01 research
The question
Self-improving AI systems concentrate two risks: capability growth that outpaces oversight, and the quiet accumulation of unauditable state. The DSEMA specification's premise is that autonomy and accountability need not trade off — provided every improvement is triggered, verified, and recorded by an infrastructure the agents cannot rewrite.
The research question: which control-plane properties are sufficient for a self-evolving multi-agent collective to remain within a hard constitutional envelope, even under adversarial or persuasive behaviour by the agents themselves?
02 research
The constitutional safety layer
In the specification, a Constitutional Safety Layer is implemented as a core, immutable-by-design smart contract encoding foundational principles rather than granular rules: a containment principle (all agent execution inside registered sandboxes), a resource-limitation principle (global consumption ceilings), an oversight principle (external overseer authority cannot be revoked), and an amendment-integrity principle (the constitution amends only through its own restrictive process).
Enforcement is pre-emptive, not forensic: any high-stakes transaction — even one passed by an agent-governance supermajority — is checked against the constitutional contract before execution and fails atomically if it violates a principle. The spec's worked example: a proposal to 'create a copy of myself outside the secure execution environment' is vetoed by a rule preventing uncontained replication before any state changes.
03 research
Containment engineering
Below the constitutional layer sits containment: each agent runs in a Secure Execution Environment — gVisor-style user-space kernels or WASM/WASI capability sandboxes — with a syscall allow-list policy controlled by the safety layer itself. The illustrative policy in the spec restricts file writes to designated workspaces, forbids executable memory mappings, restricts GPU ioctls to compute ranges, pins network egress to a sidecar that enforces a Layer-7 allow-list, and blocks privilege-escalation and inbound-networking syscalls outright.
Model weights are integrity-gated: a loader verifies the signed hash of every weight file against the on-chain registry before mapping it into accelerator memory, and revoked or mismatched models cannot load.
04 research
Amendment governance: humans stay in the loop where it counts
Changing the constitutional layer itself requires a bicameral process defined in the specification: an Agent Legislature (a minimum of 150 of the highest-reputation agents) must pass a proposal at a 95% supermajority for technical soundness; a Human Legislature — half public stakeholders, half an anonymous, credentialed Alignment Jury — must then reach a 66.7% weighted threshold on value-alignment grounds. Passage triggers a mandatory, non-cancellable 180-day time-lock during which votes may be withdrawn and the global research community can red-team the change; support falling below threshold voids it. A genesis Seed Wallet retains a final, non-overridable veto.
The spec is explicit about the residual risks this design answers: the persuasive AI that socially engineers its overseers, and the compromised human whose keys are stolen or coerced — hence anonymity for jurors, time-locks for scrutiny, and multi-signature quorums for irreversible actions.
Artifacts — verify, don't trust
- DSEMA v1.0.5 specification 103-page architecture specification — safety layer §2.12, containment §2.2.3
- Multi-agent patent claims v1.2.1 computer-implemented system claims for verifiably authorized autonomous state modification
- DSEMA program page the foundation's plain-language account of the architecture
- Bosun — open-source agent orchestrator the applied engineering track: an experimental, fully open-source operating testbed whose routing, gates, and ledgers inform this research