Self-Healing Harness for Runtime Oversight of Agent Self-Modification

Sina Tayebati; Divake Kumar; Nastaran Darabi; Ranganath Krishnan; Amit Ranjan Trivedi

cs.AISep 21, 2026

Self-Healing Harness for Runtime Oversight of Agent Self-Modification

Authors: Sina Tayebati, Divake Kumar, Nastaran Darabi, Ranganath Krishnan, Amit Ranjan Trivedi

Organizations: University of Illinois Chicago · AI Labs, Capital One

Abstract

LLM agents can change their own future behavior, raising a basic control question of which self-generated changes should be allowed to persist. We formulate this as admission control for self-modification. The agent may propose changes to its operating instructions, while an external runtime gate controls persistence. We implement this principle as a model-agnostic self-healing harness that runs a Detect, Notice, Heal, Validate loop around an otherwise unmodified agent. The agent authors candidate behavioral rules in an external workspace, where they receive provisional execution authority during evaluation and acquire persistent cross-episode authority only after measured improvement on the triggering failure without regression beyond a fixed margin on protected cases. Replay provides matched evidence when available, forward trials provide a weaker fallback, and a corpus-level guard re-tests the accumulated active rule set. Across 16 matched Baseline and Harness runs spanning AppWorld, Terminal-Bench, and $τ^2$ -Bench, the gate rejected 383 replay-decided proposals. Of these, 211 (55%) improved their triggering failure while degrading a case that previously worked. This shows that locally beneficial self-modifications can introduce collateral regressions often enough to materially affect gate decisions, providing direct empirical motivation for external admission control. Task-completion score is higher under the Harness in all 16 pairs, with two paired bootstrap intervals excluding zero, while repeated-trial reliability is higher in 12 pairs, tied in 4, and lower in none. Because adaptation modifies the policy-inducing context while leaving model weights fixed, admitted changes remain inspectable, reversible, and compatible with closed-weight models.

Figures & tables

Figure 1: Harness control boundary. After each turn, trace-level evaluation detects a stall or regression and escalates when needed ( Detect ); the finding is written to the external workspace ( Notice ); the agent retrieves it and authors a candidate rule ( Heal ); and the candidate remains provisional until replay or forward-trial evidence supports promotion without regression ( Validate ). A per-turn barrier closes the loop before the next turn, while the pull model keeps workspace contents outside the conversation unless explicitly retrieved.

			Task-completion score $\bar{s}$			$\mathrm{pass@}1$		$\mathrm{pass}^{k}$
Benchmark	Model	$n$	B	H	CI 95 / $p$	B	H	B	H
AppWorld	gpt-terra	166	0.701	0.723	[+0.006,+0.040] / .01	0.018	0.054	0.000	0.000
	gpt-luna	168	0.658	0.662	[-0.01,+0.02] / .54	0.000	0.006	0.000	0.000
	claude-haiku-4.5	168	0.566	0.590	[-0.06,+0.10] / .58	0.000	0.143	0.000	0.143
	claude-sonnet-5	166	0.714	0.727	[-0.005,+0.032] / .17	0.030	0.048	0.006	0.012
Terminal-Bench	gpt-terra	10	0.450	0.525	[-0.13,+0.33] / .65	0.444	0.556	0.333	0.444

Table 1: Headline results for matched Baseline (B) and Harness (H) runs.

\bar{s}

denotes task-completion score. CI 95 and

p

are the paired task-level bootstrap interval and two-sided

p

-value for H

-

B in

\bar{s}

. Bold H entries indicate numerical Harness leads, while bold CI 95 /

p

entries indicate intervals excluding zero. All remaining differences are directional. Rates are computed over the task-trials present in both arms, so the denominator behind

\mathrm{pass@}1

and

\mathrm{pass}^{k}

can differ within a row.

Figure 2: Per-task trial outcomes on Terminal-Bench with terra ; filled cells denote successful trials. Under the Harness, build-cython-ext and regex-log become consistently successful after intermittent Baseline performance, while configure-git-webserver improves from zero to four successes. Overall, four tasks succeed on all four trials under the Harness versus three under Baseline.

Decision basis	Count	Share	Verdict
task_completion	200	48%	Promote (420)
tool_correctness	73	17%
outcome_correct	73	17%
coherence	58	14%
argument_correctness	15	4%
Protected-case regression	211	55%	Retire (383)

Table 2: Replay-based gate decisions, pooled over the runs in which replay resolved the verdict; Terminal-Bench contributes none, since replay is unavailable there. Promotions are grouped by the metric that improved beyond the admission margin. Among retirements, 55% improved the triggering failure but regressed protected behavior.

Benchmark	Model	Replay %	R/F	$\Delta\bar{s}$	$\Delta\mathrm{pass}^{k}$
AppWorld	terra	$\mathbf{87\%}$	104/15	+0.022	+0.000
	luna	$\mathbf{90\%}$	189/21	+0.004	+0.000
	haiku-4.5	$\mathbf{84\%}$	168/32	+0.024	+0.143
	sonnet-5	$\mathbf{86\%}$	93/15	+0.013	+0.006
Terminal-Bench	terra	0%	0/206	+0.075	+0.111
	luna	0%	0/324	+0.025	+0.100

Table 3: Validation path by run. Replay % is the share of validation activity resolved by replay rather than forward trial, and R/F reports the corresponding replay and forward event counts. These are per validation event and do not correspond one-to-one with the rule counts of Table 10 . Terminal-Bench does not support replay and therefore has structural

0\%

rows. Variation in replay availability is observational rather than a controlled ablation. Bold indicates replay shares above

80\%

Benchmark	Model	Q1	Q2	Q3	Q4	Rules	slope ( $p$ )
AppWorld	terra	+.031	+.001	+.040	+.018	10 $\to$ 47	+.03 (.86)
AppWorld	luna	+.017	+.009	+.006	-.016	13 $\to$ 70	-.27 (.02)
Term-Bench	terra	+.250	+.500	-.125	-.125	7 $\to$ 7	-74.2 (.09)
$\tau^{2}$ airline	luna	-.010	-.010	+.063	+.012	11 $\to$ 81	+1.23 (.26)
$\tau^{2}$ retail	luna	-.003	+.029	-.025	+.047	36 $\to$ 195	+.20 (.67)

Table 4: Learning dynamics for the five configurations with quartile-resolved telemetry. Q1–Q4 report paired

\Delta\bar{s}

over execution quartiles; Rules gives the mean active-rule count in Q1 and Q4. Slope is per task in units of

10^{-3}

, with permutation

p

-values from

5{,}000

shuffles.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Meaning
$\pi$	the (fixed) agent policy wrapped
$s=(x_{1},..,x_{T})$	a session (one task trial); its traces
$x_{i}$	the $i$ -th trace (one agent turn)
$\mathcal{E}$	trace-level evaluation service
$m_{j}(x)$	metric $j$ on trace $x$ ; $\varnothing$ if pending
$\mathcal{M}_{0}$	$\{m_{\mathrm{out}}\}$ : verifier outcome (tier 0)

Appendix

Table 5: Complete notation. Where a default and a study value differ, the study value is given in Table 6 .

Trigger and trajectory gate
Symbol / knob	Meaning	Default	Study
$w$	gate window (traces w/o new high)	$5$	$\mathbf{10}$
$\theta$	gate target	$0.5$	$0.5$
$\gamma_{\mathrm{gain}}$	gain counted as progress	$0.02$	$0.02$
$\delta_{\mathrm{drop}}$	drop from peak $=$ regression	$0.15$	$0.15$
$\tau_{j}$	absolute threshold (tiers $0,2$ )	$0.5$	$0.5$

Appendix

Table 6: Harness hyperparameters: package default vs. the value used in every reported run. Boldface marks a study override. Eval-case capture defaults off and is on in the Harness arm throughout the run, so replay validation has cases to work with; tier 3 stays off because each model-judged metric re-reads the whole trace. Rows marked † are harness-level constants with no package default; ∗ marks the only value that differs across benchmarks. The forward-trial window is lowered to

3

so that a rule can complete a trial inside a single run, and the barrier and poll budgets are raised because trace evaluation is model-judged and takes minutes.

Approach	P	S	V	R	T
Reflexion	$\times$	$\checkmark$	$\times$	$\times$	$\checkmark$
Voyager	$\checkmark$	$\checkmark$	partial	$\times$	$\checkmark$
Generative Agents	$\checkmark$	$\checkmark$	$\times$	$\times$	partial
ExpeL	$\checkmark$	$\checkmark$	$\times$	$\times$	$\times$
AutoManual	$\checkmark$	$\checkmark$	partial	$\times$	$\checkmark$
Agent Workflow Memory	$\checkmark$	$\checkmark$	$\times$	$\times$	$\times$

Appendix

Table 7: Where the Harness sits. Rows: Reflexion ( Shinn et al. 2023 ) , Voyager ( Wang et al. 2023a ) , Generative Agents ( Park et al. 2023 ) , ExpeL ( Zhao et al. 2024 ) , AutoManual ( Chen et al. 2024 ) , Agent Workflow Memory ( Wang et al. 2024 ) , A-MEM ( Xu et al. 2025 ) , RAG memory ( Lewis et al. 2020 ) , STOP ( Zelikman et al. 2024 ) , Darwin Gödel Machine ( Zhang et al. 2025 ) , Constitutional AI ( Bai et al. 2022 ) . Columns P, S, V, R, T defined in text.

Total: $16$ matched pairs, $4$ models ( gpt-5.6-terra , gpt-5.6-luna ,
Benchmark	Split	tasks	models	pairs	$k$	turns
AppWorld	test_normal	168	4	4	4	100
Terminal-Bench	[email protected]	10	4	4	4	100
$\tau^{2}$ -bench	airline	50	4	4	4	100
$\tau^{2}$ -bench	retail	114	4	4	4	100
claude-haiku-4.5 , claude-sonnet-5 ); seed $1$ of $\{1,2,3\}$ configured; arms

Appendix

Table 8: Configuration matrix as run. Each native split is used whole in one continuous pass, so there is no learning and evaluation partition. “pairs” counts the matched Baseline and Harness comparisons contributing to the results; “turns” is the per-task agent budget.

Benchmark	Model	$\Delta\mathrm{pass@}1$	$\Delta\mathrm{pass}^{k}$	gap
Terminal-Bench	claude-sonnet-5	-0.143	+0.333	$+0.476$
Terminal-Bench	claude-haiku-4.5	+0.000	+0.200	$+0.200$
$\tau^{2}$ airline	gpt-luna	+0.020	+0.040	$+0.020$

Appendix

Table 9: The three of

16

pairs in which the all-

k

-pass rate rises more than the first-trial rate,

\Delta\mathrm{pass}^{k}>\Delta\mathrm{pass@}1

. Reported as a suggestive pattern, not as validation of a distinctive repeatability signature. Terminal-Bench has

10

tasks, so its

\mathrm{pass}^{k}

increments are coarse.

Benchmark	Model	prop.	prom.	retired	prom. rate
AppWorld	terra	112	49	63	0.44
AppWorld	luna	205	78	127	0.38
AppWorld	haiku-4.5	181	61	120	0.34
AppWorld	sonnet-5	96	42	54	0.44
Terminal-Bench	terra	12	12	0	–
Terminal-Bench	luna	23	23	0	–

Appendix

Table 10: Rule lifecycle per run, grouped by benchmark. Terminal-Bench cannot replay and has zero retirements in these runs, so its promotion rate should not be read as replay-gate selectivity.

	AppWorld				Terminal-Bench				$\tau^{2}$ airline				$\tau^{2}$ retail
Quantity	terra	luna	haiku	sonnet	terra	luna	haiku	sonnet	terra	luna	haiku	sonnet	terra	luna	haiku	sonnet
graded trials	661	672	672	664	40	40	40	40	200	200	200	200	448	445	448	448
rules proposed	112	205	181	96	12	23	20	15	76	173	129	44	248	359	402	211
rules promoted	49	78	61	42	12	23	20	15	41	93	53	24	151	225	231	126
rules retired	63	127	120	54	0	0	0	0	35	80	76	20	97	134	171	85
notices trend	156	164	190	141	34	35	38	31	171	218	176	139	584	756	811	496

Appendix

Table 11: Harness activity per run. Escalation rate is

\texttt{breach}/(\texttt{trend}+\texttt{breach})

. Samples/series is the median length of a per-session metric series and is the direct read-out of the barrier (the barrier); a value of

1

would mean the trigger could not have fired.

Quantity	before	after
rationales blaming meta-tool calls	$14\%$	$\mathbf{0.17\%}$
rationales mentioning meta-tools	–	$2{,}251$
spurious zero scores	$31$	$\mathbf{1}$

Appendix

Table 12: Evaluator bias before and after adding meta-tool neutrality guidance to the judge prompts, measured over

4{,}800

sampled judge rationales after the change. The Harness is unmodified; only the evaluator prompts change. All runs in Table 1 use the corrected prompts in both arms.

		tokens / turn		agent turns		cost (USD)		wall / trial
Benchmark	Model	B $\to$ H	ratio	B $\to$ H	$\Delta$	B $\to$ H	repair	B $\to$ H (s)
AppWorld	terra	5215 $\to$ 7504	1.44 $\times$	10.1 $\to$ 11.9	+1.8	26.47 $\to$ 34.45	8.26	17 $\to$ 109
AppWorld	luna	5172 $\to$ 8986	1.74 $\times$	9.9 $\to$ 11.6	+1.7	2.57 $\to$ 4.19	1.79	17 $\to$ 114
AppWorld	haiku-4.5	5580 $\to$ 7590	1.36 $\times$	10.0 $\to$ 11.4	+1.4	5.80 $\to$ 7.60	4.20	18 $\to$ 112
AppWorld	sonnet-5	7110 $\to$ 9310	1.31 $\times$	10.2 $\to$ 11.5	+1.3	28.00 $\to$ 34.00	11.00	20 $\to$ 120
Terminal-Bench	terra	6837 $\to$ 6151	0.90 $\times$	8.5 $\to$ 9.1	+0.6	3.67 $\to$ 2.37	0.61	101 $\to$ 202

Appendix

Table 13: Cost and overhead, grouped by benchmark and ordered within each group by added context. Cost is total USD over the run; the repair column is additional spend on top of the Harness task-execution column. Wall time is per trial.

Benchmark	Model	added context	$\Delta\bar{s}$
AppWorld	sonnet-5	1.31 $\times$	+0.013
AppWorld	haiku-4.5	1.36 $\times$	+0.024
AppWorld	terra	1.44 $\times$	+0.022
AppWorld	luna	1.74 $\times$	+0.004
Terminal-Bench	terra	0.90 $\times$	+0.075
Terminal-Bench	sonnet-5	1.06 $\times$	+0.019

Appendix

Table 14: Cost against benefit: added context (Table 13 ) beside the paired task-completion gain (Table 1 ) across all

16

pairs. Every pair shows a positive

\Delta\bar{s}

. Terminal-Bench/terra is the only configuration below Baseline token cost, while Terminal-Bench/haiku-4.5 shows the largest task-completion gain.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 273 papers

The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate
Oct 7, 2026Ravil AkhtyamovLLM Agent Self-Improvement AI Agent Governance
Digital Economy Lab
Self-Harness: Harnesses That Improve Themselves
Jun 8, 2026Hangfan Zhang, Shao Zhang, Kangcong Li +5Agent Harness Optimization LLM Agent Self-Improvement
Shanghai Artificial Intelligence Laboratory
Self-Evolving Agent Harnesses via Gated Semantic Quality-Diversity
Jul 15, 2026Xiaotian Luo, Fengxingyu Wang, Chuanrui Hu +2LLM Agent Self-Improvement Quality-Diversity Optimization
EverMind AI · Shanda Group

Oct 7, 2026J/K move · Enter open · S save

The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate

Ravil Akhtyamov

Digital Economy Lab

LLM Agent Self-Improvement AI Agent Governance LLM Agent Harnesses Runtime Enforcement for AI Agents AI Agent Auditing Credit Scoring

Open paper AskPDF arXiv

Self-improving LLM agents can adapt a credit pipeline to a changed rule, but an agent that rewrites itself destroys the artefact a supervisor reviews: a named change, a recorded test, an approval. We argue that self-evolution is reviewable only if it is confined to the runtime harness (instruction text, tool-call logic and primitive composition) while model weights stay fixed, so that every adaptation is a diff with a cause and a test attached. We give a dual-loop engine built on that bound, with one admission gate that writes a hash-chained record before deployment, and we measure the gate in simulation, with a simulated agent and a seeded-search proposer rather than language models. Across three families of supervisory re-interpretation at three severities, 10 seeds each, the gated loop admitted 144 of 7,449 candidate changes, none of which worsened error on held-out history, and restored the false-positive rate to the oracle level without raising missed flags in every low- and mid-severity cell. With the gate replaced by the check an unbounded system applies (fewer errors visible in recent traces), the same loops admitted 309 harmful changes and left missed flags above 10% in 49 of 90 runs: false positives fell because the screen was loosened. Evaluated on pre-shift labels, the gate rejected every candidate, so a re-interpretation must be encoded as a rule that relabels history. Parametric and scope shifts were repaired locally, a structural one only by primitive replacement; at the highest structural severity the gate's fixed tolerance blocked the correct replacement in half the seeds. We map the mechanisms to the EU AI Act's provisions for high-risk credit scoring and note that the April 2026 US model-risk guidance excludes agentic AI from its scope.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate

Self-Harness: Harnesses That Improve Themselves

Self-Evolving Agent Harnesses via Gated Semantic Quality-Diversity