BRAN report verification

Type: agentic-system-analyses/types/agentic-system-verification.md

Verification

The reports support a bounded, code-grounded account. No material correction is required. I reviewed runtime, memory, epistemic, workflow and reconciliation against their contracts and independently inspected the frozen SRC-1 implementation. HEAD equals the reviewed boundary. The tracked top-level tree agrees with the boundary's coverage table. The target remains the shipped context system, including CLI/TUI drivers, instructions, persistence and maintenance, not merely a library API. No target code, tests, examples, providers or services were executed.

Record support and consequential branches

Selection and context. I checked RT-RTE-query-packet, RT-OBJ-context-packet, RT-OBJ-packet-receipt, RT-BAP-evidence-supply and RT-CLM-evidence-location against ranking, query, packet and grounded-request construction in SRC-1 crates/bran-cli/src/main.rs, packet assembly in crates/bran-core/src/packet/mod.rs, and the shipped skill/use-bran/SKILL.md. Ranking uses lexical/path/body/metadata predicates and deterministic ordering. Required evidence that exceeds assembly bounds errors; ordinary evidence can be omitted. Query's missing-policy branch is not packet's branch. The packet's text and receipt have different consumers. These sources support pre-invocation context selection and explicit later requests, not automatic conversation compaction, complete relevance or outer-task ownership.

The document and symbol refinements, MEM-RTE-document-selection and MEM-RTE-symbol-reload, are supported by SRC-1 crates/bran-cli/src/document_evidence.rs, crates/bran-document/src/admit.rs and CLI symbol resolution/retained filtering. I checked positive-score selection, embedded versus OCR-derived ordering, truncation, excerpt budgets, stale-index refusal and partial freshness. Their two Part of: relations correctly identify subpaths of the combined query/packet route.

Connected acceptance and retention. I traced production setup through the grounded builder, runtime invocation, receipt packaging and get, rather than treating the analysts' validator descriptions as verification. RT-RTE-connected-request, RT-CMP-agent-model and the workflow account match SRC-1 crates/bran-cli/src/main.rs, crates/bran-core/src/agent/coordinator.rs, crates/bran-core/src/agent/delegate.rs and crates/bran-core/src/adapters/provider/mod.rs. Grounded completion requires admitted citations, answer reconstruction, material claim/support equality, reopened-file digest and support occurrence, protocol checks and successful storage. The support test is a substring test, not a semantic proposition evaluator. Executable hashing and echoed model/session/budget fields do not independently attest model weights, host confinement or external retention.

I separately checked supported-input reachability and alternate branches. RT-RTE-runtime-port can accept a constructed request without a grounding contract or token ceiling; request construction does not require either. RT-RTE-structural-connected, in SRC-1 crates/bran-core/src/adapters/connected.rs, uses packet identity/coverage checks rather than fresh-file support. Invalid grounding empties accepted returned bytes while preserving the raw response; SQZ failure instead returns original canonical bytes. These alternatives are not demonstrated bypasses of the production grounded builder. The reports preserve that distinction.

The unconditional completion store call confirms the qualification of RT-CLM-session-retention. I checked the provider's preflight/result no-session comparison and test-only omission allowance separately from local publication. Filesystem expiry, publication, read integrity and canonical decoding support MEM-OBJ-result-answer, MEM-OBJ-result-support and MEM-OBJ-lossless-artifact. The artifact has immediate integrity read-back but no established dedicated later agent consumer. get does not revalidate current cited files. The workflow's source-anchor-only retry, halved source limit, changed-prompt requirement and post-completion response-source-count rejection match the CLI branches. Runtime completion, retention, command success and outer delivery remain distinct.

Admission and diagnostic feedback. RT-RTE-settings-apply and RT-BAP-settings-consumption match TUI resolution, temporary-file replacement and later settings loading in SRC-1 crates/bran-cli/src/main.rs and crates/bran-tui/src/settings.rs. RT-RTE-maintain-apply matches the CLI fixture marker and strict revalidation plus the caller-asserted authority, digest, snapshot, staging and rollback controls in crates/bran-core/src/repair/mod.rs. Rollback I/O can fail; authority is not authenticated human approval.

I checked both recorded parts, MEM-OBJ-evidence-request and MEM-OBJ-evidence-rankings, and MEM-RTE-evidence-feedback, MEM-BAP-diagnostic-supply, EPI-OBJ-evidence-gaps, EPI-RTE-evidence-summary and EPI-RTE-evidence-replay against CLI recording, gap collection, proposal and replay consumers. Exact request/root replacement and bounded persistence are distinct from semantic consolidation. Null replacement/authority and read-only difference reporting support diagnostic feedback, not automatic source or ranking-policy revision. Document matches can affect term coverage without becoming retained anchor rankings. The reports do not misstate that history as a complete regression oracle.

Alternative representations and APIs. The four derived objects—MEM-OBJ-derived-index, MEM-OBJ-derived-snapshot, MEM-OBJ-derived-report and MEM-OBJ-generated-validator—match the separate encodings in SRC-1 crates/bran-core/src/derived_state.rs. MEM-RTE-derived-rebuild correctly preserves default software-created authority rather than importing the CLI fixture gate. MEM-OBJ-file-state, MEM-CMP-database-evidence and MEM-CMP-obsidian-export match respectively crates/bran-core/src/database/state.rs, crates/bran-core/src/database/evidence.rs, crates/bran-core/src/export/mod.rs and examples/obsidian/usage.rs. Opaque bytes, content-free provenance versus row-bearing packet content, and immediate export/reparse are not silently promoted to deployed memory learning.

Epistemic distinctions. EPI-OBJ-provider-claims, EPI-OBJ-structural-response, EPI-OBJ-document-anchors, EPI-RTE-document-admit and EPI-RTE-sqz-check preserve the actual validators' domains. SRC-1 crates/bran-core/src/adapters/sqz.rs checks required substrings and byte benefit, not semantic equivalence. The excerpt-prefix counterexample follows from public_safe_excerpt; it is explicitly a deduction, not an executed fixture. EPI-RTE-profile-check, EPI-RTE-body-preserved and EPI-RTE-doctor-readiness match the selected-profile consumer, stripped-body comparison and local-readiness consumer in SRC-1 crates/bran-core/src/profile.rs, crates/bran-core/src/migration.rs and the CLI. Their local predicates do not establish source truth or task success. The two authority claims, EPI-CLM-authoritative-files and EPI-CLM-declared-authority, accurately retain README doctrine without converting it into measured retrieval quality.

I checked all declarations and annotations for meaning, evidence-layer strength and consumer scope. No evidenced-absence records are declared. Wired routes are supported by inspected call chains; the derived helper's afforded status does not falsely assert production adoption. All operation statuses remain uninspected. The structural response's object-to-route containment is explained and supported. No supersession is proposed. The reconciliation correctly distinguishes overlapping routes and pre-validation output from retained output; shared strings do not establish duplicate identity. Its memory integration-issue dispositions preserve historical support, missing consumers and parser limits. No incompatible report findings require an unresolved-conflict paragraph. All four correction-answer files are empty; there are no declined objections to adjudicate. The structural report-check says none, so it supplies no failure requiring routing.

Selected omission questions were whether a shipped caller closes the apparently missing derived-state/database/state-store loop, whether alternate connected paths weaken the production guarantee, and whether shipped maintenance or evaluator instructions supply an omitted automatic adoption step. The basis was the frozen tracked tree, library producer/consumer dependencies, CLI dispatch, examples, skill, deployment unit and CI dispatcher—not only the submitted anchors. Repository searches for derived rebuild, state-store, evidence-engine, structural coordinator and export callers found the inspected API/test surfaces and the immediate Obsidian example, not a contrary production consumer in the searched crates/examples/tools. This supports retaining the reports' bounded integration uncertainty, not universal absence. The headless maintenance instructions do not supply authored replacement content or bypass inspected admission. SRC-1 tools/ci/check.sh supplies source-defined evaluator dispatch, not successful-run evidence or automatic knowledge acceptance. The registered-root/systemd envelope does not enclose all ordinary local invocations.

Further optional expansion stopped because those consequential challenges have supported dispositions, while remaining parser/evaluator internals could refine local coverage without invalidating the explicitly bounded conclusions. No whole-system negative about all evaluation, acceptance, learning, reflection, autonomy or self-improvement is accepted. The limits below preserve the incomplete comparisons rather than weakening supported mechanisms.

Blockers

none

Limits

  • Native conversion and index fidelity remain incompletely assessed: MEM-RTE-document-selection, MEM-RTE-symbol-reload and EPI-RTE-document-admit establish admission, selection and bounded delivery, not comprehensive native-parser conformance or source-to-index correctness. Withhold complete format-fidelity and live index-currency comparisons; the supported transport, budget and stale-refusal findings remain valid.
  • The API and evaluator inventory is partial: MEM-RTE-derived-rebuild, MEM-OBJ-file-state, MEM-CMP-database-evidence and the epistemic coverage boundary leave detailed downstream consumers and evaluator routes unresolved. Withhold a complete comparison of all shipped evaluation/adoption routes or a system-wide absence of learning and knowledge acceptance. The inspected diagnostic loop, storage capacities and grounded production workflow remain supported.