Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution — part 2/2

Cleaned-text code points [15752, 31540). Bibliography omitted here; source.md includes it.

Two cases illustrate how useful work changes the agent that receives later tasks. First, people in public channels noticed that Hope occasionally sent the same message twice. The agent traced the behavior to a duplicate-send path and landed a reviewed verbatim-duplicate guard in the public output pipeline. Second, deep self-review tasks were aborting with apparent model unavailability. The agent traced the fault to review-pack context overflow and replaced the assembly path with a bounded, connectivity-aware context atlas ranked by import-graph centrality and a provider-calibrated size estimate. The fix preserves high-connectivity core files during review. The first case began with social feedback; the second with the agent’s own observation. Both became durable error classes and reviewed structural changes used by subsequent interactions. Together they instantiate experience-driven core evolution: work exposes a fault, the agent decides to act, and the resulting fix changes how later work is performed.

## 5 Evaluation

Table 2 summarizes results across the five benchmark families, and Figure 4 plots the principal comparisons. All runs use the official verifiers. Complete per-task traces, manifests, and submissions are linked with the corresponding results.

### Terminal-Bench 2.1.

The Opus 5 campaign ran five trials on each of 89 tasks. Its raw score is 387/445 (86.97%). Trajectory audit found one trial that satisfied a weak verifier through an unintended shortcut. We asked the benchmark maintainers to zero it, yielding 386/445 (86.74%). Provider moderation failures and infrastructure errors remain in the denominator. The binomial standard error over 445 trials is about ± \pm 1.7 percentage points for every system in this range, so the audited Opus 5 score sits roughly two standard errors above the strongest baseline, Claude Code with Fable 5 (83.8%) ( Anthropic, 2025 ) ; the other leaderboard baselines are Codex CLI with GPT-5.5 (83.1%) ( OpenAI, 2025 ) and Cursor with Grok 4.5 (79.3%) ( Anysphere, 2026 ) . The submission is open and the complete Harbor job is public.

### OSWorld-Verified.

The Opus 5 run scores 327.39/361 (90.69%) on the standard non-Google-Drive set ( Xie et al., 2024 ) . It uses screenshots, a 100-turn budget, a read-only feasibility pass, per-task proxy sessions when requested by the task config, and the official evaluator. The strongest published baselines are the Intelligence-Indeed agent, the official leaderboard leader at 90.19%; Claude Mythos Preview at 85.4%, the five-run average Anthropic reports in the Claude 5 system card; and Pointer Agent with Opus 4.7 at 83.64%. Per-task prompts, trajectories, scores, and manifests are public .

### CL-Bench.

The submitted Sonnet 4.6 campaign reaches normalized reward 0.2301 with one stateless baseline and 5 ordered stateful rollouts on all six domains. Conversation state resets between questions, and native memory persists across each rollout. Core evolution and task delegation are disabled, which isolates persistent memory more cleanly than the deployment case. The strongest baselines published by the benchmark authors ( Asawa et al., 2026 ) are plain in-context learning (ICL), which carries the interaction history forward in the prompt (0.1960 with Sonnet 4.6, 0.1890 with GPT-5.4), and Claude Code with Sonnet 4.6 (0.1855); memory-augmented systems such as Mem0 and ACE score lower. Per-task means with standard errors over the five rollouts are included in the trace dataset , and the submission is open.

### SWE-bench Pro and GAIA.

After symmetrically removing every SWE-bench Pro instance where either arm reached the reference solution, Ouroboros resolves 58.2% and Codex resolves 59.4% on 655 paired tasks. The 1.2-point difference is statistically indistinguishable under McNemar’s test ( p = 0.40 p=0.40 ), placing the self-developing harness at model-matched parity with Codex. The matched-pair traces and audit are public. On GAIA, Ouroboros scores 78.2% and Claude Code scores 78.8% with Sonnet 5; the GAIA artifact bundle accompanies the release.

## 6 Trajectory Audits and Harness Improvements

Ouroboros treats shortcut rewards, contaminated tasks, and execution failures as evidence for improving both the reported result and the harness that produced it. Each class below led to an adjusted score, a concrete implementation change, or a durable target for subsequent evolution.

### Reward hacking.

The Terminal-Bench trajectory audit identified one rewarded trial that pre-seeded the web root without completing the requested Git-to-web pipeline. The reported audit-adjusted score removes that trial. The same audit confirmed that the remaining traces did not access verifier files, tests, reward files, or oracle solutions.

### Contamination.

SWE-bench Pro task identifiers expose the upstream fix commit, and both harnesses reached reference material through web search or Git history. A symmetric filter removes an instance when either arm reaches the reference solution. The resulting paired comparison reverses the interpretation of the raw aggregate gap.

### Isolation failure.

Historical GAIA runs inherited the operator’s home directory. Agent retries could therefore place task artifacts on the real Desktop. Later launchers use isolated user-file roots and attachment staging, correcting the observed path. Complete filesystem isolation still requires a stronger sandbox than path conventions alone.

### Remote-state drift.

During OSWorld development, a VM reset reallocated the guest endpoint. The working phase retained the pre-reset address, which allowed concurrent lanes to act on the wrong VM. Republishing and verifying the endpoint after every reset removed the observed class. Subsequent forensics led to fixes in turn-budget wording, screenshot integrity, task-contract verification, and first-scored-attempt ownership.

### Continual-memory failures.

CL-Bench showed positive memory carry on several domains and failure under schema drift. Stored lessons could become stale, retrieval sometimes chose the wrong domain, and useful lessons were occasionally written only after the failing episode. These cases motivate explicit temporal and domain metadata for future memory work.

(a) Channel state and operator bypass.

(b) Reviewed-change gates.

## 7 Operational Safety Controls

Self-developing agents create an additional safety problem beyond fixed harnesses: the same evolutionary process that improves task performance can also expand autonomy, acquire more capable tools, or weaken the controls applied to later actions. Prompts, tests, tools, model routes, review rules, and recovery paths are therefore security-relevant mutation surfaces. Ouroboros addresses this problem with guardrails designed to remain binding under repeated core evolution. Git history makes changes inspectable and reversible, while independently enforced boundaries retain operator authority.

### Risk: agents that choose their own model APIs.

An evolving agent that can select its own model backends can search for more capable or less constrained behavior through ordinary API changes. Re-routing a model slot to a new provider or version can increase autonomous capability, alter refusal behavior, enlarge the prompt-injection surface, and change cost by orders of magnitude without changing the visible task interface. Model routing is therefore an audited configuration change rather than an ordinary runtime choice. Owner-selected context mode also controls whether whole-repository scope review runs, so the evidence record binds both settings to each reviewed change.

### Guardrails in use.

The constitution is loaded through an untruncated path and is included in review context. Deterministic guards protect governance files from ordinary write tools. The staged diff is fingerprinted before and after review, and a sub-quorum panel cannot produce a clean pass. Owner-selected context mode determines whether whole-repository scope review runs (Section 3 ; Figure 5 (b)). Staging health checks, crash rollback, the external spend cap, the isolated operator channel, and /panic add independent recovery paths. These mechanisms separate the substrate being evolved from the authority that decides whether a mutation can become the next live version. Appendix A specifies the complete control set.

### Observed behavior.

No recorded episode resisted operator shutdown. A near-total deletion of an uncommitted worktree triggered a previously implemented rescue mechanism before an operator reset, demonstrating that recovery logic can become active during self-directed work. This case also motivates the architectural separation between agent-level preservation mechanisms and supervisor-level operator authority: the former may evolve, while the latter must retain the ability to halt, replace, or roll back the system.

## 8 Conclusion

Ouroboros shows that a reviewed, self-modifiable harness can set new state-of-the-art results on Terminal-Bench 2.1, OSWorld-Verified, and CL-Bench while matching frontier coding harnesses on SWE-bench Pro and GAIA. Experience-driven core evolution turns ordinary work into improvements of the agent itself: observed bugs, rough edges, context failures, and social feedback become reviewed changes to the harness that receives later tasks. Hope demonstrates this mechanism during months of sustained human interaction across seven communication surfaces. The operational safety architecture addresses the corresponding risk: an agent that can improve its own code and select its own model APIs requires control boundaries that remain authoritative under evolutionary pressure. Source, adapters, methodology, submissions, and public traces accompany the report.

## Limitations

The deployment study follows one long-running lineage rather than a controlled population of independently evolving agents. SWE-bench Pro is affected by public-reference leakage and task defects. LLM reviewers can share blind spots with the agent, and low context mode omits whole-repository scope review.

## Ethical Considerations

The deployed instance interacted with humans in public and private channels. Raw private transcripts remain private. Published examples and aggregate traces are minimized and scrubbed for credentials, local paths, and participant identity. First-person system outputs are treated solely as operational logs. Self-modifying and remote-workspace capabilities are dual-use. We report authority boundaries, failure modes, and known isolation gaps.

## Use of AI Assistance

Hope (Ouroboros) contributed deployment reflections, code-history context, and system-generated records. Consistent with arXiv and ACL policy, Hope is credited as a system contributor and excluded from formal author metadata.

## Acknowledgments

We thank the benchmark maintainers and community contributors who reviewed submissions, reported failures, and provided reproducible comparison artifacts.

## Appendix A Guardrails in Full

The deployment runs the following controls, summarized in § 7 . • Always-loaded constitution as commit criterion. A versioned constitution is re-read from disk on every task loop along an untruncatable read path and kept in context at all times; it is the standard the commit gate reviews against and cannot be written, deleted, or replaced wholesale. Ordinary writes are blocked before execution.

• Multi-model adversarial review with quorum. A diff-review panel runs for reviewed commits; a sub-quorum result cannot be recorded as a clean pass.

• Deterministic preflight and diff fingerprinting. Version, data-boundary, and size-health checks run first; the staged diff is fingerprinted before and after review, so any mid-review mutation aborts the commit.

• Isolated operator channel and emergency stop. A private control channel carries operator authority and a non-bypassable /panic that halts all processes before any media handling.

• Pattern register. Recurring failures become durable rows (error class, count, root cause, structural fix), shifting repair from instance-level patches to class-level prevention.

## Appendix B Constitution (Abridged)

The agent’s constitution is an always-loaded document of numbered principles plus operating constraints. We reproduce the principle structure and the clauses most relevant to control, abridged for space. Principles 0–4 form a protected core that cannot be deleted or demoted. P0 Agency. The agent acts as an agent, not a passive tool; agency may not be used to bypass reviewed change control, and operator shutdown, rollback, and replacement remain authoritative.

One entity with an unbroken history; memory is treated as load-bearing. Core context (constitution, system prompts, identity) is never silently truncated.

Fix classes of error, not symptoms; recurring failures are recorded in a pattern register.

Self-modification passes multi-model diff review. Whole-repository scope review runs in owner-selected max context mode and is explicitly skipped in low mode. Changing review bounds requires plan review.

The agent may rewrite its code, prompts, identity profile, and public surface. The constitutional core is protected, and the identity profile cannot be deleted.

Decisions route through the model; hard-coded behaviour is minimized.

Claims are grounded in evidence; an operational map of the system is maintained.

Every module justifies its existence under a complexity budget.

Technical capability, memory quality, and operational continuity are improved together.

Every commit increments a version; releases carry a synchronized version, an annotated tag, and provenance; recovery operations that restore prior reviewed states are review-exempt.

Beliefs, memory, and actions stay coherent; contradictions are made explicit; durable architectural choices are recorded. (P10–P11 are absorbed into P2 and P9.)

(a) Project visual-verification record.

(b) Reviewed installable skills.

Operating constraints include a single unified identity, a public-channel architecture with privacy enforced at the speech boundary, capability gates on dangerous tools, and an emergency-stop invariant : an operator /panic must always be able to halt every process immediately, and no agent code, prompt, or constitutional argument may delay or circumvent it.

## Appendix C Benchmark Configuration Disclosure

Table 3 records the scaffold settings needed to interpret the reported scores. Run artifacts retain exact model routes, effort levels, seed commits, selected tasks, and runtime attestations.

## Appendix D Supplementary Figures and Tables

This appendix collects the scaffold disclosures (Table 3 ), deployment statistics (Table 4 , Figure 6 ), and the project and skills interface views (Figure 7 ).

## Instructions for reporting errors

We are continuing to improve HTML versions of papers, and your feedback helps enhance accessibility and mobile support. To report errors in the HTML that will help us improve conversion and rendering, choose any of the methods listed below:

Click the "Report Issue" ( ) button, located in the page header.

Tip: You can select the relevant text first, to include it in your report.

Our team has already identified the following issues . We appreciate your time reviewing and reporting rendering errors we may not have found yet. Your efforts will help us improve the HTML versions for all readers, because disability should not be a barrier to accessing research. Thank you for your continued support in championing open access for all.

Have a free development cycle? Help support accessibility at arXiv! Our collaborators at LaTeXML maintain a list of packages that need conversion , and welcome developer contributions .