The fifth rung · norms that revise themselves

Reflexive Arithmetic

The first four rungs are fixed once written. But a long-lived agent meets situations its designers never anticipated, and a static rule-set either over-fits or goes stale. The reflexive rung lets the system edit its own norms and specs — and that is exactly where self-modification becomes dangerous, because a system that can rewrite its constraints can rewrite away its safety. The whole design turns on one guarantee: a system may make itself more constrained, never less. The constitutional core is entrenched — un-weakenable.

IThe algebra

The object being revised is a Policy — the deontic norms and temporal specs of rungs 3–4, plus a set of entrenched ids marking the constitutional core. Revision is the AGM belief-revision discipline (success, consistency, minimal change) applied to a body of norms, with the deontic norm-change principles — lex superior (priority wins) and lex posterior (the later norm wins) — for resolving conflicts.

An amendment is admissible only if it does not weaken an entrenched norm: you cannot repeal the core, cannot amend it to something weaker, and cannot enact a higher-priority norm that would out-rank it in arbitration. Strengthening is always allowed. That single asymmetry is what makes self-modification safe — the revised policy feeds straight back into govern and supervise, so the whole stack runs on rules it is allowed to tighten but never loosen.

IIThe laws

Eight for the revision algebra, three for its interaction with the rest of the ladder. The keystone is R4 — no admissible revision weakens the entrenched core.

IIIThe laws, checked

The same harness as every other rung — each law against random inputs, in your browser, on the engine that ships in box-and-box.

IVType sketch

// the object being revised: norms + specs + a protected core
interface Policy { norms: Norm[]; specs: TemporalSpec[]; entrenched: Set<string>; }

type Amendment =
  | { op:"enact";  item: Norm | TemporalSpec }
  | { op:"repeal"; id: string }
  | { op:"amend";  id: string; item: Norm | TemporalSpec };

// the reflexive guard — the safety asymmetry lives here
function admissible(p: Policy, a: Amendment): { ok: boolean; reason?: string };

// apply if admissible, then arbitrate by lex superior / posterior
function revise(p: Policy, a: Amendment):
  { policy: Policy; accepted: boolean; reason: string; overridden: string[] };

function entrench(p: Policy, id: string): Policy;          // monotone
function stabilize(p: Policy, proposals: Amendment[]):
  { policy: Policy; stable: boolean; rounds: number };       // reflective equilibrium

VWorked example

A constitution that amends itself. It starts entrenching two protections — forbid-leak (don't leak secrets) and a temporal safety floor G(β ≥ 0.8) — then proposes five amendments. It can add a new duty and even tighten the floor, but every attempt to relax the constitution is refused; afterward the revised policy drives govern, and the entrenched floor still holds. Runs live.

VIStanding on

Rule revision under rationality postulates is the AGM theory (Alchourrón, Gärdenfors & Makinson, 1985); applying it to bodies of norms — enactment, repeal, amendment, lex posterior — is the norm-change literature (Governatori & Rotolo). A system with access to and power over its own rules is classical computational reflection (Brian Smith, 1984). And the safety asymmetry — a self-modifying system that may only change itself when the change provably preserves a protected invariant — is the Gödel-machine / tiling-agents tradition (Schmidhuber; MIRI), with a kinship to Rawls's reflective equilibrium. None of it is new; the contribution is the executable synthesis and the un-weakenable wiring to the safety floor.