CocoIndex report verification

Type: agentic-system-analyses/types/agentic-system-verification.md

Verification

The reports support a bounded implementation account of incremental indexing, retained computation, shipped search consumers and model-assisted extraction. They do not establish observed operation, factual acceptance of extracted claims or improved agent performance. I read all five submitted members, the boundary, their types and the record contract. Correction-answer files were empty; the structural report returned none. There is no structural failure to route. I independently checked source behavior rather than accepting the analysts' validation statements as semantic verification. SRC-1 HEAD equals the reviewed revision and the checkout is clean; no target program, test, provider or database was executed.

Runtime and workflow

I checked every runtime declaration and its load-bearing source passages: both model components, the component memo object, all six routes and the extraction instruction path. Direct reads of SRC-1 examples/text_embedding/main.py, examples/manuals_llm_extraction/main.py, python/cocoindex/_internal/app.py, python/cocoindex/cli.py, rust/sdk/cocoindex/src/app.rs and rust/core/src/engine/app.rs support the invocation owners, separate update/query calls and SDK option forwarding in the runtime account. The producer declares a vector index despite stale comments; the query really orders distance and limits returned rows. The manual function awaits conversion and extraction before declaration; the workflow does not splice the unrelated text query into manual delivery.

The preview submit branch in SRC-1 rust/core/src/engine/execution.rs returns before normal sink application. It also rejects pending child-provider actions. This supports the branch-bounded guarantee of RT-RTE-preview-update, not universal preview success or a no-effects sandbox. Drop installs a raising error handler, drains captured live controllers with ignored timeout results, deletes the root and then clears per-app storage. Ordinary root cleanup has different error handling. The qualifications in RT-RTE-drop-app are necessary and supported. SRC-1 python/cocoindex/connectors/localfs/_source.py starts observation before scanning, marks ready, processes changes and rescans; readiness is not termination. SRC-1 rust/core/src/engine/admission.rs supports token loans and the unbounded None case, not a total-process resource cap.

SRC-1 python/cocoindex/ops/sentence_transformers.py and python/cocoindex/_internal/runner.py support inference, the configuration-based memo key, smaller-batch requests, optional callable serialization and broken-pool restart. Neither subprocess placement nor a model alias establishes isolation or exact weights. The manual's CPU converter option is distinct from its GPU runner placement. The workflow account and annotation accurately distinguish shape admission, a new row declaration, conditional SQL delivery and unobserved success. PostgreSQL dispatch and both awaited upsert implementations support that distinction. No workflow records require supersession.

Memory and epistemic records

I checked the seven memory objects, five memory routes and three annotations against their source scope, consumer and status. SRC-1 rust/core/src/state/db_schema.rs, rust/core/src/state_store/submit_session.rs, python/cocoindex/_internal/function.py and python/cocoindex/_internal/api.py distinguish function memos, component memos, arbitrary caller-assigned user state and ownership/recovery metadata. Cache-hit returns join dependencies; state assignment defers serialization; final internal writes follow sink application rather than creating an atomic cross-store transaction. The source search of SRC-1 python/cocoindex/resources/id.py and python/tests/core/test_use_state.py confirms memoized ordinal-based IDs and the counter consumer. Test source supports wiring, not a passing run. The conservative afforded state-access assessment is acceptable for the stated generic production-consumer boundary.

Full reads of SRC-1 examples/entire_session_search/main.py confirm text-only parsing, invalid-JSON and short-text filtering, separate metadata rows, imported context chunking and query projection to 200-character snippets. MEM-RTE-session-search does not establish checkpoint generation or host resumption. Direct reads of both image API programs and SRC-1 examples/sec_edgar_analytics/search.py support the delivery channels, live startup, filename/score projection and reciprocal-rank filing query of MEM-RTE-alternate-search. Their producer gaps remain explicit. CLI show/query/render reads support MEM-RTE-inspect-state: diagnostic summaries are not deserialized memory payloads. The memory annotations preserve rather than extend the supplied runtime findings.

I checked all epistemic declarations, each ledger function and both claim comparisons. SRC-1 python/cocoindex/ops/text.py supports exact slicing, not source truth. The manual schema, final validation and len calls support separate candidate, shape-check and list-cardinality findings. No actual extraction instance supports a stronger semantic relation. Full resolver reads and decision-validation/application reads in SRC-1 python/cocoindex/ops/entity_resolution/llm_resolver.py and python/cocoindex/ops/entity_resolution/__init__.py confirm candidate-membership retries, empty-decision fallback, self-match rejection and existing-canonical policy. These finite-string checks do not establish identity truth. The resolver configuration key omits retries and exact weights as reported. The function-retention cross-reference has the local defect described below.

I also read the hook registrations, four hook scripts and two portable check scripts. They support flag-triggered type/build execution and exit signaling, not a proven host veto or a production factual gate. SRC-1 README.md supplies the fresh-context claim; the extraction prompt supplies the narrower fidelity request. Their doctrine/design status and the distinction between maintenance, operational admission and factual acceptance in the bounded conclusion are warranted. No absence declarations or observed/causal statuses are emitted by any analyst.

Relations, reconciliation and omission searches

I checked all seven explicit Part of: relations: chunk text and slicing belong to index production; ModuleInfo, counts, validation and counting belong to manual extraction; the fidelity criterion belongs to the extraction instruction path. Cross-kind containment is explained and does not replace the parent. I assessed all declarations for duplicate identity, including the overlapping chunk/persisted-text accounts and internal bookkeeping envelopes. The reconciliation reasonably preserves distinct referents and valid containers. There are no supersession amendments to assess. Its convergence statements preserve evidence strength. Its one unresolved conflict cites the affected records, both accounts, schema/decorator evidence and the attribution prevented. It is not a malformed conflict or a contradiction of the frozen target.

Omission questions were selected from the frozen tree and producer/consumer dependencies: whether shipped services invalidate an API-only account; whether session summaries imply an internally generated compaction loop; whether DSPy implies optimization; and whether entity resolution has a consequential shipped graph consumer beyond the resolver return. The service and session reads above settle the first two at the reports' stated scope. A full read of SRC-1 examples/patient_intake_extraction_dspy/main.py shows fixed ChainOfThought extraction and declared JSON files, not an optimizer call in that file. This agrees with the existing bounded coverage statements, without deciding dependency-internal learning.

For the graph question, additional direct implementation reads of SRC-1 examples/conversation_to_knowledge/conv_knowledge/extract.py and the producer/consumer bodies in examples/conversation_to_knowledge/conv_knowledge/app.py show two-step transcript extraction, name filtering and graph declarations consuming canonical maps. For example:

for canonical in { resolve_canonical(e, dedup) for e in getattr(stmt, f"mentioned_{cfg.name}") }: --- examples/conversation_to_knowledge/conv_knowledge/app.py

This is a real shipped downstream responsibility, not an excluded hypothetical caller. It does not refute the reports' explicit statement that they did not trace that consumer, nor their scoped findings about manual validation or pair-interface checks. It leaves the graph route inventory incomplete as recorded below. The name filters and graph writes do not themselves supply independent factual acceptance evidence.

Further omission expansion stopped because these selected challenges now have supported dispositions, and remaining connector, graph, benchmark and provider alternatives cannot change the retained positive witnesses without a broader claim than these reports emit. The whole-system boundary includes those paths; it is not an exhaustive audited-loop claim. No unsupported system-wide negative or complete-coverage value was found. The remaining local gaps prevent the comparisons listed in Limits, not the bounded account itself.

Blockers

none

Limits

  • The retention row in the epistemic authority ledger links pair-decision persistence to RT-OBJ-component-memoization, while EPI-RTE-pair-proposal and its resolver decorator identify a memoized function. The reconciliation conflict correctly preserves this discrepancy with MEM-OBJ-function-memoization. Independent reads of SRC-1 python/cocoindex/_internal/function.py, rust/core/src/engine/function.rs, rust/core/src/state/db_schema.rs and rust/core/src/state_store/submit_session.rs support the function-cache distinction. Withhold the ledger's precise component-object attribution; do not extract it as established lineage. This is a local dependency-reference defect, not uncertainty about whether memoized pair returns are afforded or about the already separate internal object classes. The bounded retention and authority conclusions survive without that attribution, so it does not meet the material blocker threshold.
  • The graph-consumer inventory remains partial. EPI-RTE-pair-disposition ends at the returned map and explicitly leaves later graph use uninspected; memory coverage likewise leaves graph paths unresolved. SRC-1 examples/conversation_to_knowledge/conv_knowledge/app.py consumes canonical maps to declare entity nodes and relationships, while examples/conversation_to_knowledge/conv_knowledge/extract.py performs preceding model extraction and output filtering. These omitted mechanisms prevent complete comparisons of graph-content admission, lineage preservation and downstream authority. They do not invalidate the selected manual workflow or the pair-interface-check finding; no system-complete acceptance or absence conclusion should be inferred.
  • MEM-RTE-alternate-search, MEM-OBJ-session-metadata and RT-RTE-manual-extraction retain local producer, metadata-reader and later manual-reader gaps. The inspected projection paths support service/search delivery and conditional storage, not uniform freshness across all indexes, full metadata consumption or downstream answering-agent use. Imported checkpoint provenance remains unresolved in MEM-OBJ-session-embedding; withhold claims about summary generation, preserved reasons or restorable host state.