Exo report verification

Type: agentic-system-analyses/types/agentic-system-verification.md

Verification

The pinned reports support a bounded, static account. No material correction is required. I read all supplied members, their types, the record contract and the structural check. Correction-answer files were empty; the structural check reported none. I judged the declarations, annotations, source passages, evidence statuses, containment, supersessions and proposed conflict dispositions, rather than treating the analysts' validation statements as semantic verification.

The checkout HEAD matched the registered revision, and its working tree was clean. All additional source inspection used SRC-1 at that revision. No target, test, example, provider or evaluator was executed. The top-level tracked tree supports the declared functional boundary: the persistent-agent experiment and Harbor caller are included, while dependency internals and deployed state are not attributed to Exo.

Runtime and authority

Independent tracing of SRC-1 crates/executor/src/turn_queue.rs, crates/executor/src/basic.rs, crates/executor/src/permissions.rs and crates/executor/src/managed_agents.rs supports RT-RTE-definition-admission, RT-RTE-managed-turn, RT-OBJ-turn-work and the RT-CLM-recovery-scope. Queue admission captures configuration and registers the observer before enqueue visibility. Wake failure does not revoke accepted work. Basic reconstructs committed requests, authorizes before dispatch and refuses unsupported unresolved replay. Neither durable acceptance nor a completion marker warrants task correctness or exactly-once external effects. The report preserves these distinctions.

RT-CMP-managed-executor, RT-CMP-model-binding, RT-CMP-typescript-runner, RT-RTE-responses-loop and RT-RTE-rlm-subquery retain distinct owners and context boundaries. Direct inspection of SRC-1 crates/executor/src/native/managed_executor.rs, crates/executor/src/native/typescript.rs, crates/executor/src/native/rlm.rs, exoharness/typescript/model-runtime/shared.ts and exoharness/typescript/model-runtime/turn-loop.ts supports dispatch, host Node launch, model configuration, registry reconstruction and selected-input/no-tool subqueries. Provider parameters and resolved versions remain uninspected; the reports infer neither training nor fixed weights.

The RT-RTE-native-bridge is not another execution of the Responses loop. SRC-1 exoharness/typescript/codex/harness.ts and exoharness/examples/typescript/pi-harness.ts support separate instruction/history delivery, Codex reuse/resume/replay and guarded reattachment. The reported Codex findings are not generalized to all native agents.

The RT-OBJ-tool-registry, RT-RTE-tool-admission and RT-BAP-installed-code are supported by SRC-1 exoharness/typescript/harness/tool-registry.ts, exoharness/typescript/harness/tool-modules.ts and exoharness/typescript/harness/tools.ts. Import and initialization precede successful registry publication; later handler authorization cannot sandbox earlier host execution. Replacement cleanup is not semantic rollback. The RT-CLM-isolation-scope correctly separates these paths from sandbox commands; local-process acquisition and managed vault checks support its narrower rejection guarantees, not whole-runtime isolation.

For RT-RTE-background-wakeup, SRC-1 crates/executor/src/native/scheduler_runtime.rs and crates/executor/src/native/conversation_wakeup.rs show artifact/pending-fire persistence before delivery, followed by delivery marking and session closure. A crash between delivery and marking can repeat delivery. SRC-1 exoharness/cloudflare/src/provider.ts and exoharness/cloudflare/src/index.ts independently support hosted drain/recovery and front-door authentication, not eventual execution or backend parity.

Retained content and epistemic force

SRC-1 crates/exoharness/src/basic.rs, exo/tools/memory-tools.ts, exo/tools/todo-tools.ts, exoharness/typescript/harness/skill-tools.ts and exo/harness.ts support the memory objects and their lifecycle findings: MEM-OBJ-artifact-versions, MEM-OBJ-exo-memory, MEM-OBJ-exo-todos, MEM-OBJ-skills-index and MEM-OBJ-skill-record. I traced writes through latest-version selection to the actual instruction/tool-result consumer. Facts are agent-wide, todos conversation-local, and catalog metadata is not the skill body. Caps constrain the inspected writers; these are not authenticated truth stores or universal context budgets.

MEM-RTE-fact-revision, MEM-RTE-plan-replacement and MEM-RTE-skill-lifecycle accurately distinguish corruption and withdrawal. Memory corruption blocks writes and yields a warning; malformed todos can disappear from injection; skill uninstall unlists without deleting the payload or blocking direct bundled-file reads. The epistemic EPI-RTE-memory-write, EPI-RTE-memory-read, EPI-RTE-memory-forget, EPI-RTE-skills-install, EPI-RTE-skills-read and EPI-RTE-todo-state assessments preserve these mechanisms without promoting retention or operational reliance into epistemic acceptance. The EPI-CLM-memory-authority records requested reliance, not established warrant. The RT-BAP-harness-instructions and memory annotations correctly distinguish shipped identity, reread local profile, injected content and model compliance.

Independent inspection of SRC-1 exoharness/typescript/harness/tools.ts, exoharness/typescript/harness/index.ts and exoharness/typescript/codex/replay.ts supports MEM-RTE-result-offload and MEM-RTE-codex-compaction. Full result bytes, normalized envelopes, model-visible previews and opaque native state are different parts. Replay chunks preserve pending call/output units and can exceed the nominal chunk size for one oversized unit. Native compaction is requested between chunks; its semantic payload remains opaque. Both explicit Part of: relations have supported containment and do not supersede the enclosing runtime routes.

MEM-OBJ-sandbox-snapshots and MEM-RTE-sandbox-rewind match SRC-1 crates/executor/src/native/harness_tool.rs: backend restoration and registry updates do not implement transactional restoration of conversation artifacts or history. MEM-CLM-history-inspection is supported as registered read-back, not admitted lessons. Additional inspection of SRC-1 crates/executor/src/native/conversation_events.rs confirmed filter/cursor delivery; it does not establish a general full-artifact reload tool.

For EPI-OBJ-web-result and EPI-RTE-web-access, SRC-1 exo/tools/web-tools.ts supports import, extraction, caching and transport checks. The report's concrete fallback deduction follows the inspected replacement ordering; it is not an observed fetch. Extraction can remove qualifications, so the unknown source warrant and bounded transformation assessment are appropriate. The ledger separates checking, retention, selection, withdrawal and behavioral adaptation. No inspected structural gate is misclassified as factual acceptance, and generated answers are not assigned unsupported entailment or conjecture status.

Self-change and workflow

SRC-1 exo/tools/guardian-tools.ts, exo/scripts/deferred-rebuild-and-restart and exo/scripts/exo-service-guardian support RT-OBJ-guardian-update, RT-RTE-guardian-update and RT-BAP-rebuilt-services. The two-second delay is not a turn-completion barrier, and completion recording can fail. The reports preserve that counterexample to the tool description. SRC-1 scripts/precommit.mjs, package.json and the hook/CI configuration support EPI-RTE-development-checks, but ordinary guardian builds do not invoke that gate. The EPI-CLM-recursive-improvement, from SRC-1 docs/RSI.md, is therefore compared with conditional own-source change capacity, not demonstrated improvement. Missing objective-responsive update and subsequent causal dependence are not replaced by build success. Learning, reflection, autonomy and theory-builder findings remain separately bounded rather than bundled into a system-wide negative.

Direct inspection of SRC-1 eval/harbor/src/exo_harbor/plugin.py, eval/harbor/src/exo_harbor/agent.py, eval/harbor/src/exo_harbor/exo.py and eval/harbor/src/exo_harbor/trajectory.py supports both EPI-RTE-harbor-task and WF-RTE-harbor-trial. The plugin rejects concurrent default-Exo trials, reuses an existing agent, and does not reapply the requested model to that agent. Container selection rejects ambiguity. Timeout kills the wrapper subprocess; the reports do not infer rollback or cancellation of every effect. Export in finally can fail without replacing the task failure. The WF-OBJ-trajectory is a single-page, schema-checked projection using available values or previews, not a complete journal or correctness verdict. The EPI-CLM-shared-trials does not establish learning or grade-responsive adoption.

Reconciliation and omission disposition

The reconciliation preserves compatible findings. Its memory-entry, todo-object and todo-route supersessions identify the same source-native referents without transferring stronger status. The combined epistemic skill object remains a valid container alongside the memory catalog/payload parts. Specialized memory and epistemic functions, and the narrower Harbor account versus whole trial orchestration, are compatible granularities rather than replacement identities. No missing operative part or contradictory finding requires an unresolved-conflict paragraph. All six memory integration issues receive dispositions; neither supersession nor convergence erases provenance, compaction, reload or withdrawal uncertainty.

Omission questions were selected from the frozen tree and producer/consumer dependencies, not only the retained quotations. I investigated whether alternate native/hosted routes defeat Basic-only recovery claims; whether tool loading escapes handler authorization; whether unlisting revokes every skill consumer; whether result offload has a demonstrated general reload consumer; whether maintenance or evaluation supplies the missing improvement gate; and whether trajectory delivery preserves the producing journal. The traces above support the existing qualifications. Scoped searches of SRC-1 exo/profiles/, exoharness/typescript/harness/, exo/tools/introspection-tools.ts, exo/SELF.md and docs/SELF-CONTROL.md supplied additional path and doctrine checks, not execution evidence.

Further omission expansion stopped because these questions have supported dispositions and no identified material challenge remains unresolved. Claude/Cursor internals, complete adapter lifecycle, hosted retention, backend snapshot fidelity, full fork lineage and external grading were not comprehensively verified. The records already withhold parity, complete inventory, universal reload, complete lineage, empirical reliability and improvement conclusions. Their named uncertainties do not assert absence and do not invalidate the positive mechanisms. I found no additional local defect requiring a publication limit; these existing scope qualifications must remain attached to downstream claims.

Blockers

none

Limits

none