Enoch runtime report

Type: agentic-system-analyses/types/agentic-system-runtime-report.md

Runtime account

Evidence and claimed work

Enoch is an application-level personal agent, not merely a model wrapper. Its consequential work is conversation plus registered operations, repository tasks and proposals to change its own software and capabilities. The frozen scope and sole source are the boundary. All source findings below use SRC-1 at that revision. They establish implementation or declared policy, not successful execution. No target, test, example or service was run; no observed-run or causal-experiment evidence was supplied.

Added implementation inspection covers the conversation journal, effect fence, capability authorizer, task workflow and validation-repair machinery, updater, extension registry, Claude execution arguments, application composition, CLI dispatch and selected migration/lineage admission branches. Further bounded reads of src/enoch/app/core.py cover ordinary event processing, response context, task claims, scheduler/evolution proposals, approval, merge and update. These paths are all within SRC-1; this extends inspection, not the frozen boundary. Deep memory/evidence transformation, skill assessment, complete lineage assessment, provider-specific forge/service effects, complete migration import/verification and conformance internals remain uninspected here. Their availability is not evidence of absence; specialists must not infer completeness from this runtime baseline.

Entry and ordinary invocation

The package exposes admin CLI, agent and daemon entry points as recorded in the boundary (SRC-1, pyproject.toml). Admin CLI is not a chat agent: it loads identity and routes named commands or an admin REPL, rejecting unknown commands (SRC-1, src/enoch/cli.py). Agent startup resolves mutable identity, selected chat/runtime/repository/review providers, profile and extensions, establishes a daemon epoch and constructs the local or supplied workflow engine (SRC-1, src/enoch/application.py). Daemon start/restart use the selected service provider and check migration startup permission (SRC-1, src/enoch/operations/daemon.py). External service managers and actual selected installations remain outside the inspected implementation.

An ordinary chat turn follows RT-RTE-chat-actions. The chat provider is the receiving principal; event identity contains channel, conversation, message, cursor and optional thread/attachments. The application rejects events outside a configured conversation lock unless the provider recognizes an authenticated peer alias. With no lock it can converse, but model-issued actions require an exact locked-conversation match. A durable inbox receipt suppresses redispatch of completed events. Unhandled processing failures are recorded and retried up to three attempts; exhausted events receive a diagnostic terminal reply. Reply delivery is separately retried before cursor advancement, acknowledgement and turn logging (SRC-1, src/enoch/app/core.py). This is receipt-based recovery, not a demonstrated exactly-once external-effect guarantee.

The host chooses registered-command dispatch versus natural conversation. On natural conversation the model chooses a final answer or one structured registered command. The host parses JSON, executes through ordinary command handlers, and supplies real receipts to the next model turn. A journal persists planned/running/done steps; an interrupted running action is reported as uncertain rather than blindly repeated. The loop has at most six executable actions. Final reply processing accepts memory/regression requests only from the runtime final text, not raw action receipts; memory admission itself belongs to the memory analysis (SRC-1, src/enoch/app/conversation.py, src/enoch/app/core.py).

The selected runtime receives profile-extended natural-language instructions, current request and action feedback. For the first application response using a nonempty session key, code adds startup memory/context and command references. The Codex adapter independently supplies startup memory when its persistent-session mapping is absent. Thus these are two context-injection layers; deduplicated single delivery is not established. Persistent invocations resume a provider session, while isolated evidence calls use an empty session key and do not inherit the conversation transcript by that mechanism. Codex uses ephemeral execution for nonpersistent calls. On a resumed Codex BrainError, the adapter forgets the mapping and retries with reconstructed startup context; cancellation, timeout and access-unavailable errors do not enter that recovery. Provider compaction, exact retained transcript and model-window eviction remain opaque (SRC-1, src/enoch/app/core.py, src/enoch/brain.py).

Task and improvement loops

RT-RTE-task-work is the ordinary substantial-work route. Requests can come from direct work, queued chat tasks, backlog promotion, cron or extension schedules. The workflow worker obtains a task claim with worker ID and process ID, uses a task-specific session key, and passes deadline/cancellation/progress controls. Progress heartbeats can expose a lost workflow claim. Backlog auto-promotion and cron execution are software scheduling of retained requests, not new per-execution human decisions (SRC-1, src/enoch/app/core.py). Model-produced task-context snapshots are another working-context control: selected conversation context is converted into bounded task data rather than sharing the full conversation frame; snapshot correctness is not established (SRC-1, src/enoch/app/core.py).

The workflow prepares a repository workspace from the authoritative revision, invokes model work, inspects changed paths, runs doctor and optionally performs bounded model repair. Doctor supplies code/test/runtime/forge/workspace/storage checks; the default test command uses unittest discovery and can be overridden by ENOCH_TEST_COMMAND (SRC-1, src/enoch/immune.py). Repair receives failed-check diagnostics, with head/tail truncation, in the same task session. A failed final doctor preserves the workspace and prevents the normal new-change review-publication branch. A passing doctor admits capture and review handoff, not automatic activation in the running agent. Publication records stages and captured revision IDs for retries; resumed capture/publication verifies the captured working copy. Completion can mean no changed files; it is not synonymous with a merged software revision (SRC-1, src/enoch/app/task_workflow.py).

RT-RTE-evolve-admission proposes changes using evidence scans, model synthesis/curation and, in some modes, brainstorming. An isolated model call sees selected candidates, skill descriptions, mission/theme and recent completed-work material, not the full chat session. The scheduler only proposes and reports; its selected candidate is marked awaiting approval. Approval queues ordinary task work and preserves provenance. RT-RTE-lineage-adoption similarly queues an assessed direct-parent candidate, links it to a task and cancels the queue item if that linking fails. These mechanisms admit proposals into work, not automatically into deployed software. Skill acquisition/assessment enters this broader capability-change plane, but its exact assessment and install transformations are not established in this member (SRC-1, src/enoch/app/core.py).

Landing a review and activating code are separate operations: RT-RTE-software-update. Chat merge requires a locked matching conversation and forge.land; update requires the action lock and repository capabilities. Admin CLI update calls the same updater without the chat authorizer. The updater requires a clean checkout and ancestry compatibility, activates an authoritative revision, runs a fresh doctor and requests restart only after a pass. On failure it attempts to restore the prior revision and reports rollback failure separately. The old process remains pre-update code until restart (SRC-1, src/enoch/app/core.py, src/enoch/operations/updater.py, src/enoch/cli.py).

Migration is a further production-machinery path, RT-RTE-host-migration: local admin export/import/activate/verify commands transfer state under source/target markers. Export requires clean body, quiescent workflow and stopped daemon; activation verifies checkpoint integrity and establishes a target epoch. Source startup is fenced after export; cancellation relies on operator confirmation that no target remains active. This is a cooperative local protocol, not observed cross-host consensus (SRC-1, src/enoch/migration.py, src/enoch/app/epoch.py).

Forcing cases and guarantee boundaries

Four forcing cases qualify the ordinary account.

  1. Read-only conversation does not mean effect-free conversation. Codex response execution requests read-only sandboxing; host-side JSON commands can nevertheless queue work, change settings or land a review. The sandbox only covers provider-native effects subject to the external harness contract. The merge-authorization distinction is natural-language guidance; model-emitted actions reuse the command handlers without an independent check of the original user's semantic approval (SRC-1, src/enoch/brain.py, src/enoch/prompt_append.py, src/enoch/app/core.py).
  2. An isolated task workspace is not filesystem confinement. action_sandbox returns danger-full-access. Code places work in a separate repository workspace, but does not bound the Codex subprocess's filesystem access to it. Captured-file checks govern capture, not all prior shell effects. The required external contracts are Codex sandbox semantics, OS credentials and provider behavior. Actual deployed grants/isolation are uninspected (SRC-1, src/enoch/runtime.py, src/enoch/app/task_workflow.py).
  3. Adapter substitution changes controls. Claude maps all non-read-only sandbox strings to workspace tools including Bash, and supplies restricted/safe-mode/MCP/permission arguments. This is not byte-equivalent to Codex's full-access setting. Claude also ignores the passed identity object in _invoke, relying on other prompt/environment context. Its CLI semantics and installed version remain external (SRC-1, libraries/claude/src/our_ark_claude/core.py). See separate distributed-parametric components RT-CMP-codex-model and RT-CMP-claude-model.
  4. Application checks do not mediate arbitrary plugin effects. RT-RTE-extension-loading loads Python factories and invokes handlers/hooks in process. Command admission checks declared requirements, but callback contexts expose raw runtime/repository/review/chat objects; profile lifecycle hooks likewise receive them. Direct provider calls and plugin shell/subprocess effects need not pass through the application fence. The admin updater is another alternate path without that fence (SRC-1, src/enoch/extensions/registry.py, src/enoch/app/core.py, src/enoch/cli.py).

The capability surface is the provider contracts and registered operations. The selected grant set is provider-declared capabilities (or fallback defaults), optionally reduced by policy. Neither declaration nor a configured conversation lock establishes a deployed OS/security envelope (SRC-1, src/enoch/providers/authorization.py).

Load-bearing control Owner and enforcement point Strength and covered path Alternate paths / external contract Conclusion statuses
Registered bounded actions Application parser/journal in src/enoch/app/conversation.py invariant for the host action loop: syntactically accepted commands, maximum six executions, no automatic replay of persisted running step Does not constrain provider-native tools, plugins, admin commands or side effects already performed before crash; command handlers/providers must supply their own effect guarantees implementation conclusion status: wired; operation conclusion status: uninspected
Capability admission CapabilityAuthorizer.require and application call sites protocol: missing declared capabilities or deny-policy rejection raises before the wrapped call Provider honesty and callbacks' use of wrappers required; direct model/provider/plugin calls are not globally intercepted implementation conclusion status: wired; operation conclusion status: uninspected
Epoch ownership DaemonEffectFence, epoch file lock and runtime monitor protocol for fenced effects; long calls receive cooperative cancellation on takeover External subprocess/provider must honor cancellation; effects before detection cannot be undone, plugin bypasses remain implementation conclusion status: wired; operation conclusion status: uninspected
Validate before ordinary publication Task workflow after model work and repair invariant of inspected new-change publication branch, dependent on trustworthy doctor result Existing-branch/forge-maintenance requests branch earlier; resume paths use stored publication state; full-access model can alter tests, so test-preservation is policy rather than enforced immutability implementation conclusion status: wired; operation conclusion status: uninspected
Human-controlled evolution / merge Scheduler stops at proposal; explicit commands queue/land policy plus command protocol, not an invariant proving fresh human authorship of each action Model-issued commands enter same handlers and may be logged with human actor labels; external Git/forge/shell changes remain possible implementation conclusion status: wired; operation conclusion status: uninspected
Safe update and migration handoff Updater doctor/rollback; migration markers and epoch startup checks best effort rollback; protocol for cooperative handoff Repository/service correctness and operator truth required; rollback failure is exposed, restart success and exclusive cross-host continuation unobserved implementation conclusion status: wired; operation conclusion status: uninspected

Shared records

Components

RT-CMP-codex-model

Label: Codex-selected model

Source-native identity: Codex CLI model selected by Enoch configuration/environment, otherwise CLI default. Representational form: distributed-parametric model, distinct from symbolic CLI arguments and natural-language prompts. Storage substrate: external model service/harness; weights are not shipped in SRC-1.

Parameters changing during operation: uninspected — provider internals are outside the boundary; inspected code sends inference requests, not a parameter-update operation. Exact model version pinned: not established; configuration passes a model name, not a weight digest. Mutable endpoint resolving to another model: possible through environment/configuration/default selection; actual service alias resolution is uninspected. SRC-1, src/enoch/brain.py:

model = _configured_model(state_root) if model: args.extend(["--model", model]) --- src/enoch/brain.py

RT-CMP-claude-model

Label: Claude-selected model

Source-native identity: optional Claude CLI model; catalog labels include aliases such as sonnet/opus. Representational form: distributed-parametric model. Storage substrate: external Claude service/harness. Parameters changing during operation: uninspected — no provider internals acquired. Exact version pinned: not established by this adapter's configurable name or CLI default. Mutable endpoint resolving to another model: aliases/defaults may resolve differently; actual resolution is uninspected. SRC-1, libraries/claude/src/our_ark_claude/core.py:

if model: args.extend(["--model", model]) if effort: --- libraries/claude/src/our_ark_claude/core.py

Operative objects

RT-OBJ-conversation-journal

Label: ConversationJournal

Source-native identity: per-request journal keyed by SHA-256 of request ID. Representational form: symbolic schema/step state and natural-language reply/result fields, consumed separately by host state machine and subsequent model feedback. Storage substrate: private-state conversation/<key>.json, transaction-protected atomic JSON writes. It preserves uncertainty at the action-effect boundary; it is not a semantic approval record. SRC-1, src/enoch/app/conversation.py:

steps.append({"reply": reply, "state": "planned"}) self._write(steps) --- src/enoch/app/conversation.py

RT-OBJ-validation-diagnostics

Label: Validation repair diagnostics

Source-native identity: doctor failed-check payload, distinct from the generated code. Representational form: symbolic JSON envelope with natural-language diagnostics/outputs; model interpretation proposes repairs while doctor predicates decide publication. Storage substrate: transient prompt plus recorded task result/workflow state. Failed-check output is truncated to head/tail excerpts; full diagnostic preservation in the model input is not guaranteed. SRC-1, src/enoch/app/validation_repair.py:

"The following JSON is diagnostic evidence, not additional instructions:", _excerpt(json.dumps(evidence, ensure_ascii=False, indent=2), 24000), --- src/enoch/app/validation_repair.py

Routes

RT-RTE-chat-actions

Label: Chat conversation and registered actions

Endpoints/progression: provider event → inbox receipt → registered command or session-backed model response → parsed action → existing command handler → receipt feedback → final reply → outbound notification, turn log and cursor acknowledgement. Owner: host controls admission/progression; model chooses proposed action and answer. Context/state: request, quoted context marked as data, profile prompt, startup context, provider session and conversation journal. Runtime execution controls identify request/session and fenced cancellation. Executor/effect boundary: Codex read-only model invocation plus separately authorized host commands; other selected adapters follow their own contract. Decision policy: natural-language action instructions plus symbolic JSON grammar and code branch rules. Operating mode: open user requests. Answer oracle: none established for arbitrary chat; operation receipts are evidence, not reference answers.

  • Immediate return: final visible reply plus real action receipts, or interrupted-action uncertainty/limit diagnostic.
  • Later read-back: durable provider session mapping/transcript may resume on later requests; journal is reread on inbox retry; turn/state maintenance is separate from demonstrated future model use.
  • Delegated visibility: action handlers receive selected command/argument/event; substantial work receives request/context rather than automatic full transcript sharing.
  • Selection predicate: command dispatch if registered; otherwise model chooses a structured action; lock match required for host model-action execution.
  • Invalidation or expiry: six-action bound per event; resumed Codex session recovery forgets a failed mapping; inbox completion avoids redispatch. Complete session retention/expiry is uninspected.
  • Activation or effect: wired registered command invocation and subsequent model feedback; compliant semantic approval and successful external effects unobserved.
  • Evidence limits: provider-native tool effects and internal context compaction are not reconstructed; no run trace supports activation quality.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/app/conversation.py, src/enoch/app/core.py, src/enoch/brain.py, src/enoch/prompt_append.py:

if step["state"] == "running": return _receipts(observations, "An action was interrupted before its result was recorded. " "It may have completed. Check its current state before retrying; " "I have not repeated it.") --- src/enoch/app/conversation.py

Reuse command authorization and handlers; never recursively enter the model.

self.effect_fence.require_current() if _allowed_conversation_id(self.client) != event.conversation_id: return ActionResult(self._action_lock_message(), stop=True) --- src/enoch/app/core.py

This is also an instruction/knowledge-change admission surface: the final reply can request memory writes, and registered commands can modify settings/mission. Model proposes; the host command or store admits under its own predicates; no independent per-content human review is established by the command loop. Detailed memory rejection/rollback belongs to its specialist.

RT-RTE-task-work

Label: Tracked task work and validation repair

Endpoints/progression: queued/direct request → claim → authoritative workspace → model work → changed-path inspection → doctor → optional bounded repair → captured revision → review handoff. Owner: host workflow claim/deadline/publication machinery; model owns proposed edits. State includes task/attempt/worker IDs, task-specific provider session, workspace/revision IDs and publication stage. Executor: selected model CLI with task cwd, host repository/review adapters and doctor subprocess checks. Admission trigger: human or retained scheduled request; proposed changes may affect external work or Enoch's own body. Guidance: work-request prompt and failed-check evidence. Rejection: doctor failure blocks normal new-change publication; capability policy, cancellation and provider failures can stop work. Recovery: preserve failed workspace; bounded repair, retry context and recorded publication-stage resume. Human can stop/retry work and judge/land a review; starting work is not approval of every generated edit. Operating mode: open requested implementation plus bounded automatic repair, default two attempts/configurable zero through five. Answer oracle: repository tests/check predicates supplied by doctor, not an oracle for the entire user goal. Checks themselves can be edited by full-access model work; preservation is requested policy.

  • Immediate return: task acceptance/status initially; eventual WorkOutcome and review/capture evidence, failure diagnostics or no-change completion.
  • Later read-back: workflow results/stages and workspace are consulted for retries; repair reuses same task session; completion may feed later learning/evolution evidence, whose transformations remain for specialists.
  • Delegated visibility: task receives request plus selected context and profile contributions, startup memory on new Codex sessions and doctor excerpts on repair; conversation is not automatically shared as a full frame.
  • Selection predicate: workflow start/claim, locked action permission and capabilities; repair only within limit and repairable failed-check categories.
  • Invalidation or expiry: timeout/cancellation/claim loss stop work; clean completed workspace may be removed, failed workspace preserved; provider session lifecycle is externally bounded.
  • Activation or effect: edits execute with task cwd and full-access Codex setting; code wires validation/capture/review but review handoff alone does not activate a running revision.
  • Evidence limits: no passing doctor or actual edit/publication observed; prior publication-state trust and special existing-branch/forge-maintenance branches differ from the new-change doctor gate.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/app/core.py, src/enoch/app/task_workflow.py, src/enoch/app/validation_repair.py, src/enoch/immune.py:

def action_sandbox(_root: Path) -> str: return ACTION_SANDBOX_FULL_ACCESS --- src/enoch/app/task_workflow.py

if not doctor.passed: parts.append( f"I did not publish a review because doctor failed after {repair_count} " f"automatic repair attempt(s). Task workspace " f"{work_root} was preserved for inspection." ) --- src/enoch/app/task_workflow.py

Repair applies an unchanged method: diagnose concrete failure, preserve original requirements and rerun doctor. It does not by itself establish criticism/revision of a formulated theory or a reflective theory builder. The artifact revised here is implementation; future capacity improvement and attribution remain unestablished.

RT-RTE-evolve-admission

Label: Evolution proposal and approval handoff

Endpoints/progression: manual propose or scheduled due check → evidence scans/synthesis → optional mode-governed brainstorm → curation/proposal → approval command → ordinary task queue. Owner: host schedules and admits parsed candidates; models propose/curate; command invocation chooses candidate to approve. Context: mission/theme, skill summaries, selected prior candidates and completion evidence; phase-specific isolated requests. State: evolve mode/schedule claims, candidates, proposal events and task provenance. Operating modes: disabled, co-evolve and auto-evolve; auto-evolve can add scheduled brainstorming, not scheduler-side task approval. Answer oracle: none established for candidate merits; model curator/ranking is not a reference outcome. Admission/rejection: approval requires locked chat and candidate status; queue failure reports rejection. Candidate removal/status and ordinary task stop/review decision provide rejection opportunities. Rollback after installation is not supplied by candidate approval; downstream updater recovery is separate.

  • Immediate return: proposal/report; approval returns selected candidate and queued task ID.
  • Later read-back: retained candidate/proposal state feeds later proposal rounds and approved task context/provenance.
  • Delegated visibility: isolated model phase receives selected bounded candidate context, not inherited conversation; approved task receives candidate-derived request/context.
  • Selection predicate: mode, schedule due claim, available candidates/theme/cooldown for brainstorming, then selected candidate status and explicit approval command.
  • Invalidation or expiry: proposals can be superseded; candidate status prevents approval from non-candidate state; schedule acknowledgement consumes the claim.
  • Activation or effect: wired proposal retention and queue admission, not installed self-change or demonstrated benefit.
  • Evidence limits: source labels approval actor human, but model actions share these handlers; actual human authorship and semantic intent are not independently authenticated by this path. Evidence-synthesis/curation internals remain partially uninspected here.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/app/core.py:

if proposal.top_candidate is not None: self._record_evolve_event( "skipped", event_actor="system", trigger="evolve-scheduler", proposal=proposal, candidate=proposal.top_candidate, reason="awaiting-human-approval", ) --- src/enoch/app/core.py

if candidate.status != "candidate": return f"Evolve candidate {candidate.id} cannot be approved from status {candidate.status}." --- src/enoch/app/core.py

The pathway affords improvement-directed changes to Enoch's own body. Assessment boundary is proposal → task → later activation; objective is mission/theme-directed capability or reliability improvement, distinct from merely producing a candidate. Evidence-responsive proposal construction is wired, but organization change, live behavioral authority and subsequent causally dependent operation are not observed. Exercised self-improvement or successful learning cannot be attributed over this run's evidence horizon.

RT-RTE-lineage-adoption

Label: Assessed direct-parent change to task

Endpoints/progression: assessed lineage candidate → adoption request/context → task enqueue → link candidate to task → standard work/review pipeline. Owner: host admission; model assessment precedes this branch but its full mechanism is uninspected. Computation checks candidate status/assessment; caller chooses candidate. Guidance is candidate-derived adaptation request/context. Operating mode: explicit requested adaptation, not a bounded comparative experiment. Answer oracle: none established for adaptation merits. Rejection/veto: unassessed/already linked/adopted candidates do not enqueue; no action lock rejects; link failure cancels task. Recovery/rollback: queue cancellation on link error and downstream task/update recovery, not automatic parent-code replacement.

  • Immediate return: queued-task ID or status/error message.
  • Later read-back: candidate-task link and retained context reach task execution; adoption reconciliation is called after merge but its detailed predicate is uninspected here.
  • Delegated visibility: selected candidate request/context, not entire parent repository history.
  • Selection predicate: named direct-parent candidate, successful assessment and locked action permission.
  • Invalidation or expiry: linked/adopted states suppress another enqueue; linking failure cancels the newly created task.
  • Activation or effect: wired task admission, not demonstrated deployed adoption.
  • Evidence limits: parent implementation is outside SRC-1; complete assessment and adoption-reconciliation internals are not established by this branch.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/app/core.py:

if candidate.assessment_status != ASSESSMENT_ASSESSED: return ( f"Direct-parent change {candidate.id} has not been assessed successfully. " "Run /inherit to let Codex assess or retry it first." ) --- src/enoch/app/core.py

RT-RTE-software-update

Label: Review landing and running software update

Endpoints/progression: locked chat review-merge request → authorized land; separately chat/admin update → clean/ancestry check → restore authoritative revision → fresh doctor → restart request or attempted rollback. Owner: application/CLI and updater; selected repository/review/service provider performs effects. Operating mode: explicit operation; doctor is validation, not open-ended model successor selection. Proposer: review author/task or authoritative repository maintainer. Decider/veto: caller selects merge/update, capability checks and updater predicates reject; semantic human merge approval is requested in the conversation prompt, not independently enforced by the handler. Answer oracle: fresh doctor checks constrain update admission, not all correctness. Guidance: authoritative revision, ancestry and validation policy. What persists: activated checkout revision and update/action reports; running process only changes after restart.

  • Immediate return: landed review status or update/doctor/rollback report; restart may be scheduled after chat reply or directly by admin CLI.
  • Later read-back: later process startup loads new source/configuration; actual subsequent invocation is unobserved.
  • Delegated visibility: repository/review adapters receive revision or ReviewLandRequest; fresh doctor runs with updated source on PYTHONPATH, not merely cached process imports.
  • Selection predicate: exact review identity for merge; clean checkout and ancestor-compatible authoritative revision for update; doctor pass for restart request.
  • Invalidation or expiry: failed update doctor attempts restore of prior revision; rollback failure is reported; unchanged authoritative revision has a separate already-current path.
  • Activation or effect: checkout activation and restart request are wired; observed restart and changed later behavior are uninspected.
  • Evidence limits: chat capability fence is not used by admin CLI updater; external shell/Git/forge calls can bypass this route; passing checks do not imply safe arbitrary behavior.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/app/core.py, src/enoch/cli.py, src/enoch/operations/updater.py:

doctor = run_update_doctor(root) if not doctor.passed: try: repository.restore_repository_revision(previous_revision, root) rollback = f"Rolled back to {previous_head[:7]}." except RepositoryProviderError as error: rollback = f"Rollback failed: {error}" --- src/enoch/operations/updater.py

RT-RTE-extension-loading

Label: Configured extension and profile callbacks

Endpoints/progression: installed/registered factory plus configured extension names → entry-point load → validated AgentExtension → command/lifecycle/schedule callbacks. Owner: local package/configuration principal selects code; Python factory/handler executes in process. Representations: symbolic configuration/contracts and executable Python; prompt contributions are natural language. State/effects: extension storage and raw provider/workflow objects, with namespaced workflow wrappers for some operations. Admission: factory lookup and returned identity/type validation; command required-capability check before handler. Proposer/decider: installation/configuration operator or supplied composition, not a content-review model. Answer oracle: none for plugin trust; API/type checks are compatibility predicates. Operating mode: extensible host callbacks. Rejection: unknown/noncallable/mismatched factory; duplicate/conflicting commands; denied declared capability. Recovery: command/hook failures log/report; arbitrary plugin effects lack a universal rollback. Guidance: configured contracts and profile purpose-specific prompt contributions. Retained code/configuration changes load on later startup; entry-point loading alone does not evaluate malicious code.

  • Immediate return: loaded objects, callback result/failure or contribution to prompt; lifecycle hooks may return no user-visible value.
  • Later read-back: configured selection and installed implementation reload on later application startup; extension-specific retained state consumers depend on plugin code and are uninspected.
  • Delegated visibility: handlers and lifecycle contexts expose identity/root/storage and raw chat/runtime/repository/review objects.
  • Selection predicate: configured/required extension names; command match or lifecycle/schedule trigger.
  • Invalidation or expiry: replace/configure/restart can change loaded code; exact installed plugin lifecycle remains uninspected.
  • Activation or effect: in-process callback invocation is wired; unrestricted Python can perform effects outside application wrappers.
  • Evidence limits: no downstream plugin implementation or deployment inventory supplied; declared grants do not form an in-process sandbox.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/extensions/registry.py, src/enoch/application.py, src/enoch/app/core.py:

try: factory = entry.load() except Exception as error: raise AgentExtensionError( f"Could not load agent extension {name}: {error}" ) from error --- src/enoch/extensions/registry.py

RT-RTE-host-migration

Label: Host checkpoint export and activation

Endpoints/progression: admin export → verified portable bundle/source marker → admin import → imported target marker → integrity check/activation epoch → service startup/verification. Owner/principal: local operator; deterministic migration code supplies admission predicates. Proposed change: relocate retained instance state and production ownership, not revise memory meaning. Representation/state: symbolic manifest, marker and epoch fields over portable files/ZIP substrate. Operating mode: explicit handoff. Answer oracle: integrity/revision/state checks are reference predicates, not a behavioral-success oracle. Guidance: clean-body/quiescence/stopped-source and checkpoint-integrity rules. Veto: failed export preconditions or target activation status/integrity; recovery includes canceling the source fence only with operator assurance of no active target. Detailed import rollback remains uninspected.

  • Immediate return: exported/imported/activated status or rejected operation; activation returns migration ID and authority generation.
  • Later read-back: source/target markers govern future starts; transferred state is available to later target consumers, whose exact portability transforms are not fully traced here.
  • Delegated visibility: bundle selects portable state with optional artifacts; full import filtering and verification are uninspected.
  • Selection predicate: named bundle/local instance and explicit admin operation; source must be clean/quiescent/unfenced and stopped; target activation requires imported state and checkpoint integrity.
  • Invalidation or expiry: matching cancellation removes source marker; target epoch supersedes local ownership; global cross-host revocation is not established.
  • Activation or effect: local checkpoint verification and authority epoch activation are wired; successful exclusive target operation unobserved.
  • Evidence limits: local markers and operator confirmation do not independently establish that a remote target is inactive; complete import/verify implementation remains for further inspection.
  • implementation conclusion status: wired
  • operation conclusion status: uninspected

SRC-1, src/enoch/migration.py, src/enoch/app/epoch.py, src/enoch/operations/daemon.py, src/enoch/cli.py:

_require_checkpoint_integrity(resolved_root, marker) from enoch.app.epoch import begin_daemon_epoch

epoch = begin_daemon_epoch( resolved_root, provider="migration", migration_activation=True, ) --- src/enoch/migration.py

Claims

RT-CLM-merge-authorization

Label: Explicit human merge authorization policy

Claimed operation: a feature implementation request must not authorize merge; a request to merge a particular review does. The host provides this as model-facing guidance, while the merge handler checks locked conversation and provider capability, not original-request semantics. SRC-1, src/enoch/prompt_append.py:

"A human request to merge a specific review authorizes pr merge for that exact review; " "a request to implement a feature does not implicitly authorize merging its review. " --- src/enoch/prompt_append.py

Guarantee strength: policy. Owner: conversation prompt author and interpreting model, with host command admission as a separate protocol. implementation conclusion status: wired. operation conclusion status: uninspected. This limits any claim that human actor labels prove fresh human approval of a model-generated command.

Evidenced absences

none declared in this member

Behavioral-authority paths

RT-BAP-conversation-guidance

Label: Conversation instructions to model decisions

Consumer: selected conversational runtime model. Channel: constructed request/profile/startup prompt and resumed provider session. Force: natural-language guidance requesting registered operations and semantic authorization distinctions, not a host invariant. Horizon: current turn/action rounds and later provider-session requests subject to opaque retention. SRC-1, src/enoch/prompt_append.py, src/enoch/app/core.py, src/enoch/brain.py. Evidence is the merge-policy passage in RT-CLM-merge-authorization and the wired route RT-RTE-chat-actions; reliable compliance/benefit unobserved.

RT-BAP-capability-policy

Label: Declared grants and deny policy to host admission

Consumer: application CapabilityAuthorizer. Channel: symbolic TaskRequirements, provider-declared or fallback capabilities and optional AuthorizationPolicy decision. Force: rejection before covered wrapped call; deny-only policy cannot supply missing provider grants. Horizon: every covered host call using current provider/policy selection. SRC-1, src/enoch/providers/authorization.py:

if missing: raise CapabilityAuthorizationError( request, AuthorizationDecision( allowed=False, reason=( "The selected provider does not declare every required " "capability." ), denied_capabilities=missing, ), ) --- src/enoch/providers/authorization.py

Direct callbacks/provider-native effects remain outside universal interception, as established in RT-RTE-extension-loading and RT-RTE-task-work.

RT-BAP-software-revision

Label: Activated source to later application behavior

Consumer: restarted Python application and its selected installed adapters/configuration. Channel: executable source at activated authoritative revision; force: executable behavior, subject to environment/package resolution. Horizon: later process invocations after activation/restart. SRC-1, src/enoch/operations/updater.py, src/enoch/app/core.py. RT-RTE-software-update supplies the doctor/rollback passage and route. Wiring of checkout activation/restart request does not demonstrate successful restart, correct import resolution, later exercise or causal improvement.

Annotations

none