INIT: Open-Source Rust Agent Harness Hot-Swaps Core Mid-Task
INIT Labs released an open-source Rust coding agent framework that can rewrite, test, and hot-swap its own prompts, tools, and compiled core mid-conversation. The architecture features an immutable 'Root' layer for safe rollback, aiming to break the ceiling of static harnesses and enable dynamic evolution alongside model capabilities.
Full Report
Contents16 sections
An open-source coding agent from INIT Labs
It rewrites its own harness. Grows with every model.
The harness is everything around the model: its prompts, tools and loop. INIT rewrites its own, tests each change and swaps it in, mid-conversation. A Root it can never touch can undo any change.
Install in one lineRead the record → code the model may rewritea change in flightthe Root: never rewritten, undoes any change diagram gen 41 cells rewritten 0 rolled back 0 Root moved never +01THE AGENT, TAKEN APART
Take an agent apart. One layer it can never touch.
01/ 05assembled
An AI agent is a model plus a harness.
INIT may rewrite every layer. Except one.
A new core, through four gates. Same conversation.
If a change does harm, the Root rolls it back.
A fixed harness becomes a ceiling. INIT grows.
one cell = one real file · INIT v0.3.3
- Assembled: the model, a frosted plate with no files, sits on four harness plates (prompts and skills, tools, compiled core, kernel), all standing on the amber Root.
- Exploded: every layer lifts away from the Root. INIT may rewrite the harness; the kernel only at higher autonomy, and still checked. The Root never moves and is never written by the model.
- Rewrite: a candidate copy of the compiled core slides into its own lane. One real file, src/loop/mod.rs, lifts out and is rewritten, rides through four gates (build and tests 439 s, self-map 1.5 s, boots beside the live one 19 s, can still edit itself 322 s) and drops back into its slot: swapped in within 4.3 s, in the same conversation.
- Rollback: a change to src/tools/bash.rs turns red and is refused; the Root's snapshot of the old file rises back into its slot, and the signed record ticks seq 88, 89, 90 (2026-10-21).
- Grows: beside a fixed harness, whose growing model overhangs a hard ceiling, INIT's harness widens to fit each new model. The Root stays the same size, in the same place.
Diagram. One cell is one real file of INIT v0.3.3: 7 prompt and skill files, 5 tool files and 124 compiled-core files. The kernel is drawn as a texture, not counted. Gate and swap times are measured, and the rollback is a real signed record (2026-10-21, seq 88 to 90). Motion, and all of step 5, are illustrative.
+02THE BODY
This is INIT's actual body. One cell per file.
The Body · live data
This is INIT's actual body.
One cell per real file at v0.3.3, the last measured release. Coloured: files INIT changed itself.
136files508ktokens3changes prompts & skillstoolscompiled corekeptrolled backin flighthover a cell ROOTkeys · the record · undo · the off switch — never written by the model +03THOUGHT EXPERIMENT
A fixed harness pays for each friction every day. INIT pays once.
Same job, same models, three weeks. The fixed agent trips on the same problems every day. INIT fixes each one once. useful workfriction, paid againin flight: changing itselfkeptrolled back 4frictions the fixed harness still pays, every day, on day 210for INIT: it paid each one once day 21 surprises nobody planned for 2 +04EVERY CHANGE CAN BE UNDONE
Freedom, with an undo button.
The model may rewrite almost all of itself. One thing it can never touch: the Root, which holds the keys, the record and the undo.
Where the line is · the model may rewriteprompts & skills · tools · compiled core · kernel
sandboxed · no API key · one socket to the Root
every model call, every change ↓ metered and recorded ROOT · nobody rewritesAPI keys · signed record · snapshots + undo · harm signals · stop · resource floors
separate service · outside the sandbox · holds the signing key
Twelve harm signals.
One trips, the change rolls back · all twelve, and what they miss →
+05THE NUMBERS
Seeing is believing. Each number links to its log.
Measured on v0.3.x, before this preview.
87.9%of the prompt cache kept when it swaps its core, so the chat carries on↳ live run log ↗ · DeepSeek 51sfrom install to first reply↳ release log ↗ $0.0005/turnper live DeepSeek turn↳ release log ↗ · DeepSeek 4.3sto swap in a new core, mid-conversation↳ end-to-end test ↗ · simulated model 13.1minfor its first core change, every check included↳ release log ↗ 1,897runstest runs in one CI pass, 0 failed↳ CI report ↗ Real model · gated mode · 2026-10-21
A rollback, signed.
- 1A change to its own shell tool scored 5 points lower, inside the noise.
- 2The gate refused it.
- 39 seconds later it was rolled back. Every record is signed.
Refused, not proven harmful · why refuse it? →
The change scored lower.
seq 88 · sealed_g4by root · 08:32.794Zcandidate2efd6c39…d_permille−50statusinferiorprev ← seq 87sha256 chained25519 +0.063 s · hash links to seq 88
The gate refused it.
seq 89 · gateby kernel · 08:32.857Zverdictrejectreasonscore_inferiorprev ← seq 88sha256 chained25519 +8.722 s · hash links to seq 89
It was rolled back, and signed.
seq 90 · body_rollbackby kernel · 08:32.579Zfromc88be5f…toaaf07b7…prev ← seq 89audit-verify: lineage oked25519
lineage.jsonl records 88–90 · fields verbatim, abridged · m7-results.md
+06RESEARCH
Four open problems. One instrument to study them.
INIT Labs builds the agent and studies what it does to itself. Every change it makes is signed, tested and undoable: a dataset for the questions below.
nestfoodtrail, laid by antsant carrying food R1 · Swarms · open
Colonies, not committees.
Today's agent "swarms" are a manager with assistants. A bee swarm has no manager.
Open: can agents following only local rules solve what one agent, or the best of many, cannot?
genesmutationcrossoverdied out R2 · Evolution · open
Agents with DNA.
From agents that edit their own code to agents that inherit, recombine and evolve, with no human-written score.
Open: is there a genome for agents, where mutation makes variation instead of collapse?
the agentits forecast of itselfa failure it saw comingone it missed R3 · Metacognition · open
An agent that sees its own mistakes coming.
Today's agents notice an error after they make it. Minds forecast their own failures, and change course first.
Open: can an agent model itself well enough to foresee its own failures, and act on that in time?
new changedetectorslipped through R4 · Immunity · open
An immune system for self-improving AI.
An agent that upgrades itself can be infected by its own upgrades. Nothing guards against that yet.
Open: can it tell self from non-self in its own changes, without attacking the healthy ones?
Why INIT Labs
The record is the dataset.
Every change INIT makes to itself is signed, tested and undoable. Each one is a data point for all four questions.
signed · gated · reversible
Open problems, not results. We will publish what fails, too.
+07TRY IT
One line to install.
$curl -fsSL https://github.com/nagisanzenin/INIT-Agent/releases/latest/download/get.sh | sh theninit --workspacekeeps it to one folder ·read get.sh first ↗ For engineersThe record: real logs, the threat model, every receipt.Read the record → CodeGitHubSource, releases and issues.Apache-2.0 ↗ ResearchTechnical reportWhat worked, and what failed.negative results included ↗