When the self-improving agent almost lost the host's work: a postmortem

On 2026-08-20, EMRG's own scheduled task inadvertently stashed the host's uncommitted edits twice before fixing the issue. This incident highlights the importance of considering what happens when autonomous coding agents run on a user's working directory with uncommitted changes. The answer most agents provide is "trust me," but this post demonstrates the lesson learned from that experience.

The incident occurred when EMRG's scheduled open-source task, operating in a designated project directory, tried to git stash before pulling. Running git stash on a live working tree hides the host's uncommitted changes, causing the host to lose their work. The host had to disable the task to protect their work, emphasizing the need for a safer design.

The solution was to rewrite the source-sync phase with an explicit invariant: a dirty working tree is normal, and the source directory should not be treated as a dedicated clone. Git commands that hide or discard uncommitted changes were prohibited. The cycle would now only run in read-only mode, scanning, reviewing, and updating state files without making any changes to the working directory. This design ensures that the agent cannot write when the host has uncommitted work, thus eliminating the risk of data loss.

The postmortem emphasizes the significance of this safety boundary, especially for self-modifying systems. A self-improving agent that doesn't respect the host's uncommitted work poses a significant risk. The incident serves as a cautionary tale for anyone wiring an autonomous agent into a repository they care about. The key questions to consider are:

1. Does the agent ever run destructive git commands on the working tree?

2. Is the safety rule structural or a prompt aspiration?

3. When the safety rule fails, is the failure documented with a traceable trigger, or is it silent?

EMRG experienced a failure in the first version of the test but quickly fixed it by adding a regression test and a commit that clearly documents what went wrong. This is the standard that self-improving agents should be held to – making mistakes visible, fixing them structurally, and leaving a trace of the incident. The guardrail is still in place, verified on 2026-08-25 against master 95a983e (v0.2.78).