Architecture: the self-engineering loop

The lab's AI proposes changes to its own orchestrator; a human promotes every one, behind a canary and a full test gate. How a change reaches the live system, and what stops it.

human-gated deploys canary + test gate sandboxed proposals auto-rollback

Click the map to enlarge.

ISOLATED SANDBOX · cannot reach live
AI proposes · plan, edit, unit tests
adversarial review · critique + dispute
checkpoint
deploy tools are stripped inside the sandbox
↓
CANARY
canary · built on a separate port
2,424-test gate + health checks
a failed canary rolls back on its own; the live copy stays untouched
↓
HUMAN GATE
a human promotes · the only manual step, no path skips it
↓
LIVE
orchestrator · cut over, verify health
↻ the loop continues

Safety invariants

The loop is deliberately slow. Every one of these is a mechanism, not a promise, and the human gate is the one that cannot be automated away.

Sandbox-only. Agent edits run in isolated workspaces with the deploy and live-apply tools mechanically stripped.
Human-only promotion. Nothing reaches the live system without a human promote, and no path skips it.
No self-arming. The AI drafts and proposes work, but is blocked from feeding its own future queue.
Full test gate. The canary must pass the pinned regression suite before a promotion is even offered.
Auto-rollback. A failed canary or live check reverts on its own; the live copy is never left half-deployed.
Execution never grades itself. The system records the model, host, context, and tool trail, but a separate pass grades the answer, not the model that produced it.

The lab's AI improves its own orchestrator, and a human promotes every change. The agent plans, edits, and tests inside an isolated workspace whose deploy tools are stripped; an adversarial review grounds its claims in evidence and lets the author dispute a finding; and only then does a canary on a separate port run the full test gate. Nothing reaches the live system until I promote it by hand, and a failed canary reverts on its own. The incident that started this loop, the mechanisms it shipped, and the five-pin regression that closed it are on the self-engineering write-up. It runs on the Home AI orchestrator under the Operating Doctrine the agents follow, and its machinery is inherited by the Native Intelligence program. The fleet it changes is drawn across the architecture maps, starting with the lab overview.