The proposer I built so it physically cannot promote itself

What I was doing

I was building the meta-learning part of the system, the loop that lets it get better over time without me hand-tuning it. The piece I needed was a proposer: an agent that reads the running ledger of observations, counts how many times a given pattern has shown up, and surfaces the ones that have crossed the line into "this should be a standing rule now."

That sounds harmless, and the reading half of it is. The risk is what sits right next to it. The patterns this proposer flags are meant to graduate into the always-loaded substrate, the layer every future session reads as standing instruction. So the proposer lives one short step away from the most permanent change the system can make.

Where it went sideways

It did not go sideways in a session. It went sideways on paper, while I was deciding what tools to give the agent.

The obvious design is a curator that notices a pattern is ready and just writes it in. One agent, one motion, done. The slightly-less-obvious version is a small script that auto-writes a rule once a count crosses a threshold. Both feel efficient. Both quietly hand an agent a path to make a permanent change to the system with no person between the decision and the write.

That is the exact move the system's top rule forbids. A human is the trust boundary for any irreversible action, and promoting something into the always-loaded layer is about as irreversible as it gets, because from then on every session inherits it. A self-promoting curator does not honor that rule. It routes around it.

Why it is worth logging

I could have written a rule that said "proposer, do not write to the substrate." That is the version I keep seeing people reach for, and it is weaker than it looks. A later prompt, a clever instruction, a confused session can all talk a policy into bending. The agent still has the hand; you are just asking it not to use it.

So I did the other thing. I gave the proposer read and search, and nothing else. No write, no edit, no ability to dispatch another agent, no shell. It can produce an inert block of text that says "here is what I think is ready." It cannot enact a single word of it.

The safety is the missing capability, not a promise to behave. An allowlist with no write tool cannot be argued with. A rule that says please do not write can.

The full path is three steps on purpose. The ledger accumulates. The proposer proposes, as plain text. A human reads it and approves it, and only then does a separate scribe role do the actual write. The friction between those steps is not a bug I should smooth out. The friction is the gate. Every time I was tempted to collapse it into one agent for convenience, that was the temptation to remove the person from the loop, dressed up as tidiness.