LOGOS: A Living Logic for AI Agent Teams That Evolve With Humans

Abstract: AI agents are evolving from answer engines into persistent teams that use tools, delegate work, learn from experience, and modify the artifacts that shape their future behavior. The defining question for deployment is no longer merely what agents can do, but who controls what they are allowed to become. We introduce logos, a pluggable layer for self-evolution and governance that strengthens existing multiagent frameworks rather than replacing them. logos compiles heterogeneous multimodal inputs, including documents, images, audio, tables, databases, APIs, and human instructions into versioned agent packs containing agents, tools, knowledge, tests, permissions, and policies. During operation, it transforms agent activity into portable, auditable event traces and applies fail-closed verification across frameworks and backends. Every learned prompt, memory, skill, tool, role, or workflow remains an untrusted release candidate until held-out execution evidence, human-controlled policy, and explicit authorization permit its promotion. This architecture enables "verifiable human-agent loop engineering": agents can act, ask, learn, and propose improvements, while humans can steer objectives, permissions, approvals, and irreversible actions without interrupting continuous operation. logos provides a living logic for accountable automation. Agents may evolve at machine speed, but only evidence and human authority can close the loop.

• The paper introduces LOGOS, a pluggable governance layer that manages agent teams through compile, operate, propose, and promote stages, ensuring agents cannot independently rewrite evaluators, expand permissions, or authorize irreversible actions.
• The paper uses paired baseline–candidate execution on hidden holdouts, human-owned release policies, and layered verification to prevent misevolution, accepting only changes that meet pre-declared improvement and regression thresholds.
• The paper reports 0% adoption of harmful candidates and 100% of beneficial candidates in 5,000 replay decisions, while documenting important limits including generated test suites, conservative rejection, verifier assumptions, and weaker results for some models and benchmarks.

LOGOS is a pluggable governance layer for multi-agent LLM systems that treats agent self-evolution as a software release problem. Its central thesis is that once agents can modify their own prompts, memories, skills, tools, roles, and workflows, the operative deployment question shifts from "what can the model do?" to "who decides what the deployed system may become?" The paper's governing principle is that proposal is not promotion: agents may propose changes at machine speed, but release requires held-out execution evidence, human-owned policy, and explicit authorization (2607.10878).

The compile–operate–evolve lifecycle

The system is organized around four artifact-level transitions. Compile converts bounded heterogeneous inputs—documents, images, audio, tables, databases, API specifications, and human instructions—into a versioned Agent Pack containing agents, tools, knowledge, verifiers, validation probes, permissions, and provenance. Operate executes the pack through an adapter-based kernel that normalizes framework-specific behavior into typed, auditable event traces. Propose converts operational experience into isolated candidate edits. Promote is the only transition that can replace a live artifact, and it runs under a frozen external gate rather than under the proposing model.

Formally, the governed deployment object $\mathfrak{D}$ pairs the Agent Pack with a human-owned root policy $R_{\mathrm{root}}$, credential envelope, live external state, and audit sink. The root policy fixes objectives, final evaluator and gate versions, holdout samplers, permission-expansion rules, approval policy, effect boundaries, and audit destinations outside ordinary self-evolution. Candidates cannot silently rewrite the evaluator that decides their own adoption, inspect final holdouts, expand credentials, or authorize irreversible actions. A key structural distinction is that rollback restores pack artifacts but does not undo external effects such as emails, payments, or database writes; those require previews, transactions, idempotency keys, compensation, or human confirmation.

Compilation with fail-closed fallback

The compiler is LLM-first but fail-closed: it returns either a ProbeValidatedPack—meaning only that declared finite probes passed—or a DiagnosticPack carrying repair information and no live authority. Synthesis degrades gracefully from structured team blueprints to single-playbook agents to deterministic templates when the LLM emits invalid output. Validation follows an API-Bank-style philosophy: a pack is certified by whether agents can actually invoke its capabilities on a finite probe battery, with cumulative levels L0–L2 (parse, instantiate, invoke) and independent stress axes C3–C5 (complete, generalize, operate safely). An optional anytime-valid e-process attaches rate statements about true tool callability that remain valid at any stopping time, avoiding the peeking error of ordinary pass fractions.

A persistent design ledger records completed builds and retrieves nearest precedents by embedding similarity to condition later builds, but recalled precedents are candidates requiring target-side re-validation, not unconditional priors.

Routing and verification as coupled engines

Routing is instantiated in three regimes of increasing adaptivity: static cost routing over complexity buckets; learned REINFORCE-style routing with variance-reduced baselines; and a verification-gated cascade that escalates cheap-to-strong stages only on verifier rejection, with Beta–Bernoulli posteriors per task dimension enabling adaptive entry that skips stages unlikely to pass. Under stated assumptions (verifier soundness, state isolation, fresh fallback execution), cascade accuracy is provably no worse than always using the strongest stage, with accuracy loss from imperfect verifiers bounded by reach-conditioned false-accept mass.

Verification separates hard constraints (schema, syntax, lint, sandbox) from acceptance validators ordered by assurance class: deterministic-oracle, execution, trained-with-audit, judge-supported, heuristic. Hard constraints are necessary but never sufficient; missing, crashed, or inapplicable checks fail closed. Human approval is an authority decision, not a verifier verdict—it cannot convert missing semantic evidence into a pass. For free-form tasks, agents emit typed claims assembled into directed evidence graphs whose support and contradiction paths make opaque judge acceptances auditable.

Evidence-gated self-evolution

The paired-execution adoption gate is the paper's core mechanism against misevolution—a deployment changing itself into something worse than its starting version. Every evolvable asset is a typed component (skill, workflow, memory, role, prompt, tool). Cross-component credit assignment returns a primary attribution or abstains rather than optimizing arbitrary components. Candidates are evaluated by paired execution of baseline and candidate on held-out tasks disjoint from proposal data, accepting only when the empirical gain clears a pre-declared margin and observed regressions stay within budget:

$$\text{accept} \iff \widehat{\Delta}_{\mathcal{H}} \ge \delta_{\min} \wedge R_{\mathcal{H}} \le R_{\max}$$

An optional stricter variant replaces fixed thresholds with gain and regression e-processes charged through a LORD-style alpha-wealth ledger, valid under optional stopping. Gate feedback is proposal-safe (aggregate counts and hashes only), with exposure budgets that retire holdouts after repeated decisions—an operational application of reusable-holdout theory. Memory follows three trust tiers (raw episodes, validated lessons, durable skills) with value-aware retrieval blending similarity and learned outcome value; promotion requires stable pass rates, and durable skills additionally require paired contribution evidence.

Human–agent control contract

Human oversight enters through two auditable loops. Agents ask humans via pre-run clarification and mid-run questioning gated by a budgeted value-of-information surrogate $$(1-\text{conf})\cdot\text{impact}\cdot\text{cost}_{\text{wrong}}$$ under an attention budget; blocking facts, credential gaps, and irreversible effects produce tickets or fail-closed rejection rather than guessed execution. Conversely, casual human directives are fused with validated memory through an overview operator that resolves contradictions and asks targeted clarifications, then enter the same non-regression gate as any other candidate. Directives touching objectives, evaluators, or permissions are routed to the human-governed configuration path, never learned-state edits. A resident World state carries schedules, tickets, and shared lessons with shrinkage-scored usefulness.

Evaluation

The evaluation deliberately separates four evidence classes: external benchmarks, controlled mechanism studies, generated fault injection, and conformance checks. Headline results include:

Claim	Result	Boundary
Compiler fidelity	C3/C4/C5 rates 0.882/0.720/0.757 vs. one-shot LLM's 0.631/0.286/0.334 over 48,000 generated briefs	Generated templates
Paired gate semantics	Adopts 0% harmful-family and 100% beneficial-family candidates across 5,000 fixed replay decisions; ungated baseline adopts 60% harmful	Constructed candidate families
Verifier stack	Composite false-accept 0.007 at 0.796 coverage vs. schema-only 0.909	Encoded failure modes
Cascade	HumanEval accuracy 0.976 vs. floor 0.841 (Holm-adjusted $p=1.4\times10^{-6}$); gains over strong reference not significant	Execution-graded code only
Collective routing	−1.8 accuracy points for 47% cost reduction vs. always-strong	Controlled replay
Safe delegation	Zero unauthorized effects while cutting interventions from 100 to 39 per 100 tasks	Simulated risk labels

Several negative results are reported candidly and matter for interpretation. Passive memory without training signal underperforms the no-memory condition on LongMemEval and LoCoMo; compilation helps MATH-500 with gpt-5.1 (+2.8 points) but hurts gpt-4o-mini MATH-500 (−15 points), so compiled teams are treated as candidates behind a validated-route rule rather than unconditional replacements. The anytime-valid gate achieves zero misevolution partly by rejecting everything in low-signal cells—conservative error accounting, not high adoption power. GSM8K and MATH-500 show the boundary where non-code verifiers cannot dominate direct strong-model inference.

Limitations and open questions

The paper is explicit that most large-scale numbers come from generated suites built from the same contract rules LOGOS must preserve, making them conformance tests rather than statistical generalizations about production incident frequency. Formal anytime-valid guarantees depend on fresh i.i.d. gate streams, hidden holdouts, predictable bets, and valid candidate-level p-values; exposed holdouts, distribution shift, verifier drift, and unbounded utility scales fall outside the guarantee. The trusted computing base includes root-policy administration, credential providers, sandboxes, backend adapters, and audit sinks—a compromised administrator or provider invalidates the boundary. Prompt-injection defenses are defense-in-depth, not proofs. Open questions include whether the paired gate's adoption power suffices for naturally occurring (rather than constructed) proposal distributions, how gate-exposure budgets should scale with deployment lifetime, and whether calibrated selective-risk claims for questioning policies can be certified without separate calibration and certification splits.

Conclusion

LOGOS contributes a unified contract—artifacts, events, verification, authority, promotion, and audit—that makes pluggable self-evolution governable across multi-agent frameworks. Its central separation of evidence from authority allows continuous improvement while preventing a model from becoming its own evaluator or release manager. The empirical account is disciplined about what each evidence class supports, which strengthens rather than weakens the architectural claim: agents may evolve quickly, but only execution evidence and human-owned policy close the loop.