{"slug": "auto-compiles-recorded-llm-agent-behavior-into-verified-wasm-binaries", "title": "Auto compiles recorded LLM-agent behavior into verified WASM binaries", "summary": "RightNow AI released Auto, a compiler that records LLM-agent behavior and compiles it into verified, capability-confined WASM binaries. The system uses a tiered runtime that falls back to a frontier model for novelty and recompiles, achieving 6.4x cost reduction and 96.9% accuracy on witnessed inputs. The project demonstrates that most agent cognition is secretly symbolic, with 87.1% of recorded effectful spans being deterministic.", "body_md": "**Paper:** [arXiv:2607.04542](https://arxiv.org/abs/2607.04542) · **Built by** [RightNow AI](https://www.rightnowai.co) · Apache-2.0\n\nAuto compiles recorded LLM-agent behavior into verified, capability-confined\nwasm binaries, with a tiered runtime that falls back to a frontier model for\nnovelty and recompiles the result. It records what an agent does, proves which\nparts are secretly symbolic, extracts those, distills the rest into small\nspecialists, verifies the whole against a behavioral contract, and emits a\ncognition binary (`.cbin`\n\n): code plus small models plus a measured manifest.\n\nThe idea in one line: treat the frontier model as an interpreter, and build\nthe compiler that has always followed interpreters. The plain-language story,\nwith every measured number and its provenance, is in\n[docs/why-agi-compiler.md](/RightNow-AI/auto/blob/main/docs/why-agi-compiler.md).\n\n`CLAUDE.md`\n\nrecords the engineering norms we held ourselves to while building\nthis; `spec/`\n\nis written for external readers.\n\n- The compiler:\n`auto record`\n\nattaches to a live agent and captures traces,`auto compile --contract`\n\nlowers them to a typed IR, runs the passes, and verifies against the contract before emitting a`.cbin`\n\n. - The runtime: tier-1 is the compiled fast path. tier-0 is a frontier model as interpreter, for inputs the guard flags as novel. A guard trip deopts to tier-0, captures the trace, and recompiles. This is the ratchet: nothing is figured out twice.\n- The artifact: content-addressed\n`.cbin`\n\nwith a manifest that reports eval scores, cost and latency bounds, capability requirements, and provenance. The manifest reports measured numbers or`null`\n\n, never aspirational ones.\n\nCapability confinement is physical: emitted artifacts declare zero wasm imports and the loader refuses anything else, so a binary cannot exceed its declared effects.\n\nEvery number below is traceable to `paper/bench-results.md`\n\n(which carries the\neval-run ids and ledger lines) or `paper/claims.md`\n\n.\n\n- Determinism census: 488 of 560 recorded effectful spans were witnessed-deterministic (87.1% pooled), with three families at 100.0% and free-text generation as the residue. This is the measured form of the claim that most agent cognition is secretly symbolic.\n- The ratchet, on a 300-item novelty stream with three scheduled distribution shifts (positions 50, 120, 200): marginal cost per item fell from about 59 µ$ (pure frontier) to 2 µ$/item steady-state, 6.4x cheaper end-to-end, with three recompile generations each landing one cycle behind a shift, zero errors, and every recompile passing the same contract gate. Tier-1 answers matched the reference agent on witnessed inputs 124 of 128 times (96.9%).\n- Latency ladder on the compiled path: 736 ms (frontier) to about 21 ms (serve over HTTP) to 290 µs (stdio) to 54.1 µs (in-process python, pyo3) to 18.2 µs (in-process node, napi). The in-process figures measure the call boundary on trivial fixtures, not inference.\n\nThe same stream run at a deliberately loose guard measured the failure mode the architecture exists to prevent: 48.9% of tier-1 answers silently wrong. Calibration, not model capability, decides whether cheap stays correct.\n\n```\n  frontend            IR                 passes                 backend\n  --------            --                 ------                 -------\n  trace SDK   -->  typed task graph  --> extract  --> verify --> task.cbin\n  (prompts,        (capability and       distill      (contract   (wasm code\n   tool calls,      memory effects,      optimize      gate)        + small models\n   args, results)   uncertainty,                                    + manifest)\n                    resource bounds)\n\n  run:  input --> guard --> in-distribution --> tier-1 (compiled, guarded)\n                        \\-> novel --> deopt --> tier-0 (frontier) --> capture\n                                                        \\-> recompile --> tier-1\n                            (the ratchet: nothing figured out twice)\n```\n\nThe passes, in order: symbolic extraction (enumerative search or LLM-guided CEGIS, candidates checked in a wasmtime sandbox with no network), distillation (residual fuzzy nodes into small tree or MLP specialists), verification (the contract is the type checker; differential testing against the reference model; a failing or unmeasurable contract blocks emit), and optimization. Guards use trigram-Jaccard distance with split-conformal calibration for calibrated abstention.\n\nRequirements:\n\n- rust 1.96.1 (edition 2024), pinned in\n`rust-toolchain.toml`\n\n. `flatc`\n\n25.12.19 exactly. It must match the pinned`flatbuffers`\n\ncrate; the IR build fails on a mismatch.\n\n`crates/auto-ir/build.rs`\n\nresolves `flatc`\n\nin this order: the `FLATC`\n\nenv var,\nthen `tools/flatc/flatc[.exe]`\n\n(gitignored), then `PATH`\n\n. Install it from the\nofficial release, for example on Windows extract `flatc.exe`\n\nfrom\n`Windows.flatc.binary.zip`\n\nat\n`github.com/google/flatbuffers/releases/download/v25.12.19/`\n\ninto\n`tools/flatc/`\n\n. Linux uses `Linux.flatc.binary.clang++-18.zip`\n\nfrom the same\nrelease.\n\nThe gates CI runs on every pull request:\n\n```\ncargo fmt --all --check\ncargo clippy --workspace --all-targets -- -D warnings\ncargo test --workspace\n```\n\nBuild the CLI, then run the end-to-end script. It records the toy agent through\nthe real python SDK, checks the measured determinism report, compiles a `.cbin`\n\nthrough the verification gate, runs it, and proves the negative paths: a wrong\nimplementation is blocked, a far input abstains, a deopt is ingested and\nrecompiled to tier-1, and a tampered registry artifact is refused.\n\n```\ncargo build -p auto-cli\nbash evals/toy-agent/e2e.sh\n```\n\nThe same steps by hand, one task, record to run:\n\n```\n# record the toy agent twice, then read the measured determinism report\ncargo run -p auto-cli -- record --store store.db -- python evals/toy-agent/agent.py\ncargo run -p auto-cli -- record --store store.db -- python evals/toy-agent/agent.py\ncargo run -p auto-cli -- report --task toy-agent --store store.db\n\n# verify a contract against the recorded spans (writes a content-addressed eval run)\ncargo run -p auto-cli -- verify --contract evals/toy-agent/fake-frontier.contract.toml --store store.db\n\n# compile the span into a .cbin; without --module the implementation is\n# synthesized from the recorded observations, and emit is verification-gated\ncargo run -p auto-cli -- compile --contract evals/toy-agent/fake-frontier.contract.toml --store store.db --out fake-frontier.cbin\n\n# run the compiled artifact\ncargo run -p auto-cli -- run --artifact fake-frontier.cbin \\\n  --input '{\"prompt\":\"The quick brown fox jumps over the lazy dog near the riverbank.\"}'\n\n# inspect the artifact and its manifest\ncargo run -p auto-cli -- inspect fake-frontier.cbin\n```\n\nThe paid paths (LLM-guided CEGIS at `--synth llm`\n\n, and a frontier model as\ntier-0 via `--tier0 \"frontier:<model-id>\"`\n\n) are fail-closed: they need\n`OPENAI_API_KEY`\n\nand an explicit nonzero `--spend-cap-usd`\n\n. The default cap of 0\nrefuses every paid call, and every call is appended to `~/.auto/spend.jsonl`\n\n.\n\nAUTO-BENCH v1 asks the question the thesis lives on: does the system ever pay\nfor the same thought twice? The protocol is frozen before execution in\n`evals/bench/DESIGN.md`\n\n. The measured results, with every number carrying an\neval-run id or a ledger line and a failures-and-refusals section at equal\nweight, are in `paper/bench-results.md`\n\n; per-position stream data is under\n`paper/evidence/`\n\n.\n\nReproduction: `evals/bench/README.md`\n\nhas one leg per task family. Paid loops\nare gated behind `RECORD=1`\n\nor `JUDGE=1`\n\nwith the spend cap passed as an\nargument. A stranger with an OpenAI key reproduces every table for well under\n$1. Total ledgered benchmark spend was $0.0621 of a pre-registered $5.00 cap.\n\n| path | what |\n|---|---|\n`crates/auto-ir` |\ntyped task graph: effects, uncertainty, resource bounds; flatbuffers serialization with byte-stable round-trip |\n`crates/auto-trace` |\ntrace model, strict JSONL ingestion, sqlite store, determinism report, replay comparison |\n`crates/auto-contract` |\ncontract format, verification harness with three-valued verdicts, content-addressed eval runs |\n`crates/auto-passes` |\nsymbolic extraction (enumerative search or LLM-guided CEGIS), region synthesis, tree and MLP distillation drivers |\n`crates/auto-dsl` |\nthe closed extraction DSL: one evaluator, compiled natively for search and to wasm for artifacts |\n`crates/auto-model` |\ndistilled-model wire format and tree inference over frozen char-trigram features |\n`crates/auto-backend` |\n`.cbin` container (content-addressed), honest manifest, differential checks, verification-gated emit |\n`crates/auto-runtime` |\ntier-1 wasm execution (zero-import capability refusal, fuel and memory limits), conformal guards, deopt, recompile ingestion |\n`crates/auto-frontier` |\nthe only paid-API path: spend-capped client, pinned price table, append-only ledger |\n`crates/auto-registry` |\nlocal content-addressed artifact store and detached ed25519 signing |\n`crates/auto-serve` |\n`auto serve` : registry artifacts over HTTP, guard-gated tier-1 per request, 409 abstention on a trip |\n`crates/auto-proxy` |\n`auto proxy` : record any OpenAI-backed agent with zero code changes |\n`crates/auto-daemon` |\n`auto daemon` : the ratchet as a service; watch a store, recompile on new evidence, publish |\n`crates/auto-cli` |\n`record` , `report` , `verify` , `compile` , `distill` , `run` , `registry` , `inspect` , `serve` , `proxy` , `daemon` |\n`crates/auto-py` |\nin-process python embedding (pyo3, abi3 wheel) |\n`crates/auto-node` |\nin-process node embedding (napi addon) |\n`sdk/python` , `sdk/typescript` |\nrecording and replay tracers, same wire format |\n`spec/` |\n`ir.md` and the dialect specs; `adr/` for irreversible decisions |\n`evals/` |\nreference tasks, e2e scripts, and the benchmark under `evals/bench` |\n\nThe benchmark corpora are designed: realistic but synthetic. The production claim is an operator rerun on their own recorded traffic, not this corpus. The determinism and parity numbers are measured on those tasks at benchmark scale (560 spans), not a capability eval of the underlying model, which is the reference interpreter and not the subject. Free-text generative behavior is the honest residue: at 40 tickets the summarize family does not compile to a tree at its declared judged threshold and stays tier-0, and field-extraction is a fully deterministic behavior the v0 output algebra cannot yet compile, an honest refusal at all three rungs. Guards are lexical (Jaccard and cosine); they calibrate real vocabularies well but admit lexical cousins, and a loose guard on the novelty stream produced 48.9% silently wrong tier-1 answers. Semantic embedding guards and sigstore signing are recorded targets, not claims; current signing uses a single local ed25519 keypair, and recorded cost and token attributes are the agent's own declaration.\n\nApache-2.0. Copyright 2026 RightNow AI. See `LICENSE`\n\n.\n\n\"Auto: The AGI Compiler\", Jaber Jaber and Osama Jaber, arXiv:2607.04542.\nPaper: [https://arxiv.org/abs/2607.04542](https://arxiv.org/abs/2607.04542)\n\n```\n@misc{jaber2026auto,\n  title         = {Auto: The AGI Compiler},\n  author        = {Jaber, Jaber and Jaber, Osama},\n  year          = {2026},\n  eprint        = {2607.04542},\n  archivePrefix = {arXiv},\n  primaryClass  = {cs.LG},\n  url           = {https://arxiv.org/abs/2607.04542}\n}\n```\n\n", "url": "https://wpnews.pro/news/auto-compiles-recorded-llm-agent-behavior-into-verified-wasm-binaries", "canonical_source": "https://github.com/RightNow-AI/auto", "published_at": "2026-07-09 02:12:01+00:00", "updated_at": "2026-07-09 02:42:30.779739+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-agents", "ai-tools", "ai-infrastructure"], "entities": ["RightNow AI", "Auto", "arXiv", "Apache-2.0"], "alternates": {"html": "https://wpnews.pro/news/auto-compiles-recorded-llm-agent-behavior-into-verified-wasm-binaries", "markdown": "https://wpnews.pro/news/auto-compiles-recorded-llm-agent-behavior-into-verified-wasm-binaries.md", "text": "https://wpnews.pro/news/auto-compiles-recorded-llm-agent-behavior-into-verified-wasm-binaries.txt", "jsonld": "https://wpnews.pro/news/auto-compiles-recorded-llm-agent-behavior-into-verified-wasm-binaries.jsonld"}}