Phantom synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
Admit work, construct context, execute effects
Phantom is an enclosing agent service: it owns ingress, sessions, prompt construction, tools, persistence, scheduled work and instruction maintenance, while a selectable Agent SDK owns the inner model/tool loop. This account covers the shipped system at commit f8c7ab42d885936ee54abc785528000260f4acc5, with an analysis cutoff of 2026-10-15. The sole source, SRC-1, supplies inspected implementation and declared design. No target code or tests were executed, and no independent execution trace or causal experiment was supplied. The whole-system boundary includes shipped callers and maintenance paths, but not dependency internals, live deployment state or the external cloud control plane. See the boundary and Source register.
The declared product is a persistent autonomous co-worker with workstation access and accumulating capabilities. Implementation supports consequential action, not just advice: model-selected tools can affect files, shell processes, Docker, browser and communications. Actual grants and successful work are separate questions. A normal channel request enters a router callback, reaches a session-keyed runtime, receives assembled instructions and retained context, and runs through the SDK. The caller delivers returned text. Session serialization is instance-local; stale SDK history gets one retry without resume. Neither an error response nor timeout rolls back effects already performed. These mechanisms support action capacity, not the prompt's stronger claim that knowledge and capabilities compound with every conversation. RT-CLM-autonomous-worker, RT-RTE-channel-work.
Browser chat, scheduled jobs, HTTP triggers and MCP requests have distinct outer drivers. Browser chat commits messages, translates streaming SDK events and retains run timelines; abort and error can leave events without a committed assistant message. Scheduler and direct requests share foreground execution, but do not traverse the channel callback's post-response learning submissions. Shared runtime access therefore does not establish equal trace admission across ingress types. RT-RTE-durable-chat, RT-RTE-direct-work, MEM-CLM-universal-memory.
Controls are route-specific. Foreground SDK permissions default to bypass; configured options depend on the selected SDK honoring them. The direct Bash hook is best-effort screening, not confinement. Dynamic-tool registration can persist shell/script definitions whose later execution occurs outside that hook, under process rights. Judge and reflection queries have separate controls. Operator edits to YAML, skills, hooks and plugins have their own shape checks and consumers; a successful YAML save does not establish immediate replacement of the live runtime configuration. These routes do not share a universal approval, safety or correctness gate. RT-RTE-dynamic-tools, RT-BAP-handler-execution, RT-RTE-judge-call, RT-RTE-operator-config.
Retain selected experience, not a verified conversation model
After channel delivery, two parallel paths can retain experience. Vector extraction creates an episode from a truncated first user message and sparse task metadata, and pattern-matches user messages for preference/correction facts. Extractor-assigned confidence is not measured accuracy; task outcome comes from an Error: prefix convention. Negation and truncation counterexamples defeat universal semantic preservation without proving that a downstream model necessarily misreads every such item. The separate reflection path curates instruction files. Neither path establishes verified memories of every conversation. MEM-RTE-vector-extraction, MEM-OBJ-episodes, MEM-OBJ-semantic-facts, epistemic extraction assessment.
Fact conflict handling changes recall eligibility rather than checking logical contradiction. It selects similar active items sharing a subject, without requiring equal predicates, and expires an older item when incoming confidence is at least as high. Lower-confidence new candidates still persist. Default recall excludes expired facts, but temporal recall can return them. Storage and confidence do not upgrade source warrant; deletion likewise does not retract already delivered or derived copies. EPI-RTE-similarity-check, EPI-RTE-validity-change, EPI-RTE-fact-retention, MEM-RTE-operator-memory.
Later foreground context is a projection of these stores. Query-driven retrieval supplies fact text/confidence, episode summaries and one procedure's selected steps. It omits source episode IDs, episode details and procedure conditions. The shipped memory budget is 50,000 estimated tokens, calculated from characters rather than a tokenizer, and excludes the rest of the prompt. A too-large fact section is omitted whole. Requested memory tools can expose fuller payloads, but delivery is not demonstrated reliance. Procedure storage and lookup exist; a bounded non-test source search established no shipped automatic trace-to-procedure producer or outcome-update loop. MEM-RTE-vector-context, MEM-RTE-memory-tools, MEM-OBJ-procedures, MEM-ABS-procedure-learning.
File memory adds different selectors. Working memory is automatically injected, with head/tail line clipping and a trust instruction; line limits are not token limits. Agent notes are deliberately excluded from automatic injection and require tool reading. Their append-only rule is foreground guidance, not a global filesystem invariant. Arbitrary dashboard-visible user Markdown is editable, but its automatic SDK loading is uninspected. MEM-OBJ-working-memory, MEM-OBJ-agent-notes, MEM-OBJ-user-memory.
Chat continuity is another selective route. Code builds a supplement from at most 5,000 recent events, eight page artifacts and three compaction checkpoints, with durable timeline artifacts as an additional source. Events expire after 24 hours; timeline artifacts can survive longer. Compact-boundary metadata is not the SDK's opaque summary. With Murph configured, the host replaces earlier tagged supplements rather than compacting the whole conversation itself. A session-bound lexical search can reload redacted committed-message snippets, not all discarded reasoning, tool output or attachment content. This supports bounded continuity and reload capacity, not complete context restoration. RT-RTE-chat-context, MEM-OBJ-chat-events, MEM-OBJ-chat-timelines, MEM-RTE-transcript-recovery.
Revise standing instructions under branch-limited admission
The strongest supported improvement-directed contribution is a wired path from selected conversational evidence to persistent instructions and later prompt delivery. A gate model judges sampled session material for maintenance worthiness; exceptions fail open into a durable queue. Cadence stages queued summaries for a separate reflection model, which edits files before software admission. The teaching prompt requests durable preferences, correction, compaction, deduplication and promotion. This is an implemented request and editing capacity, not evidence that those transformations were performed faithfully or helpfully. RT-RTE-reflection-admission, MEM-OBJ-evolution-queue.
Admission checks covered post-state structure, protected bytes and narrow patterns, not the truth or usefulness of a retained proposition. Hard failures attempt restoration; soft warnings do not veto. A skip sentinel bypasses post-state checking/restoration, and snapshots exclude top-level meta/staging. Compaction is a per-file change action under ok, not a separate admitted status: changed-ok compactions do refresh live evolved configuration. Automatic foreground delivery then selects only persona, user profile, domain knowledge and three fixed strategy files, each subject to the formatter's more-than-one-content-line condition. Corrections, principles and arbitrary new strategy files can shape later reflection, but require promotion into a selected file for automatic foreground evolved-section delivery. File-level version summaries retain limited lineage, not generic per-bullet evidence or full reasons. RT-RTE-reflection-admission, MEM-OBJ-evolved-files, MEM-OBJ-reflection-context, MEM-OBJ-evolution-log.
These properties remain independent at this boundary:
- Theory-builder conditions 1–4: localized language content is afforded; content-sensitive consumption is claimed; content-directed criticism is uninspected; recurrent retention/read-back machinery is wired. Recurrence does not establish iteration of actual criticism. Files and sections are inspectable/editable, but no observed candidate or criticism establishes a complete theory-building episode.
- Learning as improved future-action capacity: durable behavior-shaping capacity is afforded, but improvement attributable to criticism of a consumed theory is not established. Automatic trace-fed retention and later consumers exist without proving that stronger learning claim.
- Reflection: selected prior work is represented in summaries wired to instruction revision and later prompts. Exact fidelity and exercised two-way causal effect remain unobserved. Reflective theory building is uninspected because no criticism/revision of the maintenance method against its own operation is supplied.
- Autonomy: computational proposal and branch-limited software admission need no per-edit human decision on the reflection route. That does not establish an autonomous theory builder performing all four operations.
- Self-improvement: the source supports dispositional improvement-directed self-change across sessions, aimed independently at better retention/use of durable preferences and strategies. Evidence can shape edits, edits can alter persistent instructions, and selected outputs can enter later prompts. Subsequent operation causally depending on the particular change remains unestablished; successful improvement additionally lacks outcome/comparison evidence. Neither exercised nor beneficial self-improvement follows.
All these assessments are bounded by RT-RTE-reflection-admission. External model inference is present, but inspected wrappers do not train model weights and exact provider versions remain unpinned. Retention, proposition acceptance and lifecycle integration are not interchangeable: the assessed checks establish no produced accepted ampliative claim, while partial epistemic coverage prevents a system-complete negative about all possible checking or theory production. RT-CMP-main-model, RT-CMP-reflection-model, epistemic conclusion.
Delegate future work, classify execution, deliver separately
Agent-authored scheduled work is the representative connected workflow. A foreground model supplies a self-contained task and schedule to a tool; software validates shape and schedulability and retains a SQLite job. Creation acknowledges durable delegation, not the future answer. The timer later dispatches the task under sched:<id>, a separate conversation key rather than the originating transcript. The task can recur with its own SDK session. Context completeness is requested, not checked. WF-RTE-job-creation, WF-OBJ-scheduled-job.
Execution uses ordinary SDK/model work. Exceptions or an Error: prefix determine run failure; other text can pass without an independent correctness oracle. Slack delivery has a separate outcome: a non-null transport response establishes the implemented delivered classification, not recipient reading or correctness. Run failures drive backoff and terminal thresholds; delivery failure does not trigger a delivery-only retry or veto completion. A successful delete-after-run job can disappear despite failed delivery. Restart staggering restores overdue eligibility, not interrupted reasoning or exactly-once effects; no atomic transaction joins effects, sending and bookkeeping. A busy empty return can even receive a completion callback label while leaving the row unchanged. These are source-supported distinctions, not observed failures. workflow account, RT-RTE-direct-work.
For a scenario requiring deferred self-contained work, durable task admission and dispatch are wired, while correctness, context completeness and delivery assurance remain separate. For a scenario requiring later preferences or artifact recall, selective read-back is wired, while complete recall and trustworthy proposition acceptance are not established. These conclusions do not describe every instruction-guided path: the shipped ritual skill requests memory-supported candidates and explicit user approval before scheduling, a doctrine-level policy omitted from the selective inventory. report-verification limits.
Evidence that would change the assessment includes a linked trace from admitted input through a retained edit to later change-dependent action; output-level criticism identifying a challenged claim, blame and revised reliance; and an outcome comparison against an independent improvement objective. Dependency inspection and deployment captures would resolve different questions about actual context, enforcement and persistence. System changes such as universal covered post-state checking, explicit ingress learning wiring or delivery-only retry would alter the corresponding source-level guarantees, but would still require operation evidence to establish effectiveness. The verified memory comparison remains partial on all axes because known host routes coexist with opaque SDK state and unresolved initial/caller-dependent branches; bounded existence findings are not a complete-value census. RT-RTE-reflection-admission, profile-verification.
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| No supplied execution or causal comparison | SRC-1; RT-RTE-channel-work, RT-RTE-reflection-admission, WF-RTE-job-creation | Frozen implementation and doctrine only; no target execution | Exercised learning, successful recovery/delivery, change-dependent later action or beneficial self-improvement | Linked input/edit/consumer/action traces and an independently specified outcome comparison |
| External dependencies and deployed envelope are not frozen | SRC-1; boundary, RT-CMP-main-model, RT-OBJ-session-store, RT-RTE-chat-context | Phantom wrappers inspected; SDK/provider/storage and cloud-control-plane internals excluded | Exact weights, full SDK context/compaction/delegation, effective deployed confinement, storage recovery or fleet correctness | Pinned dependency implementations, actual configuration and inspectable deployment/failure evidence |
| Initial memory provenance and some consumers remain unresolved | SRC-1; MEM-OBJ-procedures, MEM-OBJ-retrieval-indexes, MEM-OBJ-reflection-context, MEM-OBJ-user-memory, profile-verification | Known subsequent transformations, not deployed initial contents, historical embeddings, optional session-log writer or all SDK file selectors | Complete provenance, complete comparison values, arbitrary Markdown automatic authority or complete historical learning inputs | Admission histories, embedding identities, session-log producer/consumer records and dependency selector evidence |
| Intended Qdrant access-counter reinforcement is unverified | SRC-1; MEM-RTE-vector-context | Wrapper forwards $inc-shaped payload data; remote semantics not inspected/executed |
Working increment-based reinforcement or its retrieval benefit | Pinned server semantics and an inspectable counter-update/read-back trace |
| Stale inter-report attribution, retained as the reconciliation conflict and report-verification limit | SRC-1; RT-RTE-reflection-admission, MEM-OBJ-evolved-files, MEM-OBJ-reflection-context, memory integration issues, report-verification limits | Current runtime correctly states changed-ok compaction refresh and fixed-loader delivery; memory still attributes the old defects to it | Presenting those two requested runtime repairs as outstanding; this is not an unresolved implementation alternative | A corrected memory attribution agreeing with the current runtime; no additional source mechanism is needed |
| Selective inventory omits a shipped skill-guided checking/approval path | SRC-1; MEM-RTE-memory-tools, WF-RTE-job-creation, epistemic coverage, report-verification limits | Verifier inspected ritual skill guidance: memory-supported temporal candidates and explicit user approval before schedule creation | Exhaustive evaluator or schedule-admission-policy comparisons; treating generic no-compulsory-approval tool admission as every instruction-guided path | Inventory records for this guidance and any other material alternatives; execution evidence separately needed for compliance |