The hard part of agent self-editing is deciding who holds the pen

说明与用途

系统通过可变、受保护和不可变三种区域以及意图/提交两步记录协议，将代理行为与其权限分离。外部 CI 工作流验证收据链，确保只有授权文件可被代理编辑。

问题

Agents that can edit their own behavior risk rewriting the rules that govern their edits, leading to uncontrolled authority and insecure self-modification.

结果

The approach separates behavior from authority, ensuring that only authorized files can be edited by the agent and that all edits are auditable via a tamper‑evident receipt chain verified by an external workflow.

工作流

• Define zones in selfedit-policy.toml (mutable, protected, immutable).
• Agent writes an intent receipt and fsyncs.
• Policy is rechecked and target identity verified.
• Agent atomically replaces target file and fsyncs directory.
• Agent writes a commit receipt and fsyncs.
• External CI workflow (pull_request_target) checks receipts using pinned verifier, without executing PR code.
• If any step fails, verification fails and edit is rejected.

证据

A policy can say that .claude/rules/** is mutable while .github/** and the policy itself are protected.

来源

The workflow has read-only permissions, does not persist checkout credentials, pins third-party actions to immutable commits, installs an exact verifier version, and does not execute code from the pull request.

来源