# Evolution 16 — controlled self-improvement: finding and decision

**Decision: nothing new was built. Zero new invention is claimed.** The repository already contains a governed
lifecycle for admitting agent-authored skills; Evolution 16 inspected it, re-ran its tests (results in
`regression_results.json`, entry `related_mission_delegation_self_improvement`) and mapped it to the requested states.
Building a second lifecycle would have duplicated it.

## Where it already is

| Requested state | Existing mechanism | File |
|---|---|---|
| PROPOSED | signed `EvolutionProposal`; the candidate must name the SHA-256 of the exact artifact | `cain45/l5/adaptive_governance.py` (`EvolutionGate`), `cain/governed_evolution/lifecycle.py` |
| ISOLATED | each trial in a fresh bubblewrap/seccomp/cgroup process with no network | `cain/governed_evolution/sandbox_runner.py`, `cain45/confine.py` |
| EVALUATED | reproduction on known, hidden and regression tasks, run before the gate; hidden tasks are mandatory | `sandbox_runner.reproduce`, `lifecycle.propose` |
| REVIEWED | independent evaluator-signed report; authority-expansion diff; protected components; rollback-plan checks | `EvolutionGate` |
| APPROVED | promotion always needs an operator approval signed over the exact decision, from a registered operator key that is not an agent key | `lifecycle.promote` |
| VERSIONED / DEPLOYABLE | deploy through the gate; canary re-run feeding `RegressionMonitor` | `lifecycle`, `RegressionMonitor` |
| REVOKED | governance-signed rollback on regression | `RegressionMonitor` |
| every attempt | governance-signed evolution receipt | `cain/governed_evolution/receipt.py` |

Statements above are taken from the modules' own documentation and from their tests passing in this run. Evolution 16
did not audit that code line by line and did not attack it.

## Controls requested, and what was confirmed here

| Control | Status |
|---|---|
| immutable provenance, dependency digests re-checked between evaluation and promotion | present (documented; tests pass) |
| isolated, reproducible evaluation against a fixed corpus | present; the corpus is developer-authored |
| adversarial tests | present: `cain/governed_evolution/red_team.py`, `tests/governed_evolution/test_red_team.py` |
| comparison with the previous approved version | present (`benchmark.py`) |
| separation of author, evaluator, approver | approver must not be an agent key; evaluator is a separate signing key. **All keys are in one process in the tests**: this is separation of keys, not of people or organisations |
| prohibition on self-approval and authority expansion | present: a skill whose authority exceeds the deployed baseline is quarantined |
| post-deployment regression monitoring and rollback | present |

## Kinds of test evidence, kept apart

| Kind | Present for this lifecycle |
|---|---|
| developer-authored deterministic tests | yes |
| model-generated tests | none identified; **the Evolution 16 tests in this evolution were written by an AI coding agent** and are therefore not independent verification of the Evolution 16 code |
| external evaluation | none |
| independent human review | none |

## Gaps that remain (not closed by Evolution 16)

1. An admitted skill version is not bound into the mission contract: a mission cannot yet say "only skills at these
   digests". This would be a small extension of `MissionSpec` and the natural next integration.
2. No measurement with a real self-improving agent. The published attacks (EVOMAL, "Practice Makes Unsafe") were not
   reproduced against this lifecycle.
3. Memories, routing rules and evaluators are not admitted through this lifecycle; only skills are.