Evolving Agents Labs

The organisation's only active project

ai-os — agent work you can check, and prove.

“Why another agent framework?” It isn't one. Everyone can generate. Almost nobody can tell you, six months later, whether the number in their README is still the number their code produces — and prove it to a stranger. That is the layer this builds.

Truth generated by code that is forbidden to import the code under test. Gate reports a kernel reads without caring what language the work is written in. Runs that are content-addressed and hash-chained, with the environment recorded inside the artifact. And every number published here tied to the artifact that produced it — checked in the repository nightly, and on this page by the same script before it is published, because a website is exactly the surface where a number goes stale unwatched.

It is an agent-based operating system, built on QM — and that part is the how. The paragraph above is the why.

Try the desk → Check the numbers yourself Repository

The first is the demo: the real client, with a simulated backend so nothing is installed and nothing is spent. It opens on coclea-sr — every box an agent, the lines between them the handoffs, and the dot on a line the thing that actually moved. The orchestration is simulated; the numbers those project scopes show are read out of the projects' own artifacts. The second link is not a demo at all — it is the evidence, with real artifacts re-derived in your own browser. Use the first to see what this is. Use the second when you want to stop taking our word for it.

ai-flowsai-ui ai-storageai-base

The strong version of this argument is false, and we measured it

The pitch that would sell better is “a model cannot tell whether its own output is wrong.” It is not true. A companion experiment handed a frontier model twelve fabricated physics results and nine subtly defective ones, and it caught all of them, twice — naming causes at the level of “the boundary treatment at the free end fails to halve the control volume” (results).

So the claim is the narrow one that survives it. A model can judge a task; it cannot generate one with a known answer — you do not create truth by asserting it. And a judge that is right every time still hands you no ledger, no freeze and no reproduction command. Detection is not the same product as attestation, and the second is what a reviewer, a regulator, or a colleague six months later actually needs.

What it caught, in one day, on its own author's work

The checkers were finished on 2026-08-23 and immediately run by somebody who had never run this system. None of these was reachable by reading the code:

  1. A published count wrong in thirteen places for six days. The gate count had moved from 26/125 to 28/135 and the documents had not. The check that existed guarded one number and not the next one.
  2. An attested report that could not have come from the code beside it. The artifact was regenerated in the middle of the very commit that existed to make it reproducible, and nothing ever compared the two.
  3. A reported statistic that moves with a library version, not with the data. 66 of its 98 measurements are exactly zero, so one value crossing into that tie block drags a rank statistic by 0.054 — while every other number in the same report is bit-identical across machines.
  4. A transposed row in a table nobody had ever compared to its own artifact.
  5. A defect in the new instrument itself, found by using it: a 45-minute evidence run that any unrelated push could cancel.

Neither project could be started from its own documentation either — one carried a committed symlink to a path on one laptop, the other had no dependency manifest at all. A single-author project cannot find that for itself, because the author always already has it working.

What the same day also produced, on the other side of the ledger: the gate suite ran 135 checks green in 23 minutes 27 seconds on a CI runner — the first time the whole thing has executed anywhere but the author's machine — and the H0 report from the second project reproduced 1,207 of 1,207 fields bit-identical on a third environment. The attestation machinery did its job on hardware it had never seen. The project that did not have that machinery is the one that had the problems above.

Four questions today's agents cannot answer

  1. What is this agent working on? A list of sessions. A session is a conversation, not a unit of work — no declared goal, no success condition, nothing that survives compaction.
  2. What does it know, and why? A file. One flat namespace per scope, capped, dropping the oldest fact when it overflows.
  3. What is it looking at? A chat log — the right metaphor for a conversation, the wrong one for work spanning weeks.
  4. Can I branch this and rejoin it? You can fork. Nothing records that it forked, so nothing can ever diff or merge it.

Four pillars

ai-flows

What if the unit of work outlived the conversation?

Runs. A flow is a declared, persisted, resumable object with a goal, a shape, a state and a lineage. Agents and their sub-agents are markdown files; a declared tree executes as real work. A flow started by one process is finished by another, after a restart and after context compaction.

ai-ui

What if the interface were the state, not the transcript?

Runs. A desk: flows are documents, agents are cubes that stack on them. Drag a cube onto a document and that agent gets a step in that flow. The system composes the arrangement from the flow's state and never re-arranges what you moved.

ai-storage

What if memory had an address space?

Four levels — system, user, project, flow — with different lifetimes. Flow memory is expected to die. Promotion between levels is explicit, recorded and reversible. The first piece of it runs: a project knowledge base an 8,000-token window can navigate. A flat file of the same material stops fitting at 16 units; the index is still at 4,523 of 8,000 tokens at 2,000 notes — and where it does run out, at ~15,000, is written down rather than left to be discovered.

ai-base

What if we did not rebuild the part that works?

QM, vendored as a subtree and pulled weekly. Identity, scopes, sandboxes, policy, audit and six model harnesses. We did not write it and we are not rewriting it.

Where this actually is

Three pillars run. ai-base is vendored and runs. ai-flows runs — the flow engine, a signed HTTP API, multi-agent composition from markdown-declared trees, and the measurement harness below. ai-ui runs — the desk pictured here. 626 tests of our own, on top of the 3,768 ai-base carries from upstream. Memory is now agents rather than a store — an archivist that decides what one unit of a document is, an indexer that writes one note per unit against an index that has to keep fitting, a reconciler, a librarian and a coverage auditor, all of them markdown files. Every decision is an agent; every mechanic is code. The rest of ai-storage is still specified and not implemented. Nothing on this page describes running software unless it says so.

A desk: two flows as documents with agent cubes stacked on them, and a panel showing a flow digest, a menu of proposed actions with their cost, and an answer read out of the flow's trace

Above: two flows index the same notes with the same five agents, and both are green. The right-hand panel is where that stops being true — the digest counts a step that used nothing it was given, the menu offers it as somewhere to look, and the trace names what caught it. That panel is the answer to "how do you inspect this, and how do you interfere".

Open the desk and use it → — press Play and it walks itself through the whole vocabulary, or take over at any point: a real gesture stops the tour where it stands. Every beat is the real client receiving the events a hand produces, never a recording, so if the desk breaks the tour breaks. It is the real interface with a fake backend behind it, so nothing is installed and nothing is spent.

Everything on it is an agent, and the flows of information are the thing you see. A flow is a path through the agents; each line is a handoff and the dot travelling it is what moved. Click the line and you get the address the observation was recorded at. A hop nobody recorded is drawn thin, grey and dashed and carries no dot at all — because did not run is not passed, and a picture that draws them alike has thrown away the distinction this whole project is about.

One panel inspects whatever you select, in two positions. Read it gives you the object's real fields. Ask an agent hands it to INSPECTOR — an agent like any other, with one tool: read. Drag that cube onto a flow and it reads it; the sentence it comes back with carries the address it read, one click away. When it has nothing to read it is required to say unknown rather than guess, and the desk draws that differently from an answer. That is the argument of this whole site, as a thing you can do with a mouse.

It opens on coclea-sr: two chains, the same six agents, the same six steps, both green — and one of them wrong in every number it reports. Nothing in either trace separates them. A gate does, declared before the run. The second scope is hemo-verified, where no closed form exists, so the judge itself goes on trial: the oracle panel scores 0.9056 against a kill threshold written down in advance, while six of its seven members are near a coin flip alone.

The agents are alive on it now: each one is a creature that blinks while it waits, narrows its eyes while it runs, and says which step it is on. Give an agent work in a second document and it splits in two; take the work away and the extra one walks back into the first. And a companion, Cubi — the same creature at twice the size — watches what you touch, walks over to whichever agent you clicked, and asks it; the agent answers for itself, in the first person, out of its own record. When a step finishes, watch the result travel to the next agent: it arrives as a green square, or it falls short and drops on the floor in red, which is that flow's own trace saying the step carried nothing.

Then switch the scope to group:signal-lab — the same desk, on numbers. Two flows hunt a 5 Hz tone under a mains hum, with the same six agents and the same six steps, and both are green from end to end. One found the tone at bin 5; the other lost it at step 2, to a fixed-point conversion with the scale entered wrong, and answers "strongest component: bin 0, magnitude 0.00" with exactly the same confidence. Nothing in the interface knows what a Fourier transform is: the same digest, the same trace and the same "carried nothing forward" flag find it, and the evidence is a flatline you can see from across the room.

And a third, group:memory-lab: the memory agents turning a heap of notes into a knowledge base a small window can navigate. Two flows index the same material with the same five agents and both are green — but one contains a note that claims 663 characters of a passage that is 1,105, so following its range lands on different words and the hash meant to prove otherwise is of text nobody can find. It looks exactly like the others, which is why the check is code and not a prompt.

On the right, Documents — the surfaces that change while you are looking at them. Four kinds, and the two marks that matter: a dot when something is writing to it with nobody waiting, and whether you may write back. A flow being run by agents is read-only and alive; the project chat is yours; the log of what the agents said is a record and nobody types into it. Read-only is a property of the document, not of the panel. Wake its optional brain and a small language model loads into your own browser to answer freely, with everything it invents marked in red against the trace it was given.

A document is a flow; a cube is an agent; a cube resting on a document means that agent has work in that flow. Dropping one there is not a view change — it appends a real step, the same instruction composing an agent tree would have written. Positions persist per scope, and the system never re-arranges what you moved.

The panel on the right is the part a GUI could not have done. The digest states how many attempts it stands for and over what window, because a flow changes faster than anyone looks at it and a summary that drops an attempt reads exactly like a clean one. The menu is derived from this flow's state rather than fixed, and every entry carries the evidence that produced it and says whether pressing it spends. The answer is read out of the trace and never the goal — the goal is what somebody meant to happen, and it reads like an answer even when the work was never done. Asking with no evidence recorded costs nothing: it says so instead of buying a turn to tell you there is nothing there. What this does not establish is whether it helps. Its own falsification is a stopwatch — a person, a three-day-old flow they did not run, desk against transcript — and that has not been run.
Every scope level, its members and the agents each defines
Organisation, projects, groups and individuals — with each scope's roster and its agent tree, from a live instance. The interface borrows its vocabulary from System 7: one colour per kind of thing, so what you are looking at is legible before you read it. AnomalyScanner is struck through because it is declared in an agent's markdown and has no file — a declared name is a claim, a file is a fact.

Each pillar ships with the measurement that would show it is not worth building, written before the code. Two have now come back and neither flattered us. A flow does survive what a plain session loses — proven by starting one in one process and finishing it in another, on two harnesses. And the question of whether adding a reviewer to an agent tree helps came back unmeasurable: across four attempts the producer was already correct, so a review stage had nothing to add.

That second result is the one worth reading. It is the shape of Google's g-AMIE study, where physician oversight of an agent improved 6.7% of cases and reduced quality in 21.7% — oversight adding least where the output was already strong. Our first run appeared to reproduce it, reporting a reviewer that damaged a correct answer. It was an artefact of a check that scored “The answer is 24.” as wrong, and retracting it invalidated four other numbers. All of it is written up rather than deleted, because a finding that was wrong and the reason it looked right is the most useful record we can keep.

The demo, and the thing that is not a demo

There is one demo, and it is the desk above. The real client, generated from source so it cannot drift from the product, with a simulated backend so nothing is installed and nothing is spent. It is what shows you the system: flows as documents, agents as cubes that stack on them, a step you append by dragging, a trace you open. Two honest limits travel with it — the pillar it shows has never had its own falsification run, and because the backend is simulated, every number on it is invented.

Which is why the second link is not a demo. Real artifacts out of projects/, embedded verbatim, checked in your own browser with no network and no server: the hash chain re-derived entry by entry, run directories shown to be the first twelve digits of their own contents' hash, six published sentences resolved out of the runs that produced them, and the one statistic that moved between library versions sitting red among seven that did not. Edit a ledger entry from the page and watch exactly one link break; re-chain the tail and watch the break vanish and the head move instead. The code doing it is a second implementation, in a second language, of the repository's own verify_ledger.py — because a verifier sharing code with what it verifies checks self-consistency, not truth. It illustrates nothing about how the system works, on purpose: it exists so that the numbers the system produced can be checked by somebody who has never met us.

The workload that makes it real

COCLEA-SR is a biophysics hypothesis from 1995 — that the ear uses noise to detect signals too weak to cross a threshold — taken end to end on this system. It is here because the answer mattered to one of us, which made it dangerous in the right way: a beautiful graph confirming a thirty-year-old intuition would have taught nothing.

The system's first important answer was that the model was wrong. The traveling wave died before reaching the place the same model said it should peak — the response fell twenty-eight orders of magnitude before arriving — because the membrane impedance sat in the numerator of the local wavenumber instead of the denominator. Not a bug. The abstraction. The replacement was accepted against a condition registered before it was built, and only then did the original question get to run: 24 of 24 curves show the pre-registered interior maximum, at 11.6% of a parameter-free prediction with nothing left in it to tune.

Then the part nobody was aiming at. The old operator's only knobs were the membrane's own tension and mass, and no drug reaches either. The replacement put the fluid inside the operator — and fluid is what a diuretic acts on. A falsified model was replaced by one with a therapeutic surface: seven pathologies, each entering on a different parameter, each producing a different signature, and the discrimination itself gated. It predicts, among other things, that an ototoxicity monitoring protocol should watch the compression knee rather than the audiogram, because the two move with different powers of the same parameter.

28 gates, 135 checks, all green. And the page linked below is honest about the four things it does not show — including a companion experiment that came back against the usual argument for gates, and our own ratio experiment which came back null: ten flows, three mixes of exploring and verifying agents, 100% accurate in every arm and zero corrections. Verification bought nothing because nothing was ever wrong, and the rule that would have caught that before we paid for it was already written in our own contributor guide.

Read the whole arc →

The predecessor of this project shipped eighteen thousand lines describing five subsystems and three test functions — an architecture written down and never pinned to anything that could contradict it. This is the correction.

Archive

Twenty-six frozen experiments, 2025 – 2026.

Agent memory, self-modification, interpretability and constrained decoding — each labelled by how much evidence stood behind it, including the ones where the evidence went against us. Kept because they are still true, not because they are maintained.