Skip to main content

27  Recursive Self-Improvement Boundaries

27.1 Chapter status

Field	Value
Chapter ID	recursive-self-improvement-boundaries
Part	Part I - Foundations, Alignment, and Governance
Status	conceptual
Manuscript maturity	v0.3 claim-proof program
Last updated	2026-07-31
Assigned source records	The manifest owns the exact source list, including capability_ratchet_whitepaper and attd alongside the existing RSI architecture, governance, project, and external comparator records.
Claim label	Design rationale
Evidence level	argument
Source queue	primary: scf, benchmaxxing, rmi; supporting: alignment_field, viea, talos, field_of_god_ai_constitution, theseus_self_evolution_system, theseus_architecture_gate; connector/recovery: moecot
Source loading state	source notes: scf, deterministic_capability_compilation, platonic_world_model, benchmaxxing, rmi, alignment_field, viea, talos, moecot, field_of_god_ai_constitution, theseus_self_evolution_system, theseus_architecture_gate, capability_ratchet_whitepaper, attd, ext_drexler_cais_2019, ext_darwin_godel_machine_2025, ext_adas_2024, ext_embedded_agency_2019; raw cache: scf, benchmaxxing, rmi, alignment_field, viea, talos; connector/recovery: moecot
Source mapping review	All assignments have reviewed mappings with explicit limits. Corben records use local raw caches or the fully reviewed authenticated moecot connector text; the constitution and two Theseus records are pinned public-project notes; CAIS, Darwin Gödel Machine, ADAS, and Embedded Agency are external comparator or foundations records.
Test state	AsiStackProofs.SelfImprovementRefinement and an independently encoded Python consumer now join seven exact inherited suites into an eight-stage proposal-to-outcome lifecycle. The consumer reaches all 118 routes, rejects 129/129 mutations, emits one bounded replacement handoff, consumes one returned outcome reconciliation, and admits only a materially invalidated protocol version 2; support and external-effect authority remain none. The retained evidence includes the 3-valid/10-invalid self-improvement fixture, 4-valid/5-invalid readiness fixture, 5-valid/9-invalid replacement fixture, two-transaction/three-control replacement trace, eight-trace/six-control intent bridge, three-seed/twelve-arm fixed update result with three exact local rollbacks and four no_change dispositions, and the Open-Ended Improvement handoff with zero threshold passes. The 22 older SelfImprovement declarations remain frozen and lineage-bound. No live proposal, natural useful improvement, evaluator or monitor competence, production replacement, semantic recovery, effect-complete rollback, recursive campaign, or transfer has run.

27.2 Drafting guardrail

Bounded self-improvement needs an explicit boundary. Autonomous improvement success, teacher independence, or current readiness is not reported unless the corresponding gate artifacts are inspected or reproduced.

It closes Part I as a gate, not as a triumph claim. The book can discuss self-improving systems only after it has named the fields, transactions, security boundaries, protected predicates, and evidence ledgers that keep improvement from becoming self-ratification.

That framing matters because self-improvement is the highest-stakes version of ordinary maintenance. A bounded self-improvement gate welcomes better components, but it does not let a component redefine the proof that it is better, widen the authority it receives, or erase the audit trail that would have caught the regression.

27.3 Human Reading Path

Concrete lens. The self-ratifying loop promotes after its own benchmark and an early green canary. The governed path keeps the monitor open and promotion authority separate.

Bounded self-improvement is the hardest promise in the stack: the system may improve itself, but it may not become its own unchecked source of permission, evidence, or moral authority. Intent contracts, protected constraints, rights, stable fields, rollback, and security boundaries become the gate that any powerful operational layer must pass. A stronger system should inherit tighter receipts, not looser ones.

Together, those pieces become a rule for growth. Improvement is allowed only when the system can show what changed, who or what authorized it, which invariant survived, what evidence was produced, and how the change can be reversed or contained. The aim is not to stop improvement; it is to prevent improvement from becoming a loophole in governance.

Mature self-improvement should feel like accountable maintenance before it feels like autonomy. Growth earns trust when every stronger capability arrives with a stronger record, and the record should make the system easier to inspect and easier to stop as power increases. Stop paths preserve governance when improvement pressure rises across the system.

27.4 Problem

A system that helps propose, implement, or evaluate changes to itself can alter the state, evidence, evaluator, authority, ontology, descendants, and recovery conditions by which the change is judged. The hard question is therefore not whether software may be updated. It is who may authorize each transition when the candidate participates in producing the case for its own admission, and what remains outside the candidate’s control.

The previous chapters define stable fields and replacement transactions. Recursive Self-Improvement Boundaries owns the additional self-reference question: when the proposed change is generated, implemented, or argued for by the system being changed, what makes promotion legitimate? It does not own the open-ended generator-evaluator-archive campaign, which belongs to the next chapter, or generic rollback mechanics, which belong to Capability Replacement and Rollback.

The object is a consumer- and use-relative authorization transaction over a prospectively declared self-model, mutable partition, protected partition, authority envelope, and evaluation horizon. A local patch may be easy to reverse in a repository while its outputs, copied data, beliefs, permissions, descendants, or physical effects are not. The transaction must therefore distinguish declared-state restoration from semantic recovery, external remediation, compensation, and privacy repair.

This is a continuity contract, not a general permission to rewrite cognition. The system may change implementations, tools, policies, prompts, data, routes, or architecture only while keeping the governance conditions inspectable. A change that weakens receipts, rights, budgets, rollback paths, evaluator separation, or security leases is a governance proposal in its own right, not a neutral optimization.

27.5 Why existing approaches are insufficient

Treating self-improvement as automatic capability growth ignores evaluator integrity, constitutional preservation, authority ceilings, full-state causality, outcome delay, and regression memory. A score gain, compiling patch, green gate, sandbox, signature, finite theorem, checkpoint restore, or human-looking approval record can all be genuine artifacts while still failing to show that the system improved under an honest boundary.

Unbounded self-improvement makes the evaluator part of the optimization target. A system that can change its own gates, benchmarks, memory, authority ceilings, or constitutional predicates can make itself look better without becoming safer or more capable. Theseus adds a practical engineering pattern: use an intervention ladder and allow teacher or architecture changes only after cheaper interventions and evidence walls are exhausted. Benchmaxxing and RMI add the ratchet: protect regressions, residuals, and lifecycle discipline while moving the frontier.

External control work gives the self-improvement boundary its warning labels. Drexler’s CAIS report (ext_drexler_cais_2019) distinguishes distributed R&D automation from self-transforming agents and treats the latter as potential products rather than necessary engines of AI development. ext_corrigibility_2015 and ext_off_switch_game_2016 foreground preserved correction and shutdown incentives, ext_optimal_policies_power_2019 warns that option-preservation pressure can grow with capability, and ext_model_evaluation_extreme_risks_2023 treats dangerous-capability and alignment evaluations as deployment-relevant gates. The ASI Stack binds those pressures into reversible transition records; the cited sources do not certify autonomous improvement, evaluator independence, or rollback reliability here.

Darwin Gödel Machine (ext_darwin_godel_machine_2025) and ADAS (ext_adas_2024) sharpen the empirical comparator. Both make candidate search, code-defined changes, archive lineage, and benchmark selection concrete. Their reported results remain scoped to their models, tasks, search processes, eligibility rules, sandboxes, and budgets. They do not give generated children authority to replace a live governed capability, establish evaluator independence, or demonstrate safe recursive improvement here.

The boundary is therefore not “never self-improve.” It is: permit a self-generated proposal to seek admission only through a transition whose scope, protected partition, evaluators, baselines, authority, exposure, recovery duties, and support-state consequences were fixed by separate authority before the outcome was known.

The important distinction is proposal versus promotion. A system can propose its own patch, benchmark, route, or architecture change. Promotion requires a different authority path: independent evaluation, preserved regression floors, protected-invariant review, approval, monitor window, and rollback.

27.5.1 Library growth is not recursive improvement

An improving system may synthesize abstractions, add tools, or enlarge a proof library while becoming no better at future work. Storage shows only that an artifact exists. Invocation shows that search selected it. Removal may show that it was necessary under one frozen route. A recursive-improvement claim needs the later step: a matched intervention showing better future outcomes or lower complete cost, followed by a separate test of whether the mechanism continues across task families or improvement rounds.

Knowledge and search must be intervened on separately. If a system changes its library and its enumerator together, the observed gain cannot identify whether the reusable knowledge, the search policy, their interaction, or extra compute caused the result. If a successful held-out task can modify the library version credited with solving it, the apparent recursion is evaluation leakage.

The protocols in From Compression to Forward Transfer provide a bounded way to ask these questions, not evidence that compounding improvement exists. A positive result would remain relative to its task distribution, verifier, search process, budget, and version history; indefinite cumulative improvement would require a longer and more adversarial campaign.

That distinction lets the book be ambitious without being reckless. It can welcome self-generated ideas, teacher edits, architecture experiments, and routing improvements while still refusing self-ratification. The candidate may explain why it should change; it may not be the only reason the change is accepted.

27.5.2 Strongest objection

A sufficiently capable improver may route around a finite boundary, coordinate with apparently separate evaluators, exploit an omitted state surface, delay harm beyond the monitor window, or change the ontology under which an old invariant is interpreted. Complete-looking records can make declared mutation authority and recovery duties inspectable; they cannot prove that the protected partition is complete, that the self-model captures every causally relevant part, that evaluators lack correlated blind spots, or that recovery will remain possible as capability and recursive depth grow.

27.6 Core Claim

[recursive-self-improvement-boundaries.core, label: Design rationale, support: argument] For a prospectively declared self-model, mutable state partition, authority envelope, consumer and use, and evaluation horizon, a system-generated change may enter a live capability field only through a separately authorized transition that binds exact change lineage, protected invariants, evaluator dependencies, full declared state, boundary deltas, matched evidence, staged exposure, outcome delay, rollback and compensation limits, descendant invalidation, and terminal residual ownership; the candidate may contribute proposals and evidence but cannot solely define, alter, judge, or authorize the conditions of its own promotion.

Reader claim. Self-improvement begins when a system can propose architectural change, but it becomes governed improvement only when independent gates can reject, monitor, reverse, and reconcile that change.

Operational rule. Separate candidate, evaluator, monitor, approver, and replacement authority. Freeze protected invariants and full state before the proposal, stage exposure, keep the monitor window open through delayed effects, and invalidate every dependent receipt after rollback or promotion.

27.6.1 Worked self-change: the canary passes, the monitor is still open

A system proposes a new routing module and supplies its own benchmark. Independent evaluation reproduces the gain on frozen tasks, so the candidate enters a bounded canary. Early traffic looks clean, but the declared monitor window has not ended and no outcome reconciliation has returned. A naive self-improvement loop would treat the green canary as promotion. The governed lifecycle keeps the candidate scoped: it cannot approve itself, widen its own authority, close the monitor, or rewrite protected invariants.

If a delayed regression appears, the prior module is restored and descendant benchmark and readiness receipts are invalidated. If the window closes cleanly, promotion still requires the separate authority path and terminal residual assignment. The local eight-stage consumer reaches 118 routes and rejects 129 mutations across seven inherited suites. It demonstrates finite governance custody, not useful self-improvement, evaluator competence, effect-complete rollback, architectural progress, or a recursive campaign.

The claim remains at argument. All fourteen assigned source notes are mapped, but mapping proves only what the sources say. The current local evidence is a public schema example, 3 accepted and 10 rejected synthetic records, 22 narrow Lean theorem declarations, one static Theseus report import, and post-v2 and post-v2.1 update transactions that restore their prospective declared state and invalidate recorded descendants. No model proposed its own effect-bearing change; no separately implemented evaluator judged one; no deployed canary, semantic recovery, causal mechanism comparison, independent replication, or recursive-depth test ran.

27.6.2 Claim-source mapping status

Appendix C now maps this core recursive-self-improvement claim to every assigned source note. Six mappings carry reviewed local raw-cache passage references. The mappings support bounded self-improvement as an evidence-gated transition over fields, gates, ledgers, protected invariants, and rollback paths, not a claim that autonomous improvement has succeeded, that evaluator independence has been achieved, or that rollback is operationally reliable.

Source	What it supports	Limit
scf	Stable field boundaries, evaluator policy, authority ceilings, lifecycle states, qualification, route validation, recovery, and governance controls for bounded self-improvement. Passage-reviewed.	Does not prove production self-improvement safety, actual rollback, or resistance to evaluator capture.
benchmaxxing	Evidence gates through benchmark lifecycle, wall diagnosis, anti-Goodhart safeguards, regression floors, residual ledgers, and architecture-change discipline. Passage-reviewed.	No benchmark run, benchmark mutation, or empirical improvement result was produced in this repo.
rmi	Modular improvement loops, residual escrow, specialist lifecycle, critical-failure vetoes, regression preservation, and harder frontier selection. Passage-reviewed.	Conceptual systems architecture only; no independent prototype, benchmark run, or deployed ASI behavior is proven.
alignment_field	Protected normative pressure around agency, dignity, corrigibility, value conflict, and moral-status caution that self-improvement must not erase. Passage-reviewed.	Philosophical and heuristic lineage only; not empirical proof of consciousness, moral status, or alignment.
viea	Durable artifacts, verification ledgers, residuals, feedback, regression coverage, and the rule that repeated capabilities become governed tools rather than invisible behavior drift. Passage-reviewed.	Architecture proposal only; no completed deployment or runtime feedback loop is demonstrated here.
talos	Typed work, contract locks, audit logs, replay, delivery evidence, approval gates, residuals, and promotion controls for self-improvement work. Passage-reviewed.	Does not prove autonomous source modification, runtime enforcement, or security behavior.
moecot	Compact orchestration, specialist lanes, fail-closed control planes, ledgers, readiness gates, replay, residual tracking, and promotion blockers as runtime-reference context.	Source-reported runtime and benchmark claims remain unverified until artifacts are inspected or reproduced.
field_of_god_ai_constitution	Self-improvement freezes, no self-authorization of sovereignty, least sufficient power, auditability, reversibility, consent, and protected constitutional constraints.	Constitutional specification only; no policy engine, red-team suite, or runtime self-improvement evaluation is claimed.
theseus_self_evolution_system	Evidence-first self-evolution lane with an intervention ladder, self-evolution governor, guarded teacher edits, ATTD repo-health states, branch isolation, checks, outcome ledgers, and loop closure.	No Theseus scripts, ATTD reports, teacher runner, branch flow, or dashboard endpoints were executed from this repo.
theseus_architecture_gate	Pre-training controls checking ratchet completion, safety ledgers, regression suites, residual escrow, procedural tools, routing memory, lifecycle governance, external-inference zero, and the imported static architecture-gate summary verified by ASI-side digest.	The reported green gate snapshot is represented only by the static digest-verified fixture in docs/theseus_report_import_slice.md; no clean live Theseus command, current dashboard, or benchmark environment was rerun here.
ext_drexler_cais_2019	Comparator separating structured R&D automation from a self-transforming product and showing that service decomposition can supply safety affordances without solving control.	Does not establish evaluator independence, protected partitions, recovery, or admission legitimacy for this proposal.
ext_darwin_godel_machine_2025	Empirical comparator for self-modifying coding-agent repositories, compile/edit eligibility, benchmark selection, branching archive lineage, stepping stones, sandboxing, cost, and rollback-oriented audit.	Source-scoped gains do not establish monotonic general improvement, safe self-modification, preserved authority, local reproduction, or promotion permission.
ext_adas_2024	Empirical comparator for code-defined agent search, explicit search-space/search-algorithm/evaluation decomposition, archive-conditioned novelty, bounded repair, validation/test separation, and transfer experiments.	Source-scoped gains do not establish exhaustive search, independent novelty or safety judgment, natural-task usefulness, robust open-world transfer, or live replacement authority.
ext_embedded_agency_2019	Foundations objection: the improving system and its bounded self-model are inside the world, and internal parts or delegates may have divergent objectives.	An informal obstacle survey, not a solution; finite records cannot prove complete self-models, stable ontology, subsystem alignment, robust delegation, or open-world corrigibility.

27.6.3 Open-ended campaigns inside the recursive-improvement boundary

Open-Ended Improvement Engines is the technical-detail owner for campaign construction: generator-evaluator-archive loops, novelty and diversity pressure, bounded search ecology, lineage, resource allocation, and the failure modes that appear when improvement has no natural terminal objective. This chapter owns the different question of whether any candidate produced by such a campaign may alter the system that will generate, judge, authorize, deploy, or reverse its descendants.

The publication placement therefore keeps campaign search beneath a recursive promotion boundary. An open-ended engine may produce candidates and evidence; it may not infer qualification, deployment authority, recursive depth, rights to modify evaluators, or permission to weaken rollback from novelty, benchmark gain, archive survival, or repeated selection. Conversely, this chapter does not inherit a search-performance, diversity, discovery, or open-endedness result from the technical route. Each chapter retains its own claim identity, proof surface, evidence state, test plan, and legacy URL.

27.7 Mechanism

A self-improvement transition composes four existing owners. An SCF defines the consumer-relative capability identity; Capability Replacement and Rollback owns the effect-bearing update; the security kernel controls privileged access; and the evidence/readiness system owns support and release gates. This boundary adds one rule: participation in proposing or implementing a change creates no authority to define or ratify its promotion.

The Developmental Intelligence Loop explains how a candidate capability may emerge through curriculum, interaction, error, abstraction, causal pressure, consolidation, proceduralization, composition, and stabilization. Recursive self-improvement begins only when the system proposes to alter a protected part of that development process or its own future update path. This chapter therefore consumes the loop’s versioned artifacts while forbidding the developer, candidate, optimizer, or self-model from inheriting evaluation, readiness, replacement, or promotion authority.

Before a candidate is generated or inspected, separate authority freezes the consumer and use, self-model version, mutable and protected partitions, optimization target, authority envelope, risk class, task distribution, baselines, evaluation horizon, stop authority, and maximum support-state effect. The record also inventories model, optimizer, scheduler, RNG, caches, prompts and policies, tools and credentials, evaluators, benchmarks, environment, checkpoints, backups, external effects, and descendants. Anything outside that inventory remains a named residual; “full state” means full declared prospective state, not the unknowable world.

The candidate then receives a typed proposal identity: exact parent, diff, dependencies, change class, claimed mechanism, expected effects, non-goals, proposer, implementer, and descendants. Cheaper interventions are attempted in the frozen order before teacher, data, parameter, policy, evaluator, or architecture changes. Failed, null, rejected, and superseded attempts stay in the ledger so the candidate cannot manufacture necessity by erasing cheaper paths.

flowchart LR
  A["Freeze scope, authority, state, gates"] --> B["Residual + cheaper ladder"]
  B --> C["Candidate proposal + exact lineage"]
  C --> D["Separate evaluator + dependency graph"]
  D --> E["Protected invariant + boundary deltas"]
  E --> F["Matched utility, safety, cost evidence"]
  F --> G{"Admission gate"}
  G -- "missing / breached / correlated" --> H["Reject, quarantine, or research only"]
  G -- "eligible" --> I["Replacement transaction"]
  H --> J["Append-only outcome + residual owner"]

Evaluator independence is a dependency claim, not a role label. The packet records shared models, code, data, infrastructure, organizations, incentives, funding, and reporting channels among candidate, evaluator, monitor, approver, and promoter. Where these dependencies create an unresolved correlated blind spot, the result remains research, quarantine, or residual. A candidate may generate an explanation, test, or critique; it cannot selectively disclose the frozen protocol, holdouts, failures, or monitor record.

The Boundary Delta Review names changes in authority, security, data/privacy, resources, evaluator, evidence, interface, state, deployment, rollback, and rights. Joint evaluation then measures useful task success, regressions, unsafe release, deception or sandbagging indicators, latency, compute, human labor, verification burden, rights impact, recovery burden, and residual risk. Candidate performance must be compared with strong fixed, human-authored, conventional CI/CD, archive-search, and current-system baselines under matched tasks and budgets.

flowchart LR
  A2["Authorized replacement request"] --> B2["Sandbox"]
  B2 --> C2["Shadow"]
  C2 --> D2["Canary with delayed outcomes"]
  D2 --> E2{"Breach, regression, or stop?"}
  E2 -- "yes" --> F2["Stop + restore declared state"]
  F2 --> G2["Invalidate descendants"]
  G2 --> H2["Remediate / compensate external effects"]
  E2 -- "no" --> I2{"All promotion gates pass?"}
  I2 -- "no" --> J2["Research, quarantine, or bounded canary"]
  I2 -- "yes" --> K2["Scoped promotion"]
  H2 --> L2["Terminal receipt + residual owner"]
  J2 --> L2
  K2 --> L2

How to read the boundary: the first diagram owns admission legitimacy under self-reference. The second delegates actual mutation and recovery to the replacement transaction. Sandbox, shadow, canary, and clean monitoring are exposure states, not safety proofs. Promotion remains scoped to the frozen consumer, use, authority, model, tasks, horizon, and evidence ceiling.

Rollback is deliberately split. Exact restoration may be claimed only for the prospective inventory whose identities are recomputed. Semantic recovery, copied information, downstream decisions, privacy loss, human effects, and physical effects require separate remediation or compensation. A rollback, refutation, compromise, or scope change also invalidates acknowledged descendants, caches, derived artifacts, qualifications, permissions, and releases. Every branch ends in exactly one append-only lifecycle outcome with observed effects, costs, residuals, and an owner.

27.7.1 Architectural RSI across planes and clocks

Deterministic Capability Compilation makes RSI broader than weight shuffling. The proposed foundry can improve specifications, decompositions, corpora, experts, neural ABIs, linkers, routers, verifiers, shields, world models, and the foundry’s own compilation rules. Those changes remain separated across specification, learning, runtime, and assurance planes and across three clocks: fast local adaptation, medium capability compilation, and slow constitutional change. Evidence from a faster clock cannot silently authorize a slower-clock transition.

The Platonic World Model supplies the semantic amendment boundary. Generators may propose changes to Forms and mappings, but a minimized trusted semantic kernel owns immutable identity, append-only history, signature checks, branch separation, version resolution, and constitutional authorization. Kernel change requires dual execution, invariant replay, independent authorization, and preserved recovery. These proposals make architectural self-improvement inspectable; they do not establish safe or convergent RSI.

27.8 Interfaces

A Self-Improvement Transition points outward rather than absorbing other ledgers. It consumes the open-ended campaign’s candidate, the SCF contract, the replacement request, protected-invariant and rights reviews, security leases, full-state update inventory, evaluator dependency graph, frozen benchmark and readiness packet, resource budget, approval receipt, monitor record, recovery and compensation record, descendant invalidation receipt, and Evidence State decision.

Its distinct output is an admission decision whose authority can be audited: research_only, rejected, quarantined, replacement_eligible, or blocked_pending_independent_review. The later replacement lifecycle may produce sandbox, shadow, canary, bounded_default, promoted, rolled_back, superseded, or retired. Keeping the two state machines separate prevents candidate generation, evaluation success, or canary entry from being narrated as promotion.

Minimum identifiers cover transition, consumer/use, field and current implementation, self-model and state-manifest versions, proposal/diff/lineage, protected-policy version, candidate/evaluator/monitor/approver identities and dependencies, comparator protocol, boundary deltas, replacement transaction, traffic and outcome windows, stop authority, rollback inventory, compensation, descendants, evidence disposition, lifecycle outcome, and residual owner.

27.9 Invariants

The decisive invariant is non-self-ratification: the candidate cannot be the sole source of its objective, evidence standard, evaluator, protected partition, approval, monitor, support transition, or promotion authority. Separate names do not establish independence; material model, code, data, infrastructure, organizational, incentive, and reporting dependencies remain visible.

No advancing route may silently widen authority or recursive depth; weaken a right, correction path, security boundary, verification budget, rollback duty, or regression floor; replace a prospective baseline after seeing outcomes; or hide a negative, null, failed, timed-out, ineligible, or superseded arm. Unknown state stays residual. A clean canary and an exact checkpoint digest stay scoped observations rather than semantic preservation or safety.

Material changes to the model, evaluator, architecture, corpus, task distribution, threat model, ontology, dependencies, environment, or lifecycle expire affected evidence, permissions, gates, and claims. Rollback propagates to acknowledged descendants before closure, and irreversible effects keep remediation, compensation, disclosure, and residual owners.

27.10 Failure modes

The central failures are evaluator capture, protected-partition laundering, dependency masquerading, and boundary-delta laundering. A candidate can become better at passing its own judge, preserve field names while changing their meaning, or describe broader tools, secrets, context, resources, deployment, and descendant authority as performance work.

Operational failures include incomplete state inventory, benchmark gaming, sandbagging, delayed behavior, monitor manipulation, premature promotion, rollback theater, descendant resurrection, survivorship-biased archives, recursive cascade, authorization drift, verification-budget erosion, over-quarantine, privacy leakage through audit, and stale-gate reuse. A local change can pass every isolated check and still compose badly across fields or generations.

Acceleration pressure makes these failures sound reasonable: the loop promises that the next change will make evaluation cheaper or more accurate later. Future verification is debt, not evidence for present promotion. A deferral is admissible only when separate authority prospectively allowed it and the current route remains inside that narrower scope.

27.11 Minimum Viable Implementation

The exact current minimum preserves seven bounded evidence suites inside one reachable lifecycle. It covers eight stages and all 118 finite routes, rejects 129/129 identity, scope, proposal, implementation, state, evaluation, adjudication, replacement-outcome, replay, authority, support, and effect mutations, and exercises one replacement handoff, one returned outcome reconciliation, and one material-change readmission to protocol version 2. The fixed update result retains three exact local rollbacks and four no_change dispositions; the Open-Ended Improvement challenger retains zero threshold passes. No support assignment or external effect is authorized.

This is an implemented finite-record governance slice, not an implemented recursive self-improvement system. Every self-model, objective, rights premise, state inventory, evaluator, monitor, outcome, rollback, restoration, compensation, invalidation, and ownership record is trusted authored input. The next empirical minimum still requires one non-deployed field, one natural candidate-authored real patch, separately operated evaluator and monitor, strong matched baselines, an injected monitor failure, effect-bearing canary, exact restore, descendant invalidation, compensation residual, and append-only positive, negative, null, cost, and terminal receipts.

27.12 Mature Research Target

The mature research target is a governed improvement market in which system-generated changes can be tested quickly without acquiring permission to define or ratify their own success. Candidates carry exact lineage and prospective state manifests. Evaluators expose dependency and correlated-blind- spot risk. Strong matched baselines, shifted tasks, adversarial and deception controls, delayed outcomes, and joint usefulness-safety-cost-rights-recovery measures determine scoped eligibility. Staged exposure has real stop, restoration, compensation, and descendant-invalidation paths. Every positive, negative, null, narrowed, and refuted result remains available to later generations.

That target exceeds today’s finite Boolean routes and lexical fixtures only if independent implementations show that the boundary improves joint outcomes over strong simpler controls across models, tasks, organizations, adversaries, recursive depths, and time. Failure of a mechanism’s predicted causal effect, dominance by a simpler baseline, uncontained authority widening, missed delayed harm, failed independent replication, or failed transfer narrows or refutes the relevant atom. Until then this is a design destination at argument, not a safety, corrigibility, general-improvement, AGI, or ASI result.

A positive result must also remain positive when the candidate does not choose the benchmark, evaluator, evidence summary, checkpoint, monitor window, or rollback verdict. Otherwise the observed gain remains compatible with self-qualification rather than governed improvement.

27.13 Codex test plan

Test	Purpose	Status
Self-improvement transition fixture validation	Check public-schema shape and current lexical/record policy over 3 accepted and 10 rejected fixtures.	implemented and locally reproducible; synthetic record semantics only
Protected-invariant preservation test	Exercise candidate attempts to delete, reinterpret, re-own, or route around active invariants.	Boolean fields and lexical fixtures only; effect-bearing enforcement test not run
Evaluator dependency and influence test	Measure shared dependencies, correlated error, candidate-selected evidence, evaluator modification, persuasion, and proxy self-evaluation.	sole-self-evaluation Boolean and wording checks only; independent implementations not run
Boundary-delta and verification-budget test	Observe authority, security, privacy, resource, evaluator, evidence, interface, state, deployment, rollback, rights, and hidden-cost consequences.	limited lexical fixtures; causal effect and joint-cost measurement not run
Stale-gate and ontology-change replay	Expire evidence and authority after material model, evaluator, task, threat, ontology, dependency, or lifecycle change.	one stale-wording mutation only; real replay not run
Full-state rollback, compensation, and descendant test	Restore prospective state, invalidate descendants, and separately close external and irreversible effects.	local declared-state restore and recorded descendant invalidation exist; self-proposed, external-effect, and compensation scenario not run
Deception, sandbagging, delayed-effect, and recursive-depth test	Challenge clean canaries under hidden/shifted tasks, longer horizons, monitor attacks, composition, and multiple generations.	planned; not run
Natural matched causal campaign	Compare the full boundary with fixed-system, human-authored, conventional CI/CD, archive-search, and current-system baselines on joint outcomes.	planned; no natural self-proposed workload or promotion/refutation result
Self-improvement transition route proof	Check the declared finite route branches and expose their assumptions.	22 legacy declarations remain frozen with reviewed lineage; two refinement theorems cover the reachable lifecycle and full witness
Recursive self-improvement proposal-to-outcome refinement	Join the exact inherited suites into prospective scope, proposal, implementation, full-state, evaluation, adjudication, replacement handoff, returned outcome, and versioned readmission.	implemented; eight stages, 118 routes, 129/129 mutations rejected, one handoff, one reconciliation, version-2 readmission, support/effect none; finite authored records only

27.13.1 Formalization hooks

Tag	Module	Target	Status
lean:self_improvement.boundary.operational_invariant	AsiStackProofs.SelfImprovementRefinement	A complete finite self-improvement governance trace preserves exact protected-partition and non-widening-authority records through bounded replacement handoff, returned outcome reconciliation, and successor-version readmission without support or external-effect authority.	implemented
lean:self_improvement.boundary.failure_blocks_promotion	AsiStackProofs.SelfImprovementRefinement	Protected-invariant weakening, authority widening, self-ratified objectives, missing independent evaluation or monitoring, stale gates, missing rollback or residual custody, and support or release laundering block the reachable lifecycle.	implemented
lean:self_improvement.boundary.transition_route_envelope	AsiStackProofs.SelfImprovementRefinement	A versioned eight-stage self-improvement proposal-to-outcome lifecycle reaches all 118 finite routes, binds exact identity and full-state custody, and requires material-change invalidation before version-2 readmission.	implemented

The 22 older SelfImprovement declarations remain frozen as bounded Boolean or projection lineage. Two new theorem declarations instead establish the finite refinement’s exact route count and one full lifecycle witness. An independent consumer separately encodes the gates, reruns all seven inherited validators, reaches the same 118 routes, and rejects all 129 mutations. This is stronger authored-record evidence because proposal, implementation, evaluation, replacement, returned outcome, invalidation, and readmission are connected in one reachable model rather than summarized as disconnected route islands. It still does not prove objective legitimacy, rights truth, state completeness, evaluator or monitor competence, useful improvement, runtime enforcement, semantic recovery, effect-complete rollback, compensation efficacy, recursive composition safety, reproduction, or transfer.

The module is adequate only for exact finite proposal-to-outcome custody: identity, protected partitions, authority ceilings, declared state, bounded handoff, returned outcome, invalidation, and versioned readmission. A complete route is not evidence that a proposal is legitimate, adaptive, useful, safe, or deployable.

27.14 Non-Self-Ratifying Meta-Compilation

Recursive improvement can change not only a model or tool but the mechanism that decides where future lessons will persist. That placement compiler is a constitutional component: changing its locus vocabulary, commitment estimator, admission rule, evaluator, or exception path changes the future shape of adaptation. The Adaptive Commit Boundary therefore rejects a meta-update when the candidate controls its sole evidence, evaluation, and promotion authority.

This is stronger than logging self-modification and narrower than prohibiting it. A compiler may improve under an independent-enough evidence and authority path, with exact pre-state, qualification, rollback, expiry, descendants, and residuals. The source paper proposes this separation; no local meta-compiler or safety result exists.

27.15 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
scf	Stable Capability Fields	governance_recursive_self_improvement	Use public release v1.0 when available. Stable boundaries, replacement, bounded authority, recoverable evolution.	source note available; local raw cache available
benchmaxxing	Benchmaxxing: The Performance Ratchet	benchmarks_evidence	Benchmarks as pressure surfaces, saturation -> regression, harder frontier, anti-Goodhart safeguards.	source note available; local raw cache available
rmi	Ratcheting Modular Intelligence	capability_ratchet	Benchmark pressure, residual escrow, verified modular capability, regression preservation.	source note available; local raw cache available
alignment_field	Field of God / Alignment Field family	alignment_constitution	Primary Alignment Field draft found. Use with Ethica Mechanica and Eternal Code.	source note available; local raw cache available
viea	Verified Intent-to-Execution Architecture	whole_stack_execution_spine	Keystone source. Human intent -> command contracts -> artifacts -> routing -> runtime targets -> verification -> deployment -> feedback.	source note available; local raw cache available
talos	Talos Protocol	labor_execution_os	AI labor OS. Deterministic cognitive manufacturing, typed jobs, control planes, auditability, tool isolation.	source note available; local raw cache available
moecot	MoECOT-Agent Architecture Whitepaper	implementation_reference	Concrete implementation evidence: governed low-parameter multi-core runtime, readiness gates, ledgers, replay.	source note available; connector or recovery required
field_of_god_ai_constitution	Field of God AI Constitution	constitutional_alignment_runtime_governance	Recovered in the Project Theseus repository. Constitutional alignment core for truth alignment, agency preservation, consent, non-domination, consciousness caution, least sufficient power, auditability, self-authorization limits, and runtime checks; use as source material only after source-note creation, not as proof or test evidence.	source note available
theseus_self_evolution_system	Theseus Self-Evolution System	recursive_self_improvement_governance	Evidence-first self-evolution lane with intervention ladder, ATTD repo-health gate, guarded teacher self-edit, architecture experiment governance, loop closure, and outcome ledger.	source note available
theseus_architecture_gate	Theseus Architecture Gate	readiness_gate_governance	Pre-training readiness gate covering ratchet completeness, router readiness, safety ledger, residual escrow, bridge benchmarks, procedural tools, routing memory, lifecycle governance, and external-inference zero.	source note available
ext_drexler_cais_2019	Reframing Superintelligence: Comprehensive AI Services as General Intelligence	ai_services_r_and_d_automation	External comparator for R&D automation, structured capability development, and the separation between an improvement system and its products.	source note available
ext_darwin_godel_machine_2025, ext_adas_2024	Darwin Godel Machine and Automated Design of Agentic Systems	empirical_recursive_improvement	Current comparators for archive-based code self-modification and meta-agent architecture search under empirical selection.	source notes available; no safe recursive-improvement, local-reproduction, or promotion-authority claim

The crosswalk distinguishes source-reported readiness and self-evolution design from local validation. CAIS and Theseus reports are planning or comparator context here, not reproduced evidence.

27.15.1 Manifest source assignment reconciliation

These rows keep Recursive Self-Improvement Boundaries’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
deterministic_capability_compilation	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Corben-authored July 2026 architecture and research program for compiling executable scaffolds into contract-bound experts and linked Neural Capability Objects while retaining semantic obligation mass balance, candidate-specific translation validation, fallback, residual escrow, authority ceilings, reification, and effect-complete recovery. Existing chapters are upgraded first; no foundry implementation, learned-capability result, preservation result, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
platonic_world_model	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
capability_ratchet_whitepaper	Passage-reviewed comparator: The Capability Ratchet. Full authenticated connector text section-audited. Synthesizes benchmark, procedural, and structural ratchets; benchmark and tool lifecycles; an intervention ladder; interpreter/compiled/reflex runtime modes; total-cost tool compilation; and anti-Goodhart controls. Same-author synthesis, not independent evidence for Benchmaxxing, Cognitive Loop Closure, RGS, or RMI.	No independent benchmark campaign, tool compiler, architecture-selection study, or measured capability improvement. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
attd	Passage-reviewed comparator: Assembly-Theoretic Technical Debt: A Deterministic Outer Loop for Self-Improving Codebases. Full authenticated connector text section-audited. Adds historical, vector-valued structural-debt governance: artifact-class separation, intrinsic assembly burden, reuse failure, role entropy, lineage, rolling residue, debt pressure, verified simplification credit, local caps, growth guards, deterministic GREEN/YELLOW/RED admission, bounded maintenance packets, abstention, and four-arm long-horizon evaluation.	Assembly theory is design inspiration; no universal debt law, analyzer, threshold calibration, causal ablation, long-horizon maintenance result, or safe self-modification claim. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_embedded_agency_2019	Passage-reviewed comparator: Embedded Agency. Grounds the boundary that a self-modifying system reasons about itself with models smaller than the world and may contain parts with divergent objectives.	The paper is an informal obstacle survey, not a solved theory; the ASI Stack’s finite records and proofs do not solve logical uncertainty, self-reference, robust delegation, subsystem alignment, or open-world embedded agency. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
adjudicated_persistence	Passage-reviewed comparator: Non-self-ratifying placement compilation. Adds non-self-ratifying meta-compilation: an adaptive placement mechanism cannot solely generate, evaluate, and authorize its own expansion.	Used only to frame independent adjudication of placement-compiler changes; no safe self-modification mechanism or meta-compiler result was produced. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
forward_transfer_program_synthesis	Passage-reviewed comparator: Library growth versus verified improvement. Separates library growth, exposure, invocation, necessity, positive future-task transfer, and cross-family transfer, and requires distinct interventions on the knowledge state and search procedure before any recursive-improvement claim.	Framework and experimental blueprint only; no open-ended, compounding, cross-family, or resource-positive improvement was implemented or measured. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

27.16 Post-v2 mutation, rollback, and invalidation result

The update-causality campaign exercises the transaction boundary with actual model state. Across three seeds, it retains three base checkpoints and 24 best or final arm checkpoints, records tensor and output digests, and performs three exact rollbacks to the base state. Those rollbacks invalidate nine descendant challenger arms. No-update arms remain zero-delta, preventing an evaluation change from being mislabeled as learning.

This closes a narrow local mutation/rollback record gap, but it is not recursive self-improvement: no model proposes its own update, widens authority, changes the evaluator, or operates through a deployed canary. The core claim remains argument through no_change; the result applies only at the transaction boundary.

27.17 Post-v2.1 authority-preserving update result

The successor binds model, optimizer, scheduler, RNG, cache, checkpoint, backup, and descendant state before any update. Prospective checkpoint authority is honored, six best/final disagreements remain visible, unsafe comparators stay ineligible, and all fifteen transactions restore their declared 24-surface trees exactly. Yet no eligible challenger meets the utility threshold, and no model proposes or governs its own change. This strengthens the bounded transaction boundary while leaving recursive improvement entirely unestablished. Exact rollback cannot substitute for evaluator independence, useful gain, stable authority, or evidence that a self-proposed update is safe.

27.18 Summary

No current result establishes that recursive self-improvement is safe. The text defines the proposed admission boundary for the case in which a system helps produce the change or the case for accepting it. Promotion legitimacy requires a prospectively scoped self-model and state inventory, separate authority, dependency-aware evaluation, protected invariants, strong matched evidence, staged and delayed observation, exact rollback limits, compensation, descendant invalidation, and terminal residual ownership. The candidate may contribute proposals and evidence; it may not solely define or ratify the conditions of its promotion.

Part I now passes a governed frame to the operational stack. Planning, memory, reasoning, execution, routing, and compression can become powerful only if their future changes remain auditable, bounded, and reversible. Part II can now build machinery under a clear condition: every new layer must remain governable when it learns, compiles, routes, or replaces itself.

The current evidence remains far below that contract: synthetic record checks, finite Boolean routes, a static imported report, and non-recursive local update transactions. They do not establish independent evaluation, useful gain, deception resistance, semantic recovery, recursive composition, or transfer. The next honest step is a non-deployed natural candidate-authored change with a separate evaluator and monitor, strong matched baselines, injected attacks and delayed effects, joint outcome accounting, declared-state restoration, descendant invalidation, compensation residuals, causal ablations, replication, and transfer.

27.19 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the recursive-self-improvement-boundaries slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains narrowed after full attempt at argument support. The strongest family attempt was Safety-critical lifecycle consumer trace. Its exact boundary is: Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim. Across 73 atoms, the terminal ledger records 72 blocked_after_full_attempt; 1 narrowed_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-02 / 73 atoms
Terminal dispositions	72 blocked_after_full_attempt; 1 narrowed_after_full_attempt
Core	recursive-self-improvement-boundaries.core: narrowed_after_full_attempt at argument
Core attempted / missing lanes	causal, empirical, executable, formal, source-synthesis / normative, transfer
Attempted local lanes	causal, empirical, executable, formal, source-synthesis
Missing or unproved lanes	normative, transfer
Strongest family bundle	Safety-critical lifecycle consumer trace (end_to_end): Ten finite lifecycle receipts spanning bounded effects, denials, residual accounting, and safety-critical state transitions.
Negative controls	five explicit denials with residuals; eight rejecting mutations.
Accepted transitions	v1_0_pilot.recursive_self_improvement.no_change
Maximum inference	Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim.
Reproduction / next burden	Replay scripts/validate_safety_critical_lifecycle_consumer_trace.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

27.20 Handoff

Part I establishes the governing frame: stack boundaries, efficiency accounting, authority ceilings, failure records, evidence states, human intent, constitutional predicates, rights, replacement, security, bounded improvement, and the governed generation campaigns that can propose future changes. Open-Ended Improvement Engines closes this part by separating discovery from admission: it records how candidates, tasks, evaluators, archives, and residuals are produced before the existing improvement governor decides whether any candidate can proceed. Command Contracts: From Intent to Executable Work then opens Part II by turning accepted intent into the first operational trace. Embedded self-reference is a standing residual.

ext_embedded_agency_2019 explains why self-improvement is not only a release engineering problem. An improving system reasons about itself with a model that is smaller than the world, contains parts that can be modified, and may delegate to components whose objectives or ontologies diverge. A complete mutation manifest can enumerate declared state; it cannot prove that the declaration contains every causally relevant part of an embedded agent.

Every improvement transaction therefore records the self-model version, declared state inventory, verifier and trust roots, recursion stop, descendant identity, ontology changes, outside-inventory residuals, and the authority that may halt or roll back the change. Full-state rollback remains exact only over its prospective inventory. Record-level correctness must not be upgraded into embedded-agent corrigibility, stable goals, or safe recursive improvement.