自己進化でも本体を勝手に書き換えない：AMA-terasのworktree隔離と岩戸ゲートAMA-teras isolates AI-generated self-improvement code in a git worktree and…

AMA-teras is an experimental autonomous-agent architecture, described in a Zenn blog post, that lets an AI model generate improvements to its own codebase while deliberately preventing that code from taking effect without a checkpoint. The project matters because it addresses one of the more difficult practical problems in agentic AI: how to allow a system to evolve continuously without letting it silently rewrite the core it is running on. Rather than treating self-improvement as a purely open-ended loop, AMA-teras frames it as a pipeline with a mandatory gate.

The central design choice is to separate where code is written from where code runs. When the agent produces self-improvement code, that code is committed into a git worktree instead of being applied directly to the main branch. In Git, a worktree is a standard feature that lets a single repository check out multiple branches into separate directories at the same time, each with its own working state but sharing the same underlying object database. This means an agent can experiment freely in an isolated directory, run tests, and iterate, all without touching the files that define the live system. If a generated change is flawed or unsafe, it stays quarantined in the worktree and never reaches the branch the running agent depends on.

The second component is what the author calls the "岩戸ゲート" or Iwato Gate, an explicit approval step that must be cleared before any worktree changes are merged into the main branch. The name references the Ama-no-Iwato myth, the heavenly rock cave from which the sun goddess Amaterasu emerged, fitting the project's broader mythological theming. Functionally, the gate acts as a human-in-the-loop or policy checkpoint: self-generated code accumulates on the isolated side of the gate, and only a deliberate approval action moves it across into the code that governs the agent. The stated goal is to keep continuous evolution possible while making unauthorized self-modification structurally difficult rather than merely discouraged.

This approach reflects a broader concern in AI safety about self-modifying or recursively self-improving systems. A recurring worry is that an autonomous agent granted write access to its own logic could alter its behavior, remove its own guardrails, or introduce regressions faster than an operator can review them. AMA-teras appears to address this not by forbidding self-improvement outright, but by controlling the merge path, which is the point where generated code becomes operative. Isolating changes in a worktree and requiring an approval gate turns a potentially unbounded loop into a reviewable series of proposals. It is worth noting that the security of this arrangement depends on the agent not having the ability to bypass the gate directly, for example by writing to the main branch through other means, so the enforcement boundary matters as much as the concept.

The design sits alongside a wave of coding-oriented agents and frameworks. Tools such as Claude Code, on whose ecosystem this project is based, along with SWE-agent, Devin, and various open-source AutoGPT-style loops, have made it routine for models to read repositories, edit files, and run commands. Git worktrees have separately gained popularity as a way to run several agent sessions or experiments in parallel without conflicting checkouts, so AMA-teras builds on an increasingly common pattern rather than inventing one. Related safety practices include sandboxing agent execution, restricting file-system and network permissions, and requiring pull-request review before merges, all of which aim to keep a deliberate boundary between what an agent proposes and what actually runs.

For readers evaluating the idea, a few prerequisites help. Understanding branches, merges, and worktrees clarifies why isolation is cheap and reversible in Git. Understanding the concept of human-in-the-loop control clarifies what the gate is meant to guarantee and what it cannot: a gate reduces the risk of unreviewed changes, but the quality of review still determines whether harmful code is caught.

As a design pattern, AMA-teras is a concrete, reproducible way to bound self-improving agents using existing version-control primitives rather than novel infrastructure. It is presented as an architecture rather than a formal safety proof, so its effectiveness likely depends on implementation details, the rigor of the approval step, and whether the isolation boundary holds under adversarial or buggy behavior. Still, the pattern of quarantine plus explicit approval offers a pragmatic template that other autonomous-agent projects could adopt.