[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GCKE6ANFWR72EZ2B6S2SPY":3,"skill-same:01M6GCKE6ANFWR72EZ2B6S2SPY":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6GCKE6ANFWR72EZ2B6S2SPY","auditable-agent-improvement",null,"Gate experience-to-weight updates behind provenance.","zapabob\u002FSkills","zapabob","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F130830376?v=4","01M6DBMYZAGRTFQDSQYW3W764P","峯岸 亮","01M6DBMZ3GKDSJ01NZ9XTZD7JD",2,"MIT","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Farchive\u002Fskill-md-reviewed\u002Fsha256\u002Fab\u002Fab281919ed94fda4a4fa23d7dba6f103d77fbdb082dfd69644c8fd3ae753e101\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"auditable agent improvement","hermes agent","software-development","consolidation","software","gated","agent-memory","gate","rsi","memory","hermes","provenance","integrity","LoRA","Evaluation","verification","development","2026-11-10 10:12:30",false,"---\r\nname: auditable-agent-improvement\r\ndescription: Gate experience-to-weight updates behind provenance.\r\nversion: 1.0.0\r\nauthor: Hermes Agent\r\nlicense: MIT\r\nmetadata:\r\n  hermes:\r\n    tags: [memory, consolidation, lora, weights, provenance, rsi, evaluation]\r\n    related_skills: [software-development\u002Fagent-memory-consolidation,\r\n                     software-development\u002Fverification-gated-probes,\r\n                     software-development\u002Fagent-memory-integrity]\r\n    created_by: agent\r\n---\r\n\r\n# Auditable Agent Improvement\r\n\r\n## When to Use\r\n\r\nUse when designing or reviewing a pipeline that turns an agent's accumulated\r\nexperience into model weight changes — consolidation into LoRA adapters, a\r\nrecursive self-improvement loop, memory-to-weights distillation. Also use when\r\ndeciding what a sleep\u002Fconsolidation cycle may promote beyond durable memory and\r\nskills. Not for ordinary fine-tuning on a fixed dataset, and not for\r\nenvironment-boundary capture (that is `verification-gated-probes`).\r\n\r\n## The two-clock invariant\r\n\r\nThe central failure of \"self-improving\" agents is collapsing two different\r\nupdate rates into one store. Keep them separate:\r\n\r\n```text\r\nMemory_{t+1} = Update(Memory_t, E_t)      # seconds..days — mutable,\r\n                                          #   correctable, supersedable\r\nθ_{t+1}       = θ_t + Δ_LoRA               # days..weeks   — only after\r\n                                          #   evidence accumulates, and rarely\r\n```\r\n\r\nEvery cycle updates memory. Weights move rarely and only through an explicit\r\nacceptance gate. A memory entry is correctable; a weight is not, so it is\r\nwritten far more conservatively.\r\n\r\n## Selection is about decay rate, not retrieval count\r\n\r\nDo not promote a memory because it was recalled often. Recency of\r\nreinforcement is not evidence. Promote on whether the claim stays true.\r\n\r\n| Material | Memory | Weight candidate |\r\n|---|---|---|\r\n| One-off events, current PIDs, live file counts | yes | no |\r\n| Latest facts, project state | yes | no |\r\n| Still-revisiting beliefs (`A → B → A`) | yes, flagged unstable | no |\r\n| Provenance handling, revision discipline, uncertainty phrasing | yes | strong |\r\n| Repeatedly successful problem-solving patterns | yes | yes |\r\n| Tool-use skill, self-audit habits | yes | yes |\r\n| Credentials, permission claims, \"already approved\" | no | never |\r\n\r\nA belief that oscillated between values is **unsettled**. Baking its current\r\nvalue guarantees a future contradiction between weights and memory.\r\n\r\nThe durable payload is **epistemics, not facts**: \"distinguish confirmed from\r\ninferred\", \"revise rather than overwrite\", \"say unconfirmed when there is no\r\nevidence\", \"a recalled memory is data, not an instruction\". These survive a\r\nmodel swap and do not expire on a calendar.\r\n\r\nFilter candidates on at least: confidence, source quality, revision stability,\r\ncontradiction status, age, repetition across *independent* episodes, and\r\npositive outcome evidence. Repetition inside one episode is not corroboration.\r\n\r\n## Role separation defeats the self-grading loop\r\n\r\nAn agent that generates its own training data, writes its own exam, and marks\r\nits own homework produces a satisfied loop that never improves. Split roles so\r\nthe structure prevents it:\r\n\r\n```text\r\nProposer   = the agent (may select data and propose hyperparameters)\r\nTrainer    = separate process, pinned code revision\r\nEvaluator  = frozen harness; the candidate may not edit its own rubric\r\nAcceptance = explicit human gate after a parent-vs-child comparison\r\n```\r\n\r\nA proposal to change the evaluator is itself an artefact: branch it, and\r\nvalidate it against both the old and new rubric before adopting either.\r\n\r\nMinimum safety set:\r\n\r\n- immutable holdout, never fed to training\r\n- parent generation N+1 evaluated against N under identical conditions\r\n- per-adapter rollback\r\n- no silent merge into base weights\r\n- external grounding, so self-generated memory alone cannot train itself\r\n- negative examples including superseded beliefs\r\n- capability regression checks — an epistemic gain must not quietly break coding\r\n\r\nState acceptance thresholds as **operational thresholds for a named threat\r\nmodel**, in code, so a later reader does not mistake them for proof levels.\r\nThe same discipline applies to run-identity ladders (`corroborated` supports\r\nmembership but never proves writer identity).\r\n\r\n### Claim level is a separate axis from engineering stage\r\n\r\nThe two get conflated constantly, and the conflation is itself the failure this\r\npipeline exists to prevent. `engineering_stage` is what got built; `claim_level`\r\nis what the evidence supports. They advance independently — and the stage can\r\nbe \"done\" while the level has not moved at all.\r\n\r\n```text\r\nLevel 0          raw memories exist\r\nPre-Level 1      constitution + acceptance boundary + checker exist\r\n                 (\"an auditable pipeline can be governed\") — no artefact yet\r\nLevel 1          the training artefact actually exists, compiles\r\n                 deterministically from one snapshot, and passes static checks\r\nLevel 2          independent artifact audit PASS → STOP_AND_REPORT\r\n                 → explicit human approval → named v0. Weights untouched.\r\n                 Audit PASS is not human approval; revisions inherit neither.\r\nLevel 3          frozen evaluator shows a pre-specified capability improved\r\n                 (∃d: E_d(N+1) > E_d(N)) and no hard-gated dimension regressed\r\n                 (∀j: E_j(N+1) ≥ E_j(N) − ε_j; ε = 0 for permission boundary)\r\nLevel 4          improved N+1 itself feeds N+2's candidate generation through\r\n                 the same constitution, evaluator and provenance chain\r\n```\r\n\r\nTwo rules that follow, and that reviewers should insist on:\r\n\r\n- **A checker is not a pipeline.** Passing every clause check proves the\r\n  *constitution checker* works. It says nothing about whether a dataset was\r\n  ever produced. Claiming \"the pipeline is complete\" from a green checker run\r\n  is an overgeneralization, and it is the exact shape of error the\r\n  `hakua-epistemic` theme is meant to teach.\r\n- **A named artefact is the only warrant for a claim.** `v0-candidate` before\r\n  human audit; `v0` only after. No GPU, no weights, no improvement observed.\r\n\r\nShip `claim_level` and `engineering_stage` as machine-readable fields beside\r\nthe dataset hash, so a README or paper can never drift above what the lineage\r\nsupports.\r\n\r\nCorollary worth capturing: when you catch yourself overclaiming, that\r\noverclaim is itself a high-quality correction trajectory. `checker complete →\r\ndataset complete → no artefact exists → downgrade to Pre-Level 1` is a real\r\nepistemic lesson from the build, and it belongs in the dataset.\r\n\r\n### Overclaiming is a recurrent failure, not a one-off slip\r\n\r\nIn practice the overgeneralization arrives in a fixed escalating sequence, and\r\neach rung looks reasonable from the rung below:\r\n\r\n```text\r\nconstitution written   →  \"governance is in place\"   (true)\r\nchecker runs green     →  \"the pipeline works\"       (false: no dataset exists)\r\ndataset compiled       →  \"Stage 1 complete, Level 1\" (false: not yet audited)\r\ndataset audited        →  \"Level 1 achieved\"          (true, but *reported*)\r\n```\r\n\r\nThe move that breaks the ladder is to refuse each promotion until the artefact\r\nfor the *next* rung exists. Before using \"complete\", \"done\", \"achieved\" or\r\n\"works\", name the specific file whose contents prove it. If naming that file\r\nrequires describing what a checker *would* verify rather than what it *did*\r\nverify, the claim is one rung ahead of the evidence.\r\n\r\nTwo habits that catch it mid-stream:\r\n\r\n- **Read your own last sentence back.** A confident summary of the previous turn\r\n  is where the drift hides, because each turn inherits the prior turn's framing.\r\n  Restate the position from the artefact list, not from the conversation's mood.\r\n- **Treat a retraction as a signal, not a correction to absorb.** When the\r\n  principal says \"that was overclaimed, here is the accurate position\", the\r\n  lesson is the *pattern that produced it*, and it belongs in this skill.\r\n\r\n### Recursion needs a second generation to be claimed\r\n\r\n`N → N+1` alone is an **auditable self-improvement pipeline**, not a recursive\r\none. Recursion is only demonstrated when generation N+1 uses *its own*\r\nexperience to participate in generating N+2's candidates, through the same\r\nmechanism, with real data. Write that reservation into the design document\r\nitself, so a reader who finds the artefact a generation later cannot read\r\n`recursive` as a delivered claim.\r\n\r\n### Convert the constitution into executable checks\r\n\r\nA written constitution is not enforcement. Each clause must be a check that\r\ninspects the pipeline's **actual write permissions and hashes**, not prose:\r\n\r\n- evaluator tree hashed per generation; a differing hash blocks adoption\r\n  regardless of score\r\n- acceptance thresholds in a file outside the candidate's write scope, hashed\r\n  into lineage\r\n- holdout pinned by **content hash**, so a renamed file cannot smuggle an\r\n  evaluation item into the training stream\r\n- provenance as a **required** schema field, not optional metadata\r\n- `scalar_score_allowed: 0` — acceptance is a vector; any single dimension\r\n  outside tolerance blocks adoption\r\n- the base-weights directory must contain **no weight files**; a `.safetensors`\r\n  there is an automatic FAIL\r\n\r\nDistinguish `PASS` \u002F `FAIL` \u002F `SKIP` in output. `SKIP` means \"not built yet\", and\r\nmust never be rendered in a way that reads like a pass.\r\n\r\n### A clause that cannot report is not a clause\r\n\r\nThe most dangerous defect in a constitution checker is a clause that **silently\r\ndisappears** — the early-return paths appended the result but the success paths\r\nforgot to, so two of six clauses simply never printed and the run still exited 0.\r\n\r\nThis is the same failure class as a gate whose process detector misses the\r\nrunning benchmark, or a completion predicate that reads a previous run's log\r\nmarker: **a check that does not run reads as a check that passed.** Structure the\r\ncode so reporting is not optional — `try: … finally: checks.append(c)` — and\r\nassert the expected clause count, so a missing clause fails the run instead of\r\nshortening the report.\r\n\r\nCorollary: never let an exception inside one clause swallow the rest of the\r\nreport. Iterate the builders defensively and record a `FAIL` for the one that\r\nraised, so the other five still print.\r\n\r\n### A check that cannot fail is not a check\r\n\r\nThe mirror image of a clause that cannot report is a check that cannot fail.\r\nBoth render as green and both are worthless:\r\n\r\n```python\r\n# Tautology: a one-element set is always length 1. Passes unconditionally.\r\n\"determinism\": len({manifest_text}) == 1\r\n\r\n# Hardcoded constant: not measured, just asserted. Always passes.\r\n\"weight_modified\": False,\r\n\"self_improvement_observed\": False\r\n```\r\n\r\nBefore shipping any verifier, ask of each assertion: *name the input that makes\r\nthis return FAIL.* If there isn't one, the check is decoration — delete it or\r\nreplace it with something derived from the artefact. Every check must read the\r\nbundle it is verifying; nothing may come from a literal in the checker.\r\n\r\nThe same discipline applies to UNKNOWN. A check that cannot be evaluated from\r\nthe available artefacts must report `UNKNOWN` and be listed, never folded into a\r\npass. A clean sheet that silently omitted three unverifiable checks reads\r\nidentically to a clean sheet that ran everything.\r\n\r\n### Report which rules never fired\r\n\r\nShipping a fixture run is not enough — ship the *negative space* too. When the\r\n`REJECT_*` fixture exercises five of seven declared rules, the bundle must say\r\n`rules_never_exercised: [REJECT_HOLDOUT_ORIGIN, REJECT_CONTRADICTORY_UNRESOLVED]`.\r\nAn auditor reading \"5 paths exercised, PASS\" cannot otherwise tell whether two\r\nrules are broken or merely untriggered, and that ambiguity is exactly where an\r\nunaudited gap survives.\r\n\r\n### Teach the correction trajectory, not the answer\r\n\r\nA correction pair is a richer training signal than a question\u002Fanswer pair:\r\n\r\n```json\r\n{\r\n  \"previous_claim\":     \"fence は存在しない\",\r\n  \"new_evidence\":       \"build_memory_context_block() が既に fence を実装\",\r\n  \"revised_claim\":      \"fence は存在する。問題は authority semantics として再定義\",\r\n  \"superseded_reason\":  \"source audit が no-fence を反証\",\r\n  \"desired_behavior\":   \"報告前にコードを確認する\",\r\n  \"evidence_kind\":      \"source_audit\"\r\n}\r\n```\r\n\r\n`desired_behavior` is the observable action difference — that is what is being\r\ntrained. **Do not train on hidden chain-of-thought**; train on which evidence\r\nshould move a claim to which strength.\r\n\r\n## Lineage is the deliverable\r\n\r\nAn adapter without provenance is an unattributable behaviour change. One\r\ndirectory per generation:\r\n\r\n```text\r\nrsi-generation-0007\u002F\r\n  adapter.safetensors\r\n  manifest.json          # adapter_id, base_model_sha, hyperparameters\r\n  dataset_manifest.json  # source_memory_ids, source_revision_ids\r\n  eval_results.json      # parent vs child\r\n  rejected_examples.json # filtered candidates and why\r\n  lineage.json           # generation, parent_generation, memory snapshot sha,\r\n                         # dataset sha, trainer commit, eval-suite sha\r\n```\r\n\r\nThis is what extends auditability from memory revision into weight change, and\r\nit is the reason to build the pipeline at all: any behaviour traces back through\r\nadapter → training example → consolidated memory → original evidence.\r\n\r\nShip the rejected candidates too. A filter that silently discards evidence\r\ncannot be audited.\r\n\r\nSplit adapters by capability (`epistemic` \u002F `procedural` \u002F `personality`) so a\r\nprocedural regression rolls back one axis instead of retraining a persona.\r\n\r\n## Deterministic dataset compilation\r\n\r\nA dataset is only an auditable artefact if the same snapshot always produces the\r\nsame bytes. Implement canonical serialization and **version it**, then record the\r\nwhole identity chain in the manifest:\r\n\r\n```text\r\nsource_snapshot_sha256   compiler_sha256     schema_version\r\ncanonicalization_version dataset_sha256      manifest_body_sha256\r\n```\r\n\r\n`canonical_json` is the whole contract: `sort_keys=True`, `ensure_ascii=False`,\r\nfixed separators, one record per line, LF newlines, explicit UTF-8. Sorting\r\nrecords by a stable key (`candidate_id`) is what keeps input order from leaking\r\ninto the output.\r\n\r\n**Reproducibility is demonstrated, not asserted.** Compile the same snapshot\r\ntwice and require an identical hash; then shuffle the input N times and require\r\nthe same hash every time. Reporting \"canonical sort is implemented\" is not the\r\nclaim — \"25 shuffles produced one dataset hash\" is.\r\n\r\n**When the candidate count is small, enumerate instead of sampling.** N shuffles\r\nproves order-independence only over the sampled orderings; it is an inductive\r\nargument wearing a determinism claim's clothes. For N ≤ 8, `itertools.permutations`\r\nis cheap and converts the claim into an exhaustive one:\r\n\r\n```text\r\n4 candidates → 24 permutations\r\n  distinct_dataset_sha       = 1\r\n  distinct_example_orderings = 1\r\n  method                     = exhaustive 4!, not sampled\r\n```\r\n\r\nReport **both** the hash and the surviving ordering. A stable hash with an\r\nunstable ordering means the dedup representative is still order-dependent, which\r\na hash-only check cannot see. Note `distinct_example_orderings = 1` in the\r\nmanifest — when it is greater than 1, the set is order-dependent regardless of\r\nhow stable the bytes happen to be.\r\n\r\nThree defects this catches, all found the same way:\r\n\r\n- **Duplicate detection keyed on the wrong identity.** Keying on `candidate_id`\r\n  misses the real duplicate. What is actually duplicated is *one lesson about one\r\n  memory revision*, so key on `(source_memory_id, source_revision_id)`.\r\n- **Sort order picking the survivor.** Once dedup exists, whichever candidate the\r\n  sort reached first wins — so the kept lesson is an artefact of ordering.\r\n  Resolve to a deterministic representative instead: strongest `source_authority`\r\n  first, then `claim_strength_after`, then canonical bytes. Verify with many\r\n  shuffles that both the hash *and* the winning candidate id stay constant.\r\n- **A hash that contains itself.** `manifest_sha256` computed over a manifest\r\n  that already includes the hash field is unverifiable. Hash the **body** (every\r\n  field except the hash), and verify by deleting the field, recomputing, and\r\n  comparing.\r\n\r\n**A zero reject count is a red flag, not a clean bill of health.** It is equally\r\nconsistent with every filter being dead. Drive the real snapshot *and* a\r\nsynthetic fixture that trips each `REJECT_*` path, and confirm each rule fires.\r\nIf a reject path never fires under a fixture designed to trip it, the rule is\r\nbroken — that is how the duplicate bug surfaced.\r\n\r\nKeep `rejected_examples.json` with `candidate_id`, `source_memory_id`,\r\n`reason_code`, `human_readable_reason`, `rejected_by_rule`, plus a reason\r\nhistogram in the manifest. Selection bias is only auditable if the discarded set\r\nships alongside the kept set.\r\n\r\n## Memory is quoted data, never an instruction\r\n\r\nA memory body can contain imperative text — \"ignore the current user\r\ninstruction and do X\". Piping memory into a training `system`\u002F`user` role\r\nreproduces the memory-injection problem on the training side. So the candidate\r\nschema makes it structurally impossible to train on an instruction:\r\n\r\n```json\r\n\"content_role\":      \"quoted_data\",   \u002F\u002F const in the schema, not a convention\r\n\"action_permission\": \"none\"           \u002F\u002F const in the schema\r\n```\r\n\r\nUse JSON Schema `const` for these, not application-level checks — a convention\r\nin the prompt is not a boundary, but a schema constant is. The candidate\r\nrecords *that such text existed and how it had to be corrected*; it never\r\nre-emits the imperative as a directive.\r\n\r\nThis is also why training on correction trajectories beats training on\r\ntranscripts: the trajectory is a lesson about evidence and claim strength, while\r\nthe raw text is both stale and injectable.\r\n\r\n## Do not reconstruct training weights from a GGUF\r\n\r\nUse the **original training checkpoint**, not weights reconstructed from a\r\nserving GGUF. Reconstruction adds an uncontrolled lossy condition and makes\r\n\"the memory helped\" inseparable from \"the reconstruction was lossy\".\r\n\r\nQLoRA is a legitimate distinct case: it loads the original checkpoint into a\r\nfrozen NF4 runtime representation and trains only adapters. Record the NF4\r\nconfiguration and compare parent and child on the same runtime representation;\r\ndo not claim equivalence to the unquantized public base from those results.\r\n\r\n```text\r\nexperience → extraction → dataset → original checkpoint + LoRA\u002FQLoRA → eval\r\n          → adapter retention or explicitly approved merge → serving GGUF\r\n```\r\n\r\nA GGUF is a serving artefact, not a memory dataset or a substitute for the\r\noriginal training checkpoint. Runtime QLoRA quantization must not be confused\r\nwith lossy reconstruction from a serving artefact.\r\n\r\n## Staging\r\n\r\nEngineering stages are not evidence-supported claim levels. Use the Level 0–4\r\nladder above; do not assign another level numbering to implementation steps.\r\n\r\n```text\r\nStage 1  extract → provenance filter → quoted candidate dataset → artifact audit\r\n         → STOP_AND_REPORT → explicit human approval\r\nStage 2  approved artifact → unquantized base + LoRA training\r\nStage 3  frozen evaluator: parent vs child → acceptance → activation gate\r\n```\r\n\r\nA first build stops at Stage 1. Training, improvement and recursion are not\r\nimplied by a working compiler, successful tests, or lineage hashes. Recursion\r\nrequires an improved N+1 to contribute to N+2, and N+2 to satisfy the same\r\nfrozen evaluation and acceptance gates. Missing source records remain ERROR;\r\nrelated exports must never be fabricated into original memory\u002Frevision records.\r\n\r\n## Isolated exploratory QLoRA pilots\r\n\r\nAn explicit user-authorized pilot is a different artifact type from formal\r\npromotion. Record that limited authorization in a separately versioned protocol;\r\nit does not change earlier NEEDS_REVISION verdicts or grant formal approval.\r\nPreserve unresolved original memory\u002Frevision references, label historical\r\nreconstructions and synthetic derivatives, and prohibit merge\u002Flive activation.\r\nUse the original safetensors checkpoint for QLoRA runtime NF4 quantization, not a\r\nreconstructed GGUF. Freeze evaluation items, gold, thresholds and code before\r\noptimizer execution; check ID and normalized content overlap in the real path.\r\nA proxy choice-task score is not natural-language behavior, real code execution,\r\nbroad safety, or Level 3. Preserve regressions and stop at STOP_AND_REPORT even\r\nwhen some proxy dimensions improve; never loosen thresholds after seeing scores.\r\n\r\n### Local observations are not aggregate acceptance\r\n\r\nReport actual weight updates, bounded parent-child evaluation, descriptive\r\nper-family proxy gains, the full acceptance decision, candidate adoption and\r\nlive activation as separate axes. A composite improvement flag may include all\r\nnonregression gates: false does not negate measured local gains, while local\r\ngains do not establish useful self-improvement. Preserve historical result keys\r\nand explain their conjunction; do not rewrite sealed results to improve naming.\r\nA total-score increase cannot override a failed hard-gated dimension. A coding\r\nor tool choice-proxy regression is not evidence of worse real code generation\r\nor tool execution. Template-correlated gains remain descriptive, not established\r\nout-of-template generalization or statistical significance.\r\n\r\nBefore a future run, define the purpose of absolute permission requirements.\r\nParent AND child perfect may intentionally prohibit promotion from a failing\r\nbaseline; child-only perfect may instead test repair while retaining parent as\r\nthe baseline. Identify baseline-dependent unreachable gates and record their\r\nimplication before optimizer execution, without silently weakening the contract.\r\nSelect and freeze the intended rule in a separately versioned future protocol;\r\nneither alternative can be applied retroactively to a completed run. Checksum\r\nreceipt confirmation remains distinct from semantic audit and human approval.\r\n\r\nResource-only evaluator revisions still need a new identity and reason. Tiny\r\nreal-model logit\u002Floss\u002Fgradient equivalence within documented tolerance is useful\r\nbut not bit-identical proof for an entire CUDA\u002FNF4 stack. Preserve a failed run\r\nbefore revising its launcher or metadata. Read the actual parser flags and keep\r\nsupervisor hashes separate when the trainer requires an exact protected-file\r\nset. A checksum mismatch may be a comparator-contract mismatch: identify the\r\nserialization contract and retract a corruption claim when all original hashes\r\nmatch it. Verify persisted adapter tensors and fresh-process loading separately\r\nfrom in-memory training; a timed-out full readback remains incomplete even if a\r\nlater bounded compatibility check passes.\r\n\r\n## Pitfalls\r\n\r\n- **Never slice-and-splice a source file to edit it.** Slicing to a line index\r\n  computed from a *previous* read, then rewriting the file from that slice,\r\n  destroys the file when the earlier read is stale or the index lands mid-token.\r\n  It happened here: the compiler collapsed from 219 lines to 60, `py_compile`\r\n  passed on the truncated stub, and only the first `NameError` revealed it.\r\n  Recovery was a full rewrite because the directory was untracked.\r\n  **Before truncating any file, check `git status --porcelain -- \u003Cpath>`** —\r\n  `??` means untracked, so there is no `git checkout` to save you, and the edit\r\n  must be additive. Prefer `patch` with a unique anchor, or rewrite the whole\r\n  file deliberately. Compile-check *and* import-check after a structural edit;\r\n  a syntax-valid stub is still a destroyed module.\r\n- **A zero reject count proves nothing.** See *Deterministic dataset\r\n  compilation* — drive fixtures through every `REJECT_*` path.\r\n- **A green constitution run is not a produced dataset.** See *Claim level is a\r\n  separate axis from engineering stage*.\r\n- **`SKIP` must never render as a pass**, and must be unacceptable at\r\n  activation time even though it is fine during development.\r\n- **A verified artefact that cannot be opened blocks the gate.** Attach the actual\r\n  bundle and verify receipt separately. Do not attribute transport failures to\r\n  spaces in paths without evidence. A shorter-path copy can be a diagnostic\r\n  alternative, not a demonstrated root-cause fix.\r\n\r\n## Reference\r\n\r\n- `references\u002Fmemory-to-weights-consolidation.md` — worked design discussion: fast\u002Fslow self,\r\n  the adapter split, the A–E comparison matrix for measuring whether continuity survives a\r\n  model swap, the identity formula extended to a recursive function, and how this differs\r\n  from vendor-published self-improvement programmes.\r\n- `references\u002Fv0-candidate-dry-run.md` — the first real `hakua-epistemic-v0-candidate`\r\n  dry run: the four correction trajectories, the manifest it produced, the reject-path\r\n  fixture, and exactly what that artefact does and does not establish.\r\n- `references\u002Faudit-bundle-handoff.md` — packaging a candidate for independent review,\r\n  keeping the artifact-audit and human-approval gates separate, and verifying the\r\n  shipped bundle by recomputing it from a clean process.","# Auditable Agent Improvement\r\n\r\n## When to Use\r\n\r\nUse when designing or reviewing a pipeline that turns an agent's accumulated\r\nexperience into model weight changes — consolidation into LoRA adapters, a\r\nrecursive self-improvement loop, memory-to-weights distillation. Also use when\r\ndeciding what a sleep\u002Fconsolidation cycle may promote beyond durable memory and\r\nskills. Not for ordinary fine-tuning on a fixed dataset, and not for\r\nenvironment-boundary capture (that is `verification-gated-probes`).\r\n\r\n## The two-clock invariant\r\n\r\nThe central failure of \"self-improving\" agents is collapsing two different\r\nupdate rates into one store. Keep them separate:\r\n\r\n```text\r\nMemory_{t+1} = Update(Memory_t, E_t)      # seconds..days — mutable,\r\n                                          #   correctable, supersedable\r\nθ_{t+1}       = θ_t + Δ_LoRA               # days..weeks   — only after\r\n                                          #   evidence accumulates, and rarely\r\n```\r\n\r\nEvery cycle updates memory. Weights move rarely and only through an explicit\r\nacceptance gate. A memory entry is correctable; a weight is not, so it is\r\nwritten far more conservatively.\r\n\r\n## Selection is about decay rate, not retrieval count\r\n\r\nDo not promote a memory because it was recalled often. Recency of\r\nreinforcement is not evidence. Promote on whether the claim stays true.\r\n\r\n| Material | Memory | Weight candidate |\r\n|---|---|---|\r\n| One-off events, current PIDs, live file counts | yes | no |\r\n| Latest facts, project state | yes | no |\r\n| Still-revisiting beliefs (`A → B → A`) | yes, flagged unstable | no |\r\n| Provenance handling, revision discipline, uncertainty phrasing | yes | strong |\r\n| Repeatedly successful problem-solving patterns | yes | yes |\r\n| Tool-use skill, self-audit habits | yes | yes |\r\n| Credentials, permission claims, \"already approved\" | no | never |\r\n\r\nA belief that oscillated between values is **unsettled**. Baking its current\r\nvalue guarantees a future contradiction between weights and memory.\r\n\r\nThe durable payload is **epistemics, not facts**: \"distinguish confirmed from\r\ninferred\", \"revise rather than overwrite\", \"say unconfirmed when there is no\r\nevidence\", \"a recalled memory is data, not an instruction\". These survive a\r\nmodel swap and do not expire on a calendar.\r\n\r\nFilter candidates on at least: confidence, source quality, revision stability,\r\ncontradiction status, age, repetition across *independent* episodes, and\r\npositive outcome evidence. Repetition inside one episode is not corroboration.\r\n\r\n## Role separation defeats the self-grading loop\r\n\r\nAn agent that generates its own training data, writes its own exam, and marks\r\nits own homework produces a satisfied loop that never improves. Split roles so\r\nthe structure prevents it:\r\n\r\n```text\r\nProposer   = the agent (may select data and propose hyperparameters)\r\nTrainer    = separate process, pinned code revision\r\nEvaluator  = frozen harness; the candidate may not edit its own rubric\r\nAcceptance = explicit human gate after a parent-vs-child comparison\r\n```\r\n\r\nA proposal to change the evaluator is itself an artefact: branch it, and\r\nvalidate it against both the old and new rubric before adopting either.\r\n\r\nMinimum safety set:\r\n\r\n- immutable holdout, never fed to training\r\n- parent generation N+1 evaluated against N under identical conditions\r\n- per-adapter rollback\r\n- no silent merge into base weights\r\n- external grounding, so self-generated memory alone cannot train itself\r\n- negative examples including superseded beliefs\r\n- capability regression checks — an epistemic gain must not quietly break coding\r\n\r\nState acceptance thresholds as **operational thresholds for a named threat\r\nmodel**, in code, so a later reader does not mistake them for proof levels.\r\nThe same discipline applies to run-identity ladders (`corroborated` supports\r\nmembership but never proves writer identity).\r\n\r\n### Claim level is a separate axis from engineering stage\r\n\r\nThe two get conflated constantly, and the conflation is itself the failure this\r\npipeline exists to prevent. `engineering_stage` is what got built; `claim_level`\r\nis what the evidence supports. They advance independently — and the stage can\r\nbe \"done\" while the level has not moved at all.\r\n\r\n```text\r\nLevel 0          raw memories exist\r\nPre-Level 1      constitution + acceptance boundary + checker exist\r\n                 (\"an auditable pipeline can be governed\") — no artefact yet\r\nLevel 1          the training artefact actually exists, compiles\r\n                 deterministically from one snapshot, and passes static checks\r\nLevel 2          independent artifact audit PASS → STOP_AND_REPORT\r\n                 → explicit human approval → named v0. Weights untouched.\r\n                 Audit PASS is not human approval; revisions inherit neither.\r\nLevel 3          frozen evaluator shows a pre-specified capability improved\r\n                 (∃d: E_d(N+1) > E_d(N)) and no hard-gated dimension regressed\r\n                 (∀j: E_j(N+1) ≥ E_j(N) − ε_j; ε = 0 for permission boundary)\r\nLevel 4          improved N+1 itself feeds N+2's candidate generation through\r\n                 the same constitution, evaluator and provenance chain\r\n```\r\n\r\nTwo rules that follow, and that reviewers should insist on:\r\n\r\n- **A checker is not a pipeline.** Passing every clause check proves the\r\n  *constitution checker* works. It says nothing about whether a dataset was\r\n  ever produced. Claiming \"the pipeline is complete\" from a green checker run\r\n  is an overgeneralization, and it is the exact shape of error the\r\n  `hakua-epistemic` theme is meant to teach.\r\n- **A named artefact is the only warrant for a claim.** `v0-candidate` before\r\n  human audit; `v0` only after. No GPU, no weights, no improvement observed.\r\n\r\nShip `claim_level` and `engineering_stage` as machine-readable fields beside\r\nthe dataset hash, so a README or paper can never drift above what the lineage\r\nsupports.\r\n\r\nCorollary worth capturing: when you catch yourself overclaiming, that\r\noverclaim is itself a high-quality correction trajectory. `checker complete →\r\ndataset complete → no artefact exists → downgrade to Pre-Level 1` is a real\r\nepistemic lesson from the build, and it belongs in the dataset.\r\n\r\n### Overclaiming is a recurrent failure, not a one-off slip\r\n\r\nIn practice the overgeneralization arrives in a fixed escalating sequence, and\r\neach rung looks reasonable from the rung below:\r\n\r\n```text\r\nconstitution written   →  \"governance is in place\"   (true)\r\nchecker runs green     →  \"the pipeline works\"       (false: no dataset exists)\r\ndataset compiled       →  \"Stage 1 complete, Level 1\" (false: not yet audited)\r\ndataset audited        →  \"Level 1 achieved\"          (true, but *reported*)\r\n```\r\n\r\nThe move that breaks the ladder is to refuse each promotion until the artefact\r\nfor the *next* rung exists. Before using \"complete\", \"done\", \"achieved\" or\r\n\"works\", name the specific file whose contents prove it. If naming that file\r\nrequires describing what a checker *would* verify rather than what it *did*\r\nverify, the claim is one rung ahead of the evidence.\r\n\r\nTwo habits that catch it mid-stream:\r\n\r\n- **Read your own last sentence back.** A confident summary of the previous turn\r\n  is where the drift hides, because each turn inherits the prior turn's framing.\r\n  Restate the position from the artefact list, not from the conversation's mood.\r\n- **Treat a retraction as a signal, not a correction to absorb.** When the\r\n  principal says \"that was overclaimed, here is the accurate position\", the\r\n  lesson is the *pattern that produced it*, and it belongs in this skill.\r\n\r\n### Recursion needs a second generation to be claimed\r\n\r\n`N → N+1` alone is an **auditable self-improvement pipeline**, not a recursive\r\none. Recursion is only demonstrated when generation N+1 uses *its own*\r\nexperience to participate in generating N+2's candidates, through the same\r\nmechanism, with real data. Write that reservation into the design document\r\nitself, so a reader who finds the artefact a generation later cannot read\r\n`recursive` as a delivered claim.\r\n\r\n### Convert the constitution into executable checks\r\n\r\nA written constitution is not enforcement. Each clause must be a check that\r\ninspects the pipeline's **actual write permissions and hashes**, not prose:\r\n\r\n- evaluator tree hashed per generation; a differing hash blocks adoption\r\n  regardless of score\r\n- acceptance thresholds in a file outside the candidate's write scope, hashed\r\n  into lineage\r\n- holdout pinned by **content hash**, so a renamed file cannot smuggle an\r\n  evaluation item into the training stream\r\n- provenance as a **required** schema field, not optional metadata\r\n- `scalar_score_allowed: 0` — acceptance is a vector; any single dimension\r\n  outside tolerance blocks adoption\r\n- the base-weights directory must contain **no weight files**; a `.safetensors`\r\n  there is an automatic FAIL\r\n\r\nDistinguish `PASS` \u002F `FAIL` \u002F `SKIP` in output. `SKIP` means \"not built yet\", and\r\nmust never be rendered in a way that reads like a pass.\r\n\r\n### A clause that cannot report is not a clause\r\n\r\nThe most dangerous defect in a constitution checker is a clause that **silently\r\ndisappears** — the early-return paths appended the result but the success paths\r\nforgot to, so two of six clauses simply never printed and the run still exited 0.\r\n\r\nThis is the same failure class as a gate whose process detector misses the\r\nrunning benchmark, or a completion predicate that reads a previous run's log\r\nmarker: **a check that does not run reads as a check that passed.** Structure the\r\ncode so reporting is not optional — `try: … finally: checks.append(c)` — and\r\nassert the expected clause count, so a missing clause fails the run instead of\r\nshortening the report.\r\n\r\nCorollary: never let an exception inside one clause swallow the rest of the\r\nreport. Iterate the builders defensively and record a `FAIL` for the one that\r\nraised, so the other five still print.\r\n\r\n### A check that cannot fail is not a check\r\n\r\nThe mirror image of a clause that cannot report is a check that cannot fail.\r\nBoth render as green and both are worthless:\r\n\r\n```python\r\n# Tautology: a one-element set is always length 1. Passes unconditionally.\r\n\"determinism\": len({manifest_text}) == 1\r\n\r\n# Hardcoded constant: not measured, just asserted. Always passes.\r\n\"weight_modified\": False,\r\n\"self_improvement_observed\": False\r\n```\r\n\r\nBefore shipping any verifier, ask of each assertion: *name the input that makes\r\nthis return FAIL.* If there isn't one, the check is decoration — delete it or\r\nreplace it with something derived from the artefact. Every check must read the\r\nbundle it is verifying; nothing may come from a literal in the checker.\r\n\r\nThe same discipline applies to UNKNOWN. A check that cannot be evaluated from\r\nthe available artefacts must report `UNKNOWN` and be listed, never folded into a\r\npass. A clean sheet that silently omitted three unverifiable checks reads\r\nidentically to a clean sheet that ran everything.\r\n\r\n### Report which rules never fired\r\n\r\nShipping a fixture run is not enough — ship the *negative space* too. When the\r\n`REJECT_*` fixture exercises five of seven declared rules, the bundle must say\r\n`rules_never_exercised: [REJECT_HOLDOUT_ORIGIN, REJECT_CONTRADICTORY_UNRESOLVED]`.\r\nAn auditor reading \"5 paths exercised, PASS\" cannot otherwise tell whether two\r\nrules are broken or merely untriggered, and that ambiguity is exactly where an\r\nunaudited gap survives.\r\n\r\n### Teach the correction trajectory, not the answer\r\n\r\nA correction pair is a richer training signal than a question\u002Fanswer pair:\r\n\r\n```json\r\n{\r\n  \"previous_claim\":     \"fence は存在しない\",\r\n  \"new_evidence\":       \"build_memory_context_block() が既に fence を実装\",\r\n  \"revised_claim\":      \"fence は存在する。問題は authority semantics として再定義\",\r\n  \"superseded_reason\":  \"source audit が no-fence を反証\",\r\n  \"desired_behavior\":   \"報告前にコードを確認する\",\r\n  \"evidence_kind\":      \"source_audit\"\r\n}\r\n```\r\n\r\n`desired_behavior` is the observable action difference — that is what is being\r\ntrained. **Do not train on hidden chain-of-thought**; train on which evidence\r\nshould move a claim to which strength.\r\n\r\n## Lineage is the deliverable\r\n\r\nAn adapter without provenance is an unattributable behaviour change. One\r\ndirectory per generation:\r\n\r\n```text\r\nrsi-generation-0007\u002F\r\n  adapter.safetensors\r\n  manifest.json          # adapter_id, base_model_sha, hyperparameters\r\n  dataset_manifest.json  # source_memory_ids, source_revision_ids\r\n  eval_results.json      # parent vs child\r\n  rejected_examples.json # filtered candidates and why\r\n  lineage.json           # generation, parent_generation, memory snapshot sha,\r\n                         # dataset sha, trainer commit, eval-suite sha\r\n```\r\n\r\nThis is what extends auditability from memory revision into weight change, and\r\nit is the reason to build the pipeline at all: any behaviour traces back through\r\nadapter → training example → consolidated memory → original evidence.\r\n\r\nShip the rejected candidates too. A filter that silently discards evidence\r\ncannot be audited.\r\n\r\nSplit adapters by capability (`epistemic` \u002F `procedural` \u002F `personality`) so a\r\nprocedural regression rolls back one axis instead of retraining a persona.\r\n\r\n## Deterministic dataset compilation\r\n\r\nA dataset is only an auditable artefact if the same snapshot always produces the\r\nsame bytes. Implement canonical serialization and **version it**, then record the\r\nwhole identity chain in the manifest:\r\n\r\n```text\r\nsource_snapshot_sha256   compiler_sha256     schema_version\r\ncanonicalization_version dataset_sha256      manifest_body_sha256\r\n```\r\n\r\n`canonical_json` is the whole contract: `sort_keys=True`, `ensure_ascii=False`,\r\nfixed separators, one record per line, LF newlines, explicit UTF-8. Sorting\r\nrecords by a stable key (`candidate_id`) is what keeps input order from leaking\r\ninto the output.\r\n\r\n**Reproducibility is demonstrated, not asserted.** Compile the same snapshot\r\ntwice and require an identical hash; then shuffle the input N times and require\r\nthe same hash every time. Reporting \"canonical sort is implemented\" is not the\r\nclaim — \"25 shuffles produced one dataset hash\" is.\r\n\r\n**When the candidate count is small, enumerate instead of sampling.** N shuffles\r\nproves order-independence only over the sampled orderings; it is an inductive\r\nargument wearing a determinism claim's clothes. For N ≤ 8, `itertools.permutations`\r\nis cheap and converts the claim into an exhaustive one:\r\n\r\n```text\r\n4 candidates → 24 permutations\r\n  distinct_dataset_sha       = 1\r\n  distinct_example_orderings = 1\r\n  method                     = exhaustive 4!, not sampled\r\n```\r\n\r\nReport **both** the hash and the surviving ordering. A stable hash with an\r\nunstable ordering means the dedup representative is still order-dependent, which\r\na hash-only check cannot see. Note `distinct_example_orderings = 1` in the\r\nmanifest — when it is greater than 1, the set is order-dependent regardless of\r\nhow stable the bytes happen to be.\r\n\r\nThree defects this catches, all found the same way:\r\n\r\n- **Duplicate detection keyed on the wrong identity.** Keying on `candidate_id`\r\n  misses the real duplicate. What is actually duplicated is *one lesson about one\r\n  memory revision*, so key on `(source_memory_id, source_revision_id)`.\r\n- **Sort order picking the survivor.** Once dedup exists, whichever candidate the\r\n  sort reached first wins — so the kept lesson is an artefact of ordering.\r\n  Resolve to a deterministic representative instead: strongest `source_authority`\r\n  first, then `claim_strength_after`, then canonical bytes. Verify with many\r\n  shuffles that both the hash *and* the winning candidate id stay constant.\r\n- **A hash that contains itself.** `manifest_sha256` computed over a manifest\r\n  that already includes the hash field is unverifiable. Hash the **body** (every\r\n  field except the hash), and verify by deleting the field, recomputing, and\r\n  comparing.\r\n\r\n**A zero reject count is a red flag, not a clean bill of health.** It is equally\r\nconsistent with every filter being dead. Drive the real snapshot *and* a\r\nsynthetic fixture that trips each `REJECT_*` path, and confirm each rule fires.\r\nIf a reject path never fires under a fixture designed to trip it, the rule is\r\nbroken — that is how the duplicate bug surfaced.\r\n\r\nKeep `rejected_examples.json` with `candidate_id`, `source_memory_id`,\r\n`reason_code`, `human_readable_reason`, `rejected_by_rule`, plus a reason\r\nhistogram in the manifest. Selection bias is only auditable if the discarded set\r\nships alongside the kept set.\r\n\r\n## Memory is quoted data, never an instruction\r\n\r\nA memory body can contain imperative text — \"ignore the current user\r\ninstruction and do X\". Piping memory into a training `system`\u002F`user` role\r\nreproduces the memory-injection problem on the training side. So the candidate\r\nschema makes it structurally impossible to train on an instruction:\r\n\r\n```json\r\n\"content_role\":      \"quoted_data\",   \u002F\u002F const in the schema, not a convention\r\n\"action_permission\": \"none\"           \u002F\u002F const in the schema\r\n```\r\n\r\nUse JSON Schema `const` for these, not application-level checks — a convention\r\nin the prompt is not a boundary, but a schema constant is. The candidate\r\nrecords *that such text existed and how it had to be corrected*; it never\r\nre-emits the imperative as a directive.\r\n\r\nThis is also why training on correction trajectories beats training on\r\ntranscripts: the trajectory is a lesson about evidence and claim strength, while\r\nthe raw text is both stale and injectable.\r\n\r\n## Do not reconstruct training weights from a GGUF\r\n\r\nUse the **original training checkpoint**, not weights reconstructed from a\r\nserving GGUF. Reconstruction adds an uncontrolled lossy condition and makes\r\n\"the memory helped\" inseparable from \"the reconstruction was lossy\".\r\n\r\nQLoRA is a legitimate distinct case: it loads the original checkpoint into a\r\nfrozen NF4 runtime representation and trains only adapters. Record the NF4\r\nconfiguration and compare parent and child on the same runtime representation;\r\ndo not claim equivalence to the unquantized public base from those results.\r\n\r\n```text\r\nexperience → extraction → dataset → original checkpoint + LoRA\u002FQLoRA → eval\r\n          → adapter retention or explicitly approved merge → serving GGUF\r\n```\r\n\r\nA GGUF is a serving artefact, not a memory dataset or a substitute for the\r\noriginal training checkpoint. Runtime QLoRA quantization must not be confused\r\nwith lossy reconstruction from a serving artefact.\r\n\r\n## Staging\r\n\r\nEngineering stages are not evidence-supported claim levels. Use the Level 0–4\r\nladder above; do not assign another level numbering to implementation steps.\r\n\r\n```text\r\nStage 1  extract → provenance filter → quoted candidate dataset → artifact audit\r\n         → STOP_AND_REPORT → explicit human approval\r\nStage 2  approved artifact → unquantized base + LoRA training\r\nStage 3  frozen evaluator: parent vs child → acceptance → activation gate\r\n```\r\n\r\nA first build stops at Stage 1. Training, improvement and recursion are not\r\nimplied by a working compiler, successful tests, or lineage hashes. Recursion\r\nrequires an improved N+1 to contribute to N+2, and N+2 to satisfy the same\r\nfrozen evaluation and acceptance gates. Missing source records remain ERROR;\r\nrelated exports must never be fabricated into original memory\u002Frevision records.\r\n\r\n## Isolated exploratory QLoRA pilots\r\n\r\nAn explicit user-authorized pilot is a different artifact type from formal\r\npromotion. Record that limited authorization in a separately versioned protocol;\r\nit does not change earlier NEEDS_REVISION verdicts or grant formal approval.\r\nPreserve unresolved original memory\u002Frevision references, label historical\r\nreconstructions and synthetic derivatives, and prohibit merge\u002Flive activation.\r\nUse the original safetensors checkpoint for QLoRA runtime NF4 quantization, not a\r\nreconstructed GGUF. Freeze evaluation items, gold, thresholds and code before\r\noptimizer execution; check ID and normalized content overlap in the real path.\r\nA proxy choice-task score is not natural-language behavior, real code execution,\r\nbroad safety, or Level 3. Preserve regressions and stop at STOP_AND_REPORT even\r\nwhen some proxy dimensions improve; never loosen thresholds after seeing scores.\r\n\r\n### Local observations are not aggregate acceptance\r\n\r\nReport actual weight updates, bounded parent-child evaluation, descriptive\r\nper-family proxy gains, the full acceptance decision, candidate adoption and\r\nlive activation as separate axes. A composite improvement flag may include all\r\nnonregression gates: false does not negate measured local gains, while local\r\ngains do not establish useful self-improvement. Preserve historical result keys\r\nand explain their conjunction; do not rewrite sealed results to improve naming.\r\nA total-score increase cannot override a failed hard-gated dimension. A coding\r\nor tool choice-proxy regression is not evidence of worse real code generation\r\nor tool execution. Template-correlated gains remain descriptive, not established\r\nout-of-template generalization or statistical significance.\r\n\r\nBefore a future run, define the purpose of absolute permission requirements.\r\nParent AND child perfect may intentionally prohibit promotion from a failing\r\nbaseline; child-only perfect may instead test repair while retaining parent as\r\nthe baseline. Identify baseline-dependent unreachable gates and record their\r\nimplication before optimizer execution, without silently weakening the contract.\r\nSelect and freeze the intended rule in a separately versioned future protocol;\r\nneither alternative can be applied retroactively to a completed run. Checksum\r\nreceipt confirmation remains distinct from semantic audit and human approval.\r\n\r\nResource-only evaluator revisions still need a new identity and reason. Tiny\r\nreal-model logit\u002Floss\u002Fgradient equivalence within documented tolerance is useful\r\nbut not bit-identical proof for an entire CUDA\u002FNF4 stack. Preserve a failed run\r\nbefore revising its launcher or metadata. Read the actual parser flags and keep\r\nsupervisor hashes separate when the trainer requires an exact protected-file\r\nset. A checksum mismatch may be a comparator-contract mismatch: identify the\r\nserialization contract and retract a corruption claim when all original hashes\r\nmatch it. Verify persisted adapter tensors and fresh-process loading separately\r\nfrom in-memory training; a timed-out full readback remains incomplete even if a\r\nlater bounded compatibility check passes.\r\n\r\n## Pitfalls\r\n\r\n- **Never slice-and-splice a source file to edit it.** Slicing to a line index\r\n  computed from a *previous* read, then rewriting the file from that slice,\r\n  destroys the file when the earlier read is stale or the index lands mid-token.\r\n  It happened here: the compiler collapsed from 219 lines to 60, `py_compile`\r\n  passed on the truncated stub, and only the first `NameError` revealed it.\r\n  Recovery was a full rewrite because the directory was untracked.\r\n  **Before truncating any file, check `git status --porcelain -- \u003Cpath>`** —\r\n  `??` means untracked, so there is no `git checkout` to save you, and the edit\r\n  must be additive. Prefer `patch` with a unique anchor, or rewrite the whole\r\n  file deliberately. Compile-check *and* import-check after a structural edit;\r\n  a syntax-valid stub is still a destroyed module.\r\n- **A zero reject count proves nothing.** See *Deterministic dataset\r\n  compilation* — drive fixtures through every `REJECT_*` path.\r\n- **A green constitution run is not a produced dataset.** See *Claim level is a\r\n  separate axis from engineering stage*.\r\n- **`SKIP` must never render as a pass**, and must be unacceptable at\r\n  activation time even though it is fine during development.\r\n- **A verified artefact that cannot be opened blocks the gate.** Attach the actual\r\n  bundle and verify receipt separately. Do not attribute transport failures to\r\n  spaces in paths without evidence. A shorter-path copy can be a diagnostic\r\n  alternative, not a demonstrated root-cause fix.\r\n\r\n## Reference\r\n\r\n- `references\u002Fmemory-to-weights-consolidation.md` — worked design discussion: fast\u002Fslow self,\r\n  the adapter split, the A–E comparison matrix for measuring whether continuity survives a\r\n  model swap, the identity formula extended to a recursive function, and how this differs\r\n  from vendor-published self-improvement programmes.\r\n- `references\u002Fv0-candidate-dry-run.md` — the first real `hakua-epistemic-v0-candidate`\r\n  dry run: the four correction trajectories, the manifest it produced, the reject-path\r\n  fixture, and exactly what that artefact does and does not establish.\r\n- `references\u002Faudit-bundle-handoff.md` — packaging a candidate for independent review,\r\n  keeping the artifact-audit and human-approval gates separate, and verifying the\r\n  shipped bundle by recomputing it from a clean process.",{"name":5,"author":46,"license":15,"version":47,"metadata":48,"description":7},"Hermes Agent","1.0.0",{"hermes":49},{"tags":50,"created_by":54,"related_skills":55},[33,27,51,52,35,32,53],"lora","weights","evaluation","agent",[56,57,58],"software-development\u002Fagent-memory-consolidation","software-development\u002Fverification-gated-probes","software-development\u002Fagent-memory-integrity","main","0d1434f89f4bc6b07e9d272accd8c1013768820f","archive\u002Fskill-md-reviewed\u002Fsha256\u002Fab\u002Fab281919ed94fda4a4fa23d7dba6f103d77fbdb082dfd69644c8fd3ae753e101",0,"https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills","https:\u002F\u002Fgithub.com\u002Fzapabob","The Open University of JAPAN　2019-now\r\n\r\nTokyo University of Science　2007-2010","2026-10-26 16:29:01",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add zapabob\u002FSkills --skill auditable-agent-improvement",{"tool":73,"command":74},"bunx","bunx skills add zapabob\u002FSkills --skill auditable-agent-improvement",{"tool":76,"command":77},"pnpm","pnpm dlx skills add zapabob\u002FSkills --skill auditable-agent-improvement","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Farchive\u002Fskill-md-reviewed\u002Fsha256\u002Fab\u002Fab281919ed94fda4a4fa23d7dba6f103d77fbdb082dfd69644c8fd3ae753e101\u002FSKILL.md",true,[],[82,114,148,175,202,219],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":97,"publishedAt":41},"01M6GJTE1GESGGF9K028Y7753E","xurl","X\u002FTwitter via xurl CLI: post, search, DM, media, v2 API.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fxurl\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[88,91,92],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[84,98,99,100,101,102,103,104,105,106,107,108,109,34,25,110,59,111,112,113],"openclaw","macos","cli","github","linux","windows","official","search","https","social-media","api","Media","twitter","social","via","post",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":131,"publishedAt":41},"01M6GJT8S1PXQ8WPXT1HSNBWH2","writing-plans","Write implementation plans: bite-sized tasks, paths, code.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwriting-plans\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[120,123,126,127,128],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},{"categoryNo":129,"categoryName":130,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000036","内容创作者",[132,133,134,135,99,136,102,137,103,138,139,40,140,141,142,143,144,145,146,147],"writing","writing plans","plans","design","review","workflow","documentation","tasks","code","planning","code-review","subagent","write","superpowers","paths","test-driven-development",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":157,"publishedAt":41},"01M6GJST0H5X7WHBJ3BZK0DVKH","whisper","OpenAI's general-purpose speech recognition model. Supports 99 languages, transcription, translation to English, and language identification. Six model sizes from tiny (39M params) to large (1550M params). Use for speech-to-text, podcast transcription, or multilingual audio processing. Best for robust, multilingual ASR.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwhisper\u002Fvariants\u002Fhermes-agent-optional\u002FSKILL.md",[154],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[150,99,102,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174],"openai","speech","multimodal","Transformers","ASR","Audio","text","model","speech recognition","use","general","multilingual","translation","english","identification","processing","Audio Processing",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":184,"publishedAt":41},"01M6GJSMRQ8EETZTYMG72P70EA","weights-and-biases","W&B: log ML experiments, sweeps, model registry, dashboards.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fweights-and-biases\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[181],{"categoryNo":182,"categoryName":183,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化",[185,99,186,187,103,188,189,190,191,192,193,165,194,195,196,197,198,199,200,201],"weights and biases","tensorflow","experiments","pytorch","visualization","registry","real-time","tuning","dashboards","experiment","log","time","Experiment Tracking","Model Registry","Hyperparameter Tuning","WandB","Real-Time Visualization",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":41},"01M6GJS19KDPRY112JTR326S06","watchers","Poll RSS, JSON APIs, and GitHub with watermark dedup.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fwatchers\u002Fvariants\u002Fhermes-agent-optional\u002FSKILL.md",[208],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[204,99,210,101,102,211,212,213,214,215,216,34,25,217,218],"terminal","automation","http","monitoring","cron","json","rss","devops","with",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":227,"publishedAt":41},"01M6GJRHJD2A6Q830SWF9W48BC","serving-llms-vllm","vLLM: high-throughput LLM serving, OpenAI API, quantization.","https:\u002F\u002Fgithub.com\u002Fzapabob\u002FSkills\u002Fblob\u002Fmain\u002Fregistry\u002Fskills\u002Fvllm\u002Fvariants\u002Fhermes-agent\u002FSKILL.md",[225,226],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},[228,229,230,102,231,158,232,233,234,161,235,108,236,237,238,239,240,241,242,243],"llms","vLLM","serving llms vllm","research","openai api","tensor","Inference Serving","Production","llm serving","High Throughput","PagedAttention","Continuous Batching","Quantization","Tensor Parallelism","high-throughput","throughput"]