Paper: arXiv:2607.04542 · Built by RightNow AI · Apache-2.0
Auto compiles recorded LLM-agent behavior into verified, capability-confined
wasm binaries, with a tiered runtime that falls back to a frontier model for
novelty and recompiles the result. It records what an agent does, proves which
parts are secretly symbolic, extracts those, distills the rest into small
specialists, verifies the whole against a behavioral contract, and emits a
cognition binary (.cbin
): code plus small models plus a measured manifest.
The idea in one line: treat the frontier model as an interpreter, and build the compiler that has always followed interpreters. The plain-language story, with every measured number and its provenance, is in docs/why-agi-compiler.md.
CLAUDE.md
records the engineering norms we held ourselves to while building
this; spec/
is written for external readers.
- The compiler:
auto record
attaches to a live agent and captures traces,auto compile --contract
lowers them to a typed IR, runs the passes, and verifies against the contract before emitting a.cbin
. - The runtime: tier-1 is the compiled fast path. tier-0 is a frontier model as interpreter, for inputs the guard flags as novel. A guard trip deopts to tier-0, captures the trace, and recompiles. This is the ratchet: nothing is figured out twice.
- The artifact: content-addressed
.cbin
with a manifest that reports eval scores, cost and latency bounds, capability requirements, and provenance. The manifest reports measured numbers ornull
, never aspirational ones.
Capability confinement is physical: emitted artifacts declare zero wasm imports and the refuses anything else, so a binary cannot exceed its declared effects.
Every number below is traceable to paper/bench-results.md
(which carries the
eval-run ids and ledger lines) or paper/claims.md
.
- Determinism census: 488 of 560 recorded effectful spans were witnessed-deterministic (87.1% pooled), with three families at 100.0% and free-text generation as the residue. This is the measured form of the claim that most agent cognition is secretly symbolic.
- The ratchet, on a 300-item novelty stream with three scheduled distribution shifts (positions 50, 120, 200): marginal cost per item fell from about 59 µ$ (pure frontier) to 2 µ$/item steady-state, 6.4x cheaper end-to-end, with three recompile generations each landing one cycle behind a shift, zero errors, and every recompile passing the same contract gate. Tier-1 answers matched the reference agent on witnessed inputs 124 of 128 times (96.9%).
- Latency ladder on the compiled path: 736 ms (frontier) to about 21 ms (serve over HTTP) to 290 µs (stdio) to 54.1 µs (in-process python, pyo3) to 18.2 µs (in-process node, napi). The in-process figures measure the call boundary on trivial fixtures, not inference.
The same stream run at a deliberately loose guard measured the failure mode the architecture exists to prevent: 48.9% of tier-1 answers silently wrong. Calibration, not model capability, decides whether cheap stays correct.
frontend IR passes backend
-------- -- ------ -------
trace SDK --> typed task graph --> extract --> verify --> task.cbin
(prompts, (capability and distill (contract (wasm code
tool calls, memory effects, optimize gate) + small models
args, results) uncertainty, + manifest)
resource bounds)
run: input --> guard --> in-distribution --> tier-1 (compiled, guarded)
\-> novel --> deopt --> tier-0 (frontier) --> capture
\-> recompile --> tier-1
(the ratchet: nothing figured out twice)
The passes, in order: symbolic extraction (enumerative search or LLM-guided CEGIS, candidates checked in a wasmtime sandbox with no network), distillation (residual fuzzy nodes into small tree or MLP specialists), verification (the contract is the type checker; differential testing against the reference model; a failing or unmeasurable contract blocks emit), and optimization. Guards use trigram-Jaccard distance with split-conformal calibration for calibrated abstention.
Requirements:
- rust 1.96.1 (edition 2024), pinned in
rust-toolchain.toml
. flatc
25.12.19 exactly. It must match the pinnedflatbuffers
crate; the IR build fails on a mismatch.
crates/auto-ir/build.rs
resolves flatc
in this order: the FLATC
env var,
then tools/flatc/flatc[.exe]
(gitignored), then PATH
. Install it from the
official release, for example on Windows extract flatc.exe
from
Windows.flatc.binary.zip
at
github.com/google/flatbuffers/releases/download/v25.12.19/
into
tools/flatc/
. Linux uses Linux.flatc.binary.clang++-18.zip
from the same release.
The gates CI runs on every pull request:
cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
Build the CLI, then run the end-to-end script. It records the toy agent through
the real python SDK, checks the measured determinism report, compiles a .cbin
through the verification gate, runs it, and proves the negative paths: a wrong implementation is blocked, a far input abstains, a deopt is ingested and recompiled to tier-1, and a tampered registry artifact is refused.
cargo build -p auto-cli
bash evals/toy-agent/e2e.sh
The same steps by hand, one task, record to run:
cargo run -p auto-cli -- record --store store.db -- python evals/toy-agent/agent.py
cargo run -p auto-cli -- record --store store.db -- python evals/toy-agent/agent.py
cargo run -p auto-cli -- report --task toy-agent --store store.db
cargo run -p auto-cli -- verify --contract evals/toy-agent/fake-frontier.contract.toml --store store.db
cargo run -p auto-cli -- compile --contract evals/toy-agent/fake-frontier.contract.toml --store store.db --out fake-frontier.cbin
cargo run -p auto-cli -- run --artifact fake-frontier.cbin \
--input '{"prompt":"The quick brown fox jumps over the lazy dog near the riverbank."}'
cargo run -p auto-cli -- inspect fake-frontier.cbin
The paid paths (LLM-guided CEGIS at --synth llm
, and a frontier model as
tier-0 via --tier0 "frontier:<model-id>"
) are fail-closed: they need
OPENAI_API_KEY
and an explicit nonzero --spend-cap-usd
. The default cap of 0
refuses every paid call, and every call is appended to ~/.auto/spend.jsonl
.
AUTO-BENCH v1 asks the question the thesis lives on: does the system ever pay
for the same thought twice? The protocol is frozen before execution in
evals/bench/DESIGN.md
. The measured results, with every number carrying an
eval-run id or a ledger line and a failures-and-refusals section at equal
weight, are in paper/bench-results.md
; per-position stream data is under
paper/evidence/
.
Reproduction: evals/bench/README.md
has one leg per task family. Paid loops
are gated behind RECORD=1
or JUDGE=1
with the spend cap passed as an argument. A stranger with an OpenAI key reproduces every table for well under $1. Total ledgered benchmark spend was $0.0621 of a pre-registered $5.00 cap.
| path | what |
|---|---|
crates/auto-ir |
|
| typed task graph: effects, uncertainty, resource bounds; flatbuffers serialization with byte-stable round-trip | |
crates/auto-trace |
|
| trace model, strict JSONL ingestion, sqlite store, determinism report, replay comparison | |
crates/auto-contract |
|
| contract format, verification harness with three-valued verdicts, content-addressed eval runs | |
crates/auto-passes |
|
| symbolic extraction (enumerative search or LLM-guided CEGIS), region synthesis, tree and MLP distillation drivers | |
crates/auto-dsl |
|
| the closed extraction DSL: one evaluator, compiled natively for search and to wasm for artifacts | |
crates/auto-model |
|
| distilled-model wire format and tree inference over frozen char-trigram features | |
crates/auto-backend |
|
.cbin container (content-addressed), honest manifest, differential checks, verification-gated emit |
|
crates/auto-runtime |
|
| tier-1 wasm execution (zero-import capability refusal, fuel and memory limits), conformal guards, deopt, recompile ingestion | |
crates/auto-frontier |
|
| the only paid-API path: spend-capped client, pinned price table, append-only ledger | |
crates/auto-registry |
|
| local content-addressed artifact store and detached ed25519 signing | |
crates/auto-serve |
|
auto serve : registry artifacts over HTTP, guard-gated tier-1 per request, 409 abstention on a trip |
|
crates/auto-proxy |
|
auto proxy : record any OpenAI-backed agent with zero code changes |
|
crates/auto-daemon |
|
auto daemon : the ratchet as a service; watch a store, recompile on new evidence, publish |
|
crates/auto-cli |
|
record , report , verify , compile , distill , run , registry , inspect , serve , proxy , daemon |
|
crates/auto-py |
|
| in-process python embedding (pyo3, abi3 wheel) | |
crates/auto-node |
|
| in-process node embedding (napi addon) | |
sdk/python , sdk/typescript |
|
| recording and replay tracers, same wire format | |
spec/ |
|
ir.md and the dialect specs; adr/ for irreversible decisions |
|
evals/ |
|
reference tasks, e2e scripts, and the benchmark under evals/bench |
The benchmark corpora are designed: realistic but synthetic. The production claim is an operator rerun on their own recorded traffic, not this corpus. The determinism and parity numbers are measured on those tasks at benchmark scale (560 spans), not a capability eval of the underlying model, which is the reference interpreter and not the subject. Free-text generative behavior is the honest residue: at 40 tickets the summarize family does not compile to a tree at its declared judged threshold and stays tier-0, and field-extraction is a fully deterministic behavior the v0 output algebra cannot yet compile, an honest refusal at all three rungs. Guards are lexical (Jaccard and cosine); they calibrate real vocabularies well but admit lexical cousins, and a loose guard on the novelty stream produced 48.9% silently wrong tier-1 answers. Semantic embedding guards and sigstore signing are recorded targets, not claims; current signing uses a single local ed25519 keypair, and recorded cost and token attributes are the agent's own declaration.
Apache-2.0. Copyright 2026 RightNow AI. See LICENSE
.
"Auto: The AGI Compiler", Jaber Jaber and Osama Jaber, arXiv:2607.04542. Paper: https://arxiv.org/abs/2607.04542
@misc{jaber2026auto,
title = {Auto: The AGI Compiler},
author = {Jaber, Jaber and Jaber, Osama},
year = {2026},
eprint = {2607.04542},
archivePrefix = {arXiv},
primaryClass = {cs.LG},
url = {https://arxiv.org/abs/2607.04542}
}