JAZ synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
From host inputs to executed work
JAZ is an enclosing agent runtime: it owns the model/code/observation loop, rather than merely forwarding requests to a provider. This account covers its shipped Python package, console, hooks, prompts, adapters and persistence utilities at commit 0803d4971be785e95b80054b02259664d70fa3da, with an analysis cutoff of 2026-10-19. SRC-1 supplies inspected implementation and source-native design statements. No target execution, inspectable run or causal experiment was supplied. External providers, arbitrary consuming applications and the unshipped development environment are outside this evidence boundary. The boundary and source register fix those limits; no additional source reads were made for this synthesis.
A caller supplies named Python objects, task text and any tool callables. JAZ binds their live payloads into a fresh invocation namespace and describes them to the configured model. Under the default code-only protocol, response text becomes Python source without code-fence extraction. Hooks can edit or veto work at defined stages. Admitted source executes in the host interpreter; Continue supplies an observation for another query, while Return or Raise reaches completion transforms and then the caller. There is no unconditional iteration ceiling. Sync and async entry points share this progression; async does not create process isolation. See RT-RTE-agent-loop, RT-CMP-python-repl and EPI-OBJ-llm-response.
Control ownership is split. The model selects actions; the host chooses live objects, components and hooks; runtime code commits and executes the resulting work. A supplied model response skips the provider but still reaches code admission. A supplied execution result skips compilation and execution but reaches execution-completion transforms. A supplied invocation result skips the loop but reaches invocation completion. Installed return checks therefore have completion backstops, whereas code validation covers committed source, not every effect of trusted callbacks or hooks. See RT-RTE-hook-admission and RT-BAP-hook-effects.
These controls are conditional policies, not a universal sandbox. Compiler checks and wrapped builtins constrain ordinary configured REPL execution. Granted host tools can perform their own file or shell operations outside those wrappers. Initial binding accepts a caller input named __builtins__ that replaces the protected mapping; separate static checks remain. Granting child configuration overrides can also change child policy. Enabled timeout pragmas take priority without a ceiling; disabling them restores caller/configuration timeout selection, still under best-effort in-process guards. These are source-traced paths, not observed hostile exploits. Deployment containment requires a host capability contract and external isolation. See RT-CLM-repl-policy, EPI-RTE-swe-tools and the verified forcing cases.
Delegation, checking and delivery
The representative shipped workflow asks a parent to process items through recursive calls and combine a list. The parent model chooses decomposition, child inputs and aggregation code; the request is not a deterministic map scheduler. Bound invoke creates a separate child conversation and namespace, passes selected inputs plus inherited scope, and returns the child's Python value to parent execution. Child transcripts do not automatically enter the parent window. Shared live objects can nevertheless carry effects beyond the return value. See RT-RTE-recursive-invoke and the workflow account.
In that example the root's local list-return contract does not automatically propagate, while the surrounding depth-governance context does. RecursionLimit removes the built-in recursive primitive at the cap and aborts attributed over-cap calls. It is not a universal bound: public entry on a raw worker without inherited context can create a new root, and a captured closure's fallback can attribute work to its binder instead of its actual caller. Depth guarantees depend on preserving invocation context. See RT-RTE-recursive-invoke.
ReturnType can reject a non-list and feed a type error back to the model; the example's default has no mismatch-count cutoff. A final invalid Return introduced by another transform can instead become a terminal exception. Delivery is the final post-transform value reaching the caller, not merely obtaining child results. Neither list shape nor depth compliance proves item completeness, correct correspondence or substantive answer quality. Rejection does not roll back prior mutations. See RT-RTE-hook-admission and workflow delivery.
The same distinction applies beyond this example. ValidateReturn relies on a host callable raising an exception, not returning False. Replay compares selected representations, and rollout export checks structural eligibility. BudgetForcing can refuse termination solely from a counter. These mechanisms have consequential consumers, but no inherent factual-answer oracle. Actual tasks could supply evidence-consuming validators; none here establishes an accepted proposition, warranted derivation, or lifecycle integration of accepted ampliative claims. See EPI-OBJ-return-value, EPI-RTE-budget-forcing and the epistemic conclusion.
What survives and reaches later work
JAZ separates context delivery from retention. Default observations abbreviate continuing output, while current-invocation history retains that output whole. An interior error can disappear from the next observation even though generated code could inspect history. Terminal history is not a complete output checkpoint. Hooks can make transient or persistent message edits; ContextWindowWarning adds advice rather than automatically compacting content. See EPI-RTE-observation-projection, MEM-OBJ-repl-history and RT-RTE-context-control.
Across fresh console invocations, main turns automatically receive nonempty live conversation history, including failures and arbitrary input/result references. Capped repr displays do not bound or classify those payloads; all turns remain included, without an established total transcript budget. Helpers instead receive rendered main/helper transcripts. Their retained applied flag records permission before execution, not verified success. Readline restores command lines for human recall, not live result objects or automatic agent context. See MEM-OBJ-conversation-history, MEM-OBJ-helper-history and MEM-OBJ-readline-history.
Optional recording creates different products, not interchangeable checkpoints. ATIF JSON retains response text and structured provenance but only repr summaries of initial live objects. Diagnostic directories afford human inspection. Replay loads a selected ATIF trace and supplies queued responses to the ordinary parser/executor; code and tools still execute. Exhaustion, missing children or divergence can resume live provider work. Optional equality checks concern edit signatures, response content and normalized rendered observations, not complete execution equivalence or safe repetition. Later mismatches withdraw future saved service without reversing the current turn. See MEM-OBJ-atif-trajectory, MEM-OBJ-trajectory-directory, RT-RTE-trajectory-replay and EPI-RTE-replay-comparison.
Retained change without demonstrated improvement
The strongest supported trace-fed contributions are executable workflow materialization and token-native training-sample export. WorkflowReplay automatically turns execution events into durable Python for an intended later executor. Rollout export provides samples for a documented external trainer. These afford later behavior-shaping use, rather than merely displaying raw logs, but later execution or training remains unobserved. The profile verification accepts these afforded positive trace-learning findings while preserving partial coverage; this does not establish improved capacity for future action. See RT-RTE-workflow-emission and MEM-RTE-rollout-export.
The qualifications differ by route. Workflow emission can finalize abnormal work and captures Enter-time code, which may differ from committed code after other hooks edit it. It neither certifies nor installs the generated program. Token sidecars can retain hidden reasoning omitted from visible code and later text context. A tokenless completed query drops that invocation's partial token log; flat export rejects nonmonotone contexts while alternative exports remain. Samples contain no built-in reward judgment. SGLang additionally exposes weight-update transport, but no shipped trainer connects exported samples to those updates in the accepted account. Service acceptance, candidate provenance and subsequent policy behavior remain unresolved. See MEM-OBJ-token-stamp, MEM-OBJ-rollout, MEM-RTE-weight-update and report verification.
There is also a human-admitted configuration channel. The console helper receives configuration/source/transcript information and proposes an answer or code. Only code proposals pass the TTY and explicit confirmation gate before host execution. A model switch probes connectivity before changing live configuration and attempting persistence; successfully stored choices route later console work. Direct user Python is a distinct path, not subject to the helper gate. Consent and connectivity do not establish better task performance. See RT-RTE-settings-admission and RT-BAP-settings-load.
For open tasks requiring Python computation and selective delegation, the supported architecture provides action selection, separate child contexts, optional admission checks and typed delivery. For a scenario requiring semantically verified aggregates, isolated untrusted execution, faithful offline replay or automatic beneficial policy updates, those same mechanisms do not establish the required result. They need different evidence or stronger contracts, not a system-wide quality grade.
The accepted records do not identify a formulated-theory route sufficient to assess theory-builder conditions 1–4 positively: localized theory content, content-dependent consumption, content-directed criticism and retained iteration each remain unestablished at that level. Code retries alone establish none of them. Likewise, criticism of a consumed theory improving future capacity is not demonstrated. Automatic internal execution and human-admitted configuration change are separately supported; they do not establish autonomous theory building or reflection with both causal directions through a self-representation. Exercised self-improvement is also unestablished: no independently specified improvement objective is traced through evidence-shaped update determination, admission into JAZ's own organization and subsequent operation causally dependent on that update. These are independent unresolved properties, not a bundled negative inferred from missing runs. See RT-RTE-settings-admission, RT-RTE-workflow-emission, MEM-RTE-weight-update and the epistemic conclusion.
Concrete changes to this assessment would include task traces with item-level acceptance criteria; a replay comparison covering the claimed execution domain; committed-code capture plus an equivalence check for generated workflows; and a connected training/update driver with provenance, an independent objective and later policy-use evidence. Controlled outcome comparisons would additionally be needed to attribute benefit rather than merely establish operation.
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| No supplied execution or causal comparison | SRC-1; RT-RTE-agent-loop, MEM-RTE-rollout-export | Published package implementation and declarations at the frozen commit | Actual activation, successful correction, reliable delivery, or causal benefit | Inspectable runs with inputs, grants, checks and outcomes; controlled comparisons for benefit |
| Adapter context inventory is incomplete; report verification found additional Copilot reuse and trimming | SRC-1; report-verification limit, RT-CMP-llm, memory coverage | Named adapter paths; verifier inspected src/jaz/llm/copilot.py reuse checks, prefix agreement, rebuild and trimming-related session drop |
Exhaustive cross-system comparison of adapter-held context and reload behavior; local console/default-codec/replay/SGLang findings remain supported | Accepted records tracing Copilot and remaining adapter state producers, selectors and consumers |
| Human diagnostic-consumer authority is omitted from the partial comparison inventory | SRC-1; profile-verification limit, MEM-OBJ-trajectory-directory | Diagnostic directory displays and their afforded human inspection consumer | Complete diagnostic-consumer authority comparison, not the validity of emitted authority findings | A separate classification of the recorded human consumer and its effect |
| Opaque live payloads, remote telemetry and other provider state remain unresolved | SRC-1; MEM-OBJ-conversation-history, RT-CMP-llm, memory coverage | Known local capture/delivery paths; remote payloads and internals uninspected or external | Complete storage, form, provenance, authority, update or retention inventory | Operative payload records and bounded provider/collector retention and consumer contracts |
| Replay/converter coverage and concurrency audit are partial; representation agreement is narrower than equivalence | SRC-1; RT-RTE-trajectory-replay, EPI-RTE-replay-comparison, MEM-OBJ-trajectory-directory | Saved-response serving and selected comparisons, not all conversion or concurrent ownership paths | Lossless checkpoint restoration, universal replay fidelity, offline-only execution or rollback | End-to-end conversion/ownership analysis and traces under declared external-effect conditions |
| Workflow artifacts may be partial and capture pre-edit code | SRC-1; RT-RTE-workflow-emission | Event-driven emitter including abnormal finalization | Successful, equivalent, safe or automatically installed generated workflows | Committed-source provenance, artifact acceptance checks and later execution evidence |
| Export and weight update are not a closed improvement loop | SRC-1; MEM-RTE-rollout-export, MEM-RTE-weight-update, MEM-OBJ-token-stamp | Shipped sample projections and update wrappers; external trainer/server internals excluded | Verified training provenance, accepted policy replacement, learned benefit or exercised self-improvement | Connected driver, candidate/evaluation provenance, server acceptance and subsequent causally traced policy use |
| Generated release excludes the development/evaluation system; protocol performance reports are attributed only | SRC-1; boundary, EPI-CLM-protocol-framing | Published tree and embedded reports, without underlying evaluation data | Independent performance validation or conclusions about the authors' complete improvement process | Evaluation protocols, raw results and relevant development-loop evidence within a newly declared boundary |
| Host and external contracts bound control guarantees | SRC-1; RT-CLM-repl-policy, RT-RTE-recursive-invoke, RT-RTE-hook-admission | Inspected binding, execution, timeout, parentage and completion paths; actual deployment grants absent | Universal containment, hard resource/depth ceilings or semantic answer correctness | Explicit capability/context-propagation contracts, external supervision and task-specific evidence-consuming validators |