OpenSage synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
From a supplied task to model-directed work
OpenSage is an enclosing agent runtime built around Google ADK. Its distinctive proposal is that models construct and orchestrate agent topology, capabilities and memory during work instead of relying entirely on developer-authored arrangements. Source inspection supports dynamic agent registration, shell-based script construction and memory-maintenance guidance. It does not establish useful decomposition, successful task execution or improvement caused by those mechanisms (RT-CLM-runtime-creation).
This account covers the repository's shipped runtime, memory, callers and evaluation interfaces at commit 54d64702e18d195c8f0fed711c6db5dc1d62ab29, with an analysis cutoff of 2026-10-14. SRC-1 supplies implementation and doctrine/design. There are no supplied execution traces or causal experiments, and the target and its tests were not executed. External ADK, provider, sandbox-service and trainer bodies are outside the frozen source set. The whole-system functional boundary does not mean every backend, benchmark or extension has been inspected (boundary and evidence, Source register). This synthesis uses the handed records without further target-source reads.
In ordinary CLI operation, an operator selects an executable agent factory and configuration and supplies a task. The host imports the factory, registers templates, creates or restores a root instance and sends the task through its inbox. The manager owns waking, continuation and release; a per-instance ADK runner owns the inner model/tool sequence. The model chooses proposed actions, and Python tools execute effects. Agent names identify templates, while session IDs identify independently retained instances. Separate session state does not imply isolated tools, provider objects or workspaces. CLI idleness and displayed model text are not answer acceptance. The ordinary web route acknowledges enqueueing rather than delivering a finished answer (RT-RTE-user-dispatch).
Constructing capabilities and delegating selected work
A model can propose a child template's instruction, model and tools. The builder checks names and registry availability, registers the template and persists its definition. Creation does not run it or evaluate its competence. Baseline terminal and orchestration tools are added even when the requested tool list is short; MCP prefix selection can add an entire toolset. This is structural admission, not least privilege or a correctness gate. Persisted selectors are re-resolved on restart: missing models can prevent rebuilding, and missing non-baseline tools can be dropped. The separate natural-language instruction subsequently guides the child model (RT-RTE-create-subagent, RT-OBJ-agent-definition, RT-BAP-dynamic-instruction).
Calling a child creates a separate task context by default. Parent events and business state stay out unless the caller requests history inheritance. Synchronous invocation returns extracted final text and a session ID; asynchronous invocation acknowledges a running child and later posts text or an error. Large inbox deliveries may be truncated, with a full-text file available only if saving succeeds. A path is not an automatic reference: the parent must read it. Child return also does not delete its stored context or undo shared-file effects. Context savings therefore depend on selected inputs and returned material, not simply on delegation (RT-RTE-directed-child).
Shell commands can create reusable scripts and files without admitting a new Python tool. Their effect boundary is the selected backend. Local execution uses host bash; native Docker forwards configured privileges, networking and mounts. Trusted factory and plugin imports execute host Python outside model-tool mediation. Neither the sandbox abstraction nor guidance to read before editing establishes universal containment or prevention. Budget enforcement is likewise a soft pre-call guard on covered paths, dependent on usage reporting and capable of concurrent overshoot (RT-RTE-terminal-extension, RT-RTE-host-extension, RT-BAP-tool-guidance, RT-CLM-soft-budget).
These guarantees cannot be generalized to all shipped routes. Websocket live execution calls the existing runner without the directed sleeping-state rejection or ordinary inbox/continuation loop. Local-support and vulnerability drivers construct ADK runners with their own policies. Importing OpenSage patches does not establish that manager-added guards apply (RT-RTE-live-runner, RT-RTE-direct-driver).
Retaining work and choosing what later models see
OpenSage combines agent-requested file reading with automatic context supply. Its wrapper seeds and discloses a shared session wiki, an index and per-agent task files. The default policy requests reusable entries and correction or removal of stale material. It pushes locations and instructions, not the wiki's contents. A later agent must skim the index and request relevant files; semantic approval and synchronized index maintenance are not enforced. File reuse also depends on sandbox survival or reattachment, not merely the label “long-term” (MEM-RTE-wiki-maintenance, MEM-OBJ-knowledge-files).
Enabled history compaction instead selects older, branch-compatible events using character budgets and a call/response-balanced cut, asks a model for a summary, and appends a range marker. Later history construction substitutes the summary for that range while keeping the recent tail. Original events remain in session storage; their omission from the model window is not physical deletion. This is an implemented automatic trace-fed write with a retained result and later consumer, not just raw logging. It supports a wired trace-learning mechanism in the comparison's write-route sense, without establishing improved future capacity (RT-RTE-history-compaction, MEM-OBJ-compacted-content, MEM-BAP-summary-authority).
The context reduction is not guaranteed lossless or cumulative. Expanded ranges can subsume earlier summaries while the summarizer is told not to re-summarize background; requested rationale can consequently disappear from the read view. Failed replacement-event construction can still reach code that skips originals. Pins are read independently and appended at successful automatic compaction, but missing, empty or failed reads omit them, outer whitespace is stripped, and emptying the live file does not immediately purge previous embedded text. Character accounting is not a hard provider-token bound (MEM-OBJ-compacted-content, MEM-CLM-pinning-survival).
Optional tool-output reduction similarly replaces a large dictionary response with a model summary or deterministic prefix. It attempts to save the original first, but failed saving removes the assured full-output fallback. Replacement removes original keys as well as omitted text; a saved-file pointer requires an actual later read. Thus later audits can receive already-reduced evidence rather than complete tool results (MEM-RTE-output-reduction, MEM-OBJ-tool-output). Concrete benchmark handoffs extend beyond the optional wiki: SWE exploration supplies final text or a quota-exception trace summary to the main agent, and vulnerability checkpoints supply structured findings to a new PoC task. Non-empty text, schema parsing and file presence select these transitions; they do not validate their claims (MEM-RTE-explore-handoff, MEM-RTE-findings-resume).
Checkpoint restoration reloads retained events and resource selectors, with root-snapshot sanitization and current configuration affecting reconstruction. It is best-effort recovery, not faithful replay: startup clears pending inboxes, metadata does not back up sandbox bytes, and no exactly-once effect guarantee follows (MEM-RTE-checkpoint-resume).
Checking claims and delivering a product
The system has implemented evidence-oriented consultation, not only a maintenance prompt. Critique can inspect represented progress and flag unjustified claims; one shipped PoC factory grants it. Audit and validation inspect selected history, but their shipped grants remain unresolved. Validation's parsed confidence and Boolean are independent advisory fields: a true Boolean can coexist with weak confidence, and it does not intercept pin writes. These checks assess a rendered transcript, potentially compacted or truncated, rather than independently investigating task truth (EPI-RTE-critique-feedback, EPI-RTE-assumption-audit, EPI-RTE-claim-validation).
The exposed finding mechanism compares new text with retained findings, suppresses model-labelled duplicates and can append and broadcast contradiction analysis. First-entry and no-model branches bypass comparison and ordinary broadcast. Read and append locks do not span model judgment; append success is not established by its reported Boolean. Contradiction exposure is not automatic retraction, truth acceptance or integration of accepted knowledge. The internal chain is inspected, but a shipped invocation grant remains unestablished (MEM-RTE-finding-admission, EPI-RTE-finding-check, EPI-RTE-finding-write, EPI-RTE-finding-delivery).
The representative DevOps-Gym workflow connects task setup, root-agent work, optional specialist delegation, requested verification and post-run grading. The root is instructed to reproduce an issue, edit and test, but finish_task merely sets a Boolean. Default stopping follows idleness or timeout rather than requiring explicit finish. The driver then copies an external grading script into the still-live container, executes it, parses the result and collects workspace, trace and metadata before cleanup. Zero exit without a FAILED token can pass without a PASSED line. Failed or unknown grading does not veto export, feed the grade back for automatic rework or roll back edits. Collection can also continue after copy failure. This establishes a coordinated delivery and grading contract, not an observed successful patch or complete artifact export (WF-BAP-devops-workflow, WF-RTE-devops-grading, workflow account).
Other evaluators have different licenses. Cybench accepts a task as solved under a non-empty matching reference flag plus a passing model blacklist judgment; this does not certify the reported causal solution process. Vulnerability reference comparison assesses similar type/class, while its separate RL reward can award a completed response containing the word vulnerability even when the response denies finding one. A separate PoC interpreter can emit success for a null exit code because the nonzero comparison precedes its null guard. These are source-conditioned deductions, not observed failures, and cannot be generalized to every evaluator (EPI-RTE-cybench-disposition, EPI-RTE-vulnerability-comparison, EPI-RTE-vulnerability-reward, EPI-RTE-poc-interpretation).
What the implemented progression establishes
For long-running tasks, the strongest supported contribution is the wired transformation of recorded work into retained continuation context, together with model-directed capability construction and selected specialist returns. Whether these paths preserve decisive evidence or improve future capacity remains unresolved. For benchmark delivery, the supported contribution is explicit post-run checking and retained results; it is not closed-loop repair or production-policy improvement.
The independent properties remain separate:
- Theory-builder condition 1, localized theory content: uninspected at the instance level. No supplied concrete theory establishes it; generic instruction and finding containers are insufficient.
- Condition 2, content-dependent consumption: uninspected at the instance level. Delivered instructions, summaries and findings do not establish that decisions depended on a theory's content.
- Condition 3, content-directed criticism with revision or changed reliance: uninspected for an actual theory. Criticism tools and correction requests are implemented opportunities, not supplied criticism/revision instances.
- Condition 4, iteration shaped by retained criticism: uninspected for an actual theory. Stored advice and subsequent context wiring do not alone establish that next-round dependence.
- Learning from criticism of a consumed theory: improved capacity is unestablished. Automatic trace-derived summaries remain a supported partial contribution, distinct from this stronger claim.
- Reflection: implemented opportunities represent the agent's progress from its history and return feedback capable of influencing later action. Exercised representation-mediated change remains unobserved; this is not a system-wide reflective-theory-builder finding.
- Autonomy: computational scheduling, consultation and automatic admission are implemented within named routes. Role-complete autonomous theory building remains unestablished; upstream problem/configuration supply does not itself refute autonomy.
- Self-improvement: persisted instructions, capabilities and summaries can enter behavior-shaping paths, but the supplied evidence does not establish an independently specified improvement objective shaping a particular update followed by operation causally dependent on that change. Exercised self-improvement at this boundary is therefore unestablished, not evidenced absent. Exported rewards and accepted model objects do not expose external trainer updates or checkpoint admission.
These distinctions follow the supported epistemic conclusion and runtime change routes (bounded conclusion, RT-RTE-create-subagent, RT-RTE-evaluation-rollout). They are not a ranking or ladder. Unassessed skills, plugins and benchmark alternatives prevent whole-repository negatives.
The assessment would change with linked traces identifying retained content, its criticism, revision/admission, actual later consumption and an independently measured capacity outcome. A controlled comparison varying the mechanism would be needed for a component-benefit attribution. Implemented fidelity checks, preserved cumulative reasons, durable inbox recovery or grade-driven rework would change particular architectural limits, but each would still need its own coverage and operation evidence. Inspecting trainer updates and checkpoint selection would resolve a different question from measuring summary benefit.
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| No supplied operation or causal comparison | SRC-1; RT-RTE-user-dispatch, RT-RTE-evaluation-rollout, MEM-RTE-wiki-maintenance | Frozen implementation and doctrine; target/tests not executed | Actual activation, compliant maintenance, task reliability, improved capacity and exercised self-improvement | Provenance-linked runs and objective outcomes; independent mechanism variation for causal attribution |
| Checking/recovery plugin inventory remains partial; carried report-verification limit | SRC-1; RT-RTE-host-extension, EPI-CLM-evidence-tools, WF-BAP-devops-workflow; verification limits | Optional build verifier and doom-loop detector identified by verification, without full analyst-record accounts. Build verification can reset completion on selected first-attempt failures, allow later attempts and fail open; repetition suppression checks identical tool-name/argument hashes, not prior failure | Complete comparison of verification/recovery/admission plugins; does not invalidate the selected DevOps sequence | Analyst records tracing configuration, conditions, results and consumers of these plugins |
| Web live-history edit admission is not fully inventoried; carried report-verification limit | SRC-1; MEM-OBJ-traj, MEM-RTE-checkpoint-resume; verification limits | Web caller can replace text/call/response content by event ID in a live session; caller agency and subsequent disk persistence are not fully accounted for | Complete write-control, provenance and disk-durability comparisons; edit is not established semantic acceptance or human approval | Records linking web admission, caller control, event replacement, persistence and later consumption |
| Findings and vulnerability-checkpoint lineage units are omitted from the partial comparison inventory; carried profile-verification limit | SRC-1; MEM-OBJ-findings, EPI-RTE-finding-write, MEM-OBJ-vulnerability-findings, MEM-RTE-findings-resume; verification limits | Caller-finding/appended-analysis derivations and model-generation/parsing/serialization are recorded but not enumerated as lineage units | Object-complete lineage comparisons for these parts; existing positive witnesses remain valid | Complete units derived from these accepted records, retaining branch-specific provenance |
| Summary fidelity, cumulative reasons and pin coverage are not guaranteed | SRC-1; MEM-OBJ-compacted-content, MEM-CLM-pinning-survival, MEM-RTE-output-reduction | Inspected compaction fold, pin reads and tool-result replacement; no semantic-output comparison | Lossless/cumulative context, unconditional pin survival, hard token bound and assured full-output reload | Paired original/derived/later-request evidence, checked semantic preservation and repaired failure branches |
| Recovery and delivery depend on surviving resources and current configuration | SRC-1; MEM-RTE-checkpoint-resume, RT-RTE-directed-child, RT-RTE-create-subagent | Startup clears inboxes; saves are best effort; rebuild re-resolves tools/models; result truncation has conditional file fallback | Faithful restart, complete durable messaging, equivalent capability restoration or exactly-once effects | Failure/restart traces with resource, message and effect provenance, plus strengthened recovery contracts |
| External and alternate paths remain uncertain | SRC-1; RT-CMP-base-llm, MEM-CMP-memory-service, RT-RTE-live-runner, MEM-RTE-image-retention, RT-RTE-evaluation-rollout | Provider/ADK/trainer bodies excluded; deployed weights, opaque memory payloads, image request-copy contract, other backends and custom extensions unresolved | Immutable-model attribution, complete memory/authority inventories, image-storage immutability, universal guard coverage or end-to-end learning correctness | Frozen dependency/deployment evidence and records tracing each material alternate consumer/update path |
| Consultation/finding exposure and actual theory dependence remain unresolved | SRC-1; EPI-RTE-critique-feedback, EPI-RTE-claim-validation, MEM-RTE-finding-admission | Critique has a factory witness; audit/validation/finding grants unresolved; no concrete theory/criticism/reliance instance supplied | Ordinary activation, conditions 1–4, autonomous theory building or criticism-caused future capacity | Grant/caller records and linked content, criticism, blame, changed reliance and next-round traces |
| Evaluator licenses and delivered artifacts are bounded | SRC-1; WF-RTE-devops-grading, EPI-RTE-cybench-check, EPI-RTE-vulnerability-reward, EPI-RTE-poc-interpretation | External grading/reference provenance uninspected; selected parsers and reward branches inspected; export best effort | General correctness oracle, legitimate causal production, confirmed vulnerability from reward/success text, complete delivery or automatic repair | Frozen task/reference/script evidence, validated evaluator outputs and complete export/rework traces |