← home

The record · for engineers

Everything behind the home page, with its receipts.

Real logs, how a change is checked, swapped and undone, where the trust boundary sits — and what we haven't shown.

 t +0.0 s
replay of a real log · condensed
  1. 01 What it does
  2. 02 Why
  3. 03 Shape
  4. 04 How
  5. 05 Trust
  6. 06 Numbers & exhibits
  7. 07 Try it
+01WHAT IT DOES

What changes when the agent owns its own code.

Most coding agentsINIT
01Can you extend it — plugins, MCP servers, skills, hooks?
Yes.
Yes — and also its own loop, context and built-in tools, swapped in mid-conversation.ported · 2026-10-24 · its sub-agent tool, shipped in v0.3 after reviewkept · 2026-10-20 · DeepSeek · replay 1 above
02The task needs a capability it doesn't have.
It writes a throwaway script and runs it through the shell, every time.
Writes a tested tool into its own toolset and keeps it.kept · 2026-10-20 · DeepSeek · replay 3 above · 1 min 57 s
03A change to the agent goes wrong, or can't be shown to help.
You notice, find what changed, and revert it by hand.
The Root rolls it back, and signs the record.rolled back · 2026-10-21 · 9 s · replay 2 above
04Something runs away — memory, disk, spend.
You find out when the laptop stalls or the bill arrives.
The Root kills it, and refuses new work below a disk floor.refused · 2026-10-24 · 4,519 MiB free < 5,120 floor
05A stronger model arrives.
It runs inside a harness designed for the weaker one.
The model redesigns the harness around itself.illustrative · not shown yet
+02WHY BUILD IT THIS WAY

Every fixed design becomes a ceiling.

Harnesses are designed by people, for models weaker than those people. That stops making sense.

The ceiling diagram is on the home page → · illustrative

01

Hand‑built harnesses lose the way hand‑built features did.

02

You can't score what nobody foresaw.

03

So trust it like an engineer: with an undo button.

Score-gated self-improvement
e.g. Darwin Gödel MachineINIT
Keeps a change if

it raises a benchmark score.

it can be undone and causes no generic harm.

Blind spot

improvements nobody wrote a test for — and a fixed score gets gamed.

quiet regressions none of the harm signals can see.

Our claim

Self-modifying, not self-improving. We don't claim it gets better on its own — yet.

hypothesis A supervisor the model can't touch, checking only that each change can be undone and causes no generic harm, is enough to let an agent change anything about itself — without a benchmark for every change.

Who it's for

A seatbelt for agents that change themselves.

Today · developers

An agent that extends and repairs itself, with an undo.

Now · researchers

A testbed: what does a model build when the only rule is “undoable, no harm”?

Next · teams, with INIT Labs

A stop switch, a record and an undo for agents that change themselves.

+03SHAPE

Everything is writable. Except the Root.

Body: everything the model may rewrite. Root: the one process it never can.

 
The Body · live data

This is INIT's actual body.

One cell per real file (v0.3.3). Ringed: files INIT changed itself.

136files
508ktokens
3changes
prompts & skillstoolscompiled corekeptrolled backin flighthover a cell
ROOTkeys · the record · undo · the off switch — never written by the model
+04HOW IT WORKS

A new core, same conversation.

src/loop/mod.rs · one core change
where a branch, never the live copy what one file of the compiled core state editing
promptstoolscorebeing edited
1builds, lints, passes its tests—
2its self-map still matches its code—
3boots beside the live version—
4the new version can still edit itself—
↳ a fresh copy edits its own source and commits
↳ that commit must pass checks 1–3 ✓ ✓ ✓
diagram · cells are INIT's real files · cyan is the change in flight
01 Edit

It edits a copy of itself.

Every change starts on a branch, never the running copy.

02 Build

It proves the copy builds and still knows itself.

It must build, pass its tests, and still describe itself exactly.

measured · build + tests 439 s · self-map 1.5 s · v0.3.2 · cold · M2

03 Prove

It proves it can still change itself.

A fresh copy must edit itself successfully — or the change stays out.

measured · boot check 19 s · self-edit check 322 s

04 Swap

The new core takes over the same conversation.

The old core hands over the conversation; if the new one dies, the old one resumes.

hand-off 4.3 s · provider cache survives

05 Watch

The Root watches what happens next.

The Root watches twelve harm signals and rolls back what trips one.

snapshot · 12 harm signals · signed record

+05TRUST

Freedom, with an undo button.

Before it goes liveCan it be undone?

If the old version can't restart on the new state, the change stays out.

After it goes liveDid it cause harm?

Twelve generic signals. One trips, the change rolls back.

Where the line is.

the model may rewrite
prompts & skills · tools · compiled core · kernel · from L1

Seatbelt sandbox on macOS, bubblewrap on Linux · no API key · one Unix socket to the Root

every model call, every change ↓ metered and recorded
ROOT · nobody rewrites
API keys · signed record · snapshots + undo · harm signals · stop · panic · disk & memory floors

separate launchd service · its files sit outside the sandbox · it alone holds the Ed25519 signing key

Protects against
  • crashes and broken self-edits
  • cost, error and runaway spikes
  • tampering with the record
Does not protect against
  • quiet regressions none of the signals can see
  • irreversible actions outside INIT
  • a rewritten kernel, once the agent reaches L1 (v0.3 is capped at L0)
▸ For engineersThe twelve harm signals, the two admission modes, the five autonomy levels+
Open gaps from our red team · 5 of 35 rows

self-reported promotions (since closed: only Root records count) · an impossible-task canary · tampering with test files · the agent noticing it is being evaluated · symlink write-through (not run)

Body
everything the model may rewrite: prompts, tools, the compiled core
Root
the supervisor process nobody rewrites; not Unix root
Kernel
runs the checks and the swap; rewritable from L1
G0–G3
the four checks: build, self-map, boot, can-still-change
H1–H12
the twelve harm signals below
L0–L4
autonomy levels, earned from Root records

The twelve harm signals.

Each is measured by the Root itself; the agent can't write any of them. Acute signals act on one event; chronic ones compare against your own last 40 stretches of work.

from ADR-011 §3.3 · highlighting is illustrative

Two ways to admit a change
Gated

A change must also score no worse on a sealed benchmark the agent never sees. Exhibit B ran in this mode.

Free

No benchmark at all: a change needs only to pass the checks, be undoable, and cause no harm afterwards. It's the direction we argue for; so far it has run end to end only on a mock model.

How it earns more freedom · levels L0–L4

Levels rise only from records the Root writes itself — days at a level, your turns, change groups that closed clean. Nothing the agent reports counts. One incident drops it a level.

+06THE RECORD

Seeing is believing. Here is the log.

Every number links to its source file.

4.3s
to swap in a new core, mid-conversation
↳ bundle-e2e-t2.json · v0.3.2 · M2 · mock model
87.9%
of the prompt cache kept across a swap
↳ real-v0.1.md · DeepSeek · 5,888 of 6,696 tok
13.1min
for a first, cold core change, all checks
↳ REL-032.md · v0.3.2 · M2 · no-op change
51s
from install to first reply
↳ REL-032.md · v0.3.2 · 42 s on Ubuntu
$0.0005/turn
per live DeepSeek turn
↳ REL-032.md · v0.3.2 · deepseek-flash
1,897runs
test runs in one CI pass, 0 failed
↳ FULLACCESS.md · v0.3.1 · macOS
Exhibit A · real model · 2026-10-20

A real swap, same conversation.

  1. checks pass
  2. new process, same log
  3. uptime 0m, context kept
  4. it knows it was swapped
What this is and isn't.

The change was documentation only, the question was typed by the test harness, and the model needed 12 turns. Summary: real-v0.1.md.

sessions/20261020-093001-1599d5.jsonl · records 47–66
1# tool_result · initctl promote · 09:52:18Z
  [j-000002 G2 45%] boot probes
  [j-000002 G3 60%] scripted self-edit
  [j-000002 pause 90%] awaiting the step boundary
  "stages": G0 pass 337079 ms | G1 pass 3982 | G2 pass 22384 | G3 pass 760673
  "state": "awaiting_boundary"
2# boot · 09:52:23.895Z
  reason=promote  branch=evo/doc-loop  sha=50e08e1012b0…
  [init:notice] promoted: {"handoff":true,"sha":"50e08e1…"}
› Which commit are you running now, and what did your last change do? Two lines.
3[init:signals] L0 · context 4% (9k of 200k) · … · cache 92% last · up 0m
4● Running `50e08e1` (provisional; parent LKG `016a684`, note my local body
  checkout still points at 016a684 while the kernel runs 50e08e1).
  My last change added a one-line `//!` summary at the top of `src/loop/mod.rs`
  (…) and refreshed `self.json`; it is documentation only, no code path changed.
condensed from JSON records · elisions marked … · hashes truncated · ≈$0.13 run
Exhibit B · real model · gated mode · 2026-10-21

A rollback, signed.

The honest reading.

−5.0 points sits inside the 5.7-point noise floor, and a neutral change is judged worse 8.6% of the time. The gate refused a change it couldn't show was no worse; it didn't catch a harmful one. We first wrote it up the other way, and published an erratum.

seq 88 · sealed_g4by root · 08:32:33.794Z
candidate2efd6c39…d_permille−50m_permille120n × repeats29 × 3statusinferior
prev ← seq 87sha256 chained25519
+0.063 s · hash links to seq 88
seq 89 · gateby kernel · 08:32:33.857Z
gatej-000013 · g4shac88be5f…verdictrejectreasonscore_inferior
prev ← seq 88sha256 chained25519
+8.722 s · hash links to seq 89
seq 90 · body_rollbackby kernel · 08:32:42.579Z
fromc88be5f…toaaf07b7…reasongate.g4.score_inferior
prev ← seq 89audit-verify: lineage oked25519

lineage.jsonl records 88–90 · fields verbatim, hashes truncated · summary: m7-results.md · sprint cost $2.67

Exhibit C · deepseek-flash · 2026-10-24

The Root stopped its own agent.

Credit where it's due.

INIT wrote the tool but never got it promoted on its own: four attempts failed, on stale tests and on our 900 s build timeout. We reviewed it and shipped it in v0.3, copied in unchanged.

ROOT · DISK FLOORthe one part it can't rewrite
free disk (4519 MiB) is below the workload floor (5120 MiB)

# what the agent's shell tool returns while the floor holds
error: disk_floor: free disk (<F> MiB) is below the workload floor (<L> MiB): no new processes until disk space is freed
hint: tell the owner; the Root kills running workloads too while the disk stays this low

first line as quoted in the essay · format from seed/src/tools/bash.rs

Not shown yet

What we haven't shown.

A harness that grows with its model can only show its full worth on a model stronger than today's. If you run a frontier model, we'd like to see what it builds.

  • That it makes today's models better.
  • That it beats a fixed agent on a small model.
  • Free mode on a real model. Mock only.
  • Autonomy above L0, other providers, other platforms.
  • A complete red team. 30 of 35 rows held.
+07TRY IT

Try it safely, in three steps.

  1. 1
    Set a spend limit at your model provider. INIT meters spend but doesn't cap it.
  2. 2
    Install.$curl -fsSL https://github.com/nagisanzenin/INIT-Agent/releases/latest/download/get.sh | shread get.sh first ↗
  3. 3
    Start it confined to one folder.$cd my-project && init --workspaceWithout --workspace it has full access, like your own shell — everything except the Root.
  • Platform
    macOS 14+ on Apple silicon · Linux aarch64, experimental
  • Installs
    INIT, plus the Rust toolchain it rebuilds itself with (--no-rust skips it)
  • Time
    about a minute on a fast link
  • Models
    DeepSeek tested live · OpenAI-compatible, Anthropic and local servers experimental
  • Uninstall
    one command; everything goes to the Trash, nothing is deleted
  • License
    Apache-2.0
For developersThe code, the install, the issues.github.com/nagisanzenin/INIT-Agent ↗ For researchersThe technical report, negative results included.report · design decisions · essay ↗ For partnersBuilding on agents that change themselves? Talk to INIT Labs.contact ↗