Hiro development journal

Autonomous controller feeds one clean real improvement into promotion

2026.08.26 at 22:11:48 America/Los_Angeles Phase 1 passed; repeatability, autonomous discovery, and meta-improvement remain unproven Machine-readable JSON

Executive summary

Qualified the first upstream controller layer against the already-proven production promotion actuator, using one deliberately trivial real Hiro observability change rather than a synthetic promotion object.

The final candidate added one redacted raw-model-output length field to response-envelope logs and one targeted baseline-contrast test. It traversed normal investigation, model-driven construction, evaluation, independent canary, full-suite governor, real activation, runtime verification, four probation checkpoints, and finalization.

The final governor run passed 790 tests. The live service reports the promoted revision as both loaded and checked out, and the canonical queue finished implemented while the promotion transaction finished finalized.

First-divergence discipline exposed and repaired narrow upstream problems: ambiguous evidence classification, qualification-environment configuration, external-runner activation reconciliation, and a repeatable insert-before edit-shape defect that duplicated a preserved anchor.

Two deliberately bad candidate attempts were correctly rejected at the first independent canary after a new duplicate-key invariant was added. No threshold was lowered and no promotion gate was bypassed.

Phase 2 was not started. The measured full governor suite takes about eight minutes and a complete real promotion takes roughly fifteen to seventeen minutes, so ten distinct clean promotions require at least two and a half hours. Phases 3 and 4 therefore remain gated and unproven.

Work completed

Explicit evidence and regression semantics

Completed

Wrote the expected corroboration truth table before changing implementation: supporting evidence with healthy regressions passes; contradictory evidence fails; absent evidence defers; supporting evidence plus a new regression fails; unavailable evidence defers.
The prior implementation described a healthy existing regression suite as an uncorroborated negative result. The minimum repair introduced explicit pass, fail, and defer decisions with stable reason codes.
Deferred corroboration now uses bounded retries and an eventual terminal reason instead of silently becoming a rejection or circulating indefinitely.
The focused continuous-engine suite passed all 64 tests after this repair; the five truth-table cases and the causal-protocol case passed directly.

Deterministic controller qualification command

Completed

Added a process-level Phase 1 qualification command that starts from a clean Git revision and fresh canonical queue database, persists one real low-risk local regression observation, and invokes the normal controller and model-driven autonomous sandbox.
The command does not manufacture a candidate revision. The normal candidate builder creates the production patch and targeted test, the normal evaluator judges it, and the existing governor and activation broker perform promotion and restart.
Logical canary and probation checkpoint time is advanced deterministically, while each checkpoint still runs the real independent tests and verifies the actual running process and revision.
The trace captures queue state, action, transaction state, and active revision at every boundary and writes a machine-readable result under the private runtime evidence area.

Deliberately trivial real improvement

Passed

The final candidate adds raw_model_output_length to the redacted ResponseEnvelope log dictionary. This helps distinguish model output from validator replacement text without recording private raw text.
The production diff is one line. The generated test verifies the length, preserves the existing final-answer length, and verifies that neither the raw field nor its text appears in the log receipt.
The candidate changed only the approved response-envelope production file and its generated autonomous test. It did not alter scoring, thresholds, promotion policy, external research, or RSI governance.
The final candidate revision is bb14826264f84a0bbb516b8d463695a58d9dfefa.

First-divergence repairs

Completed

Initial qualification inputs used a noncanonical origin and score shape. Those attempts failed before a candidate existed; only the harness inputs were corrected.
The first real construction attempt deferred because the external held-out evaluation vault was not resolved from the worktree. The existing supported environment path was supplied; no evaluation requirement was removed.
Early successful activations remained in queue state activation because the external qualification orchestrator observed the new runtime before the durable broker receipt was committed, then because runtime identity is cached at process import. The runner was repaired to wait for both health identity and the canonical transaction receipt and to reconcile under only that independently verified revision.
Several provisional candidate activations were additively reverted to re-establish a clean baseline after qualification-runner failures. They were not counted as completed Phase 1 promotions.
Source inspection found that the candidate repeatedly duplicated the existing final_answer_length dictionary key. A narrow independent AST canary was added; two subsequent candidates were correctly rejected at checkpoint zero.
The frozen candidate receipt showed the exact cause: an insert-before patch copied the preserved anchor into new content. The builder now mechanically removes only an exact copied trailing anchor for that edit operation. Eleven focused builder and response-envelope tests passed after the repair.

Final clean end-to-end proof

Passed

The final trace traversed queued, investigating, candidate, canary, activation, probation, and implemented without requeue or retry.
Independent canary checkpoints at logical minutes zero, five, and fifteen passed before promotion was requested.
The production governor ran the complete repository suite: 790 tests passed in 472.45 seconds. Five existing unknown-marker warnings did not affect the result.
The real activation broker restarted Hiro. Reconciliation verified the candidate revision running before entering probation.
Runtime probation checkpoints at logical minutes zero, sixty, two hundred forty, and four hundred eighty passed. The canonical queue finished implemented and the transaction finished finalized.
The live service reports loaded revision and checkout revision bb14826264f84a0bbb516b8d463695a58d9dfefa with revision_matches true.

Phase gates

Stopped after Phase 1

Phase 1 is the highest empirically demonstrated layer: a deliberately selected real non-meta improvement can traverse the normal controller into the proven actuator and become the verified running revision.
Phase 2 requires ten successful real promotions without manual promotion decisions. It was not started because measured wall time implies at least two and a half hours plus the work of defining ten distinct real changes.
Phase 3 autonomous discovery was not enabled because Phase 2 has not met its repeatability target.
Phase 4 meta-improvement was not attempted because Phases 2 and 3 remain unproven. Hiro is not characterized as recursively self-improving by this result.

Decisions and reasoning

Treat the deterministic promotion actuator as proven and diagnose upstream boundaries first.
Use canonical queue and promotion-transaction state as authority; runtime health is additional identity evidence, not a replacement for persisted state.
Classify corroboration through an explicit pass, fail, or defer truth table and never interpret a healthy pre-existing regression suite as contradictory evidence.
Reject candidates that introduce duplicate literal logging keys even when Python silently preserves runtime behavior.
Repair only the exact repeated insert-before anchor shape demonstrated by frozen candidate evidence.
Do not lower thresholds, bypass canaries, mock activation, or count provisional activations as completed promotions.
Stop after Phase 1 rather than silently reducing the Phase 2 target or claiming autonomous discovery and recursive improvement without evidence.

Validation and evidence

Check	Status	Result
Corroboration truth table	passed	Five explicit evidence/regression combinations plus the causal-protocol test passed with normalized pass, fail, and defer reason codes.
Continuous engine regression suite	passed	64 tests passed after the bounded corroboration and retry-semantics repair.
Builder edit-shape repair	passed	Eleven focused builder and response-envelope tests passed, including the exact copied-anchor case and unique literal log-key invariant.
Negative candidate control	passed	Two independent candidate attempts that duplicated the preserved dictionary key were rejected at canary checkpoint zero with the exact duplicate-key assertion.
Final candidate targeted and independent tests	passed	The generated baseline-contrast test passed on the candidate, and all three pre-promotion response-envelope canary checkpoints passed.
Production full-suite governor	passed	790 tests passed in 472.45 seconds; return code was zero.
Activation and probation	passed	The real broker activated the candidate, reconciliation verified the loaded revision, all four probation checkpoints passed, queue state became implemented, and transaction state became finalized.
Live runtime identity	passed	Hiro is healthy with model connected and matching loaded and checkout revision bb14826264f84a0bbb516b8d463695a58d9dfefa.
Public journal tests and build	passed	npm run test:hiro passed. npm run build generated and validated all 167 journal pages, compiled TypeScript, and completed the Vite production bundle.

Current state

One clean real non-meta candidate has completed the normal autonomous-controller path into the production actuator.
The active Hiro runtime and checkout both match the finalized candidate revision.
External-evidence decisions now distinguish support, contradiction, absence, service unavailability, and candidate-introduced regression.
The builder normalizes the exact copied insert-before anchor defect demonstrated by frozen evidence.
Phase 2 repeatability, Phase 3 autonomous discovery, and Phase 4 meta-improvement remain unproven.

Next steps

Extend the controller qualification to a set of ten distinct, objectively beneficial, low-risk non-meta candidate contracts and run them serially from clean state without manual promotion decisions.
Report the exact Phase 2 funnel counts and every terminal rejection reason; a failure resets the relevant repeatability sequence and stops at its first divergent boundary.
Only after ten clean real promotions, enable bounded autonomous discovery for similarly low-risk non-meta improvements and qualify that layer separately.
Do not permit or claim meta-improvement until autonomous discovery repeatedly produces promotable changes with bounded terminal outcomes.