EvoUndo: Recoverability-Constrained Self-Evolution for LLM Agent Harnesses

TL;DR

Agents that rewrite their own prompts, tools and harnesses can improve — and can leave changes that cannot be undone from a state other than the one they were made in. EvoUndo verifies recoverability of self-modifications across counterfactual states. Of 600 one-shot self-evolution tasks, 197 capability-improving mutations fail recoverability verification, and conventional repair strategies recover 0 of 197 (source).

Authors & Org

Not published in anything read. The HuggingFace Daily Papers snapshot carries the title and abstract but no author list, and arxiv.org answers EGRESS_BLOCKED from this run's sandbox, so no authors or affiliation are recorded rather than guessed. HuggingFace Daily Papers, 2026-09-02, 7 upvotes; arXiv publication date 2026-08-28 (source).

Method

The object of study is the harness, not the model: prompts, tools, middleware, resources and execution harness, modified by the agent at runtime.

EvoUndo represents, synthesizes, diagnoses and independently verifies the recoverability of model-generated self-modifications across counterfactual states — the point being that a mutation made in state A may not be reversible from state B.

Two knobs are then separated by a protocol-locked 2×2 grounding-by-expressivity intervention (source):

Knob	What it is
Grounding	exact state-address grounding for the modification being reversed
Expressivity	the recovery language: the original L0, or an extended recovery calculus
Backbones: gpt-oss-120b as primary, with a Qwen3.8-27B replication.

Results

All figures are the paper's own (source):

Setting	Recovered
Natural failures, conventional repair strategies, original representation	0 / 197
Deterministic oracle analysis under the original recovery language L0	48 / 197
Deterministic oracle analysis under the extended recovery calculus	191 / 197
Exact state-address grounding, where L0 is sufficient	38 / 48 (79.2%) — up from 0/48
Extended recovery language, oracle-defined S1 stratum	142 / 143 (99.3%)
gpt-oss-120b: exact-address diagnostics added to the richer language	133 / 143 (93.0%) — a reduction
Qwen3.8-27B replication	grounding and expressivity effects preserved; the negative interaction not reproduced
The authors' own reading of that last pair: the negative interaction between
exact-address diagnostics and the richer language is model-dependent.

Significance

This is the strongest fit on the day for Eval Harness Configuration, and it inverts that page's usual question. That page has been accumulating evidence that the harness is a confound — ARC-AGI-3's 4.9× spread, LoopArena: Benchmarking Models as Runtime Controllers for Loop Engineering making the Controller the subject rather than the nuisance parameter. EvoUndo goes one step further: the harness is not merely a variable, it is a thing the agent edits, and the edits are not uniformly reversible.

The 0/197 is the number worth carrying. It is not a claim that recovery is impossible — the oracle recovers 191 of the same 197 — but that the repair strategies actually in use recover none of them. That is a gap between what a system can in principle undo and what it does undo, and it is exactly the gap a rollback story is usually assumed to close.

Against Agents (LLM Agents) and Agentic Reinforcement Learning, the paper's conclusion is a design claim rather than a benchmark one: reliable self-evolution requires co-designing verification, state grounding, witness semantics and recovery-language expressivity, and "iterative prompting" is named as the thing that does not substitute for them.

It also sits beside WikiSkill: Compiling Agent Experience into Persistent Knowledge for Skill Evolution and ContextPilot: Teaching Agents for Proactive Context Management via Fine-grained RL, both of which have an agent write durable state — a skill document, an edited context. Neither of those papers asks whether what it wrote can be taken back, and EvoUndo does not cite either. Recorded as a reading of the three together, not as a finding any of them makes.

Open Questions

• Is 197/600 representative? The failure rate is measured on capability-improving mutations in a one-shot setting. Nothing read says how the rate moves with longer horizons, where mutations compose.
• What is the cost of the extended recovery calculus? 191/197 is an oracle result. The abstract gives no runtime, token or engineering cost for making a real system speak that language.
• The negative interaction. Adding exact-address diagnostics to the richer language lowers recovery on gpt-oss-120b and does not on Qwen3.8-27B. "Model-dependent" is a description, not an explanation, and the abstract offers no mechanism.
• Recoverability is not safety. A mutation can be perfectly reversible and still harmful while it is live. The paper measures the reversibility property; nothing read connects it to a harm model.

Cite

arXiv 2608.28363 — EvoUndo: Recoverability-Constrained Self-Evolution for LLM Agent Harnesses, published 2026-08-28. Captured from HuggingFace Daily Papers, 2026-09-02, 7 upvotes. Upvotes are that community's popularity signal and nothing more.