The hard part of agent self-editing is deciding who holds the pen

Description and use

The system separates agent behavior from its authority using zones (mutable, protected, immutable) and a two‑record intent/commit protocol. An external CI workflow verifies the receipt chain, ensuring only authorized files can be edited by the agent.

Problem

Agents that can edit their own behavior risk rewriting the rules that govern their edits, leading to uncontrolled authority and insecure self-modification.

Outcome

The approach separates behavior from authority, ensuring that only authorized files can be edited by the agent and that all edits are auditable via a tamper‑evident receipt chain verified by an external workflow.

Workflow

• Define zones in selfedit-policy.toml (mutable, protected, immutable).
• Agent writes an intent receipt and fsyncs.
• Policy is rechecked and target identity verified.
• Agent atomically replaces target file and fsyncs directory.
• Agent writes a commit receipt and fsyncs.
• External CI workflow (pull_request_target) checks receipts using pinned verifier, without executing PR code.
• If any step fails, verification fails and edit is rejected.

Evidence

A policy can say that .claude/rules/** is mutable while .github/** and the policy itself are protected.

Source

The workflow has read-only permissions, does not persist checkout credentials, pins third-party actions to immutable commits, installs an exact verifier version, and does not execute code from the pull request.

Source