Tardigrade synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
From request to executable work
Tardigrade is an enclosing agent runtime built around an immutable event log. It accepts identified actor invocations, derives model and tool work from recorded state, executes effects through configured services, and projects terminal method results. This account covers the shipped framework, hosts, callers and improvement instructions at commit 1b9f1e5760d1d4d4a63eb1f87af9e5a2341de7e8, with analysis cutoff 2026-10-15. The whole-system boundary includes both current atom APIs and deprecated component APIs still used by the shipped server. It does not imply exhaustive inspection or equivalence between them. SRC-1 supplies code and doctrine/design, but no observed execution or causal experiment. External dependency implementations and live deployments are not captured. See the boundary and evidence and Source register.
The representative workflow is the shipped Bun example's message invocation, not a constructed combination of unrelated capabilities. A caller allocates an actor/instance/thread and supplies a message with an invocation ID. The method turns that request into a turn with the same ID. Fixed graph rules then own progression: inference waits for context and outstanding work, proposes a model call, and consumes the returned text and tool proposals. The provider receives system instructions, selected messages and tool schemas; runtime services, not the provider, dispatch ordinary tools. Tool results become events and later conversation input. The caller supplies a problem, not an expected answer. The example defaults to a greeting, so its source establishes a conditional multi-step branch, not an observed tool-using rollout. See RT-RTE-bun-message and the workflow account.
An intermediate model response is not delivery. Outstanding tool calls require continuation; a tool-free answer must pass settlement checks before the method returns { text }. Unknown tools yield error content that can inform another model proposal. A rejected generation or duplicate provider call IDs can instead fail the turn. Cancellation drains accepted work before terminal cancellation, without undoing completed external effects. Delivery means a terminal method result reaches the waiting caller, not that the answer is factually correct. These distinctions are retained in the workflow annotation.
Execution authority is composition-specific
The default actor can wrap ordinary tools in permission and budget checks. Those wrappers can wait, deny or permit execution, but the actor author must compose them. “Ask” does not necessarily mean human approval, and an unconfigured budget passes through. The representative Bun actor uses unwrapped library tools and supplies no output contract. Its controls therefore cannot be inferred from the default actor's richer composition. See RT-RTE-governed-tools.
Current code mode is a separate execution route: model-generated JavaScript runs through a configured isolate and issues independently durable package calls. Registry checks and ordinal argument comparisons can reject replay drift; they do not establish that each package method traverses the ordinary permission/budget wrapper. Bun's subprocess restrictions and Cloudflare's Worker Loader adapter depend on different external isolation contracts. Host library code and imported actor modules are not confined merely because generated code is sandboxed. See RT-RTE-code-execution.
The shipped server uses a deprecated host and component runtime, with its own inference, code mode, compaction and output checks. Its escalation callback grants computationally rather than demonstrating an operator veto. Current atom guarantees must not be transferred to that composition. Current child delegation separately passes selected message/budget input and returns a handle followed by completion, not the parent's full transcript; local handles survive only their service scope. Legacy delegation has additional controls not fully inventoried by the current child record. See RT-RTE-legacy-server, RT-RTE-child-invocation and the report verification limits.
Retention, recovery and the next context
The current core requires a committed effect request before dispatch. With the inspected SQL journal, records, pending inputs and optional checkpoints commit together by default; recovery reconstructs state from a checkpoint and journal suffix. This supports a request-before-execution invariant and a conditional persistent-recovery protocol. It does not provide exactly-once external effects: recovery can recreate a producer that reaches an external service again. No-journal operation and custom adapters remain possible. Compatible actor code, storage and executor contracts are necessary. See RT-CLM-request-before-execution and RT-OBJ-journal.
What is retained differs from what the model sees. A trajectory projection extracts conversation from the broader journal. Current compaction clips user/tool text, estimates context size, and, above configured thresholds, summarizes an older prefix while retaining a boundary-valid tail. Later inference receives labelled user-role summary text plus that tail; subsequent compaction can consume the previous summary again. Matching-call and nonempty-text checks govern installation, not factual preservation. Pending tools or missing boundaries can prevent compaction despite an oversized estimate, and compatible continuation expansion and attachment bytes further prevent treating the estimate as a hard provider-token bound. See MEM-OBJ-trajectory, MEM-RTE-atom-compaction and MEM-RTE-content-replay.
A semantic summary is not a recovery checkpoint. Checkpoints encode durable state and operation lifecycle for reconstruction. Provider-compatible continuations instead replay identity-matched serialized assistant content; their readable reasoning display does not expose every consumed payload. File references resolve separately stored bytes with integrity checks, not semantic authentication. Explicit initial-state adoption validates destination atom names/codecs and fresh-history conditions, while the caller remains responsible for conversion meaning. See MEM-OBJ-effect-checkpoint, MEM-OBJ-provider-continuation, MEM-OBJ-content-parts and MEM-RTE-state-adoption.
Reload routes also differ. Current workspace tools support requested keyed text writes and bounded reads; the example backend is a layer-local Map. Legacy spilling retains full values separately and emits preview/ref pointers, supporting requested slices/search and hydration during resumed code. This is not the current code-mode spill policy. Legacy compaction has stronger completion/tool-call rejection than current summarization and can resolve attachments; its repair projection can hide designated attempts before later rendering and summarization without deleting raw history or proving those attempts false. Operator event inspection is real, but an advertised logs.events pointer does not establish an installed model-facing reload tool. See MEM-RTE-text-workspace, MEM-RTE-spill-readback, MEM-RTE-legacy-compaction and MEM-RTE-event-inspection.
Checks, revision and future capacity
Tardigrade implements consequential checks, but their domains differ. Conditional current output-schema checks can reject a response, retain errors, guide another inference and fail at a correction bound. Legacy completion and typed reread enforce their declared output contracts. Resource acquisition preserves local URL/status/query lineage, not the warrant of imported assertions. Repository hooks can block ordinary commit/push continuation on selected development checks, when installed and used. None of these local checks licenses a system-wide factual verdict. Without concrete input/output content, the semantic relation of model generation or summarization remains indeterminate rather than established derivation or conjecture. See EPI-RTE-response-check, EPI-RTE-legacy-output, EPI-RTE-resource-import and EPI-RTE-repository-gate.
The strongest supported trace-fed contribution is implemented automatic summary retention for later inference, plus conditional retained rejection feedback shaping corrective guidance. These qualify as trace-fed artifact updates without establishing improved future capacity. Summary context can acquire operational reliance without an evidence-consuming factual acceptance decision. Neither retention nor consumption establishes integration of accepted knowledge. The remaining question is whether these updates preserve relevant content and improve later action, not whether the update paths exist. See both compaction routes, EPI-RTE-response-check and the bounded epistemic conclusion.
For durable prompt/harness revision, NPO and GEPA prescribe fixed evaluations, unchanged baselines, trace-backed candidates, held-out comparison and authorized promotion. Build and server-push mechanisms independently admit executable artifacts through integrity/shape checks; they do not enforce the optimization procedure or demonstrate behavioral improvement. No candidate lineage, comparison result, installation episode or later exercise connects the prescribed optimization loop to live behavior here. See RT-RTE-optimization-guidance, EPI-CLM-evaluation-promotion and RT-RTE-artifact-admission.
The optimization record supports separate conditional theory-builder findings: condition 1, localized theory-bearing text, is afforded; condition 2, decisions depending on that content, is afforded; condition 3, content-directed criticism with placement of blame, is claimed; condition 4, criticism shaping another round, is claimed. Editable instructions and prescribed trace inspection do not establish an exercised theory-building episode. Criticism of a consumed theory improving future capacity is unestablished. Reflection is prescribed through inspection of the actor's own traces and revision of its text, but the two causal directions are not observed. Autonomous theory building is not established; computational proposal and selection instructions do not demonstrate every internal operation. Self-improvement has a dormant prescribed pathway targeting the actor's own behavior-determining instructions, not demonstrated exercised self-improvement: objective-bearing evidence shaping an update, live installation and subsequent dependence on the change remain unestablished. Successful improvement needs separate outcomes. These are independent findings, not a ladder or a single negative grade. See RT-RTE-optimization-guidance.
For an event-backed conversational workflow, the supported architectural contribution is explicit invocation/effect identity, replay-oriented state and caller-visible settlement, with model context managed separately from storage. For scenarios requiring universal action approval, exact external-effect execution, faithful long-history recall or demonstrated adaptive improvement, those properties are not established at this boundary. Restart traces with external-effect identity, source/summary fidelity comparisons, complete control tracing across both generations, and immutable candidate-to-deployment evaluations would alter the corresponding assessments. Implementing uniform inner-package admission or checked semantic summary acceptance would change specific architectural guarantees; neither can be assumed from present naming or instructions.
Limitations
All rows concern SRC-1 at the frozen revision above. No unresolved cross-report conflict was identified. This synthesis adds no source inspection or new evidence.
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| Implementation and doctrine are not observed operation or causal benefit. | SRC-1; RT-RTE-bun-message, RT-RTE-optimization-guidance | Shipped source and prescribed procedures; no supplied runs or experiments | Successful task delivery, production durability, cost savings or improved future capacity | Inspectable runs and controlled comparisons tied to actor/candidate identity and stated objectives |
| Advertised model log reload is not established wiring. | SRC-1; MEM-RTE-event-inspection, RT-RTE-legacy-server, report limits | Legacy renderer, built-in server assembly and separate CLI inspection | Universal reloadability of truncated messages; positive workspace/file/CLI routes remain supported | A traced registered model-facing consumer and invocation restoring the omitted content |
| Legacy delegation is omitted from the detailed current-child inventory. | SRC-1; RT-RTE-child-invocation, RT-RTE-legacy-server, epistemic boundary, report limits | Current library record; verifier additionally identified legacy depth ceilings, child model-policy selection and optional contract decoding | Complete cross-generation delegation, inherited-control and evaluator comparisons; no inference of absent legacy controls | Accepted detailed legacy records tracing those controls and their consumers |
| Spill producer/binding coverage and loss recovery are incomplete. | SRC-1; MEM-RTE-spill-readback, MEM-OBJ-spill-values, report limits | Final-code writer, hydration and workspace readers; verifier additionally inspected package-return writer | Exhaustive cross-host comparisons or loss-tolerant reconstruction; missing hydration falls back to recorded result, not necessarily preview/full value | Complete producer/backend tracing and loss/recovery evidence showing available retained payloads |
| Corrective-guidance delivery is not separately classified in the profile's partial read-back inventories. | SRC-1; EPI-RTE-response-check, profile limits | Retained errors and attempt-dependent next-system guidance are established; separate direction/signal units omitted | Complete route-by-route corrective-delivery and selector comparison, not the supported positive read-back findings | Explicit classification of this route's trigger, retained selection and later delivery |
| Context reduction lacks semantic fidelity and universal size guarantees. | SRC-1; MEM-RTE-atom-compaction, MEM-RTE-legacy-compaction, MEM-RTE-content-replay | Current/legacy selectors and distinct summary checks; final provider input can differ from size estimate | Preserved facts/reasons, complete attachment understanding or hard provider-token bounds | Paired source/summary judgments and final-input accounting covering pending tools, boundaries, continuations and attachments |
| Opaque payloads, caller provenance and custom storage remain unresolved. | SRC-1; MEM-OBJ-provider-continuation, MEM-OBJ-content-parts, MEM-RTE-state-adoption, MEM-OBJ-workspace-text | Local envelopes, codecs and example backends, not every consumed payload or caller-selected service | Complete representation, lineage, admission-control, retention-duration, erasure or trace-source inventory | Concrete payload/provenance records, converter contracts and backend lifecycle inspection |
| Recovery and action controls are conditional, not universal. | SRC-1; RT-CLM-request-before-execution, RT-RTE-governed-tools, RT-RTE-code-execution | Current core/SQL path, composed wrappers and configured isolate adapters; dependency operation excluded | Exactly-once external effects, universal human veto or OS-level isolation | Executor idempotency/recovery contracts, full alternate-path enforcement tracing and isolation evidence |
| Repair filtering and contract checks do not establish factual rejection or complete later rationale. | SRC-1; MEM-RTE-legacy-compaction, EPI-RTE-legacy-output | Projected attempt hiding and local contract completion/reread; fuller repair/verdict transitions unassessed | Rejected assertions proven false, all reasons retained for later use, or current/legacy evaluator parity | Full verdict-producer/mode tracing and semantic criteria tied to concrete repair episodes |
| Broader host/evaluator coverage and optimizer attribution remain incomplete. | SRC-1; RT-RTE-legacy-server, EPI-RTE-repository-gate, RT-CMP-model, RT-RTE-artifact-admission, RT-RTE-optimization-guidance | Unassessed Cloudflare scheduling, formal-model soundness, arbitrary actors, provider internals and maintenance alternatives; prescribed optimization only | System-complete evaluator absence, weight identity/update claims, general rollback, exercised reflection/autonomy/self-improvement or component-level gains | Scoped implementation records, evaluator/weight contracts, immutable candidate/deployment lineage and subsequent comparative operation |