Self-Improve

Out of the box, an AI assistant forgets everything between sessions. Users repeat the same corrections, restate the same preferences and re-teach the same techniques — and every repeated correction is paid for twice: once in time, once in trust. The obvious fix is to let the assistant update its own instructions. The obvious fix is also a governance nightmare: unsupervised self-modification is exactly the failure mode responsible AI operations exist to prevent.

So the real problem isn't making an assistant learn — models do that eagerly. It's making one learn safely: it must not capture the wrong lessons (a transient failure, a misread intention), it must never quietly rewrite its own capabilities, and a human must be able to see everything it learned, veto any of it, and stop the whole loop instantly.

And it had to respect the local-first constraint we build to: no new database, no new API keys, no cloud service to subscribe to. The loop had to run on the assistant subscription already being paid for, store everything in plain files a human can read, and be portable to other coding agents rather than locked to one.

Phase one was the control plane, deliberately manual. A single command reviews the session against a written methodology: corrections and preferences become memory ("who the user is, state of the world"); reusable techniques become skills ("how to do a class of task"). Updating-in-place beats duplicating; a do-not-capture list keeps transient failures out; and in consent-first mode a new skill never goes live — it lands in a proposals folder a human approves or rejects. Every action, including "nothing to save", is appended to a tamper-evident audit journal.

Phase two automated the trigger without automating the trust. Session-end hooks call a gatekeeper that only fires a review when thresholds are met — enough user turns, enough tool calls, or repeated correction signals — under a daily cap, a per-session gap and a single-review lock. What the reviewer sees is a redacted digest: tool outputs dropped, sidechains skipped, capped in size. And the reviewer itself runs in a straitjacket: a headless assistant with tools cut to read-only plus writes scoped to the memory and proposals folders only, under a 15-minute hard cap.

Phase three keeps the library from silting up: a weekly curator merges overlapping learned skills and archives stale ones. Its AI pass has no shell at all — it can only propose moves in a plan file; a validating script checks provenance, pins and protection rules before applying anything, then commits the skill library to git. The safety rails hold everywhere: nothing is ever deleted (archive is the maximum), skills the loop didn't author are untouchable, conversation content is treated as data rather than instructions, and touching one file pauses every automatic behaviour instantly.

What exists is a complete, working learning loop: written memory conventions, a skill library with provenance stamped in every file, an eight-script automation layer with three written methodologies (~1,400 lines), and a full audit journal. The assistant starts each session already knowing the user's preferences and proposes new capabilities instead of assuming them — approving or rejecting one is a single command.

The governance is the product. Every write is journaled; learning fires only through gates; the background reviewer physically cannot touch anything outside two folders; and the curator cannot move a skill whose provenance doesn't check out. We'll be honest about its age: the journal is a handful of entries deep, one learned skill is live so far, and the automation is currently paused — by choice, with the one-file kill switch, which is the control working exactly as designed.

That's the proof point. "AI that improves itself" is usually either a demo or a liability; this is the third thing — a learning system a business could actually operate, auditable end to end, running at £0 marginal cost on the subscription already paid for. The same pattern — gated triggers, sandboxed reviewers, consent-first change, journaled everything — is how we'd wire memory into any client's assistant or agent fleet.