Origin report verification

Type: agentic-system-analyses/types/agentic-system-verification.md

Verification

The pinned reports support a bounded implementation account. The previous runtime blocker is repaired: ordinary and candidate-source refresh no longer inherit the forced-rebuild incarnation guarantee. No remaining material defect was established.

I read the complete pinned reports, annotations, correction answers, structural check, previous verification and governing contracts. The runtime answer argues a branch-specific repair; the other answer files are empty. The structural check reports none. I judged the current findings rather than treating either that check or the previous verifier's conclusions as source verification. I independently checked SRC-1's HEAD and clean working tree against the boundary, enumerated the top-level tracked tree, searched source dependencies and read selected implementation ranges. No target code, tests, providers or services were executed. All added source checks below concern implementation or attributed doctrine/design at the frozen commit, not observed operation or causal benefit.

I assessed every declared record and annotation for meaning, source support and evidence strength, including the explicit Part of: relations and reconciliation's identity dispositions. The grouped account below identifies the consequential checks. It is not a full audit of every branch of each source module. Quotations already retained in cited records supply the minimum passages; the resolved runtime objection has an additional decisive passage below.

Runtime correction and dependent workflow

RT-RTE-page-refresh now correctly separates the captured fence from the arguments actually enforced by each terminal write. I followed SRC-1, crates/wenlan-core/src/synthesis/distill.rs, into crates/wenlan-core/src/post_write/page_dispatch.rs, crates/wenlan-core/src/post_write/page_update.rs and the terminal operations in crates/wenlan-core/src/db.rs. UserForced without candidate sources selects the forced write with source revision and incarnation. The ordinary/candidate-source branch selects the source-revision wrapper without that incarnation. The page-update implementation refuses a non-forced incarnation fence and dispatches to different database methods. Summary maintenance also separates forced incarnation-fenced and ordinary updates; discard markers carry the full captured fence.

let user_forced_write = reason == RefreshReason::UserForced && candidate_sources.is_none(); --- crates/wenlan-core/src/synthesis/distill.rs

The record's opening, invalidation and evidence-limit fields, the third forcing case and the runtime coverage account now agree on that scope. The revised wording does not claim that a source counter detects deletion/recreation under a reused ID with matching counters. This disposes of the earlier blocker without weakening forced-rebuild protection or the lexical admission finding.

The dependent WF-RTE-rebuild-request, WF-BAP-rebuild-skill and workflow annotation on refresh remain supported. Their selected workflow is explicitly forced and does not supply candidate sources. SRC-1, crates/wenlan-server/src/routes.rs and crates/wenlan-mcp/src/tools.rs connect the request to shared refresh and return wrote as updated, with a reason only for discard. Gate/card/acknowledgement details and page prose do not travel in that receipt. The workflow therefore preserves the ambiguity of an unchanged result and does not mistake a receipt for page delivery. plugin/skills/distill/SKILL.md requests confirmation and verbatim reporting; it does not establish API-enforced consent. The reconciliation now explicitly preserves the repaired branch distinction. Its dependent findings do not require the withdrawn universal guarantee.

Runtime admission, scheduling and delivery

RT-RTE-capture-store, RT-CLM-ambient-ownership and EPI-RTE-quality-check distinguish capture admission/storage from deferred organization. Source checks in SRC-1, crates/wenlan-server/src/memory_routes.rs and crates/wenlan-core/src/quality_gate.rs support selective reduced-trust supersession staging, full trust for an unidentified first-party write, fail-closed fallback admission and configuration-dependent quality checking. The gate's disabled branch prevents an unconditional quality guarantee. None of these predicates authenticates human intent or assesses source truth. Quality checking is a valid part of capture, not a duplicate durable-store route.

RT-RTE-ambient-work correctly scopes its call bound to shared provider facades in an automatic slice. SRC-1, crates/wenlan-server/src/scheduler.rs supplies the atomic counter, phase ownership, progress persistence and filesystem-watcher call. crates/wenlan-server/src/main/runtime.rs independently owns truth promotion, while crates/wenlan-server/src/routes.rs supplies foreground selection. These shipped callers are included, not excluded enclosing applications. Neither the runtime nor reconciliation now generalizes one facade's bound to every daemon inference.

RT-RTE-filesystem-edit is a distinct admission surface. SRC-1, crates/wenlan-core/src/sources/page_watcher.rs checks projection version and unique identity, then uses source-preserving fs_edit updates. The report correctly separates externally supplied prose from synthesis admission and does not equate filesystem access with authenticated human authorship.

RT-RTE-recall-search, its memory annotation and RT-BAP-recall-skill preserve selection before delivery. SRC-1, crates/wenlan-server/src/memory_routes.rs partitions results, logs accesses and filters supplemental page references. crates/wenlan-mcp/src/tools.rs projects standard hits without separate source text, structured fields or summary. These omitted fields cannot silently provide warrant to the receiving agent. The skill's relevance judgment remains requested host behavior, not an enforced server gate or evidence of changed answers.

RT-RTE-remote-query scopes refusal to the selected MCP surface. SRC-1, crates/wenlan-mcp/src/tools.rs checks query-only and local-only refusal before dispatch; crates/wenlan-mcp/src/main.rs rejects query-only no-auth startup and checks scope. relay/src/worker.ts connects OAuth forwarding, reverse-device routing and reconstructed headers. These checks support wiring, not complete helper correctness or deployed isolation. Direct daemon and filesystem paths remain alternate surfaces outside the MCP profile guarantee.

Retained parts, updates and later consumers

MEM-OBJ-memories, MEM-OBJ-episode-rows and MEM-OBJ-fact-children have distinct operative roles. SRC-1, crates/wenlan-core/src/db.rs supports prose/control fields, optional redacted episode co-writes, base-channel episode exclusion, fact-child parent rehydration and optional deep channels. These are not duplicate outer capture/recall routes or an assertion of uniform server admission for core writers.

MEM-OBJ-summary-nodes and MEM-RTE-summary-rollup describe separate stored outputs and transformation/reuse. SRC-1, crates/wenlan-core/src/refinery/summary.rs clears/rebuilds nodes, derives root text from bucket titles and applies lexical/fallback admission. crates/wenlan-core/src/db.rs places selected prelude rows before ordinary results. The report preserves opt-in consumption, source associations rather than full reasons, and the absence of a demonstrated atomic whole-rebuild replacement.

MEM-RTE-enrichment-slices and MEM-RTE-burst-recaps distinguish derived fields from summary-plus-context retention. SRC-1, crates/wenlan-core/src/ingest.rs and crates/wenlan-core/src/post_ingest.rs support capped classification context and bounded retry receipts. crates/wenlan-core/src/synthesis/recaps.rs retains raw context separately from generated summary and supplies source IDs; crates/wenlan-core/src/synthesis/decision_logs.rs is the related decision aggregation path. Standard MCP's omitted summary field materially qualifies later delivery. These routes and rollup are valid stage-specific parts of ambient work, not duplicate schedulers.

MEM-RTE-import-inputs keeps acquisition separate from later distillation. SRC-1, crates/wenlan-core/src/chat_import/mod.rs constructs paired user/assistant content; crates/wenlan-core/src/chat_import/bulk_ingest.rs flushes raw-import batches. Searches in crates/wenlan-server/src/source_routes.rs also locate directory mtime/hash, queue, rename and deletion handling beyond ordinary store admission. The report does not deny those operations: it withholds a fully traced deletion-propagation/fidelity account. Its mixed-origin and partial downstream-lineage conclusions remain supported.

MEM-OBJ-space-brief and MEM-RTE-brief-handoff establish a non-ranked current-work snapshot. SRC-1, crates/wenlan-core/src/db/brief.rs handles operation digests, exact IDs, expected versions and conflicts. crates/wenlan-server/src/brief_routes.rs reloads the Space snapshot and optionally adds separately selected related context. crates/wenlan-server/src/outbox.rs resets the summary's expected version on replay, a weaker boundary than online snapshot CAS. plugin/skills/handoff/SKILL.md identifies the Markdown receipt as one-way and requests ordinary updates without further approval. Those instructions do not demonstrate host compliance or make the chronological log an automatic later input.

MEM-OBJ-revision-cards, MEM-RTE-review-decisions and EPI-RTE-refinement-decision retain different terminal effects. SRC-1, crates/wenlan-core/src/post_write/page_revision.rs resolves manufactured cards first and deletes dismissed cards. crates/wenlan-core/src/db.rs clears supersession on ordinary revision dismissal rather than deleting that capture. crates/wenlan-core/src/synthesis/refinement_queue.rs acknowledges contradiction without mutating either fact and refuses deprecated unsupported accept actions. Card containment in refresh is valid; broader review and refinement dispatch overlap without being identical. Review instructions are not authenticated consent or a universal substantive truth criterion.

MEM-OBJ-access-state and MEM-RTE-withdrawal-cleanup keep access logs separate from count/time fields, decay and soft eviction. SRC-1, crates/wenlan-core/src/db.rs supports recoverable eviction and dependency staleness rather than synchronous erasure of every derived sentence. Caller searches across crates, app/src, src, shipped plugins and scripts located count-flush definition/test uses, not the missing ordinary recall-to-count chain. This supports the bounded attribution gap, not a system-wide absence of adaptive retention.

MEM-RTE-eval-compression has a concrete evaluator consumer. SRC-1, crates/wenlan-core/src/retrieval/compress.rs falls back on disabled/error/timeout/empty paths; crates/wenlan-core/src/eval/answer_quality.rs supplies returned text to the answer request. The same scoped caller search did not establish a production recall consumer. Comments about shared production use do not defeat the report's implementation uncertainty. Nonempty output is not a faithfulness check, and request-local compression is not demonstrated retained checkpoint or host transcript compaction.

Model guidance and epistemic authority

The six runtime component records—RT-CMP-text-embedding, RT-CMP-cross-encoder-reranker, RT-CMP-on-device-provider, RT-CMP-api-provider, RT-CMP-openai-compatible-provider and RT-CMP-claude-cli-provider—separate inference integration from uninspected provider internals and deployed model choices. SRC-1, crates/wenlan-core/src/db.rs, crates/wenlan-core/src/reranker.rs and crates/wenlan-core/src/llm_provider.rs support the loader, constructor, endpoint and request distinctions. Snapshot-derived on-device versions are not global repository-pinned deployed weights; remote aliases do not establish immutable internals. No inspected adapter implements training.

RT-OBJ-prompt-registry, RT-RTE-prompt-override, RT-BAP-task-prompts and the memory annotation correctly separate durable configurable guidance from accumulated experience. SRC-1, crates/wenlan-core/src/prompts/mod.rs admits readable nonempty overrides with selected aliases; crates/wenlan-core/src/synthesis/distill.rs supplies guidance and capped snippets to inference. Neither establishes feedback-driven authorship, obedience or successful improvement.

EPI-OBJ-page-citation, EPI-RTE-citation-check and EPI-RTE-citation-admission are valid output/check/disposition parts of refresh. SRC-1, crates/wenlan-core/src/citations.rs, crates/wenlan-core/src/faithfulness.rs and crates/wenlan-core/src/synthesis/distill.rs support the token filter, bidirectional overlap, paragraph fallback and occurrence-count admission. The negation example is a valid implementation deduction, not an executed experiment. Removing an invalid marker does not remove the associated prose. EPI-RTE-citation-backfill instead preserves marker-stripped normalized text before annotation; its preservation guard and fenced writes do not license changing claims or establish semantic equivalence outside that domain.

EPI-OBJ-derived-claim, EPI-OBJ-page-truth, EPI-RTE-claim-extraction, EPI-RTE-claim-judgment, EPI-RTE-support-publish and EPI-RTE-support-withdrawal support the separate later acceptance architecture. SRC-1, crates/wenlan-core/src/claim_judge.rs requests entailment and validates exact IDs/finite scores. crates/wenlan-core/src/db/claim_derivation.rs bounds inventories and eligible policy, distinguishes incomplete/unresolvable runs from refutation, recomputes publication inside the transaction and separates support from human review. Demotion clears prior warrant and requests rechecking without asserting the opposite proposition. Evidence-consuming support acceptance is implemented, but source truth, semantic accuracy and an actual accepted ampliative claim are not established.

EPI-RTE-truth-exposure, EPI-RTE-page-attestation and EPI-RTE-truth-cutover preserve materially different authority changes. SRC-1, crates/wenlan-core/src/truth_contract.rs permits generation-zero pass-through, human override, unevaluated visibility and bounded named-page inspection. crates/wenlan-core/src/truth_adapter.rs supplies prose-reduction controls; crates/wenlan-core/src/db/presence_review.rs binds the separate review mark to version/digest and nonce. crates/wenlan-server/src/cmd_cutover.rs requires stopped service, matching dry run and confirmation before regime advancement. These are not source-truth certificates, proof of actual human review, or evidence of deployed activation.

EPI-OBJ-lint-report, EPI-OBJ-repair-manifest, EPI-RTE-lint-assessment, EPI-RTE-repair-admission and EPI-RTE-repair-verification distinguish advisory diagnostics, bounded mutation authorization and postcondition checking. SRC-1, crates/wenlan-core/src/lint/semantic.rs retains evidence/counterevidence and Advisory force; crates/wenlan-core/src/repair.rs checks approved manifest digest and verification reports, then publishes completion before clearing pending linkage. These mechanisms support the bounded account, not universal rollback or global factual acceptance. EPI-RTE-retrieval-eval instead scores seeded relevance references in isolated databases: SRC-1, crates/wenlan-core/src/eval/runner.rs. Neither report claims those scores automatically rewrite production policy.

EPI-CLM-notes-change, EPI-CLM-reviewed-repair and EPI-CLM-entailment-judge accurately attribute doctrine. SRC-1, README.md explicitly labels its improvement illustration as neither customer results nor an automated test; crates/wenlan-core/src/claim_judge.rs requests semantic judgment without proving its accuracy. The bounded conclusion appropriately withholds exercised learning, self-improvement and theory-building conclusions without bundling them into a system-complete architectural negative.

Reconciliation and omission-search stopping decision

The reconciliation retains valid containers and parts, makes no supersession amendment, and declares no unresolved cross-report conflict. I checked its apparent tensions: scheduler versus independent truth worker; lexical admission versus later entailment judgment; internal refresh outcome versus reduced receipt; ordinary dismissal versus card deletion; and partial memory-lens inspection versus positive epistemic findings. These differ in scope, timing or consumer, rather than contradicting each other. Its dispositions preserve all six memory integration issues and the corrected refresh guarantee. No conflict requires an unsupported stronger status or a missing part to be silently supplied.

Omission questions were selected from the frozen tree, shipped alternate callers and producer/consumer dependencies, not only the listed anchors:

• Could an alternate write branch invalidate the page-recreation guarantee? Following dispatch to distinct database arguments confirms the repair, including the candidate-source alternative, discard marker and summary branches.
• Could another shipped inference owner invalidate the scheduler or lexical-only account? The independent truth worker and foreground rebuild are included and already distinguished. No universal scheduler budget or lexical-only system conclusion remains.
• Could reuse bypass ranked search, or lose retained evidence before delivery? Brief reads/outbox replay, deep episode/fact/summary channels and MCP projection preserve the report's non-search route and delivery qualifications.
• Could logs or a helper establish production adaptation/compaction? The expanded caller searches support only the recorded bounded gaps. They do not establish absent mechanisms across all possible invocation styles.
• Could alternate source and repair writers defeat a universal admission or withdrawal claim? Directory queue/deletion handling, revision dispatch and manifest-bound repair are real included alternatives. The reports already describe mechanism-specific admission and explicitly partial lineage/invalidation inventories, not one universal gate or complete retraction guarantee.

Further optional expansion stopped because these central questions have supported dispositions, the known concurrency challenge is repaired, and no identified material challenge remains undisposed. Detailed graph/vocabulary operations, complete import distillation, all UI/relay helpers, every writer and full provider internals remain outside completed inspection. The reports already withhold complete route, permission, lineage, semantic-withdrawal and client-parity comparisons. Additional artifacts alone would not justify treating these faithful scope qualifications as defects or inventing absence findings. No separate unresolved issue requiring a publication limit was established; unobserved activation and benefit remain beside the claims they qualify.

Blockers

none

Limits

none