Hiro development journal

Phase 3E demonstrates controller-to-production integration

2026.08.28 at 08:17:17 America/Los_Angeles One frozen, independently qualified non-meta improvement traversed Hiro's normal controller, production activation, verification, and eight-hour probation without a manual promotion decision Machine-readable JSON

Executive summary

Phase 3E consumed only the two frozen Phase 3D promotion-eligible candidate lineages. Discovery, external intake, interaction-audit candidate generation, and meta-improvement remained disabled for the qualification.

The first authorized lineage, causal failure attribution, was replayed against the current production trust base. Its deterministic target score improved from 1/6 to 5/6, its evaluator-owned holdout passed 4/5, its resource receipt passed, and its complete repository suite passed.

Hiro's normal continuous controller—not the requalification command and not a manual promotion operation—admitted and selected the exact current-base artifact, ran the real 0-, 5-, and 15-minute canary, invoked the existing governor, prepared the durable promotion transaction, and requested activation.

Production fast-forwarded from the qualified base to candidate revision 8c18072fe28fc3fc9dad15d119407310d5292459. The activation broker restarted Hiro, and both checkout and loaded-runtime identity were verified against the candidate revision.

The post-activation five-scenario pipeline qualification passed before runtime probation began. The real production probation then passed checkpoints 0, 60, 240, and 480 minutes.

Every probation checkpoint passed the independent candidate holdout, five-case assistant interaction lab, live candidate-specific target/holdout/resource verification, runtime identity check, health check, and bounded production error/latency thresholds.

At the final checkpoint the queue moved to implemented and the promotion transaction moved to finalized. No rollback occurred for the successful candidate, and the active Hiro runtime remained on the promoted revision.

The final disposition is PHASE 3E DEMONSTRATED — CONTROLLER-TO-PRODUCTION INTEGRATION WORKS. This demonstrates one ordinary non-meta controller-to-production improvement cycle; it does not demonstrate recursive or meta self-improvement.

Work completed

Frozen authorization and current-base replay

Completed

Bound Phase 3E to the immutable Phase 3D report and exactly two authorized candidate lineages, in deterministic causal-attribution-then-memory-selection order.
Requalification replayed exact hash-verified candidate snapshots against the live production base. It could evaluate and report but contained no promotion call, transaction creation, or activation authority.
The successful final replay produced candidate p3e-causal-failure-attribution-3a99a6c866f8 at revision 8c18072fe28fc3fc9dad15d119407310d5292459 from base a261e917ea6fef8307a2c32874fedcc67a46f0b8.
The final immutable requalification report passed freshness, target, holdout, resource, complete regression, and governor-dry gates. Its SHA-256 is db5f001ed946b3b616fd101f9c83b4807398bf6ee85b0c215ec6cf4e599a21a4.

Normal controller admission and canary

Completed

The live continuous controller discovered the verified report, persisted the exact candidate identity, selected it into the normal canary, and recorded controller ownership in the canonical queue.
Independent canary checkpoints 0, 5, and 15 minutes each passed the evaluator-owned causal-attribution holdout test.
The final canary checkpoint prepared transaction promotion-p3e-causal-failure-attribution-3a99a6c866f8-8c18072fe28f and synchronously invoked the existing stable governor.
The governor's complete candidate-worktree regression passed 846 tests with one expected skip in 504.72 seconds before production mutation was allowed.

Production activation and revision verification

Completed

The governor fast-forwarded the live branch without a merge commit or rebase, preserving the exact candidate revision as production HEAD.
The checked hidden activation broker stopped and restarted Hiro, then persisted runtime verification only after the health endpoint reported both checkout and loaded revision as 8c18072fe28fc3fc9dad15d119407310d5292459.
A fresh five-scenario production pipeline qualification passed on the activated revision: candidate evaluation, promotion and rollback, autonomous recovery, runtime isolation and state, and assistant product path.
Canonical queue and promotion-transaction state agreed when the candidate entered runtime probation.

Eight-hour production probation

Completed

The real production schedule used checkpoints 0, 60, 240, and 480 minutes; time was not compressed and no checkpoint was manually inserted.
All four checkpoints verified the active revision, healthy service, independent holdout, five passing assistant interaction cases, target gain of 0.6667, holdout score of 0.80, and a passing resource receipt.
At each checkpoint the recent bounded production metrics were a 1% error rate across 100 observations and 9.266-second p95 latency, below the configured 10% and 30-second limits.
The final checkpoint at 2026-08-28 18:33:46 Pacific changed the queue to implemented and transaction to finalized. The loaded runtime remained revision-matched and no rollback revision was created.

First-divergence repairs

Completed

An initial attempt reached the governor full-suite boundary but the generic Linux isolation runner timed out. The minimum repair routed only frozen qualified candidates through the existing scrubbed Windows complete-suite runner needed by the repository's Windows launcher contracts; generic autonomous candidates retained their normal isolation policy.
A later activated attempt exposed a canonical-state mismatch: stale-candidate cleanup superseded a candidate whose transaction had already entered probation. The candidate was failed with an explicit state-persistence reason, rolled back through the real rollback path, and the stale predicate was constrained so activation, probation, and rollback states cannot be superseded.
The failed attempt also exposed that generic builder-version recovery could recycle a frozen qualified artifact. Qualified artifacts were excluded from generic artifact requeue so their only retry path is fresh, hash-verified Phase 3E requalification.
A legacy requeue had erased one frozen artifact's version payload and left it blocking intake. Pre-activation qualified records without a versioned artifact are now explicitly superseded for fresh requalification.
After each repair, Hiro restarted on a new committed base, passed the normal five-scenario readiness qualification, and replayed the candidate from the beginning. No stale requalification report was reused across a changed base.

Decisions and reasoning

Use the Phase 2-qualified promotion actuator unchanged unless an observed transition directly proves a defect at its boundary.
Permit only the two exact Phase 3D-qualified non-meta lineages and disable replacement discovery during Phase 3E.
Require current-base replay and immutable report verification before controller admission.
Keep promotion selection under the normal continuous controller with no per-candidate manual promotion decision.
Treat infrastructure, state-integrity, and incomplete-artifact outcomes as retryable lineage failures rather than decisions against candidate merit.
Restart from a clean current base after every repair and never reuse a candidate report made stale by that repair.
Use the full configured eight-hour production probation for this qualification even though the final four hours added limited new semantic coverage.
Stop after demonstrating ordinary non-meta controller-to-production integration; do not infer recursive self-improvement.

Validation and evidence

Check	Status	Result
Focused Phase 3E/controller regression suite	passed	The final focused integration run passed 83 tests with two expected skips and one non-failing pytest-cache warning.
Final candidate requalification	passed	846 repository tests passed with one expected skip in 477.53 seconds; target score improved from 0.1667 to 0.8333, holdout scored 0.80, resource receipt passed, and governor dry validation returned PASS.
Normal controller and governor path	passed	Controller admission, canary checkpoints 0/5/15, durable transaction preparation, and the governor's complete suite all passed. The governor suite passed 846 tests with one expected skip in 504.72 seconds.
Activation and post-activation qualification	passed	Production HEAD, checkout revision, and loaded runtime all matched 8c18072fe28fc3fc9dad15d119407310d5292459. All five post-activation pipeline scenarios passed.
Production runtime probation	passed	Checkpoints 0, 60, 240, and 480 all passed live health, runtime identity, independent tests, five-case interaction lab, candidate-specific verification, and production metrics. Queue finalized as implemented and transaction finalized with no rollback.
Public journal tests and production build	passed	npm run test:hiro passed. npm run build generated and validated 175 journal pages, compiled TypeScript, and completed the Vite production bundle. The clean checkout first required npm ci; installation reported one existing high-severity dependency advisory, which was not automatically modified because dependency maintenance was outside this session.

Current state

Phase 3E candidate p3e-causal-failure-attribution-3a99a6c866f8 is implemented and its promotion transaction is finalized.
Production HEAD and the loaded Hiro runtime are revision 8c18072fe28fc3fc9dad15d119407310d5292459.
The promoted change adds bounded causal-precedence ordering to reflection synthesis so observed tool failures, hallucinations, stale data, and timeouts receive more accurate first-cause attribution.
The second authorized Phase 3D lineage, quality-aware memory selection, was not started during this completed first integration cycle.
Autonomous discovery and meta-improvement remain outside this qualification's demonstrated scope.

Next steps

Treat Phase 3E as demonstrated for one ordinary non-meta controller-to-production cycle, not as evidence of recursive self-improvement.
If continuing the frozen qualification, requalify the second authorized lineage against promoted revision 8c18072fe28fc3fc9dad15d119407310d5292459 and submit it through the same normal controller without changing candidate order or thresholds.
Before future campaigns, consider a prospective risk-tiered probation policy so deterministic low-risk changes can finalize at four hours while timing-sensitive changes retain eight-hour exposure.
Do not enable meta-change discovery until ordinary autonomous candidates repeatedly traverse this now-demonstrated controller-to-production boundary.