Decapod synthesis

Type: agentic-system-analyses/types/agentic-system-synthesis.md

Bounded synthesis

From human intent to governed work

Decapod is a repository-native governance tool for coding agents, not an enclosing agent runtime. The human supplies intent. An external host agent reasons, edits code, invokes tools and decides what to do next. Decapod's ephemeral Rust CLI and structured process RPC return context, custody state, blockers and checked publication results. Durable repository and database state connects successive invocations. Its public claim is that required proof remains tied to the current change, not that every action or semantic judgment is controlled by Decapod (EPI-CLM-checked-work, RT-BAP-readiness-gates).

This account covers the shipped governance layer at Git revision 067b8f55071e13dd103779998168b4c9ffd31a79, with applicability cutoff 2026-10-14. The boundary classifies it as an extension or tool mechanism with a whole-system functional boundary. SRC-1 supplies inspected implementation and doctrine/design, not a target execution, host transcript or causal experiment. External hosts, Jev service internals and dependency implementations were not acquired. Whole-system inclusion does not mean exhaustive tracing: named decision, worker, health/reflex, scheduler, governance and remote-driver alternatives remain partially inspected. The report verification accepts a bounded account, not universal enforcement or observed success.

The representative workflow is an agent carrying a repository change to verified branch/PR publication. Shipped instructions sequence prompt evaluation, orientation, session acquisition, task creation/claim, workspace preparation and context resolution. The marker evaluator can reject the text submitted to it; the host must invoke it and honor the result. Task and agent identities bind custody to a branch/worktree, while session tokens identify a local epoch. These are not interchangeable with authenticated human approval. Invalid local credentials commonly cause automatic reacquisition, RPC has exemptions, and cloud todo uses a separate authenticated transport (RT-RTE-prompt-eval, RT-RTE-session-custody, RT-CLM-session-auth).

Workspace preparation can reject conflicting custody and create or reuse a task-scoped Git worktree. The host must enter it and continue work. Containers are optional and off by default; neither a worktree nor a container creates a separate model conversation. This handoff separates filesystem execution and ownership, not reasoning frames (RT-RTE-workspace-ensure).

Context and experience across invocations

Context resolution supplies doctrine and authored project specifications on request. Operation, touched paths, tags and lexical matches influence scoped selection. The combined fragment list is subsequently reference-sorted, deduplicated and truncated; separately returned scoped fragments and spec fields can add material beyond that limit. Local-spec projection may expose only an initial relevant content line rather than the whole rationale. The host decides what enters its actual model window. This is context supply, not total token budgeting, conversation eviction or automatic obedience (RT-RTE-context-resolve, RT-BAP-context-delivery).

Accumulated memory has several distinct later-consumer routes. Knowledge search returns active substring matches, including provenance; basic CLI/RPC writes default to persistent entries without expiry. Provenance syntax is not source verification. Procedural-prefixed entries require a promotion event containing evidence references and an approver string, but the checks neither resolve those references nor authenticate approval or establish that the new body follows from the source. Library conflict, supersession, expiry and optional recency operations exist as afforded capabilities; no shipped decay caller was established, and search does not itself expire rows (MEM-RTE-knowledge-store, MEM-RTE-promotion-lifecycle, EPI-RTE-promotion-record, EPI-RTE-knowledge-withdraw).

Decision memory illustrates why producer and consumer must be traced separately. Valid federation library writes retain decision prose and relationships, and independent RPC listing returns bodies and lifecycle fields. RPC decision upsert, however, supplies invalid fixed provenance and rejects before persistence. Listing also omits source/relationship expansion and can return superseded text. A functioning read route does not repair that rejected producer or guarantee withdrawal at the host (MEM-RTE-decision-memory). Aptitude reminders likewise have known context/category selection and usage-based ordering, but prompt initialization is unresolved and access counts do not show adoption (MEM-RTE-aptitude-reminders).

The strongest supported experience-fed contribution is architectural: successful handoff status triggers best-effort formatted knowledge and an observation, with later search/pending consumers; LCM automatically derives a retained chronological extract from selected originals after a requested summarization, with later summary lookup. For recorded interaction/tool inputs, these are wired trace-fed durable-context paths, independently accepted by profile verification. They do not establish better future capacity, successful writes, automatic recipient injection or parameter training. Handoff write errors are discarded, while LCM's 64 KiB byte prefix can omit qualifications or fail at a UTF-8 boundary. Original hashes support separate reload, not completeness of the immediate extract (MEM-RTE-handoff-memory, MEM-RTE-lcm-summary).

Other context artifacts have different guarantees. Archive packing copies a file and replaces its working copy with a caller-authored summary/pointer; restoration returns original text under a caller-file token budget, not the actual host-window budget. Same-second packs can overwrite archived bytes before index registration, so full recovery is not generally assured. Bundles instead persist selected snippets and reject incompatible or stale imports through hash, identity and current-input checks. Both return content by value; neither installs a live reference or reclaims existing conversation turns (MEM-RTE-archive-context, MEM-RTE-bundle-transfer). Known read-back chains are requested pull routes; unresolved automatic consumers prevent a complete pull-only conclusion.

Repair, proof and delivery

The host authors implementation and semantic living specs, checkpoints and commits, then requests validation. Decapod can heal supported generated projections and supervise prerequisite checks, but semantic repair stays with the host. Full readiness requires the current candidate, accepted-base ancestry, source inventory, required profile and supported controller contract. Accepted executor authority comes from immutable accepted-target Git objects and checked closure, not a candidate-supplied receipt. CI-local success explicitly reports that publication is not ready (RT-OBJ-accepted-executor, RT-RTE-validate-candidate).

An additional evaluation subsystem imports externally supplied success judgments and explanations, then computes binary-score means and bootstrap intervals. These calculations license numerical conclusions conditional on the inputs, not authenticated task outcomes or component causality. An optional marked evaluation requirement can veto publication based on sample counts, iterations, timeouts and whether the upper interval endpoint is below the negative regression tolerance. An interval crossing zero can therefore pass; the gate is not proof of improvement or even a nonnegative lower bound. This helper does not bind its aggregate to current code and does not replace separate exact-candidate readiness (EPI-RTE-eval-judge-import, EPI-RTE-eval-statistics, EPI-RTE-eval-promotion-gate).

The workspace publisher rechecks committed material and current readiness after any optional commit, performs a normal push, reads the exact remote head/base and verifies a matching GitHub PR. It then checks for remote movement. A successful push alone is not delivery; failed acknowledgement can leave a pushed branch and an incomplete-publication error. Recovery preserves that branch, reconciles state and revalidates before retry; matching PRs are reused. A non-GitHub remote can yield a verified branch without a publish-ready PR. The endpoint is verified publication, not merge, deployment or semantic correctness (RT-RTE-workspace-publish, workflow recovery).

What the supported progression establishes

For a host following the prescribed workflow through supported proof profiles and publication routes, Decapod implements persistent custody, requested context and executable rejection of incompletely proved candidates. For a host acting directly through shell/Git, that enforcement does not apply. Worktree exemptions and gate-skip controls further qualify coverage; shell-containing external-action allowlists are not command-content sandboxes. Neither the selected publisher's ordering nor the agent contract establishes a universal prohibition on branch pushes before proof (RT-BAP-readiness-gates, report verification).

Optional Jev observations add a narrowed intent/trajectory alignment estimate, not approval or an answer oracle. Typed finite probabilities are checked, but calibration and mutable model-alias internals are unknown. Retained Jev results support ledger maintenance and validation; the inspected subsequent assessment input does not include that history (RT-CMP-jev, RT-RTE-assurance-observe, MEM-RTE-governance-reload). Internalization similarly establishes artifact integrity and lease metadata, not model loading: default noop output is empty, custom bytes are opaque, and attachment writes mounts/logs. Feedback proposal generation returns quotations and a fixed placeholder rather than installing an inferred rule (MEM-RTE-internalization-lease, MEM-RTE-feedback-proposal).

The supported partial contribution is durable experience-derived context plus candidate-specific governance. Whether criticism of a consumed theory improved future action remains unestablished: failed proof can prompt host repair, but the accepted reports do not establish a claim-targeted criticism, blame assignment, retained revision and later improved capacity. Theory-builder conditions remain separate: localized doctrine/spec content is delivered, but the records do not establish its theory classification and consequential consumption sufficiently to conclude conditions 1 or 2; content-directed criticism and retained criticism shaping a next round are independently unestablished for conditions 3 and 4. This is not a system-wide absence finding (RT-RTE-validate-candidate, epistemic conclusion).

Reflection is also not established as a property of the bounded system: retained self-related governance exists, but the accepted account does not establish both representation-mediated causal directions required for that conclusion. Autonomous theory building is not established; the selected workflow assigns continuation and semantic authorship/repair to the host. Self-improvement is independently unestablished: trace-derived context has later consumers, but objective-bearing evidence determining organizational change and subsequent operation causally depending on that change are not demonstrated. Version-selected CLI installation changes machinery without that evidence-responsive comparison (MEM-RTE-governance-reload, RT-RTE-release-update, workflow account). None of these conclusions negates the wired trace-fed context contribution.

A host transcript connecting context, repair, current-candidate checks and exact remote acknowledgement would change the operation assessment. An objective-defined intervention/comparison tracing retained criticism or guidance into later behavior would change the learning or self-improvement assessment at that comparison's boundary. Tracing worker/remediation and remote-driver alternatives could expand the partial inventories; inspecting custom producers and inference loaders could resolve internalization. Collision-safe archive identity/write admission would remove a concrete obstacle to general original-retention guarantees. No new source reads were made for this synthesis.

Limitations

Limitation	Affected SRC IDs and record citations	Inspected boundary	Conclusion prevented	Evidence that would resolve it
Automatic-write and authority inventories remain partial, including worker lessons and health/reflex remediation.	SRC-1; MEM-RTE-handoff-memory; report limit.	Bounded todo handoff/worker passages and health/reflex source inspection: optional lesson attempts retain knowledge/federation content; recorded proof labels/freshness can drive remediation todos. Full admission, lineage and later consumers are not traced.	Exhaustive automatic-curation, trace-origin and evaluator/authority-route comparisons; lesson write success, actual activation and remediation completion; semantic policy learning or exercised self-improvement.	Complete producer/admission/consumer records for these paths and supplied execution evidence; objective-relative comparison for improvement claims.
Archive originals lack an all-packs durability guarantee.	SRC-1; MEM-OBJ-archive-entry, MEM-RTE-archive-context; report limit.	Context/archive copy, index and restore paths: second-resolution identity and overwriting write precede registration; restore does not invoke content-hash verification.	All-packs durable original retention and reliable recovery. Noncolliding copy/restore remains supported; no collision execution was observed.	Collision-safe names and atomic/non-overwriting admission, verified restoration, and supplied collision/recovery results for operation claims.
Living-spec lineage/form is not separately enumerated in the partial profile.	SRC-1; RT-RTE-context-resolve, RT-RTE-validate-candidate; profile limit.	Authored repository prose and later selective projection, including the memory annotation; initialization remains unresolved.	Complete per-object lineage/form comparison for living specs; existing authored/natural-language existence witnesses remain valid.	Separate accepted classification of spec text and its initialization, projection and later host consumer.
Trajectory revision is omitted as a distinct curation unit in the partial profile.	SRC-1; MEM-OBJ-trajectory-artifact, MEM-RTE-governance-reload; profile limit.	Array extension, named-check replacement, blocker clearing and active-section replacement before assurance/validation consumption.	Complete route-level governance-memory revision comparisons, not the already supported evolve existence finding; revision alone cannot establish semantic criticism or improved capacity.	Separate classification of the recorded revision route and its consumers; additional criticism/use evidence for stronger properties.
No observed target operation or causal experiment.	SRC-1; source register, RT-RTE-workspace-publish, MEM-RTE-lcm-summary.	Static implementation and shipped doctrine at the frozen commit; external host/service behavior unacquired.	Host compliance, successful task/delivery rates, reliable activation and causal improvement.	Inspectable host/tool/remote traces and appropriately scoped intervention/comparison evidence.
Additional included routes and external contracts remain unresolved.	SRC-1; MEM-RTE-decision-memory, MEM-RTE-aptitude-reminders, RT-RTE-validate-candidate; memory inventory.	Decide producer, full federation graph, scheduling/evaluation, RPC trace consumers, spec/override initialization, full plans/claims/checkpoints, broker and remote/release drivers are not exhaustively traced; dependencies and hosts are not acquired.	Complete memory/warrant enumeration, absence of other adaptation or push routes, universal authentication/enforcement, remote reliability and deployment isolation.	Accepted route records for consequential alternatives, deployment grants and dependency/service contract evidence, with execution evidence where needed.
Custom internalization semantics and inference consumption are unresolved.	SRC-1; MEM-OBJ-adapter-payload, MEM-RTE-internalization-lease, EPI-CLM-adapter-replay.	Noop/custom producer seam, cached manifests, integrity/replay metadata, mount creation/deletion and validation; custom executable and loader uninspected.	Parametric representation/training, semantic preservation, actual model activation, replay success, inference-scope enforcement and parameter rollback.	Frozen custom producer/loader implementations, immutable model identity and inspected replay/loading/detachment results.
Admission labels and numerical checks have narrower licenses than truth or improvement.	SRC-1; EPI-RTE-knowledge-admit, EPI-RTE-promotion-record, EPI-RTE-eval-promotion-gate, RT-RTE-assurance-observe.	Provenance/event field checks, imported verdict aggregation and optional thresholds, typed provider probability.	Authenticated evidence-consuming procedural acceptance, calibrated alignment, general non-regression, component causality or accepted ampliative knowledge from these checks alone.	Resolved evidence and authenticated acceptance with criterion/use/scope; validated verdicts and suitable sampling/comparison design; provider calibration evidence.