Tortoise synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
Tortoise implements a memory service whose model-dependent write path turns conversational traces into retained graph content, while code selects prior material for later agent context. It is not the enclosing agent's task scheduler. This account concerns SRC-1, https://github.com/daniel-ospina/tortoise, at commit 54922a800f96858935b58ef250da569a4896df44, with an analysis cutoff of 2026-10-30. The evidence is inspected implementation and target-authored design, not an observed execution or causal experiment. The boundary is complete artifact, partial loop: the repository is frozen, but selected paths rather than every shipped writer, maintainer and consumer were traced. External host, provider and database internals and live deployments are outside the evidence (boundary and evidence, Source register).
From conversation to retained memory
The shipped entry points offer stdio MCP and HTTP service modes, alongside an in-process SDK. Their admission controls are not interchangeable. In the selected SDK workflow, a caller supplies turns and optionally a session ID. Code validates the request, stores bounded/redacted session turns, and then chooses extraction. Missing provider credentials can therefore leave searchable episodic material without derived memories. Hosted REST and hosted MCP add recording policy, capacity and quota gates; these do not govern every local SDK or direct graph write. The separate production-commit door checks consent before dispatch, but its complete remote consumer remains untraced (RT-RTE-session-capture, RT-RTE-hosted-capture, RT-RTE-production-commit).
Fresh v2 extraction proceeds through chunk narratives, candidate mapping, eligible graph search, gap review and payload construction. The model proposes content; SDK code owns graph effects. Gap review sees the story, current candidates, rendered graph priors and available source transcript. Its default request is for additions and corrections. Code preserves omitted baseline candidates and gives review output precedence on identity collisions. A failed review keeps the baseline with diagnostics; partial output can still merge. Chunk failures and completeness warnings can also permit continuation. This is bounded recovery, not proof that missing information was recovered or every candidate checked true (WF-RTE-gap-review, workflow account).
Raw stored turns, transient payloads and admitted graph products are separate milestones. The retained state mixes prose, symbolic IDs/relations/status and numerical representations. Dense embeddings differ from fixed-rule confidence fields and from encoder weights. The local embedding model has a pinned revision; the extraction model's configured alias does not pin exact remote weights. Neither route establishes provider-side training or weight changes (MEM-OBJ-session-turns, MEM-OBJ-derived-points, EPI-OBJ-extracted-points, RT-CMP-embedding-model, RT-CMP-extraction-model).
Storage is not one atomic transaction. Graph events, configured JSONL journals and optional Postgres record writes have separate outcomes. A receipt with diagnostics is not a guarantee of complete durable admission. Conditional retry does not roll back earlier writes, and replay of a successful extraction need not heal nonfatal provenance gaps. Direct Point creation and caller-composed checkpoints/diaries are additional admission doors; their shape, namespace and duplicate checks do not establish human endorsement or factual correctness (RT-OBJ-event-emission, RT-RTE-session-capture, RT-RTE-direct-point, MEM-RTE-checkpoint-diary).
What checks license—and what they do not
Tortoise's declared evidence architecture is narrower in implementation than the universal claim that every Point keeps a quoted source span. The inspected address check can establish textual occurrence and a value-bearing location in a resolved turn. Missing spans can instead produce warnings while content survives. Occurrence neither proves source truth nor entails the extracted claim. Optional VET likewise judges payload suitability: mechanical identifier-only filtering and optional arbiter opinions can affect membership, but dependency repair can retain or restore referenced entities. A DISCARD token is not an unconditional removal guarantee (EPI-CLM-evidence-authority, EPI-RTE-source-address, EPI-RTE-vet-check, EPI-RTE-vet-disposition).
Evidence Propagation computes numerical belief state and makes it consequential for selection. Arithmetic is conditional on stored parameters and graph inputs, not an independently calibrated probability of truth. A declared prior alone can clear volunteering's default 0.7 confidence floor. Dream maintenance can retain recomputed confidence even without convergence; freshness stamping additionally requires convergence, and stale epochs can suppress writes (EPI-CLM-belief-propagation, EPI-RTE-belief-evaluate, EPI-RTE-belief-retain, MEM-RTE-dream-writeback).
Correction review is a separate reliance-changing mechanism. Default operation queues candidates. An opt-in automatic branch accepts at a configurable EP mean threshold, default 0.75, subject to promotion eligibility. Measurement is disclosed but is not itself a hard gate: lowering the threshold can admit an unmeasured neutral value. Explicit keep/reject/close decisions have no enforced evidence-consuming criterion and do not identify a human merely by being caller-supplied. Keep can promote and wire prior relationships or supersession; rejection can retract an already-live candidate. These are operative graph changes, but integration and cleanup can partially fail. Their scope is graph-relative correction admission, not independent truth certification (EPI-RTE-review-disposition, EPI-RTE-review-integration, MEM-RTE-point-retraction).
From retained state to later model work
The representative end-to-end path needs a later caller sharing the memory state; capture does not schedule another agent task. A framework callback sends a filtered recent window to the reflex. Code selects retrieval intent, searches a bounded pool, reads confidence, filters/sorts candidates, suppresses prior mentions and caps output. The canonical pipeline defaults to three pointers, permits at most five, truncates synopses to 160 characters and caps the block at 8 KiB. Search-matching internals remain unresolved in the accepted records; these gates do not establish a particular lexical or embedding selector (RT-RTE-context-delivery, memory annotation).
Framework adapters consume the block, not the full structured justification. They append ADK instructions or a user-content fallback, return a LangGraph message, or prepend Semantic Kernel's rendered prompt. Compatible prompt hooks offer another delivery seam. The text asks the agent to follow pointers before settling details, but that is advice, not an enforced evidence-reading step. Whitespace sanitation does not establish resistance to malicious stored prose. The host owns the subsequent model invocation and task actions; delivered context does not prove reliance or benefit (RT-BAP-framework-block, MEM-RTE-hook-volunteer).
Other readers have different semantics. Session-start delivery supplies recency-based excerpts, not task-targeted matches; the inspected local digest lacks canonical terminal-status exclusion. Retraction is therefore not universal withdrawal from future contexts. A shipped evaluation driver expands retrieval pools through source-session traversal, but graph-only expansion does not establish completeness for record-capable turn storage, final reader use or live reflex integration (MEM-RTE-start-digest, MEM-BAP-start-digest, MEM-RTE-source-expansion, MEM-OBJ-session-turns).
These controls select and shorten the reflex's inputs and add external memory to host work; they do not evict the host's original conversation or establish host-wide compaction. Pointers require explicit retrieval rather than automatic dereference. Retrieval failures can yield unobtrusive silence, but invalid input and unbound search can raise. HTTP timeout bounds an await, not worker cancellation; the stricter 300-ms completion rule is opt-in. No universal no-throw or latency guarantee follows (RT-RTE-context-delivery).
Assessment at this boundary
The strongest supported learning-related contribution is an automatic conversation-trace-to-durable-graph-to-later-context path. It consolidates session material into standing content and gives retained experience force at the updater and selected prose advisory force at later models. This supports wired trace-fed memory formation without requiring weight training or demonstrated improvement. It does not establish improved capacity for future action, semantic faithfulness, or a produced and accepted ampliative claim (MEM-OBJ-derived-points, WF-RTE-gap-review, RT-BAP-framework-block, profile verification).
For continuity across sessions, the inspected architecture supplies concrete retention and delivery mechanisms. For a scenario requiring every recalled statement to carry verified support, every withdrawal to reach every reader, or failures to leave no partial writes, these mechanisms do not establish the required guarantees. This is a scenario-relative distinction, not a product ranking.
The accepted runtime does not supply separate theory-builder condition assessments. Condition 1 (localized formulated theory), condition 2 (decisions depending on its content), condition 3 (content-directed criticism with blame and changed reliance), and condition 4 (retained criticism shaping another round) are each unestablished as theory-route findings here; graph claims and S4 candidate review do not by themselves close those requirements. No improvement caused by criticism of a consumed theory is established. Reflection's two causal directions and role-complete autonomous theory building likewise remain unestablished, independently of automatic write progression. Exercised self-improvement of the bounded system is not established: retained context can reach later behavior, but subsequent operation causally depending on an evidence-responsive organizational change, against an independently stated improvement objective, is not shown. These are evidence limits, not system-wide absences (runtime account, epistemic bounded conclusion).
Paired transcript/claim assessments would change the semantic-fidelity finding; independently validated parameter provenance and calibration could change the confidence interpretation. Consumer traces following retained content through selection into subsequent decisions would establish activation beyond delivery. An objective-linked intervention and comparison could assess improved capacity and self-improvement without attributing an effect more finely than the intervention. All-path tracing or changed reader predicates would be needed for stronger withdrawal, consent and recovery guarantees. No additional source reads were needed for this synthesis.
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| Partial shipped-loop coverage | SRC-1; RT-RTE-production-commit, MEM-OBJ-capture-spool, boundary | Selected v2, hosted capture, maintenance and consumers; M2, full remote commit, imports/packs, UI/service writers, other harnesses, replay/recovery and complete evaluators remain unresolved | Whole-system inventories, cross-harness parity, global consent, absence of other learning or acceptance routes | Trace material alternative producers, admission controls, persistence and later consumers at the pin |
| No observed execution or causal comparison established | SRC-1; RT-RTE-session-capture, RT-RTE-context-delivery, WF-RTE-gap-review | Source-level capture, recovery and delivery | Successful operation, reliable compliance, measured latency, improved capacity, exercised self-improvement or component benefit | Provenanced end-to-end traces; objective-linked comparisons with stated intervention and confounding limits |
| Incomplete authority-restriction inventory, carried from report verification | SRC-1; EPI-RTE-review-integration, EPI-RTE-belief-evaluate, RT-RTE-direct-point, report verification limit | Selected correction/belief routes omit the separate caller-supplied claim-class marker and derived-over-asserted override restrictions identified in tortoise/claim_class.py and tortoise/sdk.py |
Complete comparison of authority restrictions, class-aware supersession or propagation safeguards; neither factual truth nor an audited all-path invariant follows | Accepted records tracing marker admission and every material override/propagation consumer, including alternate paths |
| Source occurrence and extraction warrant remain distinct | SRC-1; EPI-RTE-source-address, EPI-OBJ-extracted-points, EPI-RTE-vet-disposition | Conditional spans, candidate filtering and dependency repair | Universal quoted evidence, semantic entailment, source truth or accepted novel-claim production | Paired source/claim checks, complete provenance propagation and explicit evidence-consuming acceptance within a named domain |
| Numerical confidence has unresolved empirical warrant | SRC-1; EPI-RTE-belief-evaluate, EPI-RTE-review-disposition, MEM-RTE-dream-writeback | Parameter arithmetic, write-back and distinct volunteer/review gates; full mathematics, initial evidence and calibration provenance unresolved | Calibrated truth probabilities, measured-only admission, reliable correction quality or outcome-based learning from dream alone | Input provenance, propagation validation, calibration measurements and exercised gate outcomes |
| Persistence and expansion parity unresolved | SRC-1; RT-OBJ-event-emission, MEM-OBJ-session-turns, MEM-RTE-source-expansion, MEM-OBJ-capture-spool | Independent store outcomes, record-capable turns, graph-only expansion and selected spool handling | Atomic all-writes durability, lossless/exactly-once capture, complete restoration or source expansion | Full writer/reader/replay and failure-recovery tracing, including record-only turns and spool producers |
| Withdrawal and integration are reader-specific and can be partial | SRC-1; MEM-RTE-point-retraction, MEM-RTE-start-digest, EPI-RTE-review-integration | Canonical terminal filtering differs from local recency digest; supersession/cleanup can fail | Universal forgetting, all-consumer withdrawal, physical erasure or atomic correction integration | Every-reader lifecycle audit, cache/replay handling and checked partial-failure recovery; changed digest filtering for a stronger local guarantee |
| Delivered context is narrower than available justification | SRC-1; RT-BAP-framework-block, MEM-RTE-hook-volunteer, RT-RTE-context-delivery | Bounded block injection; matching internals, full rationale retrieval and host internals unresolved | Full evidence delivery, mandatory support reading, malicious-text resistance, host-wide compaction or universal no-throw/deadline guarantees | Traced matching and support-following consumers, host invocation evidence and explicitly enforced contracts at each claimed boundary |
| Theory and organizational-change properties independently unresolved | SRC-1; runtime account, WF-RTE-gap-review, epistemic bounded conclusion | Selected automatic memory update, review and downstream selection; no complete theory-route assessment or objective-linked exercised change | Theory-builder conditions 1–4, learning through theory criticism, reflection, autonomous theory building or exercised self-improvement | Localized theory/criticism/iteration records, self-representation feedback paths, role-by-role ownership and objective-linked later operation causally dependent on retained change |