The self-learning Governor

The Autonomous Delivery Engine learns which agent profile and model to use for a given task, and continuously audits that learning for quality regressions. This page explains the layered learning model (L0–L2) and what the L3 governor does on top of it. The single most important property to understand is at the end: the governor never auto-applies a configuration change — every change is gated on workspace-owner approval.

The learning layers (L0–L2)

Selection learning is layered so that a cold start is safe and the data-driven signal only steers selection once it is trustworthy.

L0 — the static heuristic

At the base, SupaCloud scores candidate profiles and models with a static heuristic over the task: severity, effort, budget headroom, and capability fit. A brand-new workspace with no history runs entirely on L0. This layer is always authoritative on safety and budget — the learned layers above it can only nudge its score, never override a hard budget or safety signal.

L1 — the reward signal

Every completed run earns a scalar reward in [-1, 1]: a weighted blend of hard-to-game outcome signals — tests and build passing, a pull request being created or merged, an independent LLM judge approving — minus a cost penalty. The weighting is deliberately resistant to reward hacking: a coding task that changed zero files is capped, the test/build signal only counts when real work (a PR) was produced, and an expensive run that accomplished nothing scores net-negative. This reward is the supervised signal the next layer learns from.

L2 — the contextual bandit

A contextual bandit aggregates rewards into per-segment statistics (segmented by task type, severity, and effort) and nudges the L0 heuristic score toward the arm with the better learned reward. Two guards keep it honest:

The nudge is bounded — it can adjust the heuristic score by at most a small margin, so it tilts a close call rather than overriding the heuristic.
A segment must accumulate enough samples (a minimum-significance gate) before its learned reward steers selection at all; below that, selection stays heuristic-dominant. Cold start is therefore never driven by noise.

The L3 governor

The governor sits above the learning substrate and governs it. It runs on a periodic schedule (driven by the scheduler’s tick — not an always-on loop) and has four concerns.

Golden-set audit

Each workspace can curate a golden set — a set of representative (task type, fixture, expected) cases the governor replays and grades against to detect quality regression. The periodic audit aggregates the recent window’s outcomes per profile and produces a self-describing quality report.

Kappa-calibrated judge

The audit’s headline quality score can come from an LLM judge — but only when that judge is trusted. The governor measures the judge’s agreement with ground-truth signals (merged PRs, passing builds) as Cohen’s kappa over a calibration window. The judge is trusted only when:

there are enough labelled calibration samples to estimate kappa at all, and
kappa meets the trust threshold (the conventional “substantial agreement” boundary).

When the judge is uncalibrated — too few samples, or kappa below the threshold — the governor distrusts it and falls back to the deterministic outcome metrics (reward and success-rate aggregates), which a flattering judge cannot game. The chosen verdict source is recorded in the report, so every audit says whether it trusted the judge or fell back.

Drift-freeze

For each recently-active profile, the governor compares its recent reward distribution against its baseline distribution with a two-sample Kolmogorov–Smirnov test. The KS test is used (rather than a simple mean comparison) because it catches a change in the shape of the distribution — for example a profile that still averages well but has grown a fat tail of failed runs.

On a statistically significant regression — a worse-direction shift with enough samples on both sides — the governor:

freezes the profile’s learned selection. While frozen, the bandit nudge for that profile is suppressed and selection falls back to the static heuristic, so a regressing profile cannot keep being steered by stale learned reward;
raises an audit event (the signal the operator console and governor dashboard read);
opens an owner-gated remediation proposal (see below).

The freeze is reversible and is lifted only when an owner approves a remediation. A profile that is already frozen does not raise duplicate alerts.

Owner-gated proposals

The governor never edits a profile on its own. Instead it raises proposals that an owner reviews and decides:

A profile-version proposal carries a concrete, reviewable candidate config — typically the profile’s last known-good prior version (revert the change that preceded the regression), or the current config for the owner to edit. On approval, the candidate is materialized as a new agent-profile version through the normal validated writer (it is versioned, snapshotted, and audited), and the drift freeze is lifted so learned selection resumes from the corrected baseline. On rejection, the proposal is closed and the freeze stays in place until cleared otherwise.
A skill-induction proposal mines a successful run’s reflection — the lessons the agent captured in its final summary — for a generalizable skill, and raises it as a draft. On approval, it is published as a skill capability that run-time skill retrieval can then use; on rejection, it is closed. A draft is invisible to run-time retrieval by construction, so an un-approved proposal never reaches a live agent.

Nothing auto-applies

This is the governor’s defining guarantee: the governor diagnoses and proposes, but never applies a configuration change without owner approval.

The L0–L2 learning only ever tunes a bounded nudge to selection scoring — it never rewrites a profile’s config.
A drift-detected regression freezes learned selection (a safe, reversible fall-back to the heuristic) and proposes a remediation — it does not change the profile.
A profile-version change and a new induced skill both materialize only on explicit owner approval, through the same validated, audited writers an owner would use by hand.

Every governor action — a freeze, an audit report, a proposal decision — is recorded in the audit trail, so the autonomous loop is fully traceable.