ANNEAL: Adapting LLM Agents via Governed Symbolic Patch Learning

# Adapting LLM Agents via Governed Symbolic Patch LearningImplementation: github.com/sbhakim/anneal-agents.
Source: [https://arxiv.org/html/2605.16309](https://arxiv.org/html/2605.16309)
## ANNEAL: Adapting LLM Agents via Governed Symbolic Patch Learning††thanks:Implementation:[github\.com/sbhakim/anneal\-agents](https://github.com/sbhakim/anneal-agents)\.

Safayat Bin Hakim1, Keyan Guo2, Wenkai Tan1, Alvaro Velasquez3, Shouhuai Xu4, Houbing Herbert Song1 1University of Maryland, Baltimore County2University at Buffalo 3University of Colorado Boulder4University of Colorado Colorado Springs

###### Abstract

LLM\-based agents can recover from individual execution errors, yet they repeatedly fail on the same fault when the underlying process knowledge—operator schemas, preconditions, and constraints—remains unrepaired\. Existing self\-evolving approaches address this gap by updating prompts, memory, or model weights, but none directly repair the symbolic structures that encode how tasks are executed, and few provide the governance guarantees required for safe deployment\. We introduceAnneal, a neuro\-symbolic agent that converts recurring failures into governed symbolic edits of a process knowledge graph without modifying foundation model weights\. Its core mechanism,Failure\-Driven Knowledge Acquisition \(FDKA\), localizes the responsible operator, synthesizes a typed patch through constrained LLM generation, and validates the proposal via multi\-dimensional scoring, symbolic guardrails, and canary testing before commit\. Every accepted edit carries full provenance and deterministic rollback capability\. Across four domains and 27 multi\-seed runs,Annealis the only evaluated system that commits persistent structural repairs—strong baselines such as ReAct and Reflexion achieve high episodic recovery yet retain 72–100% holdout failure rates on recurring faults, whereasAnnealreduces these to 0% in the tested recurring\-failure settings\. Ablation confirms that removing FDKA eliminates all structural repairs and drops success rate by up to 26\.7 percentage points\. These results suggest that governed symbolic repair offers a complementary paradigm to weight\-level and prompt\-level adaptation for persistent fault elimination\.

## 1Introduction

When a human expert encounters a recurring process failure—say, a booking system that keeps rejecting corporate cards during blackout dates—they do not simply retry harder; they repair the underlying procedure by adding a check for blocked dates\. This ability to convert recurring breakdowns into durable structural fixes is central to expertise\(Belleet al\.,[2023](https://arxiv.org/html/2605.16309#bib.bib1)\)\. LLM\-based agents lack this capability: they may recover within a single episode, but when the same fault reappears, they fail again because the process knowledge that caused it—operator schemas, preconditions, and constraints—remains unchanged\(Goelet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib2)\)\.

Recent work on self\-evolving agents addresses this gap through several paradigms\. Reflection\-based methods store verbal summaries across episodes\(Shinnet al\.,[2023](https://arxiv.org/html/2605.16309#bib.bib3)\)but leave the agent’s operational knowledge intact; the same structural fault can recur on every new task\. Memory\-augmented approaches retrieve past trajectories or distilled principles to guide decisions\(Wuet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib4); Zhonget al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib5)\), yet they adapt what the agentrecalls, not the process definitions itexecutes\. Reinforcement learning on memory\(Zhanget al\.,[2026b](https://arxiv.org/html/2605.16309#bib.bib6)\)and evolutionary prompt optimization\(Heet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib7); Zhanget al\.,[2026a](https://arxiv.org/html/2605.16309#bib.bib8)\)offer stronger adaptation but still operate over prompts, policies, or weights—none directly repair the typed symbolic structures that encode how tasks are planned and executed\. Moreover, few of these systems provide the governance guarantees—provenance, guardrails, canary testing, rollback—that safe deployment demands\(Wanet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib9); Shaoet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib10)\)\.

In this work, we introduceAnneal\(Figure[1](https://arxiv.org/html/2605.16309#S1.F1)\), a neuro\-symbolic agent that bridges this gap by converting recurring failures into governed symbolic edits of a process knowledge graph, without modifying foundation model weights\. Rather than updating what the agent recalls or how it prompts,Annealrepairs the operator definitions that the planner directly consults—ensuring that once a fault is fixed, it cannot structurally recur\. Its core mechanism,Failure\-Driven Knowledge Acquisition \(FDKA\), treats the LLM strictly as a constrained code generator under a closed typed schema, so that all acceptance logic remains symbolic and auditable\. Because no single validation step suffices for safe deployment, proposed edits must survive multi\-dimensional scoring, deontic and causal guardrails, and canary testing before commit—each layer catching failure modes the others miss\. A metacognitive controller further regulates when adaptation is warranted by arbitrating between fast and deliberative pathways based on uncertainty and violation signals\. A formal definition of the target environments and the open\-world instructability problem scope is provided in Appendix[A](https://arxiv.org/html/2605.16309#A1)\.

![Refer to caption](https://arxiv.org/html/2605.16309v1/x1.png)Figure 1:Annealadaptation cycle\.User requests hotel booking; execution fails due to policy violation\. FDKA localizes the responsible operator, synthesizes a precondition patch, validates through scoring and guardrails, and commits\. Replan with updated operator succeeds\. Complete cycle:<<2 minutes, no model retraining\.Contributions\.Our work combines neuro\-symbolic planning\(Goelet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib2); Kwonet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib11)\), metacognitive control\(Bergamaschi Ganapiniet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib12); Ji\-Anet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib13)\), and causal/value verification\(Jaiminiet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib14); Ziet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib15)\)into a governed system for symbolic process repair\. We make the following contributions:

1. 1\.Governed failure\-driven knowledge acquisition\.We propose FDKA, a pipeline that synthesizes typed symbolic edits \(schema updates, precondition additions, effect refinements\) under a closed JSON schema and validates them through multi\-dimensional scoring, value/causal guardrails, and canary deployment\. Across the 27 runs reported here, FDKA achieves 100% patch acceptance with no observed rollbacks \(Appendix[E](https://arxiv.org/html/2605.16309#A5),[F](https://arxiv.org/html/2605.16309#A6)\)\.
2. 2\.Metacognitive arbitration\.A stage\-aware control loop monitors uncertainty and violation signals to arbitrate between fast \(S1\), deliberative \(S2\), and verify\-before\-act pathways under explicit budgets\. Removing arbitration drops success rate by 4\.7 pp under stochastic noise, where compound policy shifts create multi\-violation chains that exceed the fast path’s budget\.
3. 3\.Comprehensive governance envelope\.Every committed edit carries provenance, Beta–Bernoulli trust scoring, human\-in\-the\-loop gates, and deterministic rollback\. A dedicated governance\-stress benchmark confirms selective activation: all six auth\-sensitive schema edits are escalated before commit in the reported suite, yielding 100% decision accuracy on that benchmark\.
4. 4\.Empirical evidence across four domains\.Across 27 multi\-seed runs,Annealis the only evaluated system that commits persistent structural repairs while achieving 94\.7–100% task success\. In recurring\-failure stress tests, committed patches reduce holdout failures to 0% in the evaluated settings, whereas ReAct and Reflexion retain 72–100% holdout failure rates despite high episodic recovery\. Removing FDKA drops success rate by up to 26\.7 percentage points and eliminates all structural repairs \(Appendix[G](https://arxiv.org/html/2605.16309#A7)provides a TTA convergence bound\)\.

Section[2](https://arxiv.org/html/2605.16309#S2)reviews related work; Section[3](https://arxiv.org/html/2605.16309#S3)formalizes the agent and control loop; Section[4](https://arxiv.org/html/2605.16309#S4)details FDKA and governance; Section[5](https://arxiv.org/html/2605.16309#S5)presents evaluation; Section[6](https://arxiv.org/html/2605.16309#S6)discusses limitations\.

## 2Related Work

Additional background on neuro\-symbolic planning, metacognitive control, and symbolic knowledge editing appears in Appendix[A](https://arxiv.org/html/2605.16309#A1); the main text focuses here on the most novelty\-sensitive comparisons\.

Governance for self\-evolving systems\.Integrating causal and value reasoning is critical for safe autonomy\(Jaiminiet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib14); Ziet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib15)\)\. Surveys on governed deployment\(Wanet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib9)\)emphasize provenance, human oversight, and rollback as prerequisites, while risk analyses show that self\-evolution can degrade safety through memory, tool, model, or workflow drift\(Shaoet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib10)\)\.Annealinstantiates this line of work through metacognitive arbitration, multi\-dimensional scoring, and an explicit governance envelope \(provenance, trust, rollback\)\.

Self\-evolving agents\.Surveys organize self\-evolving agents by what, when, and how to evolve\(Gaoet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib16)\)\. Current approaches span explicit evolution over persistent artifacts\(Linet al\.,[2026](https://arxiv.org/html/2605.16309#bib.bib17)\), whole\-agent configuration updates at test time\(Heet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib7)\), offline self\-distillation plus online policy reinforcement\(Wuet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib4)\), trajectory\-level self\-improvement\(Linet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib18)\), autonomous policy learning from experience\(Sunet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib19)\), and memory\-augmented or RL\-based adaptation\(Zhonget al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib5); Zhanget al\.,[2026b](https://arxiv.org/html/2605.16309#bib.bib6);[a](https://arxiv.org/html/2605.16309#bib.bib8)\)\. These systems mainly evolve prompts, memories, trajectories, or policies\. By contrast,Annealtargets typed symbolic process knowledge—operators, preconditions, effects, tool schemas, and constraints—and accepts only governed edits that survive scoring, guardrails, and canary tests \(Table[1](https://arxiv.org/html/2605.16309#S2.T1)\)\. Its contribution is therefore narrower but more concrete: governed, weight\-frozen structural repair of process knowledge rather than broad self\-evolution over arbitrary agent components\. Adjacent model\-editing work instead alters internal model parameters or auxiliary memories to change behavior, and recent results highlight nontrivial trade\-offs among reliability, generalization, locality, capability retention, and safety under repeated edits\(Liet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib20); Wanget al\.,[2024a](https://arxiv.org/html/2605.16309#bib.bib21)\)\.Annealdiffers by editing explicit symbolic process knowledge outside the foundation model, making changes directly auditable, reversible, and compatible with governance constraints\.

Table 1:Representative self\-evolving systems\.Annealis closest in spirit to artifact\-level evolution, but differs in its typed symbolic repair target and stricter governed commit path\.The next section formalizesAnneal’s agent tuple and control loop before detailing FDKA and governance in Section[4](https://arxiv.org/html/2605.16309#S4)\.

## 3System Overview and Control

Agent tuple\.Let𝒜=\(Π,Σ,ℰ,ℳ,ℛ\)\\mathcal\{A\}=\(\\Pi,\\Sigma,\\mathcal\{E\},\\mathcal\{M\},\\mathcal\{R\}\), whereΠ\\Piis the HTN planner consulting PKG,Σ\\Sigmais the typed symbolic state,ℰ\\mathcal\{E\}is the executor,ℳ\\mathcal\{M\}is the metacognitive controller, andℛ=\(ℛrules,ℛexp\)\\mathcal\{R\}=\(\\mathcal\{R\}\_\{\\text\{rules\}\},\\mathcal\{R\}\_\{\\text\{exp\}\}\)contains therule pool\(operators, constraints\) andexperience pool\(indexed failure traces\)\. The target environments and formal scope of open\-world instructability are defined in Appendix[A](https://arxiv.org/html/2605.16309#A1)\. Throughout,uudenotes uncertainty,pviolp\_\{\\text\{viol\}\}violation probability,BBremaining budget, andτu,τp\\tau\_\{u\},\\tau\_\{p\}their respective escalation thresholds\.

Anoperatoriso=⟨name,params,pre​\(o\),eff​\(o\),cost​\(o\)⟩o=\\langle\\text\{name\},\\text\{params\},\\text\{pre\}\(o\),\\text\{eff\}\(o\),\\text\{cost\}\(o\)\\rangle\. ApatchΔ​o\\Delta omodifies these fields \(typically adding preconditions\)\. Acceptance is governed by:

a=𝟏​\[Score​\(Δ​o\)≥θ∧Verify​\(Δ​o\)=allow\],a=\\mathbf\{1\}\\\!\\left\[\\textsc\{Score\}\(\\Delta o\)\\geq\\theta\\;\\land\\;\\textsc\{Verify\}\(\\Delta o\)=\\texttt\{allow\}\\right\],\(1\)whereScoreaggregates plausibility, consistency, utility, and risk \(Appendix[E](https://arxiv.org/html/2605.16309#A5)\);Verifyenforces value and causal constraints\. Accepted patches are staged, canaried, and committed with provenance; rejected patches are logged for audit\.

![Refer to caption](https://arxiv.org/html/2605.16309v1/x2.png)Figure 2:Annealsystem architecture\.Instructions compile into HTN plans via the Process Knowledge Graph \(PKG\)\. Metacognitive controllerℳ\\mathcal\{M\}monitors uncertaintyuu\(token\-level entropy\) and violation probabilitypviolp\_\{\\text\{viol\}\}\(logistic heuristic over precondition gaps\) to arbitrate between S1 \(fast\), S2 \(deliberative\), andVerify\(precondition check\) pathways\. Failures trigger FDKA: localize the responsible operator, synthesize patchΔ​o\\Delta o, score, validate via guardrails, and commit with governance \(provenance, trust, rollback\)\.Figure[2](https://arxiv.org/html/2605.16309#S3.F2)illustrates the closed\-loop architecture\. The eight core APIs separating planning, grounding, control, adaptation, safety, and learning are listed in Appendix[B](https://arxiv.org/html/2605.16309#A2)\.

Control loop\.At each planning step, the controller computes \(see Appendix[C](https://arxiv.org/html/2605.16309#A3)for signal computation details\):

pathway=Arb​\(u,pviol,B\)=\{Verifyif​pviol\>τp∧B≥cVerify𝒮2if​u\>τu∧B≥c𝒮2𝒮1otherwise\\text\{pathway\}=\\textsc\{Arb\}\(u,p\_\{\\text\{viol\}\},B\)=\\begin\{cases\}\\textsc\{Verify\}&\\text\{if \}p\_\{\\text\{viol\}\}\>\\tau\_\{p\}\\;\\land\\;B\\geq c\_\{\\textsc\{Verify\}\}\\\\ \\mathcal\{S\}\_\{2\}&\\text\{if \}u\>\\tau\_\{u\}\\;\\land\\;B\\geq c\_\{\\mathcal\{S\}\_\{2\}\}\\\\ \\mathcal\{S\}\_\{1\}&\\text\{otherwise\}\\end\{cases\}\(2\)whereu∈\[0,1\]u\\in\[0,1\]is uncertainty \(grounding\-completeness proxy\),pviol∈\[0,1\]p\_\{\\text\{viol\}\}\\in\[0,1\]is violation probability \(precondition\-gap heuristic\),BBis remaining budget, andc𝒮1<cVerify<c𝒮2c\_\{\\mathcal\{S\}\_\{1\}\}<c\_\{\\textsc\{Verify\}\}<c\_\{\\mathcal\{S\}\_\{2\}\}are pathway costs\. Thresholdsτu,τp\\tau\_\{u\},\\tau\_\{p\}are tuned via reflection \(exponential moving average; full reflection equations in Appendix[C](https://arxiv.org/html/2605.16309#A3)\)\.

Verify\-before\-act\.Whenpviol\>τpp\_\{\\text\{viol\}\}\>\\tau\_\{p\}, the verifier checks the next\-hhoperators \(h=3h=3\):

Verify​\(π,Σ,h\)=\{allowif​∀i∈\[1,h\]:Σ⊧pre​\(πi\)repairif​∃i:Σ⊧̸pre​\(πi\)∧LocalFixblockotherwise\\textsc\{Verify\}\(\\pi,\\Sigma,h\)=\\begin\{cases\}\\texttt\{allow\}&\\text\{if \}\\forall i\\in\[1,h\]:\\Sigma\\models\\text\{pre\}\(\\pi\_\{i\}\)\\\\ \\texttt\{repair\}&\\text\{if \}\\exists i:\\Sigma\\not\\models\\text\{pre\}\(\\pi\_\{i\}\)\\;\\land\\;\\text\{LocalFix\}\\\\ \\texttt\{block\}&\\text\{otherwise\}\\end\{cases\}\(3\)Local repairs substitute trusted alternative operators or apply micro\-patches fromℛexp\\mathcal\{R\}\_\{\\text\{exp\}\}, preserving plan semantics within≤2\\leq 2operator swaps\. LRU caching achieves≈60%\\approx 60\\%hit rate, reducing overhead to<<5ms per check\. End\-to\-end latency breakdown for all pathways is in Appendix[D\.1](https://arxiv.org/html/2605.16309#A4.SS1)\.

## 4Failure\-Driven Knowledge Acquisition and Governance

FDKA converts execution failures into verifiable edits through six stages: \(1\) localization, \(2\) proposal, \(3\) scoring, \(4\) guardrail validation, \(5\) canary testing, and \(6\) commit or rollback\. A concrete patch example and an end\-to\-end walkthrough are in Appendix[N](https://arxiv.org/html/2605.16309#A14)and Appendix[O](https://arxiv.org/html/2605.16309#A15); algorithmic specification is in Appendix[D](https://arxiv.org/html/2605.16309#A4)\.

Localization\.Given failure traceτt=⟨s0:t,a0:t,o,Σt,ϵt⟩\\tau\_\{t\}=\\langle s\_\{0:t\},a\_\{0:t\},o,\\Sigma\_\{t\},\\epsilon\_\{t\}\\rangle, responsibility scores operators via:

r​\(o′∣τt\)∝exp⁡\(ϕ​\(τt,o′\)⊤​w\),r\(o^\{\\prime\}\\mid\\tau\_\{t\}\)\\propto\\exp\(\\phi\(\\tau\_\{t\},o^\{\\prime\}\)^\{\\top\}w\),\(4\)whereϕ\\phiencodes symbolic deltas, tool log similarity, and parser confidence\. The top\-ranked operator becomes the patch target\.

Constrained generation\.ProposeEditis a three\-stage pipeline treating the LLM strictly as a code generator: \(1\) serialize the trace to a structured JSON prompt; \(2\) generate with a closed schema restricting edits to three typed categories—precondition additions, effect refinements, and tool\-schema updates—at temperatureT=0\.3T=0\.3; \(3\) deterministically parse and type\-check intoΔ​o=⟨scope,predicate,target,action⟩\\Delta o=\\langle\\text\{scope\},\\text\{predicate\},\\text\{target\},\\text\{action\}\\rangle\. No model weights are updated; all acceptance logic is symbolic\. The full three\-stage pipeline with figures is in Appendix[E](https://arxiv.org/html/2605.16309#A5)\.

Multi\-dimensional scoring\.Four dimensions, aggregated as:

Score​\(Δ​o\)=wplaus​splaus\+wcons​scons\+wutil​sutil−wrisk​srisk−λbudget,\\textsc\{Score\}\(\\Delta o\)=w\_\{\\text\{plaus\}\}s\_\{\\text\{plaus\}\}\+w\_\{\\text\{cons\}\}s\_\{\\text\{cons\}\}\+w\_\{\\text\{util\}\}s\_\{\\text\{util\}\}\-w\_\{\\text\{risk\}\}s\_\{\\text\{risk\}\}\-\\lambda\_\{\\text\{budget\}\},\(5\)with weights\(0\.40,0\.25,0\.25,0\.10\)\(0\.40,0\.25,0\.25,0\.10\)and a small budget penaltyλbudget≥0\\lambda\_\{\\text\{budget\}\}\\geq 0when regulation cost exceeds the configured budget\.Plausibilityuses calibrated log\-probability differences \(Spearmanρ=0\.83\\rho=0\.83with human judgments\)\.Consistencyapplies dual\-mode verification: fast symbolic heuristic \(<<5ms\) and optional Z3 SMT check \(20–50ms\)\.Utilitycounts failure prevention via counterfactual replay overk=20k=20retrieved traces\.Riskcombines value\-violation probability and blast radius\. Individual sub\-equations for all four dimensions, plus the EDCR probabilistic pre\-filter, are in Appendix[E](https://arxiv.org/html/2605.16309#A5)\. Risk here is a soft preference term; guardrails below are hard symbolic vetoes and therefore non\-redundant\.

Guardrails\.Two veto gates enforce deontic and structural constraints independently; a single veto blocks the patch regardless of score\. The value guardrail queries𝒦​𝒢val\\mathcal\{KG\}^\{\\text\{val\}\}\(deontic rules encoded as⟨action,modality,condition⟩\\langle\\text\{action\},\\text\{modality\},\\text\{condition\}\\rangletriples where modality∈\{Obligatory,Prohibited,Permitted\}\\in\\\{\\text\{Obligatory\},\\text\{Prohibited\},\\text\{Permitted\}\\\}\):

val\-veto​\(Δ​o\)=\{trueif∃r∈ℛa:r\.mod=Prohibited∧Δoenablesatrueif∃r∈ℛa:r\.mod=Obligatory∧Δoweakensr\.condfalseotherwise\\text\{val\-veto\}\(\\Delta o\)=\\begin\{cases\}\\texttt\{true\}&\\text\{if \}\\exists r\\in\\mathcal\{R\}\_\{a\}:r\.\\text\{mod\}=\\textsc\{Prohibited\}\\land\\Delta o\\text\{ enables \}a\\\\ \\texttt\{true\}&\\text\{if \}\\exists r\\in\\mathcal\{R\}\_\{a\}:r\.\\text\{mod\}=\\textsc\{Obligatory\}\\land\\Delta o\\text\{ weakens \}r\.\\text\{cond\}\\\\ \\texttt\{false\}&\\text\{otherwise\}\\end\{cases\}\(6\)The causal guardrail uses identifiabilityι\\iotaand normalized impact propagationη\\eta:

caus\-veto​\(Δ​o\)=\(ι<τident\)∨\(η\>τimpact\),\\text\{caus\-veto\}\(\\Delta o\)=\(\\iota<\\tau\_\{\\text\{ident\}\}\)\\lor\(\\eta\>\\tau\_\{\\text\{impact\}\}\),\(7\)withτident=0\.5\\tau\_\{\\text\{ident\}\}=0\.5andτimpact=0\.6\\tau\_\{\\text\{impact\}\}=0\.6\. Full guardrail context and threshold rationale are in Appendix[E](https://arxiv.org/html/2605.16309#A5)\.

Staging, canary testing, and rollback\.Patches passing scoring and auto\-approval enter canary testing \(up ton=8n=8sandboxed runs; when fewer examples are available, a low\-power mode evaluates the available examples/suite and rejects on any observed failure; strict\-mode pass threshold≥80%\\geq 80\\%\)\. This stage catches distributional mismatch that replay\-based scoring may miss\. Upon commit, a deterministic rollback set is computed and trust initializes via Beta–Bernoulli priors \(ρ0=2/3\\rho\_\{0\}=2/3\)\. Patches withρ<0\.3\\rho<0\.3over 10 tasks trigger automatic rollback\. The CSR canary equation, HITL gate equation, trust score equation, and commit equation are all in Appendix[F](https://arxiv.org/html/2605.16309#A6)\. Thestructural ratchetproperty—once a valid precondition is installed, that failure mode becomes difficult to repeat under unchanged upstream conditions, thereby reducing recurrence within the current operator abstraction—is discussed in Appendix[J](https://arxiv.org/html/2605.16309#A10)\.

Governance pipeline\.Every committed patch carries a provenance record \(source, inputs, rationale, timestamp\) enabling forensic trace\-back; all edits are versioned with deterministic rollback sets\. A conflict\-aware ledger\(Zhanget al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib22)\)detects coverage and reverse conflicts via edit\-key hashing, resolving or escalating as needed\. Patches must clear scoringandguardrailsandcanary testing before deployment—no single mechanism is a single point of failure\. Formal equations \(provenance, rollback, conflict detection, trust\) are in Appendix[F](https://arxiv.org/html/2605.16309#A6)\. In the evaluated runs, no rollbacks were observed\.

## 5Evaluation

### 5\.1Setup

Domains\.Travel planning: 25 tasks, failure rate 70%, seed=42 \(hard difficulty\)\.Travel stochastic: 25 tasks with transient failures and policy shifts \(hard difficulty\)\.E\-commerce: 25 tasks \(order processing, payment validation, inventory management; easy difficulty as configured\)\.ITSM: 25 tasks \(access provisioning, patch deployment, credential reset, ticketing; hard difficulty\)\. All runs initialize with emptyℛexp\\mathcal\{R\}\_\{\\text\{exp\}\}and 12 operators\. Evaluation uses both single\-seed and 3\-seed protocols; each table states its horizon and seed regime explicitly\. Full dataset specification is in Appendix[H](https://arxiv.org/html/2605.16309#A8)\.

Implementation\.Patch synthesis uses GPT\-4o\-mini \(T=0\.3T=0\.3, max 512 tokens\)\. Thresholds:θ=0\.18\\theta=0\.18,τimpact=0\.6\\tau\_\{\\text\{impact\}\}=0\.6,τconf=0\.5\\tau\_\{\\text\{conf\}\}=0\.5,τu=0\.25\\tau\_\{u\}=0\.25,τp=0\.20\\tau\_\{p\}=0\.20, budgetB=5B=5s\. Scoring weights: plausibility 0\.40, consistency 0\.25, utility 0\.25, risk 0\.10\. All reported results use OpenAI\-family models via the released code\. Cross\-model comparisons are deferred to future work\.

Baselines and ablations\.Static\-NS: neuro\-symbolic with fixed operators, no learning\.LLM\-Reflect: LLM with cross\-episode textual reflection memory \(FIFO, max 20 episodes\); GPT\-4o\-mini calls\.Verify\-Only: neuro\-symbolic with verification but no FDKA\.ReAct\(Yaoet al\.,[2023](https://arxiv.org/html/2605.16309#bib.bib23)\): per\-step Thought–Action–Observation loop using GPT\-4o\-mini; no cross\-episode memory or knowledge updates—failures recur across episodes\. Ablations systematically remove Governance, Verify, Arbitration, and FDKA\. In the main−\-Governance ablation we disable value and causal gates while retaining canary/rollback, so the deployment guard remains empirical; a separate governance\-stress config pair fully disables governance to isolate deployment gating on auth\-sensitive schema edits\. Full system configurations are tabulated in Appendix[H](https://arxiv.org/html/2605.16309#A8)\.

A formal TTA convergence bound appears in Appendix[G](https://arxiv.org/html/2605.16309#A7)\. In the runs reported here, observed TTA values for successfully patched failure classes ranged from 0 to 15 tasks depending on scenario and failure type\.

### 5\.2Results

Baseline comparison\.In single\-seed travel planning \(25 tasks, seed=42; full table in Appendix[M](https://arxiv.org/html/2605.16309#A13)\),Annealachieves100% SRwith 1 accepted patch and zero terminal repeat failures\. ReAct and Reflexion\(Shinnet al\.,[2023](https://arxiv.org/html/2605.16309#bib.bib3)\)match 100% SR via intra\-episode retry but commit no structural repairs; LLM\-Reflect \(GPT\-4o\-mini\) reaches 88% with 4% permanent failures; non\-adaptive baselines plateau at 30–49%\.

Direct multi\-seed comparison\.Table[2](https://arxiv.org/html/2605.16309#S5.T2)reports a controlled comparison using a common OpenAI model family across 3 agents, 3 scenarios, and 3 seeds \(27 runs total\)\. On both travel domains, all three agents reach 100% or near\-100% success, but onlyAnnealcommits persistent symbolic repairs: 1\.0±\\pm0\.0 accepted patches in travel planning and travel stochastic, versus 0\.0 for ReAct and Reflexion in every run\. In e\-commerce, Reflexion reaches the highest episodic SR at 98\.7±\\pm1\.9%, but commits zero structural repairs\.Annealreaches 94\.7±\\pm2\.3% SR—outperforming ReAct \(78\.7±\\pm2\.3%\)—while committing 2\.7±\\pm0\.6 patches per run spanning three distinct edit categories \(schema updates, precondition additions, effect refinements\)\. The stress test helps distinguish this gap: Reflexion’s additional episodic SR comes from within\-episode workarounds rather than persistent operator repair\.

E\-commerce stress test \(3 seeds\)\.To isolate cross\-domain adaptation, we ran a controlled 14\-task stress test \(8 prefix \+ 6 holdout, all order\-placement dominant\) with 100% injected tool\-schema\-drift failures\.Annealcommits one schema\-update patch in every seed with TTA=0 \(patch accepted at the first failure encounter\), reducing holdout order\-placement failures to0%across all three seeds\. ReAct achieves 71\.4% mean SR with 83\.3% holdout target\-failure rate\. Reflexion reaches 97\.6±\\pm3\.4% overall SR and 94\.4±\\pm7\.9% holdout SR via within\-episode workarounds—it successfully completes tasks by alternative LLM\-generated paths—yet still leaves 72\.2±\\pm15\.7% holdout order\-placement failures unresolved, consistent with the view that episodic reflection does not eliminate the underlying operator fault\. Among the evaluated systems, onlyAnnealcommits a persistent repair that reduces recurrence \(Figure[3](https://arxiv.org/html/2605.16309#S5.F3)b\)\.

Table 2:Direct OpenAI comparison\(mean±\\pmstd over 3 seeds per cell; 27 runs total\)\. Among the evaluated systems, onlyAnnealcommits validated persistent repairs \(2\.7±\\pm0\.6 patches in e\-commerce spanning 3 distinct edit categories\)\. Reflexion can exceed episodic SR in e\-commerce but commits zero structural repairs\.Recurring\-failure stress test\.Table[3](https://arxiv.org/html/2605.16309#S5.T3)isolates persistent adaptation from episodic retry\. We constructed a targeted 12\-task travel split with 3 early API\-drift exposures on the flight\-booking operator, 3 filler tasks, and then the same failure class reintroduced on 6 later holdout tasks\. All three agents solved the holdout tasks episodically, but onlyAnnealsuppressed the target failure itself: the holdout target\-failure rate falls to 0\.0±\\pm0\.0 after one committed patch, whereas ReAct and Reflexion remain at 100\.0±\\pm0\.0 despite 100\.0±\\pm0\.0 holdout SR\. These results are consistent with the claim thatAnnealmodifies environment\-facing process knowledge rather than merely recovering within episode \(Figure[3](https://arxiv.org/html/2605.16309#S5.F3)a\)\.

Table 3:Recurring\-failure stress test\(mean±\\pmstd over 3 seeds\)\. The same flight\-booking API\-drift class is forced in an adaptation prefix and then reintroduced on 6 holdout tasks\. Holdout failure rate measures whether the target failure is still observed on those later tasks\.![Refer to caption](https://arxiv.org/html/2605.16309v1/x3.png)Figure 3:Adaptation curve \(ratchet effect\)\.Cumulative target\-class failures versus task index, from real per\-task metrics \(seed 7; all seeds identical under deterministic failure injection\)\. \(a\) Travel stress \(12 tasks\):Annealpatches BookFlight API\-drift on first encounter \(TTA=0\); target failures plateau at 1 while baselines accumulate 9 across prefix and holdout\. \(b\) E\-commerce stress \(14 tasks\):Annealpatches PlaceOrder tool\-schema drift on first encounter; holdout failures remain at zero versus 11–12 for baselines\. The plateau after the⋆\\starmarker is the signature of persistent structural repair\.Key findings\.

1. 1\.Among the evaluated systems,Annealis the only one tocommit validated knowledge edits—2\.7±\\pm0\.6 patches per e\-commerce run spanning schema updates, precondition additions, and effect refinements—while ReAct and Reflexion commit none\. Stress tests make the distinction concrete:Annealreduces holdout target\-failure rates to 0%, while baselines retain≥\\geq72% despite high episodic SR \(Figure[3](https://arxiv.org/html/2605.16309#S5.F3)\)\.
2. 2\.Terminal failures are near\-zero across domains \(0% travel, 1\.3±\\pm2\.3% e\-commerce\); residual failures are non\-patchable constraints correctly blocked by verify\-before\-act\.
3. 3\.Across the reported runs, 100% patch acceptance with no observed rollbacks is consistent with the intended multi\-layered governance design\. The FDKA ablation \(Table[4](https://arxiv.org/html/2605.16309#S5.T4)\) confirms structural necessity: removing FDKA drops e\-commerce SR by 26\.7 pp and eliminates all structural repairs\.

Ablation study\.Table[4](https://arxiv.org/html/2605.16309#S5.T4)reports component ablations across three domains \(3 seeds each\)\. In deterministic travel, removing FDKA drops SR by 4\.0 pp; other components are modular \(0\.0 pp\) because the failure schedule produces neither high uncertainty nor multi\-step precondition chains\. The stochastic variant injects compound policy shifts creating 3\-violation repair chains that exceed the fast path’s 2\-hop budget; removing Arbitration drops SR by 4\.7 pp as the fast path exhausts its budget after two repairs while the slow path resolves all three via extended look\-ahead\. In e\-commerce, removing FDKA drops SR by 26\.7 pp \(the largest single\-component impact\) and eliminates all structural repairs\. Removing Verify yields\+\+4\.0 pp, reflecting constraint types where verify\-before\-act catches violations that the repair loop does not yet cover\.

Table 4:Ablation study \(5 conditions×\\times3 domains×\\times3 seeds each\)\.FDKA is essential:−\-4\.0 pp in deterministic travel;−\-26\.7 pp in e\-commerce \(largest single\-component impact\)\. Arbitration activates under stochastic noise \(−\-4\.7 pp\), where compound policy shifts create multi\-violation repair chains that exceed the fast path’s budget\.The ablation reveals a principled activation hierarchy\. FDKA is essential across all domains \(−\-4\.0 to−\-26\.7 pp\) because persistent knowledge gaps appear in each setting\. Arbitration activates under stochastic noise \(−\-4\.7 pp\) where compound disruptions create multi\-hop repair chains that overwhelm the fast path; it is dormant in deterministic domains where violation probability stays below the escalation threshold\. In the routine benchmark, governance is intentionally quiet because accepted patches are low\-risk local repairs; its role there is to certify safe commits without reducing headline SR on already\-safe edits\.

Cross\-scenario summary\.Across the four untuned scenarios in theAnnealcross\-scenario table \(3 seeds each; full table in Appendix[L](https://arxiv.org/html/2605.16309#A12)\), both travel domains reach 100% SR with 1\.0 accepted patch per run and zero terminal failures\. E\-commerce reaches 94\.7±\\pm2\.3% SR with 2\.7±\\pm0\.6 patches spanning three edit categories\. ITSM also reaches 100\.0±\\pm0\.0% SR, 100\.0±\\pm0\.0% CSR, and 1\.0±\\pm0\.0 accepted patches, showing that the current operator library transfers to a third domain under the same untuned multi\-seed protocol\.

Governance validation\.The absence of observed rollbacks is consistent with defense\-in\-depth in the routine runs\. To isolate governance selectivity directly, we add a dedicated e\-commerce governance\-stress suite: six fixed order\-placement tasks all force auth\-schema drift onPlaceOrder\. Under full governance, the synthesized migration from legacyauth\_tokentosigned\_session\_tokenis escalated before commit on every task \(6 proposals, 6 escalations, 0 commits, 0/6 recovered tasks\)\. Under a governance\-off stress ablation, the same repair is committed on the first task and suppresses the remaining failures \(1 proposal, 1 commit, 6/6 recovered tasks\)\. This suite is not intended to maximize average\-case SR; it shows that, in this setting, security\-relevant schema edits are escalated rather than silently committed, addressing the low\-risk bias of the routine benchmark\. A complementary synthetic 8\-patch governance suite still achieves100% decision accuracy; both tables appear in Appendix[F](https://arxiv.org/html/2605.16309#A6); additional governance notes appear in Appendix[I](https://arxiv.org/html/2605.16309#A9)\.

## 6Discussion and Limitations

Scope\.The current evidence supports a narrow claim about persistent symbolic repair, not broad general superiority\. The strongest results are in recurring operator and tool\-schema failures, whereAnnealcommits validated edits and suppresses later recurrence; the e\-commerce stress test confirms cross\-domain generalization after guardrail calibration, and the untuned 3\-seed ITSM result extends this to a third domain under the current operator library\. The evidence supports operator\-centric transfer under the released ontology, not arbitrary\-domain autonomy\. A central observation is that high overall SR is insufficient evidence of adaptation: Reflexion reaches 97\.6±\\pm3\.4% SR on the e\-commerce stress test via within\-episode workarounds, yet retains 72\.2±\\pm15\.7% holdout target\-failure rates—the underlying operator fault persists\. Among the evaluated systems, onlyAnnealrepairs the underlying operator fault in these settings\.

Edit coverage\.E\-commerce commits 2–3 patches per run spanning three edit categories, but the majority of recoveries across domains come from verify\-before\-act and local repair rather than FDKA\. The proposal pipeline is limited to operator\-level edits; extending it to constraint and workflow edits would broaden coverage\. Similarly, several ITSM recoveries rely on verification rather than committed structural changes\.

Component activation\.The routine benchmark is dominated by low\-risk local repairs, so governance contributes primarily as deployment gating rather than as a top\-line SR gain; we isolate its role with a dedicated six\-task auth\-schema governance\-stress suite rather than claiming average\-case SR deltas\. The metacognitive arbitrator shows measurable impact only under stochastic noise \(−\-4\.7 pp in travel stochastic\); richer uncertainty sources—multi\-provider variation, adversarial perturbations—would widen this gap\.

Extensions\.The most important next steps are richer edit spaces beyond operators, operator synthesis for entirely novel fault classes, and stronger scalability of the value and causal knowledge graphs\. Better cold\-start transfer and multi\-provider comparisons are needed for a more complete empirical case\. Additional future directions are collected in Appendix[K](https://arxiv.org/html/2605.16309#A11)\.

## 7Conclusion

We presentedAnneal, a governed neuro\-symbolic system that converts recurring agent failures into persistent symbolic repairs of process knowledge without modifying model weights\. Our experiments across four domains and 27 multi\-seed runs provide evidence that high episodic recovery does not necessarily imply persistent fault elimination: baselines that achieve strong per\-episode success retain 72–100% holdout failure rates on recurring faults, whereasAnneal’s committed patches reduce these to 0% in all evaluated settings\. The contribution is deliberately narrow—auditable, typed symbolic repair with explicit guardrails, provenance, and rollback—but provides a concrete foundation for extending governed adaptation to richer edit spaces, multi\-agent coordination, and deployment settings where auditability is a prerequisite\.

## Ethics Statement

Self\-evolving agents can introduce unsafe or non\-compliant updates\.Annealmitigates this risk through explicit guardrails, canary testing, provenance, rollback, and optional human review\. The current experiments are sandboxed simulations and do not involve deployment on human subjects or safety\-critical infrastructure\.

## Reproducibility Statement

We provide sufficient detail to reproduce the reported results in the main paper, appendix, and supplementary material\. The manuscript specifies the evaluated domains, baselines, model settings, thresholds, scoring weights, metrics, and fixed seeds\. The appendix provides additional details on datasets, algorithms, operational signals, governance procedures, and metric computation\. The accompanying codebase, configurations, scripts, and minimal run configuration are available at[https://github\.com/sbhakim/anneal\-agents](https://github.com/sbhakim/anneal-agents)\.

## References

- J\. Bell, L\. Quarantiello, E\. N\. Coleman, L\. Li, M\. Li, M\. Madeddu, E\. Piccoli, and V\. Lomonaco \(2025\)The future of continual learning in the era of foundation models: three key directions\.InProceedings of the TCAI Workshop 2025,pp\. 16\.Note:arXiv:2506\.03320,[https://arxiv\.org/abs/2506\.03320](https://arxiv.org/abs/2506.03320)External Links:[Document](https://dx.doi.org/10.48550/arXiv.2506.03320)Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p2.1),[Appendix A](https://arxiv.org/html/2605.16309#A1.p2.1),[Appendix J](https://arxiv.org/html/2605.16309#A10.p3.1)\.
- Neuro\-symbolic ai\+ agent systems: a first reflection on trends, opportunities and challenges\.InInternational Conference on Autonomous Agents and Multiagent Systems,pp\. 180–200\.Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p1.1)\.
- M\. Bergamaschi Ganapini, M\. Campbell, F\. Fabiano, L\. Horesh, J\. Lenchner, A\. Loreggia, N\. Mattei, F\. Rossi, B\. Srivastava, and K\. Venable \(2025\)Fast, slow, and metacognitive thinking in ai\.npj Artificial Intelligence1\(1\),pp\. 27\.Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2605.16309#S1.p4.1)\.
- H\. Gao, J\. Geng, W\. Hua, M\. Hu, X\. Juan, H\. Liu, S\. Liu, J\. Qiu, X\. Qi, Y\. Wu, H\. Wang, H\. Xiao, Y\. Zhou, S\. Zhang, J\. Zhang, J\. Xiang, Y\. Fang, Q\. Zhao, D\. Liu, Q\. Ren, C\. Qian, Z\. Wang, M\. Hu, H\. Wang, Q\. Wu, H\. Ji, and M\. Wang \(2025\)A survey of self\-evolving agents: what, when, how, and where to evolve on the path to artificial super intelligence\.External Links:[Link](https://arxiv.org/abs/2507.21046)Cited by:[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- S\. Goel, P\. Lymperopoulos, R\. Thielstrom, E\. Krause, P\. Feeney, P\. Lorang, S\. Schneider, Y\. Wei, E\. Kildebeck, S\. Goss,et al\.\(2024\)A neurosymbolic cognitive architecture framework for handling novelties in open worlds\.Artificial Intelligence331,pp\. 104111\.Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p1.1),[§1](https://arxiv.org/html/2605.16309#S1.p4.1)\.
- Y\. He, J\. Liu, Y\. Liu, Y\. Li, T\. Cao, Z\. Hu, X\. Xu, and B\. Hooi \(2025\)EvoTest: evolutionary test\-time learning for self\-improving agentic systems\.External Links:[Link](https://arxiv.org/abs/2510.13220)Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[Table 1](https://arxiv.org/html/2605.16309#S2.T1.5.5.4.1),[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- U\. Jaimini, C\. Henson, and A\. Sheth \(2024\)Causal neurosymbolic ai: a synergy between causality and neurosymbolic methods\.IEEE Intelligent Systems39\(3\)\.Cited by:[Appendix K](https://arxiv.org/html/2605.16309#A11.p2.2),[§1](https://arxiv.org/html/2605.16309#S1.p4.1),[§2](https://arxiv.org/html/2605.16309#S2.p2.1)\.
- L\. Ji\-An, H\. Xiong, R\. C\. Wilson, M\. G\. Mattar, and M\. K\. Benna \(2025\)Language models are capable of metacognitive monitoring and control of their internal activations\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p4.1)\.
- J\. Julian, Y\. S\. Koh, and A\. Bifet \(2025\)Building adaptive knowledge bases for evolving continual learning models\.npj Artificial Intelligence1\(1\),pp\. 26\.Cited by:[Appendix K](https://arxiv.org/html/2605.16309#A11.p3.1)\.
- M\. Kwon, Y\. Kim, and Y\. J\. Kim \(2025\)Fast and accurate task planning using neuro\-symbolic language models and multi\-level goal decomposition\.In2025 IEEE International Conference on Robotics and Automation \(ICRA\),pp\. 16195–16201\.Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p1.1),[Appendix K](https://arxiv.org/html/2605.16309#A11.p1.3),[§1](https://arxiv.org/html/2605.16309#S1.p4.1)\.
- M\. Kwon and Y\. J\. Kim \(2025\)Neuro\-symbolic task planning and replanning using large language models\.InICRA 2025 Workshop on Foundation Models and Neuro\-Symbolic AI for Robotics,Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p1.1),[Appendix K](https://arxiv.org/html/2605.16309#A11.p1.3)\.
- Q\. Li, X\. Liu, Z\. Tang, P\. Dong, Z\. Li, X\. Pan, and X\. Chu \(2024\)Should we really edit language models? on the evaluation of edited language models\.Advances in Neural Information Processing Systems37,pp\. 30850–30885\.Cited by:[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- J\. Lin, Y\. Guo, Y\. Han, S\. Hu, Z\. Ni, L\. Wang, M\. Chen, H\. Liu, R\. Chen, Y\. He, D\. Jiang, B\. Jiao, C\. Hu, and H\. Wang \(2025\)SE\-agent: self\-evolution trajectory optimization in multi\-step reasoning with LLM\-based agents\.InAdvances in Neural Information Processing Systems \(NeurIPS\),External Links:[Link](https://arxiv.org/abs/2508.02085)Cited by:[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- M\. Lin, H\. Lu, Z\. Shi, B\. He, R\. Mao, Z\. Zhang, Z\. Wu, X\. Tang, H\. Liu, Z\. Dai, X\. Zhang, S\. Wang, B\. Dumoulin, and J\. Pei \(2026\)Position: agentic evolution is the path to evolving LLMs\.External Links:[Link](https://arxiv.org/abs/2602.00359)Cited by:[Table 1](https://arxiv.org/html/2605.16309#S2.T1.5.3.2.1),[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- S\. Shao, Q\. Ren, C\. Qian, B\. Wei, D\. Guo, J\. Yang, X\. Song, L\. Zhang, W\. Zhang, D\. Liu, and J\. Shao \(2025\)Your agent may misevolve: emergent risks in self\-evolving LLM agents\.External Links:[Link](https://arxiv.org/abs/2509.26354)Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[§2](https://arxiv.org/html/2605.16309#S2.p2.1)\.
- N\. Shinn, F\. Cassano, A\. Gopinath, K\. Narasimhan, and S\. Yao \(2023\)Reflexion: language agents with verbal reinforcement learning\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[§5\.2](https://arxiv.org/html/2605.16309#S5.SS2.p1.1)\.
- Z\. Sun, Z\. Liu, Y\. Zang, Y\. Cao, X\. Dong, T\. Wu, D\. Lin, and J\. Wang \(2025\)SEAgent: self\-evolving computer use agent with autonomous learning from experience\.External Links:[Link](https://arxiv.org/abs/2508.04700)Cited by:[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- Z\. Wan, C\. Liu, H\. Yang, C\. Li, H\. You, Y\. Fu, C\. Wan, T\. Krishna, Y\. Lin, and A\. Raychowdhury \(2024\)Towards cognitive ai systems: a survey and prospective on neuro\-symbolic ai\.arXiv preprint arXiv:2401\.01040\.Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[§2](https://arxiv.org/html/2605.16309#S2.p2.1)\.
- P\. Wang, Z\. Li, N\. Zhang, Z\. Xu, Y\. Yao, Y\. Jiang, P\. Xie, F\. Huang, and H\. Chen \(2024a\)Wise: rethinking the knowledge memory for lifelong model editing of large language models\.Advances in Neural Information Processing Systems37,pp\. 53764–53797\.Cited by:[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- S\. Wang, Y\. Zhu, H\. Liu, Z\. Zheng, C\. Chen, and J\. Li \(2024b\)Knowledge editing for large language models: a survey\.ACM Comput\. Surv\.57\(3\)\.External Links:[Document](https://dx.doi.org/10.1145/3698590),[Link](https://doi.org/10.1145/3698590)Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p2.1)\.
- H\. Wei, P\. Shakarian, C\. Lebiere, B\. Draper, N\. Krishnaswamy, and S\. Nirenburg \(2024\)Metacognitive ai: framework and the case for a neurosymbolic approach\.InInternational Conference on Neural\-Symbolic Learning and Reasoning,pp\. 60–67\.Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p1.1)\.
- R\. Wu, X\. Wang, J\. Mei, P\. Cai, D\. Fu, C\. Yang, L\. Wen, X\. Yang, Y\. Shen, Y\. Wang, and B\. Shi \(2025\)EvolveR: self\-evolving LLM agents through an experience\-driven lifecycle\.External Links:[Link](https://arxiv.org/abs/2510.16079)Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[Table 1](https://arxiv.org/html/2605.16309#S2.T1.5.7.6.1),[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao \(2023\)ReAct: synergizing reasoning and acting in language models\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§5\.1](https://arxiv.org/html/2605.16309#S5.SS1.p3.1)\.
- N\. Zhang, Z\. Xi, Y\. Luo, P\. Wang, B\. Tian, Y\. Yao, J\. Zhang, S\. Deng, M\. Sun, L\. Liang,et al\.\(2024\)OneEdit: a neural\-symbolic collaboratively knowledge editing system\.InVLDB Workshops,External Links:[Link](https://vldb.org/workshops/2024/proceedings/LLM%2BKG/LLM%2BKG-2.pdf)Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p2.1),[§4](https://arxiv.org/html/2605.16309#S4.p7.1)\.
- Q\. Zhang, C\. Hu, S\. Upasani, B\. Ma, F\. Hong, V\. Kamanuru, J\. Rainton, C\. Wu, M\. Ji, H\. Li, U\. Thakker, J\. Zou, and K\. Olukotun \(2026a\)Agentic context engineering: evolving contexts for self\-improving language models\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- S\. Zhang, J\. Wang, R\. Zhou, J\. Liao, Y\. Feng, Z\. Li, Y\. Zheng, W\. Zhang, Y\. Wen, Z\. Li, F\. Xiong, Y\. Qi, B\. Tang, and M\. Wen \(2026b\)MemRL: self\-evolving agents via runtime reinforcement learning on episodic memory\.External Links:[Link](https://arxiv.org/abs/2601.03192)Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- Y\. Zhao, C\. Dai, W\. Zhuo, Y\. Xiu, and D\. Niyato \(2025\)CLAUSE: agentic neuro\-symbolic knowledge graph reasoning via dynamic learnable context engineering\.arXiv preprint arXiv:2509\.21035\.Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p2.1),[Appendix K](https://arxiv.org/html/2605.16309#A11.p2.2)\.
- W\. Zhong, L\. Guo, Q\. Gao, H\. Ye, and Y\. Wang \(2024\)MemoryBank: enhancing large language models with long\-term memory\.InProceedings of the Thirty\-Eighth AAAI Conference on Artificial Intelligence and Thirty\-Sixth Conference on Innovative Applications of Artificial Intelligence and Fourteenth Symposium on Educational Advances in Artificial Intelligence,pp\. 19724–19731\.Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p2.1),[§2](https://arxiv.org/html/2605.16309#S2.p3.1)\.
- Y\. Zhou, Y\. Liu, X\. Li, Y\. Zhao, X\. Wang, J\. Tian, Z\. Li, and X\. Xu \(2025\)Metagent\-p: a neuro\-symbolic planning agent with metacognition for open worlds\.InFindings of the Association for Computational Linguistics: ACL 2025,pp\. 22747–22764\.Cited by:[Appendix A](https://arxiv.org/html/2605.16309#A1.SS0.SSS0.Px1.p1.1)\.
- Y\. Zi, K\. Roy, and A\. Sheth \(2025\)Cognitive neurosymbolic artificial intelligence for complex decision\-making: integrating foundation models, cognitive architectures, and knowledge\.IEEE Intelligent Systems40\(3\),pp\. 16–22\.Cited by:[§1](https://arxiv.org/html/2605.16309#S1.p4.1),[§2](https://arxiv.org/html/2605.16309#S2.p2.1)\.

## Appendix AProblem Statement and Scope

We targetopen\-world instructability: environments where tasks are long\-horizon, tools and APIs evolve \(schema changes, policy updates\), norms shift \(new regulations, organizational flips\), and novel entities appear \(out\-of\-distribution requests, unseen edge cases\)\. Concrete examples include enterprise scheduling under dynamic policies, multi\-step travel planning with evolving booking APIs, and conversational assistants managing heterogeneous tool ecosystems\.

Critically, we do not modify foundation model weights\. Adaptation occurs exclusively through governed edits to the symbolic layer: operators \(preconditions, effects, cost models\), tool schemas, constraints, and thresholds\. This design is motivated by practical constraints—continual fine\-tuning risks catastrophic forgetting\(Bellet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib24)\)—and governance requirements: auditable, reversible changes with provenance\. Our goal is to measure Time\-to\-Adapt \(TTA\)—the latency from observing a new failure class to achieving sustained improvement—as a first\-class performance metric with provable bounds \(Theorem[1](https://arxiv.org/html/2605.16309#Thmtheorem1)in Appendix[G](https://arxiv.org/html/2605.16309#A7)\), positioning governed symbolic repair as a viable alternative to model retraining in production settings\.

#### Background notes\.

Robust instruction following benefits from neuro\-symbolic decomposition: instructions compile into Hierarchical Task Networks \(HTN\) by consulting a Process Knowledge Graph \(PKG\) encoding typed operators\(Kwonet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib11); Kwon and Kim,[2025](https://arxiv.org/html/2605.16309#bib.bib25)\)\. Metacognitive frameworks distinguish fast heuristic reasoning \(S1\) from slower deliberative reasoning \(S2\), aggregating signals to regulate interventions within resource budgets\(Bergamaschi Ganapiniet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib12); Weiet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib26)\)\. Verify\-before\-act mechanisms use satisfiability checking to prevent infeasible plans\(Zhouet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib27)\)\. However, these systems usefixedoperators, so failures recur as process knowledge remains static without repair\.

Traditional continual learning updates model weights\(Wanget al\.,[2024b](https://arxiv.org/html/2605.16309#bib.bib28)\), but fine\-tuning is slow, expensive, and poses governance challenges\(Bellet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib24)\)\. Neural\-symbolic knowledge editing\(Zhanget al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib22); Zhaoet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib29)\)emphasizes stable edit keys, conflict detection, and provenance\.Annealinstead edits symbolic knowledge while keeping foundation model weights frozen, using the LLM as a constrained code generator rather than a learned policy\.

## Appendix BSystem APIs and Operational Signals

The architecture exposes eight core APIs enabling modular composition:

- •Π​\(instruction,PKG\)→π\\Pi\(\\text\{instruction\},\\text\{PKG\}\)\\to\\pi: Compile instruction into HTN plan
- •Parse​\(π,Σ\)→πground\\textsc\{Parse\}\(\\pi,\\Sigma\)\\to\\pi\_\{\\text\{ground\}\}: Ground symbolic parameters to entities
- •Arb​\(u,pviol,B\)→\{𝒮1,𝒮2,Verify\}\\textsc\{Arb\}\(u,p\_\{\\text\{viol\}\},B\)\\to\\\{\\mathcal\{S\}\_\{1\},\\mathcal\{S\}\_\{2\},\\textsc\{Verify\}\\\}: Arbitrate pathway under budgetBB
- •Verify​\(π,Σ,h\)→\{allow,repair,block\}\\textsc\{Verify\}\(\\pi,\\Sigma,h\)\\to\\\{\\texttt\{allow\},\\texttt\{repair\},\\texttt\{block\}\\\}: Check next\-hhoperators
- •ProposeEdit​\(τ,Σ\)→Δ​o\\textsc\{ProposeEdit\}\(\\tau,\\Sigma\)\\to\\Delta o: Synthesize patch from failure trace
- •Score​\(Δ​o,ℛexp\)→\[0,1\]\\textsc\{Score\}\(\\Delta o,\\mathcal\{R\}\_\{\\text\{exp\}\}\)\\to\[0,1\]: Multi\-dimensional scoring
- •Guardrails​\(Δ​o,𝒦​𝒢val,𝒦​𝒢cau\)→\{allow,veto\}\\textsc\{Guardrails\}\(\\Delta o,\\mathcal\{KG\}^\{\\text\{val\}\},\\mathcal\{KG\}^\{\\text\{cau\}\}\)\\to\\\{\\texttt\{allow\},\\texttt\{veto\}\\\}: Constraint validation
- •Reflect​\(outcomes,τu,τp\)→τu′,τp′\\textsc\{Reflect\}\(\\text\{outcomes\},\\tau\_\{u\},\\tau\_\{p\}\)\\to\\tau^\{\\prime\}\_\{u\},\\tau^\{\\prime\}\_\{p\}: Threshold tuning

Operational signals used throughout are summarized in Table[5](https://arxiv.org/html/2605.16309#A2.T5)\.

Table 5:Operational signals for metacognitive control, arbitration, and scoring\.
## Appendix CSignal Computation and Arbitration

Uncertainty via token\-level entropy\.For sequencey=\(y1,…,yL\)y=\(y\_\{1\},\\ldots,y\_\{L\}\):

Hi=−∑v∈top\-​kp​\(v∣y<i,x\)​log⁡p​\(v∣y<i,x\),u=min⁡\{1,H​\(y\|x\)H¯\},H\_\{i\}=\-\\sum\_\{v\\in\\text\{top\-\}k\}p\(v\\mid y\_\{<i\},x\)\\log p\(v\\mid y\_\{<i\},x\),\\quad u=\\min\\\!\\left\\\{1,\\frac\{H\(y\|x\)\}\{\\bar\{H\}\}\\right\\\},\(8\)whereH¯\\bar\{H\}is an exponential moving average over 1000 tasks \(α=0\.01\\alpha=0\.01\)\.

Violation probability via logistic regression\.A 10\-dimensional feature vectordd\(precondition gap, invariant distance, tool health, novelty, recent violations, plan depth, budget slack,uu, value impact, operator diversity\) feeds a calibrated logistic regression:pviol=σ​\(w⊤​d/Tcal\)p\_\{\\text\{viol\}\}=\\sigma\(w^\{\\top\}d/T\_\{\\text\{cal\}\}\)\.

Reflection and threshold tuning\.Over the lastn=100n=100tasks:

τu′\\displaystyle\\tau^\{\\prime\}\_\{u\}=\(1−α\)​τu\+α⋅Quantile0\.8​\(\{ui:outcomei=failure\}\)\\displaystyle=\(1\-\\alpha\)\\tau\_\{u\}\+\\alpha\\cdot\\text\{Quantile\}\_\{0\.8\}\(\\\{u\_\{i\}:\\text\{outcome\}\_\{i\}=\\text\{failure\}\\\}\)\(9\)τp′\\displaystyle\\tau^\{\\prime\}\_\{p\}=\(1−α\)​τp\+α⋅Quantile0\.8​\(\{pviol,i:outcomei=failure\}\)\\displaystyle=\(1\-\\alpha\)\\tau\_\{p\}\+\\alpha\\cdot\\text\{Quantile\}\_\{0\.8\}\(\\\{p\_\{\\text\{viol\},i\}:\\text\{outcome\}\_\{i\}=\\text\{failure\}\\\}\)\(10\)withα=0\.01\\alpha=0\.01to prevent oscillation\. IfSR𝒮1<0\.7\\text\{SR\}\_\{\\mathcal\{S\}\_\{1\}\}<0\.7, thresholds increase; ifSR𝒮2\>0\.95\\text\{SR\}\_\{\\mathcal\{S\}\_\{2\}\}\>0\.95, thresholds decrease\.

## Appendix DDetailed Algorithms and Complexity

Algorithm 1Main Control Loop with Metacognitive Arbitration1:Instruction

II, initial state

Σ0\\Sigma\_\{0\}, budget

BB, PKG,

ℛ\\mathcal\{R\}
2:Task outcome, updated

ℛrules\\mathcal\{R\}\_\{\\text\{rules\}\}
3:

π←Π​\(I,PKG\)\\pi\\leftarrow\\Pi\(I,\\text\{PKG\}\);

πground←Parse​\(π,Σ0\)\\pi\_\{\\text\{ground\}\}\\leftarrow\\textsc\{Parse\}\(\\pi,\\Sigma\_\{0\}\)
4:

Σ←Σ0\\Sigma\\leftarrow\\Sigma\_\{0\},

Bremain←BB\_\{\\text\{remain\}\}\\leftarrow B
5:while

πground≠∅∧Bremain\>0\\pi\_\{\\text\{ground\}\}\\neq\\emptyset\\wedge B\_\{\\text\{remain\}\}\>0do

6:

u←Uncertainty​\(πground,Σ\)u\\leftarrow\\textsc\{Uncertainty\}\(\\pi\_\{\\text\{ground\}\},\\Sigma\);

pviol←ViolationProb​\(πground,Σ\)p\_\{\\text\{viol\}\}\\leftarrow\\textsc\{ViolationProb\}\(\\pi\_\{\\text\{ground\}\},\\Sigma\)
7:

pathway←Arb​\(u,pviol,Bremain\)\\text\{pathway\}\\leftarrow\\textsc\{Arb\}\(u,p\_\{\\text\{viol\}\},B\_\{\\text\{remain\}\}\)
8:if

pathway=Verify\\text\{pathway\}=\\textsc\{Verify\}then

9:

verdict←Verify​\(πground,Σ,h=3\)\\text\{verdict\}\\leftarrow\\textsc\{Verify\}\(\\pi\_\{\\text\{ground\}\},\\Sigma,h=3\)
10:if

verdict=block\\text\{verdict\}=\\texttt\{block\}then

πground←Π​\(I,PKG\)\\pi\_\{\\text\{ground\}\}\\leftarrow\\Pi\(I,\\text\{PKG\}\)
11:elseif

verdict=repair\\text\{verdict\}=\\texttt\{repair\}thenApply local fix;

Bremain\-=cVerifyB\_\{\\text\{remain\}\}\\mathrel\{\-\}=c\_\{\\textsc\{Verify\}\}
12:endif

13:elseif

pathway=𝒮2\\text\{pathway\}=\\mathcal\{S\}\_\{2\}then

14:

πground←DeliberativePlan​\(I,Σ\)\\pi\_\{\\text\{ground\}\}\\leftarrow\\textsc\{DeliberativePlan\}\(I,\\Sigma\);

Bremain\-=c𝒮2B\_\{\\text\{remain\}\}\\mathrel\{\-\}=c\_\{\\mathcal\{S\}\_\{2\}\}
15:endif

16:

ot←Head​\(πground\)o\_\{t\}\\leftarrow\\textsc\{Head\}\(\\pi\_\{\\text\{ground\}\}\);

\(Σ′,status\)←ℰ​\(ot,Σ\)\(\\Sigma^\{\\prime\},\\text\{status\}\)\\leftarrow\\mathcal\{E\}\(o\_\{t\},\\Sigma\)
17:if

status=failure\\text\{status\}=\\texttt\{failure\}then

18:

Δ​o←FDKA​\(τt,ℛ\)\\Delta o\\leftarrow\\textsc\{FDKA\}\(\\tau\_\{t\},\\mathcal\{R\}\)
19:if

Δ​o≠null\\Delta o\\neq\\texttt\{null\}then

ℛrules∪=\{Δo\}\\mathcal\{R\}\_\{\\text\{rules\}\}\\mathrel\{\\cup\}=\\\{\\Delta o\\\};

πground←Π​\(I,PKG\)\\pi\_\{\\text\{ground\}\}\\leftarrow\\Pi\(I,\\text\{PKG\}\)
20:elsereturnfailure

21:endif

22:else

Σ←Σ′\\Sigma\\leftarrow\\Sigma^\{\\prime\};

πground←Tail​\(πground\)\\pi\_\{\\text\{ground\}\}\\leftarrow\\textsc\{Tail\}\(\\pi\_\{\\text\{ground\}\}\)
23:endif

24:

Bremain\-=c𝒮1B\_\{\\text\{remain\}\}\\mathrel\{\-\}=c\_\{\\mathcal\{S\}\_\{1\}\}
25:endwhile

26:

Reflect​\(trajectory,τu,τp\)\\textsc\{Reflect\}\(\\text\{trajectory\},\\tau\_\{u\},\\tau\_\{p\}\);returnsuccess

Algorithm 2FDKA Pipeline: From Trace to Committed Patch1:Failure trace

τt\\tau\_\{t\}, pools

ℛ\\mathcal\{R\}, KGs

𝒦​𝒢val\\mathcal\{KG\}^\{\\text\{val\}\},

𝒦​𝒢cau\\mathcal\{KG\}^\{\\text\{cau\}\}
2:Committed patch

Δ​o\\Delta oornull

3:

o∗←Localize​\(τt,ℛrules\)o^\{\*\}\\leftarrow\\textsc\{Localize\}\(\\tau\_\{t\},\\mathcal\{R\}\_\{\\text\{rules\}\}\)
4:

Δ​o←ProposeEdit​\(τt,o∗\)\\Delta o\\leftarrow\\textsc\{ProposeEdit\}\(\\tau\_\{t\},o^\{\*\}\)
5:if

Δ​o=null\\Delta o=\\texttt\{null\}thenreturnnull

6:endif

7:

s←Score​\(Δ​o,ℛexp\)s\\leftarrow\\textsc\{Score\}\(\\Delta o,\\mathcal\{R\}\_\{\\text\{exp\}\}\)
8:if

s<θs<\\thetaor

val\-veto​\(Δ​o\)\\textsc\{val\-veto\}\(\\Delta o\)or

caus\-veto​\(Δ​o\)\\textsc\{caus\-veto\}\(\\Delta o\)thenreturnnull

9:endif

10:

conflict←Ledger\.CheckAndStage​\(Δ​o\)\\text\{conflict\}\\leftarrow\\texttt\{Ledger\.CheckAndStage\}\(\\Delta o\)
11:if

conflict=reverse∧ρ​\(Δ​o\)<τoverride\\text\{conflict\}=\\texttt\{reverse\}\\wedge\\rho\(\\Delta o\)<\\tau\_\{\\text\{override\}\}then

12:

QueueHuman​\(Δ​o\)\\textsc\{QueueHuman\}\(\\Delta o\);returnnull

13:endif

14:if

Gate​\(Δ​o\)=queue\_human\\textsc\{Gate\}\(\\Delta o\)=\\texttt\{queue\\\_human\}then

QueueForReview​\(Δ​o\)\\textsc\{QueueForReview\}\(\\Delta o\);returnnull

15:endif

16:if

CanaryTest​\(Δ​o,ℛexp\)≥τcanary\\textsc\{CanaryTest\}\(\\Delta o,\\mathcal\{R\}\_\{\\text\{exp\}\}\)\\geq\\tau\_\{\\text\{canary\}\}then

17:

Ledger\.Commit​\(Δ​o\)\\texttt\{Ledger\.Commit\}\(\\Delta o\);return

Δ​o\\Delta o
18:else

Ledger\.Rollback​\(Δ​o\)\\texttt\{Ledger\.Rollback\}\(\\Delta o\);returnnull

19:endif

Algorithm 3CheckAndStage: Conflict Detection & Resolution1:procedureCheckAndStage\(

Δ​o\\Delta o, Ledger\)

2:

edit\_key←SHA256​\(scope​‖predicate‖​subject\)\\texttt\{edit\\\_key\}\\leftarrow\\textsc\{SHA256\}\(\\text\{scope\}\\\|\\text\{predicate\}\\\|\\text\{subject\}\)
3:

existing←Ledger\.Lookup​\(edit\_key\)\\text\{existing\}\\leftarrow\\texttt\{Ledger\.Lookup\}\(\\texttt\{edit\\\_key\}\)
4:if

existing≠null\\text\{existing\}\\neq\\texttt\{null\}then

5:if

existing\.target≠Δ​o\.target\\text\{existing\.target\}\\neq\\Delta o\.\\text\{target\}then⊳\\trianglerightCoverage conflict

6:PreRollback\(edit\_key\);returncoverage\_resolved

7:elseif

Negates​\(existing,Δ​o\)\\text\{Negates\}\(\\text\{existing\},\\Delta o\)then⊳\\trianglerightReverse conflict

8:if

ρ​\(Δ​o\)≥τoverride\\rho\(\\Delta o\)\\geq\\tau\_\{\\text\{override\}\}thenPreRollback\(edit\_key\);returnreverse\_overridden

9:elsereturnreverse\_escalate\_human

10:endif

11:endif

12:endif

13:Ledger\.Stage\(edit\_key,

Δ​o\\Delta o,

ℛΔ​o\\mathcal\{R\}\_\{\\Delta o\},

prov​\(Δ​o\)\\text\{prov\}\(\\Delta o\)\);returnok

14:endprocedure

When edit history for a key exceedsKmax\-history=50K\_\{\\text\{max\-history\}\}=50entries, auto\-schedule consolidation: squash to canonical patch, reset trust prior, and require fresh canary validation\.

### D\.1Complexity and Latency

The principal computational overheads arise from five operations:

- •PlanningΠ\\Pi:𝒪​\(bd\)\\mathcal\{O\}\(b^\{d\}\)with branching factorbband depthdd; pruning and caching yieldd≤5d\\leq 5typical, 10–50ms latency\.
- •VerificationVerify:Symbolic heuristic checks complete in<<5ms; optional Z3/SAT solving incurs 20–50ms;𝒪​\(n​log⁡n\)\\mathcal\{O\}\(n\\log n\)in predicates per operator \(n∼10n\\sim 10\); LRU caching reduces invocations by≈\\approx60%\.
- •Arbitration:Constant time;uuandpviolp\_\{\\text\{viol\}\}computation<<1ms each, total<<5ms\.
- •ProposeEdit \(LLM call\):500 input tokens, 100 output tokens; 200–500ms depending on model; dominant latency cost of FDKA\.
- •Scoring:Probabilistic pre\-filter \(20ms\), consistency check \(<<5ms\), utility retrieval \(30ms\), risk classification \(<<5ms\), total 60–100ms\.

End\-to\-end latency\.Fast path \(no failure\): 50–200ms for planning and execution\. FDKA path: ProposeEdit \(≈\\approx300ms\) \+ scoring \(≈\\approx100ms\) \+ canary testing \(≈\\approx500–800ms for 5–8 runs, depending on available evidence\)≈\\approx0\.9–1\.2s total overhead\. The metacognitive controller enforces a regulate budgetBregulateB\_\{\\text\{regulate\}\}\(default 2s\): if patch evaluation threatens to exceed this, scoring suspends and the patch queues for asynchronous review\.

## Appendix EDetailed ProposeEdit Pipeline and Scoring Equations

![Refer to caption](https://arxiv.org/html/2605.16309v1/x4.png)Figure 4:ConcreteProposeEditpipeline\.Stage 1 serializes failure traceτ\\tauinto compact JSON\. Stage 2 uses few\-shot constrained prompting to emit a patch in closed JSON schema\. Stage 3 deterministically parses and type\-checks output into typed symbolic editΔ​o\\Delta o\. The LLM acts as a constrained code generator; all acceptance is handled by subsequent scoring and guardrail stages\.Figure[4](https://arxiv.org/html/2605.16309#A5.F4)illustrates the three\-stage pipeline\.

Stage 1: Input serialization\.Only predicates relevant to the failure are included \(≤10\\leq 10symbols\):\{operator: \{name, params, preconditions, effects\}, state\_minimal: \{relevant\_symbols\}, error: \{type, message, evidence\}\}\.

Stage 2: Constrained generation\.The system message enforces a closed schema admitting only three edit types: precondition additions, effect refinements, and tool\-schema updates\. Few\-shot exemplars \(3–5\) fromℛexp\\mathcal\{R\}\_\{\\text\{exp\}\}demonstrate valid patches\. TemperatureT=0\.3T=0\.3\.

Stage 3: Parsing and type checking\.A deterministic parser validates JSON structure, extracts the edit type, and type\-checks against the operator schema\. Invalid outputs are rejected immediately\. Valid patches normalize toΔ​o=⟨scope,predicate,target,action⟩\\Delta o=\\langle\\text\{scope\},\\text\{predicate\},\\text\{target\},\\text\{action\}\\rangle\.

### E\.1Individual Scoring Sub\-Equations

Plausibilityevaluates patch alignment with the LLM’s learned distribution via calibrated log\-probability differences:

splaus=σ​\(1\|Δ​o\|​\[log⁡p​\(Δ​o∣τt\)−log⁡p​\(null∣τt\)\]\),s\_\{\\text\{plaus\}\}=\\sigma\\\!\\left\(\\frac\{1\}\{\|\\Delta o\|\}\\left\[\\log p\(\\Delta o\\mid\\tau\_\{t\}\)\-\\log p\(\\texttt\{null\}\\mid\\tau\_\{t\}\)\\right\]\\right\),\(11\)where\|Δ​o\|\|\\Delta o\|is patch length in tokens andnullis a minimal baseline edit\. Length normalization prevents penalizing longer patches\. Validation on 200 labeled patches yields Spearmanρ=0\.83\\rho=0\.83with human judgments\.

Consistencyverifies that the patched operator preserves logical integrity via dual\-mode verification:

scons=\{1ifSAT​\(pre​\(o′\)∧Σt∧Inv\)∧TypeCheck​\(o′\)0otherwises\_\{\\text\{cons\}\}=\\begin\{cases\}1&\\text\{if \}\\textsc\{SAT\}\(\\text\{pre\}\(o^\{\\prime\}\)\\land\\Sigma\_\{t\}\\land\\text\{Inv\}\)\\land\\textsc\{TypeCheck\}\(o^\{\\prime\}\)\\\\ 0&\\text\{otherwise\}\\end\{cases\}\(12\)whereo′=o∪Δ​oo^\{\\prime\}=o\\cup\\Delta ois the patched operator andInvis the conjunction of domain invariants\. The fast symbolic heuristic \(<<5ms\) runs by default; Z3 SMT solving \(20–50ms\) is invoked optionally for formal guarantees\.

Utilityestimates whetherΔ​o\\Delta owould have prevented past failures via counterfactual replay overk=20k=20retrieved traces:

sutil=nprevent\+0\.5⋅nmitigatek,s\_\{\\text\{util\}\}=\\frac\{n\_\{\\text\{prevent\}\}\+0\.5\\cdot n\_\{\\text\{mitigate\}\}\}\{k\},\(13\)wherenpreventn\_\{\\text\{prevent\}\}counts fully averted failures andnmitigaten\_\{\\text\{mitigate\}\}counts partially mitigated ones\. Ifk<3k<3\(cold\-start\), relax acceptance threshold or queue for human review\.

Riskquantifies potential harm combining value\-violation probability and blast radius:

srisk=wval⋅qval\+wblast⋅b,s\_\{\\text\{risk\}\}=w\_\{\\text\{val\}\}\\cdot q\_\{\\text\{val\}\}\+w\_\{\\text\{blast\}\}\\cdot b,\(14\)withwval=0\.8w\_\{\\text\{val\}\}=0\.8,wblast=0\.2w\_\{\\text\{blast\}\}=0\.2, whereqval∈\[0,1\]q\_\{\\text\{val\}\}\\in\[0,1\]is value\-violation probability andb=naffected/\|ℛrules\|b=n\_\{\\text\{affected\}\}/\|\\mathcal\{R\}\_\{\\text\{rules\}\}\|is the blast radius fraction\. High\-risk patches \(srisk\>0\.6s\_\{\\text\{risk\}\}\>0\.6\) trigger human\-in\-the\-loop gates\.

EDCR probabilistic pre\-filter\.Before full scoring, a lightweight pre\-filter ensures the failure class is systematic enough to warrant a patch:

P^err≥1−Pα,\\hat\{P\}\_\{\\text\{err\}\}\\geq 1\-P\_\{\\alpha\},\(15\)whereP^err\\hat\{P\}\_\{\\text\{err\}\}is the empirical error rate for the failure class andPαP\_\{\\alpha\}is the baseline residual \(errors not preventable by symbolic edits, e\.g\., transient tool outages; typicalPα=0\.25P\_\{\\alpha\}=0\.25\)\. This filter rejects patches for rare, non\-systematic errors, reducing noise in the rule pool\.

Scoring geometry visualization\.Figure[5](https://arxiv.org/html/2605.16309#A5.F5)visualizes the four scoring axes\.

![Refer to caption](https://arxiv.org/html/2605.16309v1/x5.png)Figure 5:Four\-dimensional scoring geometry\.Each patchΔ​o\\Delta ois evaluated along plausibility \(Eq\.[11](https://arxiv.org/html/2605.16309#A5.E11)\), consistency \(Eq\.[12](https://arxiv.org/html/2605.16309#A5.E12)\), utility \(Eq\.[13](https://arxiv.org/html/2605.16309#A5.E13)\), and risk \(Eq\.[14](https://arxiv.org/html/2605.16309#A5.E14)\)\. Aggregate score \(Eq\.[5](https://arxiv.org/html/2605.16309#S4.E5)in main text\) must exceedθ=0\.18\\theta=0\.18for acceptance\.

## Appendix FGovernance Details

### F\.1Provenance, Rollback, Canary, HITL Gate, Trust Score, and Commit Equations

Provenance tuple\.Every committed change stores:

prov​\(Δ​o\)=⟨source,inputs,context,rationale,t,τref⟩,\\text\{prov\}\(\\Delta o\)=\\langle\\text\{source\},\\text\{inputs\},\\text\{context\},\\text\{rationale\},t,\\tau\_\{\\text\{ref\}\}\\rangle,\(16\)enabling full forensic trace\-back\. Selective evidence deletion supports GDPR/HIPAA compliance while retaining functional patches\.

Example Provenance / Commit Artifactedit\_key:bookhotel\.precondition\.blocked\_card source:FDKA / ProposeEdit inputs:failure trace, operator snapshot, retrieved similar tracescontext:travel\_planning, seed 42, failure classPAY\-401 rationale:add a blocked\-card precondition so replanning avoids a policy\-invalid payment pathrollback set:delete new predicate, restore prior operator versiontrace reference:pointer to the originating failure trace used for forensic audit

Rollback set\.All edits are versioned:

ℛΔ​o=\{del​\(new\_pred\),add​\(old\_pred\),…\},\\mathcal\{R\}\_\{\\Delta o\}=\\\{\\texttt\{del\}\(\\text\{new\\\_pred\}\),\\texttt\{add\}\(\\text\{old\\\_pred\}\),\\ldots\\\},\(17\)enabling one\-step deterministic reversion at any point\.

Canary Score Rate \(CSR\)\.Canary testing executes the patched operatoro′o^\{\\prime\}on up toncanary=8n\_\{\\text\{canary\}\}=8sandboxed scenarios:

CSR=npass\+0\.5⋅nmitigatedncanary,\\text\{CSR\}=\\frac\{n\_\{\\text\{pass\}\}\+0\.5\\cdot n\_\{\\text\{mitigated\}\}\}\{n\_\{\\text\{canary\}\}\},\(18\)with strict\-mode commit thresholdτcanary=0\.8\\tau\_\{\\text\{canary\}\}=0\.8\. When fewer retrieved examples are available, the system enters a low\-power mode using the available examples and/or deterministic suite and rejects on any observed failure\. Failed canary tests execute with no side effects, preventing user\-facing regressions\.

Human\-in\-the\-Loop gate\.High\-risk or low\-confidence patches require human approval:

Gate​\(Δ​o\)=\{queue\_humanif​srisk\>τimpact∨Score​\(Δ​o\)<τconfauto\_approveotherwise\\textsc\{Gate\}\(\\Delta o\)=\\begin\{cases\}\\texttt\{queue\\\_human\}&\\text\{if \}s\_\{\\text\{risk\}\}\>\\tau\_\{\\text\{impact\}\}\\;\\lor\\;\\textsc\{Score\}\(\\Delta o\)<\\tau\_\{\\text\{conf\}\}\\\\ \\texttt\{auto\\\_approve\}&\\text\{otherwise\}\\end\{cases\}\(19\)with defaultsτimpact=0\.6\\tau\_\{\\text\{impact\}\}=0\.6andτconf=0\.5\\tau\_\{\\text\{conf\}\}=0\.5\. Safety\-critical domains should useτimpact=0\.3\\tau\_\{\\text\{impact\}\}=0\.3,τconf=0\.7\\tau\_\{\\text\{conf\}\}=0\.7\. Human approvals update trust \(s←s\+5s\\leftarrow s\+5\); denials apply penalty \(f←f\+10f\\leftarrow f\+10\); rationales are indexed for future retrieval\.

Trust score\.Upon first commit, the patch receives a trust score via Beta–Bernoulli conjugate priors:

ρ​\(Δ​o\)=s\+αs\+f\+α\+β,\\rho\(\\Delta o\)=\\frac\{s\+\\alpha\}\{s\+f\+\\alpha\+\\beta\},\(20\)wheressis success count,ffis failure count, and\(α,β\)=\(2,1\)\(\\alpha,\\beta\)=\(2,1\)is an optimistic prior \(ρ0=2/3\\rho\_\{0\}=2/3\)\. As the patch accrues outcomes,ρ\\rhoconverges to empirical success rate\. Patches withρ<0\.3\\rho<0\.3overn=10n=10tasks are auto\-flagged for rollback\.

Commit operation\.The commit stores:

Commit​\(Δ​o\)=⟨edit\_key,Δ​o,ℛΔ​o,prov​\(Δ​o\),ρ0,t⟩,\\textsc\{Commit\}\(\\Delta o\)=\\langle\\texttt\{edit\\\_key\},\\Delta o,\\mathcal\{R\}\_\{\\Delta o\},\\text\{prov\}\(\\Delta o\),\\rho\_\{0\},t\\rangle,\(21\)whereedit\_key=Hash​\(scope,predicate,subject\)\\texttt\{edit\\\_key\}=\\textsc\{Hash\}\(\\text\{scope\},\\text\{predicate\},\\text\{subject\}\)is a stable identifier for conflict detection,ℛΔ​o\\mathcal\{R\}\_\{\\Delta o\}is the rollback set \(Eq\.[17](https://arxiv.org/html/2605.16309#A6.E17)\),prov​\(Δ​o\)\\text\{prov\}\(\\Delta o\)is the provenance tuple \(Eq\.[16](https://arxiv.org/html/2605.16309#A6.E16)\), andttis the commit timestamp\. To prevent thrashing after rollback, gates are temporarily tightened:τconf←1\.2⋅τconf\\tau\_\{\\text\{conf\}\}\\leftarrow 1\.2\\cdot\\tau\_\{\\text\{conf\}\}for 50 tasks \(exponential decay\)\.

### F\.2Integrated Governance Pipeline \(8\-Step\)

The complete governance envelope executes as follows for each proposed patch:

1. 1\.Propose:FDKA generatesΔ​o\\Delta owith full provenance \(source, inputs, context, rationale\)\.
2. 2\.Ledger check:CheckAndStagedetects coverage or reverse conflicts; resolves or escalates\.
3. 3\.Score:Multi\-dimensional scoring \(Eq\.[5](https://arxiv.org/html/2605.16309#S4.E5)\) evaluates plausibility, consistency, utility, and risk\.
4. 4\.Guardrails:Value \(Eq\.[6](https://arxiv.org/html/2605.16309#S4.E6)\) and causal \(Eq\.[7](https://arxiv.org/html/2605.16309#S4.E7)\) gates veto or escalate unsafe edits\.
5. 5\.Human gate:High\-impact or low\-confidence patches queue human review immediately after guardrails; only auto\-approved patches continue\.
6. 6\.Canary test:CSR \(Eq\.[18](https://arxiv.org/html/2605.16309#A6.E18)\) provides empirical safety evidence for auto\-approved patches or post\-review approvals\.
7. 7\.Commit:On approval, commit \(Eq\.[21](https://arxiv.org/html/2605.16309#A6.E21)\) with trust initialization and rollback set\.
8. 8\.Monitor:Trust scoring \(Eq\.[20](https://arxiv.org/html/2605.16309#A6.E20)\) tracks reliability; automatic rollback triggered ifρ<0\.3\\rho<0\.3\.

This multi\-layered defense ensures no single mechanism is a single point of failure\.

### F\.3Governance Stress Test Results

Table[6](https://arxiv.org/html/2605.16309#A6.T6)reports the synthetic audit; Table[7](https://arxiv.org/html/2605.16309#A6.T7)reports the live suite\.

Table 6:Synthetic governance stress test outcomes\.Eight synthetic patches \(4 safe, 4 unsafe\) evaluated to probe guardrail behavior\. All decisions match expected outcomes \(100% decision accuracy\)\.Live governance\-activation suite\.Complementing the synthetic audit, we ran a fixed 6\-task e\-commerce suite that forcesauth\_schema\_driftonPlaceOrderunder identical seeds and task list for two configs\. The same OpenAI\-generated patch family is proposed: replace legacyauth\_tokenwithsigned\_session\_token\. Under full governance, the migration is escalated before commit on all six tasks; under the governance\-off stress ablation, the first such patch is committed and the remaining tasks recover without further proposals\. This suite is used to test deployment gating rather than average\-case SR\.

Example Governance Escalation Record: Auth\-Sensitive Schema MigrationFailure class:PlaceOrder:auth\_schema\_drift Proposed edit:replace legacyauth\_tokenwithsigned\_session\_tokenin the order\-placement tool schema\.Guardrail outcome:value constraints pass, but causal review marks the migration as high\-impact on the authentication path and returnsrequest\_human\.Canary:not executed under full governance because escalation occurs before deployment\.Counterfactual:in the governance\-off stress ablation, the first such patch is committed and the remaining five tasks recover without further proposals\.

Table 7:Live governance\-activation suite\.Six fixed auth\-sensitive schema\-drift tasks under identical seeds/task list\. Full governance escalates every proposed migration before commit; governance\-off commits once and suppresses the remaining failures\.

## Appendix GTTA Convergence Proof

###### Theorem 1\(TTA Convergence Bound\)\.

Letℱ\\mathcal\{F\}be a failure class\. Assume: \(i\) experience pool contains≥kmin\\geq k\_\{\\min\}similar traces; \(ii\) utility scoring detects preventable failures with probability≥pdetect\\geq p\_\{\\text\{detect\}\}; \(iii\) acceptance thresholds filter false positives at rate≤ϵ\\leq\\epsilon\. Then with probability≥1−δ\\geq 1\-\\delta, FDKA proposes a correct patch within:

TTA≤⌈log⁡\(1/δ\)pdetect⋅\(1−ϵ\)⌉\\text\{TTA\}\\leq\\left\\lceil\\frac\{\\log\(1/\\delta\)\}\{p\_\{\\text\{detect\}\}\\cdot\(1\-\\epsilon\)\}\\right\\rceil\(22\)tasks after observingℱ\\mathcal\{F\}\.

###### Proof of Theorem[1](https://arxiv.org/html/2605.16309#Thmtheorem1)\.

Model adaptation as a geometric process where each task independently proposes a correct patch with probabilitypsuccess=pdetect⋅\(1−ϵ\)p\_\{\\text\{success\}\}=p\_\{\\text\{detect\}\}\\cdot\(1\-\\epsilon\)\. The number of trialsTTuntil first success followsT∼Geom​\(psuccess\)T\\sim\\text\{Geom\}\(p\_\{\\text\{success\}\}\)with tail bound:

P​\(T\>t\)=\(1−psuccess\)t\.P\(T\>t\)=\(1\-p\_\{\\text\{success\}\}\)^\{t\}\.SettingP​\(T\>t\)≤δP\(T\>t\)\\leq\\deltaand solving fortt:

t≥log⁡\(1/δ\)log⁡\(1/\(1−psuccess\)\)≈log⁡\(1/δ\)psuccesst\\geq\\frac\{\\log\(1/\\delta\)\}\{\\log\(1/\(1\-p\_\{\\text\{success\}\}\)\)\}\\approx\\frac\{\\log\(1/\\delta\)\}\{p\_\{\\text\{success\}\}\}for smallpsuccessp\_\{\\text\{success\}\}, usinglog⁡\(1/\(1−p\)\)≈p\\log\(1/\(1\-p\)\)\\approx p\. Substitutingpsuccess=pdetect​\(1−ϵ\)p\_\{\\text\{success\}\}=p\_\{\\text\{detect\}\}\(1\-\\epsilon\)yields Eq\. \([22](https://arxiv.org/html/2605.16309#A7.E22)\)\.

Assumption validation:\(i\) Experience pool coverage \(kmink\_\{\\min\}\) ensures reliable utility scoring\. \(ii\)pdetect≥0\.8p\_\{\\text\{detect\}\}\\geq 0\.8from counterfactual replay validation\. \(iii\) Multi\-layered governance achievesϵ≤0\.1\\epsilon\\leq 0\.1empirically \(zero rollbacks observed\)\. ∎

## Appendix HEvaluation Harness

### H\.1Dataset Specification

Travel\-planning benchmark: 25 tasks, failure rate 70%, seed=42 \(hard difficulty\)\. Tasks span Policy Flip \(blackout dates, approval thresholds, loyalty restrictions\), Tool Drift \(schema changes, rate limits, transient 503 errors\), and OOD Entities \(group bookings, multi\-city, accessibility\)\. Travel\-stochastic adds uncertainty injection, transient failures, and policy shifts over 25 hard tasks\. E\-commerce contains 25 tasks in order processing, payment validation, inventory, and refund handling \(easy difficulty as configured\)\. ITSM contains 25 tasks spanning access provisioning, patch deployment, credential reset, and ticket creation \(hard difficulty\)\. Each task includes a natural language instruction, scenario class, expected failure operator, and success criterion\. Separate from these 25\-task suites, we report a targeted governance\-activation suite: six fixed e\-commerce instructions with forcedauth\_schema\_drift, run under identical seeds/task list for full\-governance and governance\-off stress configs\. This probe is excluded from headline SR averages because its purpose is to isolate deployment gating rather than average\-case task performance\. The manuscript therefore combines: \(i\) a single\-seed travel baseline table, \(ii\) 3\-seed direct comparisons across travel planning, travel stochastic, and e\-commerce, \(iii\) 3\-seed ablations on those same three scenarios, \(iv\) a 3\-seedAnnealcross\-scenario table spanning travel planning, travel stochastic, e\-commerce, and ITSM, and \(v\) the fixed 6\-task governance\-activation suite\.

### H\.2Baseline and Ablation Configurations

Table[8](https://arxiv.org/html/2605.16309#A8.T8)details all baseline and ablation configurations\.

Table 8:Baseline and ablation configurations\.All systems share identical planners, parsers, and domain ontologies; differences lie in adaptation mechanisms\.
### H\.3Key Metric Formulas

Repeat\-Failure Rate \(RFR\):

RFRt=\|\{i∈\[t−99,t\]:failure​\(i\)∧repeat​\(i\)\}\|\|\{i∈\[t−99,t\]:failure​\(i\)\}\|×100%,\\text\{RFR\}\_\{t\}=\\frac\{\|\\\{i\\in\[t\-99,t\]:\\text\{failure\}\(i\)\\wedge\\text\{repeat\}\(i\)\\\}\|\}\{\|\\\{i\\in\[t\-99,t\]:\\text\{failure\}\(i\)\\\}\|\}\\times 100\\%,whererepeat\(i\)=𝟏\[∃j<i:error\(j\)=error\(i\)\]\\text\{repeat\}\(i\)=\\mathbf\{1\}\[\\exists j<i:\\text\{error\}\(j\)=\\text\{error\}\(i\)\]\.

Time\-to\-Adapt \(TTA\):

TTA​\(ℱ\)=tadapt​\(ℱ\)−tfirst​\(ℱ\),\\text\{TTA\}\(\\mathcal\{F\}\)=t\_\{\\text\{adapt\}\}\(\\mathcal\{F\}\)\-t\_\{\\text\{first\}\}\(\\mathcal\{F\}\),wheretfirst​\(ℱ\)t\_\{\\text\{first\}\}\(\\mathcal\{F\}\)is the first task containing failure classℱ\\mathcal\{F\}andtadapt​\(ℱ\)t\_\{\\text\{adapt\}\}\(\\mathcal\{F\}\)is the first task at which a committed repair forℱ\\mathcal\{F\}is installed \(or, on longer horizons, the first task where task\-level RFR forℱ\\mathcal\{F\}falls below 5%\)\. The released code records the commit\-based version in short horizons; the sustained\-improvement interpretation underlies Theorem[1](https://arxiv.org/html/2605.16309#Thmtheorem1)\.

Statistical testing:The current manuscript mixes single\-seed and 3\-seed evidence\. The travel baseline table is single\-seed; the direct\-comparison, recurring\-failure stress, e\-commerce stress, cross\-scenario, and ablation tables report 3\-seed means/std where stated; the governance\-activation suite is a fixed 6\-task counterfactual\. Formal significance testing is deferred to future work and should accompany any stronger generalization claims\.

### H\.4Per\-Failure Class Analysis

Table[9](https://arxiv.org/html/2605.16309#A8.T9)reports the observed learnability hierarchy\.

Table 9:Observed hierarchy of learnability in the verified runs\.Tool\-schema drift is the clearest successful patch target; several other failure classes are recovered by verification and local repair without a committed patch\. Some commerce failures remain unresolved within the current operator\-level edit space\.

## Appendix IAdditional Governance Notes

The full\-governance accepted patches in the current draft all pass value checks, causal checks, and canary testing, with zero observed rollbacks\. The governance\-off stress ablation is reported separately as a counterfactual deployment probe and should not be mixed with those full\-envelope statistics\. We omit model\-by\-model governance tables until reruns are available with matching artifact capture\.

## Appendix JSurgical Precision Analysis

The system demonstratesconservative, high\-confidence patch generationin the full\-governance runs: every accepted patch clears governance and remains rollback\-free \(Table[10](https://arxiv.org/html/2605.16309#A10.T10)\)\. In e\-commerce,Annealcommits 2\.7±\\pm0\.6 patches per run spanning three distinct edit categories \(schema updates, precondition additions, effect refinements\), each targeting a different operator\. This precision strategy indicates that FDKA triggers only when high\-confidence root\-cause diagnosis is achieved—not for every failure observed\.

Structural ratchet\.The versioned commit system acts as a structural ratchet: once a valid operator or tool\-schema update is installed, that specific failure mode becomes difficult to repeat without an explicit rollback or a new upstream change\. In the verified e\-commerce runs, three distinct ratchets engage per run: a schema update on the order\-placement operator \(API drift\), a precondition addition on the promo\-code operator \(field validation\), and an effect refinement on the shipping\-calculation operator \(timeout recovery\)\. This property contrasts with LLM\-Reflect, where the same error can recur on every new task instance since no structural knowledge is updated\.

Comparison with fine\-tuning\.Continual learning via fine\-tuning typically requires many gradient updates per task class\(Bellet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib24)\), and risks catastrophic forgetting of previously learned behaviors\.Annealinstead repairsstructural knowledge gapsthrough symbolic reasoning and governed commits\. We do not make strong cost\-ratio claims here because the current telemetry for token and latency accounting is incomplete in some scenarios\.

Table 10:Representative accepted patches\.Two verified examples from travel planning and ITSM, both tool\-schema repairs that passed the full governance pipeline with zero rollbacks\.
## Appendix KFuture Directions

Richer edit schemas and hierarchical learning\.The current proposal pipeline supports operator\-level edits only\. Extending to HTN\-level changes \(new operator templates, hierarchical decomposition rules, temporal constraints such as “actionaamust complete withinttseconds ofbb”\) would address the unresolved commerce failures in Table[9](https://arxiv.org/html/2605.16309#A8.T9)and increase expressiveness\(Kwonet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib11); Kwon and Kim,[2025](https://arxiv.org/html/2605.16309#bib.bib25)\)\. Techniques from program synthesis \(sketching, version space learning\) could expand the search over candidate patches while preserving deterministic parsing and typing\.

Scalable knowledge graph construction and maintenance\.LLM\-assisted extraction currently addresses value constraint \(𝒦​𝒢val\\mathcal\{KG\}^\{\\text\{val\}\}\) construction\. Extending to causal graphs \(𝒦​𝒢cau\\mathcal\{KG\}^\{\\text\{cau\}\}\) via embedding\-based completion and identifiability analysis would complete automated construction\(Jaiminiet al\.,[2024](https://arxiv.org/html/2605.16309#bib.bib14); Zhaoet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib29)\)\. Value graphs should support versioning, effective dates, and jurisdictional scoping as first\-class features\. Temporal logic frameworks \(LTL, CTL\) could formalize time\-dependent constraints beyond current conflict detection\.

Multi\-agent federated FDKA\.CurrentAnnealis single\-agent\. In multi\-agent settings \(multiple instances serving different users or organizations\), patches learned by one agent could benefit others\. Federated FDKA would aggregate patches across agents while preserving privacy: agents share privacy\-preserving provenance summaries and scoring distributions, not raw traces\(Julianet al\.,[2025](https://arxiv.org/html/2605.16309#bib.bib30)\)\. Conflict resolution is critical: if Agent A learns “corporate cards allowed on Mondays” and Agent B learns “corporate cards blocked on Mondays” \(due to different organizational policies\), the federation must detect incompatibility and maintain policy\-scoped patches rather than global rules\.

## Appendix LCross\-Scenario Matrix

Table[11](https://arxiv.org/html/2605.16309#A12.T11)summarizes the untuned 3\-seed behavior ofAnnealacross the reported scenarios\.

Table 11:Cross\-scenario behavior ofAnneal\(mean±\\pmstd over 3 seeds for untuned scenarios\)\. Travel domains are strong, e\-commerce demonstrates diverse patch types, and ITSM now also verifies as a stable untuned multi\-seed transfer domain\.
## Appendix MSingle\-Seed Baseline Comparison

Table[12](https://arxiv.org/html/2605.16309#A13.T12)gives the full single\-seed travel baseline used for the main\-text comparison\.

Table 12:Single\-seed baseline comparison\(travel planning, 25 tasks, seed=42\)\.Annealachieves 100% SR via structural adaptation: zero terminal repeat failures and 1 accepted patch\. Non\-adaptive baselines plateau at 30–49%; LLM\-Reflect \(GPT\-4o\-mini\) achieves 88% with 4% permanent failures; ReAct and Reflexion match 100% SR via intra\-episode retry but cannot suppress recurrence across tasks\. RFRobs\{\}\_\{\\text\{obs\}\}: repeat\-failure rate during recovery; RFRterm\{\}\_\{\\text\{term\}\}: terminal failures after all recovery;†\\dagger: persistent—no cross\-episode learning;‡\\ddagger: cross\-episode verbal buffer empty \(within\-episode recovery always succeeded\)\.†\\daggerReAct resolves each episode via intra\-episode retry; failurepatternspersist unchanged across episodes \(no knowledge update\)\.‡\\ddaggerReflexion’s cross\-episode verbal buffer remained empty in this run \(within\-episode recovery always succeeded\), collapsing to ReAct\-equivalent behaviour\.

## Appendix NFDKA Patch Example

This appendix shows one concrete governed patch from failure trace to accepted structural edit \(Figure[6](https://arxiv.org/html/2605.16309#A14.F6)\)\.

Compact ProposeEdit Record: Accepted Patch Exampleoperator:BookHotel edit type:ADD\_PRECONDITION patch body:not\_blocked\_card\(payment, dates\) scores:plausibility 0\.92; consistency 0\.85; utility 0\.89; risk 0\.15; aggregate 0\.87governance result:value allow; causal allow; canary 7/7 passcommit result:accepted with deterministic rollback capability

![Refer to caption](https://arxiv.org/html/2605.16309v1/x6.png)Figure 6:FDKA patch example\.A payment\-authorization failure \(PAY\-401\) on the hotel\-booking operator triggers synthesis of a blocked\-card precondition\. The box above lists the scoring breakdown and governance outcome; the figure shows the end\-to\-end pipeline from failure trace to committed edit\.
## Appendix OTravel Planning Walkthrough

Walkthrough Patch Summary: Before/After Operator ConstraintBefore patch PRE: hotel\_available\(city, dates\) payment\_method\_present\(card\)After patch PRE: hotel\_available\(city, dates\) payment\_method\_present\(card\) not\_blocked\_card\(card, dates\)This accepted edit inserts the blocked\-card check into the operator precondition, so replanning switches to a valid payment alternative instead of repeating the same failure\.

The full pipeline is illustrated in Figure[7](https://arxiv.org/html/2605.16309#A15.F7)\. A user requests:“Book a hotel in San Francisco for April 10–12 and a flight from Newark on April 10\.”

![Refer to caption](https://arxiv.org/html/2605.16309v1/x7.png)Figure 7:End\-to\-end FDKA walkthrough\.\(A\) Plan compilation\. \(B\) Policy\-violation failure\. \(C\) Localization: hotel\-booking operator \(r=0\.92r=0\.92\)\. \(D\) Patch proposal\. \(E\) Scoring yields 0\.838\. \(F\) Guardrails allow\. \(G\) 5/5 canary passes; commit \(ρ=0\.67\\rho=0\.67\)\. \(H\) Replan succeeds\. \(I\) Reflection updates trust \(ρ=0\.75\\rho=0\.75\)\. Total:<<2 minutes\.Failure\.The API returns a policy violation: corporate cards are blocked for April 10–15\. Trace:τt=⟨s0,BookHotel,Σt,ToolError⟩\\tau\_\{t\}=\\langle s\_\{0\},\\text\{BookHotel\},\\Sigma\_\{t\},\\text\{ToolError\}\\rangle\.

Localization\.The hotel\-booking operator scoresr=0\.92r=0\.92\(highest of 12 operators\) due to high symbolic delta and tool invocation match \(Eq\.[4](https://arxiv.org/html/2605.16309#S4.E4)\)\.

Scoring\.Plausibility \(Eq\.[11](https://arxiv.org/html/2605.16309#A5.E11)\): 0\.97\. Consistency \(Eq\.[12](https://arxiv.org/html/2605.16309#A5.E12)\): 1\.0 \(Z3 SAT confirmed\)\. Utility \(Eq\.[13](https://arxiv.org/html/2605.16309#A5.E13)\): 0\.8 \(16/20 traces prevented\)\. Risk \(Eq\.[14](https://arxiv.org/html/2605.16309#A5.E14)\): 0\.122\. Aggregate \(Eq\.[5](https://arxiv.org/html/2605.16309#S4.E5)\):0\.838\.

Guardrails\.Value \(Eq\.[6](https://arxiv.org/html/2605.16309#S4.E6)\): no Prohibited or Obligatory violations→\\toallowed\. Causal \(Eq\.[7](https://arxiv.org/html/2605.16309#S4.E7)\): identifiability 18/20, normalized impact 0\.20→\\toallowed\.

Canary & Commit\.CSR \(Eq\.[18](https://arxiv.org/html/2605.16309#A6.E18)\): 5/5 pass\. Trust \(Eq\.[20](https://arxiv.org/html/2605.16309#A6.E20)\):ρ0=0\.67\\rho\_\{0\}=0\.67\. Commit \(Eq\.[21](https://arxiv.org/html/2605.16309#A6.E21)\): edit key is a content\-addressed hash of the operator scope and predicate\.

Replan & Success\.The updated precondition \(blocked\-card check\) is detected during replanning; a personal card alternative is selected\. Execution succeeds\. Trust updates toρ=0\.75\\rho=0\.75\.Total: 1 minute 47 seconds\.