feat: real subagent-driven skill self-evolution (Hermes-style), wired into core

[NagyVikt]

What & why

cue already ports NousResearch/hermes-agent-self-evolution into evolution/, but the loop was dormant: default-OFF, pilot-wired into skill-writer only, never run, and the automated path did a single claude -p rewrite + one text-diff judge with no iteration. This makes it real: a true writer→lint→critic loop, grounded in real usage, wired into core (still default-OFF).

What shipped (3 of the planned levers)

1. Writer→lint→critic loop (reflective.py, evolve_skill.py, config.py)
The single-shot optimizer — the path the Stop-hook loop actually runs — now iterates: the writer proposes a body, the cue gate lints it, an independent critic (a different/stronger model) judges it, and the writer retries with the lint errors and the critic's concrete fixes until BETTER or the round budget runs out (CUE_WRITER_LOOP_ROUNDS, default 2). propose_improved_body/judge_is_better kept as back-compat wrappers. Fail-soft: a claude -p outage degrades to a proposal, never crashes the unattended run.

2a. Task-grounded critic (reflective.py, evolve_skill.py)
When history exists, the loop runs the candidate skill as instructions on the most recent real user prompt that flagged this skill as a gap (mined from analytics.jsonl, DSPy-free) and feeds that transcript to the critic — so the rewrite is judged on real behaviour, not just prose. Best-effort: no history → text-only review.

3. Promote to core, default-OFF (profiles/core/profile.yaml, auto-evolve.sh)
Both self-learner Stop hooks (profile-self-improve.json capture + auto-evolve.json act) move from the skill-writer pilot into core. They exit 0 instantly when the flag files are absent, so this adds zero runtime cost until opt-in. Also fixes the auto-evolve.sh portability gap (it hard-coded ~/Documents/cue/evolution; now self-locates from the materialized hook symlink, CUE_EVOLUTION_DIR override preserved).

Deferred (documented in docs/self-evolution-upgrade-plan.md)

2b/2c — GEPA judge default + SubagentJudgeMetric. Cut on purpose: they touch only the manual GEPA path (the automated loop runs single-shot, never GEPA), and they can't be live-verified in the dev env (dspy import is broken — libstdc++.so.6). A naive default-flip would also put LLMJudge in GEPA's inner loop (~1200 calls/run). Exact change-points are recorded for a follow-up once dspy works. Stage 2a already delivers "judge real behaviour on mined tasks" for the path that runs.

How to enable (opt-in, propose-only)

cue telemetry enable                              # consent (already set on dev machine)
touch ~/.config/cue/.auto-improve-enabled         # capture skill_gap signals
touch ~/.config/cue/.auto-evolve-enabled          # allow evolution (propose-only)
# auto-apply stays OFF unless CUE_AUTO_EVOLVE_APPLY=1; 24h cooldown; canary auto-revert

Test plan

• evolution/tests: 95 passed / 2 skipped (skips = dspy-only seams; dspy broken in dev env). 17 new writer-loop/grounding tests incl. an evolve() single-shot integration test that exercises the real call site.
• src/lib/runtime-materializer.test.ts: 40 passed / 0 fail (hook materialization unaffected).
• cue validate core: schema-valid, 20 hooks resolved; flags-OFF = silent exit 0.
• Independent adversarial review (4 dimensions → verified): 1 CRITICAL found + fixed (propose_only kwarg TypeError at the real call site), HIGH/LOW test gaps closed.
• CI is the gate for the full TS suite (won't complete locally — validate/e2e do slow submodule/registry resolution).

🤖 Generated with Claude Code