Learning Outside the Model

A language model deployed as an agent arrives at every session with the weights it was trained with, so anything it learns in deployment has to be held somewhere else. External memory is now a standard answer to that problem. A store that an agent writes, reads and summarises for itself, however, can accumulate its own errors with rising confidence, and a log that the agent can read is a log that the agent can manage.

This paper reports the design and evaluation of a single-operator personal agent built on one principle: every learning mechanism held outside the weights is paired with a check that the model does not perform on itself. Four mechanisms operate at four timescales, from a per-cycle grounding block to self-knowledge derived from the agent's whole history. Memory consolidation is non-destructive and depth-bounded. Stored statements are split into exchanges, the agent's own words, which can never become standing fact, and told memories, the operator's words, which can do so only when an instrument agrees with them. The agent's conduct is recorded in an Ed25519-signed, SHA-256 hash-chained, append-only ledger that the agent may write but may not read. What the agent is told about itself is computed from that ledger by deterministic code.

Fifty-one prose safety claims were converted into invariant tests, run against the live code with an adversarial corpus generated by a language model, and made a boot gate on the service. On first execution, 7 of 51 invariants failed. These were two fail-open paths, one refusal message that disclosed protected paths, one privilege escalation through string normalisation, two coverage gaps and one defective test. All seven were corrected before the gate was wired. The shell deny-list still admitted 14 of 18 kernel-tuning rewrites (78%; Wilson 95% CI 55–91%) and 32 of 75 rewrites against six protected targets (43%; 32–54%). That result is treated here as evidence for kernel-level enforcement, not for a longer list.

The paper also identifies six residual threats: a gate that the gated process can edit, promotion of whole claims on partial measurement, in-process key custody, a witness co-located with the node, an ungoverned coding agent, and an off-box verifier that reads the current version of a key the agent can overwrite. It argues that the learning claims themselves remain unmeasured, and it names a limitation of its own method: the model that drafted the design note also generated the tests and the corpus that evaluate it. A companion note examines what the design becomes if the planner can update its own weights. The contribution is a pattern, not a proof: claims about an agent made executable, so that they can be wrong in public.

Preprint, revision 7. Design case study with executable evaluation; pre-service deployment. Companion note: When the Weights Can Move, doi:10.5281/zenodo.22994587. Use of AI is declared in the paper. Part of the Heartbeat Framework, an open-access clinical AI governance estate: heartbeat-framework.org.