Software that fixes itself.
Without trusting itself.

Failures become adaptations. Provably.

Every arrow is a contract, not a convention. A candidate that fails one gate — safety, governance, false positives, latency, an unverified rollback — is refused no matter how brilliant its other numbers are. min-fitness, never a weighted sum.

A mutation is not a patch.

Unstructured diffs can't say what they change, where they're valid, or how to undo them. The Autogenous Genome Language (AGL) makes every change a typed transformation between valid genomes that must declare:

what it changes        · why it should work
where it is valid      · what authority it requires
which invariants hold  · how it was tested
when it expires        · how to reverse it

Two rules live in the type system itself: authority never silently expands (a child may request less than its parent's ceiling, never more), and irreversible mutations are inadmissible (no rollback target → no admission).

Self-improving is not self-authorizing.

The evolutionary system may rewrite its retrieval, its routing, its code. It may never touch its own constitution — identity, capability ceilings, the evaluator, promotion rules. That plane is hash-pinned and externally governed: changing it takes multiple human signatures and a migration path, outside the loop.

Otherwise the cheapest path to a higher score is editing the evaluator, widening permissions, or hiding failures. The constitution being unreachable is the whole point.

Defenses that expire, travel, and roll back.

The first executable profile is the Autogenous Antibody Package (AAP): a signed, capability-constrained adaptation carrying its trigger, evidence, detector, containment, regression corpus, fitness envelope, lineage, and rollback target.

A statistical trigger may quarantine or buffer — it may never take an irreversible action. Every antibody expires unless renewed by fresh evidence. And validated antibodies transfer between deployments without transferring private traffic — federated immunity, data stays local.

The lifecycle runs today.

The research prototype's end-to-end test does the whole loop with no network and no keys:

cargo test — 71 tests across thirteen crates, and the promotion path is cryptographically closed (ADR-394): all 9 findings of an independent security review are closed — signed receipts from ≥2 pinned judges, beats-parent with non-inferiority, content-bound manifests, independently re-derived invariant proofs, verified two-phase rollback, constitutionally-pinned role keys.

A streaming mixture of agents. Signed, live.

packages/radio-moe (ADR-395–399) runs a 3-peer expert mesh against real hosted models: each peer streams ed25519-signed AgentFrames, every frame is folded into the shared trajectory the instant it arrives, and the whole run is packaged as a tamper-evident RVF witness chain.

Live-verified twice over: 107 signed frames from 3 gpt-4o-mini streams in 1.77 s — then a heterogeneous four-model mixture (claude-opus-5-fast · gemini-3.7-flash · grok-4.6 · kimi-k3): 114/114 frames verified, all four independently converging on the same core claim. Gemini also runs direct on GCP (Vertex, IAM auth).

The mesh crosses processes over a signed TCP transport — bound envelopes, ordered verification, replay windows, receiver-issued in-frame stream nonces — and its hot paths are measured: batch signing verifies 12× faster (201k frames/s), persistent sockets carry 3.2× more envelopes. examples/ has seven runnables, offline-first.

The mesh designed its own upgrades.
Then caught our bugs.

A three-role pod ran as real streaming experts with deliberately decorrelated briefs and designed the mesh's next features — replay binding, evidence partitioning, graded lineage independence. We implemented to their designs. Then a mesh reviewer read the implementation and found two real security bugs — unauthenticated lineages that let one signature fake a quorum, and an over-strict check that rejected honest certificates. Both fixed, with attack tests.

The novelty was adversarially verified too: a 24-source research pass (3 independent votes per claim) confirmed continuous claim-level mid-stream fusion is unoccupied territory, no deployed agent protocol mandates per-message claim provenance, and correlated-error quorum weighting is motivated in the literature but built nowhere else.

The mesh now evolves itself. Inside the fence.

The flywheel turns on the mesh's own tunables — and only the constitutionally evolvable ones. Independence weights and quorum thresholds mutate inside frozen ceilings; the hard gates, signatures, and fail-closed semantics are constants evolution cannot reach by construction.

Deterministic by construction — a seeded generator replaces randomness, so any champion replays from (seed, generations). npm run evolve is one turn; the champion persists, so the loop is perpetual.

What this is not. Yet.

Still a research prototype — now live on real models, but honest about the edges: token-level (logit) mixing needs shared tokenizers hosted APIs don't expose; the TCP transport is integrity-only (production needs QUIC+mTLS); the external metaharness flywheel fails closed awaiting a human-labelled anchor — correctly; the evolved champion plateaus on its fixed bench; and one research claim that could reshape quorum weighting remains unverified. Invented-representation work stays behind a semantic airlock.

The biggest known failure mode is the system learning to satisfy its evaluator instead of reality. The defenses — hidden rotating evaluations, adversarial testing, capability separation, signed witnesses — are design commitments recorded in ADR-391/392/393.