The hard part of agent self-editing is deciding who holds the pen

Описание и применение

Система разделяет поведение агента от его полномочий, используя зоны (mutable, protected, immutable) и протокол двух записей (intent/commit). Внешний CI‑workflow проверяет цепочку чеков, гарантируя, что только авторизованные файлы могут быть изменены агентом.

Задача

Agents that can edit their own behavior risk rewriting the rules that govern their edits, leading to uncontrolled authority and insecure self-modification.

Результат

The approach separates behavior from authority, ensuring that only authorized files can be edited by the agent and that all edits are auditable via a tamper‑evident receipt chain verified by an external workflow.

Рабочий процесс

• Define zones in selfedit-policy.toml (mutable, protected, immutable).
• Agent writes an intent receipt and fsyncs.
• Policy is rechecked and target identity verified.
• Agent atomically replaces target file and fsyncs directory.
• Agent writes a commit receipt and fsyncs.
• External CI workflow (pull_request_target) checks receipts using pinned verifier, without executing PR code.
• If any step fails, verification fails and edit is rejected.

Доказательства

A policy can say that .claude/rules/** is mutable while .github/** and the policy itself are protected.

Источник

The workflow has read-only permissions, does not persist checkout credentials, pins third-party actions to immutable commits, installs an exact verifier version, and does not execute code from the pull request.

Источник