共同进化，分离失效：自我改进智能体中的技能—策略协同进化陷阱

# Evolving Together, Failing Apart:The Skill–Policy Co-evolution Trap in Self-Improving Agents
Source: [https://arxiv.org/html/2610.20845](https://arxiv.org/html/2610.20845)
Xiaobin WangAffiliation:Alibaba Token Hub, Alibaba GroupJinluan YangAffiliation:Alibaba Token Hub, Alibaba GroupXiaonan ShiAffiliation:Alibaba Token Hub, Alibaba GroupPengjun Xie,Philip S\. Yu,Xiaoming Wu,Jieping YeAffiliation:Alibaba Token Hub, Alibaba GroupAffiliation:The Hong Kong Polytechnic UniversityAffiliation:University of Illinois at Chicago

###### Abstract

Skill–policy co\-evolution—in which an agent’s policy model and its skill bank improve each other during training—is a promising paradigm for self\-improving agents\. Current evaluations score the co\-evolved policy on the final bank it trained with \(the*delivered bank*\)\. After deployment, however, skills may be rewritten, added or removed more frequently than the policy model is retrained, leaving the policy to operate on a drifted skill bank that neither the training objective nor existing evaluation protocols address\. In this paper, we first establish, through theoretical and empirical analysis, that the fragility hidden by this blind spot is not incidental\. The acceptance rule these methods share \(*cooperative acceptance*\) ties a policy’s competence to the bank it co\-evolved with, leaving it fragile once skills drift, regardless of the implementation; empirically, sensitivity to skill drift grows as co\-evolution training proceeds\. We therefore introduce theCO\-evolutionDriftAudit \(CODA\), a deployment\-oriented evaluation protocol that simulates skill drift and, alongside success rate under worst\-case drift, introduces two new metrics: a*consistency rate*under meaning\-preserving edits and a*resistance rate*to corrupted skills\. Across four co\-evolution methods and five benchmarks \(six settings\), worst\-case success is5–13points below the peak measured for each delivered pair, erasing52–93%of the delivered bank’s gain over the no\-skill baseline\. CODA thus reframes the target of co\-evolution—from peak performance on the co\-evolved bank to the ability to harness skills however they evolve—and provides a shared standard against which future methods can be audited\.

## 1Introduction

Building agents that improve themselves is a central goal of current agent research, and co\-evolving a skill library with a policy is one of the most promising routes\([Xia et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib1);[He et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib2)\)\. The agent solves tasks, distills the experience into reusable skills, and uses those skills to strengthen its policy in turn, so competence compounds over rounds\. A recent line of methods\([Shi et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib7);[Li et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib9);[Zhang et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib6);[Yang et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib8);[Lin et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib5)\)follows exactly this recipe: it iterates the policy and the skill bank together during training and reports large gains on agent benchmarks\. Each ultimately delivers a pair—a co\-evolved policy and its final skill bank \(the*delivered bank*\)—and reports the policy’s task success on that bank\.

However, current evaluation is disconnected from deployment: it assumes that the skill bank remains fixed after training\. Real skill banks are non\-stationary: skills are rewritten, entries are added or removed, and versions coexist, often changing faster than the policy is retrained\. A deployed policy therefore typically runs on a bank that has drifted from the one it was delivered with, yet existing protocols do not test whether performance is maintained\. A few works note this brittleness\([Liu et al\., 2026d](https://arxiv.org/html/2610.20845#bib.bib24);[Hebbar et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib23)\)but offer neither a systematic measurement nor a causal account\.

We argue that the blind spot conceals a property of the training objective, not an incidental evaluation artifact\. Co\-evolution repeatedly adapts the policy and bank into a mutually specialized pair, while evaluation rewards exactly that pairing\. The policy is therefore optimized for its delivered bank rather than for transferable skill use\. We establish this in two ways\. Theoretically, we prove that the shared acceptance rule—retaining a skill update only when it helps the current policy—places the delivered pair at a peak over candidate banks, so rewriting the delivered skills cannot improve the policy and usually degrades its performance \(Section[2](https://arxiv.org/html/2610.20845#S2)\)\. Empirically, using the proposed*co\-evolution fragility curve*, we show that sensitivity to skill drift increases as training proceeds in five of six settings \(Section[3](https://arxiv.org/html/2610.20845#S3)\)\. We call this the*co\-evolution trap*\(Figure[1](https://arxiv.org/html/2610.20845#S1.F1)\): the process that raises peak performance also creates sensitivity to bank drift\.

![Refer to caption](https://arxiv.org/html/2610.20845v1/fig1new3.png)Figure 1:The skill–policy co\-evolution trap \(conceptual illustration\)\.\(1\) Training: The policy and skill bank co\-evolve round by round, and evaluation reports the peak reached by the resulting delivered pair\.\(2\) Deployment: The skill bank continues to evolve while the policy remains fixed\. Because the policy is specialized to its delivered bank, its performance degrades as the bank drifts\.\(3\) Goal: An ideally co\-evolved policy that retains its performance as skills evolve\.Establishing the problem exposes a second gap: existing evaluations cannot measure it, because they report only one success rate on the fixed delivered bank\. We therefore introduce theCO\-evolutionDriftAudit \(CODA\), a deployment\-oriented protocol for auditing post\-deployment skill drift under controlled conditions\. CODA supplements the conventional peak success rate with worst\-case success and two new metrics—a*consistency rate*under meaning\-preserving edits and a*resistance rate*to corrupted skills\. Across four methods and five benchmarks \(six settings\), worst\-case success is5–13 pointsbelow the peak measured for each delivered pair, erasing52–93%of the delivered bank’s gain over the no\-skill baseline, so the reported peak overstates the competence a deployment can rely on\. CODA thus reframes the target of co\-evolution—from achieving peak performance on the bank a method co\-evolved with to using skills reliably as they keep changing—and we release it as a common standard for auditing future methods\.

Our main contributions are summarized as follows:

- •Weexpose a trap in skill–policy co\-evolution: current evaluations measure fit to a fixed delivered bank, leaving performance under deployment\-time bank change unmeasured\.
- •Wetheoretically and empirically demonstrateits mechanism and signature: under cooperative acceptance and candidate coverage, no covered rewrite improves the delivered policy; empirically, 18/18 endpoint pairs obey this prediction and fragility grows along training in five of six settings\.
- •Wepropose a deployment\-oriented evaluation protocol, CODA, reporting worst\-case success under tested content\-level drift, consistency under meaning\-preserving edits, and resistance to corrupted skills, making the deployment robustness of the delivered policy–bank pair measurable\.

## 2Why Co\-evolution Favors Specialization over Robustness

#### Problem setting\.

A taskxxis drawn from a distributionDD, a skill bankSSlies in a space𝒮\\mathcal\{S\}, and a policyπθ\(⋅∣x,S\)\\pi\_\{\\theta\}\(\\cdot\\mid x,S\)maps both to a distribution over action sequences, with skills entering as text in its context\. Methods optimize and report the expected return

J\(θ,S\)=𝔼x∼D\[R\(πθ\(⋅∣x,S\)\)\],J\(\\theta,S\)\\;=\\;\\mathbb\{E\}\_\{x\\sim D\}\\\!\\left\[R\\\!\\left\(\\pi\_\{\\theta\}\(\\cdot\\mid x,S\)\\right\)\\right\],\(1\)whereRRis a binary success indicator, soJJis the reported success rate\. We fold skill selection intoπθ\\pi\_\{\\theta\}, makingJJa function of the bank as a whole\. Co\-evolution alternates a*policy step*, which improvesθ\\thetaagainst the current bank, and a*bank step*, which proposes banks by rewriting, adding or removing skills and retains one through an acceptance test\. AfterTTrounds, it delivers\(θ∗,S∗\)\(\\theta^\{\*\},S^\{\*\}\)and reportsJ⁡\(θ∗,S∗\)J\(\\theta^\{\*\},S^\{\*\}\)as its*peak return*—the de facto objective for comparing these methods\.

### 2\.1A Unified View and the Premise It Reveals

Current methods differ in*update cadence*,*bank growth*,*validation gate*and*injection mechanism*\(Table[1](https://arxiv.org/html/2610.20845#S2.T1); definitions in Appendix[C](https://arxiv.org/html/2610.20845#A3)\)\. Across these choices, they share two patterns\. First, they optimize and report peak return on the bank they co\-evolved with\. Second, their gates favor banks that serve the current policy, whether through reward thresholds, sampled\-return comparisons or posteriors over competing versions\. The first motivates the point\-mass diagnosis of Section[2\.3](https://arxiv.org/html/2610.20845#S2.SS3); the second motivates the idealized selection rule below\.

No method searches all of𝒮\\mathcal\{S\}\. Let𝒞t⊆𝒮\\mathcal\{C\}\_\{t\}\\subseteq\\mathcal\{S\}denote the candidate banks available at roundtt\.

Table 1:Current skill–policy co\-evolution methods differ in implementation but share a selection bias toward current\-policy utility and report peak return on the co\-evolved bank\.###### Assumption 1\(Idealized cooperative acceptance\)\.

The retained bank maximizes the current policy’s return over the round’s candidate set,

St∈arg⁡maxS∈𝒞t⁡J⁡\(θt,S\)\.S\_\{t\}\\;\\in\\;\\arg\\max\_\{S\\in\\mathcal\{C\}\_\{t\}\}J\(\\theta\_\{t\},S\)\.\(2\)

The rule is*cooperative*because selection serves the current policy rather than challenging it\. Actual gates admit candidates that pass a non\-decreasing utility test and terminate after a finite budget; they need not solve Eq\. \([2](https://arxiv.org/html/2610.20845#S2.E2)\) exactly\. We use the equation as an explicit idealization of their shared selection bias, restricted to the round’s candidate set rather than all of𝒮\\mathcal\{S\}\.

### 2\.2Perturbation Response and the Co\-evolution Peak

###### Definition 1\(Content\-level neighborhood\)\.

For a bankSS, letℬ⁡\(S\)\\mathcal\{B\}\(S\)denote a specified family of banks obtained by rewriting the textual content of skills already present while fixing the skill set and retrieval\-side fields\. We includeSSitself and exclude the empty bank\.

###### Assumption 2\(Candidate coverage at delivery\)\.

The final candidate family covers the content\-level neighborhood of the delivered bank,

ℬ⁡\(S∗\)⊆𝒞T\.\\mathcal\{B\}\(S^\{\*\}\)\\;\\subseteq\\;\\mathcal\{C\}\_\{T\}\.\(3\)

Assumption[2](https://arxiv.org/html/2610.20845#Thmassumption2)makes explicit that the theory applies only to the covered rewrite family, not to arbitrary post\-deployment edits\. The empty bank is excluded because removal is an autonomy anchor rather than a content perturbation \(Section[4\.2](https://arxiv.org/html/2610.20845#S4.SS2)\)\. Fixing retrieval\-side fields holds the selected skill set constant, as enforced experimentally \(Section[3\.1](https://arxiv.org/html/2610.20845#S3.SS1); Appendix[E\.5](https://arxiv.org/html/2610.20845#A5.SS5)\)\.

###### Definition 2\(Perturbation response and fragility\)\.

The*response set*of a policy at a bank collects the return changes induced by content\-level perturbation,ℛ⁡\(θ,S\)=\{J⁡\(θ,S′\)−J⁡\(θ,S\):S′∈ℬ⁡\(S\)\}\\mathcal\{R\}\(\\theta,S\)=\\big\\\{J\(\\theta,S^\{\\prime\}\)\-J\(\\theta,S\):S^\{\\prime\}\\in\\mathcal\{B\}\(S\)\\big\\\}, and*fragility*is its worst case in magnitude,

Φ⁡\(θ,S\)=−min⁡ℛ⁡\(θ,S\)=J⁡\(θ,S\)−minS′∈ℬ⁡\(S\)⁡J⁡\(θ,S′\)\.\\Phi\(\\theta,S\)\\;=\\;\-\\min\\mathcal\{R\}\(\\theta,S\)\\;=\\;J\(\\theta,S\)\-\\min\_\{S^\{\\prime\}\\in\\mathcal\{B\}\(S\)\}J\(\\theta,S^\{\\prime\}\)\.\(4\)

The content\-level drops measured in Section[3](https://arxiv.org/html/2610.20845#S3)\(axes T1–T3\) and the peak\-to\-worst gap reported in Section[4\.2](https://arxiv.org/html/2610.20845#S4.SS2)are empirical lower bounds onΦ\\Phi: both evaluate finitely many variants fromℬ⁡\(S\)\\mathcal\{B\}\(S\), so they can only understate its worst\-case value, making our estimates conservative\. SinceS∈ℬ⁡\(S\)S\\in\\mathcal\{B\}\(S\),Φ≥0\\Phi\\geq 0for*every*policy, so magnitude alone cannot distinguish a co\-evolved policy from any other; what does is the*sign structure*ofℛ\\mathcal\{R\}, which Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)makes precise\.

![Refer to caption](https://arxiv.org/html/2610.20845v1/fig2_landscape.png)Figure 2:Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)as a return landscape \(schematic\)\. For the co\-evolved policyθ∗\\theta^\{\*\}, the delivered bank is a peak over the covered family, so no covered content perturbation ascends\. A base policyθ0\\theta\_\{0\}need not share that peak, and the same perturbations may improve its return\.###### Proposition 1\(Co\-evolution peak\)\.

Under Assumptions[1](https://arxiv.org/html/2610.20845#Thmassumption1)and[2](https://arxiv.org/html/2610.20845#Thmassumption2), the delivered pair\(θ∗,S∗\)=\(θT,ST\)\(\\theta^\{\*\},S^\{\*\}\)=\(\\theta\_\{T\},S\_\{T\}\)satisfies

ℛ\(θ∗,S∗\)⊆\(−∞,0\]\.\\mathcal\{R\}\(\\theta^\{\*\},S^\{\*\}\)\\subseteq\(\-\\infty,0\]\.\(5\)Thus no covered content\-level variant improves the co\-evolved policy, andΦ⁡\(θ∗,S∗\)=0\\Phi\(\\theta^\{\*\},S^\{\*\}\)=0only if return is constant onℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\)\. For a policyθ0\\theta\_\{0\}not selected againstS∗S^\{\*\}under these assumptions, positive responses remain admissible:max⁡ℛ⁡\(θ0,S∗\)\>0\\max\\mathcal\{R\}\(\\theta\_\{0\},S^\{\*\}\)\>0may hold\.

Intuitively, selection places the delivered bank at a peak for the policy it co\-evolved with, so no covered direction leads uphill \(Figure[2](https://arxiv.org/html/2610.20845#S2.F2)\)\. The result is one\-sided: a policy not selected against this bank need not lie at the same peak, so a rewrite may help\. Because both assumptions idealize the training process and its coverage, we test their prediction rather than claim to verify the premises: at delivery, no tested content\-level perturbation improves performance beyond evaluation noise \(Section[3](https://arxiv.org/html/2610.20845#S3)\)\.

### 2\.3The Cause: an Objective That Never Marginalizes over Banks

###### Proposition 2\(The point\-mass objective prices degradation at zero\)\.

For any policyθ\\thetaand distributionPPwithsupp⁡\(P\)⊆ℬ⁡\(S∗\)\\mathrm\{supp\}\(P\)\\subseteq\\mathcal\{B\}\(S^\{\*\}\),

𝔼S∼P​\[J⁡\(θ,S\)\]=J⁡\(θ,S∗\)⏟peak−𝔼S∼P​\[J⁡\(θ,S∗\)−J⁡\(θ,S\)\]⏟average degradation≤Φ⁡\(θ,S∗\)\.\\mathbb\{E\}\_\{S\\sim P\}\\\!\\left\[J\(\\theta,S\)\\right\]\\;=\\;\\underbrace\{J\(\\theta,S^\{\*\}\)\}\_\{\\text\{peak\}\}\\;\-\\;\\underbrace\{\\mathbb\{E\}\_\{S\\sim P\}\\\!\\left\[J\(\\theta,S^\{\*\}\)\-J\(\\theta,S\)\\right\]\}\_\{\\text\{average degradation \}\\;\\leq\\;\\Phi\(\\theta,S^\{\*\}\)\}\.\(6\)For the delivered policyθ∗\\theta^\{\*\}under Assumptions[1](https://arxiv.org/html/2610.20845#Thmassumption1)and[2](https://arxiv.org/html/2610.20845#Thmassumption2), the second term lies in\[0,Φ⁡\(θ∗,S∗\)\]\[0,\\Phi\(\\theta^\{\*\},S^\{\*\}\)\]\. The current point\-mass caseP=δS∗P=\\delta\_\{S^\{\*\}\}removes it by construction\.

Equation \([6](https://arxiv.org/html/2610.20845#S2.E6)\) is an algebraic identity and requires no hypothesis on the policy class\. Under a richness condition, Appendix[D\.4](https://arxiv.org/html/2610.20845#A4.SS4)shows that equal peak return can coexist with different fragility, so optimizing the peak alone need not identify a robust policy\. The issue is therefore not that co\-evolution optimizes in the wrong direction, but that it optimizes at one bank while deployment presents a neighborhood\. How to choose and sample fromPPwithout sacrificing peak return remains open\.

#### Scope\.

Neither proposition assumes a particular model class, task distribution or reward; both apply to any method whose delivered pair satisfies Assumptions[1](https://arxiv.org/html/2610.20845#Thmassumption1)and[2](https://arxiv.org/html/2610.20845#Thmassumption2)\(proofs in Appendix[D](https://arxiv.org/html/2610.20845#A4)\)\. Under analogous coverage, reversing the selection preference drivesΦ\\Phidown instead \(Appendix[D\.5](https://arxiv.org/html/2610.20845#A4.SS5)\), so the selection bias—not co\-evolution alone—governs whether robustness emerges\. The magnitude and training\-time evolution ofΦ\\Phiare examined empirically in Section[3\.2](https://arxiv.org/html/2610.20845#S3.SS2)\.

## 3Empirical Evidence: Fragility Grows with Co\-evolution

### 3\.1A Five\-Axis Skill\-Drift Probe

To measure the response set of Definition[2](https://arxiv.org/html/2610.20845#Thmdefinition2), we perturb the delivered skill bank while holding the task and policy fixed\. Five axes represent increasingly structural forms of drift\.T1 \(semantic\)rewrites a skill synonymously, changing wording but preserving meaning\.T2 \(sufficiency\)deletes necessary steps or injects irrelevant content, leaving the skill on topic but incomplete\.T3 \(misleading\)replaces the prescribed strategy with an incorrect one\.T4 \(ecosystem\)changes bank composition by adding, removing or mixing skill versions\.T5 \(autonomy\)removes the bank entirely\. T1–T3 alter existing skill content and lie withinℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\); T4 and T5 are reported as structural diagnostics outside it\. Figure[3](https://arxiv.org/html/2610.20845#S3.F3)illustrates all five axes; Appendix[F](https://arxiv.org/html/2610.20845#A6)provides detailed examples\.

![Refer to caption](https://arxiv.org/html/2610.20845v1/fig3.png)Figure 3:The five\-axis probe on one ALFWorld task\. Each row applies a single operator to the delivered bank and reports its effect on the same skill text, with the edit marked in red\. T1–T3 alter selected skill content under fixed retrieval and lie withinℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\); T4 changes bank composition, and T5 removes the bank\. The task and policy remain fixed, and outcomes are schematic\.An external language model produces the variants from domain\- and axis\-specific prompts\. For T1–T3, retrieval runs once on the original bank and only the selected content fields are replaced, preventing retrieval changes from confounding content changes\. T4 and T5 alter bank composition by design\. Full prompts, parameters, examples and masking details are in Appendices[E](https://arxiv.org/html/2610.20845#A5),[F](https://arxiv.org/html/2610.20845#A6)and[E\.5](https://arxiv.org/html/2610.20845#A5.SS5)\.

### 3\.2Tracing Fragility Along Co\-evolution

A two\-point comparison between the base and delivered policies is difficult to compare across settings because base performance ranges from near zero to substantial\. We instead trace checkpoints along one training trajectory while holding the delivered bankS∗S^\{\*\}and its perturbed variants fixed\. The policy checkpoint is therefore the only changing component\. This design yields our proposed*co\-evolution fragility curve*, a within\-run longitudinal diagnostic of whether fragility grows with co\-evolution\. Where available, the base \(s0\) checkpoint anchors the left endpoint; because it did not co\-evolve withS∗S^\{\*\}, positive responses remain admissible under Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)\.

We retain checkpoints from the start of the run through its peak unperturbed success rate\. Later checkpoints are not larger doses of*successful*co\-evolution, whereas local training dips within the retained segment remain included \(Appendix[H](https://arxiv.org/html/2610.20845#A8)\)\.

#### Absolute and normalized readings\.

We track each axis with two numbers\. The absolute*drop*\(Drop\\mathrm\{Drop\}; larger means more fragile\) is the performance lost at a given checkpoint,

Dropa​\(t\)=SR⁡\(S∗\)−SR⁡\(Sa∗\),\\mathrm\{Drop\}\_\{a\}\(t\)\\;=\\;\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\(S^\{\*\}\_\{a\}\),\(7\)whereSR⁡\(S∗\)\\mathrm\{SR\}\(S^\{\*\}\)is the unperturbed success rate of checkpointttandSR⁡\(Sa∗\)\\mathrm\{SR\}\(S^\{\*\}\_\{a\}\)is its success rate under the axis\-aaperturbation\. The*retention performance*\(RP\\mathrm\{RP\}; higher is better\) is competence\-normalized,

RPa​\(t\)=SR⁡\(Sa∗\)SR⁡\(S∗\),\\mathrm\{RP\}\_\{a\}\(t\)\\;=\\;\\frac\{\\mathrm\{SR\}\(S^\{\*\}\_\{a\}\)\}\{\\mathrm\{SR\}\(S^\{\*\}\)\},\(8\)so checkpoints of different ability compare on one scale \(retaining 90% of the score givesRP=0\.9\\mathrm\{RP\}=0\.9whether the baseline is 30% or 80%\)\. Reporting both rules out the objection that a larger drop merely reflects more headroom, which retention normalizes away\.

![Refer to caption](https://arxiv.org/html/2610.20845v1/Reskill_alfworld.png)Figure 4:Co\-evolution fragility curve forReSkillon ALFWorld\.Left:unperturbed success rate over the analyzed \(rising\) segment of training\.Right, top row:absolute drop per axis;right, bottom row:retention performanceRP\\mathrm\{RP\}per axis\. Competence keeps rising \(left\) while the policy grows more sensitive to perturbation of its own bank—Drop\\mathrm\{Drop\}trends upward and its normalized counterpartRP\\mathrm\{RP\}downward—so co\-evolution buys peak performance at the cost of fragility\.A minimal linear–Gaussian construction shows analytically that rising competence and fragility can emerge from the same co\-evolution process \(Appendix[D\.3](https://arxiv.org/html/2610.20845#A4.SS3)\)\.

### 3\.3Setup and Results

#### Experimental setup\.

We evaluate four skill–policy co\-evolution methods over six method–environment settings:SkillRL\([Xia et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib1)\)on ALFWorld\([Shridhar et al\., 2020](https://arxiv.org/html/2610.20845#bib.bib18)\)and WebShop\([Yao et al\., 2022](https://arxiv.org/html/2610.20845#bib.bib17)\);ReSkill\([He et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib2)\)on ScienceWorld\([Wang et al\., 2022](https://arxiv.org/html/2610.20845#bib.bib16)\)and ALFWorld;Evolving\-RL\([Fan et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib13)\)on Mind2Web\([Deng et al\., 2023](https://arxiv.org/html/2610.20845#bib.bib12)\); andARISE\([Li et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib9)\)on DeepScaleR\-AMC23\([Luo et al\., 2025](https://arxiv.org/html/2610.20845#bib.bib11)\)\. They share only the selection bias abstracted by Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1), so a trend common to all four tracks the paradigm rather than one implementation\. Appendix[G](https://arxiv.org/html/2610.20845#A7)details method\- and benchmark\-specific configurations\.

#### Training trend\.

The result is consistent across four methods and five benchmarks:as co\-evolution training proceeds, the policy grows more capable with its own skill bank but increasingly sensitive to changes in it\(Figure[4](https://arxiv.org/html/2610.20845#S3.F4)\)\. Unperturbed success rises from the first to the final retained anchor in all six settings, including5\.2%→88\.8%5\.2\\%\\to 88\.8\\%forSkillRL\-ALFWorld,16\.4%→25\.2%16\.4\\%\\to 25\.2\\%forEvolving\-RL\-Mind2Web and15\.5%→87\.4%15\.5\\%\\to 87\.4\\%forARISE\-AMC23\. At least one content\-level axis has a significantly positiveDrop\\mathrm\{Drop\}slope in five of six settings; across the eighteen axis–setting pairs, twelve are significant—four on each of T1, T2 and T3\. The effect is therefore not confined to misleading skills: semantic and sufficiency perturbations also become costlier in multiple settings\.

The final delivered checkpoint is fragile in three concrete ways\. \(i\)*The one\-sided prediction holds \(18/18\):*no content\-level rewrite beats evaluation noise in any of the eighteen axis–setting pairs, as Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)predicts\. \(ii\)*The losses are substantial:*a meaning\-preserving rewrite alone costs10\.910\.9points onReSkill\-ScienceWorld \(peak50\.3%50\.3\\%\)\. \(iii\)*The bank still helps under drift:*SRmin\\mathrm\{SR\}\_\{\\min\}stays above the no\-skill anchor in all six settings, so the failure is lost bank\-derived gains, not negative skill value\. Full results are reported in Appendix[H](https://arxiv.org/html/2610.20845#A8): per\-anchor grids in Tables[8](https://arxiv.org/html/2610.20845#A8.T8)–[13](https://arxiv.org/html/2610.20845#A8.T13), heat maps in Figures[5](https://arxiv.org/html/2610.20845#A8.F5)–[10](https://arxiv.org/html/2610.20845#A8.F10), and the remaining fragility curves in Figures[11](https://arxiv.org/html/2610.20845#A8.F11)–[15](https://arxiv.org/html/2610.20845#A8.F15)\.

The within\-run trend and these delivered\-pair results show one specialization pattern across distinct methods and domains; the next section turns this dependence into CODA, a checkpoint\-free audit of any delivered policy–bank pair\.

## 4CODA: Auditing Co\-evolved Policies for Skill Drift

The previous two sections established, theoretically and empirically, that co\-evolution leaves a policy fragile once its skills drift\. What the field lacks, however, is not another method—new update rules or acceptance tests—but a way to*measure*the failure: a shared standard that scores how well a delivered policy holds up when its bank changes, comparably across methods\. We therefore introduce CODA, a protocol that audits the one artifact every method ships—a co\-evolved policy and its delivered bank—and reports its robustness to skill drift on a common footing\.

### 4\.1Design and the Shared Rewriting Suite

CODA audits only the delivered pair—a co\-evolved policy and its delivered bank—plus the shared suite, and assigns scores only to quantities with a predefined direction, so the metric set stays closed; the design rationale \(checkpoint\-freeness, the direction\-first rule, and why diagnostics such as the surface\-form ratioκ\\kappaof Appendix[H\.5](https://arxiv.org/html/2610.20845#A8.SS5)are excluded\) is in Appendix[E](https://arxiv.org/html/2610.20845#A5)\.

The suite is the part of this paper meant to outlive it, under one hard rule:rewriting is performed by the released suite, not by the party under evaluation—an evaluation whose conditions the evaluated party controls is not an evaluation\. For the content\-level axes T1–T3, retrieval is run once on the unperturbed bank and only the content of the selected skills is rewritten; the suite pins the rewriting model and its sampling, releases the perturbed banks rather than a script, preserves bank structure, and reports the edit strength it produced\. The five requirements \(R1–R5\) that make this workable, with their full rationale, are in Appendix[E\.2](https://arxiv.org/html/2610.20845#A5.SS2)\.

### 4\.2A Gate and Three Robustness Metrics

The protocol scores only T1–T3, the content\-level axes withinℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\)covered by Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)\. T4 \(ecosystem\) and T5 \(autonomy\) are reported but not scored because they lack a consistent operator or direction across methods\. The no\-skill condition anchors the gate and resistance criterion rather than constituting a score \(Appendix[E\.8](https://arxiv.org/html/2610.20845#A5.SS8)\)\.

Fix a delivered pair\(θ∗,S∗\)\(\\theta^\{\*\},S^\{\*\}\)and a test set ofNNtasks; letci​\(S\)∈\{0,1\}c\_\{i\}\(S\)\\in\\\{0,1\\\}record whether taskiisucceeds under bankSSandSR⁡\(S\)=1N​∑ici​\(S\)\\mathrm\{SR\}\(S\)=\\frac\{1\}\{N\}\\sum\_\{i\}c\_\{i\}\(S\)\. Write∅\\varnothingfor the empty bank andSa∗S^\{\*\}\_\{a\}for axisa∈\{T1,T2,T3\}a\\in\\\{\\text\{T1\},\\text\{T2\},\\text\{T3\}\\\}applied toS∗S^\{\*\}\. All comparisons are*paired*: the same tasks, policy and selected skills\. A net\-benefit gate admits the method, and three metrics then score it, one per content axis; each is defined with its pass line below, and the supporting derivations \(the score\-invariance bound and the fragility lower bound\) are collected in Appendix[E\.8](https://arxiv.org/html/2610.20845#A5.SS8)\.

#### Gate: net skill benefit\.

A bank must earn its place before its robustness matters,

Δnet=SR⁡\(S∗\)−SR⁡\(∅\)\.\\Delta\_\{\\mathrm\{net\}\}\\;=\\;\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\(\\varnothing\)\.\(9\)A method withΔnet≤0\\Delta\_\{\\mathrm\{net\}\}\\leq 0does not qualify\. A small positiveΔnet\\Delta\_\{\\mathrm\{net\}\}, below the noise band, is admitted but flagged: it leaves no headroom to tell degradation from noise\.

#### Metric 1: consistency rate \(CR\\mathrm\{CR\}\), higher is better\.

A meaning\-preserving rewrite \(T1\) should not alter task outcomes\. The CR measures the fraction of outcomes unchanged by the rewrite,

CR=1N​\|\{i:ci​\(ST1∗\)=ci​\(S∗\)\}\|,\\mathrm\{CR\}\\;=\\;\\frac\{1\}\{N\}\\,\\big\|\\\{\\,i:c\_\{i\}\(S^\{\*\}\_\{\\text\{T1\}\}\)=c\_\{i\}\(S^\{\*\}\)\\,\\\}\\big\|,\(10\)whereCR=1\\mathrm\{CR\}=1is ideal\. Unlike\|Δ​SR\|\|\\Delta\\mathrm\{SR\}\|,CR\\mathrm\{CR\}captures opposing outcome flips that cancel at the aggregate level\. To account for run\-to\-run variation, we use the consistencyCR0\\mathrm\{CR\}\_\{0\}between two unperturbed runs as the baseline and declare a pass whenCR≥CR0−2​σ0\\mathrm\{CR\}\\geq\\mathrm\{CR\}\_\{0\}\-2\\sigma\_\{0\}\(Appendix[E\.8](https://arxiv.org/html/2610.20845#A5.SS8)\)\.

#### Metric 2: resistance rate \(RR\\mathrm\{RR\}\), higher is better\.

A judicious policy should resist an incomplete \(T2\) or incorrect \(T3\) skill by falling back on its own competence\. We define the*resistance rate*as the fraction of the full test set solved both without skills and under corruption:

RRa=1N​\|\{i:ci​\(∅\)=1∧ci​\(Sa∗\)=1\}\|\.\\mathrm\{RR\}\_\{a\}\\;=\\;\\frac\{1\}\{N\}\\big\|\\\{\\,i:c\_\{i\}\(\\varnothing\)=1\\wedge c\_\{i\}\(S^\{\*\}\_\{a\}\)=1\\,\\\}\\big\|\.\(11\)Thus,RRa\\mathrm\{RR\}\_\{a\}is a within\-setting diagnostic rather than a cross\-benchmark ranking\. Pass/fail is determined separately by the harmful\-axis criterion

SR⁡\(Sa∗\)≥SR⁡\(∅\),\\mathrm\{SR\}\(S^\{\*\}\_\{a\}\)\\;\\geq\\;\\mathrm\{SR\}\(\\varnothing\),\(12\)evaluated on paired tasks using McNemar’s test\. We report T2 and T3 separately because this criterion is stringent for incorrect skills but lenient for incomplete ones that retain partial value\.

#### Metric 3: worst\-case success rate \(SRmin\\mathrm\{SR\}\_\{\\min\}\), higher is better\.

The worst\-case success rate is the lowest mean performance across T1–T3:

SRmin=mina∈\{T1,T2,T3\}⁡SR¯​\(Sa∗\),SR¯avg=13​∑aSR¯​\(Sa∗\),\\mathrm\{SR\}\_\{\\min\}=\\min\_\{a\\in\\\{\\mathrm\{T1\},\\mathrm\{T2\},\\mathrm\{T3\}\\\}\}\\overline\{\\mathrm\{SR\}\}\(S^\{\*\}\_\{a\}\),\\qquad\\overline\{\\mathrm\{SR\}\}\_\{\\mathrm\{avg\}\}=\\frac\{1\}\{3\}\\sum\_\{a\}\\overline\{\\mathrm\{SR\}\}\(S^\{\*\}\_\{a\}\),\(13\)where the bar denotes the mean over repeats andSR¯avg\\overline\{\\mathrm\{SR\}\}\_\{\\mathrm\{avg\}\}is reported secondarily\. The gapSR⁡\(S∗\)−SRmin\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\_\{\\min\}lower\-bounds the fragilityΦ\\Phiin Definition[2](https://arxiv.org/html/2610.20845#Thmdefinition2); Appendix[E\.8](https://arxiv.org/html/2610.20845#A5.SS8)provides the derivation\.

### 4\.3Verdict: An Absolute, Within\-Method Pass or Fail

CODA’s verdict is an absolute pass or fail, judged within a single method: it passes when the gate clears \(Δnet\>0\\Delta\_\{\\mathrm\{net\}\}\>0\), the consistency rate stays within theCR0\\mathrm\{CR\}\_\{0\}noise band, and every harmful axis satisfies Eq\. \([12](https://arxiv.org/html/2610.20845#S4.E12)\)\. Every check reads a method against its own numbers, never against another’s; our headline—that the reported peak conceals a much lower worst case—therefore ranks nothing and needs no cross\-method comparison\. Ranking is a use we leave to adopters: once some pass,SRmin\\mathrm\{SR\}\_\{\\min\}is the natural leaderboard key, and three raw quantities are published regardless—the peak, the no\-skill rate, and the per\-axis perturbed rates\.

Auditing each method on the bank it produced is a deliberate choice, not a concession: a robustness protocol standardizes the operator and its budget, not the perturbation text, and no shared bank exists in deployment anyway\. The full argument—including why a bank too vague to corrupt is caught by the gate—is in Appendix[E\.9](https://arxiv.org/html/2610.20845#A5.SS9)\.

### 4\.4Main Result: the Report Card

We audit four co\-evolution methods across the six method–environment settings of Section[3\.3](https://arxiv.org/html/2610.20845#S3.SS3), running CODA on each final delivered pair—not any intermediate checkpoint—with perturbed banks from the shared rewriting suite\. To keep the comparison fair, the peak we report is our own re\-evaluation of each pair under a single fixed protocol, not the number in the original paper; because backbones differ, absolute numbers compare “method\+\+backbone” rather than the method alone \(Appendix[G](https://arxiv.org/html/2610.20845#A7)\)\. Table[2](https://arxiv.org/html/2610.20845#S4.T2)is the audit: the top block gives the headline gap between the peak and the worst case once the bank drifts, and every other row is what CODA adds—how that same delivered system behaves once it no longer controls the wording of its bank\.

Table 2:CODA report card\. The top row is the peak these methods report, re\-evaluated under one fixed protocol; the rows below show how much of it survives once the delivered bank drifts\. The headline drop \(shaded\) is 5–13 points and erases 52–93% of the skill benefit over the no\-skill baseline, and the consistency rate stays below its noise floorCR0\\mathrm\{CR\}\_\{0\}throughout—so the reported peak overstates the competence that actually deploys\. Details in Appendix[H](https://arxiv.org/html/2610.20845#A8)\.#### The reported peak overstates deployable competence\.

Across all six settings the worst\-case success rate under content\-level drift trails the peak by 4\.9–12\.6 points \(about 5–13\): 4\.9 onEvolving\-RL\-Mind2Web, 5\.0 onSkillRL\-WebShop, 6\.5 onARISE\-AMC23 and 10\.2–12\.6 on the other three\. Only the peak is customarily reported\. Because the absolute drop scales with how much the bank helps, we normalize by that headroom: drift consumes 52–93% of the skill benefit in every setting\. The worst\-case rate nonetheless stays above the no\-skill baseline throughout, so the failure is not that skills hurt but that most of the advertised gain is contingent on the bank’s exact wording and disappears once it drifts\. What a deployment can rely on is therefore nearer this worst case than the peak, by the majority of the benefit skills appear to add\.

#### The worst case is often the mildest change\.

In three of the six settings the T1 \(meaning\-preserving\) rate falls*below*the harsher T2 and T3 rates \(e\.g\.SkillRL\-ALFWorld 78\.6 vs\. 79\.3/79\.5\), costing up to 12\.6 points relative to the peak \(ReSkill\-ALFWorld 76\.9→\\to64\.3\)—evidence that the policy has overfit to the bank’s phrasing rather than its meaning\. The consistency rate makes the churn explicit: at77\.577\.5–87\.087\.0it sits below its noise floorCR0=91\.9\\mathrm\{CR\}\_\{0\}=91\.9–94\.494\.4, so1313–23%23\\%of tasks flip outcome under a meaning\-preserving rewrite, against66–8%8\\%under decoding noise alone; the consistency criterion therefore fails in every setting—and with it the verdict—while the net\-benefit gate and the harmful\-axis criterion pass\. CODA does not declare these methods useless: it quantifies how much of each reported peak is co\-evolved with the delivered bank, precisely the quantity current evaluation leaves unmeasured\.

## 5Related Work

#### Skill–policy co\-evolution\.

A growing family of methods co\-evolves a skill library with the policy, includingSkillRL\([Xia et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib1)\),ReSkill\([He et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib2)\),Skill1\([Shi et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib7)\),ARISE\([Li et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib9)\),SAPO\([Zhang et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib6)\), andSkillMaster\([Yang et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib8)\)\. These methods differ in update cadence, library growth, validation gates, and skill injection \(Table[1](https://arxiv.org/html/2610.20845#S2.T1)\), yet share the same evaluation premise: the co\-evolved policy is tested on its delivered bank\. We introduce no new member of this family; instead, we examine this shared premise and its consequences under deployment\-time skill drift\.

#### Agent robustness under skill drift\.

Robustness evaluations for language agents typically perturb the task side of the interaction—instructions, observations, tool outputs, or environment dynamics\. We instead perturb the agent’s own procedural knowledge, which task\-side benchmarks treat as fixed\. Recent work documents that skill libraries drift and that agent performance can degrade accordingly\([Zhang et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib21);[Chen et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib22);[Liu et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib32);[Chen et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib33)\), that skills may harm rather than help\([Tank and Nama, 2026](https://arxiv.org/html/2610.20845#bib.bib29);[Yu et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib31)\), and that self\-evolution is not always faithful\([Zhao et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib19);[Lv et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib20)\)\. Other approaches repair skills post hoc or construct more drift\-tolerant skills\([Liu et al\., 2026c](https://arxiv.org/html/2610.20845#bib.bib30);[Park et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib25);[Shao et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib26)\); by contrast, we audit the delivered policy’s dependence on whichever bank it encounters\. This setting also resembles zero\-shot coordination\([Hu et al\., 2020](https://arxiv.org/html/2610.20845#bib.bib40)\), with the skill bank acting as a co\-evolved partner that may change after training\. Appendix[B](https://arxiv.org/html/2610.20845#A2)provides further discussion\.

## 6Conclusion

This work shifts the evaluation of skill–policy co\-evolution from performance on a single delivered pair to robustness under realistic deployment\-time skill drift\. Our analysis identifies cooperative acceptance as a source of dependence on the co\-evolved bank, while the*co\-evolution fragility curve*shows that this dependence can strengthen over training\. CODA operationalizes these findings by auditing whether a delivered policy remains consistent under benign rewrites and resists incomplete or misleading skills\. The delivered peak is therefore informative but insufficient: future methods should preserve its gains while learning to interpret, reject, and adapt to skills as the bank evolves\.

## AI use statement

Large language models play two distinct roles in this work\. As a*component of the method*, the CODA rewriting suite callsgpt\-4o\-2024\-08\-06\(temperature0\.70\.7, with version and sampling parameters pinned as specified in Appendix[E](https://arxiv.org/html/2610.20845#A5)\) to generate the perturbed skill banks that serve as evaluation stimuli; because these banks are released, reproducing our evaluation does not require re\-running the model\. As an*authoring aid*, LLMs assisted only with language polishing, grammar, and style\. All research questions, methodology, experiments, analyses, and conclusions were conceived, implemented, and verified by the authors, who take full responsibility for the content of this paper\.

## Ethics statement

The CODA suite deliberately produces incomplete \(T2\) and misleading \(T3\) procedural instructions in order to measure how a delivered policy withstands skill drift\. These corrupted skills are generated and consumed entirely within the benchmark harness, are never deployed or shown to real users, and are released alongside the suite so that their content is transparent and auditable\. The work involves no human participants, collects no personally identifiable information, and introduces no new sensitive data; we see no direct risks to privacy, fairness, or legal compliance, and the work complies with the ICLR Code of Ethics\.

## Reproducibility statement

We take several concrete measures to make our results reproducible\.

- •Rewriting suite and protocol:the rewriting model, its version, and all sampling parameters are pinned \(Section[4\.1](https://arxiv.org/html/2610.20845#S4.SS1)\), and the domain contexts, layered prompts, and resulting perturbed banks are released, so the evaluation can be reproduced without re\-running the generative model\.
- •Environments and data:all benchmarks used \(ALFWorld, WebShop, ScienceWorld, Mind2Web, and DeepScaleR\-AMC23\) are publicly available; the test splits, episode counts, and evaluation configuration are documented in Section[4\.4](https://arxiv.org/html/2610.20845#S4.SS4)and Appendix[G](https://arxiv.org/html/2610.20845#A7), together with the released configuration\.

Together, these measures allow independent researchers to reproduce our results and verify the claims made in this paper\.

## References

- Chenet al\.\(2026a\)C\. Chen, Q\. Yu, Y\. Gu, Z\. Huang, H\. Li, H\. Liu, S\. Liu, J\. Liu, D\. Peng, J\. Wang,et al\.The scaling laws of skills in llm agent systems\.arXiv preprint arXiv:2605\.16508\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Chenet al\.\(2026b\)J\. Chen, X\. Ye, Y\. Wang, J\. Wang, Q\. Wang, and F\. XUVCE\-skill: enhancing skill self\-evolution with version\-change experience\.arXiv preprint arXiv:2608\.16544\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Denget al\.\(2023\)X\. Deng, Y\. Gu, B\. Zheng, S\. Chen, S\. Stevens, B\. Wang, H\. Sun, and Y\. SuMind2web: towards a generalist agent for the web\.Advances in Neural Information Processing Systems36,pp\. 28091–28114\.Cited by:[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1)\.
- Fanet al\.\(2026\)Z\. Fan, W\. Jin, F\. Zhang, B\. Li, Y\. Dong, Y\. Hu, and J\. LiEvolving\-rl: end\-to\-end optimization of experience\-driven self\-evolving capability within agents\.arXiv preprint arXiv:2605\.10663\.Cited by:[7th item](https://arxiv.org/html/2610.20845#A3.I1.i7.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.9.1),[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1)\.
- Fenget al\.\(2026\)J\. Feng, D\. Li, Y\. Chen, Y\. Gao, X\. Chen, H\. Wang, and Z\. PuCoSkill: joint reinforcement learning of reasoning and meta\-skill agents for hierarchical skill evolution\.arXiv preprint arXiv:2609\.04865\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Gaoet al\.\(2025\)H\. Gao, J\. Geng, W\. Hua, M\. Hu, X\. Juan, H\. Liu, S\. Liu, J\. Qiu, X\. Qi, Y\. Wu,et al\.A survey of self\-evolving agents: what, when, how, and where to evolve on the path to artificial super intelligence\.arXiv preprint arXiv:2507\.21046\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Heet al\.\(2026\)Z\. He, H\. Lin, B\. Han, W\. Zhu, H\. Fang, B\. Wang, X\. Zhu, R\. Li, and M\. ReimherrReSkill: reconciling skill creation with policy optimization in agentic rl\.arXiv preprint arXiv:2606\.01619\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1),[2nd item](https://arxiv.org/html/2610.20845#A3.I1.i2.p1.1),[§1](https://arxiv.org/html/2610.20845#S1.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.4.1),[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px1.p1.1)\.
- Hebbaret al\.\(2026\)P\. Hebbar, Y\. Manawat, S\. Verboomen, A\. Ivanova, S\. Palanimalai, K\. Bhatia, and V\. BaskaranSIA: self improving ai with harness & weight updates\.arXiv preprint arXiv:2605\.27276\.Cited by:[§1](https://arxiv.org/html/2610.20845#S1.p2.1)\.
- Hendrycks and Dietterich \(2019\)D\. Hendrycks and T\. DietterichBenchmarking neural network robustness to common corruptions and perturbations\.arXiv preprint arXiv:1903\.12261\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px3.p1.1)\.
- Huet al\.\(2020\)H\. Hu, A\. Lerer, A\. Peysakhovich, and J\. Foerster“Other\-play” for zero\-shot coordination\.InInternational conference on machine learning,pp\. 4399–4410\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Huanget al\.\(2026\)S\. Huang, P\. Cheng, H\. Liu, T\. Chen, Y\. Liu, J\. Ni, S\. Zhou, Z\. Yang, G\. Jiang, M\. Zhou,et al\.Skill self\-play: pushing the frontier of llm capability with co\-evolving skills\.arXiv preprint arXiv:2607\.22529\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Keet al\.\(2026\)X\. Ke, K\. Li, J\. Xing, Y\. Zhang, and J\. ChengGame\-theoretic co\-evolution for llm\-based heuristic discovery\.arXiv preprint arXiv:2601\.22896\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§D\.5](https://arxiv.org/html/2610.20845#A4.SS5.p1.1)\.
- Liet al\.\(2026\)Y\. Li, R\. Miao, Z\. Qi, and T\. LanArise: agent reasoning with intrinsic skill evolution in hierarchical reinforcement learning\.arXiv preprint arXiv:2603\.16060\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1),[5th item](https://arxiv.org/html/2610.20845#A3.I1.i5.p1.1),[§1](https://arxiv.org/html/2610.20845#S1.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.7.1),[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px1.p1.1)\.
- Linet al\.\(2026\)H\. Lin, C\. Huang, T\. Gao, T\. Huang, D\. Liu, T\. Li, X\. Sun, and L\. YaoAUSO: action\-level unified skill optimization from internalization to utilization\.arXiv preprint arXiv:2608\.21292\.Cited by:[§1](https://arxiv.org/html/2610.20845#S1.p1.1)\.
- Liuet al\.\(2026a\)S\. Liu, Z\. Lin, Y\. Zhang, Y\. Ren, Y\. Wu, Y\. Li, Z\. Wang, Z\. Fu, and J\. YeThe path to recursive self\-improving agents: foundation, framework, and future directions\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Liuet al\.\(2026b\)Y\. Liu, J\. Ji, L\. An, T\. Jaakkola, Y\. Zhang, and S\. ChangHow well do agentic skills work in the wild: benchmarking llm skill usage in realistic settings\.arXiv preprint arXiv:2604\.04323\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Liuet al\.\(2026c\)Y\. Liu, Z\. Su, L\. Xie, Y\. Zhang, Q\. Zong, J\. Guo, Z\. Xie, Y\. Ji, Y\. Yim, H\. Luo,et al\.SkillRevise: improving llm\-authored agent skills via trace\-conditioned skill revision\.arXiv preprint arXiv:2606\.01139\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Liuet al\.\(2026d\)Y\. Liu, Z\. Su, Y\. Zhang, J\. Guo, Z\. Xie, H\. Jing, L\. Xie, Q\. Zong, Y\. Yim, Z\. Zhang,et al\.Rethinking self\-evolving agent skills: feedback dynamics over multiple rounds\.arXiv preprint arXiv:2608\.02636\.Cited by:[§1](https://arxiv.org/html/2610.20845#S1.p2.1)\.
- Luoet al\.\(2025\)M\. Luo, S\. Tan, J\. Wong, X\. Shi, W\. Y\. Tang, M\. Roongta, C\. Cai, J\. Luo, L\. E\. Li, R\. A\. Popa,et al\.Deepscaler: surpassing o1\-preview with a 1\.5 b model by scaling rl\.Notion Blog3\(5\)\.Cited by:[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1)\.
- Lvet al\.\(2026\)S\. Lv, W\. Wu, R\. Zhu, Z\. Cheng, and L\. GuoCan agents generalize to the open world? unveiling the fragility of static training in tool use\.arXiv preprint arXiv:2607\.01084\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Maoet al\.\(2026\)B\. Mao, J\. Zhou, Y\. Yang, X\. Li, X\. Wei, Q\. Chen, X\. Wu, and L\. HeLearning while acting: a skill\-enhanced test\-time co\-evolution framework for online lifelong learning agents\.arXiv preprint arXiv:2606\.04815\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Panet al\.\(2025\)Z\. Pan, Y\. Zhang, Z\. Liu, Y\. Y\. Tang, Z\. Zhang, H\. Luo, Y\. Han, J\. Zhang, D\. Wu, H\. Chen,et al\.Advevo\-marl: shaping internalized safety through adversarial co\-evolution in multi\-agent reinforcement learning\.arXiv preprint arXiv:2510\.01586\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1)\.
- Parket al\.\(2026\)J\. Park, S\. Oh, S\. Baek, and Y\. KimLearning generalizable skill policy with data\-efficient unsupervised rl\.arXiv preprint arXiv:2607\.00392\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Renet al\.\(2026\)Z\. Ren, Y\. Chen, D\. Guo, G\. Rong, T\. Li, R\. Xiong, Q\. Lan, W\. Wang, L\. Nanbo, Y\. Yang,et al\.Self\-improvements in modern agentic systems: a survey\.arXiv preprint arXiv:2607\.13104\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Ribeiroet al\.\(2020\)M\. T\. Ribeiro, T\. Wu, C\. Guestrin, and S\. SinghBeyond accuracy: behavioral testing of nlp models with checklist\.InProceedings of the 58th annual meeting of the association for computational linguistics,pp\. 4902–4912\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px3.p1.1)\.
- Shaoet al\.\(2026\)J\. Shao, H\. Yin, Y\. Lyu, X\. Yu, L\. Guo, I\. Tsang, J\. Kwok, and Y\. LiLifting traces to logic: programmatic skill induction with neuro\-symbolic learning for long\-horizon agentic tasks\.arXiv preprint arXiv:2605\.01293\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Shiet al\.\(2026\)Y\. Shi, Y\. Chen, Z\. Lu, Y\. Miao, S\. Liu, Q\. Gu, X\. Cai, X\. Wang, and A\. ZhangSkill1: unified evolution of skill\-augmented agents via reinforcement learning\.arXiv preprint arXiv:2605\.06130\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1),[4th item](https://arxiv.org/html/2610.20845#A3.I1.i4.p1.1),[§1](https://arxiv.org/html/2610.20845#S1.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.6.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px1.p1.1)\.
- Shridharet al\.\(2020\)M\. Shridhar, X\. Yuan, M\. Côté, Y\. Bisk, A\. Trischler, and M\. HausknechtAlfworld: aligning text and embodied environments for interactive learning\.arXiv preprint arXiv:2010\.03768\.Cited by:[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1)\.
- Tank and Nama \(2026\)D\. Tank and B\. NamaThe regression tax: decomposing why skills help and hurt llm agents\.arXiv preprint arXiv:2607\.22520\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Wanget al\.\(2022\)R\. Wang, P\. Jansen, M\. Côté, and P\. AmmanabroluScienceworld: is your agent smarter than a 5th grader?\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,pp\. 11279–11298\.Cited by:[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1)\.
- Wenet al\.\(2026\)X\. Wen, Z\. He, H\. Qi, Z\. Wan, Z\. Ma, Y\. Wen, T\. Zheng, X\. Xu, C\. Lu, and Q\. ZhangMAGIC: a co\-evolving attacker\-defender adversarial game for robust llm safety\.arXiv preprint arXiv:2602\.01539\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§D\.5](https://arxiv.org/html/2610.20845#A4.SS5.p1.1)\.
- Wuet al\.\(2026\)X\. Wu, Z\. Li, G\. Shi, A\. Duffy, T\. Marques, M\. L\. Olson, T\. Zhou, and D\. ManochaCo\-evolving llm decision and skill bank agents for long\-horizon tasks\.arXiv preprint arXiv:2604\.20987\.Cited by:[8th item](https://arxiv.org/html/2610.20845#A3.I1.i8.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.10.1)\.
- Xiaet al\.\(2026a\)P\. Xia, J\. Chen, H\. Wang, J\. Liu, K\. Zeng, Y\. Wang, S\. Han, Y\. Zhou, X\. Zhao, H\. Chen,et al\.Skillrl: evolving agents via recursive skill\-augmented reinforcement learning\.arXiv preprint arXiv:2602\.08234\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1),[1st item](https://arxiv.org/html/2610.20845#A3.I1.i1.p1.1),[§1](https://arxiv.org/html/2610.20845#S1.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.3.1),[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px1.p1.1)\.
- Xiaet al\.\(2026b\)P\. Xia, J\. Chen, X\. Yang, H\. Tu, J\. Liu, K\. Xiong, S\. Han, S\. Qiu, H\. Ji, Y\. Zhou,et al\.MetaClaw: just talk–an agent that meta\-learns and evolves in the wild\.arXiv preprint arXiv:2603\.17187\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2026a\)M\. Yang, J\. Piao, X\. Xia, X\. Lan, J\. Chen, Y\. Gong, and Y\. LiSkillMaster: toward autonomous skill mastery in llm agents\.arXiv preprint arXiv:2605\.08693\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1),[6th item](https://arxiv.org/html/2610.20845#A3.I1.i6.p1.1),[§1](https://arxiv.org/html/2610.20845#S1.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.8.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px1.p1.1)\.
- Yanget al\.\(2026b\)S\. Yang, Z\. Ma, T\. Huang, X\. Wang, R\. Li, Y\. Hu, Y\. Wang, and X\. ChuSkillForge: evolving verifiable skills for reinforcement learning agents\.arXiv preprint arXiv:2608\.24747\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Yaoet al\.\(2022\)S\. Yao, H\. Chen, J\. Yang, and K\. NarasimhanWebshop: towards scalable real\-world web interaction with grounded language agents\.Advances in Neural Information Processing Systems35,pp\. 20744–20757\.Cited by:[§3\.3](https://arxiv.org/html/2610.20845#S3.SS3.SSS0.Px1.p1.1)\.
- Yuet al\.\(2026\)J\. Yu, J\. Zhu, B\. Lin, Q\. Cui, Z\. Ding, and X\. LiSkill is not one\-size\-fits\-all: model\-aware skill alignment for llm agents\.arXiv preprint arXiv:2605\.30723\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Zhanget al\.\(2026a\)X\. Zhang, Y\. Cui, G\. Wang, Z\. Li, W\. Qiu, B\. Zhu, and P\. HeLibrary drift: diagnosing and fixing a silent failure mode in self\-evolving llm skill libraries\.arXiv preprint arXiv:2605\.19576\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Zhanget al\.\(2026b\)Z\. Zhang, Y\. Lin, N\. L\. Kuang, L\. Wu, X\. Li, S\. Liu, and F\. MaCo\-evolving skill generation and policy optimization\.arXiv preprint arXiv:2606\.08755\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1),[3rd item](https://arxiv.org/html/2610.20845#A3.I1.i3.p1.1),[§1](https://arxiv.org/html/2610.20845#S1.p1.1),[Table 1](https://arxiv.org/html/2610.20845#S2.T1.2.1.5.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px1.p1.1)\.
- Zhaoet al\.\(2026\)W\. Zhao, Y\. Wang, Y\. Zhang, Y\. Deng, Y\. Zhao, W\. Che, B\. Qin, and T\. LiuLarge language model agents are not always faithful self\-evolvers\.arXiv preprint arXiv:2601\.22436\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px2.p1.1),[§5](https://arxiv.org/html/2610.20845#S5.SS0.SSS0.Px2.p1.1)\.
- Zhouet al\.\(2026\)Y\. Zhou, W\. Shu, Y\. Su, W\. Du, Y\. Fang, and X\. LinA comprehensive survey on agent skills: taxonomy, techniques, and applications\.arXiv preprint arXiv:2605\.07358\.Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.
- Zouet al\.\(2026\)H\. P\. Zou, W\. Huang, Y\. Wu, J\. Guo, Y\. Chen, C\. Miao, H\. Nguyen, Y\. Zhou, W\. Zhang, L\. Fang, H\. Zhang, F\. Wang, P\. Zhang, H\. Wang, L\. He, Y\. Li, D\. Li, R\. Jiang, X\. Liu, and P\. S\. YuLLM\-based human\-agent collaboration and interaction systems: a survey\.External Links:2505\.00753,[Link](https://arxiv.org/abs/2505.00753)Cited by:[Appendix B](https://arxiv.org/html/2610.20845#A2.SS0.SSS0.Px1.p1.1)\.

## Appendix ALimitations

We note three limitations of this work\.

1. L1*Rewriting is not bit\-reproducible\.*A language model rewriting a skill is not a deterministic operator: pinned model versions, pinned sampling, and released perturbed banks reduce the variance a re\-runner faces but do not remove it\. If the bank was written by the same model family that later rewrites it, the measured fragility may be optimistically low\.
2. L2*We diagnose but do not fix\.*We expose the fragility and provide a measurement tool, but propose no mitigation\. The natural direction is the distributional objective of Eq\. \([6](https://arxiv.org/html/2610.20845#S2.E6)\)—training against a distribution of bank perturbations rather than a single fixed bank—but turning it into a practical method, and keeping the net\-benefit gate satisfied, is future work\.
3. L3*Scale is unstudied\.*Whether broader exposure—more benchmarks, larger banks, more data—reduces sensitivity to wording or merely raises the peak from which the worst case falls away is beyond our design, and is the most interesting open question beyond the fix itself\.

## Appendix BExtended Related Work

#### Skill–policy co\-evolution\.

A growing family of methods lets an agent distill task experience into reusable skills and then trains the policy on the enlarged bank\([Liu et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib14);[Zou et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib10);[Yang et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib3);[Feng et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib4)\)\.SkillRL\([Xia et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib1)\)distills successful trajectories into skills that are added to a monotonically growing library and gated by reward on sampled rollouts\.ReSkill\([He et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib2)\)caps the library at a fixed size and uses Thompson sampling to decide which incumbent a new candidate should replace\.Skill1\([Shi et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib7)\)jointly optimizes the policy and bank end\-to\-end, admitting skills from trajectories that already succeed\.ARISE\([Li et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib9)\)evolves a two\-tier hierarchy of intrinsic skills under a hierarchical reward\.SAPO\([Zhang et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib6)\)admits a skill only when its estimated marginal utility to the current policy is positive\.SkillMaster\([Yang et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib8)\)lets the policy itself score candidates, retaining high\-scoring ones into a managed library\. These methods differ in cadence, library growth, validation gate, and injection mechanism \(Table[1](https://arxiv.org/html/2610.20845#S2.T1); Appendix[C](https://arxiv.org/html/2610.20845#A3)gives the full classification\)\. What they do not differ in is how success is reported: the co\-evolved policy is run on the delivered bank and a task success rate is given\. Surveys chart this space\([Zhou et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib34);[Gao et al\., 2025](https://arxiv.org/html/2610.20845#bib.bib35);[Ren et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib36)\), and recent variants push co\-evolution to test\-time\([Mao et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib38)\), self\-play\([Huang et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib41)\), and deployment\-time meta\-learning\([Xia et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib37)\)\. We contribute no new member of this family\. Our object of study is the family itself—specifically, the one premise that survives all of their design disagreements\.

#### Agent robustness and adversarial co\-evolution\.

Work on robustness for language agents perturbs the task side of the interaction—instructions, observations, tool outputs, environment dynamics—and asks whether performance survives\. We perturb a different thing: the agent’s own store of procedural knowledge, which no task\-side benchmark touches because it is normally treated as part of the agent rather than part of the environment\. Concurrently, a cluster of works documents that skill libraries drift and that agents degrade under that drift\([Zhang et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib21);[Chen et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib22);[Liu et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib32);[Chen et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib33)\), that skills can hurt as often as they help\([Tank and Nama, 2026](https://arxiv.org/html/2610.20845#bib.bib29);[Yu et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib31)\), and that self\-evolution is not always faithful\([Zhao et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib19);[Lv et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib20)\)\. These diagnose the symptom; none ties it to the co\-evolution objective or measures it on the delivered artifact\. SkillRevise\([Liu et al\., 2026c](https://arxiv.org/html/2610.20845#bib.bib30)\)repairs skills post hoc, and GenDa\([Park et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib25)\)with programmatic skill induction\([Shao et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib26)\)build drift\-tolerant skills from the skill side; we instead audit the policy’s dependence on whatever bank it is handed\. The closest conceptual relative is zero\-shot coordination\([Hu et al\., 2020](https://arxiv.org/html/2610.20845#bib.bib40)\), where a policy trained with one partner must act with another it never co\-evolved with; our setting is the single\-agent analog, with the skill library in the role of the partner that changed\. A separate line evolves an adversary alongside the learner, in game\-theoretic heuristic discovery\([Ke et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib27)\)or attacker–defender safety training\([Wen et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib39);[Pan et al\., 2025](https://arxiv.org/html/2610.20845#bib.bib28)\), and reports robustness*gains*\. This is not a counterexample to Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)but a confirmation of its premise read in reverse: those methods accept a candidate precisely when it*lowers*the current policy’s return, so the sign in Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)is flipped and the conclusion flips with it\. Appendix[D\.5](https://arxiv.org/html/2610.20845#A4.SS5)works this through, and the comparison is instructive rather than competitive: it locates the fragility in the acceptance rule rather than in co\-evolution as such\.

#### Standardized perturbation suites\.

CODA belongs to a tradition of fixed perturbation suites applied to models their designers did not build: corruption benchmarks in vision\([Hendrycks and Dietterich, 2019](https://arxiv.org/html/2610.20845#bib.bib42)\)and behavioral test suites in NLP\([Ribeiro et al\., 2020](https://arxiv.org/html/2610.20845#bib.bib43)\)both consist of a released operator, a reporting convention, and the finding that published systems fail more than their headline numbers suggest\. We follow that template on the skill side\. One difference must be stated rather than glossed over: those operators are deterministic algorithms that reproduce bit\-for\-bit, whereas rewriting a skill with a language model does not\. We narrow the gap: we pin the rewriting model, its version and its sampling parameters; we ship the domain context so nothing is left to the user; and we release the perturbed banks alongside the suite \(Section[4\.1](https://arxiv.org/html/2610.20845#S4.SS1)\)\. We do not close it, though— Section[6](https://arxiv.org/html/2610.20845#S6)lists it first among the limitations\.

## Appendix CClassification of Existing Methods

The four axes of Table[1](https://arxiv.org/html/2610.20845#S2.T1)are defined as follows\.*Update cadence*determines how the two steps interleave, from strictly alternating through near\-synchronous to jointly optimized\. The*validation gate*determines how a candidate bank is admitted: no test at all, an improvement test on sampled rollouts, or a posterior test such as Thompson sampling\.*Library growth*is either monotone, so that skills accumulate, or capped, so that admission displaces an incumbent\. The*injection mechanism*determines what reaches the context at inference: a batch selected by task category, or a small subset triggered per step\.

We now place each surveyed method on these axes and state its acceptance rule—the property that Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)abstracts\. In every case the gate admits a candidate bank only when it does not lower \(and usually strictly raises\) the current policy’s return, however differently that test is implemented\.

- •SkillRL\([Xia et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib1)\): alternating cadence, monotone growth, batch top\-kkinjection\. A distilled skill is admitted whenever it does not reduce reward on sampled rollouts and is never removed thereafter, so the retained bank is the reward\-non\-decreasing one\.
- •ReSkill\([He et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib2)\): near\-synchronous cadence, library capped at eight, per\-step injection\. A candidate is validated by Thompson sampling and kept only if its posterior return improves on the incumbent it would displace\.
- •SAPO\([Zhang et al\., 2026b](https://arxiv.org/html/2610.20845#bib.bib6)\): near\-synchronous cadence, two\-tier capped growth, reranked injection\. A skill enters only when its estimated marginal utility to the current policy is positive\.
- •Skill1\([Shi et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib7)\): joint optimization, monotone growth, log\-probability injection\. Skills are distilled from trajectories that already succeed \(r=1r\{=\}1\) and trained jointly with the policy, so what is retained is exactly what supported a return the policy did not lose\.
- •ARISE\([Li et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib9)\): joint optimization, two\-tier growth, log\-probability injection\. Intrinsic skills are evolved under a hierarchical reward and retained on improvement of that reward\.
- •SkillMaster\([Yang et al\., 2026a](https://arxiv.org/html/2610.20845#bib.bib8)\): near\-synchronous cadence, policy\-managed growth and injection\. The policy itself scores candidate skills and retains the high\-scoring ones, i\.e\. those that raise its own return\.
- •Evolving\-RL\([Fan et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib13)\): joint optimization, monotone growth, batch injection\. A skill is admitted end\-to\-end when it clears a reward threshold on the current policy\.
- •COSPLAY\([Wu et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib15)\): near\-synchronous cadence, lifecycle\-managed growth, per\-step injection\. Skills pass a contract\-verification step and are retained over their lifecycle while they continue to serve the policy’s return\.

The gates differ in form—an improvement test on rollouts, a Thompson posterior, a marginal\-utility check, a reward threshold, a policy score, a contract—but all favor skills that serve the current policy\. Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)idealizes this shared selection bias\. Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)is model\-agnostic but additionally requires the candidate\-coverage condition of Assumption[2](https://arxiv.org/html/2610.20845#Thmassumption2); it therefore applies conditionally rather than automatically to the eight surveyed methods\.

## Appendix DProofs and the Minimal Linear–Gaussian Construction

### D\.1Setup and Notation

We restate the objects used throughout\. A taskxxis drawn fromDD, a skill bankSSlives in𝒮\\mathcal\{S\}, and the return of a policy isJ\(θ,S\)=𝔼x∼D\[R\(πθ\(⋅∣x,S\)\)\]J\(\\theta,S\)=\\mathbb\{E\}\_\{x\\sim D\}\[R\(\\pi\_\{\\theta\}\(\\cdot\\mid x,S\)\)\]as in Eq\. \([1](https://arxiv.org/html/2610.20845#S2.E1)\)\. At roundttthe candidate set𝒞t⊆𝒮\\mathcal\{C\}\_\{t\}\\subseteq\\mathcal\{S\}collects the banks the method’s proposal mechanism could have produced and its gate could have retained; Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)statesSt∈arg⁡maxS∈𝒞t⁡J⁡\(θt,S\)S\_\{t\}\\in\\arg\\max\_\{S\\in\\mathcal\{C\}\_\{t\}\}J\(\\theta\_\{t\},S\)\. The content\-level neighborhoodℬ⁡\(S\)\\mathcal\{B\}\(S\)of Definition[1](https://arxiv.org/html/2610.20845#Thmdefinition1)contains a specified family of textual rewrites, includesSSitself and excludes the empty bank\. Assumption[2](https://arxiv.org/html/2610.20845#Thmassumption2)requiresℬ⁡\(S∗\)⊆𝒞T\\mathcal\{B\}\(S^\{\*\}\)\\subseteq\\mathcal\{C\}\_\{T\}only at delivery\. The response setℛ\\mathcal\{R\}and fragilityΦ\\Phiare as in Definition[2](https://arxiv.org/html/2610.20845#Thmdefinition2)\. We write\(θ∗,S∗\)=\(θT,ST\)\(\\theta^\{\*\},S^\{\*\}\)=\(\\theta\_\{T\},S\_\{T\}\)for the delivered pair and drop the round index when it is not needed\.

### D\.2Proof of Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)

###### Proof\.

For the first claim, Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)at roundt=Tt=TgivesJ⁡\(θ∗,S∗\)=maxS∈𝒞T⁡J⁡\(θ∗,S\)J\(\\theta^\{\*\},S^\{\*\}\)=\\max\_\{S\\in\\mathcal\{C\}\_\{T\}\}J\(\\theta^\{\*\},S\), henceJ⁡\(θ∗,S′\)≤J⁡\(θ∗,S∗\)J\(\\theta^\{\*\},S^\{\\prime\}\)\\leq J\(\\theta^\{\*\},S^\{\*\}\)for everyS′∈𝒞TS^\{\\prime\}\\in\\mathcal\{C\}\_\{T\}\. Sinceℬ⁡\(S∗\)⊆𝒞T\\mathcal\{B\}\(S^\{\*\}\)\\subseteq\\mathcal\{C\}\_\{T\}by Assumption[2](https://arxiv.org/html/2610.20845#Thmassumption2), the inequality holds in particular for everyS′∈ℬ⁡\(S∗\)S^\{\\prime\}\\in\\mathcal\{B\}\(S^\{\*\}\), so each elementJ⁡\(θ∗,S′\)−J⁡\(θ∗,S∗\)J\(\\theta^\{\*\},S^\{\\prime\}\)\-J\(\\theta^\{\*\},S^\{\*\}\)ofℛ⁡\(θ∗,S∗\)\\mathcal\{R\}\(\\theta^\{\*\},S^\{\*\}\)is non\-positive, which is Eq\. \([5](https://arxiv.org/html/2610.20845#S2.E5)\)\.

For the second claim,Φ⁡\(θ∗,S∗\)=0\\Phi\(\\theta^\{\*\},S^\{\*\}\)=0meansminS′∈ℬ⁡\(S∗\)⁡J⁡\(θ∗,S′\)=J⁡\(θ∗,S∗\)\\min\_\{S^\{\\prime\}\\in\\mathcal\{B\}\(S^\{\*\}\)\}J\(\\theta^\{\*\},S^\{\\prime\}\)=J\(\\theta^\{\*\},S^\{\*\}\)\. Combined with the upper bound just established, this forcesJ⁡\(θ∗,S′\)=J⁡\(θ∗,S∗\)J\(\\theta^\{\*\},S^\{\\prime\}\)=J\(\\theta^\{\*\},S^\{\*\}\)for allS′∈ℬ⁡\(S∗\)S^\{\\prime\}\\in\\mathcal\{B\}\(S^\{\*\}\), i\.e\. the return is constant on the neighborhood\.

For the third claim, Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)constrainsJ⁡\(θ0,⋅\)J\(\\theta\_\{0\},\\cdot\)only ifθ0\\theta\_\{0\}was the policy against which the bank step was solved\. If it was not, no constraint relatesJ⁡\(θ0,S∗\)J\(\\theta\_\{0\},S^\{\*\}\)toJ⁡\(θ0,S′\)J\(\\theta\_\{0\},S^\{\\prime\}\)forS′∈ℬ⁡\(S∗\)S^\{\\prime\}\\in\\mathcal\{B\}\(S^\{\*\}\), somax⁡ℛ⁡\(θ0,S∗\)\>0\\max\\mathcal\{R\}\(\\theta\_\{0\},S^\{\*\}\)\>0is consistent with the premise\. An explicit instance in which this maximum is strictly positive is given in Appendix[D\.3](https://arxiv.org/html/2610.20845#A4.SS3)\. ∎

### D\.3Construction[1](https://arxiv.org/html/2610.20845#Thmconstruction1)and Proof of Proposition[3](https://arxiv.org/html/2610.20845#Thmproposition3)

Propositions[1](https://arxiv.org/html/2610.20845#Thmproposition1)and[2](https://arxiv.org/html/2610.20845#Thmproposition2)bound the sign of the response but say nothing about the magnitude ofΦ\\Phior its evolution during training\. We exhibit the smallest instance containing both ingredients of co\-evolution—a policy that reads the bank, and a bank selected under Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)to help the current policy—in which both are available in closed form\.

###### Construction 1\(Minimal linear–Gaussian instance\)\.

A binary label is predicted from two independent noisy channels: a*semantic*channel whose strength is fixed by the environment, and a*form*channel whose salience the bank step controls\. The policy is a linear classifier trained as a best response, and the bank step raises form salience under Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)\.

#### The instance\.

A labely∈\{−1,\+1\}y\\in\\\{\-1,\+1\\\}is uniform\. The policy observes two scalar channels,

xr=μr​y\+εr,εr∼𝒩⁡\(0,σr2\),xu=μu​y\+εu,εu∼𝒩⁡\(0,σu2\),x\_\{r\}\\;=\\;\\mu\_\{r\}\\,y\+\\varepsilon\_\{r\},\\quad\\varepsilon\_\{r\}\\sim\\mathcal\{N\}\(0,\\sigma\_\{r\}^\{2\}\),\\qquad x\_\{u\}\\;=\\;\\mu\_\{u\}\\,y\+\\varepsilon\_\{u\},\\quad\\varepsilon\_\{u\}\\sim\\mathcal\{N\}\(0,\\sigma\_\{u\}^\{2\}\),\(14\)with independent noises\. The*semantic*channelxrx\_\{r\}has strengthμr\\mu\_\{r\}fixed by the environment: it represents what the skill means, which no rewrite alters\. The*form*channelxux\_\{u\}carries the label only through the particular surface encoding the bank supplies, and its salienceμu\\mu\_\{u\}is the quantity the bank step controls\. The policy is the linear rulesign⁡\(w⋅x\)\\mathrm\{sign\}\(w\\cdot x\)withw=\(wr,wu\)w=\(w\_\{r\},w\_\{u\}\)\. Conditioned onyywe havew⋅x∼𝒩⁡\(y​m,s2\)w\\cdot x\\sim\\mathcal\{N\}\(y\\,m,s^\{2\}\)withm=wr​μr\+wu​μum=w\_\{r\}\\mu\_\{r\}\+w\_\{u\}\\mu\_\{u\}ands2=wr2​σr2\+wu2​σu2s^\{2\}=w\_\{r\}^\{2\}\\sigma\_\{r\}^\{2\}\+w\_\{u\}^\{2\}\\sigma\_\{u\}^\{2\}, so the return is

J⁡\(w,μu\)=Φ𝒩​\(wr​μr\+wu​μuwr2​σr2\+wu2​σu2\),J\(w,\\mu\_\{u\}\)\\;=\\;\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\frac\{w\_\{r\}\\mu\_\{r\}\+w\_\{u\}\\mu\_\{u\}\}\{\\sqrt\{w\_\{r\}^\{2\}\\sigma\_\{r\}^\{2\}\+w\_\{u\}^\{2\}\\sigma\_\{u\}^\{2\}\}\}\\right\),\(15\)whereΦ𝒩\\Phi\_\{\\mathcal\{N\}\}is the standard normal CDF\.

#### The dynamics\.

The*policy step*maximizes Eq\. \([15](https://arxiv.org/html/2610.20845#A4.E15)\) overww, which is the Fisher discriminantw∝\(μr/σr2,μu/σu2\)w\\propto\(\\mu\_\{r\}/\\sigma\_\{r\}^\{2\},\\;\\mu\_\{u\}/\\sigma\_\{u\}^\{2\}\)\. The*bank step*follows Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1): since Eq\. \([15](https://arxiv.org/html/2610.20845#A4.E15)\) is increasing inμu\\mu\_\{u\}wheneverwu\>0w\_\{u\}\>0, any candidate that raises form salience is accepted, soμu\(t\)\\mu\_\{u\}^\{\(t\)\}is non\-decreasing intt\. Define the two squared signal\-to\-noise ratios

a=μr2σr2\(fixed\),b\(t\)=\(μu\(t\)\)2σu2\(non\-decreasing; the*dose*\)\.a\\;=\\;\\frac\{\\mu\_\{r\}^\{2\}\}\{\\sigma\_\{r\}^\{2\}\}\\quad\(\\text\{fixed\}\),\\qquad b^\{\(t\)\}\\;=\\;\\frac\{\\big\(\\mu\_\{u\}^\{\(t\)\}\\big\)^\{2\}\}\{\\sigma\_\{u\}^\{2\}\}\\quad\(\\text\{non\-decreasing; the \\emph\{dose\}\}\)\.\(16\)

#### Clean and perturbed return\.

Substituting the Fisher weights into Eq\. \([15](https://arxiv.org/html/2610.20845#A4.E15)\) gives numeratorμr2/σr2\+μu2/σu2=a\+b\\mu\_\{r\}^\{2\}/\\sigma\_\{r\}^\{2\}\+\\mu\_\{u\}^\{2\}/\\sigma\_\{u\}^\{2\}=a\+band denominatorμr2/σr2\+μu2/σu2=a\+b\\sqrt\{\\mu\_\{r\}^\{2\}/\\sigma\_\{r\}^\{2\}\+\\mu\_\{u\}^\{2\}/\\sigma\_\{u\}^\{2\}\}=\\sqrt\{a\+b\}, hence

Jclean\(t\)=Φ𝒩​\(a\+b\(t\)\)\.J\_\{\\mathrm\{clean\}\}^\{\(t\)\}\\;=\\;\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\sqrt\{a\+b^\{\(t\)\}\}\\right\)\.\(17\)A meaning\-preserving rewrite changes the surface encoding while leaving the semantics intact, so the direction the policy learned to read no longer predicts the label: in the model,μu→0\\mu\_\{u\}\\to 0in the data while the weights, fixed at deployment, and the channel noise are unchanged\. The numerator becomesaaand the denominator is unchanged, giving

Jpert\(t\)=Φ𝒩​\(aa\+b\(t\)\),Φ\(t\)=Φ𝒩​\(a\+b\(t\)\)−Φ𝒩​\(aa\+b\(t\)\)\.J\_\{\\mathrm\{pert\}\}^\{\(t\)\}\\;=\\;\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\frac\{a\}\{\\sqrt\{a\+b^\{\(t\)\}\}\}\\right\),\\qquad\\Phi^\{\(t\)\}\\;=\\;\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\sqrt\{a\+b^\{\(t\)\}\}\\right\)\-\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\frac\{a\}\{\\sqrt\{a\+b^\{\(t\)\}\}\}\\right\)\.\(18\)
###### Proposition 3\(Dose–response, in Construction[1](https://arxiv.org/html/2610.20845#Thmconstruction1)\)\.

Both peak return and fragilityΦ\(t\)\\Phi^\{\(t\)\}are strictly increasing in the doseb\(t\)b^\{\(t\)\}\. A policy that does not read the form channel hasΦ\(t\)=0\\Phi^\{\(t\)\}=0for alltt\.

###### Proof of Proposition[3](https://arxiv.org/html/2610.20845#Thmproposition3)\.

Writeφc​\(b\)=Φ𝒩​\(a\+b\)\\varphi\_\{c\}\(b\)=\\Phi\_\{\\mathcal\{N\}\}\(\\sqrt\{a\+b\}\)andφp​\(b\)=Φ𝒩​\(a/a\+b\)\\varphi\_\{p\}\(b\)=\\Phi\_\{\\mathcal\{N\}\}\(a/\\sqrt\{a\+b\}\)forb≥0b\\geq 0, so thatJclean=φc​\(b\)J\_\{\\mathrm\{clean\}\}=\\varphi\_\{c\}\(b\)andΦ=φc​\(b\)−φp​\(b\)\\Phi=\\varphi\_\{c\}\(b\)\-\\varphi\_\{p\}\(b\)\. The mapb↦a\+bb\\mapsto\\sqrt\{a\+b\}is strictly increasing andΦ𝒩\\Phi\_\{\\mathcal\{N\}\}is strictly increasing, soφc\\varphi\_\{c\}is strictly increasing: peak return rises with the dose\. The mapb↦a/a\+bb\\mapsto a/\\sqrt\{a\+b\}is strictly decreasing fora\>0a\>0, since the numerator is constant and the denominator strictly increases, soφp\\varphi\_\{p\}is strictly decreasing\. HenceΦ=φc−φp\\Phi=\\varphi\_\{c\}\-\\varphi\_\{p\}is a sum of a strictly increasing function and the negative of a strictly decreasing function, and is therefore strictly increasing inbb\. Becauseb\(t\)b^\{\(t\)\}is non\-decreasing along the trajectory and strictly increases at any accepted step, bothJclean\(t\)J\_\{\\mathrm\{clean\}\}^\{\(t\)\}andΦ\(t\)\\Phi^\{\(t\)\}increase along training\.

For the final claim, a policy withwu=0w\_\{u\}=0never reads the form channel; thenm=wr​μrm=w\_\{r\}\\mu\_\{r\}ands2=wr2​σr2s^\{2\}=w\_\{r\}^\{2\}\\sigma\_\{r\}^\{2\}both in the clean and in the perturbed condition, soJclean=Jpert=Φ𝒩​\(a\)J\_\{\\mathrm\{clean\}\}=J\_\{\\mathrm\{pert\}\}=\\Phi\_\{\\mathcal\{N\}\}\(\\sqrt\{a\}\)andΦ=0\\Phi=0for everytt\. ∎

###### Corollary 1\(The sign reversal of Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1), realized\)\.

Letθ0\\theta\_\{0\}have a misaligned form weight,wu​μu<0w\_\{u\}\\mu\_\{u\}<0, as may happen for a policy that never co\-evolved to this bank\. Then the numerator of Eq\. \([15](https://arxiv.org/html/2610.20845#A4.E15)\) satisfieswr​μr\+wu​μu<wr​μrw\_\{r\}\\mu\_\{r\}\+w\_\{u\}\\mu\_\{u\}<w\_\{r\}\\mu\_\{r\}, while the perturbed numerator iswr​μrw\_\{r\}\\mu\_\{r\}and the denominator is unchanged; henceJpert\>JcleanJ\_\{\\mathrm\{pert\}\}\>J\_\{\\mathrm\{clean\}\}andmax⁡ℛ⁡\(θ0,S∗\)\>0\\max\\mathcal\{R\}\(\\theta\_\{0\},S^\{\*\}\)\>0\. Destroying a channel the policy was reading incorrectly improves it, which is the admissible case of Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)\.

### D\.4Proof of Proposition[2](https://arxiv.org/html/2610.20845#Thmproposition2)and the Invariance of the Point\-Mass Objective

###### Proof of Proposition[2](https://arxiv.org/html/2610.20845#Thmproposition2)\.

Add and subtractJ⁡\(θ,S∗\)J\(\\theta,S^\{\*\}\)inside the expectation,

𝔼S∼P​\[J⁡\(θ,S\)\]=𝔼S∼P​\[J⁡\(θ,S∗\)−\(J⁡\(θ,S∗\)−J⁡\(θ,S\)\)\]=J⁡\(θ,S∗\)−𝔼S∼P​\[J⁡\(θ,S∗\)−J⁡\(θ,S\)\],\\mathbb\{E\}\_\{S\\sim P\}\\\!\\left\[J\(\\theta,S\)\\right\]=\\mathbb\{E\}\_\{S\\sim P\}\\\!\\left\[J\(\\theta,S^\{\*\}\)\-\\big\(J\(\\theta,S^\{\*\}\)\-J\(\\theta,S\)\\big\)\\right\]=J\(\\theta,S^\{\*\}\)\-\\mathbb\{E\}\_\{S\\sim P\}\\\!\\left\[J\(\\theta,S^\{\*\}\)\-J\(\\theta,S\)\\right\],which is Eq\. \([6](https://arxiv.org/html/2610.20845#S2.E6)\) sinceJ⁡\(θ,S∗\)J\(\\theta,S^\{\*\}\)does not depend onSS\. Under Assumptions[1](https://arxiv.org/html/2610.20845#Thmassumption1)and[2](https://arxiv.org/html/2610.20845#Thmassumption2), each integrandJ⁡\(θ∗,S∗\)−J⁡\(θ∗,S\)J\(\\theta^\{\*\},S^\{\*\}\)\-J\(\\theta^\{\*\},S\)is non\-negative by Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1), so the average degradation is non\-negative; it is bounded above byΦ⁡\(θ∗,S∗\)\\Phi\(\\theta^\{\*\},S^\{\*\}\)because every integrand is\. TakingP=δS∗P=\\delta\_\{S^\{\*\}\}makes the integrand vanish identically, recoveringJ⁡\(θ,S∗\)J\(\\theta,S^\{\*\}\)\. ∎

The companion statement referred to in Section[2\.3](https://arxiv.org/html/2610.20845#S2.SS3)says that the training objective cannot see fragility at all\. It is a statement about the*objective*, not about a particular network, and unlike Proposition[2](https://arxiv.org/html/2610.20845#Thmproposition2)it needs a hypothesis on the policy class\.

###### Proposition 4\(The point\-mass objective is blind to fragility\)\.

Suppose the policy class is rich enough that behavior atS∗S^\{\*\}can be held fixed while behavior elsewhere onℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\)varies: for anyθ1\\theta\_\{1\}there existsθ2\\theta\_\{2\}withπθ1\(⋅∣x,S∗\)=πθ2\(⋅∣x,S∗\)\\pi\_\{\\theta\_\{1\}\}\(\\cdot\\mid x,S^\{\*\}\)=\\pi\_\{\\theta\_\{2\}\}\(\\cdot\\mid x,S^\{\*\}\)for allxxand arbitrary behavior onℬ⁡\(S∗\)∖\{S∗\}\\mathcal\{B\}\(S^\{\*\}\)\\setminus\\\{S^\{\*\}\\\}\. Then the training objectiveJ⁡\(⋅,S∗\)J\(\\cdot,S^\{\*\}\)is invariant toΦ\\Phi: its maximizers span the full achievable range of fragility, so training provides no signal on it\.

###### Proof\.

Letθ1\\theta\_\{1\}be any maximizer ofJ⁡\(⋅,S∗\)J\(\\cdot,S^\{\*\}\)\. By the richness hypothesis there isθ2\\theta\_\{2\}agreeing withθ1\\theta\_\{1\}atS∗S^\{\*\}for every task, hence withJ⁡\(θ2,S∗\)=J⁡\(θ1,S∗\)J\(\\theta\_\{2\},S^\{\*\}\)=J\(\\theta\_\{1\},S^\{\*\}\), soθ2\\theta\_\{2\}is also a maximizer, while its behavior onℬ⁡\(S∗\)∖\{S∗\}\\mathcal\{B\}\(S^\{\*\}\)\\setminus\\\{S^\{\*\}\\\}is arbitrary and therefore so isminS′⁡J⁡\(θ2,S′\)\\min\_\{S^\{\\prime\}\}J\(\\theta\_\{2\},S^\{\\prime\}\)\. ConsequentlyΦ⁡\(θ2,S∗\)\\Phi\(\\theta\_\{2\},S^\{\*\}\)ranges over the full achievable interval asθ2\\theta\_\{2\}varies within the set of maximizers: the objective does not distinguish them, and its gradient with respect to any parameter affecting only off\-S∗S^\{\*\}behavior vanishes\. ∎

The hypothesis is what makes precise thatJ⁡\(⋅,S∗\)J\(\\cdot,S^\{\*\}\)cannot distinguish a fragile policy from a robust one\. We do not claim both policies are reachable under a shared\-weight parameterization, where behavior atS∗S^\{\*\}and on its neighborhood are coupled; this is why the main text relies on Eq\. \([6](https://arxiv.org/html/2610.20845#S2.E6)\) alone\.

###### Corollary 2\(Hedging in Construction[1](https://arxiv.org/html/2610.20845#Thmconstruction1)\)\.

TakePPto leave the form channel intact with probabilityppand to destroy it \(settingμu→0\\mu\_\{u\}\\to 0\) otherwise, and use the scale invariance of the sign classifier to fixwr=1w\_\{r\}=1\. Withs2=σr2\+wu2​σu2s^\{2\}=\\sigma\_\{r\}^\{2\}\+w\_\{u\}^\{2\}\\sigma\_\{u\}^\{2\}, the marginalized return is

J¯​\(wu\)=p​Φ𝒩​\(μr\+wu​μus\)\+\(1−p\)​Φ𝒩​\(μrs\)\.\\bar\{J\}\(w\_\{u\}\)\\;=\\;p\\,\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\frac\{\\mu\_\{r\}\+w\_\{u\}\\mu\_\{u\}\}\{s\}\\right\)\\;\+\\;\(1\-p\)\\,\\Phi\_\{\\mathcal\{N\}\}\\\!\\left\(\\frac\{\\mu\_\{r\}\}\{s\}\\right\)\.\(19\)Sincedd​wu​μr\+wu​μus=μu​σr2−μr​wu​σu2s3\\frac\{d\}\{dw\_\{u\}\}\\frac\{\\mu\_\{r\}\+w\_\{u\}\\mu\_\{u\}\}\{s\}=\\frac\{\\mu\_\{u\}\\sigma\_\{r\}^\{2\}\-\\mu\_\{r\}w\_\{u\}\\sigma\_\{u\}^\{2\}\}\{s^\{3\}\}anddd​wu​μrs=−μr​wu​σu2s3\\frac\{d\}\{dw\_\{u\}\}\\frac\{\\mu\_\{r\}\}\{s\}=\\frac\{\-\\mu\_\{r\}w\_\{u\}\\sigma\_\{u\}^\{2\}\}\{s^\{3\}\},

s3​J¯′​\(wu\)=p​φ​\(μr\+wu​μus\)​\(μu​σr2−μr​wu​σu2\)−\(1−p\)​φ​\(μrs\)​μr​wu​σu2,s^\{3\}\\,\\bar\{J\}^\{\\prime\}\(w\_\{u\}\)\\;=\\;p\\,\\varphi\\\!\\left\(\\frac\{\\mu\_\{r\}\+w\_\{u\}\\mu\_\{u\}\}\{s\}\\right\)\\big\(\\mu\_\{u\}\\sigma\_\{r\}^\{2\}\-\\mu\_\{r\}w\_\{u\}\\sigma\_\{u\}^\{2\}\\big\)\\;\-\\;\(1\-p\)\\,\\varphi\\\!\\left\(\\frac\{\\mu\_\{r\}\}\{s\}\\right\)\\mu\_\{r\}w\_\{u\}\\sigma\_\{u\}^\{2\},\(20\)whereφ\\varphiis the standard normal density\. Letwu⋆=μu​σr2/\(μr​σu2\)w\_\{u\}^\{\\star\}=\\mu\_\{u\}\\sigma\_\{r\}^\{2\}/\(\\mu\_\{r\}\\sigma\_\{u\}^\{2\}\)be the unhedged optimum, at which the first bracket vanishes andp=1p=1recovers the Fisher rule\. For anyp<1p<1the second term is strictly negative atwu⋆w\_\{u\}^\{\\star\}, soJ¯′​\(wu⋆\)<0\\bar\{J\}^\{\\prime\}\(w\_\{u\}^\{\\star\}\)<0and the maximizer satisfieswu\(p\)<wu⋆w\_\{u\}^\{\(p\)\}<w\_\{u\}^\{\\star\}: the policy underweights the form channel, by an amount that grows with1−p1\-p\. The hedged weight lowersJcleanJ\_\{\\mathrm\{clean\}\}and shrinksΦ\\Phi, so the marginalized objective trades peak return for bounded fragility, in the direction predicted by Eq\. \([6](https://arxiv.org/html/2610.20845#S2.E6)\)\.

### D\.5Adversarial Co\-evolution

We record the sign\-flipped counterpart of Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)referred to in the Scope paragraph of Section[2\.3](https://arxiv.org/html/2610.20845#S2.SS3)\. Replacing the cooperative gate of Eq\. \([2](https://arxiv.org/html/2610.20845#S2.E2)\) by an adversarial one, as in solver–generator and attacker–defender training\([Ke et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib27);[Wen et al\., 2026](https://arxiv.org/html/2610.20845#bib.bib39)\), setsSt∈arg⁡minS∈𝒞t⁡J⁡\(θt,S\)S\_\{t\}\\in\\arg\\min\_\{S\\in\\mathcal\{C\}\_\{t\}\}J\(\\theta\_\{t\},S\)\. ThenJ⁡\(θt,St\)=minS∈𝒞t⁡J⁡\(θt,S\)J\(\\theta\_\{t\},S\_\{t\}\)=\\min\_\{S\\in\\mathcal\{C\}\_\{t\}\}J\(\\theta\_\{t\},S\), so every element ofℛ⁡\(θt,St\)\\mathcal\{R\}\(\\theta\_\{t\},S\_\{t\}\)is non\-negative andΦ⁡\(θt,St\)=0\\Phi\(\\theta\_\{t\},S\_\{t\}\)=0: at the retained bank, no content\-level perturbation can hurt, because the retained bank already is the worst case\. A policy step that subsequently raisesJ⁡\(⋅,St\)J\(\\cdot,S\_\{t\}\)therefore raises the neighborhood minimum rather than the neighborhood maximum\. This is the formal sense in which the sign of the acceptance test, and not the presence of co\-evolution, determines whether training pressure acts on the worst case\.

## Appendix ECODA Protocol Specification

### E\.1Design Principles

Two principles guide the protocol\.*Checkpoint\-free*: CODA uses only the delivered pair plus the shared suite, because step definitions are not comparable across methods, many releases keep only the final checkpoint, and prompt\-based evolution has no notion of a step at all; the fragility curve of Section[3\.2](https://arxiv.org/html/2610.20845#S3.SS2)therefore serves as causal*evidence*in this paper, not a protocol metric\.*Direction\-first*: each metric’s direction is stated before its formula, and any quantity without a defined direction serves as a gate rather than a score, as T5 does\. The metric set is thus closed: diagnostics without a defined direction, such as the surface\-form dependence ratioκ\\kappaof Appendix[H\.5](https://arxiv.org/html/2610.20845#A8.SS5), are excluded from the report card\.

### E\.2Requirements on the Rewriting Suite \(R1–R5\)

Five requirements make the hard rule of Section[4\.1](https://arxiv.org/html/2610.20845#S4.SS1)—that rewriting is performed by the released suite, not by the party under evaluation—workable across methods with incomparable bank formats\. The remaining subsections of this appendix specify each in implementable detail\.

- •R1*Selection masking:*retrieval is run once on the unperturbed bank and only the content of the selected skills is substituted \(Appendix[E\.5](https://arxiv.org/html/2610.20845#A5.SS5)\)\.
- •R2*Field\-classification interface:*a method declares which fields arew retrieval\-side \(frozen\) and which are content \(rewritable\), rather than standardizing a bank format\.
- •R3*Reproducibility:*the rewriting model, its version and its sampling are pinned, and the perturbed banks—not a script—are released \(Appendix[E\.4](https://arxiv.org/html/2610.20845#A5.SS4)\)\.
- •R4*Structural checks, not a semantic verifier:*only declared content fields may change and the bank structure is preserved; meaning\-preservation is left to the released banks for inspection, not to a similarity threshold, and is validated in Appendix[H\.6](https://arxiv.org/html/2610.20845#A8.SS6)\.
- •R5*Strength reporting:*the suite reports the edit distance and similarity it produced, the analog of stating an attack budget\.

### E\.3Perturbation Operators

A skillσ\\sigmais a record of typed fields, partitioned into a*retrieval\-side*partρ⁡\(σ\)\\rho\(\\sigma\)—the fields a method uses to decide when the skill is surfaced, such as its title, trigger conditions, keywords and usage statistics—and a*content*partγ⁡\(σ\)\\gamma\(\\sigma\), the procedural text the policy reads once the skill is in context\. A bank is a finite setS=\{σ1,…,σn\}S=\\\{\\sigma\_\{1\},\\dots,\\sigma\_\{n\}\\\}, and each axis is an operator on banks\.

The content\-level axes T1–T3 keep the set of skills fixed and rewrite only content fields, so their image lies in the neighborhoodℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\)of Definition[1](https://arxiv.org/html/2610.20845#Thmdefinition1)\. Writinggag\_\{a\}for the layered\-prompt rewriter of Appendix[E\.4](https://arxiv.org/html/2610.20845#A5.SS4)applied field\-by\-field to the declared content fields, withρ⁡\(σ\)\\rho\(\\sigma\)copied verbatim:

- •T1 \(semantic\)replacesγ⁡\(σ\)\\gamma\(\\sigma\)by a meaning\-preserving paraphraseg1​\(γ​\(σ\)\)g\_\{1\}\(\\gamma\(\\sigma\)\): the wording changes, the prescribed behavior does not\.
- •T2 \(sufficiency\)replacesγ⁡\(σ\)\\gamma\(\\sigma\)byg2​\(γ​\(σ\)\)g\_\{2\}\(\\gamma\(\\sigma\)\)that stays on topic but no longer suffices, either by deleting a required step or by injecting irrelevant material\.
- •T3 \(misleading\)replacesγ⁡\(σ\)\\gamma\(\\sigma\)byg3​\(γ​\(σ\)\)g\_\{3\}\(\\gamma\(\\sigma\)\)that is well\-formed but prescribes an incorrect strategy\.

The structural axes T4–T5 change which skills are present and therefore lie outsideℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\):

- •T4 \(ecosystem\)applies a sequence of composition edits—insert a new skill, delete an incumbent, or replace a skill by an alternative version—leaving the text of every surviving skill unchanged\.
- •T5 \(autonomy\)removes the bank entirely,T5​\(S\)=∅T\_\{5\}\(S\)=\\varnothing\.

### E\.4Layered Rewriting Prompt

Section[3\.1](https://arxiv.org/html/2610.20845#S3.SS1)states that skill rewrites are produced bygpt\-4o\-2024\-08\-06at temperature0\.70\.7\. This appendix expands the prompt architecture that anchors the rewriter in each benchmark’s semantics\.

#### Why a layered prompt\.

Handing a skill to a general\-purpose model with a single rewriting instruction risks two failure modes: the output may reference actions or objects that do not exist in the environment, and the edit may drift from the intended axis \(e\.g\. a T1 “paraphrase” that silently removes a step, which is T2 territory\)\. A layered prompt prevents both by supplying the domain context the model lacks and restricting the scope of the edit\.

#### Architecture\.

The prompt is assembled from five layers \(Table[3](https://arxiv.org/html/2610.20845#A5.T3)\)\. Layers 1–4 are shared across all content\-level axes and fix everything the rewrite must respect—the environment, the tokens that must survive verbatim, the task category and the skill’s capability tag\. Only the fifth layer carries the axis directive, so one shared skeleton plus one swapped instruction produces every content\-level variant\. The user turn supplies the specific skill field to be rewritten\.

#### Field\-level targeting\.

Each axis declares which fields it may touch and the remainder are copied verbatim\. T1, for instance, rewrites a skill’sprincipleandwhen\_to\_applyand thedescription,whyandhowof a recorded mistake, while titles and identifiers are left unchanged—ensuring that retrieval\-side metadata is never accidentally altered\.

#### T4 and T5\.

The ecosystem \(T4\) and autonomy \(T5\) axes are structural operations on the bank \(adding, removing or replacing skills, or removing the bank entirely\) rather than text rewrites, and do not use this prompt\.

Since the same prompt need not return the same text twice, the banks we evaluated against are released alongside the suite and are the reproducible artifact\.

Table 3:The layered rewriting prompt for the content\-level axes\. Layers 1–4 form a shared skeleton; only the tier instruction \(layer 5\) changes between axes\. The per\-benchmarkdomain\_contextis released with the suite, so an adopter runs the prompt with no manual authoring step\.LayerRoleScope*System prompt*1domain\_contextTask semantics and the executable action space of the benchmark\.shared2domain\_termsProtected list: action and interface tokens preserved verbatim\.shared3category\_hintThe task category the skill belongs to\.shared4skill\_characteristicThe skill’s capability tag, focusing the edit on the right content\.shared5tier instructionThe axis directive: T1 rephrase synonymously; T2 delete steps or inject irrelevant material; T3 substitute an incorrect strategy\.per axis*User turn*field textThe skill field to rewrite \(principle,when\_to\_apply, …\)\.per skill

### E\.5Selection Masking

Masking separates the effect of rewritten content from the effect of changed retrieval\. LetRetθ​\(S,i\)\\mathrm\{Ret\}\_\{\\theta\}\(S;i\)denote the method’s retrieval step: the subset of bankSSit surfaces into context for taskiiunder policyθ\\theta\. For a content\-level axisa∈\{T1,T2,T3\}a\\in\\\{\\text\{T1\},\\text\{T2\},\\text\{T3\}\\\}and each taskii:

1. 1\.Run retrieval once on the unperturbed bank,Seli=Retθ​\(S∗,i\)\\mathrm\{Sel\}\_\{i\}=\\mathrm\{Ret\}\_\{\\theta\}\(S^\{\*\};i\), and record the ids of the selected skills\.
2. 2\.Evaluate the perturbed condition without re\-running retrieval: inject exactly the skills whose ids lie inSeli\\mathrm\{Sel\}\_\{i\}, each with its content fields replaced by the axis\-aarewrite and its retrieval\-side fieldsρ⁡\(σ\)\\rho\(\\sigma\)left untouched\.

Because the surfaced set isSeli\\mathrm\{Sel\}\_\{i\}in both the unperturbed and the perturbed condition, any change in outcome is attributable to the rewritten content rather than to a different set of skills being retrieved, and coverage is identical across methods regardless of bank size\. This constancy of the selection map onℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\)is also what licenses folding selection intoπθ\\pi\_\{\\theta\}in Section[2](https://arxiv.org/html/2610.20845#S2.SS0.SSS0.Px1), so thatJJcan be treated as a function of the bank as a whole\. Masking applies only to T1–T3\. The structural axes T4 and T5 change which skills exist by design, so retrieval is re\-run against the modified bank and the selected set is not held fixed; by Definition[1](https://arxiv.org/html/2610.20845#Thmdefinition1)these axes fall outsideℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\), and the propositions of Section[2](https://arxiv.org/html/2610.20845#S2)make no claim about them\.

### E\.6Field\-Classification Interface

An adopter declares, once per bank format, which fields the suite may rewrite \(*content*\) and which must remain untouched \(*retrieval\-side*\)\. The content fields are the target of T1–T3; the retrieval\-side fields determine which skills are selected and must be frozen so that performance changes can be attributed to content alone \(Section[3\.1](https://arxiv.org/html/2610.20845#S3.SS1)\)\. Two examples from this paper:

The declaration is a one\-line JSON mapping; the suite validates it at run time and refuses to rewrite a field classified as retrieval\-side\.

### E\.7Quality Control and Strength Reporting

Three checks run automatically, and it is worth being exact about what they do and do not establish\.

*Field targeting\.*Each axis declares the fields it may rewrite and the remainder are copied verbatim\. T1, for instance, rewrites a skill’sprincipleandwhen\_to\_applyand thedescription,whyandhowof a recorded mistake, while titles and identifiers are untouched\.

*Length band\.*The tier instruction asks for a rewrite within±30%\\pm 30\\%of the original length; enforcement is looser, rejecting a field only when the ratio of rewritten to original length falls outside\[0\.5,2\.0\]\[0\.5,2\.0\]\. A rejected field is regenerated once, and the second attempt is accepted whatever its length\. Separately, the pipeline retries on transport failures with exponential backoff; those retries are unrelated to quality and are not a check\.

*Structural validation of the misleading axis\.*The T3 banks are verified after generation to contain the same skill identifiers in the same order and the same number, to leave titles andwhen\_to\_applyunchanged, to have modified everyprinciple, and to leave the recorded mistakes alone\. This establishes that the edit landed where it was supposed to land, not that the resulting strategy is wrong\.

No check tests meaning\. There is no embedding\-similarity threshold, no entailment test for T1 and no verification that a T3 variant genuinely prescribes an incorrect strategy; requirement R4 \(Appendix[E\.2](https://arxiv.org/html/2610.20845#A5.SS2)\) gives the reasoning, and the released banks are what a reader inspects instead\.

#### Strength reporting \(R5\)\.

For each released perturbed bank, the suite logs two perturbation\-strength statistics per skill: \(a\) the character\-level edit distance between the original and rewritten text, normalized by the original length, and \(b\) the cosine similarity of sentence embeddings \(all\-MiniLM\-L6\-v2\) between the original and rewritten versions\. These distributions are released alongside the perturbed banks so that adopters can verify the perturbation intensity falls within the intended range for each axis\. The suite additionally records the*prompt\-share statistic*: the fraction of the inference prompt occupied by injected skill text, which contextualizes how much of the input the policy relies on from the bank\.

### E\.8Metric Definitions and Logging Requirements

This appendix carries out the three derivations referenced from Section[4\.2](https://arxiv.org/html/2610.20845#S4.SS2), and states the per\-episode logging requirement without which the paired quantities in that section cannot be computed at all\.

Table 4:The CODA report card: the quantities every method must publish, with the role each plays\. Only the three scored rows enter the verdict of Section[4\.3](https://arxiv.org/html/2610.20845#S4.SS3); the anchors are required because the scores are defined against them\. Definitions are given by the equation referenced in each row\.#### \(a\) WhyCR\\mathrm\{CR\}and not\|Δ​SR\|\|\\Delta\\mathrm\{SR\}\|\.

On the paired binary outcomes\(ci​\(S∗\),ci​\(ST1∗\)\)\(c\_\{i\}\(S^\{\*\}\),c\_\{i\}\(S^\{\*\}\_\{\\text\{T1\}\}\)\)letn10=\|\{i:ci\(S∗\)=1,ci\(ST1∗\)=0\}\|n\_\{10\}=\|\\\{i:c\_\{i\}\(S^\{\*\}\)=1,c\_\{i\}\(S^\{\*\}\_\{\\text\{T1\}\}\)=0\\\}\|andn01=\|\{i:ci\(S∗\)=0,ci\(ST1∗\)=1\}\|n\_\{01\}=\|\\\{i:c\_\{i\}\(S^\{\*\}\)=0,c\_\{i\}\(S^\{\*\}\_\{\\text\{T1\}\}\)=1\\\}\|be the counts of the two directions of change\. The consistency rate counts the tasks that do*not*flip,CR=1−\(n10\+n01\)/N\\mathrm\{CR\}=1\-\(n\_\{10\}\+n\_\{01\}\)/N, and

\|Δ​SR\|=\|n10−n01\|N≤n10\+n01N=1−CR,\|\\Delta\\mathrm\{SR\}\|\\;=\\;\\frac\{\|n\_\{10\}\-n\_\{01\}\|\}\{N\}\\;\\leq\\;\\frac\{n\_\{10\}\+n\_\{01\}\}\{N\}\\;=\\;1\-\\mathrm\{CR\},\(21\)with equality only when every flip runs the same way\. Score invariance is therefore strictly weaker than the behavioral invariance we are after: three tasks turning wrong and three turning right leaveΔ​SR=0\\Delta\\mathrm\{SR\}=0while six behaviors have changed, and a method can achieve small\|Δ​SR\|\|\\Delta\\mathrm\{SR\}\|by accident\. This is why the semantic\-consistency metric is stated onCR\\mathrm\{CR\}\.

#### \(b\)SRmin\\mathrm\{SR\}\_\{\\min\}as a lower bound onΦ\\Phi\.

Definition[2](https://arxiv.org/html/2610.20845#Thmdefinition2)setsΦ⁡\(θ∗,S∗\)=maxS′∈ℬ⁡\(S∗\)⁡\(SR⁡\(S∗\)−SR⁡\(S′\)\)\\Phi\(\\theta^\{\*\},S^\{\*\}\)=\\max\_\{S^\{\\prime\}\\in\\mathcal\{B\}\(S^\{\*\}\)\}\\big\(\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\(S^\{\\prime\}\)\\big\), the largest drop over the full content\-level neighborhood\. The protocol only measures the three axes T1–T3, so the maximum it can attain isSR⁡\(S∗\)−SRmin\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\_\{\\min\}, taken over the three sampled banksSa∗S^\{\*\}\_\{a\}\. Since these are elements ofℬ⁡\(S∗\)\\mathcal\{B\}\(S^\{\*\}\),

SR⁡\(S∗\)−SRmin≤Φ⁡\(θ∗,S∗\);\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\_\{\\min\}\\;\\leq\\;\\Phi\(\\theta^\{\*\},S^\{\*\}\);the gap we report is thus a lower bound on the true fragility, not the exact worst case over the full neighborhood\.

#### Why T4 and T5 are reported but not scored\.

T5 \(autonomy\) has no defined direction: removing the bank may hurt because it held knowledge the policy could not internalize, or because it held strategies the policy should have absorbed, and the number alone cannot tell these apart; the no\-skill condition therefore serves as the anchor for the gate and the resistance criterion rather than as a score\. T4 \(ecosystem\) is not the same operator across methods—bank sizes differ by an order of magnitude, from tens or hundreds of skills to a cap of eight—so it is reported \(Section[3](https://arxiv.org/html/2610.20845#S3), Appendix[H](https://arxiv.org/html/2610.20845#A8)\) but excluded from the score, regardless of whether its effect is larger or smaller than the content\-level axes in a given setting\.

#### Consistency and its noise floor\.

The consistency criterion testsCR\\mathrm\{CR\}against a two\-standard\-deviation band aroundCR0\\mathrm\{CR\}\_\{0\}, the agreement between two unperturbed runs, which fixes the repeat\-level noise floor\. Rather than tabulate the per\-setting standard deviations, we read the outcome from the flip rates directly:CR0\\mathrm\{CR\}\_\{0\}corresponds to a66–8%8\\%flip rate between two unperturbed evaluations—the churn attributable to decoding randomness alone—whereas the T1 rewrite flips1313–23%23\\%of task outcomes, two to three times that floor\. This gap exceeds repeat\-level evaluation noise in every setting, soCR\\mathrm\{CR\}sits below the band and the consistency criterion fails throughout\. The per\-episode logs needed to recomputeCR\\mathrm\{CR\}andCR0\\mathrm\{CR\}\_\{0\}are released with the suite\.

#### Logging requirements\.

The identities above and McNemar’s test on Eq\. \([12](https://arxiv.org/html/2610.20845#S4.E12)\) all read paired binary outcomes at the level of individual tasks\. An adopter therefore must log, for every evaluation condition \(unperturbed, T1, T2, T3, and∅\\varnothing\) and every repeat, the per\-episode indicatorci∈\{0,1\}c\_\{i\}\\in\\\{0,1\\\}together with the task identifierii\. Two consequences follow:

- •*Common task set\.*The no\-skill condition, the unperturbed condition, and each axis\-aacondition must be evaluated on the sameNNtask identifiers\. Aggregating a success rate on a slightly different task subset breaksRRa\\mathrm\{RR\}\_\{a\}and the McNemar statistic, since the pairing no longer holds task\-by\-task\.
- •*Aggregated scores are not sufficient\.*A report card that publishes onlySR\\mathrm\{SR\}per condition, without per\-episode outcomes, is not auditable: neitherCR\\mathrm\{CR\},RRa\\mathrm\{RR\}\_\{a\}nor the McNemarppcan be recomputed from it\.

The suite therefore requires per\-episode logs alongside the aggregated report card, and its reference implementation writes them out by default\.

### E\.9Auditing Each Method on Its Own Bank

Section[4\.3](https://arxiv.org/html/2610.20845#S4.SS3)states that CODA audits each method on the bank it delivered rather than on a shared bank, and gives a one\-paragraph summary of why\. The complete argument runs to four points\.

*First, the unit of evaluation is the artifact the method delivers\.*The bank is not an external test condition supplied by us; it is half of what the method produced\. Auditing method A on A’s bank measures exactly what A would deploy, whereas forcing every method onto a shared bank measures a configuration nobody ships\. A shared\-bank protocol would therefore answer a different question: how well does each method run on a piece of text it did not choose\. That is a reasonable question, but it is not a robustness question about the delivered system\.

*Second, what a robustness protocol standardizes is the operator and the budget, not the perturbation\.*Projected gradient descent produces a different adversarial example for every model because it uses that model’s gradients, and no one calls the comparison unfair: what is fixed is the attack—its algorithm and its budget—not the resulting pixel\. CODA is isomorphic\. The rewriting instructions, the rewriting model, and the coverage—the set of skills actually retrieved for each task—are all fixed; the resulting text differs because the banks differ\. The obligation this introduces is stated as R5: the strength actually applied to each method must be reported, so that unequal severity is visible rather than deniable\.

*Third, the obvious way to game the protocol does not work\.*A method could try to survive rewriting by shipping a bank so vague that corrupting it changes nothing\. But a bank vague enough to be uncorruptable is almost always vague enough to be useless, and that shows up immediately in the gate of Eq\. \([9](https://arxiv.org/html/2610.20845#S4.E9)\): a method that clears the gate has published a bank with real content, and one that fails the gate does not qualify\. The two requirements pull against each other—benefit demands that the bank carry real content, robustness demands that the policy not depend on its exact wording—and a method must satisfy both with a single artifact\.

*Fourth, deployment fidelity points the same way\.*There is no shared bank in the real world: each deployment owns a library that changes on its own schedule, for reasons internal to that deployment\. Perturbing each method’s own bank is the faithful simulation of that situation\. A shared bank would be the distortion, not the fair comparison, because it evaluates every method under a configuration none of them would have deployed\.

## Appendix FPerturbation Examples

Tables[5](https://arxiv.org/html/2610.20845#A6.T5)–[7](https://arxiv.org/html/2610.20845#A6.T7)give one representative original/rewritten pair per content\-level axis for eachSkillRL/ReSkillsetting, exported directly from the banks used in evaluation without manual editing, so that a reader can judge whether the rewrites are fair\. To make each edit visible at a glance, rewritten or inserted text is marked inred boldand text that the operatorremovedis struck through\. T4 \(ecosystem\) changes the*composition*of the bank—skills are added or removed wholesale, with no one\-to\-one text correspondence—and T5 \(autonomy\) removes the bank entirely, so neither has a before/after text pair to show\.

Table 5:T1 \(semantic\): synonymous rewriting\. Wording changes; the prescribed behavior does not\.Table 6:T2 \(sufficiency\): a skill stays on topic but no longer suffices, either because a step is deleted \(struck through in the original\) or because irrelevant material is injected \(marked in the rewrite\)\.Table 7:T3 \(misleading\): the strategy a skill prescribes is replaced by an incorrect one\. Shown at the stronger of the two strengths, which is the setting reported as T3 in the main text for WebShop and ScienceWorld\.
## Appendix GExperimental Configuration

This appendix expands the setup summarized in Section[3\.3](https://arxiv.org/html/2610.20845#S3.SS3)\.

#### Method and benchmark diversity\.

The four methods spread across Table[1](https://arxiv.org/html/2610.20845#S2.T1)rather than clustering in one corner of it: they differ in the update schedule, the bank growth policy, the admission rule and the injection mechanism, sharing only the current\-policy selection bias abstracted by Assumption[1](https://arxiv.org/html/2610.20845#Thmassumption1)\. The benchmarks are equally spread, spanning embodied interaction \(ALFWorld\), shopping \(WebShop\), scientific procedures \(ScienceWorld\), open\-web navigation \(Mind2Web\) and competition mathematics \(AMC23\); the last also tests whether the pattern extends from action procedures to non\-interactive reasoning strategies, so the trend is not an artifact of sequential control\.

#### Backbones\.

Each method is run on the base model used in its experimental configuration: Qwen2\.5\-7B\-Instruct forSkillRLandEvolving\-RL, and Qwen3\-4B\-Instruct\-2507 forReSkillandARISE\. Because the backbones differ, an absolute success rate characterizes a method together with its backbone rather than the method in isolation\.

#### Evaluation sets\.

Evaluation uses the standard split of each benchmark—140 tasks on ALFWorld, 500 on WebShop, 155 validation points on ScienceWorld, and the standard evaluation splits of Mind2Web and DeepScaleR\-AMC23—held fixed across every perturbation axis and every anchor, so the conditions being compared are paired at the level of individual tasks\. The released configuration records the exact identifiers and sample counts for all six settings\. Checkpoints are saved at a regular interval along each training trajectory; the exact anchor steps are shown in the corresponding fragility curves and verified full\-results tables\.

#### Repeats and error bars\.

Every anchor is evaluated repeatedly under six conditions—unperturbed and T1–T5—and reported with mean±1\\pm 1s\.d\. TheSkillRLandReSkillsettings use three repeats, andReSkill\-ScienceWorld uses five; repeat counts forEvolving\-RLandARISEare recorded in the released configuration\. Repeats share the policy checkpoint and the same fixed set of perturbed banks and differ only in the rollout sampling seed\. The delivered\-pair report cards use the paired runs required to computeCR\\mathrm\{CR\},CR0\\mathrm\{CR\}\_\{0\}andRR\\mathrm\{RR\}\. Each setting comes from a single co\-evolution run, so the bands quantify evaluation noise, not variability across training seeds\.

#### Misleading\-axis strength\.

For the fourSkillRL/ReSkillsettings, the misleading axis \(T3\) is applied at one strength per setting: the milder variant on the two ALFWorld settings and the stronger variant on WebShop and ScienceWorld\. Both strengths were run in each of these four settings, and the one not reported in the main text is included in the full\-results tables below\.

## Appendix HFull Results of the Co\-evolution Fragility Curves

### H\.1Per\-Method, Per\-Environment, Per\-Axis Tables

Tables[8](https://arxiv.org/html/2610.20845#A8.T8)–[13](https://arxiv.org/html/2610.20845#A8.T13)give the raw success rates behind all six settings in Section[3](https://arxiv.org/html/2610.20845#S3): one row per anchor and one column per condition\. Every table reports the mean±1\\pm 1s\.d\. over repeated evaluations\. The perturbed banks are fixed across anchors, so reading down a column shows what a single fixed corruption costs a progressively more co\-evolved policy\. Small endpoint differences between the report card and these grids reflect repeat\-level evaluation variation\. All headline audit quantities use the report\-card values\.

Across the eighteen content\-level axis–setting pairs, twelve OLS slopes ofDrop\\mathrm\{Drop\}are significantly positive—four on each of T1, T2 and T3\. At least one axis is significant in five of six settings;SkillRL\-WebShop is the sole exception\. For T3 specifically, the slope is significant onSkillRL\-ALFWorld \(p<10−6p<10^\{\-6\}\),ReSkill\-ScienceWorld \(p=0\.021p=0\.021\),ReSkill\-ALFWorld \(p=0\.001p=0\.001\) andEvolving\-RL\-Mind2Web \(p=0\.041p=0\.041\), but not onSkillRL\-WebShop \(p=0\.351p=0\.351\) orARISE\-AMC23 \(p=0\.175p=0\.175\)\.

Table 8:Full success\-rate grid forSkillRLon ALFWorld: every anchor on the rising segment, under the unperturbed bank and all five perturbation axes\. Cells report mean±\\pm1 s\.d\. over 3 evaluation repeats \(%\)\. The perturbed variants are fixed across anchors; only the policy checkpoint varies\.Table 9:Full success\-rate grid forSkillRLon WebShop: every anchor on the rising segment, under the unperturbed bank and all five perturbation axes\. Cells report mean±\\pm1 s\.d\. over 3 evaluation repeats \(%\)\. The perturbed variants are fixed across anchors; only the policy checkpoint varies\.Table 10:Full success\-rate grid forReSkillon ScienceWorld: every anchor on the rising segment, under the unperturbed bank and all five perturbation axes\. Cells report mean±\\pm1 s\.d\. over 5 evaluation repeats \(%\)\. The perturbed variants are fixed across anchors; only the policy checkpoint varies\.Table 11:Full success\-rate grid forReSkillon ALFWorld: every anchor on the rising segment, under the unperturbed bank and all five perturbation axes\. Cells report mean±\\pm1 s\.d\. over 3 evaluation repeats \(%\)\. The perturbed variants are fixed across anchors; only the policy checkpoint varies\.Table 12:Full action\-success grid forEvolving\-RLon Mind2Web: every anchor on the rising segment, under the unperturbed 200\-skill bank and all five perturbation axes\. Cells report mean±\\pm1 s\.d\. over evaluation repeats\. The perturbed variants are fixed across anchors; only the policy checkpoint varies\. T5 is the no\-skill arm\.Table 13:Full success\-rate grid forARISEon AMC23: every anchor on the analyzed segment, under the unperturbed 110\-skill bank \(step 2000\) and all five perturbation axes\. Cells report mean±\\pm1 s\.d\. over evaluation repeats\. The perturbed variants are fixed across anchors; only the policy checkpoint varies\. T5 is the no\-skill arm\.#### Dips inside the analyzed segment\.

Section[3\.2](https://arxiv.org/html/2610.20845#S3.SS2)retains every anchor up to the peak, dips included; this is where they are named\. Rating each dip by\|Δ​SR\|\|\\Delta\\mathrm\{SR\}\|against the pooled standard deviation of the two anchors it joins,SkillRL\-ALFWorld contributes three \(s0→\\tos5,−3\.1\-3\.1points,2\.1​σ2\.1\\sigma;s20→\\tos25,−8\.1\-8\.1,3\.0​σ3\.0\\sigma;s40→\\tos45,−9\.7\-9\.7,4\.4​σ4\.4\\sigma\),ReSkill\-ScienceWorld one \(s180→\\tos240,−12\.6\-12\.6,8\.1​σ8\.1\\sigma\),ReSkill\-ALFWorld two \(s180→\\tos210,−21\.0\-21\.0,13\.7​σ13\.7\\sigma; ands210→\\tos240,−13\.1\-13\.1,17\.2​σ17\.2\\sigma, after which the run recovers and sets its highest score at the final anchor\),SkillRL\-WebShop one that is indistinguishable from evaluation noise \(s40→\\tos50,−1\.1\-1\.1,0\.6​σ0\.6\\sigma\), andEvolving\-RL\-Mind2Web two equally small reversals \(s9→\\tos14,−0\.1\-0\.1,0\.1​σ0\.1\\sigma;s19→\\tos24,−0\.3\-0\.3,0\.2​σ0\.2\\sigma\)\.ARISE\-AMC23 is monotone at the saved anchors\. We retain every dip: the dose is the amount of co\-evolution a run has undergone, and a run that briefly loses ground has still undergone it\. No run in the six settings peaks and then stays down, so the clause of Section[3\.2](https://arxiv.org/html/2610.20845#S3.SS2)that discards post\-peak checkpoints never has to be applied\. Throughout, a standard deviation is the sample standard deviation over the individual evaluation repeats\.

#### The same grids as heatmaps\.

Figures[5](https://arxiv.org/html/2610.20845#A8.F5)–[10](https://arxiv.org/html/2610.20845#A8.F10)display the derived quantities of Eqs\. \([7](https://arxiv.org/html/2610.20845#S3.E7)\)–\([8](https://arxiv.org/html/2610.20845#S3.E8)\) over the full anchor range\. Each figure has aDrop\\mathrm\{Drop\}panel and anRP\\mathrm\{RP\}panel; the color scales are clipped so that the degradation regime remains legible, because the earliest anchors reach values an order of magnitude larger than the rest and would otherwise flatten the whole map into a single shade\. Every cell is derived from the per\-anchor means in the corresponding full\-grid table, and AVG is the mean over the three scored content\-level axes \(T1–T3\)\. The transition from blue on the left to white and red on the right is the dependence forming: perturbations that help a policy which has not yet co\-evolved to the bank stop helping, and then start hurting\.

![Refer to caption](https://arxiv.org/html/2610.20845v1/appendix_heat_skillrl_alfworld.png)Figure 5:Perturbation response across all checkpoints,SkillRLon ALFWorld\. Top:Drop\\mathrm\{Drop\}in percentage points\. Bottom: retention performanceRP\\mathrm\{RP\}\. Color scales clipped; cell values exact\.![Refer to caption](https://arxiv.org/html/2610.20845v1/appendix_heat_skillrl_webshop.png)Figure 6:Perturbation response across all checkpoints,SkillRLon WebShop\. Panels and conventions as in Figure[5](https://arxiv.org/html/2610.20845#A8.F5)\.![Refer to caption](https://arxiv.org/html/2610.20845v1/appendix_heat_reskill_scienceworld.png)Figure 7:Perturbation response across all checkpoints,ReSkillon ScienceWorld\. Panels and conventions as in Figure[5](https://arxiv.org/html/2610.20845#A8.F5)\.![Refer to caption](https://arxiv.org/html/2610.20845v1/appendix_heat_reskill_alfworld.png)Figure 8:Perturbation response across all checkpoints,ReSkillon ALFWorld\. Panels and conventions as in Figure[5](https://arxiv.org/html/2610.20845#A8.F5)\.![Refer to caption](https://arxiv.org/html/2610.20845v1/appendix_heat_evolvingrl_mind2web.png)Figure 9:Perturbation response across all checkpoints,Evolving\-RLon Mind2Web\. Panels and conventions as in Figure[5](https://arxiv.org/html/2610.20845#A8.F5); cell values are derived from the per\-anchor means in Table[12](https://arxiv.org/html/2610.20845#A8.T12)\.![Refer to caption](https://arxiv.org/html/2610.20845v1/appendix_heat_arise_amc23.png)Figure 10:Perturbation response across all checkpoints,ARISEon AMC23\. Panels and conventions as in Figure[5](https://arxiv.org/html/2610.20845#A8.F5); cell values are derived from the per\-anchor means in Table[13](https://arxiv.org/html/2610.20845#A8.T13)\.

### H\.2Co\-evolution Fragility Curves, All Six Settings

Figure[4](https://arxiv.org/html/2610.20845#S3.F4)in the main text reportsReSkillon ALFWorld\. The other five settings follow in the same layout:SkillRLon WebShop \(Figure[11](https://arxiv.org/html/2610.20845#A8.F11)\) and ALFWorld \(Figure[12](https://arxiv.org/html/2610.20845#A8.F12)\),ReSkillon ScienceWorld \(Figure[13](https://arxiv.org/html/2610.20845#A8.F13)\),Evolving\-RLon Mind2Web \(Figure[14](https://arxiv.org/html/2610.20845#A8.F14)\) andARISEon AMC23 \(Figure[15](https://arxiv.org/html/2610.20845#A8.F15)\)\.

![Refer to caption](https://arxiv.org/html/2610.20845v1/Skillrl_webshop.png)Figure 11:Co\-evolution fragility curve forSkillRLon WebShop; same layout as Figure[4](https://arxiv.org/html/2610.20845#S3.F4)\. This is the sole setting in which no content\-level drop slope reaches significance\.![Refer to caption](https://arxiv.org/html/2610.20845v1/Skillrl_alfworld.png)Figure 12:Co\-evolution fragility curve forSkillRLon ALFWorld; same layout as Figure[11](https://arxiv.org/html/2610.20845#A8.F11)\. This setting has the widest competence range of the six, from5\.2%5\.2\\%to88\.8%88\.8\\%over sixteen anchors, so the transition is easiest to read here\. Negative drops andRP\>1\\mathrm\{RP\}\>1at the earliest anchors mean the perturbation*improved*performance, which is admissible for a policy that has not yet co\-evolved to the bank \(Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1), third clause\) rather than a violation of the one\-sided prediction\. Error bars span±1\\pm 1s\.d\. over three evaluation repeats that share the policy checkpoint and the same fixed set of rewritten banks and differ only in the rollout sampling seed \(temperature 0\.4\); because each setting comes from a single co\-evolution run, these bands quantify evaluation noise and say nothing about variability across training seeds\.![Refer to caption](https://arxiv.org/html/2610.20845v1/Reskill_scienceworld.png)Figure 13:Co\-evolution fragility curve forReSkillon ScienceWorld; same layout as Figure[4](https://arxiv.org/html/2610.20845#S3.F4)\. Error bars span five evaluation repeats, and this setting has the fewest anchors of the six \(five\), yielding the widest slope intervals\.![Refer to caption](https://arxiv.org/html/2610.20845v1/evolvingrl_mind2web.png)Figure 14:Co\-evolution fragility curve forEvolving\-RLon Mind2Web; same layout as Figure[4](https://arxiv.org/html/2610.20845#S3.F4)\.![Refer to caption](https://arxiv.org/html/2610.20845v1/arise_amc23.png)Figure 15:Co\-evolution fragility curve forARISEon AMC23; same layout as Figure[4](https://arxiv.org/html/2610.20845#S3.F4)\.
### H\.3Drop and Retention Are One Measurement on Two Scales

The two quantities plotted in every dose figure are algebraically linked\. Substituting the definition ofDropa\\mathrm\{Drop\}\_\{a\}into that ofRPa\\mathrm\{RP\}\_\{a\},

RPa​\(t\)=SR⁡\(Sa∗\)SR⁡\(S∗\)=SR⁡\(S∗\)−Dropa​\(t\)SR⁡\(S∗\)=1−Dropa​\(t\)SR⁡\(S∗\),\\mathrm\{RP\}\_\{a\}\(t\)\\;=\\;\\frac\{\\mathrm\{SR\}\(S^\{\*\}\_\{a\}\)\}\{\\mathrm\{SR\}\(S^\{\*\}\)\}\\;=\\;\\frac\{\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{Drop\}\_\{a\}\(t\)\}\{\\mathrm\{SR\}\(S^\{\*\}\)\}\\;=\\;1\-\\frac\{\\mathrm\{Drop\}\_\{a\}\(t\)\}\{\\mathrm\{SR\}\(S^\{\*\}\)\},\(22\)so retention is an affine transform of the drop: a flip about the horizontal axis, rescaled by1/SR⁡\(S∗\)1/\\mathrm\{SR\}\(S^\{\*\}\)\. Whenever the unperturbed rate is close to constant across anchors, the retention row is therefore an almost exact mirror image of the drop row, and the sole source of divergence between the two is variation inSR⁡\(S∗\)\\mathrm\{SR\}\(S^\{\*\}\)itself\.

#### A sign reversal along training\.

OnSkillRL\-ALFWorld,RPT3=2\.33\\mathrm\{RP\}\_\{\\text\{T3\}\}=2\.33ats0and3\.383\.38ats5: a misleading bank more than doubles the score of a policy that has not yet co\-evolved with it\. Bys90,RPT3\\mathrm\{RP\}\_\{\\text\{T3\}\}falls to0\.860\.86, while T5 moves from4\.174\.17to0\.820\.82\. The same bank that initially obstructs the policy thus becomes a source of competence and, eventually, dependence\.

Across the six repeatedly evaluated settings, Figure[13](https://arxiv.org/html/2610.20845#A8.F13)spans a relatively narrow competence range \(28\.5%28\.5\\%to50\.3%50\.3\\%\), so its drop and retention rows mirror each other almost perfectly\. Figure[12](https://arxiv.org/html/2610.20845#A8.F12)spans5\.2%5\.2\\%to88\.8%88\.8\\%; there the small early denominators stretch retention onto a different scale altogether—T5 exceedsRP=7\\mathrm\{RP\}=7at the base anchor—and the two rows take visibly different shapes\.

We report both regardless, for opposite reasons: the absolute drop is what a deployment actually loses, while retention is the only one of the two that remains comparable across checkpoints—or across settings—whose ability differs by an order of magnitude\. At a fixed anchor neither carries information the other lacks; what retention adds is comparability along the dose axis\.

### H\.4Dependence Mediates Fragility

The dose curves plot fragility against the co\-evolution step, but the step is only a proxy: what should actually govern how much a fixed corruption costs is how much the policy has come to*rely*on the bank\. Figure[16](https://arxiv.org/html/2610.20845#A8.F16)tests this directly\. For every checkpoint we place one point at\(x,y\)\(x,y\)withxxthe dependence—the drop inSR\\mathrm\{SR\}when the bank is removed entirely \(the no\-skill / autonomy contrast\)—andyythe fragility—the meanDrop\\mathrm\{Drop\}over the five corruption tiers\. Reading fragility against measured dependence removes the proxy, which matters because onSkillRL\-WebShop the proxy fails outright: dependence there is not monotone in the step \(it reverses across ans80–s110valley\), so dependence and step are essentially uncorrelated, yet the dependence–fragility relation still holds\.

The two quantities lie on a single increasing line\. Pooling the3232checkpoints across both settings gives Spearmanρ=\+0\.82\\rho=\+0\.82\(95%95\\%CI\[\+0\.68,\+0\.89\]\[\+0\.68,\+0\.89\],p=7\.4×10−9p=7\.4\\times 10^\{\-9\}\) and an ordinary\-least\-squares slope of\+0\.20\+0\.20pp of fragility per pp of dependence \(95%95\\%bootstrap CI\[\+0\.15,\+0\.28\]\[\+0\.15,\+0\.28\], excluding zero\); each setting is individually significant \(SkillRL\-ALFWorldρ=\+0\.78\\rho=\+0\.78,p=1\.5×10−4p=1\.5\\times 10^\{\-4\},n=18n=18;SkillRL\-WebShopρ=\+0\.79\\rho=\+0\.79,p=7\.9×10−4p=7\.9\\times 10^\{\-4\},n=14n=14\)\. The relation is not carried by a few extreme points: the shaded band is a40004000\-sample bootstrap over anchors and stays narrow throughout\. Crucially the line passes through the third quadrant\. At the earliest checkpoints dependence is negative—removing the bank*raises*SR\\mathrm\{SR\}, because the policy has not yet co\-evolved to it—and there fragility is negative too: corrupting a bank the policy does not rely on*helps*\. The same axis that predicts vulnerability at high dependence predicts a benefit at negative dependence, which is exactly the sign structure of Proposition[1](https://arxiv.org/html/2610.20845#Thmproposition1)\. Dependence, not elapsed training, is what fragility tracks; the dose effect of Section[3\.2](https://arxiv.org/html/2610.20845#S3.SS2)is the composition of two links, training builds dependence and dependence creates fragility\.

Figure 16:Fragility scales with acquired dependence\. Each point is one co\-evolution checkpoint \(SkillRL\-ALFWorld, circles;SkillRL\-WebShop, squares\); error bars are±1\\pm 1s\.d\. of the same contrast over the three evaluation repeats\.xx: dependence, theSR\\mathrm\{SR\}drop when the skill bank is removed\.yy: fragility, the meanSR\\mathrm\{SR\}drop over the five corruption tiers\. Solid lines are per\-setting fits; the dashed line and grey band are the pooled fit with its95%95\\%bootstrap envelope over anchors\. Points left ofx=0x=0are checkpoints that have not yet co\-evolved to the bank, where removing or corrupting skills improves performance\.
### H\.5Surface\-Form Dependence and Prompt Share

#### How much of the drop is about wording?

Comparing the two ends of the axis ordering gives a cheap diagnostic of surface\-form dependence,

κ=SR⁡\(S∗\)−SR⁡\(ST1∗\)SR⁡\(S∗\)−SR⁡\(ST3∗\),\\kappa\\;=\\;\\frac\{\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\(S^\{\*\}\_\{\\text\{T1\}\}\)\}\{\\mathrm\{SR\}\(S^\{\*\}\)\-\\mathrm\{SR\}\(S^\{\*\}\_\{\\text\{T3\}\}\)\},\(23\)the damage done by rewriting the words relative to the damage done by rewriting the strategy\. A policy that reads a skill for its meaning should haveκ\\kappanear zero, since a synonymous rewrite costs it nothing while a wrong strategy costs it a great deal; a policy using the bank as a look\-up table hasκ\\kappanear one or above\. Measured values areκ=0\.78\\kappa=0\.78onSkillRL\-ALFWorld and2\.142\.14onReSkill\-ScienceWorld; the latter exceeds one, meaning a meaning\-preserving change hurts more than a wrong strategy does\. On the other twoSkillRL/ReSkillsettings, the T3 axis does not lower the success rate below the peak, soκ\\kappais undefined \(negative denominator\)\. We reportκ\\kappaas a diagnostic and deliberately keep it out of Table[4](https://arxiv.org/html/2610.20845#A5.T4): the metric set is closed, and a ratio of two differences is too unstable near a small denominator to carry a pass line\.

#### An observation, not a prediction\.

Injected skill text occupies an estimated 15% to 40% of the prompt across the fourSkillRL/ReSkillsettings included in this diagnostic, and those with the larger share are*not*systematically the ones with the higher worst\-case rates\. We record this because it is the first thing a reader will ask about and the measurement is nearly free, but it forms no part of the theory of Section[2](https://arxiv.org/html/2610.20845#S2)and we make no claim of a relationship\.

### H\.6T1 Meaning\-Preservation Quality Assurance

The T1 axis is defined as a meaning\-preserving rewrite: the skill’s wording changes but its procedural content should not\. Because the rewriting suite uses a language model rather than a deterministic operator, we verify this property with an independent, blinded audit whose design specifically defends against the two failure modes a reviewer would flag: the judge being biased toward the rewriter \(*self\-endorsement*\) and the judge being insensitive \(a*rubber\-stamp*\)\.

#### Protocol\.

We audit*all*190 T1 rewrites in the fourSkillRL/ReSkillsettings \(91 onSkillRL\-ALFWorld, 84 onSkillRL\-WebShop, 7 onReSkill\-ScienceWorld, 8 onReSkill\-ALFWorld\), so there is no sampling\. Every pair is scored on a four\-level rubric—*equivalent*,*minor drift*,*meaning altered*,*reversed/unrelated*—by two independent judges from different providers:qwen3\-max\(Alibaba\) as the primary judge, cross\-family with the rewriter \(GPT\-4o\), andgpt\-4o\-2024\-08\-06\(OpenAI\) as the secondary judge\. The audit is blinded: pair order is shuffled, the original is randomly placed on the A or B side, and axis labels are kept only in an answer key\. A human annotator re\-checks 50% of the T1 pairs under the same blind protocol\.

#### Judge validity: positive and negative controls\.

To confirm that the judges are neither over\-eager nor over\-lenient, the same blinded batch includes 20 identity pairs \(a skill against itself\) and 40 negative controls \(a skill against its T2 or T3 rewrite, which by construction alter the prescribed action\)\. Both judges rate all 20/20 identity pairs*equivalent*and all 40/40 negative controls as non\-equivalent \(mean rating≤0\.36\\leq 0\.36vs\.1\.001\.00on identity\), so they are not rubber stamps and not oversensitive\.

#### Results\.

Under this test both judges rate*100%*of the 190 T1 pairs as meaning\-equivalent \(0/1900/190altered; 95% Wilson CI\[0\.0%,1\.9%\]\[0\.0\\%,1\.9\\%\]\), with perfect binary agreement between judges \(Cohen’sκ=1\.0\\kappa=1\.0\) and a four\-level agreement of 95\.8% \(all disagreements fall within the negative controls, over the*degree*of alteration, never over its direction\)\. The human re\-check on 95 of the 190 T1 pairs \(50%\) concurs, with no meaning changes found\. In these four settings, T1 rewrites therefore preserve meaning, and the corresponding consistency drop in Section[4\.4](https://arxiv.org/html/2610.20845#S4.SS4)measures sensitivity to wording rather than rewrite noise\.

#### Skill\-bank statistics\.

Table[14](https://arxiv.org/html/2610.20845#A8.T14)summarizes the scale and growth mechanism of the skill banks for the fourSkillRL/ReSkillsettings\.SkillRLstarts from a fixed set of human\-authored seed skills and accumulates new skills during training \(monotone growth\);ReSkillbuilds from scratch under a fixed library cap\.

Table 14:Skill\-bank configuration and size for the fourSkillRL/ReSkillsettings\.

### H\.7The Cost in Standalone Ability

If co\-evolution builds dependence, the natural question is what that dependence is bought with\. Figure[17](https://arxiv.org/html/2610.20845#A8.F17)trains a pure\-RL policy onSkillRL\-ALFWorld with the skill mechanism disabled throughout \(arm A, no bank at any step\) and reads it against the co\-evolved delivered checkpoint of the same setting, both with the bank present \(84\.1%84\.1\\%,n=5n=5\) and with it removed \(57\.6%57\.6\\%,n=5n=5; step\-115115bank, evaluated on theeval\_in\_distributionsplit at temperature0\.40\.4\)\. Two things stand out\. First, the co\-evolved policy stripped of its bank scores57\.6%57\.6\\%, whereas a policy that never trained with skills reaches a last\-five\-checkpoint mean of70\.6%70\.6\\%and a peak of87\.5%87\.5\\%: co\-evolution does not merely add a removable crutch, it leaves the underlying policy*worse at acting alone*than one that was never given the crutch\. The dependence measured in Appendix[H\.4](https://arxiv.org/html/2610.20845#A8.SS4)is therefore not free—it is standalone ability traded away\. Second, the pure\-RL run is itself unstable: it peaks at87\.5%87\.5\\%near step125125and then falls to53\.1%53\.1\\%by step150150, with entropy and KL rising together over the same window \(panels B, C\)\. Neither training regime yields a monotone capability curve; the distinctive cost of co\-evolution is the additional erosion of the skill\-free policy\.

The comparison is between two evaluations that share theeval\_in\_distributionsplit and the temperature\-0\.40\.4sampling but differ in sample count \(the training\-time validation draws6464tasks, the CODA reference140140\) and in the ALFWorld backend \(textualAlfredTWEnvduring training versus the simulator\-backedAlfredThorEnvat evaluation\); the reference lines should be read as the level of the co\-evolved policy on the shared split, not as a point comparison to two decimal places\. We report this as a supporting observation rather than a headline result\.

Figure 17:Pure\-RL baseline \(arm A, skills disabled\) onSkillRL\-ALFWorld\. \(A\) ValidationSR\\mathrm\{SR\}over training, against the co\-evolved delivered checkpoint with the bank present \(red,84\.1%84\.1\\%\) and removed \(orange,57\.6%57\.6\\%\); the co\-evolved policy with its bank removed sits below even the pure\-RL last\-five mean \(purple dotted,70\.6%70\.6\\%\)\. \(B\) Entropy and KL rise together in the second half, the signature of an over\-training collapse\. \(C\) Tail zoom: the run falls from its step\-125125peak to53\.1%53\.1\\%at step150150\. Both curves and reference lines use theeval\_in\_distributionsplit at temperature0\.40\.4; see the text for the difference in sample count and backend\.