BRAN boundary

Type: agentic-system-analyses/types/agentic-system-boundary.md

Boundary and evidence

This run covers BRAN as shipped in the public repository, not merely its Rust library API. Its intended use is deterministic repository evidence selection and bounded context delivery to agents, with optional connected model execution. The primary class is memory/knowledge/context-engineering system: offline retrieval and packet assembly are first-class operations; model calls are not a prerequisite for that classification. Optional runtime coordination is included, but BRAN is not classified here as the enclosing agent that decides and implements an outer task. SRC-1, README.md, skill/use-bran/SKILL.md, crates/bran-cli/src/main.rs.

BRAN locates and cites repository evidence. It does not decide or implement the outer task; the outer agent owns all decisions and changes. --- skill/use-bran/SKILL.md

The boundary kind is whole-system for this shipped context system. It includes the CLI and terminal driver, library components, document admission, repository policy, shipped agent instructions, retention and later consumption of query evidence and connected results, maintenance, export, deployment wrappers, and source-defined evaluators. Same-repository callers are included rather than treated as external hosts. The workspace declares the CLI, core, document, TUI, and release packager together. SRC-1, Cargo.toml, crates/bran-cli/Cargo.toml, crates/bran-cli/src/main.rs.

Entry-point and state-loop coverage

Initial implementation inspection traced these shipped paths, rather than inferring a whole-system boundary from the repository name:

• The bran binary enters main, dispatches through CliApp::run_inner, and invokes a terminal driver for interactive tui. Query scans the root, creates graph input, ranks sources, compiles a view, expands evidence dependencies, and emits selected sources. Packet repeats that production chain with bounded packet assembly and optional SQZ evaluation. SRC-1, crates/bran-cli/Cargo.toml, crates/bran-cli/src/main.rs, crates/bran-core/src/scan/mod.rs.
• Query's --record path persists evidence, and the evidence-summary and proposal paths load those records and compare them with repository evidence; replay evaluation rebuilds query evidence from live roots. This is a shipped feedback path, not just a hypothetical library consumer. It remains inside the boundary. SRC-1, crates/bran-cli/src/main.rs.
• TUI Apply writes .bran/settings.conf; subsequent packet and connected invocations load project settings. Connected headless execution constructs a grounded repository request, invokes AgentRuntime through configured ports, and opens the filesystem result store. get opens that store and decodes retained results. These persistence and consumption responsibilities belong to BRAN. SRC-1, crates/bran-cli/src/main.rs, crates/bran-tui/src/lib.rs.
• Document evidence discovery calls the format adapter and admission layer, then ranks admitted anchors and attaches digest, fidelity, and locator data to query/packet results. Native document parsers and their conformance tests are included, not excluded as unrelated utilities. SRC-1, crates/bran-cli/src/document_evidence.rs, crates/bran-document/src/admit.rs.
• Maintenance is a shipped CLI path through RepairCoordinator, proposal digests, explicit authority, and revalidation. The inspected CLI validator requires a fixture-authority marker; merely seeing a maintenance command does not establish unrestricted production self-repair. Derived-state and database modules are included library surfaces, whose actual consumers and wiring must be distinguished from their available APIs. SRC-1, crates/bran-cli/src/main.rs, crates/bran-core/src/derived_state.rs, crates/bran-core/src/database/mod.rs.
• The shipped agent skill directs an outer agent to consume packet/query evidence and continue its own task. The Obsidian example exercises export and reparse. The headless guide includes propose/apply/revalidate instructions. These prompts, instructions, and examples are part of the system's consumption and maintenance surfaces. SRC-1, skill/use-bran/SKILL.md, docs/integrations/agent-setup.md, examples/obsidian/usage.rs, examples/headless/README.md.
• CI definitions invoke source-defined contract checks and Rust tests; benchmarks exercise controlled scanner, graph, and packet workloads. They are inspectable evaluators, not observed successful executions in this run. SRC-1, .github/workflows/bran-fast.yml, tools/ci/check.sh, benches/context_packet.rs.

The persistence boundary is explicit in shipped source configuration:

BRAN's policy is source; everything else below .bran is local runtime state.

--- .branignore

The connected result-store access root is visible in implementation:

let state = root.join(".bran"); checked_directory(&state)?; let directory = state.join("results"); checked_directory(&directory)?; --- crates/bran-cli/src/main.rs

Top-level tracked coverage

All rows refer to SRC-1 at the frozen commit. “Included” sets functional scope; it does not mean every implementation statement has already been audited. Initial reads and tree inventory are distinguished below. Available internals awaiting detailed analysis are not access gaps.

External responsibilities and evidence limits

The immutable evidence boundary is the public Git repository at 7bc428b2ccdfad38e05caa0c0cba2bb19041993a, with an applicability cutoff of 2026-11-08. The acquired checkout's HEAD was checked against that full commit. The access path is not a second source identity. All tracked files at this revision remain eligible for later source inspection under SRC-1, including included paths not yet inspected in detail.

The overall evidence tier is code-grounded. Initial reads establish inspectable producers, admission, retention, consumers and shipped drivers. Product documentation supplies doctrine/design. No target code, examples, tests, benchmarks, model calls, or services were executed for this boundary. Source-defined checks therefore support an account of intended verification, not measured retrieval quality, operational reliability, token savings, or causal superiority.

External responsibilities are excluded as follows:

• Outer agent hosts and model providers: BRAN's configured-host integration and runtime ports are included; the external executable's implementation, provider execution, credential store and enclosing task loop are not supplied. This prevents conclusions about the external host's actual tool enforcement, model reasoning quality, credential safety or completion of outer tasks. Requested capabilities must not be treated as attested effective ones. SRC-1, docs/integrations/agent-setup.md, crates/bran-cli/src/main.rs, crates/bran-core/src/agent/coordinator.rs.
• External SQZ implementation: BRAN's packet/agent SQZ adapters and receipts are included, but an independently configured compressor is not frozen here. This prevents conclusions about its actual compression, fidelity or model behavior. SRC-1, crates/bran-cli/src/main.rs, crates/bran-core/src/agent/coordinator.rs.
• SCIP producers and external repositories: BRAN's existing-index consumer is included, not a SCIP indexer's implementation or a user's indexed repository. This prevents conclusions about index-generation correctness or real repository freshness. SRC-1, docs/integrations/agent-setup.md.
• Deployment infrastructure: the shipped systemd unit, OCI builder and registered-root CLI are included; SSH, job runners, real container bases, mounted repositories and live systemd enforcement are not observed. This prevents claims about a deployed service or real isolation effectiveness. The deployment document explicitly distinguishes remote CLI from a future service. SRC-1, deploy/systemd/bran-check@.service, deploy/oci/build_image.py, docs/deployment-profile.md.
• External specifications, databases and cloud services: in-repository schema, adapter, database and attestation contracts are included; linked upstream OKF, database engines, Google services and their operational accounts are not separately frozen sources. Their live conformance and behavior cannot be established from links or fixtures alone. SRC-1, README.md, docs/database-boundary.md, tools/ci/check.sh.
• Private development history: the export manifest identifies a private source origin, but only this public revision is frozen. Unexported code or private review history is unavailable, preventing conclusions about that larger development system. SRC-1, .bran-export.json.

There is no identified unavailable material shipped path that prevents inspection of BRAN's own context-system loop. The external gaps above limit operational conclusions; they do not turn BRAN's complete shipped artifact into an analysis of only its library subsystem.

Source register