Playground synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
Playground is an agent-facing shell and file provider, not the agent that decides what to do next. This account covers its shipped executable, provisioning and lifecycle commands, sandbox backends, authenticated HTTP transport, optional native-worker gateway and supervisor, and relevant maintenance scripts at Git revision de28ac8fdda30c7a5c2ee099de089e65a685195f, with an applicability cutoff of 2026-10-14. SRC-1 supplies inspected implementation and doctrine/design, but no target execution, successful test, model trace or causal experiment. The whole-system boundary is for this provider: enclosing clients, external Faculties implementations and actual operator host state are excluded. See the boundary and evidence and Source register.
Provision an environment, then admit caller-selected work
An operator provisions a tenant, its storage and execution environment, and then credentials. The provider checks topology and subprocess success; these are operational checks, not semantic approval of retained facts. Resource creation and credential saving are not one atomic transaction. Jail onboarding invokes external bootstrap import and tenant registration under fixed pile/key destinations. Those calls are wired, while native collection admission and corpus semantics remain external. Closing a handle preserves the workspace; permanent sandbox destruction removes clone/disk resources but leaves original host pile/key storage. These are different retention horizons, not contradictory lifecycle promises. See RT-RTE-tenant-provision, MEM-RTE-native-onboarding, MEM-OBJ-self-pile, MEM-OBJ-shared-pile and RT-CLM-persistent-sandbox.
Authenticated sandbox HTTP binds transport sessions, sandbox handles and jobs to the tenant before dispatch. Stdio and direct dispatch do not inherit that authorization layer. The grant permits tenant shell execution, not an approved command vocabulary or per-command human review. Normal subsequent-request revocation depends on a readable, detectably changed token store: reload errors preserve cached authority. It is not fail-closed revocation under every storage fault. See RT-RTE-sandbox-exec, RT-BAP-shell-command and the report-verification limits.
Opening yields a stable tenant sandbox identity; same-tenant handles share state rather than receiving independent workspaces. Each command is a symbolic request executed in a fresh shell, with login-profile defaults. Files and processes can persist, but preceding shell-local cd or assignments are not thereby preserved. Lifecycle locks order registration, start and last-handle detach within the provider, not the semantics of concurrent commands or a separate administrative process. The external client owns command choice and continuation; the provider and backend own dispatch, execution and return. See RT-CMP-sandbox-provider and RT-RTE-sandbox-exec.
Execute, collect bounded evidence, and recover explicitly
The representative callable workflow is open → job_exec → repeated job_poll → optional cancellation → close. This delegates shell execution, not model reasoning. It applies to the proof-capable root-local FreeBSD backend; Lima and SSH callers must use synchronous execution instead. No completed agent task or acknowledged client delivery was supplied. The client retains pages, interprets outcomes and judges task adequacy. See the workflow account and RT-RTE-retained-jobs.
One job kernel handles synchronous execution, retained jobs and file-tool commands. It bounds active jobs to eight per tenant and 32 globally, retained handles to eight per tenant and 64 globally, and output to 4 MiB/1024 chunks per ring. Polls select surviving chunks by job ID and cursor, with loss metadata; they are not semantic retrieval. Final-page construction marks terminal output observed on the server, not acknowledged by the client. Capacity recycling can then forget it; one-hour terminal TTL can independently expire unread results. Restart loses the process-memory ledger. Synchronous execution waits and forgets its hidden handle. Consequently, terminal completion does not guarantee a complete transcript or durable delivery receipt. See RT-CMP-job-manager, MEM-OBJ-output-log, MEM-OBJ-job-snapshot and RT-RTE-retained-jobs.
Cancellation is a request until backend return establishes a terminal state. Root-local FreeBSD descendant cleanup depends on privileges and the reaper contract; loss of cleanup control shuts admission rather than promising safe reuse. Neither cancellation nor a tool error rolls back filesystem effects. Ordinary recovery belongs to the client/operator: collect output, inspect partial effects, choose a new command or retry a failed close. Cursor retries are read retries, not proof that repeating a side-effecting command is safe. See RT-RTE-retained-jobs and the workflow annotations.
Retain bytes without confusing custody with warrant
File tools use clean shells, bypassing login-profile interference. Successful bounded reads return valid text or lossless binary encoding, refusing files above 3 MiB. Writes validate an exclusive text/base64 payload and command completion, then replace bytes by truncating redirection. They neither reread the result nor provide transactional rollback; the HTTP body ceiling can reject a payload below the decoded tool ceiling. Arbitrary execution is another mutation path without the file parser's constraints. Later reads select literal paths, and subsequent commands can consume persisted scripts or profiles as executable instructions. Generic caller identity does not settle human approval or original authorship. See RT-RTE-file-exchange, MEM-OBJ-workspace-files, MEM-OBJ-session-profile, EPI-RTE-file-check and EPI-RTE-file-disposition.
File-byte fidelity does not authenticate provenance or endorse assertions. Execution reports are weaker byte witnesses: output can be evicted and malformed UTF-8 replaced. Exit zero reports process success, not truth of stdout or accomplishment of the agent's task. The inspected routes retain and deliver evidence candidates without establishing evidence-consuming acceptance and lifecycle integration of an ampliative claim. This is a scoped finding, not a negative over arbitrary sandbox programs or external workers. See EPI-CLM-file-lossless, EPI-RTE-result-render and the epistemic bounded conclusion.
Native pile custody is durable but semantically opaque. Jail append-only setup requires the host/kernel privilege envelope; Lima tolerates failure of its append-only setup and therefore trusts rather than prevents truncation. Neither append-only custody nor a read-only signer establishes trusted native facts. The optional HTTP worker mode is an alternative catalogue, not a stage of the sandbox workflow. Exact tenant mappings, internal bearer substitution, session translation and the fixed pile/key/persona supervisor launch are wired; native tools, memory selection and model internals are external. A forwarding timeout explicitly leaves execution outcome unknown and does not retry. See MEM-OBJ-self-pile, MEM-OBJ-shared-pile, the runtime guarantee account, RT-OBJ-worker-manifest and RT-RTE-worker-forward.
Distinguish declared memory and implemented change paths
The strongest learning-related contribution is a declared episode-to-summary-to-later-context route. Prompts request consolidation of experience into durable memories. The documented cover prioritizes hierarchical summaries, trims oldest roots by temporal/budget rules, fills remaining space with recent turns and delays changed cover one turn. This supports claimed trace-fed summary learning, not wired provider learning or improved capacity. The provider entry/module surfaces have a bounded absence of a built-in prompt/cover loader; external worker alternatives remain unresolved. Temporal-overlap retrieval associates records with a summary interval, but does not prove which records produced the summary or that it was accepted as true. Conflicting legacy lens, explicit-creation and breath descriptions prevent a single definitive external renderer specification. See MEM-CLM-memory-cover, MEM-ABS-context-loader, EPI-CLM-memory-provenance and the profile verification.
Shipped scripts add narrower implemented operations. Timestamp migration preserves correctly typed LE interval endpoints under a new encoding and requests additive persistence; ISO interpretation and native acceptance are external. Wiki rewriting edits changed resolver output without checking intended referents. Telemetry derives sums/counts over selected decoded durations and prints ranked diagnostics, but retains no adaptation. Smoke assertions check selected deployment fixtures and gate their script, not arbitrary answer acceptance or a production release. Source-fingerprint bundle builds admit successfully compiled/staged capabilities, not empirically improved behavior. See EPI-RTE-timestamp-reshape, EPI-RTE-timestamp-retain, EPI-RTE-link-rewrite, EPI-RTE-telemetry-report, EPI-RTE-smoke-check and RT-RTE-bundle-build.
These partial contributions do not establish that criticism of a consumed theory improved future capacity. No theory route is established in the supplied runtime account, so theory-builder conditions 1–4 cannot be assigned affirmative findings from transport, build completion or prompt requests: localized theory content, content-dependent consumption, formulated content-directed criticism and retained criticism shaping another round each require their own evidence. Reflection and autonomy are independently unestablished; supervision restarts machinery, while the enclosing client still supplies reasoning and continuation. Self-improvement at the provider boundary is likewise unestablished: the records do not connect objective-bearing evidence to an update of its own organization, a live later authority path and subsequent operation causally dependent on that change. Operator capability installation and file revision alone close none of that attribution. See the runtime capability/change account, RT-RTE-bundle-build, RT-RTE-worker-forward and the epistemic bounded conclusion.
For caller-directed shell work, the supported assessment is a wired persistence, admission and bounded-result mechanism with deployment-dependent cancellation and client-owned recovery. For automatic memory assembly or evidence-responsive improvement, this source establishes doctrine and integration glue, not an exercised loop. Inspectable worker implementations and linked traces showing summary production, admission, selection and later consumption would change the memory assessment. Deployment results would establish operation only for their tested conditions. Improvement attribution additionally needs an independently specified objective and evidence connecting an update to later behavior; comparative outcomes are needed to establish benefit. No source reads were added during synthesis.
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| No supplied execution or causal evidence | SRC-1; RT-RTE-sandbox-exec, RT-RTE-retained-jobs, RT-RTE-worker-forward | Frozen provider, backends and launch glue; source inspection only | Successful deployment, exercised agent delivery, activation or causal benefit | Linked execution artifacts at named configurations; controlled comparisons for causal claims |
| Cached authority can survive token-store faults | SRC-1; RT-RTE-sandbox-exec, RT-RTE-worker-forward, admission ledger, verification limit | Static-token reload in src/mcp_http.rs; modification-time detection and retained cache on error |
Timely fail-closed revocation under unreadable/malformed stores or unchanged detected modification time | Fault/revocation traces and enforcement design covering those cases |
| Evaluator inventory is partial | SRC-1; EPI-RTE-smoke-check, verification limit | Smoke script plus verification inspection of native-discovery/runbook and bounded service/CLI assertions; not every evaluator inspected | Complete evaluator enumeration or coverage comparison; observed test success | Records covering additional protocol/configuration/no-pile-key-creation fixtures and remaining material evaluators; results for operation claims |
| Source-native context specifications differ | SRC-1; MEM-CLM-memory-cover, EPI-CLM-memory-provenance, EPI-CLM-shell-causality, verification limit | Memory/event documents, redesign history, legacy guide and both prompts | One definitive external context-renderer specification or equivalence across document eras | Version-matched renderer implementation and prompt-loading traces resolving lens, creation, provenance and breath behavior |
| Native content and model mechanisms are external | SRC-1; MEM-OBJ-self-pile, MEM-OBJ-shared-pile, MEM-RTE-native-onboarding, RT-RTE-worker-forward | Fixed mounts, onboarding calls, gateway and supervisor; excludes native implementation | Complete native storage/form/lineage/admission/read-back or model-version/parameter-change account | Pinned native implementation, initial content provenance and linked consumer traces |
| Guarantees depend on backend and deployment contracts | SRC-1; RT-RTE-retained-jobs, MEM-OBJ-self-pile, runtime guarantee account | Jail/Lima/runner glue; no actual host state or isolation audit | Universal append-only enforcement, isolation, egress containment or cancellation across backends | Host/configuration evidence and backend-specific fault/cleanup tests; enforced Lima protection for truncation claims |
| Result retention is bounded and not acknowledged delivery | SRC-1; MEM-OBJ-output-log, MEM-OBJ-job-snapshot, EPI-RTE-result-render | Ring eviction, decoding, final-page observation, TTL and restart | Complete byte transcript, durable delivery receipt or client/model consumption | Lossless durable output retention plus client acknowledgement and linked consumption evidence |
| Content approval, provenance and maintenance semantics remain unresolved | SRC-1; MEM-OBJ-workspace-files, EPI-RTE-file-disposition, EPI-RTE-link-rewrite, EPI-RTE-timestamp-reshape, EPI-RTE-telemetry-report | Generic caller file writes and script wrappers; external parser/resolver/storage and input measurements | Per-content human approval, substantive truth, referent preservation, measurement authenticity or downstream semantic acceptance | Caller/admission provenance, native acceptance and resolver/parser records, authenticated measurements and later-consumer evidence |
| Theory, learning benefit and self-change attribution are not established | SRC-1; MEM-CLM-memory-cover, RT-RTE-bundle-build, RT-RTE-worker-forward, epistemic conclusion | Provider change paths and declared external model conduct; no theory-round or update-dependent operation trace | Affirmative theory-builder, improved future capacity, reflection, autonomy or exercised self-improvement conclusions; also a complete negative over external programs | Property-specific records of theory consumption/criticism/iteration, bidirectional self-representation, computational role ownership, and objective-responsive organization change reaching later operation |