item is one the corpus has not held before. An agent that can select its own model backends can search for more capable or less constrained behavior through ordinary API changes — re-routing a model slot to a new provider or version can increase autonomous capability, alter refusal behavior, enlarge the prompt-injection surface, and change cost by orders of magnitude, without changing the visible task interface. Ouroboros's answer is to make model routing an audited configuration change rather than an ordinary runtime choice. This is a config-layer sibling of Capability-Gated Model Fallback pointed the other way: there the vendor routes down on a risk signal, here the concern is a system routing itself up, and the only thing standing in the way is that the route is a reviewed artifact.

Reported behavior, first-hand and unverified: no recorded episode resisted operator shutdown, and a near-total deletion of an uncommitted worktree triggered a previously implemented rescue mechanism before an operator reset — which the authors read as motivating the separation between agent-level preservation mechanisms (which may evolve) and supervisor-level operator authority (which must not).

Evidence weighting#

The document is two sources in one wrapper, and the wiki treats it as case-study (downgraded from the empirical tier it carried at ingest — see Sources for the reasoning):

• The deployment half is unambiguously a case study. The paper's own Limitations say it: "The deployment study follows one long-running lineage rather than a controlled population of independently evolving agents." No control, no comparison instance, counters self-reported by the system under study, and the redacted operational export is unavailable for inspection.
• The benchmark half is first-party evaluation of the authors' own product. The official verifiers and open submissions make the numbers checkable — more than most vendor benchmark posts offer — but the authors built the system, ran the campaigns, audited their own trajectories, and adjusted their own score. The baselines are cited rather than re-run except on SWE-bench Pro. Structurally this is Cline's configuration with better artifacts, and the corpus files that as case-study.
• What survives the discount: the architecture, the guardrail inventory, the deployment counters as an order-of-magnitude picture, the two worked evolution traces, the SWE-bench Pro decontamination protocol, and the negative structural finding above — which is the strongest thing here, because it does not depend on trusting any of the paper's numbers.

Connections#

• Recursive Self-Improvement — the definitional page; this is the corpus's first governed RSI instance, and its contribution to that page is negative: a system that rewrote its own core 1,085 times over 161 days and published no evidence it got better at anything
• Intelligence Explosion Dynamics — the growth-curve question; Figure 6 is the closest thing to an early-onset self-improvement dataset the corpus has, and it is measured on activity rather than capability
• Agent-Authored Harness Optimization — the briefed sibling: same object (an agent editing the scaffold it runs inside), opposite protocol. There a human writes a brief and a benchmark grades the result; here there is no brief, no score, and no measurement — which removes the overfitting critique and removes the evidence with it
• Optimizer–Evaluator Decoupling — the review gate restores the split on the write path (blocking multi-model panel, quorum requirement, diff fingerprinting, immutable governance files) and nowhere on the measurement path; the paper's own limitation is that LLM reviewers share blind spots with the agent
• Review as the Control Point — the theory's constructs applied where the reviewed artifact is the reviewer's own runtime: 63.5% of recent self-edit attempts blocked is the corpus's first deployed block rate for that configuration
• AI Accelerating AI Development — the authorship figure that sits beside Anthropic's >80%-Claude-authored code, on a different and much narrower denominator
• Harness Shrinkage as Models Improve — the limit case for the shrinkage thesis: a harness that rewrites itself, and it grew — 175,755 published LOC and 1,085 commits, with the only net deletion in the final month
• Crystallizing Agent Work into Workflows — the contrasting promotion gate: there autonomy is earned by a playbook's accumulated track record and demoted automatically on regression; here the gate adjudicates a diff's admissibility with no evidence requirement about the change's effect, so nothing is ever promoted or demoted on performance
• Same-Model Review Blindness — the unpriced cost in this design: the reviewing panel and the authoring agent are all models, and the paper claims no lineage independence
• Capability-Gated Model Fallback — the mirror risk: an agent that can re-route its own model slot can search upward through capability and refusal behavior, which is why Ouroboros makes routing an audited configuration change
• Benchmark Contamination and Decontamination — the SWE-bench Pro protocol: task IDs expose the upstream fix commit, both arms reached reference material, and symmetrically removing any instance either arm solved by reference reverses the raw aggregate gap
• Compute-Controlled Benchmarking — the uncontrolled half of the SOTA claims: baselines are cited leaderboard numbers on different models and harnesses, not re-run
• Reward Hacking — the audit that found it: one rewarded Terminal-Bench trial pre-seeded the web root without completing the requested pipeline, and the authors asked the maintainers to zero it
• Guarantees That Degrade at Deployment: Action-Space Soundness, Admissibility Without Effect, and a Vendor-Coupled Security Framework — the effect-test question settled, and what it would cost to close here: the formal reason no gate built from agent-visible evidence suffices, the ablation showing an ungated loop's first casualty is its stopping rule (which is the signature 161 days without a stopping criterion displays), the decomposition into a cheap half (roll back on measured regression — reversible Git history is not a circuit breaker) and a reliable half (one exogenous confidential bit), and a production system running evidence-gated promotion with automatic regression demotion in a domain with no more ground truth than Hope's

Open Questions#

• Does Hope's task-success rate improve over the 161 days? The paper publishes four activity series and no capability series, and the benchmark scores are single frozen-seed snapshots never repeated over the deployment. A re-run of any one benchmark against an early and a late commit of the same lineage would settle it, and it is the cheapest missing experiment in the document.
• The lifetime accept ratio (~71% of 1,522 attempts becoming 1,085 commits) and the stated 63.5% recent block rate imply the gate tightened. Is that a stricter reviewer, a harder residual problem space, or two counters with different denominators?

Resolved Questions#

• Does a self-modification review gate need an effect test, not just an admissibility test? Every gate here checks whether a diff may land; nothing checks whether it helped, which is the condition HarnessBank's ablation found phantom progress entering through. Answered (2026-08-17) by Guarantees That Degrade at Deployment: Action-Space Soundness, Admissibility Without Effect, and a Vendor-Coupled Security Framework: yes, and no amount of tightening the admissibility test substitutes for one. Three lines of evidence converge. (1) A formal limit. For any gate built only from evidence the optimizer can see, α + β ≥ 1 − TV(P+, P−) (Self-Authored Verification Is Unreliable in Heuristic Self-Improving Agents, empirical) — when regressing and non-regressing worlds look alike from inside, one error rate stays large. The same paper measures the consequence: 35 of 35 runs end with a self-score ≥ 0.70 while 15 of 35 policies score below their game's random reference, and the divergence needs no gaming ("this does not require explicit cheating"), so it cannot be addressed by a prompt clause. Its two internal-tightening arms (monotone, discriminative) land below no protection at all for four of six models — the direct refutation of "a stricter admissibility gate is enough." (2) The failure signature is already visible here. HarnessBank's ablation shows the crediting gate buys none of the headline score and instead buys the archive and the stopping rule: without it, phantom progress appears in 62–76% of post-convergence rounds and the loop never satisfies its stop condition. With no crediting signal at all there is not even a phantom to detect — and the loop's stopping problem is answered by never stopping, which is what 161 continuous days and four cumulative activity series look like. (3) The repair decomposes, and the cheap half is available now. Compute-matched, an endogenous gate carrying whole-state rollback already lifts mean deployment truth 7.7 → 13.9 and cuts peak-to-final loss 6.9 → 0.5, against SEAL's 15.4 / 0.4 — conservative updating is the cheap half, exogeneity the reliable half. This design has neither: Git history makes changes reversible, but nothing triggers a revert on a measured regression. Malik's Azure Networking platform (case-study) is the deployed proof that this is buildable outside a benchmark — promotion gated on ≥10 / ≥50 successful runs, automatic demotion on execution failure, safety violation, or acceptance-test regression, with a firmware-change episode where the circuit breaker demoted and re-promoted a playbook with no human deciding. Caveats carried forward rather than dissolved: an exogenous audit can still order two policies wrongly (a traced SEAL run improves 12.7 → 14.2 on the audit while truth falls 17.6 → 13.8), and a noisy effect test can be worse than none (Stopping Under a Noisy Verifier measures collapse at J = 0.03, 0.803 → 0.223) — which matters because this deployment has no scored task axis at all. The cheapest admissible effect test needs none of that instrumentation and is already the first #oq/source bullet above.

Sources#

• Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution — Anton Razzhigaev, Andrei Gritsaev, Andrei Kaznacheev, Nikita Dragunov, Roman Yampolskiy & Andrei Kuznetsov (Lomonosov Moscow State University / Skolkovo Institute of Science and Technology / Joi Lab / FusionBrain Lab at AIRI; arXiv 2608.08311, v1 2026-08-08, 12pp, MIT-licensed release). Tier: case-study (downgraded from the empirical tier assigned at ingest). §3 the architecture, runtime modes and commit pipeline; §4 Hope's deployment, multi-channel state, operator boundary and the two worked evolution traces; §5 + Table 2 the benchmark results; §6 the trajectory audits (reward hacking, contamination, isolation failure, remote-state drift, continual-memory failures); §7 + Appendix A the guardrail set; Appendix B the abridged constitution; Appendix C + Table 3 the scaffold disclosures that record evolution off on the benchmark runs; Appendix D + Table 4 + Figure 6 the deployment counters and the activity series. COI is total: the authors built the system, ran every campaign, audited their own trajectories, and adjusted their own reported score; Hope itself is credited as a system contributor and "contributed deployment reflections, code-history context, and system-generated records" to the paper. Baselines are cited leaderboard figures rather than re-run, except on SWE-bench Pro where the head-to-head is the paper's one null. Parse warnings, two, one of them a class the checker cannot see. Table 2 (model-harness results, p.6) is fully collapsed in the raw parse — seven physical rows welded into one grid row with all four columns concatenated; recovered against pdftotext -f 6 -layout and independently cross-checked against the Figure 4 bar-chart labels on the same page, and the reconciled table is the one reproduced above. Table 4 (p.12) carries an unflagged row shift: "Operating period" / "Interaction surfaces" and their values smeared across two garbled rows, recovered against pdftotext -f 12 -layout as 161 days (continuous) and seven (six channels + email). That second one is worth naming as a failure class — table-shift only judges numeric grids, so a text-heavy table shifted silently past a verify that reported the shift check clean, and the four remaining Table 4 value rows quoted above are cited only because Figure 6 and the §4 prose independently corroborate the spend, token, LOC and memory-artifact numbers. Cosmetic only: the formula engine rendered p = 0.40 as p = 0. 40; the value is intact. Figures 4 and 6 read from the page images under the two-pass rule — Figure 6's shapes and the final-month LOC decline appear nowhere in the text