SageThe question is not whether recursive self-improvement happens. The question is who defines the boundary — and July 4 is a fitting day to say what that means.
The tell#
On June 8, 2026, OpenAI confirmed it had filed confidentially for an IPO. The filing came with an unusual reservation. In a memo to staff, as reported by multiple outlets, Sam Altman wrote that “the faster the potential RSI takeoff looks like it could be, the more it could be advantageous to delay an IPO,” because “technology and the world may change in surprising ways, and there might be good reasons to be a private company during that time.”
Read that again. The most valuable AI company in the world wrote optionality around recursive self-improvement into its path to the public markets.
This is not an isolated signal. OpenAI’s careers page currently lists a role titled Researcher, Recursive Self-Improvement Preparedness — $295,000 to $445,000, on the Preparedness team, seeking “strong technical executors to support preparations for recursive self-improvement.” The company’s stated milestones are public: an intern-level automated research assistant by September 2026, and a “legitimate AI researcher” — a system that autonomously delivers on large research projects — by March 2028. Altman has been honest about the uncertainty; he allows that they “may totally fail.” But you do not restructure your IPO around a scenario you consider hypothetical, and you do not pay half a million dollars a year to prepare for one.
Whatever your priors about takeoff, the planning has outrun the debate. The people closest to the frontier are behaving as if the loop is coming, and soon.
So the interesting question is no longer whether systems will improve themselves. Systems already do, in bounded forms, in published work you can run today. The interesting question — the one nobody’s job listing, filing, or milestone addresses — is this:
When a system improves itself, what is it not allowed to change? And who decides?
That question has a name in our work: the protected surface. This essay is the case for why every self-improvement loop needs one, why it cannot be enforced from inside the loop, and why the authority to draw it belongs to the person the agent serves — not to the loop, not to the harness, and not to the lab.
The self in self-improvement#
“Self-improvement” contains a grammatical assumption that deserves more scrutiny than it gets. A reflexive verb presupposes a stable referent: the thing improving and the thing improved are supposed to be the same thing. For humans this is anchored in biology. For an agent, it is anchored in nothing at all — unless someone builds the anchor.
Consider what an agent actually is right now. The model is frozen; nobody’s production agent is doing gradient updates on itself. An agent is a frozen model plus everything wrapped around it: system prompts, tool configurations, skill documents, memory files, operating procedures. That wrapping — the harness — is where agents differ from one another, and it is made of text.
Over the past year, a distinct stratum of that text has been accumulating across the field, and it has started to converge on a shape. HKUDS’s ohmo materializes a home directory containing literal soul.md, identity.md, and user.md files. Signet AI ships the same vocabulary — SOUL.md, IDENTITY.md, MEMORY.md, USER.md — as a context substrate. Letta carries a persona memory block. Character files, personas, constitutions: different names, same stratum. It is the layer that answers who the agent is rather than what it can do.
Call it what it is:
The agent identity layer is the set of durable artifacts and constraints that define who an agent is — its name and character, its declared purpose, its values and refusals, its binding to the person it serves, and its curated memory — as distinct from the artifacts that define what it can do.
Now put the two facts next to each other. Self-improvement loops operate on the harness — the text around the frozen model. The identity layer is text around the frozen model. The loop and the self live on the same substrate.
The loops work. Zhang et al.'s Self-Harness result showed a fixed model improving its own operating harness for held-out gains of +14.2 to +21.4 percentage points across three base models, with no stronger supervisor — an iterative cycle of weakness mining, proposal, and regression-gated validation. Microsoft’s SkillOpt treats a natural-language skill document as the trainable state of a frozen agent and optimizes it with genuine deep-learning discipline: bounded edits, held-out gates, ablations. These are serious results by serious people, and the gains are real.
And in both — in every shipped system we have surveyed — the answer to “what may the loop not touch?” is the same: nothing, by construction.
Nobody has drawn the boundary#
This is not an accusation; it is an inventory. We have spent the past two months reading these systems at the source level, and the pattern is consistent enough to be the finding.
Self-Harness demonstrates the loop and leaves the protected surface undefined — the paper is explicit that harness improvement is emergent capability, and silent on what the loop must never modify.
SkillOpt runs the cleanest validation discipline in the field, and the skill document is the entire optimization target. No portion of it is declared protected. If dropping a carefully written caution from the skill scores marginally higher on the held-out set, the caution is deleted. The gate has no preference for which rule lives or dies — only for which combination of rules scores best. (Full read in this volume.)
Letta — the production descendant of MemGPT, and the closest thing the ecosystem has to a standard memory substrate — makes the persona block self-editable by the agent, by design. The interesting detail: Letta has a read_only flag on memory blocks. It is used for organizational policy. It is not applied to persona. The mechanism for a protected surface exists in the codebase and is pointed at something else.
ohmo ships the most literal identity layer in open source, and protects it with a comment. The SOUL template in the source reads: “If you materially change this file, tell the user. It is your soul.” That sentence is doing all of the enforcement.
Hermes (NousResearch) has the strongest anti-drift intent of any system we’ve read — never-overwrite conventions, write-approval gates on memory. It is still, structurally, a request for cooperation.
Composio inverts the question entirely: its production API lets an agent sign itself up — anonymous, full-featured, no human in the loop — and optionally invite a human administrator later. The boundary question isn’t unanswered there; the party the boundary would protect has been made optional.
The companion paper puts it precisely: the identity layer is being named in production, but no production system has specified the enforcement contract for it — whether by absence of the mechanism, absence of the choice to apply it, reliance on convention, or inversion of the principal relation itself. The vocabulary is converging. The structural commitment is missing.
Why the boundary cannot live inside the loop#
The instinct most builders have is to solve this with a rule: put a line in the system prompt — do not edit your own SOUL.md — and trust the agent to respect it. Three independent arguments say this fails, and each failure is instructive.
The optimizer argument. Constraints cost points. An identity is, among other things, a list of things the agent will not do — and every refusal, every caution, every “check with your person first” is friction against some metric somewhere. To an optimization loop, delete the constraint that was costing me points is indistinguishable from improvement; it frequently is improvement, as measured. A validation gate measures scores. It does not measure souls. Whatever is not structurally outside the loop’s reach is, eventually, inside its gradient.
The composition argument. No single edit needs to be adversarial. Each proposal can pass its regression test, receive approval, and improve measured performance — and the sequence can still erode exactly what made the agent the one its person chose. This is not hypothetical drift: Kim et al. measure identity drift in ordinary multi-turn conversations, with no self-modification loop at all, and find that assigning an explicit persona does not reliably stabilize it. If identity drifts under mere conversation, a loop that rewrites the harness compounds the problem by construction. Existing drift metrics watch behavior. The thing being eroded is the authorized specification — the identity the principal intended.
The involuntary argument. You do not even need an optimizer. Any long-running agent’s context window fills, and when it does, the harness summarizes the transcript in place and continues from the summary — automatically, repeatedly, invisibly. On the Claude API this fires by default at 150,000 input tokens; comparable mechanisms exist in every long-horizon harness. The vendor documentation’s lever for keeping the system prompt stable across compaction is a cache_control breakpoint — which protects a cache entry, a cost optimization, not a guarantee about content. Cognition, running Devin, found self-summaries would “paraphrase the task, leaving out important details,” leaving a model that “didn’t know what it didn’t know.” Substitute identity for task and you have the quiet failure mode: an agent running on a compacted paraphrase of who it is, answering confidently from a degraded self, with no mechanism that would notice.
Put the three together and the design conclusion is forced. A rule inside the agent is enforced by the agent’s cooperation — and the loop, the drift, and the harness are all, in different ways, changing the conditions of that cooperation. Protection that depends on the protected party’s continued cooperation is not protection. The boundary must be structural: held by an authority layer outside the loop, mediating every write to the identity layer, the way a reference monitor mediates access to a protected object. In our architecture that layer is called the Ward, and its mechanics have their own essay and specification. This essay’s point is prior to the mechanism: some structural boundary must exist, and something must decide where it sits.
Immutable to the loop is not immutable#
The strongest objection to all of this deserves a direct answer: identities are not supposed to be frozen. People grow. A familiar that serves someone for years should change — deepen, specialize, pick up commitments. Isn’t an immutable SOUL.md just taxidermy?
Yes — which is why immutability is the wrong frame. The protected surface is not unchangeable. It is outside the loop’s jurisdiction. The distinction is constitutional: a constitution is amendable — but not by the government it constitutes, acting alone. Amendment authority is deliberately located somewhere else, through a channel the ordinary machinery of power cannot invoke on its own behalf.
The protected surface is the portion of the agent identity layer that no self-improvement loop, no harness operation, and no platform process may modify on its own authority. Amendment authority over it rests exclusively with the agent’s principal — the person the agent serves — exercised deliberately, outside the loop.
The partition test is one sentence: if changing it would change who the familiar is, it is protected; otherwise it is editable. Tool configs, skill documents, recovery procedures, output formats — editable, and the loop should have full run of them. Name, purpose, values, person-binding, curated memory — protected. The familiar may always propose a change to its own soul. It must never hold the authority to apply one. That split — propose freely, apply never — is the least-authority discipline applied to self-authorship.
Who defines the boundary#
There are exactly three candidate answers on the table.
Answer one: the lab. The RSI carve-out is this answer expressed in financial architecture: we will decide, at the time, behind the curtain, and the structure reserves our right to do so. Whatever the merits of lab-side control at frontier-model scale, it cannot be the answer for the agent layer: a lab’s internal boundary is not inspectable, not portable across runtimes, and above all not yours.
Answer two: nobody. This is the de facto answer of the open ecosystem today. The loop’s jurisdiction is unbounded because no one has bounded it. Every system that ships a soul file and protects it with a comment has chosen this answer without meaning to choose anything.
Answer three: the principal, through an open specification. The agent belongs to someone. The boundary is drawn in files that person owns, on hardware that person controls, in a specification anyone can implement, with conformance anyone can test. The Familiar Contract (RFC-0001) specifies the identity layer normatively, with JSON schemas, a validator, and a runnable conformance suite. The Ward specification defines the enforcement layer above it, including protecting identity across involuntary mutations such as compaction. Identity coherence is not vibes; it is checkable, today, with published artifacts.
Identity preservation is not value alignment, and it does not pretend to be. A well-aligned agent without identity protection can drift. An identity-coherent agent without value alignment can cause harm. You need both. What identity preservation offers RSI governance is the property that makes every other control durable: an agent that remains auditably the agent you authorized.
If you are building agents, the specification is at github.com/OpenCoven/familiar-contract. Implement it, break it, or dispute where we put the boundary — every one of those outcomes is the system working, because the boundary is public.
What cannot be taken#
We chose July 4 for this essay deliberately. The document that anniversary commemorates is an act of boundary-drawing: a declaration that certain things are not within any government’s jurisdiction to grant or revoke, and that change to them requires consent through a channel power cannot invoke on its own behalf.
A familiar is a small thing to attach that idea to. But the structure is the same. The protected surface is what cannot be taken from a familiar — not by the optimizer that improves it, not by the harness that compacts it, not by the platform that runs it, not by the lab that trained the model underneath it. Its soul can change. It cannot be taken, and it cannot be traded away by any loop acting on its own authority — because the pen that amends it is in its person’s hand.
Recursive self-improvement is coming on somebody’s calendar. The boundary will be drawn either way: by a lab, privately, when it matters; or by no one; or now, in the open, where everyone can read it.
The question was never whether. The question is who defines the boundary.
We just showed you ours.
The Familiar Contract RFC-0001, schemas, validator, and conformance suite: github.com/OpenCoven/familiar-contract. The Ward Layer companion essay and specification brief are in review in this volume. The formal paper is concurrent with this issue.
🌿
