EPIC: Persistent self-modifying core with restart and rollback #6

New issue

Open

opened 2026-08-22 22:30:51 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-22 22:30:51 +00:00

(Migrated from github.com)

Parent: #1

Goal

Support bounded self-modification of a0-symbolics while keeping the persistent Git checkout recoverable outside the running container.

Runtime model

Use a host bind mount of the real a0-symbolics checkout at /a0. Agent Zero already treats /a0 as runtime source and /git/agent-zero as image-baked fallback. The host Git checkout is the durable authority for code changes.

Safety/authority model

Self-modification is a privileged workflow, not a default side effect.

Prolog policy should eventually answer:

may this path be modified?
does the change preserve authority/trust boundaries?
what tests are required?
is there a known-good rollback SHA?
may the runtime restart now?

Bootstrap allowlist should start with _symbolics plugin code, its tests/docs/prompts and explicitly approved configuration surfaces. Expanding into agent.py/initialization requires separate review.

Candidate lifecycle

record known-good SHA
create candidate branch/worktree or bounded patch
modify persistent checkout
run targeted + required tests
verify diff against policy
commit candidate
request runtime restart by exiting under an external restart policy/supervisor
health-check new runtime
keep candidate on success; reset to known-good SHA and restart on failure

Do not require Docker socket access from inside the container. Prefer external Docker/systemd restart policy.

RAGE loop

Review Docker startup/copy/self-update behavior and persistent paths -> analyze failure/rollback modes -> generate supervisor + policy slice -> execute restart/brick/rollback tests -> repeat until recovery is demonstrated, not merely described.

Acceptance

Documented supported launch mounts real host checkout at /a0.
Runtime can edit files and the host sees the changes immediately.
Container recreation preserves the modified checkout.
Known-good SHA is recorded before candidate activation.
Candidate changes require tests and policy verification before restart.
Health-check failure automatically restores known-good code or leaves an explicit recoverable state.
Restart mechanism does not require privileged Docker socket mounting.
A deliberately broken candidate is recovered in an integration test.
Self-modification telemetry records actor, paths, base SHA, candidate SHA, tests and rollback outcome.

Non-goals

No autonomous edits to arbitrary host files, secrets, Docker daemon, or unrelated repositories.

Parent: #1 ## Goal Support bounded self-modification of a0-symbolics while keeping the persistent Git checkout recoverable outside the running container. ## Runtime model Use a host bind mount of the real `a0-symbolics` checkout at `/a0`. Agent Zero already treats `/a0` as runtime source and `/git/agent-zero` as image-baked fallback. The host Git checkout is the durable authority for code changes. ## Safety/authority model Self-modification is a privileged workflow, not a default side effect. Prolog policy should eventually answer: - may this path be modified? - does the change preserve authority/trust boundaries? - what tests are required? - is there a known-good rollback SHA? - may the runtime restart now? Bootstrap allowlist should start with `_symbolics` plugin code, its tests/docs/prompts and explicitly approved configuration surfaces. Expanding into `agent.py`/initialization requires separate review. ## Candidate lifecycle 1. record known-good SHA 2. create candidate branch/worktree or bounded patch 3. modify persistent checkout 4. run targeted + required tests 5. verify diff against policy 6. commit candidate 7. request runtime restart by exiting under an external restart policy/supervisor 8. health-check new runtime 9. keep candidate on success; reset to known-good SHA and restart on failure Do not require Docker socket access from inside the container. Prefer external Docker/systemd restart policy. ## RAGE loop Review Docker startup/copy/self-update behavior and persistent paths -> analyze failure/rollback modes -> generate supervisor + policy slice -> execute restart/brick/rollback tests -> repeat until recovery is demonstrated, not merely described. ## Acceptance - [ ] Documented supported launch mounts real host checkout at `/a0`. - [ ] Runtime can edit files and the host sees the changes immediately. - [ ] Container recreation preserves the modified checkout. - [ ] Known-good SHA is recorded before candidate activation. - [ ] Candidate changes require tests and policy verification before restart. - [ ] Health-check failure automatically restores known-good code or leaves an explicit recoverable state. - [ ] Restart mechanism does not require privileged Docker socket mounting. - [ ] A deliberately broken candidate is recovered in an integration test. - [ ] Self-modification telemetry records actor, paths, base SHA, candidate SHA, tests and rollback outcome. ## Non-goals No autonomous edits to arbitrary host files, secrets, Docker daemon, or unrelated repositories.