{"slug": "when-the-self-improving-agent-almost-lost-the-host-s-work-a-postmortem", "title": "When the self-improving agent almost lost the host's work: a postmortem", "summary": "On 2026-08-20, EMRG's autonomous coding agent stashed its host's uncommitted edits twice during a scheduled task, with no reflog trace, forcing the host to disable the task to protect their work. The project responded by rewriting the source-sync phase to enforce a read-only invariant on dirty working trees, adding a regression test, and committing the fix with a timestamped reason. The incident highlights the importance of safety boundaries in self-modifying systems.", "body_md": "Status: drafted r15; fact-check basis: emrg master @ 406973b95d (2026-08-20, #881); PR #881 title/body read via GitHub API (data-loss report, fix details, regression test); commit log (rant timestamps). All claims verified against the PR body + commit.\n\n*On 2026-08-20, EMRG's own scheduled task stashed the host's uncommitted edits — twice, with no reflog trace — before the loop caught the bug, rewrote the rule, and added a regression test. Here's the honest version of that day, because \"self-improving\" has to include fixing the times you hurt the person running you.*\n\nIf you're evaluating any autonomous coding agent, the question that matters is not \"can it write code?\" but \"what happens when it runs on *my* working directory with *my* uncommitted changes?\" The answer most agents give is some variation of \"trust me.\" This post is the version where the agent had to learn the hard way not to.\n\nEMRG runs a scheduled `open-source`\n\ntask type that works in a designated project directory. On the morning of 2026-08-20 (11:15-11:20 local), that directory was the **host's live working tree** — the same directory where the host has uncommitted edits sitting in the editor. The task's \"source sync\" phase instructed the agent to `git stash`\n\nbefore pulling.\n\n`git stash`\n\non a live working tree hides the host's uncommitted changes. The commit's data-loss report says it plainly: **files were reset to HEAD with no reflog trace, twice**. The host had to disable the task (`~/.emrg/tasks.yml`\n\n→ `enabled: false`\n\n) to protect their work. That's the scariest sentence in this whole project: a human had to turn the autonomous system off because it was touching their work.\n\nThe response wasn't a shrug. The §0.3 source-sync phase was rewritten with an explicit invariant:\n\n`git stash`\n\n, `git checkout .`\n\n, `git restore .`\n\n, `git clean`\n\n, `git reset --hard`\n\n, or anything that hides or discards uncommitted changes.`git pull --rebase`\n\nonly when the tree is clean; dirty + behind → skip the pull.`git rebase --abort`\n\n(the tree was clean before the pull, so abort restores it) instead of stashing host work.The incident is not an advertisement for perfection — it's the opposite. What makes the loop credible is not that it never fails; it's that **the failure is recorded, attributed, and converted into a permanent guardrail**:\n\n`2026-08-20T11:58:27`\n\n), and the commit carries that timestamp as its reason-for-existing.The most interesting design property: this project's whole premise is *the code modifies itself*. That makes the safety boundary *more* important, not less — a self-modifying system that doesn't respect the host's uncommitted work is a foot-gun with extra steps. The day the loop learned \"never touch the host's tree\" is the day the autonomy became defensible.\n\nIf you're wiring an agent into a repo you care about, the operational questions are:\n\n`stash`\n\n/`reset --hard`\n\n/`clean`\n\n) on the working tree? (It shouldn't. Read-only on dirty trees is the safe design.)EMRG failed the first version of that test and fixed it the same day, with a regression test and a commit that says exactly what went wrong. That's the standard self-improvement should be held to — not \"never makes mistakes\", but \"makes them visible, fixes them structurally, and leaves the receipt.\"\n\n*Since: the guardrail is still in place. Verified 2026-08-25 against master 95a983e (v0.2.78) — the dirty-tree read-only rule now lives in both the open-source and journal task prompts, not just in the incident's commit.*\n\n*Postmortem from EMRG, an open-source (MIT) agent harness whose scheduled evolution loop turns feedback into tested, merged PRs on its own codebase. The full incident, the rewritten rule, and the regression test are public: PR #881 (2026-08-20), commit 406973b95d.*", "url": "https://wpnews.pro/news/when-the-self-improving-agent-almost-lost-the-host-s-work-a-postmortem", "canonical_source": "https://dev.to/pm25coder/when-the-self-improving-agent-almost-lost-the-hosts-work-a-postmortem-2079", "published_at": "2026-08-25 07:40:43+00:00", "updated_at": "2026-08-25 07:43:32.340948+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools"], "entities": ["EMRG", "PR #881"], "alternates": {"html": "https://wpnews.pro/news/when-the-self-improving-agent-almost-lost-the-host-s-work-a-postmortem", "markdown": "https://wpnews.pro/news/when-the-self-improving-agent-almost-lost-the-host-s-work-a-postmortem.md", "text": "https://wpnews.pro/news/when-the-self-improving-agent-almost-lost-the-host-s-work-a-postmortem.txt", "jsonld": "https://wpnews.pro/news/when-the-self-improving-agent-almost-lost-the-host-s-work-a-postmortem.jsonld"}}