IWE report verification
Type: agentic-system-analyses/types/agentic-system-verification.md
Verification
The reports support a bounded source-grounded account of a document and agent-memory service, not an enclosing model runtime. I independently checked the frozen checkout's HEAD and tracked roots against the boundary, then traced the consequential paths below. All source inspection used SRC-1 at the reviewed revision. Source text supplies implementation or doctrine/design evidence; no target, tests, examples, model or service were executed. The report-check input contains none; all four correction-answer inputs are empty. There are no structural findings or correction arguments requiring disposition.
Runtime, admission and recovery
RT-OBJ-graph and RT-OBJ-session-record correctly separate loaded graph state from serialized capture bookkeeping. The graph's lock does not govern other processes or editor buffers. I checked RT-RTE-cli-document, RT-RTE-mcp-document and RT-BAP-schema-admission against CLI create/body-update/mutation-update and MCP create/update/query handlers, pending conversion, validation and persistence. SRC-1, crates/iwe/src/main.rs, crates/iwec/src/lib.rs, crates/diwe/src/schema.rs.
The reports preserve the important branch distinctions: non-strict CLI writes are supported; strict body replacement does not require mutation-mode count guards; MCP query checks guards before dry-run; existing-key create/skip writes nothing; validation can return clean reports for unbound keys. MCP's checked branches do not establish a universal all-tools schema gate. The filesystem applies changes sequentially, and MCP reloads affected keys after a write error rather than restoring previous files. Post-write warnings are not vetoes. These support the reported conditional enforcement and best-effort recovery, not atomicity. SRC-1, crates/diwe/src/fs.rs, crates/iwec/src/lib.rs.
I checked RT-RTE-editor-reload against open, close, external update and removal handlers. Open-document ownership suppresses disk reload; close releases it. This is an alternate admission path without distill selection, not an observed unauthorized write. MCP startup's stdio/default-loopback and HTTP router construction support the scoped deployment discussion, not public-network safety. SRC-1, crates/iwes/src/router/server.rs, crates/iwec/src/main.rs.
Memory production and later consumption
MEM-OBJ-documents, MEM-OBJ-policy-body and MEM-OBJ-policy-knobs retain the operative distinctions among prose, parsed fields, durable files and their consumers. I checked starter/typed policies, enable's installation branches and rollback scope, section extraction, knob precedence and injection scope. MEM-RTE-memory-enable correctly leaves caller identity and custom policy content unresolved while retaining known initialization transformations. SRC-1, crates/iwe/templates/claude/enable/starter.md, crates/iwe/templates/claude/enable/typed.md, crates/iwe/src/internal/claude/enable.rs, crates/iwe/src/internal/claude/hook/store.rs.
I traced RT-RTE-session-capture, MEM-OBJ-proposal, MEM-OBJ-rejected, MEM-RTE-inbox-read and MEM-RTE-session-adopt through session read/stage/inbox/complete/adopt, proposal settlement, rejection sampling and record serialization. Shape checks do not authenticate evidence or user answers. Grouped output omits evidence and reduces bodies to their first line; one-session pending reads expose the evidence. Adoption drops pending proposals without semantic extraction. Completion can turn unasked pending entries into rejection strings. Accordingly, progress and rejection counts cannot establish reading or genuine human feedback. The reports already preserve these qualifications. SRC-1, crates/iwe/src/internal/claude/session.rs, crates/iwe/src/internal/claude/record.rs.
Digest rendering and chunk advancement support the memory annotation's lossy raw-to-derived chain: tool results, unknown blocks and oversized rendered lines are not full-fidelity transcript delivery. The inbox is durable read-back; it is not a full host continuation checkpoint. Subagent isolation is a shipped instruction, not an IWE-owned context runtime. SRC-1, crates/iwe/src/internal/claude/digest.rs, crates/iwe/templates/claude/prompts/distill.md.
I traced RT-RTE-document-retrieval, RT-RTE-session-index, RT-BAP-session-policy and MEM-RTE-mcp-context through their actual projections and consumers. Seed filtering is not reapplied to all expanded documents; exclusion of emitted keys is not exclusion of all edge metadata. Ordinary retrieval omits arbitrary frontmatter. Index selection excludes machinery entries but can deliver a separate policy section; empty groups suppress that output altogether. First-line clipping is not an absolute slice-size guarantee. MCP resource reads and review/refactor contexts are distinct delivery paths, and resource listing's 100-entry cap is not a read permission cap. None establishes model receipt, compliance or benefit. SRC-1, crates/diwe/src/retrieve.rs, crates/iwe/src/internal/claude/hook/index.rs, crates/iwe/templates/claude/memory_index.md.jinja, crates/iwec/src/lib.rs.
Epistemic and workflow findings
EPI-OBJ-proposal, EPI-OBJ-policy-body, EPI-OBJ-injection and EPI-OBJ-learning-schema have the claimed source-native referents and forms. The schema sample constrains shape rather than factual truth. EPI-RTE-schema-check separates report computation from enforcing disposition. Its derivation claim is explicitly conditional on parsed representation and validator correctness, not a source-truth guarantee. EPI-RTE-post-tool correctly separates post-write diagnostics from vetoes and lexical similarity from same-fact judgment. I inspected both the hook consumer and symmetric score/length gates. SRC-1, crates/iwe/templates/claude/enable/schemas/learning.yaml, crates/diwe/src/schema.rs, crates/iwe/src/internal/claude/hook/post_tool.rs, crates/diwe/src/stats.rs.
MEM-RTE-graph-restructure, EPI-RTE-link-cleanup and EPI-RTE-review-prompts retain appropriately separate effects. Rename/extract/inline handlers check pending documents; normalize persists without that gate. Delete removes parsed incoming links and the target; this does not warrant semantic preservation of surrounding prose or factual rejection. Review questions are implemented prompt output, not implemented model evaluation. SRC-1, crates/iwec/src/lib.rs, crates/liwe/src/operations/delete.rs.
RT-CLM-capture-exclusivity is correctly treated as a host protocol rather than universal enforcement. EPI-CLM-shared-context concerns continuity and access, not a scientific acceptance algorithm. The epistemic ledger preserves requested semantic transformation as indeterminate without paired actual propositions, structural checks as bounded evidence, and retention as distinct from post-acceptance integration. RT-RTE-policy-maintenance and the rejection-ledger annotation support a requested feedback-to-policy pathway and known later consumers, without establishing actual criticism, improved capacity, autonomy or exercised self-improvement. The independently qualified theory assessments are not collapsed into one negative. SRC-1, README.md, crates/iwe/templates/claude/prompts/distill.md, crates/iwe/templates/claude/prompts/reflect.md.
The workflow account follows one coherent shipped procedure. WF-RTE-inbox-selection correctly distinguishes code grouping from the foreground agent's requested evidence-preserving merge and user disposition. I checked all-answer-before-write ordering, named-item unattended exception, strict-write repair instructions, final settlement and delivery summary. The workflow annotation correctly places hub writes before record saving, preserving nontransactional recovery. These are procedure and supporting command wiring, not an observed successful workflow.
Relations, reconciliation and omission disposition
All declared records and their source support were assessed above, including separate implementation/operation statuses and the absence of any evidenced-absence declarations. The Part of: relations are substantively valid: proposals/rejections belong to session bookkeeping; inbox and selection are parts of capture; the policy payload/settings belong to the loaded graph; post-tool diagnostics belong to the combined editor/reload diagnostic route. Containment does not transfer a container's status to a part.
The reconciliation correctly supersedes the duplicate epistemic proposal and policy-body declarations while retaining their findings. Injection-only versus broader knobs, MCP prompt/resource versus broader context alternatives, and inbox reading versus selection are valid narrower accounts, not identical referents requiring wholesale replacement. I checked all integration dispositions: the no-groups guard adds specificity to conditional runtime wording; the ten-document brief claim is source doctrine rather than an asserted runtime count; provenance projection, rejection/adoption semantics and hub-before-save ordering qualify rather than contradict the reports. No unresolved inter-report conflict was found, and no missing required part needs an invented record or supersession.
Omission questions were selected from the frozen tree and producer/consumer dependencies: can another shipped writer bypass the advertised admission protocol; can intermediate projections drop evidence needed by later consumers; and does feedback reach later policy consumers without demonstrating learning? The CLI, MCP mutation variants, editor handlers, completion helper, digest, inbox, resource and index paths answer these questions at the reports' stated breadth. MCP attach was additionally inspected: it selects configured targets, can create or update them, checks pending content and optionally persists. It adds no semantic acceptance or user-selection gate. SRC-1, crates/iwec/src/lib.rs.
Further optional expansion stopped because the identified alternatives either corroborate already bounded conclusions or have the local inventory consequence below. Lower-level transformation semantics, evaluator outcomes and deployed host behavior are not claimed complete or observed. Additional inspection is not needed to sustain this account's positive persistence, context-selection and protocol findings; it would be needed for exhaustive transformation, approval, reliability or benefit comparisons.
Blockers
none
Limits
- RT-RTE-session-capture, its workflow annotation, and the memory write-side inventory describe automatic area-hub linking but do not separately tabulate its admission mechanism. Independent inspection of SRC-1,
crates/iwe/src/internal/claude/session.rs, shows that completion's hub append normalizes and directly writes the hub without the strict CLI/schema gate. This is an additional bounded software-authored maintenance path, not evidence of unselected factual capture. The reports' conditional gate and nontransactional conclusions remain valid; readers should withhold an exhaustive write-admission inventory or an inference that all completion-induced document changes were schema-checked.
let content = normalize_content(store.config(), &Key::name(area), &content); if std::fs::write(&path, content).is_ok() { linked.push((key.clone(), area.to_string())); } ---
crates/iwe/src/internal/claude/session.rs