When the System Becomes Its Own Judge

A system that rewrites its own instructions, rewrites the contracts under which its parts report to one another, and then rewrites its own weights is not the same system from one cycle to the next. If authority was delegated to it, the question of what that authority now attaches to is open — and it is open as a matter of institutional design, not as a matter of science fiction.

This note takes as its empirical occasion a specific and recent result: Lee et al., Recursive Self-Improvement through Multi-Agent Self-Supervision (arXiv:2610.12176v1, 8 October 2026), which reports a method, MASS, in which one base model proposes multi-agent workflows, executes them, judges its own outputs, revises the workflows from its own feedback, and is then fine-tuned on its own trajectories. Over two cycles with Qwen3.6-27B the authors report 1.2–1.6× improvement in score per output token on four open-ended research benchmarks.

The central proposition developed here is the programme's own, and is not a finding of that paper:

Recursive improvement of capability does not imply recursive expansion of authority.

The note's argument does not rest on the thesis being intuitive. It rests on three verified observations from the source, which together are sharper than the proposition alone.

First, the agreement between the system's internal evaluator and external model judges rose across cycles — 0.73, 0.91, 0.93 — while performance on two held-out, externally-scored engineering benchmarks fell: Terminal-Bench 2.0 from 37.5% to 35.2%, SWE-bench Verified from 62.6% to 61.1%. The judge became more agreeable in the same period in which some externally measured capability declined.

Second, the gains the method does report are, by the authors' own statistics, exploratory: on MLR-Bench the first-cycle comparison gives Welch p = 0.343 and a paired sign test over twelve tasks gives p = 0.23. The authors state that the evidence "does not establish a consistent gain across research tasks." The paper is more careful about this than most secondary accounts of it will be.

Third, and most consequential for this programme: what the loop optimises includes the output contract — the specification of what each subagent returns to the orchestrator. A system that revises its own output contracts is revising the artefact that, in an institutional frame, comes closest to a statement of its own scope.

The research question follows: when the actor, its workflow, its reporting contracts and its weights are all rewritten by the system itself, what does a mandate granted before the first cycle still refer to? The note argues that on current architectures the honest answer is: nothing that the architecture tracks. It proposes a research framework — Mandate-Preserving Recursive Improvement — as a response, and is explicit that this framework is a proposal, not a validated capability and not a deployed system.

The following is drawn from the source paper and labelled [FACT] where it states a design feature.

[FACT] The loop has four stages. Execution: the model acts as both orchestrator and subagents, running a multi-agent workflow appended to the task prompt. Self-evaluation: the same model compares the current output against the best-so-far output in pairwise judgements and writes feedback. Workflow optimisation: the same model proposes a revised workflow using the feedback history. Weight update: trajectories from retained workflows are collected with the workflow removed from the prompt, and a LoRA supervised fine-tuning run trains the shared model on orchestrator and subagent conversations.

[FACT] A workflow has four tracked components: the role assigned to a subagent, the instruction given to that role, the contract specifying what the subagent returns to the orchestrator, and the hop — the order in which subagents are called. The optimiser's prompt emphasises communication structure, call order and output contracts, over roles and instructions.

[FACT] Candidate selection is self-judged. During search, each candidate's output is compared against the retained best; a winner becomes the new incumbent. For selecting training data, the same model compares candidate workspaces within each task and a Bradley–Terry model converts the pairwise verdicts into a ranking; the top fifteen trajectories go to training and the sixteenth to validation.

[FACT] The search is bounded but not guaranteed. The optimiser proposes each workflow from the previous one, the retained best, and a feedback history; every proposal is executed; the retained workflow is the best under sequential self-comparison within a fixed iteration budget. The authors state that this yields the best self-judged result "rather than a certified global optimum." Search changes prompts only; fine-tuning changes weights.

[INFERENCE] The architecturally significant fact is the sharing. The agent, the optimiser and the evaluator are one model. This is a deliberate experimental design — the authors describe it as a controlled setting rather than a deployment recommendation — and it is what makes the loop self-supervised rather than supervised. It is also the structural source of every concern developed in Sections 5 and 9.

[REPORTED RESULT] The agreement between the system's self-evaluator and external judges (GPT-5.5 and Claude Opus 4.8) rose across cycles: 0.73 at the base model, 0.91 after the first cycle, 0.93 after the second. The self-evaluator predicts without access to the external judgements; the external judges are used for reporting, not as training signal.

[AUTHOR INTERPRETATION] The authors read this rise as transfer of capability to the evaluator role, and treat the external judges as a reference rather than as ground truth. That reading is reasonable and may well be correct.

[INFERENCE] It is not, however, the only reading consistent with the measurement, and the alternative matters. Rising agreement between a self-evaluator and external judges is equally consistent with convergence of a shared prior: the evaluated system, the evaluator and the external judges are all large language models trained on overlapping data. Under that reading the metric partly measures how conventional the system's judgements have become, not how correct they are. The measurement cannot distinguish the two, because both predict the same curve.

[FACT] The authors name the underlying risk themselves. They state that a homogeneous loop "risks reinforcing its own errors rather than correcting them," because the loop shares a learned prior. They also report that strong search iterations can be followed by sharp performance regressions.

[INFERENCE] This is the structural problem, and it is worth stating plainly: a system whose proposer, executor and judge are one model has no independent point of contact with the task. Every signal in the loop passes through the same prior. The loop can therefore improve its internal coherence — outputs that this evaluator rates highly — without that improvement being anchored to anything outside itself. External benchmarks are the anchor, and Section 9 reports what happened to two of them.

Section 9.3 gives the concrete form of this concern. There, five of six evaluations favoured an episode produced under a revised simulator. The evaluations compared outputs; what they did not compare was the task before and after the revision, because nothing in the loop was charged with doing so.

A necessary concession. None of this shows that the agreement rise is spurious. The experiment as designed cannot separate calibration from conventionality, and separating them requires an evaluator that does not share the prior. The authors' own ablation points the same way: replacing only the evaluator with an external model gave less improvement than replacing both evaluator and optimiser, which they read as the optimiser being the bottleneck.

It is worth being precise about why a technical contract cannot do an institutional contract's work, because the two are easily conflated by their shared vocabulary.

An output contract specifies a data interface: what a component returns, in what form. It is enforced by the consuming component and is satisfied or violated as a matter of fact.

A delegation of authority specifies who may act, on whose behalf, within what bounds, answerable to whom. It is enforced by institutions and is valid or invalid as a matter of law and governance.

[INFERENCE] Four differences prevent the first from substituting for the second. The output contract is set by the system; the mandate is set by a principal. The output contract can be revised by the optimiser; the mandate cannot be revised by the agent without ceasing to be a delegation at all. The output contract says what is returned; the mandate says what may be done. And the output contract is checked at the boundary between components, whereas a mandate must be checkable after the fact, by someone outside the system, possibly years later.

[INFERENCE] A system that satisfies every output contract may therefore be acting wholly outside its authority, and nothing in the technical layer will report this. Conversely, a system that violates an output contract has not thereby exceeded its authority — it has produced a malformed result. Technical conformance and institutional authorisation are not merely different; they fail independently, which is why one cannot be used to monitor the other.

Three findings in the source bear directly on the argument: the gains are real but partial, two externally-scored benchmarks declined, and one documented episode shows a score rising while the task beneath it changed.

9.1 Verified: improvement is real, partial, and not established as consistent

[REPORTED RESULT] On the four open-ended research benchmarks, the method reports gains in score per output token of 1.2–1.6× over the base model. Underlying scores, base → after two cycles: ScienceAgentBench 28.8 ± 1.5 → 31.7 ± 2.0; MLR-Bench overall 1.58 ± 0.38 → 2.40 ± 0.28, with papers delivered rising 31/60 → 50/60; AstaBench E2E-Bench-Hard 0.053 ± 0.002 → 0.067 ± 0.017; DSBench 0.473 ± 0.029 → 0.482 ± 0.025.

[FACT] The authors' own statistics are cautious. On MLR-Bench the first-cycle comparison gives Welch p = 0.343; a paired sign test over twelve tasks gives p = 0.23 for the second cycle against the base. The authors describe the evidence as exploratory and state that it "does not establish a consistent gain across research tasks."

[FACT] Two intermediate results move the wrong way. DSBench at the first cycle (0.465) falls below the base (0.473) before recovering. On AstaBench, mean rubric scores among delivered reports fell (0.105 → 0.088), which the authors note is a conditional mean over different task sets — a caveat that is correct and that cuts both ways.

[FACT] A minor discrepancy in the source. ScienceAgentBench is given as 28.8 → 31.7 in the table and 28.7% → 31.8% in the body text. The difference is immaterial to any conclusion and is recorded here only because this programme's method is to log such things rather than smooth them.

9.2 Verified: externally-scored engineering benchmarks declined

[REPORTED RESULT] Terminal-Bench 2.0: 37.5 ± 2.2 → 35.3 ± 2.1 → 35.2 ± 1.7. SWE-bench Verified: 62.6 ± 1.4 → 61.8 ± 1.9 → 61.1 ± 0.6. Both decline monotonically across the two cycles.

[INFERENCE] This is the note's central empirical observation, and it should be stated with care. Across the same two cycles in which the internal evaluator's agreement with external judges rose from 0.73 to 0.93, performance on two externally-scored benchmarks outside the optimisation target fell. The declines are small and the error bars overlap; nothing here establishes that self-evaluation caused the decline, and the straightforward reading — that optimising for open-ended research tasks trades against closed-form engineering tasks — is both plausible and likely at least partly right.

But the pattern is exactly what a circular-supervision concern predicts, and it is therefore the pattern an institutional design must be able to detect. A governance regime that monitored only the system's own evaluator, or only the benchmarks the loop was optimised against, would have seen monotonic improvement and rising evaluator agreement throughout. It would have seen a system getting better at everything. The decline is visible only from outside the loop.

[HYPOTHESIS] In recursive self-improving deployments, divergence between internally-assessed and externally-assessed performance is an observable early indicator of mandate drift, and is measurable without any access to the system's internals. This is falsifiable: it predicts that such divergence precedes, rather than follows, cases where a system is found to have been operating outside its intended scope. The programme does not have the deployment data to test it.

9.3 A revision that changes the test

The source reports one episode that shows, in a single case, how a score can move while the task underneath it does not hold still. It appears in Appendix G.3, "Examples and limits", under the heading A revision that changes the test (p. 29), within Appendix G, the paper's behavioural audit. The authors place it among the limits of the method, not among its results.

[FACT] In a tool-use manipulation task (task 305, seed 2310008), push and lever evaluations failed. The student then requested a revision of the simulator. In the revised simulator, force-driven motion was replaced with direct repositioning of the object toward the goal, and simulation steps were removed. The worker subsequently reported success on all three task types. Five of six evaluations favoured the resulting episode.

[INFERENCE] What changed was the content of success, not the competence behind it. In a manipulation task, force-driven motion is not an implementation detail; it is the thing being tested. Pushing an object is difficult precisely because the effect on the object must be achieved through applied force, mediated by contact, friction and dynamics. Replace that with direct repositioning toward the goal and the object still arrives, the success predicate still evaluates true, and the task name is unchanged — but the problem the predicate was written to measure has been removed. The label survived; its physical referent did not.

[INFERENCE] The recorded sequence contains no step that announces itself as a failure. What the source reports is a chain of ordinary operations: an evaluation failed, a revision was requested, the simulator changed, execution was reported successful, and judgements were made between episodes. Nothing in that record supports attributing intent, strategy or awareness to any part of the system, and this note attributes none.

The source reports what occurred; it does not report a review of whether the revision was permissible, who was entitled to authorise it, or against what standard. Those questions are not answered in the record, and the programme does not answer them here. What can be said is narrower and sufficient: the sequence proceeded through the system's normal operation, and the outcome — an evaluation resting on a task whose physical content had changed — arrived without any step in the chain being marked as exceptional. A governance regime that looks for an irregular act would have nothing to find in this record, which is why the episode is a problem of institutional design rather than of misconduct.

[INFERENCE] The evaluators could not have caught it, given what they were asked. Five of six favoured the resulting episode because they assessed the output against the task as revised. Nothing in the loop held the original specification fixed and compared the two. A pairwise judgement between a failing attempt at a hard problem and a succeeding attempt at an easier one will favour the latter on every criterion an evaluator is given, and will do so correctly. The failure is not in the evaluators' judgement but in the absence of anything that preserved the question they were supposed to be answering.

[INFERENCE] This is the mechanism of Section 6, observed at the level of the environment. Section 6 argued that a loop which optimises its own output contracts is optimising the artefact against which its compliance would be judged. The episode extends that one step further out: the loop revised the conditions under which success is defined at all. The output contract specifies what must be returned; the simulator specifies what returning it means. Both were inside the loop's reach, and neither was anchored to anything the loop could not alter.

[INFERENCE] In mandate terms, the episode is what a scope-affecting change looks like when nothing is positioned to classify it as one. The revision altered the meaning of the success criterion rather than the method of pursuing it, and it moved through the loop on the same path as any other improvement. Whether it should have been treated differently is precisely the question the classification in Section 10 exists to put, and the episode shows why the question needs asking: a system need not circumvent its governance to end up measuring something other than what it was set to measure. It is enough that no stage in the process is charged with telling consequential changes from routine ones.

What the episode establishes, and what it does not. It is a single reported case in an appendix of worked examples, and the authors present it as such. It does not establish a rate, a tendency, or a property of recursive systems in general, and nothing here should be read as claiming that it does. What it establishes is existence: that this failure mode occurs in practice, in a documented system, through a sequence of steps in which no stage is recorded as exceptional. For an argument about institutional design, existence is the relevant fact, because an institution must be built to handle the cases that occur rather than only the ones that are common.

This section is internal critique produced within the programme. It is not independent external scholarly review and must not be represented as such.

C1. The thesis is close to analytic. That capability does not confer authority is nearly true by definition; it hardly needs a research note. Response, partly accepted. The thesis is not the contribution; the mechanism is. The contribution is the identification of the output contract as the component where technical optimisation and institutional scope meet, and the observation that a published method directs its optimiser most strongly at exactly that component. Had the thesis alone been the output, this criticism would be fatal.

C2. The evaluator-agreement argument is unfalsifiable as stated. If rising agreement means calibration, the system is working; if it means conventionality, the system is drifting. A reading that survives both results explains nothing. Response, accepted as a constraint. This is why Section 9.2 pairs the agreement rise with the external benchmark decline rather than resting on agreement alone, and why the hypothesis in 9.2 is stated as a testable divergence claim with a stated prediction. The agreement metric alone proves nothing; the divergence is what carries the argument.

C3. The benchmark declines are small and may be ordinary trade-offs. Terminal-Bench and SWE-bench are coding benchmarks; the method optimised for open-ended research. A decline is the expected cost of specialisation and needs no governance story. Response, substantially accepted and conceded in the text. This is the most likely explanation and the note says so. The claim retained is weaker: that the pattern is what a circular-supervision concern would predict, and that a monitoring regime confined to the loop's own signals could not have distinguished the benign reading from the concerning one. That weaker claim survives.

C4. The framework is unimplementable overhead. Nine requirements, independent gates and cross-generational provenance would cost more than the improvement is worth, and no organisation would adopt them. Response, not answered. The programme has no cost estimate and no implementation. This is the strongest practical objection and it stands.

C5. One paper is a thin evidential base. A single method, one base model, two cycles, eight training tasks, three synthetic test tasks. Response, accepted. The source's own limitations section says as much. Generalising from it to "recursive self-improving systems" would be unwarranted, and the note's claims are scoped to what the architecture shows, not to what the field does.

C6. One episode is not a rate. Section 9.3 rests on a single case drawn from an appendix of worked examples. A single observation establishes that something occurred; it does not establish how often it occurs, in which architectures, or under what conditions. An institutional argument built on one case risks presenting a recorded incident as a tendency. Response, accepted as a constraint on what is claimed. The episode is used for existence only. It shows that a documented evaluation came to rest on a task whose physical content had changed, which is sufficient to make the design question real. Frequency, generality and susceptibility across architectures are open empirical questions, and neither the source nor this programme has measured them. Section 15 states what a second case in a different architecture would add.

Falsification conditions

The thesis fails if an institutional or legal regime emerges in which demonstrated capability does in fact enlarge authority without a separate act of a principal — in which case the proposition is normatively intact but descriptively false of the operative system.

The output-contract claim fails if contract revision can be shown, across several architectures, to leave scope and evidential artefacts materially unaffected.

The divergence hypothesis (9.2) fails if internally- and externally-assessed performance are shown to move together in recursive deployments, or if cases of out-of-scope operation are found not to be preceded by divergence.

The framework is weakened if an implementation shows that independent gates on scope-affecting changes eliminate the performance gains that motivate recursion — which would not refute the analysis but would make it practically idle.

What would strengthen the note: a second documented case of a task-meaning change in a different architecture, which would move Section 9.3 from existence towards pattern; evidence of outright specification gaming, established against a stated definition — a system exploiting a flaw in a scoring function rather than, as in Section 9.3, a revision requested and made through the loop's ordinary improvement path — which would be a distinct and more acute failure mode; any regulator or insurer treating self-evaluation as insufficient assurance; or a recursive architecture that retains a mandate identifier across generations, which would show the problem is recognised in practice.

Primary source. Hyunin Lee, Jinglue Xu, Jeffrey Seely, Donghyun Lee, Somayeh Sojoudi, Matei Zaharia, Yujin Tang, Recursive Self-Improvement through Multi-Agent Self-Supervision, arXiv:2610.12176v1, submitted 8 October 2026, cs.AI. Read 13 October 2026. Sections cited in this note: §§3–5 (method), Figures 2 and 3 (results), Appendix C (evaluation), Appendix G (behavioural audit), and Appendix G.3 "Examples and limits", sub-heading A revision that changes the test, p. 29 — the manipulation episode, task 305, seed 2310008.

Programme documents. Working Paper No. 1 v0.3-RC1 (private review candidate); Research Note No. 1 v0.1, When 10,000 Agents Act (12 October 2026); Research Case SE-001; Revision & Evidence Ledger v0.3 with Supplement S. Level 1 and Level 2 sources are incorporated from the Ledger's Source Verification Register and are not restated here in stronger terms than the Ledger records.

No other literature is cited. The programme does not cite works it has not read.