autoresearch-loop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited autoresearch-loop (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generalize Karpathy's autoresearch into a domain-adaptive improvement loop. The agent discovers what to measure, then runs a disciplined propose → trial → keep-or-revert loop, maintaining an explicit ledger of what was tried, kept, discarded, and implemented.
Read DESIGN.md once at the start of a run for the full architecture and the domain-specific tensions (metric latency/noise/cost, Goodhart gaming, cost-per-trial, reversibility). The phases below are the operating procedure.
Runtime: the loop's mechanics (run a trial, parse the metric, score confidence, keep/commit or discard/revert) are handled by the arl CLI over a .auto/ session folder — a Claude-native port of pi-autoresearch's tools. Read references/runtime-contract.md for the .auto/ layout, the METRIC name=value contract, MAD confidence scoring, and the arl init|run|log|status commands. Invoke it as node scripts/arl.mjs <cmd> (or arl if on PATH).
Given {project, goal, context} — follow the procedure in references/metric-discovery.md (restate the goal as an outcome → enumerate candidates on the proxy→outcome spectrum → score on six axes → choose primary + guardrails + strategy → red-team for gaming). In brief:
adapters/*.md). If none fits, draft an inline adapter following references/domain-adapter-contract.md.deterministic-delta (fast, low-noise), significance-test, or bandit (noisy/delayed/expensive — e.g. ads).runs/<id>/CHARTER.md. Confirm it with the user before spending real budget if trials cost money or touch production.Write .auto/measure.sh (and .auto/checks.sh if guardrails require it). arl init with the primary metric + direction, run the baseline (arl run), and record it (arl log --status keep --metric <baseline> --desc baseline). If the baseline can't be measured cleanly and repeatably, stop (see "When NOT to run").
Before proposing any change, profile where the cost actually is, and confirm the benchmark stresses the IN-SCOPE artifact — not a dependency, a native/FFI call, an external engine, the network, or unrelated code. (Validated the hard way on two live runs: once the assumed hot path was wrong twice and 97% of time was in an out-of-scope library; once the in-scope managed code was only 0.4–3.8% of wall-time because a Rust NIF dominated — the correct loop output there was a true negative, "re-scope," not a sub-noise edit. See adapters/code-perf-audit.md → Pitfalls.) Spend one profiling run on the managed-vs-native/dependency split; a loop that optimizes code which isn't the bottleneck produces confident, useless churn — and proving "no in-scope headroom" cheaply is itself a successful outcome.
Each iteration:
.auto/prompt.md, the .auto/log.jsonl tail, and .auto/ideas.md — never re-propose an exhausted line..auto/ideas.md; append newly-imagined ideas there..auto/ is preserved).arl run — runs the trial harness, parses METRIC lines, runs guardrail checks.sh.fast-low-noise domains, watch the MAD confidence score (<1.0× = within noise, re-run before trusting). For delayed-expensive domains (ads), do NOT trust a single trial — reach the adapter's minimum sample and use significance/bandit logic. A primary win that regresses any guardrail is a discard.arl log --status keep|discard|... --metric <value> --desc "..." --asi <learning>. Keep auto-commits and advances the baseline; discard auto-reverts the code. Record cost with --cost.--asi with what was learned (survives a discard's revert); prune exhausted ideas.Respect concurrency reality: deterministic domains can run many fast sequential trials; noisy/delayed domains (ads) run few long concurrent trials and must reach a minimum sample before any verdict.
adapters/web-onboarding.md.At any stop, report (arl status summarizes most of it): metric baseline → current with the delta and confidence, the kept improvements (each with its delta and cost), what was tried and discarded with the --asi reasons from .auto/log.jsonl, the remaining promising ideas, and total cost. The durable record is .auto/ plus the git history of kept commits.
DESIGN.md — architecture, per-domain design tensions, and the pi-autoresearch prior-art decision (read once per run).references/metric-discovery.md — the Phase 0 procedure: deriving + scoring + red-teaming the metric.references/runtime-contract.md — the .auto/ layout, METRIC contract, MAD confidence, and arl commands.references/domain-adapter-contract.md — how to define a new domain adapter.references/journal-schema.md — the ledger record formats.adapters/*.md — concrete domain adapters (code-perf-audit, bug-finding, code-generation, google-ads, web-onboarding).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.