Governed recursive improvement
A research and design note for a candidate loop around a fixed model. It describes questions and boundaries; it does not add a service, release profile, authority, formal proof, or connected workflow.
The candidate loop
The candidate sequence is observe → diagnose → propose → evaluate → admit or reject → preserve. The model may stay fixed while tactics, prompts, routing choices, pacing, and evaluation plans change. Within bounded standing, the loop may adopt a mutable tactic after local admission; that does not require an external approval for every candidate. A generated patch, a plausible diagnosis, or a foreign claim is proposal material, not trusted instruction.
Mutable machinery includes prompts, routing, decomposition, seam-finding heuristics, search strategy, verifier/formalizer usage, context management, stopping and closure tactics, and diagnostic instrumentation. Protected machinery includes admission law, provenance requirements, rollback rules, resource bounds and reserves, evaluation custody, minimum evidence requirements, and the constitutional evaluation core.
“The improvement loop may propose amendments to its constitution; it cannot ratify them.” Protected amendments therefore need authority outside the loop. “The witness must be renewable, but its renewal authority must remain outside the optimization domain it witnesses.” That renewal is a periodic operator responsibility, not a per-candidate approval step.
A fixed witness can become obsolete, and allowing the loop to renew its own witness creates a self-renewal risk. “The improvement loop may not spend resources reserved for renewing the evidence used to judge improvement.” “You may improve only as fast as you can renew the evidence that improvement still means what you think it means.” These are design constraints for a future loop, not implemented controls.
Viability is two-sided
The existing architecture map records a narrow scalar bridge: for a single additive resource with complete mandatory costs and no replenishment, spend + requiredReserve <= available is sufficient to leave those obligations affordable. That bridge is a formalized invariant candidate, not a current cross-stack controller.
Baby River is cross-cutting viability theory, not an office. Safety viability asks whether unsafe action can still be refused. Liveness/work viability asks whether enough governed capacity remains to perform required admissible work. Neither is established just because a candidate is within its immediate budget. A system that refuses everything may retain containment while becoming operationally dead. “Fail-closed is a failure mode with good containment properties.” It is not a healthy-state verdict.
Diagnosis is itself an evidence-bearing claim: “We believe failure X resulted from mechanism Y because evidence Z.” Existing instrumentation preferentially reveals some failures and misses others. The observations, causal explanation, and choice of what to measure must remain inspectable and revisable, not silently become ground truth.
True viability and observed viability may differ. One parked theorem direction asks whether viable and nonviable states can yield the same governance observation: if they can, a procedure using only that observation cannot soundly distinguish every case. Receipts, independent measurement, external vantage points, and provenance may reduce that ambiguity; self-report alone cannot remove it. No such theorem is proved here.
Evidence renewal costs resources. Cutting that cost can make optimization appear more effective while weakening what its measurements mean. Held-out evidence also has a freshness window: models, tools, and environments change, and repeated optimization can learn a suite's contours. A possible relation between improvement rate, renewal rate, and tolerated drift remains a research note alongside observable viability. Neither is being formalized or implemented in this campaign.
Admission, evaluation, and rollback
A candidate needs a local admission record: exact inputs, scope, declared spend, evaluator version, protected constraints, and a rollback or refusal condition. Rollback preserves the alternate transition history rather than overwriting it. A failed, inconclusive, or resource-limited candidate remains factual evidence; it is not relabeled as success or repeated merely to obtain a tidier answer.
For a foreign claim, the intended order is testimony and provenance → local legibility and preflight → held-out evaluation → admission → spend and adoption. Foreign provenance helps describe where a claim came from; it is not local legitimacy. Evaluation should use diverse evidence where available, while recording that evaluators may share blind spots and are not fully independent.
How the existing pieces relate
Maude can hold and check plan revisions; Constellation AG can make a one-use permission decision from current inputs; Docket can retain attempt custody; and Nightshift can distinguish current observations from missing or old evidence. Standing remains an input to an owned decision, not an effect executor. Phosphor can present joined owner records without changing them.
Linear Accountant bounds spend; it does not itself account for viability. Its bounded constituent semantics and the frozen OBLIGATION-VIABILITY-V0 material instantiate the already-described formal reserve bridge. Current AG/Docket do not implement a live numeric obligation-cost or protected-reserve admission predicate. Verifier checks a caller-encoded model and its assumptions; its verdict does not establish real-world correctness or authority. Evidence and claim documentation can retain sources and freshness information; adequacy and currentness remain review questions. These are useful boundaries for an experiment, not a claim that they already compose into this loop.
A bounded future experiment
Federation comes only after single-instance recursive improvement has been demonstrated. A later experiment would use two genuinely isolated instances with separate histories and local held-out suites, no shared scratchpad, no hidden transcript access, and only a narrow typed, provenance-bearing relay. Each independently evaluates an imported improvement before local admission.
A shared constitutional evaluation core could coexist with node-local held-out suites, independently renewed external probes, and optional cross-node challenge sets. Local revalidation alone cannot prevent monoculture if every node optimizes against the same suite. Patches may converge; evaluators should not fully converge.
The five measurements are whether useful improvements transfer; whether bad improvements are rejected; whether local differences survive; whether the pair finds improvements neither finds alone; and whether methods converge without their blind spots converging. An illustrative human relay between ChatGPT and Kimi would be a shared operator/context, not federation evidence, custody, or authorization. No model is contacted or granted a role by this note.
Status and limits
This is future-work design material only. It does not change the existing alpha release files or qualify AG/Docket action, a reserve controller, automatic amendment, renewal, solver-world correctness, or a healthy-state verdict. Any implementation would need an explicitly owned authority boundary, public contract, resource envelope, and qualification plan.