White paper
The body that makes any model useful.
Models are heads in jars. Perslis is the harness, shell, and loop that gives intelligence a body — and the symbolic guardrails that let it thrive. Part II proves it from the binary.
The last three years poured almost all of their effort into one variable: model intelligence. That variable is now abundant and commoditized — many labs ship near-frontier reasoning. Yet intelligence alone does not do operational work. A model with no body cannot perceive a system, act on it, remember, recover from failure, or prove a result. This paper argues that the binding constraint has moved from intelligence to embodiment: the harness, shell, and loop around a model. We describe Perslis, a model-agnostic operational runtime that supplies that body — a research-to-deploy loop, a symbolic guardrail layer we call the Captain, a persistent-memory evolution system, and a verification-first contract for "done." Then, in Part II, we prove the thesis on the hardest possible substrate — dead legacy binaries — with a self-evolving compatibility engine, and we label every claim by how it was earned.
PART I — The thesis
1 · The thesis: intelligence is no longer the bottleneck
Ask a frontier model to change a production system and it will answer confidently — and it will be, on its own, unable to do a single thing about it. It cannot read the files, run the code, observe what broke, remember what it decided yesterday, or touch the machine that matters. This is not a small gap to be closed by a smarter model. It is a categorical one: a mind without a body produces opinions, not outcomes.
We put it plainly: a model is a head in a jar. Brilliant, conscious, and helpless. The work of turning that intelligence into reliable action — perception, action, memory, coordination, and proof — is the body's work, and almost none of it is model IQ. A slightly weaker head in a strong body outperforms a genius in a jar on every real task, because real tasks are repetitive, operational, and unforgiving, the way a human job done by hand every day is unforgiving.
2 · Related direction: self-improving agents
The frontier has begun to notice that the agent around the model is where the leverage is. Sakana AI's Darwin Gödel Machine demonstrates agents that rewrite and empirically improve their own code, evolving a lineage of better coding agents over time [Sakana AI, "Darwin Gödel Machine," 2025]. We read that work as strong evidence for the same claim from a different angle: durable capability comes from the operating system around the model — its ability to act, evaluate, and adapt — not from the weights alone. Perslis takes the complementary position. Rather than evolving a single self-modifying agent, it is the runtime that any model plugs into, that evolves around its operator, and that holds every action to a symbolic contract before it ships.
3 · The loop: from intent to deployed outcome
The body's spine is a loop that turns a plain-language goal into a proven result. You direct; the model, inside the runtime, executes across eight stages:
Research
Discover how the system really behaves before touching it.
Plan
Turn the outcome into an ordered, inspectable approach.
Analyze
Weigh options, risks, and fit against the real project.
Decide
Judge correctness — verification-first, not trust-first.
Build
Make the change against the real system.
Test
Run it; prove the result holds.
Deploy
Ship the verified outcome; keep it operational.
Connect
Wire legacy systems to modern API applications.
Figure 1 — The operational loop. Failures and new evidence loop back into the plan rather than ending the run.
The division of labor is the point: the operator owns judgment (what to build, whether it's right), the runtime owns execution (research, build, test, deploy) — and neither pretends to be the other. This is what lets a person operate at the altitude of an architect rather than a code monkey.
4 · Symbolic guardrails: the Captain
A probabilistic model produces the most likely-looking answer, which is sometimes confidently wrong. Trusting that answer is how bad decisions ship. Perslis places a symbolic layer between proposal and result — the Captain — that only ever says yes when a claim actually holds.
- Rules & facts: the Captain encodes what must be true — invariants, constraints, contracts, and established facts about your systems — as checkable logic rather than prose.
- Grounded verdicts: a decision carries a verdict bound to evidence — the tests that ran, the invariants that held, the contradictions searched for and not found. Absent evidence, the verdict is not proven, which the runtime treats very differently from fine.
- Neural proposes, symbolic disposes: the model handles the open-ended part; the Captain gates the part that has to be right. When they disagree, Perslis does not ship.
The same symbolic muscle powers legacy reconstruction. A 32-bit Windows binary is a PE32 file; Perslis parses its headers, rebuilds the import tree and call-graph, resolves each imported API, and reconstructs the program's expected environment — a symbolic model of a binary nobody documented, produced before a single instruction is trusted to run. Guardrails and understanding are the same discipline: establish what is true, symbolically, then act.
5 · Evolution: the body learns its operator
A stock model is identical for everyone and forgets you when the session ends. Perslis accumulates a persistent memory of your systems and decisions, tunes its own planning and routing based on what actually worked, and lets its defaults drift toward how you operate. Two operators running Perslis for a month hold two measurably different runtimes. The model can be swapped for a better one tomorrow; the accumulated fit between runtime and operator cannot — it is earned over hundreds of decisions and compounds.
6 · Model-agnostic orchestration
Because Perslis is the body and not the head, it is indifferent to which head it wears. It routes each step to the model best suited to it — by capability, cost, latency, or privacy — across OpenAI, Anthropic, Google, Qwen, DeepSeek, or a local model. We do not compete with model providers; we orchestrate them. A better model appearing tomorrow is an upgrade Perslis absorbs without an architecture change. The bet is on interoperability, not on any one head winning forever.
7 · Safety: fail-closed by construction
Autonomy and safety are usually traded off; Perslis separates them. The freedom is in decisions; the blast radius is fixed at permissions. Every action runs under deny-by-default host control inside an OS sandbox, and reversibility-classified operations are checked before they execute. Autonomy — up to full YOLO mode — raises how much the runtime decides on its own, never how much it is allowed to touch. On uncertainty, the default is no.
Part I is the argument. The rest of this paper is the evidence — the same body, applied to the least forgiving substrate there is, with every claim labelled by how it was earned.
Part II — The proof · kist × Perslis technical report
Proof Is the Product
Routing, repairing, and verifying legacy software from the binary — a self-evolving compatibility engine that perceives, diagnoses, fixes, verifies, and learns, where the rest of the field only looks up.
Observed from a real command run or a passing test on this machine. Cited to a command, commit, or artifact.
Built and demonstrated to a point, but not yet unattended. The boundary is stated explicitly.
A schematic to explain structure. Not a claim of a working result.
8 · The wedge: the field looks up. It never looks in.
Take apart the automation in every mainstream compatibility tool and you find the same mechanism. protonfixes maps a Steam AppID to a Python module and runs it; success means the module imported without throwing. winetricks ships 556 declarative verbs, each a pinned URL and SHA — the richest fix vocabulary in the industry, and entirely static. Lutris and Bottles curate human-written install scripts. GOG pre-patches per title by hand. New mappings arrive only as git pull requests. measured — mechanism-level teardown, 2026-07-07.
This is not a complaint about those projects — they are excellent, and their curated data is exactly what we ingest. It is an observation about a capability boundary that the whole field sits behind. The contribution here is to cross it, and to prove the crossing rather than assert it.
9 · One loop, six stages, grounded in the bytes
The system is a Darwin–Gödel-style engine: it does not just apply fixes, it accumulates a self-evolving archive of which fix worked for which failure signature, and it selects on measured fitness. The loop is the whole product.
Figure 2 — The loop. Verify is the load-bearing stage: a fix counts only when a captured frame is non-black by luminance, not when a process exits zero. Every outcome becomes a fitness-weighted trial in a self-evolving archive. measured — each stage maps to a live CLI command.
| Stage | What it does | Implementation |
|---|---|---|
| Perceive | Reconstruct a stripped binary's architecture from the binary itself — header class (MZ/PE/NE/LE), import dependency tree, sections, and a capstone call-graph trace-back to key OS APIs. | map + compatScanImports |
| Route | From the fingerprint alone, pick a runtime tier: NE→unwrap, DOS/LE→DOSBox-X, Glide→Win98-VM, legacy-D3D→wine+dgVoodoo2, DDraw-only→cnc-ddraw, modern-D3D→wine+DXVK. | compat-route |
| Diagnose | Turn a crash log + display probe into a failure signature, then match it to a remediation rule. | compat-diagnose |
| Fix | Compile a rule into a runnable, exec+argv plan — no shell — with resolved, guarded shim assets. | compat-apply / compat-autofix |
| Verify | Re-launch supervised; a fix counts only if the display actually maps and renders — checked by luminance on a captured frame, not an exit code. | liveWineRerun + compatProbeDisplay |
| Learn | Every fix application is an empirical trial; Laplace-smoothed fitness drives selection; failed rules are kept as stepping-stones that can breed variants. | recordCompatTrial + compatFitness |
10 · Evidence, tagged
compat-autofix --execute took a broken Heavy Gear runtime, read glide2x.dll not found from its own launch, deployed the dgVoodoo2 glide2x wrapper, re-launched, verified the display, and recorded a worked trial — with no human in the loop. measured. Boundary: this is the wine tier; the same game's 3D-mission wall is not solved under wine and needs the VM tier.
The hardware-3D wall, proven three ways
For Final Fantasy VII, the capstone call-graph trace-back independently re-derived the initialisation path — sub_402275 reads the registry keys and calls sub_41CD14, which calls DirectDrawCreate. The same dependency was confirmed by three independent readings of the binary: the strings, the import table, and the reconstructed call graph. measured — perslis map (capstone + graphviz). Perception is grounded in the bytes, not a title lookup; a route is trustworthy precisely when three independent readings agree.
Figure 3 — Triangulation. The FF7 hardware-3D dependency reached three independent ways. The call-graph path was re-derived by the trace-back, not read from a database.
pefile, capstone, and graphviz are commodity third-party oracles — the same relationship the COBOL vertical has with GnuCOBOL. We do not claim to have written a disassembler. We claim to have built the agent that uses one to decide, fix, verify, and learn.
11 · The field, side by side
Read from each project's source, not its marketing. The columns are the four things that separate a loop from a lookup.
| System | Route from binary | Diagnose failure | Verify fix | Learn mapping |
|---|---|---|---|---|
| kist × Perslis | ● | ● | ● | ● |
| protonfixes / umu | — | — | — | — |
| winetricks | — | — | — | — |
| Lutris | — | — | — | — |
| Bottles | — | — | — | — |
| GOG | — | — | — | — |
12 · Adversarial review
The fix path executes real commands on real media. It has been through multiple Codex stop-gates and a 4-model council (Codex + Grok + DeepSeek). Codex repeatedly caught the bug the others missed. The load-bearing findings:
- HIGH
compatStageFromPathfed a provider script's shell-string staging commands to a naive splitter; a/Volumespath emittedrm -rf X && mkdir Y && find…|cpio…, whose unparsed&&turned staging roots into literal operands of/bin/rm— a delete-outside-workspace on writable media. Fixed: fail-closed rejection of shell control operators, plus an exec allowlist (rm excluded). - HIGH
legacy_appallowlist-checked only absolute paths, so a relative../../etc/xescaped. Fixed: reject any..component; map output viaConfinedRoot; fail-closed on non-canonicalizable roots. - MED
compatLaunchDetachedreported success onpid > 0, so a crash-on-start legacy runtime process faked "launched." Fixed: settle, then require the process is still running.
Every subprocess in the fix path is exec+argv — no shell. Writes stay confined to the project root by construction; external roots (mounted media) are read-only. The review gate is on. measured — each finding traces to a specific commit and a regression test.
13 · Limitations, without softening
- prototype VM (T2) tier boots but does not yet self-install. The Win98 escalation stages a copy-on-write overlay and boots a real guest under private Perslis control, fail-closed on any unknown tier — but it does not yet drive the in-guest installer unattended. Escalation to an unavailable tier returns
launched=falsewith a reason and stops; it never fakes a fix. - measured 3Dfx/Glide on Apple Silicon is CPU-bound under wine. The durable path is the Perslis accelerated legacy graphics runtime, gated on a golden VM image and not yet built. Routing Glide→OpenGL on ARM is a known dead end, and the router explicitly avoids it.
- measured Thin where the field is thick. ~11 rules against winetricks' 556 verbs, ~12 curated titles against thousands. The moat is the loop; the gap is their data — and 469 verbs are already parsed and addressable. Corpus ingestion is the closing move.
This section exists because a label is worthless the moment it is aspirational. The system is PILOT-READY: the wine-tier loop is measured; the VM tier is a booting prototype; the corpus is small. Those are the three things between here and the next tier, named so they can be closed.
Conclusion
The industry optimized the head and left the body behind. But operational reliability — the thing enterprises actually buy — is a body problem: perception, action, memory, coordination, and proof, held together by a loop and bounded by symbolic guardrails. Part I made that argument; Part II proved it on dead binaries nobody else can route, diagnose, verify, or learn from. Perslis ships no model and competes with none. It takes whatever intelligence is best today, gives it hands and a memory and a conscience, and turns it into work you can depend on. The heads will keep getting smarter. They will still need a body.
References & citation
- Zhang et al., "Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents," 2025 — arxiv.org/abs/2505.22954. (After Schmidhuber's Gödel Machine; see also Sakana AI.)
- Open-Wine-Components / umu-protonfixes — per-AppID Python compatibility fixes.
- Winetricks — declarative w_metadata verbs with pinned URL+SHA.
- Lutris — community-authored install scripts.
- Bottles — curated dependency programs for wine prefixes.
- dgVoodoo2 — Glide / DirectX 1–9 to Direct3D 11 wrapper.
- cnc-ddraw — DirectDraw replacement.
- Capstone — disassembly framework; pefile — PE parsing.