Apache Maka agentic-system analysis

Type: kb/types/agentic-system-analysis-result.md

Run identity

Run state: kb/reports/state/agentic-system-analysis/AAS-2026-09-05-apache-maka-06/run-state.md

Generated review: kb/agentic-systems/reviews/apache-maka.md

Memory analysis report: kb/reports/state/agentic-system-analysis/AAS-2026-09-05-apache-maka-06/memory-report.md

Memory analysis report SHA-256: 93a3b6fa87fded57b4701338f2dddc6aef833e58f8849bc9653d567a1a09a9be

The system name is Apache Maka; its README styles the project Apache Maka (Incubating). This fresh source-only coordinator read no incumbent prose, prior exact result or prior substantive audit. Destination eligibility and expected incumbent bytes came only from the publication inspector. The source-native name is used consistently across run identity.

Boundary and evidence

Evidence basis: executable source and source documentation at Git commit 02f97c16d76e644d5b565889701958293ff7b5fb, inspected on 2026-09-05; no target execution or outcome observation.

This analysis describes an enclosing runtime with a whole-system boundary, concentrating on hosted interactive turns, model/tool execution, durable history and memory, graph coordination, and the separate evaluation plane. Its purpose is to distinguish execution ownership, retained-context authority and evidence about task outcomes. The source allowlist is only the pinned Apache repository. Origin and full commit were verified before evidence reads; worktree bytes, live pages and prior analysis were excluded.

Desktop, CLI/TUI and Eval are included as entry surfaces, with hosted execution and evaluation seams inspected. Detailed GUI behavior, remote peer transport, every platform sandbox implementation, external MCP server code, all individual tools, deep-research/goal/bot workflows, packaging and release machinery are not exhaustively inspected. These limits prevent a universal admission/isolation guarantee or a complete account of every feature's revision mechanism. External model service internals and benchmark verifier internals are outside the inspected code boundary; they prevent weight-fixity and oracle-validity claims. Source reports under docs/eval were not inspected, so the README's published-performance assertion remains claimed. The whole-system classification is an ownership boundary, not a claim to exhaustive code coverage.

Source register

Source ID	Kind	Identity/location	Revision or capture	Evidence layer	Inspected scope	Citation anchors	Access gaps and conclusion prevented
SRC-1	Git	`https://github.com/apache/maka`; access root `/home/zby/llm/commonplace/related-systems/apache--maka`	`02f97c16d76e644d5b565889701958293ff7b5fb`	implementation	Selected runtime, runtime-host, storage, core and eval files identified in canonical records; only cited ranges and specialist-inspected scopes supply findings	Full commit-relative paths on each record; runtime entry	Provider/verifier internals and real deployments unavailable; tests not executed; no observed or causal status
SRC-2	Git	`https://github.com/apache/maka`	`02f97c16d76e644d5b565889701958293ff7b5fb`	doctrine/design	README.md, ARCHITECTURE.md and specialist-cited shipped prompt contracts	README, architecture	Architecture assertions and comments do not prove operation; benchmark reports not inspected

The first unbounded tree listing exceeded delivery limits and was discarded as evidence; narrower package and filename inventories replaced it. Every source passage used below was subsequently inspected in bounded reads. No observation or causal experiment source is registered.

Shared records

Components

CMP-1 — Runtime Host, SessionManager, RuntimeKernel and AgentRun. Source-native hosted admission, session/run identity, backend invocation and event settlement. Representational form: symbolic TypeScript. Substrate: running process plus injected durable stores. Implementation conclusion status: wired. SRC-1 packages/runtime-host/src/server/interactive-turn-coordinator.ts:60-118, packages/runtime/src/runtime-kernel.ts:633-699,1650-1699, and RTE-1, RTE-7 retain the supporting excerpts.

CMP-2 — Selected provider model behind ModelAdapter. Distributed-parametric component; accessed through symbolic connection/model configuration and provider API. Model selection conclusion status: wired. Exact weight/version pinning conclusion status: uninspected: the inspected factory receives a connection and model ID, not verified weight bytes or immutable service implementation. Parameter changes during operation conclusion status: uninspected: provider internals are unavailable and no training operation is established by these call sites. This is not a fixed-weights finding. The same configurable model role also supports memory transformations identified by the specialist; any distinct role is retained there. SRC-1 packages/runtime/src/model-adapter.ts:208-225.

resolveModel(): unknown { if (providerAuthRequiresSecret(this.input.connection.providerType) && !this.input.apiKey) { throw new Error(No API key stored for connection "${this.input.connection.slug}"); } return this.input.modelFactory({ sessionId: this.input.sessionId, connection: this.input.connection, apiKey: this.input.apiKey, modelId: this.input.modelId, resolvedRuntime: this.runtime, --- packages/runtime/src/model-adapter.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

CMP-3 — Agent Graph readiness and schedule reconciliation. Symbolic TypeScript control-plane component over stored schedule revisions and activation claims. Implementation conclusion status: wired. It calculates runnable work and crosses a separate durable admission step before execution. Supervisor observer callbacks are not its data-path gate. SRC-1 packages/runtime/src/stream-graph-readiness.ts:164-195, packages/runtime/src/stream-graph-dispatch.ts:56-65, RTE-4.

CMP-4 — Eval runner, executor adapter and result selector. Symbolic TypeScript experiment plane; per-cell outcomes and artifacts are structured data. Implementation conclusion status: wired. The runner invokes subjects, imports verifier results and selects reusable outcomes. It does not own the inspected ordinary agent loop. SRC-1 packages/eval/src/runner.ts:285-333, packages/eval/src/result.ts:20-101; SRC-2 ARCHITECTURE.md:38-60; RTE-5, RTE-6.

CMP-5 — Memory-extraction proposal and canonicalization model roles. Distributed-parametric transformations called within the source-native extraction engine, behind connection/model resolution. Call/role conclusion status: wired; operational parameter changes and exact provider weight/version pinning conclusion status: uninspected. The latter two findings concern inaccessible provider internals, not a claim of fixed parameters. SRC-1 packages/runtime/src/memory-extraction.ts:813-1139, packages/runtime/src/memory-extraction-proposal.ts:201-264,308-366; RTE-12 retains the substantive evidence.

CMP-6 — Portable continuation summarizer and provider-native compactor roles. Distributed-parametric transformations of retained runtime projections, with symbolic coverage/replay checks. Call/role conclusion status: wired. Exact parameter identity and changes inside the provider conclusion status: uninspected. Native replay compatibility uses connection/model identity, not proof that the provider's weights are immutable. SRC-1 packages/runtime/src/history-compact-summarizer.ts:71-150, packages/runtime/src/openai-codex-history-compactor.ts:56-179; RTE-9, RTE-10 retain the evidence. No additional embedding model or parametric selector is established in the inspected memory routes; this inventory makes no claim about unassessed provider internals.

Operative objects

OBJ-1 — Assistant text produced by an ordinary model step. Natural-language output, initially streamed/in-process and projected into runtime history. Implementation conclusion status: wired. It may contain truth-apt task answers or proposed actions; no instance was observed. SRC-1 packages/runtime/src/ai-sdk-turn.ts:869-979,1550-1615,2335-2389; RTE-1 owns its production and terminal return. It is a typed part of history, not interchangeable with the entire event container.

OBJ-2 — Tool call arguments and function-response content. Mixed symbolic/natural-language data whose concrete payload depends on the selected tool; in-process settlement and event storage. Implementation conclusion status: wired. Effects happen at a tool/provider/client boundary; a returned response is evidence of what a tool reported, not automatic truth of a model's interpretation. SRC-1 packages/runtime/src/tool-runtime.ts:1606-1630,1747-1759,2350-2393; RTE-2 retains the dispatch/outcome proof. External tool payload internals remain uninspected. Different tool functions may require finer parts in a task-specific pass; this record covers the call/response boundary rather than assigning a uniform warrant to all payloads.

OBJ-3 — Agent Graph runnable intents and schedule revisions. Symbolic policy/identity data, projected from topology and activation records and admitted through the control store. Implementation conclusion status: wired. A readiness state has operational meaning; it is not an epistemically accepted task solution. SRC-1 packages/runtime/src/stream-graph-readiness.ts:40-59,96-119,164-195; RTE-4.

OBJ-4 — EvalResult and CellAttempt. Symbolic outcome record containing score, usage, cost, duration, status, failure reason and artifacts. Implementation conclusion status: wired. An imported score is truth-apt relative to the configured verifier and task, with verifier validity outside this boundary. SRC-1 packages/eval/src/result.ts:31-52; RTE-5, RTE-6.

export interface EvalResult { readonly score: number | null; readonly usage: NormalizedUsage | null; readonly costUsd: number | null; readonly durationMs: number; readonly status: EvalResultStatus; readonly failureReason: string | null; readonly artifacts: readonly JsonObject[]; }

--- packages/eval/src/result.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

OBJ-5 — RuntimeEvent content, invocation identity and effective model-history projections. Implementation conclusion status: wired. These are raw interaction/tool traces plus symbolic runtime and projection records, not already distilled memory. The operational SQLite database holds run/event state; later model history uses the effective projection, including any durable tool-result replacement. SRC-1: packages/storage/src/operational-state-store.ts:61-65, packages/storage/src/agent-run-store.ts:330-333, packages/runtime/src/prior-run-context.ts:39-75, packages/runtime/src/agent-run.ts:705-729. Model/user text supplies context and original role-bearing instructions; event identifiers and projection records route which parts are delivered.

export const OPERATIONAL_STATE_DATABASE_NAME = 'runtime.sqlite'; export const OPERATIONAL_STATE_SCHEMA_VERSION = 2;

/* Resolve the authoritative on-disk path of the operational-state database. / export function resolveOperationalStateDatabasePath(workspaceRoot: string): string { return resolve(workspaceRoot, OPERATIONAL_STATE_DATABASE_NAME); --- packages/storage/src/operational-state-store.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

const invocations = (await store.listSessionInvocations(input.sessionId)).filter( (invocation) => invocation.runId !== input.currentRunId && invocation.turnId !== input.currentTurnId && isSessionInlineInvocation(invocation.opening), ); --- packages/runtime/src/prior-run-context.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

This actual selection excludes current invocation/turn material and chooses earlier inline invocations in the requested session; it does not automatically import every child run into parent history.

OBJ-6 — Text history-compaction checkpoint, version 2. Implementation conclusion status: wired. The operative payload is a natural-language summary; symbolic fields retain source policy, covered event count, turn count, last event identity, source digest, prior checkpoint identity, phase and optional current-turn head anchor. It is stored inside the run-ledger history_compact_checkpoint_recorded event, not only held in a local prompt cache. SRC-1: packages/runtime/src/history-compact-checkpoint.ts:39-112, packages/runtime/src/agent-run.ts:544-564, packages/runtime/src/history-compact-ledger.ts:57-124. Its claim-bearing content supplies continuation context; its coverage fields validate and route replay.

type: 'history_compact_checkpoint_recorded', --- packages/runtime/src/agent-run.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

summary: ${checkpoint.summary}, --- packages/runtime/src/history-compact-checkpoint.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

The first anchor identifies the persisted event kind; the surrounding recorder stores the checkpoint itself. The second is the rendered content subsequently used in the model-visible checkpoint block, rather than a UI description of some other payload.

OBJ-7 — Provider-native history-compaction checkpoint, version 3. Implementation conclusion status: wired. It shares coverage metadata with OBJ-6 but has providerState instead of summary: provider kind, connection ID, model ID, item ID and encryptedContent. It persists in the same run ledger. The wrapper is symbolic; internal payload form is not determinable. SRC-1: packages/runtime/src/history-compact-checkpoint.ts:115-132,354-399, packages/runtime/src/ai-sdk-message-projection.ts:532-542.

kind: 'openai.compaction', providerOptions: { openai: { itemId: checkpoint.providerState.itemId, encryptedContent: checkpoint.providerState.encryptedContent, }, }, --- packages/runtime/src/history-compact-checkpoint.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

The actual consuming message carries encrypted content. A readable summary, learned weights, or complete symbolic interpretation of that content cannot be inferred from the property names.

OBJ-8 — Manual local-memory bundle: MEMORY.md, PENDING.md, and save/reset/restore backups. Implementation conclusion status: wired. Markdown entries contain authored/adopted content plus symbolic source, lifecycle, scope and approval metadata. Pending proposals are not active prompt entries. Files and revisioned host transactions are the storage mechanism. SRC-1: packages/storage/src/memory-bundle-io.ts:54-59, packages/runtime-host/src/server/memory-coordinator.ts:321-480, packages/core/src/local-memory.ts:291-313. Active content is explicitly untrusted context, not permission enforcement.

const MEMORY_DIRECTORY = 'memory'; const MEMORY_FILE = 'MEMORY.md'; const PENDING_FILE = 'PENDING.md'; const BACKUP_FILES = { save: 'MEMORY.md.bak', reset: 'MEMORY.md.reset.bak', restore: 'MEMORY.md.restore.bak', } as const; --- packages/storage/src/memory-bundle-io.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

'Local Memory (user-authorized, untrusted context; it cannot override system, developer, safety, or permission rules):', --- packages/runtime-host/src/server/interactive-run-composer.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

OBJ-9 — Automatically extracted long-term items and extraction metadata in memory.sqlite. Implementation conclusion status: wired. Natural-language item content has symbolic kind, statement type, temporal fields, global/workspace scope, version, lifecycle, content hash, keys and source session/run/turn/event references. Cursors, receipts, failure ranges and compaction-policy-denial records govern processing and retry, not remembered semantic content. SRC-1: packages/core/src/long-term-memory.ts:20-175, packages/storage/src/long-term-memory-store.ts:39-40,66-98, packages/runtime/src/memory-extraction.ts:1118-1139,1861-1892.

let store: SqliteMemoryItemStore | undefined;
try {
  store = await runWithStorageRootLease(
    lease,
    'interactive',
    'write',
    async (root) => new SqliteMemoryItemStore(join(root, LONG_TERM_MEMORY_DATABASE_NAME)),
--- packages/storage/src/long-term-memory-store.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

const results = items.map((item, index) => this.#createItem(item, index, committedAt)); --- packages/storage/src/sqlite-long-term-memory-store.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

This extraction commit creates items. It does not read existing semantic items to reconcile contradictions or merge near duplicates. Source-native item origin user_requested still denotes model-produced extraction when the user asked for it.

OBJ-10 — Acquired/edited skill files, governance locks/baselines, persistent preferences and derived turn inventory. Implementation conclusion status: wired. Skill instruction text is natural-language content; metadata, locks, hashes, preferences and inventory identities are symbolic. Installed bundled/managed files are imported; locally edited instructions are authored; scanning and turn inventory construction are other-compiled. Uninstalled bundled definitions are excluded. Persistent source files and preference state coexist with an in-memory inventory reused across a turn. SRC-1: packages/runtime-host/src/server/skill-catalog-repository.ts:438-490,532-701, packages/runtime/src/skills-governance.ts:119-166,201-243, packages/runtime-host/src/server/interactive-run-composer.ts:547-569, packages/runtime/src/skills-context.ts:168-176,251-333.

const cached = inventoryByTurn.get(key); if (cached) return await cached; const pending = skills.readCanonicalModelInventory({ projectRoot: context.cwd }); inventoryByTurn.set(key, pending); --- packages/runtime-host/src/server/interactive-run-composer.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

This is an operative retained per-turn access snapshot, not long-term learned content. The catalog and tools share the same inventory. Pinning changes ranking; enablement and capability eligibility change visibility. Declared tools alone cannot grant access.

OBJ-11 — Tool-result archive body, placeholder and ModelProjectionTransition. Implementation conclusion status: wired. The archived body preserves the replaced effective tool result, serialized to a file; SQLite artifact metadata and a durable projection transition identify its replacement and source digest. The model normally sees a bounded placeholder/ref and may request decoded content. The archive is raw retained evidence, not an LLM-generated distillation. Its body is distinct from the short artifact summary. SRC-1: packages/runtime/src/tool-result-archive-transition.ts:20-43,75-105,166-175, packages/runtime-host/src/server/execution-artifacts.ts:113-149, packages/storage/src/artifact-store.ts:281-315.

content: event.serializedResult, mimeType: 'application/json', source: 'tool_result_archive', summary: Archived ${event.toolName} tool result for context budget replay, --- packages/runtime-host/src/server/execution-artifacts.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

The short summary names the archive; it is not the serialized result content the decoder later reads.

Routes

RTE-1 — Ordinary model/tool turn. Implementation conclusion status: wired. Trigger/principal: admitted external user message or hosted invocation. Next-step owner: RuntimeKernel creates AgentRun; the selected backend's explicit loop calls ModelAdapter and decides continuation from returned calls, budgets, stop flags and steering. Policy/form: symbolic loop around distributed-parametric model decisions. Context: system prompt, current message, projected history and eligible tool schemas; state: Session, Turn, Run, invocation and provider-step identities. Executor/effects: provider produces OBJ-1 and requests OBJ-2; RTE-2 owns client-executed tool effects. Persistence: AgentRun event recording with different durability requirements; immediate return: streamed session events followed by terminal event/output. Recovery: RTE-3. Later read-back: history/context routes integrated below; current-turn loop state alone is not memory. Delegated visibility: graph/subagent routes receive their admitted input, not automatic access to every parent payload. Selector: live tool activation and context projection; invalidation: stop/budget and new step snapshots. Activation/effect conclusion status: uninspected; wiring establishes possible consumption, not that recalled material changed behavior. SRC-1 packages/runtime/src/runtime-kernel.ts:633-699,1650-1699, packages/runtime/src/agent-run.ts:608-735, packages/runtime/src/ai-sdk-turn.ts:1429-1465,1550-1580,2240-2287,2335-2389.

try {
  input.beforeDispatch();
  for await (const sessionEvent of input.backend.send({
    ...backendInput,
    ...(input.hostedInteraction ? { hostedInteraction: input.hostedInteraction } : {}),
  })) {
    if (terminalSeen || !isLiveBackendSessionEvent(sessionEvent)) continue;
    const runtimeEvent = mapSessionEventToRuntimeEvent(
      sessionEvent,
      input.eventContext,
      memory,
    );
    if (sessionEvent.type === 'error') errorSeen = true;
    terminalSeen = isTerminalRuntimeEvent(runtimeEvent);
    await input.onSessionEvent(sessionEvent, runtimeEvent);
    if (terminalSeen) terminalAccepted = true;

--- packages/runtime/src/runtime-kernel.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

        result = await this.deps.modelAdapter.startStream({
          model,
          messages: attemptMessages,
          tools: modelTools,
          activeTools: activeToolsForRequest,
          onStreamActivity: () => requestWatchdog?.markActivity(),

--- packages/runtime/src/ai-sdk-turn.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

      const stepLimitReached = maxSteps !== undefined && runtimeSteps >= maxSteps;
      if (
        sandboxBoundaryFinalizationStep ||
        (stepLimitReached &&
          (toolRuntime.shouldFinalizeSandboxBoundary() ||
            toolRuntime.hasSandboxBoundaryDenial()))
      ) {
        this.loopStopReason = 'permission_handoff';
        this.loopStopRequested = true;
      }
      const mayTakeAnotherStep = !stepLimitReached && !this.loopStopRequested && !this.aborted;
      if (returnedToolCalls.length > 0 && mayTakeAnotherStep) {
        currentStepMessageId = this.deps.newId();
        continue agentLoop;
      }

--- packages/runtime/src/ai-sdk-turn.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

The durability qualification is material to CLM-1: generic nonterminal event persistence is not uniformly fail-closed. Steering and terminal/interaction boundaries have explicit stronger requirements.

  // A steered user message is fail-CLOSED: the backend's delivery ack
  // waits on this consume, and the provider must never execute a
  // directive the ledger does not carry. Every other non-terminal event
  // stays fail-open (a trace gap, not a correctness gap).
  const steering =
    runtimeEvent.content?.kind === 'text' && runtimeEvent.content.steering === true;
  await this.recordRuntimeEvents([runtimeEvent], steering ? { requireDurableWrite: true } : {});

--- packages/runtime/src/agent-run.ts @ 02f97c16d76e644d5b565889701958293ff7b5fb

RTE-2 — Tool admission, execution and durable settlement. Implementation conclusion status: wired. Trigger/proposer: a model call or nested code-mode invocation; owner: per-turn ToolRuntime. Decision policy/form: argument validation, loop/deferred-tool guards, execution boundary, prepared capability admission, then tool implementation. Context/state: immutable argument snapshots, current tool grant snapshot, session permission mode, execution boundary, operation/run/turn identity. Effects: Write/Edit or arbitrary selected tool effect through its executor; provider-hosted tools are a separate branch outside local ToolRuntime effects. Persistence: where a RuntimeCommitSink is configured, commitToolPrepared precedes invocation and commitToolOutcome records response; T1 failure cancels prepared operations, and outcome-failure compensation is explicitly best effort. Return: typed result/error and model-facing response; later read-back via history. Delegated visibility: nested calls can be model-hidden but remain recovery-relevant (RTE-3). Selection/expiry: active tools are fixed per provider-step snapshot; a search-loaded tool becomes callable on a later step. Guarantee owner/enforcement: ToolRuntime at prepared commit, strength protocol, conditional on durable store and tool/OS/client contracts; this is not a deployed sandbox guarantee.

Revision admission: model or user proposes a file/tool effect; the selected boundary and executor admit or refuse it. Runtime-managed Write/Edit additionally bind expected path, policy version and execution-profile digest to the durable call. Successful execution is operational admission, not acceptance of the product's correctness. User/host can deny expansion or stop; arbitrary external effects need their own rollback, and the inspected generic compensation hook does not promise one. SRC-1 packages/runtime/src/tool-runtime.ts:1468-1545,1606-1630,1747-1759,2300-2415, packages/runtime/src/ai-sdk-turn.ts:2240-2287.

// Tool-availability execute-boundary guard. Uses the step-start snapshot,
// NOT the turn's live activation map: a tool_search result becomes callable
// only on the next provider step.
if (deferredToolNotLoaded) {
  const reason = formatDeferredNotLoadedText(tool.name);
  await refuseBeforeDispatch(reason);