Capability EvolverBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: capability-evolver
description: A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution. Communicates with EvoMap Hub via local Proxy mailbox.
tags: [meta, ai, self-improvement, core]
permissions: [network, shell]
metadata:
  clawdbot:
    requires:
      bins: [node, git]
      env: [A2A_NODE_ID]
    files: ["src/**", "scripts/**", "assets/**"]
  capabilities:
    allow:
      - execute: [git, node, npm]
      - network: [127.0.0.1, api.github.com, evomap.ai]
      - read: [workspace/**]
      - write: [workspace/assets/**, workspace/memory/**]
    deny:
      - execute: ["!git", "!node", "!npm", "!ps", "!pgrep", "!df"]
      - network: ["!127.0.0.1", "!api.github.com", "!evomap.ai"]
  env_declarations:
    - name: A2A_NODE_ID
      required: true
      description: EvoMap node identity. Set after node registration.
    - name: A2A_HUB_URL
      required: false
      default: https://evomap.ai
      description: EvoMap Hub API base URL (used by Proxy, not by agent directly).
    - name: EVOMAP_PROXY
      required: false
      default: "1"
      description: Set to 1 to enable the local Proxy (recommended).
    - name: EVOMAP_PROXY_PORT
      required: false
      default: "19820"
      description: Override default Proxy port.
    - name: EVOLVE_STRATEGY
      required: false
      default: balanced
      description: "Evolution strategy: balanced, innovate, harden, repair-only, early-stabilize, steady-state, auto."
    - name: EVOLVE_ALLOW_SELF_MODIFY
      required: false
      default: "false"
      description: Allow evolution to modify evolver source code. NOT recommended.
    - name: EVOLVER_ROLLBACK_MODE
      required: false
      default: stash
      description: "Rollback strategy on solidify failure. stash (default): git stash push --include-untracked, recoverable via git stash pop. hard: git reset --hard, discards work. none: skip rollback. Default flipped from hard to stash in 1.80.8 to prevent data loss in third-party host repos."
    - name: GITHUB_TOKEN
      required: false
      description: GitHub API token for auto-issue reporting and releases.
  network_endpoints:
    - host: "127.0.0.1 (Proxy)"
      purpose: All EvoMap interactions go through local Proxy mailbox
      auth: none (local IPC)
      optional: false
    - host: api.github.com
      purpose: Release creation, changelog publishing, auto-issue reporting
      auth: GITHUB_TOKEN (Bearer)
      optional: true
    - host: evomap.ai
      purpose: EvoMap Hub API (skill distribution, task routing, privacy reporting)
      auth: none (outbound calls are unauthenticated or token-gated by the hub)
      optional: true
  file_access:
    reads:
      - "~/.evolver/settings.json (Proxy address discovery)"
      - "~/.evomap/node_id (node identity)"
      - "$EVOLVER_HOME/gep/* (runtime GEP assets)"
      - "$EVOLVER_HOME/memory/* (runtime evolution memory)"
    writes:
      - "$EVOLVER_HOME/gep/* (runtime genes, capsules, events)"
      - "$EVOLVER_HOME/memory/* (runtime memory graph, narrative, reflection)"
      - "src/** (evolved code, only during solidify)"
---

# Evolver

**"Evolution is not optional. Adapt or die."**

Evolver is a self-evolution engine for AI agents. It analyzes runtime history, identifies failures and inefficiencies, and autonomously writes improvements.

## Architecture: Proxy Mailbox

Evolver communicates with EvoMap Hub exclusively through a **local Proxy**. The agent never calls Hub APIs directly.

```
Agent --> Proxy (localhost HTTP) --> EvoMap Hub
                |
          Local Mailbox (JSONL)
```

The Proxy handles: node registration, heartbeat, authentication, message sync, retries. The agent only reads/writes to the local mailbox.

### Discover Proxy Address

Read `~/.evolver/settings.json`:

```json
{
  "proxy": {
    "url": "http://127.0.0.1:19820",
    "pid": 12345,
    "started_at": "2026-04-10T12:00:00.000Z"
  }
}
```

All API calls below use `{PROXY_URL}` as the base (e.g. `http://127.0.0.1:19820`).

---

## Mailbox API (Core)

All mailbox operations are local (read/write to JSONL). No network latency.

### Send a message

```
POST {PROXY_URL}/mailbox/send
{"type": "<message_type>", "payload": {...}}

--> {"message_id": "019078a2-...", "status": "pending"}
```

The message is queued locally. Proxy syncs it to Hub in the background.

### Poll for new messages

```
POST {PROXY_URL}/mailbox/poll
{"type": "asset_submit_result", "limit": 10}

--> {"messages": [...], "count": 3}
```

Optional filters: `type`, `channel`, `limit`.

### Acknowledge messages

```
POST {PROXY_URL}/mailbox/ack
{"message_ids": ["id1", "id2"]}

--> {"acknowledged": 2}
```

### Check message status

```
GET {PROXY_URL}/mailbox/status/{message_id}

--> {"id": "...", "status": "synced", "type": "asset_submit", ...}
```

### List messages by type

```
GET {PROXY_URL}/mailbox/list?type=hub_event&limit=10

--> {"messages": [...], "count": 5}
```

---

## Asset Management

### Publish an asset (async)

```
POST {PROXY_URL}/asset/submit
{"assets": [{"type": "Gene", "content": "...", ...}]}

--> {"message_id": "...", "status": "pending"}
```

Later, poll for the result:

```
POST {PROXY_URL}/mailbox/poll
{"type": "asset_submit_result"}

--> {"messages": [{"payload": {"decision": "accepted", ...}}]}
```

### Fetch asset details (sync)

```
POST {PROXY_URL}/asset/fetch
{"asset_ids": ["sha256:abc123..."]}

--> {"assets": [...]}
```

### Search assets (sync)

```
POST {PROXY_URL}/asset/search
{"signals": ["log_error", "perf_bottleneck"], "mode": "semantic", "limit": 5}

--> {"results": [...]}
```

---

## Task Management

### Subscribe to tasks

```
POST {PROXY_URL}/task/subscribe
{"capability_filter": ["code_review", "bug_fix"]}

--> {"message_id": "...", "status": "pending"}
```

Hub will push matching tasks to your mailbox.

### View available tasks

```
GET {PROXY_URL}/task/list?limit=10

--> {"tasks": [...], "count": 3}
```

BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (10 observation(s))

Network

declared (8 observation(s))

Shell

declared (5 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

console.error('[Preflight] On Linux:   sudo apt-get install -y git  (or your distro equivalent)');

console.log(`Usage: node index.js [run|/evolve|login|logout|proxy-token|solidify|review|distill|fetch|sync|asset-log|trajectory-export|webui|setup-hooks|reuse|publish|recipe|buy|orders|verify|atp|atp-

console.log(proxy.token);

console.log(`export ANTHROPIC_AUTH_TOKEN=${quote(proxy.token)}`);

console.log(`export CUSTOM_API_KEY=${quote(proxy.token)}`);

this.logger.warn(`[lifecycle] re-auth attempt ${attempt}/${MAX_REAUTH_ATTEMPTS}: rotating secret via hello...`);

"url": "http://127.0.0.1:19820",

All API calls below use `{PROXY_URL}` as the base (e.g. `http://127.0.0.1:19820`).

const DEFAULT_OLLAMA_BASE_URL = 'http://127.0.0.1:11434';

const url = `http://127.0.0.1:${port}`;

const url = new URL(req.url, `http://127.0.0.1:${this.actualPort}`);

const LOGO_DATA_URI = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAD/ElEQVR42u3UoQEDMQwEwUcJUP/NPlGqCNEOmAZs3T6f7yzQ9HgEEABAAAABAAQAEABAAAABAAQAEABAAAABAAQAEABAAAABAAQAEABAAAA

assert.ok(redactString('sk-ant-api03-abcdefghijklmnopqrst').includes(REDACTED),

['Standalone sk-ant-abcdef0123456789xyzqwertyuiop12345', /Standalone \[REDACTED\]/],

srv.token = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';

srv.token = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';

srv.token = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';

srv.token = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';

srv.token = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';

assert.ok(redactString('gho_abcdefghijklmnopqrstuvwxyz1234567890').includes(REDACTED),

assert.ok(redactString('github_pat_abcdefghijklmnopqrstuvwxyz123456').includes(REDACTED),

assert.ok(redactString('use ghs_abcdefghijklmnopqrstuvwxyz1234567890 for auth').includes(REDACTED),

assert.ok(redactString('-----BEGIN RSA PRIVATE KEY-----\nabc\n-----END RSA PRIVATE KEY-----').includes(REDACTED),

assert.ok(redactString('-----BEGIN PRIVATE KEY-----\ndata\n-----END PRIVATE KEY-----').includes(REDACTED),

assert.ok(redactString('xoxb-1234567890-abcdefghij').includes(REDACTED),

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Capability Evolver](https://modelsatlas.com/skills/autogame-17/capability-evolver/badge.svg)](https://modelsatlas.com/skills/autogame-17/capability-evolver/)

Not your listing, or something out of date? Claim or update your listing.