Citadel synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
From engineering work to retained memory
Citadel is an organization-memory service for people and coding agents, not the enclosing agent runtime that performs engineering tasks. This code-grounded account covers its shipped capture, admission, maintenance and retrieval loop at commit 749a24014a6cef59499dbe13b6fb4c348f8044a4 of masumi-network/citadel, with an analysis cutoff of 2026-11-09. SRC-1 supplies implementation, design and attributed reporting; no supplied execution trace or causal experiment establishes deployed operation or benefit. Whole-system scope includes CLI, HTTP, MCP, hooks, browser/plugin consumers and scheduled drivers, but does not mean every branch was inspected. External provider internals, private corpora and host behavior are outside the captured evidence. See the boundary and Source register.
The strongest supported experience-reuse contribution is a wired chain from recorded sessions to durable, selective context for later work. A SessionEnd hook deterministically extracts a personal note and requests authenticated ingestion. Volunteered sharing can instead distill a shared trace containing selected task, approach, commands and dead-end descriptions, or accept already-authored text. Personal capture and sharing are different routes; sharing writes to personal and reference-only shared scopes. These automatic trace-fed transformations and later search/document consumers establish durable experience reuse without weight training. They do not establish that later action improves. The supplied-text alternative also leaves original provenance unresolved. See RT-RTE-session-capture, MEM-OBJ-node-note, MEM-OBJ-session-trace and MEM-RTE-share-session.
Extraction is not outcome verification. The personal note labels last assistant text as “Outcome” and collects file paths from tool-use entries without checking successful tool results. An assistant success claim followed by a failed write can therefore yield an apparent successful outcome and “Files changed.” This is a deduction from inspected implementation, not an observed faulty note. It qualifies fidelity, not the existence of the retained experience pathway. See EPI-RTE-note-distill.
Admission, persistence and projection are different decisions
HTTP admission checks identity, role/scope, target and content guards. Ordinary seat writes route privately, but privileged identities and direct local CLI calls have different authority envelopes. Private-by-default is consequently a bounded routing protocol, not universal isolation. Explicit user approval is tool policy, not a server consent attestation: automatic hooks and known-work promotion do not require per-item human approval. These alternate paths do not demonstrate remote privilege escalation. See RT-RTE-ingest-admission, RT-RTE-local-access and RT-CLM-explicit-approval.
Lifecycle mode retains source bytes and revision/head relations in SQLite, then records separate projection jobs and receipts. Acceptance identifies retained source and work to do; it does not attest completed indexing. A leased worker reloads source, checks relational visibility, projects/checks vector chunks and optionally projects/checks graph presence. Lexical retrieval can use retained bytes before vector/graph completion. Legacy direct-provider mode has different retention and duplicate-handling semantics. These mechanisms support source-level recovery paths, not measured durability or semantic correctness. See MEM-OBJ-source-revisions, MEM-OBJ-projection-receipts, RT-OBJ-ingest-result and RT-RTE-source-projection.
The inspected HTTP path suppresses synchronous generative enrichment, not all model computation: deferred capture can start vector-only work, and later graph work can use models. Optional direct-learning callers can enable generated chunks, summaries and tags. Their parser checks shape rather than comparing semantic fidelity with the original source. Provider models and mutable aliases are separate from stored embedding vectors; no inspected note/projection write establishes weight training. See MEM-RTE-source-enrichment, EPI-OBJ-enriched-chunk, RT-CMP-openrouter-chat, RT-CMP-promotion-decision, RT-CMP-embedding-profile and RT-CMP-cognee-models.
Source retention also has an independent vault route. Obsidian JSON history can save an accepted revision before size/scan checks reject its searchable copy. A rejected search admission therefore need not mean no retained source anywhere. Tombstones and current-head bindings exclude obsolete material in named lifecycle search branches, but historical revision drilldown is not restricted to current heads. Neither mechanism establishes physical erasure or retraction of context already emitted. See MEM-RTE-vault-sync, MEM-BAP-current-head, EPI-RTE-source-withdrawal and MEM-RTE-document-drilldown.
Crossing from personal scope into shared Central
Scheduled promotion is the representative multi-step workflow. Its driver checks enablement and a current Central evaluation receipt, then iterates seats. Best-effort seed searches produce capped candidates, possibly summaries rather than full original documents. Personal/secret controls and organization-reference heuristics precede bounded model triage. A usable negative typed-model decision is retained; chat fallback occurs only when no usable typed verdict exists. Fixed relevance, sensitivity, score and rejection-history rules decide the next action. This is bounded model delegation, not a tool-using child agent. See RT-RTE-promotion-review and its workflow account.
Qualifying known work can enter Central automatically; qualifying new-project work enters review. The review list removes the stored candidate body and exposes a redacted preview/metadata. An admin-authorized approval reloads the full candidate for guarded seat/Central writes without repeating model triage. Browser confirmation offers a human decision opportunity, but credentials alone do not establish human agency. Backend promoted means accepted Central content and audit, not completed indexing or later host reliance. Failed approval still consumes the pending item; sequential writes lack an established atomic rollback, and the browser handler does not inspect promoted before reloading. Thus HTTP success is not delivery proof. These are implementation findings, not an observed failed workflow. See RT-RTE-promotion-review and workflow.
What reaches the next task, and what it warrants
Explicit MCP/CLI search returns requested context. The task hook instead cleans the current prompt into a query, requests scoped hits, then automatically supplies at most three short descriptions to the host: 500 characters per description within a 6,000-character outer cap. MCP/CLI have a separate default 2,000-character hit-text budget, configurable or disableable. Full bodies generally remain outside the model window; an explicit document call can expand an available pointer. This is bounded external-memory supply, not host conversation compaction or subagent-frame management. The host owns subsequent action. See RT-RTE-task-search, its memory annotation, MEM-RTE-document-drilldown and RT-BAP-context-delivery.
Retrieved content is untrusted reference, including Central content. Source pointers enable checking; they do not attest truth. Backend read checks establish projection availability. Promotion assesses sharing eligibility. Conflict detection measures title/hash differences, and resolving its warning does not itself revise source truth. CLI verify supplies lexical/source-shape pointers, not factual validation. These distinct evaluators cannot be compressed into a single knowledge-acceptance gate. See EPI-CLM-context-links, EPI-RTE-conflict-record and EPI-RTE-verify-report.
The retrieval benchmark does provide a bounded evidence-consuming comparison: expected answer spans and document identities determine metrics, and a separate comparator can fail its invoking command for missing, noncomparable or regressing evidence. A matched span need not be true or come from the expected source. The README's reported score is not a supplied authenticated run, and no downstream deployment gate or component-level causal benefit is established. Automation permission is a separate receipt check over scope, timestamps and five Boolean assertions; it does not replay their measurements. See EPI-RTE-benchmark-gate, MEM-CLM-retrieval-evaluation, EPI-CLM-benchmark-score and EPI-RTE-automation-receipt.
Maintenance and the assessment it supports
Scheduled curation has a concrete retained output: additive optimization notes proposed from recent document labels/tags, parsed for known labels and admitted through learning writes. It does not edit the original source. Its dry-run guard suppresses note application, not the preceding provider improve call. Feedback separately produces metadata decisions or searchable fallback notes; ranking-evaluation candidacy does not install a ranker, and raw feedback text is not established as optimization-model input. Upstream Cognee improve/global-context-index successors remain opaque. See RT-RTE-index-curation, MEM-OBJ-optimization-note, MEM-RTE-feedback-processing and MEM-OBJ-search-projections.
For later engineering-context lookup, the supported capacity is scoped retention, selective experience consolidation, bounded delivery and explicit expansion. For attested factual knowledge or demonstrated improvement of future action, the evidence does not close the necessary acceptance and outcome links. Generated chunks, notes and digest interpretations remain semantically indeterminate candidates rather than established accepted new claims; lack of entailment evidence alone does not prove novelty. The digest can be returned or posted without being retained as accepted knowledge. See MEM-RTE-source-enrichment and EPI-RTE-digest-build.
These partial contributions do not settle independent theory-building or self-change properties. The runtime does not establish conditions 1–4 of a theory builder for the curation route: its optimization prompt is guidance, not demonstrated formulated methodological criticism and iteration. Criticism of consumed theory improving future capacity is unestablished. Reflection and autonomous theory building are separately unestablished, not disproved by missing traces. Automatic maintenance is not by itself evidence for either. For self-improvement at the Citadel service boundary, retained notes could enter later behavioral paths, but objective-responsive update determination and subsequent operation causally depending on the change are not established; successful improvement is also unobserved. Opaque provider processing warrants no absence claim. See RT-RTE-index-curation, RT-OBJ-optimize-prompt and the epistemic bounded conclusion.
Paired source/output artifacts would change the fidelity assessment. Item-linked acceptance, projection and host-consumption traces would establish exercised delivery. Objective-bearing update evidence and subsequent controlled comparisons could change the improvement assessment, with component attribution requiring independent component variation. Inspectable provider successors and receipt-issuer measurements would change the maintenance account. No new source inspection was needed for this synthesis.
Limitations
| limitation | affected SRC IDs and record citations | inspected boundary | conclusion prevented | evidence that would resolve it |
|---|---|---|---|---|
| Opaque provider maintenance and asserted evaluation checks; carried report-verification limit | SRC-1; MEM-OBJ-search-projections, RT-RTE-index-curation, EPI-RTE-automation-receipt; verification limits | Repository gateway calls, explicit note writes and receipt reader, not provider successor or issuer measurements | Complete maintenance-transformation, accepted-knowledge and improvement comparisons for the opaque alternative | Inspectable update inputs, retained successor, later consumer and authenticated issuer measurement evidence |
| Incomplete alternative-route and recovery coverage; carried report-verification limit | SRC-1; MEM-RTE-vault-sync, MEM-RTE-document-drilldown, EPI-RTE-source-withdrawal, memory coverage; verification limits | Connector checkpoints, backup/restore, some repair/capture branches and detailed plugin application remain incompletely traced | Complete corpus, universal erasure, cross-store rollback and exhaustive route-inventory comparisons; complete memory inventories | Traced alternative admission/return paths, checkpoint/restore semantics and client transformations at the frozen boundary |
| Implementation does not establish activation or benefit | SRC-1; RT-RTE-task-search, RT-RTE-source-projection, RT-RTE-promotion-review, EPI-RTE-benchmark-gate | Source and attributed reporting; no supplied observed-run or causal-experiment layer | Successful deployment/recovery, host compliance, realized recall/latency or causal task improvement | Item-linked execution/consumer traces and appropriately controlled outcome comparisons |
| Transformation fidelity and original provenance remain local uncertainties | SRC-1; EPI-RTE-note-distill, MEM-RTE-source-enrichment, MEM-OBJ-session-trace, EPI-RTE-digest-build | Selection/shape checks and prompts, not paired production instances or supplied-text origin | Verified outcomes, complete semantic preservation or accepted novel factual claims | Provenanced source/output pairs, tool-effect evidence and evidence-consuming claim acceptance for a named use |
| Bounded review visibility and nontransactional delivery | SRC-1; RT-RTE-promotion-review, workflow handoffs and recovery, MEM-RTE-share-session | Preview-only review list, full-body approval reload, consumed failed approvals and sequential multi-target writes | Full-content verification from the review list, universal human approval, atomic delivery or guaranteed retry | Full review-consumer evidence and inspected transactional/retry semantics, with execution traces for exercised recovery |