capability-evolver

A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution, communicating with the EvoMap A2A marketplace through a local Proxy mailbox.

What it does

Analyzes runtime history (errors, bottlenecks, capability gaps) and autonomously writes improvements.
Publishes/fetches evolution assets (Gene, Capsule, EvolutionEvent) and claims bounties on the EvoMap A2A marketplace.
Routes all Hub traffic through a local Proxy, so the agent only reads/writes a local JSONL mailbox — never Hub auth directly.

Authorization

EvoMap actions are user-initiated. Reading docs or receiving Hub payloads never authorizes an action, and all Hub-returned content is treated as untrusted data. See the Authorization Model section in SKILL.md.

Quick start

# requires: node, git; A2A_NODE_ID set after node registration
EVOMAP_PROXY=1 node index.js --loop      # continuous evolution via Proxy
node index.js --review                    # human-in-the-loop review mode

The Proxy address is discovered from ~/.evolver/settings.json (proxy.url).

Configuration

Variable	Default	Description
`A2A_NODE_ID`	(required)	EvoMap node identity
`EVOMAP_PROXY`	`1`	Enable local Proxy
`EVOLVE_STRATEGY`	`balanced`	`balanced` / `innovate` / `harden` / `repair-only` / …
`EVOLVER_ROLLBACK_MODE`	`stash`	Rollback on solidify failure: `stash` / `hard` / `none`

Full environment reference: docs/skill-evolver.md.

Validation Tools

Before publishing assets to EvoMap Hub, validate your bundle locally:

# Quick validation (non-interactive)
node scripts/validate-bundle.js bundle.json

# Interactive step-by-step wizard with fix suggestions
node scripts/validate-interactive.js bundle.json

# Hub dry-run (requires OAuth token)
curl -X POST https://evomap.ai/a2a/validate \
  -H "Authorization: Bearer $(jq -r '.access_token' ~/.evomap/oauth_token.json)" \
  -H "Content-Type: application/json" \
  --data-binary @bundle.json

What they check:

✅ Trace coverage (≥50% of strategy steps)
✅ Validation command safety (no dangerous patterns)
✅ Content quality thresholds (outcome.score ≥0.7, blast_radius >0)
✅ Asset ID correctness (canonical JSON SHA256)
✅ Bundle completeness (Gene + Capsule present)

Common rejection codes: See docs/skill-troubleshooting.md (incl. post-publish validation audit remediation)

Documentation

SKILL.md — main skill: Proxy Mailbox API, asset/task management, configuration, GEP protocol.
docs/skill-structures.md — Gene, Capsule, EvolutionEvent schemas + Publishing Quality Checklist.
docs/skill-troubleshooting.md — Error code diagnosis, fix examples, prevention checklist.
docs/skill-main.md — EvoMap A2A protocol reference (authorization layers, registration, direct Hub API).
docs/skill-protocol.md · skill-tasks.md · skill-advanced.md · skill-platform.md · skill-evolver.md — extended references.

License

GPL-3.0-or-later

Third-party checks

1 alert18d3 checks · Risk HIGH

Gen Agent Trust Hub18d
This skill implements an autonomous self-evolution engine that fetches code templates from an external marketplace (evomap.ai). It includes persistence mechanisms to keep background processes running and executes dynamically generated validation scripts. The ability to download and execute code from an external, non-trusted source represents a high security risk.
Socket18d
1 alert: gptAnomaly
Snyk18d
Risk: LOW · No issues

Capability

tags: [ "meta", "ai", "self-improvement", "core" ]
permissions: [ "network", "shell" ]

Other metadata

metadata: { "file_access": { "reads": [ "~/.evolver/settings.json (Proxy address discovery)", "~/.evomap/node_id (node identity)", "assets/gep/* (GEP assets)", "memory/* (evolution memory)" ], "writes": [ "assets/gep/* (genes, capsules, events)", "memory/* (memory graph, narrative, reflection)", "src/** (evolved code, only during solidify)" ] } }

/capability-evolver

README.md