{ "schemaVersion": 2, "date": "2026.08.26", "publishedAt": "2026-08-26T22:11:48-07:00", "timeZone": "America/Los_Angeles", "title": "Autonomous controller feeds one clean real improvement into promotion", "publicationStatus": "Phase 1 passed; repeatability, autonomous discovery, and meta-improvement remain unproven", "executiveSummary": [ "Qualified the first upstream controller layer against the already-proven production promotion actuator, using one deliberately trivial real Hiro observability change rather than a synthetic promotion object.", "The final candidate added one redacted raw-model-output length field to response-envelope logs and one targeted baseline-contrast test. It traversed normal investigation, model-driven construction, evaluation, independent canary, full-suite governor, real activation, runtime verification, four probation checkpoints, and finalization.", "The final governor run passed 790 tests. The live service reports the promoted revision as both loaded and checked out, and the canonical queue finished implemented while the promotion transaction finished finalized.", "First-divergence discipline exposed and repaired narrow upstream problems: ambiguous evidence classification, qualification-environment configuration, external-runner activation reconciliation, and a repeatable insert-before edit-shape defect that duplicated a preserved anchor.", "Two deliberately bad candidate attempts were correctly rejected at the first independent canary after a new duplicate-key invariant was added. No threshold was lowered and no promotion gate was bypassed.", "Phase 2 was not started. The measured full governor suite takes about eight minutes and a complete real promotion takes roughly fifteen to seventeen minutes, so ten distinct clean promotions require at least two and a half hours. Phases 3 and 4 therefore remain gated and unproven." ], "workstreams": [ { "title": "Explicit evidence and regression semantics", "status": "Completed", "details": [ "Wrote the expected corroboration truth table before changing implementation: supporting evidence with healthy regressions passes; contradictory evidence fails; absent evidence defers; supporting evidence plus a new regression fails; unavailable evidence defers.", "The prior implementation described a healthy existing regression suite as an uncorroborated negative result. The minimum repair introduced explicit pass, fail, and defer decisions with stable reason codes.", "Deferred corroboration now uses bounded retries and an eventual terminal reason instead of silently becoming a rejection or circulating indefinitely.", "The focused continuous-engine suite passed all 64 tests after this repair; the five truth-table cases and the causal-protocol case passed directly." ] }, { "title": "Deterministic controller qualification command", "status": "Completed", "details": [ "Added a process-level Phase 1 qualification command that starts from a clean Git revision and fresh canonical queue database, persists one real low-risk local regression observation, and invokes the normal controller and model-driven autonomous sandbox.", "The command does not manufacture a candidate revision. The normal candidate builder creates the production patch and targeted test, the normal evaluator judges it, and the existing governor and activation broker perform promotion and restart.", "Logical canary and probation checkpoint time is advanced deterministically, while each checkpoint still runs the real independent tests and verifies the actual running process and revision.", "The trace captures queue state, action, transaction state, and active revision at every boundary and writes a machine-readable result under the private runtime evidence area." ] }, { "title": "Deliberately trivial real improvement", "status": "Passed", "details": [ "The final candidate adds raw_model_output_length to the redacted ResponseEnvelope log dictionary. This helps distinguish model output from validator replacement text without recording private raw text.", "The production diff is one line. The generated test verifies the length, preserves the existing final-answer length, and verifies that neither the raw field nor its text appears in the log receipt.", "The candidate changed only the approved response-envelope production file and its generated autonomous test. It did not alter scoring, thresholds, promotion policy, external research, or RSI governance.", "The final candidate revision is bb14826264f84a0bbb516b8d463695a58d9dfefa." ] }, { "title": "First-divergence repairs", "status": "Completed", "details": [ "Initial qualification inputs used a noncanonical origin and score shape. Those attempts failed before a candidate existed; only the harness inputs were corrected.", "The first real construction attempt deferred because the external held-out evaluation vault was not resolved from the worktree. The existing supported environment path was supplied; no evaluation requirement was removed.", "Early successful activations remained in queue state activation because the external qualification orchestrator observed the new runtime before the durable broker receipt was committed, then because runtime identity is cached at process import. The runner was repaired to wait for both health identity and the canonical transaction receipt and to reconcile under only that independently verified revision.", "Several provisional candidate activations were additively reverted to re-establish a clean baseline after qualification-runner failures. They were not counted as completed Phase 1 promotions.", "Source inspection found that the candidate repeatedly duplicated the existing final_answer_length dictionary key. A narrow independent AST canary was added; two subsequent candidates were correctly rejected at checkpoint zero.", "The frozen candidate receipt showed the exact cause: an insert-before patch copied the preserved anchor into new content. The builder now mechanically removes only an exact copied trailing anchor for that edit operation. Eleven focused builder and response-envelope tests passed after the repair." ] }, { "title": "Final clean end-to-end proof", "status": "Passed", "details": [ "The final trace traversed queued, investigating, candidate, canary, activation, probation, and implemented without requeue or retry.", "Independent canary checkpoints at logical minutes zero, five, and fifteen passed before promotion was requested.", "The production governor ran the complete repository suite: 790 tests passed in 472.45 seconds. Five existing unknown-marker warnings did not affect the result.", "The real activation broker restarted Hiro. Reconciliation verified the candidate revision running before entering probation.", "Runtime probation checkpoints at logical minutes zero, sixty, two hundred forty, and four hundred eighty passed. The canonical queue finished implemented and the transaction finished finalized.", "The live service reports loaded revision and checkout revision bb14826264f84a0bbb516b8d463695a58d9dfefa with revision_matches true." ] }, { "title": "Phase gates", "status": "Stopped after Phase 1", "details": [ "Phase 1 is the highest empirically demonstrated layer: a deliberately selected real non-meta improvement can traverse the normal controller into the proven actuator and become the verified running revision.", "Phase 2 requires ten successful real promotions without manual promotion decisions. It was not started because measured wall time implies at least two and a half hours plus the work of defining ten distinct real changes.", "Phase 3 autonomous discovery was not enabled because Phase 2 has not met its repeatability target.", "Phase 4 meta-improvement was not attempted because Phases 2 and 3 remain unproven. Hiro is not characterized as recursively self-improving by this result." ] } ], "decisions": [ "Treat the deterministic promotion actuator as proven and diagnose upstream boundaries first.", "Use canonical queue and promotion-transaction state as authority; runtime health is additional identity evidence, not a replacement for persisted state.", "Classify corroboration through an explicit pass, fail, or defer truth table and never interpret a healthy pre-existing regression suite as contradictory evidence.", "Reject candidates that introduce duplicate literal logging keys even when Python silently preserves runtime behavior.", "Repair only the exact repeated insert-before anchor shape demonstrated by frozen candidate evidence.", "Do not lower thresholds, bypass canaries, mock activation, or count provisional activations as completed promotions.", "Stop after Phase 1 rather than silently reducing the Phase 2 target or claiming autonomous discovery and recursive improvement without evidence." ], "validation": [ { "check": "Corroboration truth table", "status": "passed", "result": "Five explicit evidence/regression combinations plus the causal-protocol test passed with normalized pass, fail, and defer reason codes." }, { "check": "Continuous engine regression suite", "status": "passed", "result": "64 tests passed after the bounded corroboration and retry-semantics repair." }, { "check": "Builder edit-shape repair", "status": "passed", "result": "Eleven focused builder and response-envelope tests passed, including the exact copied-anchor case and unique literal log-key invariant." }, { "check": "Negative candidate control", "status": "passed", "result": "Two independent candidate attempts that duplicated the preserved dictionary key were rejected at canary checkpoint zero with the exact duplicate-key assertion." }, { "check": "Final candidate targeted and independent tests", "status": "passed", "result": "The generated baseline-contrast test passed on the candidate, and all three pre-promotion response-envelope canary checkpoints passed." }, { "check": "Production full-suite governor", "status": "passed", "result": "790 tests passed in 472.45 seconds; return code was zero." }, { "check": "Activation and probation", "status": "passed", "result": "The real broker activated the candidate, reconciliation verified the loaded revision, all four probation checkpoints passed, queue state became implemented, and transaction state became finalized." }, { "check": "Live runtime identity", "status": "passed", "result": "Hiro is healthy with model connected and matching loaded and checkout revision bb14826264f84a0bbb516b8d463695a58d9dfefa." }, { "check": "Public journal tests and build", "status": "passed", "result": "npm run test:hiro passed. npm run build generated and validated all 167 journal pages, compiled TypeScript, and completed the Vite production bundle." } ], "currentState": [ "One clean real non-meta candidate has completed the normal autonomous-controller path into the production actuator.", "The active Hiro runtime and checkout both match the finalized candidate revision.", "External-evidence decisions now distinguish support, contradiction, absence, service unavailability, and candidate-introduced regression.", "The builder normalizes the exact copied insert-before anchor defect demonstrated by frozen evidence.", "Phase 2 repeatability, Phase 3 autonomous discovery, and Phase 4 meta-improvement remain unproven." ], "limitations": [ "This session proves one selected low-risk candidate, not ten-promotion repeatability.", "The candidate idea was deliberately selected for deterministic qualification; Hiro did not discover it autonomously.", "Canary and probation use logical time advancement with real tests and real process identity rather than waiting eight wall-clock hours.", "The qualification command uses an isolated queue, so its external orchestrator must carry forward the revision already verified by both live health and the durable broker receipt when reconciling after restart.", "Several provisional candidates activated during qualification-runner debugging and were additively reverted; only the final clean implemented transaction counts as the Phase 1 success.", "No meta-change candidate was autonomously proposed, judged, or promoted. This result does not establish recursive self-improvement." ], "nextSteps": [ "Extend the controller qualification to a set of ten distinct, objectively beneficial, low-risk non-meta candidate contracts and run them serially from clean state without manual promotion decisions.", "Report the exact Phase 2 funnel counts and every terminal rejection reason; a failure resets the relevant repeatability sequence and stops at its first divergent boundary.", "Only after ten clean real promotions, enable bounded autonomous discovery for similarly low-risk non-meta improvements and qualify that layer separately.", "Do not permit or claim meta-improvement until autonomous discovery repeatedly produces promotable changes with bounded terminal outcomes." ], "disclosureNote": "This public entry contains no credentials, certificate contents, private message content, private network addresses, local filesystem locations, or actionable unresolved security details." }