semquery report verification

Type: agentic-system-analyses/types/agentic-system-verification.md

Verification

The supplied reports support a bounded implementation account of document indexing, persistent hybrid retrieval and returning question answering. No material blocker was found. This judgment does not establish successful execution, faithful answers, deployed model identity or causal benefit.

I read all supplied members, correction-answer files and the structural report. The answer files are empty; there is no correction argument to accept or reject. The structural report states none, so it supplies no structural failure requiring routing. I independently inspected the frozen source rather than treating the analysts' validation statements as semantic verification. The checkout HEAD equals the reviewed revision and its working tree is clean. The tracked tree, workspace manifest, executable declaration and library exports agree with the boundary: the shipped CLI is inside the system, and downstream applications are not. All source inspection below is SRC-1 implementation or attributed doctrine/design, not observed-run or causal evidence.

Runtime and downstream delivery

I traced CLI registration and add-time drift selection through Engine construction, lazy loading, source iteration, preparation, batching and metadata updates in SRC-1 crates/semquery/src/main.rs, crates/semquery/src/engine.rs, crates/semquery-indexer/src/indexer.rs and crates/semquery-storage/src/sqlite.rs. RT-RTE-index-admission correctly separates user initiation from automatic content admission. Registration precedes model loading; five-file transaction commits, deletion sweeps and baseline updates do not form a whole-run transaction. RT-CLM-transaction-scope preserves that distinction and does not infer same-connection caller isolation from individual mutex acquisitions. The all-source wrapper recalculates drift within successive source passes; its early baseline update supports the report's qualification of all-collection reembedding. Search/ask do not invoke a freshness barrier.

I traced both recall branches, error propagation, fusion, optional reranking, chunk lookup, path resolution and final assembly in SRC-1 crates/semquery-retrieve/src/retriever.rs and crates/semquery-retrieve/src/fusion.rs. RT-RTE-hybrid-search is supported: either recall error stops the pipeline; rank fusion ignores raw score magnitudes; an injected absent reranker preserves fused ordering, whereas an unfilled configured cell errors. Empty queries terminate in Retriever only after ordinary Engine loading. These are selection mechanisms, not factual evaluators.

For RT-RTE-answer-generation, I followed direct synthesis and streaming synthesis through SRC-1 crates/semquery-synth/src/synthesizer.rs, crates/semquery-synth/src/prompt.rs, crates/semquery-synth/src/citation.rs, crates/semquery-model/src/gguf.rs, Engine forwarding and CLI output. Five-hit retrieval precedes generation; no hits return an empty answer. Both concrete GGUF completion methods allocate fresh contexts and keep only a suffix of over-budget formatted input. Query strings have no total prompt-token admission bound here, so over-budget reachability is not inferred from a dead branch alone. The pre-truncation marker set remains unchanged. Both synthesis variants return raw text; metadata filtering does not scrub displayed markers or test sentence support. RT-CLM-citation-filter and RT-BAP-prompt-influence correctly bound enforcement to metadata and describe natural-language grounding as a request.

The workflow account faithfully follows this shipped path rather than inventing agent delegation. Token callbacks precede citation checking; ignored send failures do not cancel active inference. The current-thread callback uses best-effort sends, while the ordinary CLI has a multithreaded runtime. The report preserves that condition instead of alleging routine CLI token loss. Text mode does not replace printed deltas with terminal text; JSON prefers the terminal answer and has a buffered fallback; Engine's collecting ask requires a terminal answer. Error propagation, possible partial display and caller-driven reinvocation are correctly distinguished from durable recovery and successful delivery.

Model, memory and epistemic records

I inspected SRC-1 crates/semquery-model/src/embed.rs, crates/semquery-model/src/rerank.rs, crates/semquery-model/src/hub.rs, crates/semquery-model/src/gguf.rs, crates/semquery/src/config.rs and the Engine loaders. RT-CMP-fast-embed, RT-CMP-fast-reranker and RT-CMP-gguf-llm distinguish inference from parameter updates, configured specs from authenticated artifacts, and symbolic revisions from immutable pins. FastEmbed options do not forward configured revision/filename. GGUF resolution has no explicit checksum verification here. RT-RTE-config-admission correctly covers external configuration and component injection without attributing runtime self-revision or known human authorship to them.

Reader, chunker, segmenter, schema and write/read consumer inspection supports the separate operative identities of MEM-OBJ-chunks, MEM-OBJ-fts-chunks, MEM-OBJ-vec-chunks and MEM-OBJ-document-paths. Text slices, lexical derivatives, dense vectors and fixed-rule association/control state are not interchangeable. Evidence anchors include SRC-1 crates/semquery-indexer/src/chunker.rs, crates/semquery-indexer/src/tokenizer.rs, crates/semquery-indexer/src/indexer.rs and crates/semquery-storage/src/sqlite.rs. The lexical replacement qualification below does not undermine the existence of these parts or their later consumers.

MEM-CLM-chunk-lineage survives tracing from content-hash insertion through associated-document selection and citation formatting: the single retained range and lexicographically selected document need not identify the same occurrence. MEM-CLM-empty-retention also survives tracing: directory membership is computed before extraction; a listed empty/invalid-data file can skip preparation without unlinking old chunks. Explicit deletion uses path-component and surviving-root checks; directory sweep instead uses a raw string prefix. The sibling-prefix hazard is reachable with separately registered sibling paths and is correctly reported as a possibility, not observed loss. Shared-chunk preservation and orphan deletion remain independently supported.

MEM-OBJ-config, MEM-OBJ-system-prompt and MEM-OBJ-semq-log have different content and consumers despite shared file-based substrates. CLI logging and config creation establish automatic retention, not human approval or an automatic diagnostic-to-policy transformation. The memory annotations preserve query-requested selection, actual selected payloads, context budgets and separate maintenance/cache consumers.

I checked every epistemic declaration against its source and the supplied routes. EPI-OBJ-document-source is pre-chunk extracted input; EPI-OBJ-prompt is transient formatted input; EPI-OBJ-answer and EPI-OBJ-citation have different forms and checks. EPI-RTE-reader-import is contained within indexing, and EPI-RTE-marker-check within answer generation: both Part of: relations are semantically supported. The DOCX paragraph-boundary counterexample follows from the complete extraction match, not merely a missing separator in one branch. Marker checking uses exact offered strings and first-occurrence deduplication; its consumer filters metadata without accepting answer propositions. The ledger correctly separates transformation, retention, selection, checking and disposition. EPI-CLM-cited-answers matches SRC-1 README.md without inventing a universal factual-validation promise. Generated content's entailment/ampliation remains indeterminate without an instance, independently of known generation wiring.

Reconciliation, omissions and stopping decision

I checked every declaration, source-anchor support, evidence status and annotation across the reports, including empty absence inventories. Route implementation statuses are supported as wiring; no run or causal status is promoted from code or test definitions. No theory-builder, learning, reflection or self-improvement property is inferred from another. The reconciliation correctly distinguishes objects from their producing routes and route parts from duplicate whole routes. There are no supersessions to justify and no unresolved cross-report conflicts requiring repair. Its integration dispositions preserve the memory lineage, freshness and withdrawal qualifications; they do not silently select a stronger guarantee.

Omission questions were selected from the frozen tree and producer/consumer chain: could an alternate shipped client bypass citation filtering, preserve omitted context, impose factual acceptance, persist answers into future policy, or change maintenance guarantees? I inspected Engine injection, the public trait defaults in SRC-1 crates/semquery-core/src/traits.rs, both synthesis paths, both GGUF completion paths, direct-file versus multi-source indexing, explicit deletion versus directory sweep, CLI config/logging and the shipped integration/check drivers. This supports the reports' adapter-scoped conclusions and leaves arbitrary injected components outside those conclusions. SRC-1 test-integration.sh invokes post-deletion search/ask but supplies no execution result or factual acceptance oracle. Proposed cascade/context changes in SRC-1 docs/todo.md and docs/optimize.md do not override the inspected executable routes. No additional shipped consumer establishing answer write-back or evaluation-fed revision was identified in these selected surfaces.

Further optional omission expansion stopped because the consequential questions have supported dispositions and no identified material challenge remains unresolved. Exhaustive dependency, extractor, corpus and backend correctness audits would exceed the breadth claimed. Existing uncertainty about dependency internals, user content, model artifacts and actual operation is faithfully scoped in the reports, not evidenced absence. The remaining local lexical-maintenance issue is retained below; broader conclusions about exact replacement and lexical freshness should be withheld without invalidating the bounded retrieval account.

Blockers

none

Limits

• MEM-OBJ-fts-chunks describes lexical derivatives as overwritten for inserted/reembedded IDs, but exact replacement and duplicate-free lexical maintenance are not established by the inspected SQL. SRC-1 crates/semquery-storage/src/sqlite.rs declares an FTS5 chunk_id column without a uniqueness constraint and inserts with INSERT OR REPLACE; the reembedding write chain does not first delete lexical rows for those IDs. Readers should withhold exact-replacement and duplicate-free lexical-ranking comparisons, while retaining the supported segmentation, persistence and query-dependent read-back findings. This is a local maintenance qualification, not evidence that hybrid retrieval or orphan deletion is absent.

let mut stmt = conn.prepare("INSERT OR REPLACE INTO fts_chunks (chunk_id, text) VALUES (?1, ?2)")?; --- crates/semquery-storage/src/sqlite.rs

chunk_id, text, tokenize='unicode61' --- crates/semquery-storage/src/sqlite.rs