How Cordis Enables Self‑Evolving Agents to Hot‑Swap Without Downtime

When an AI agent rewrites its own code and crashes, traditional rollback mechanisms fail, and a full restart would lose all accumulated state. Most existing AI‑agent frameworks cannot guarantee safe hot‑replacement of components.

Cordis is the underlying mechanism of DeepSeek Harness that solves the "install‑plugin‑uninstall‑no‑residue" problem. It allows dozens or hundreds of inter‑dependent plugins to be hot‑replaced while preserving correct system state and dependency links—something previously unattained.

The difficulty stems from the fact that an agent is a live system: changing component A may alter its interface, breaking component B that depends on it. Static analysis cannot handle this dynamic dependency graph, and conventional module hot‑patching either requires hand‑written migration functions or only supports function‑level patches, not full component interface changes.

Mathematically, Cordis treats each modification as a function f and records a left‑inverse g such that g∘f = id. Only a left inverse is needed because rollback concerns the specific change, not arbitrary states. Composite operations obtain their inverse by reversing the order of the individual inverses, e.g., installing A then B is undone by undoing B then A. For operations whose inverse depends on the current state, Cordis generates a dynamic inverse that incorporates the state at execution time.

Dependency cycles are handled by a two‑stage rollback: the provider of a key stops offering it, triggering dependent components to unload before the provider itself performs its own cleanup. If a cycle makes simultaneous satisfaction impossible, the system aborts loading and reports an error, preventing deadlock.

All effects and side‑effects run within a unified context Γ∞ = μΓ. Γ × (Γ → Γ) × Σ, comprising the current state, the accumulated undo chain, and the dependency table. Independent effects commute, allowing arbitrary ordering, while effects on the same key are ordered according to their algebraic structure.

Implementation-wise, Cordis exposes a ctx.effect function. Every operation—registering a dependency, modifying configuration, launching a sub‑component—is wrapped in ctx.effect, which returns a dispose closure that reverses the entire effect. The framework maintains a fiber‑based lifecycle state machine (INACTIVE, LOADING, ACTIVE, UNLOADING, FAILED) driven by a refresh loop; any change in the dependency table triggers recomputation of the affected fibers' target views.

Declarative configuration enables hot module replacement without developer‑written module.hot.accept code. When a config file changes, Cordis computes the diff, unloads only the impacted components, and reloads them transactionally—if the new load fails, the system automatically rolls back to the previous state.

Cordis proved its robustness in the open‑source Koishi chatbot framework, running for four years with over 4,000 community plugins, never experiencing a global crash due to dependency resolution errors. DeepSeek Harness adopted Cordis for LLM‑generated tool plugins, allowing new tools to be loaded and old versions to be unloaded while all dependent skills update automatically, achieving truly uninterrupted service.

The design closes a missing chapter in the "physics of program worlds" by turning abstract mathematical undo semantics into a practical, production‑grade runtime.