Multi-Agent Formation Coverage, Gaps, and Handoff¶

Date: 2026-09-17 · Status: Handoff for a follow-up session · Live matrix: R9700 / InferFlux / Qwen3-Coder-30B (see multiagent-formations-inferflux.md) · Rev 2: adds §2, an industry pattern catalog researched from current framework docs and surveys (LangChain, Anthropic, AutoGen, OpenAI, CrewAI, ADK, MDPI/arXiv), with three new gaps (G14–G16) and two new workstreams (WS-G/WS-H). · Rev 3: adds §2.3 role-nomenclature standardization, §2.4 cross-cutting standards mandate (prompt engineering, design patterns, architecture), and workstream WS-I; adversarially reviewed — all codebase claims re-verified against the repo.

This document answers three questions: which formations Victor implements and which of
those were verified live; which designs exist beyond the canonical six (implemented,
unwired, or deferred); and what the follow-up session should address, with the
co-design learnings that motivate each item.

2026-10-07 closeout: read the restart handoff
for merged milestones, release versus source status, and the ordered remaining gates.
It supersedes stale session/branch instructions; dated live evidence below is retained.

1. Coverage: what is implemented, and what was verified live¶

1.1 Canonical formations — implemented and live-tested (6/6)¶

TeamFormation (victor/teams/types.py) defines twelve values, all registered in UnifiedTeamCoordinator._formations.
The original six below were verified live on
2026-09-17 (single 3-member PARALLEL re-verified again on rebased develop, 48.2s green):

Formation	Live result	Notes from the run
SEQUENTIAL	✅ 30.0s	context chains member→member
PIPELINE	✅ 18.0s	both stages delivered files
PARALLEL	✅ 44.7s / 48.2s	3 concurrent members, disjoint deliverables
HIERARCHICAL	✅ 19.0s	supervisor delegation + synthesis
CONSENSUS	✅ 18.5s	agreement reached in one pass
REFLECTION	✅ 48.2s	generator→critic→refine, early exit

The WS-F paired artifact battery (2026-09-18) uses a different strict task and
records failures separately: matrix and follow-ups.
Its Qwen ⅙ and small-MoE 0/6 results do not establish general edge-model support.

1.2 Additional surfaces — verification status¶

The original matrix omitted these surfaces; follow-up validation is recorded per item:

Dynamic formation selection. StateGraphNodeConfig.formation_strategy picks a
formation per invocation from graph state (sync-only; async strategies raise
TypeError), and formation_hint / topology_formation_hint context keys override
per call (_resolve_effective_formation, unified_coordinator.py). A raising strategy
falls back to the default formation with a warning log and additive
team_formation_warning stream/wire event (WS-E). Invalid returned identifiers
use the same observable failure path.
Capacity admission — ✅ WS-C (PR #1110)
verified three members against capacity two, with throttling and all assignments
retained. Legacy max_workers alone still limits member count.
Worktree-isolated members. victor/teams/worktree_runtime.py
(WorktreeAssignment, WorktreeExecutionPlan) plus worktree_planner/worktree_runtime
coordinator params and colon-format child_session_id for isolated planning members.
✅ WS-D live validation covered materialized per-member worktrees, independent
pytest, and wire/result session attribution (PR #1111).
Heterogeneous members. Per-member provider / model / temperature /
reasoning_effort (TeamMemberSpec), with create_review_team (PIPELINE preset,
same-vendor warning) and create_reflection_team (rounds=3) presets. Unit-tested
(heterogeneous-member and review-preset suites). ✅ WS-E (PR #1115) verified six
R9700/Qwen members and a ZAI/GLM reviewer through Sandhi, including per-member
model routing and local reasoning-effort stripping.
Member-granular durability (FEP-0028 / ADR-023 / TD-25, shipped #733–#752):
per-member checkpoint/resume at formation-natural granularity across all six,
durable MemberApprovalPause for the four non-iterative formations, and
MemberEventSink per-member streaming lanes. ✅ WS-E (PR #1115) verified an injected
mid-pipeline approval pause and resume on the mixed local/cloud team; completed
writer and reviewer executions were restored without replay.

1.3 Additional formations — WS-A integration¶

Decision: INTEGRATE. The orphan trio now has enum values, shared-registry
registration, AgentTeam presets, feature/formation docs, coordinator-dispatch tests,
and explicit supports_durable_pause() == False statements. The new ZAI/Sandhi
matrix passed adaptive and dynamic router; multi-level hierarchy failed missing
member artifacts. Matched Qwen validation remains outstanding (see §1.5).

Strategy	Public formation / preset	State
`AdaptiveFormation`	ADAPTIVE / `create_adaptive_team`	✅ Integrated; invocation-local bounded switching, real member outcomes; PR #1107
`DynamicRouterFormation`	DYNAMIC_ROUTER / `create_router_team`	✅ Integrated; one-member dispatch retaining structured outcomes; PR #1107
`MultiLevelHierarchyFormation`	MULTI_LEVEL_HIERARCHY / `create_multi_level_hierarchy_team`	✅ Integrated; validated member-ID tree, lossless splitting, supervisor synthesis; PR #1107

Regression coverage: tests/unit/coordination/formations/test_new_formations.py
and the mirrored test_adaptive.py, test_dynamic_router.py,
test_multi_level_hierarchy.py, and test___init__.py, plus preset coverage in
tests/unit/teams/test_integrated_formations.py. Durable partial resume is not
supported for these three: no topology/routing/tree cursor is persisted. Approval
remains inline (see G17).

1.4 Designed, not implemented (or explicitly deferred)¶

FEP-0028 deferred remainder (recorded as Non-Goals, not debt): iterative-formation
pause/resume (CONSENSUS rounds, REFLECTION iterations cannot pause mid-loop),
iterative mid-loop partial resume, member tool/token streaming granularity,
project.db checkpointer, non-team chat continuation.
FEP-0006 external-harness executors (Draft) — members backed by agents outside
Victor's process; the remaining Omnigent cross-learning.
Patterns with no Victor counterpart: see the researched catalog in §2 — the
blackboard and contract-net remain absent. Conversation-native formations now
use the FEP-0035 transcript substrate; ensemble status is tracked separately (G16).

1.5 Completion audit (updated 2026-10-07; cohort dates retained)¶

Implementation delivery and live acceptance have different denominators:

Measure	Complete	Remaining
WS-A through WS-I increments landed	9/9 (100%); PRs in §4	0 original increments
Historical live passes before the new matrix	7/15 (47%): original six plus ensemble vote	Historical tasks/gates differ; not matched acceptance
2026-09-20 contract-v1 ZAI/Sandhi case passes	10/15 (67%)	2 deliverable failures; 3 ensemble cases blocked by resource exhaustion
Historical contract-v1 matched Qwen/InferFlux case passes	0/15 (0%); not run under that contract	15 cases
Historical contract-v1 matched matrix case passes	10/30 (33%)	20 cases without a pass (67%); overall ZAI run remains FAIL
2026-09-21 renewed contract-v2 ZAI/Sandhi acceptance	15/15 (100%); overall PASS	No case failures; broader lifecycle and cross-model acceptance remain separate
Contract-v2 Qwen/InferFlux ROCm case checks	0/15 (0%); overall FAIL	15 cases; missing tests and formation-contract failures
Contract-v2 combined case checks	15/30 (50%)	15 Qwen cases without a pass; not mixed-team or lifecycle acceptance
Historical 2026-09-21 single-file Qwen/ROCm profile	12/15 (80%); overall FAIL	Debate, multi-level hierarchy and ensemble synthesizer
Historical 2026-09-21 single-file ZAI profile	0/4 completed cases; interrupted/incomplete	26 HTTP 429s among 61 calls; no profile acceptance
2026-09-23 OIDC ZAI standard cohort	15/15 (100%); overall PASS	Broader lifecycle acceptance remains separate
2026-09-23 OIDC ZAI single-file cohort	15/15 (100%); overall PASS	No case failures; separate task profile
2026-09-23 OIDC Qwen3/ROCm single-file cohort	0/15 accepted; interrupted overall FAIL	First completed case timed out; second cancelled; 13 unstarted, not 15 model-quality failures
OIDC Qwen14/CUDA single-file cohort	0/15; not started	Held for consolidated-origin liveness investigation
Current six-Qwen/one-ZAI C5 acceptance	Open; historical failed run retained	InferFlux v0.5.0 release wire acceptance passes (16 synthetic checks); full run remains held for durable gateway/lifecycle acceptance and reviewed verdict on InferFlux #184
G53 operator deadline policy	✅ Buffered #297, stream body owner #298 and standalone streaming policy Sandhi #301 released in 0.10.1	Owned prepared admission and usage qualification merged in Sandhi #336/#337; tracked buffered HTTP/recovery merged in #338. Broader lifecycle, released deployment and changed-deadline live evidence remain open
G60 pre-dispatch enforcement repair	✅ Victor #1180; all CI green including Vertical Py3.12	Result-publication follow-up is described in G60 below; broader G60 and G61–G65 remain open
G60 result-publication boundary	Victor #1204: typed withholding, cache/result publication checks and retry vetoes	Executor/observer disclosure and cached pre-action authorization remain open; this does not close G60 or C5
G62 local single-action observations	✅ Victor #1209, merged October 3 and included in v0.12.0	Bound receipt capability landed in #1255; production adapters and whole-member continuation remain open
G62 asynchronous journal follow-up	Victor #1249, merged to main October 7; not in v0.12.0	Integrated via #1250; failed historical shards and repairs remain in the completed-work record; no release or live acceptance from that integration

The PDF recheck and critique
maps the local Agentic Workflow Automation guide to formation-specific acceptance
gates. Supervisor/MCP/queue choices remain workload-dependent; exact approval,
effect-aware recovery and verified outcomes apply to every member. Offline safety
repairs do not add formation passes or close C5.

Released foundation checkpoint (2026-10-09). InferFlux v0.5.0 is published
and deployed from verified source, with Sandhi 0.11.0 unchanged. The
new synthetic wire evidence
passes 16 direct/gateway checks and four accounting joins. It does not add a
formation, actual-member replay or C5 pass. Two failed harness attempts and their
verified rollbacks remain preserved. The canonical VAS-17 checkpoint
owns current runtime identities, remaining gateway/lifecycle work and next actions.

Released foundation checkpoint (2026-09-24). Sandhi 0.10.1 and InferFlux
0.3.0 are published and deployed. The
new synthetic liveness evidence
records exact source/binary/config identities. InferFlux's one loopback endpoint
on aiserver1:8080 serves Qwen3 on AMD and Qwen2.5-Coder-14B plus BGE on NVIDIA.
Discovery, both direct chat checks and ordered finite 384-dimensional embeddings
passed with BGE embedding_batch_size=1. Mixed-load capacity and performance
remain unaccepted; separate startup and lazy embedding contexts prevent treating
a single allocation log value as a comparable memory benchmark.

Two new short Qwen calls through released Sandhi used existing OIDC inference and
separate accounting identities. Both succeeded below the unchanged 120-second
acceptance deadline. The existing wire/SQLite/C4/dashboard oracle verified 2/2
joins, conserving 30 input, 2 output and explicitly reported zero cache tokens.
Shared cache was preserved; reported zero does not establish executed reuse.
These are explicitly synthetic startup checks, not the preserved five-call member
replay, new formation passes or C5 acceptance. Formation percentages above are unchanged.

The mixed-GPU deployment is a separately hashed build of the exact published
InferFlux tag; standard Linux release archives are CPU-only. The Homebrew formula
update #74 passed review, CI,
actual upgrade, executable test and installed/archive hash comparison. InferFlux's
unsupported --version flags remain a usability gap; do not infer binary identity
from version output. Origin OIDC, broader lifecycle acceptance, and Sandhi durable
HTTP settlement remain open. The earlier gateway startup-bound failure and all
historical failed evidence remain retained.

2026-09-25 implementation checkpoint (not a deployment or formation verdict):
InferFlux #229 landed endpoint
request admission on develop after independent review and all PR CI gates passed.
The shared per-subject ceiling remains authoritative; generation and embeddings can
have separate opt-in buckets on one listener. Its 54 CPU CTest targets pass, but
released deployment and measured embedding/mixed-load capacity were still open at
that implementation checkpoint (G67); the later release checkpoint below supersedes it.
Sandhi #310 landed immutable terminal
observations; #311 landed canonical
settlement from their stored charge after clean review and green PR CI. The latter
passes 732 workspace tests with 89.80% line coverage. Both are library foundations;
authoritative HTTP settlement, bounded recovery and lifecycle acceptance remain open.
Sandhi currently has no embeddings ingress (G68), so direct InferFlux embedding
results cannot establish gateway embedding metering. No formation counts or C5
verdicts change, and these changes have not replaced the released runtimes above.

Later 2026-09-25 foundation checkpoint: Sandhi #312
landed scoped, read-only recovery inventory, followed by
#313's owned terminal-observation and
settlement bridge. Both passed independent review, PR CI and post-merge CI.
The latter passes 738 workspace tests with 89.87% CI-scope line coverage. Persistence
failure retains the owner and unresolved liability; original stored charge and receipt
remain authoritative. These library increments do not activate durable HTTP settlement,
a recovery worker or pre-dispatch closure, and are not deployed in released Sandhi 0.10.1.

InferFlux #230 prepared v0.4.0;
#232 superseded #231 and promoted the
reviewed tree to main at 75e8d3c58d0c748dd6ac41a20179e040dcff518e after all PR CI
passed. Exact-main CI and all four trusted GPU jobs passed, including CUDA, ROCm and
same-process placement/concurrency/gateway accounting. Pre-release packaging and all
four platform installer/archive smoke jobs passed. The immutable v0.4.0 tag names
that revision. Tag CI and all tagged packaging/publication gates subsequently passed;
all 13 manifest-listed assets were downloaded and checksum-verified.
The 54 configured CPU CTest targets passed on isolated ports; an initial run conflicted
with the retained 18081 tunnel.

The new synthetic embedding measurements
record 14,309/14,309 successful timed direct BGE requests across four 15-second samples,
excluding two warmups. They check finite 384-dimensional outputs and integer prompt-token
reporting, not full usage conservation. Approximately 256-token passages
measured 154.55 requests/s at concurrency 4 and 162.64 at concurrency 16. These are
payload-specific samples, not long-duration capacity, competing generation, gateway
embedding or actual-member evidence. At the user's request, the live v0.3.0 shared
per-subject ceiling was changed to 6,480 requests/minute (108/s refill): 70% of the
lower passage measurement, rounded down to whole requests/s. The admin update was
acknowledged and read back exactly. Preserve this newer persisted policy during restart;
600/minute in the benchmark's restoration field is the earlier intermediate value.

The deployment preflight also found stale canonical PID/configuration metadata (G69).
Authorized maintenance uses fresh executable/start-time/listener/configuration evidence,
origin-local rollback copies and a verified-child-only stop. Preserve credentials, cache,
LAN binding and effective policy; startup can re-encrypt unchanged policy, so restoration
must compare private semantics and effective limits, not require identical ciphertext.
The old released runtime was restored with readiness and the 6,480/minute policy
verified before the release upgrade. Missing Mac origin forwards and the dataserver3
HTTPS reverse forward were also restored; the existing OIDC accounting principal again
received HTTP 200. These are current transport checks, not reconnect/reboot supervision.
The released-runtime checkpoint
then deployed InferFlux v0.4.0 on the consolidated port 8080 from the published
source above, using the separately accepted mixed-GPU binary SHA-256
cb367bcd77eddee272a629b7048d0682124235ebd28874eb1e4bbd7adf869a8e.
Readiness, exclusive listener ownership and effective policy were checked before
publishing its new canonical process identity. The shared 6,480/minute policy
remains authoritative; an explicit embeddings bucket now has 6,480/minute and
6,480 burst, with no additional generation bucket. These are request quotas and
burst allowances, not limits on concurrent GPU work.

New direct discovery, both Qwen chat checks and ordered finite 384-dimensional BGE
vectors passed with conserved reported usage. Two synthetic chat requests through
released Sandhi v0.10.1, using existing OIDC inference and separate accounting
identities, passed the unchanged 120-second deadline and strict 2/2 wire/SQLite/C4/
dashboard joins: 30 input, 2 output, explicitly reported zero cache tokens.
The origin process identity remained unchanged across those gateway checks. An initial
broker-unavailable attempt was preserved as failed evidence; a later authenticated
read and full retry passed. This does not establish broker reliability or origin OIDC.

Homebrew #75 carries the v0.4.0
formula. Local upgrade, executable help/test, all eight existing contract tests and
style checks passed; installed macOS executables match the published archive exactly.
Independent review is clean; its PR CI and merge remain tracked separately.
No shared cache or credentials were cleared/transferred. These are synthetic released
startup/accounting checks, not the preserved actual-member replay, executed cache-reuse
proof, mixed-load capacity, lifecycle acceptance or new formation results.
Formation counts and the C5 verdict remain unchanged.

The new OIDC cohorts use clean Victor source 208e2535f523b3c28a77823ff90673c329970a5f
(#1173), released Sandhi 0.9.0 and
separate inference/accounting identities. The
standard cohort passed all 15 cases
with 120 HTTP-200 calls and 120 clean wire/SQLite/C4 joins. The
single-file cohort separately passed all
15 with 121 calls/joins. Each has 33 distinct member sessions, 29 passing pytest
checks and 29 independent numeric oracles of 10,242 inputs each. Explicit cache
reporting is 120/120 and 121/121; dashboard totals and attribution reconcile.
Only the standard cohort's accounting identity renewed; inference-token renewal
was not exercised. These are new actual-member experiments, not historical replays.

The new Qwen3 attempt,
matrix-96be2e7e91, is incomplete and FAIL. Its first sequential case hit the
240-second case limit after a gateway HTTP 504 (126.015 seconds observed including
credential acquisition). The parallel case was cancelled while in flight. Four
observed gateway HTTP calls across three sessions were captured; zero clean accounting
joins passed, and cancellation-time accounting failed. The final wire file records
four HTTP 504s; its completion occurred after the accounting snapshot, which
contains only one ledger row. Preserve both timings and the failed verdict;
later ledger writes cannot retroactively make that snapshot pass.
The runtime reported ready while generation completion counters stayed zero and
its queue grew. This is an origin-liveness investigation (G52), not evidence that
Qwen cannot solve the simpler task. Qwen14 and the new C5 run remain unstarted.

The preceding security/runtime snapshot
records released Sandhi v0.9.0,
source d755c262386e6cd041a300532ea34411d012a2d8, independently verified GitHub,
PyPI, npm and crates artifacts. Both Homebrew binaries report 0.9.0 after a real
upgrade (tap #66); release
history is synchronized to develop (Sandhi #290).
Eight live authorization checks passed, including denied member admin/dashboard
access and denied accounting mutation/inference. TLS-verified browser sign-in,
actual-member run lookup, matching C4/SQLite totals and logout passed. The earlier
0.8.0 57-token check remains
preserved separately. Security/release checks alone add no formation passes.

The subsequent 0.9.1 release/deployment evidence
records the published binaries, real Homebrew upgrade and preserved OIDC state.
Exact-main CI, all package targets, tap PR/post-merge CI and the history-sync gate
passed. The first release verifier observed npm propagation 404; only its read-only
verification job was retried, successfully. The new gateway missed its initial
25-second startup bound before later independent readiness and eight OIDC checks
passed (G57). Neither original failure was overwritten.
A fresh 0.9.1 sequential case,
matrix-9099a9446a, passed with six HTTP-200 calls, six clean accounting joins,
two distinct sessions, two deliverables and two passing pytest/oracle checks.
Fresh/cache-read/output totals are 5067/13248/535; cache reporting is explicit 6/6.
TLS-verified browser sign-in, lookup of a new member's three calls and matching
C4/dashboard totals, then logout passed. This is one new release smoke case, not
a rerun of the 15-case cohorts; it adds no InferFlux or full C5 acceptance.
The subsequent human-account repair granted the existing mapped viewer group and
one verified-subject viewer binding; all other bindings remained unchanged.
The user confirmed that the dashboard opened. Agent/accounting permission checks
passed again after the restart; this confirmation is distinct from the automated
administrator browser test (G58).

The historical consolidated InferFlux deployment at source
02cf22addb9f78309bb5b2807427f215353a7085 served all
three pinned models on loopback 8080: Qwen3 on ROCm, Qwen14 and BGE on CUDA. CPU CI,
GPU CI and the separate same-process dual-GPU gate passed before deployment. Fresh
model-file hashes and placement are recorded in the runtime evidence. Those gates
used short setup workloads; they do not establish Victor acceptance. The origin
still uses existing private API keys. Direct-origin OIDC, embedding compatibility
through the new gateway, streaming/cancellation, tokenizer equivalence, session
leases and executed-cache acceptance remain separate open gates.

The renewed contract-v2 ZAI run,
matrix-aae4713703, used clean source d872b6103e319fa562d20a514d458af52314c027
(the candidate merged through PR #1163).
All 12 formations and three ensemble modes passed: 119 HTTP-200 calls, 33 distinct
member sessions, 62 required artifacts, 29 passing pytest checks and 29 independent
numeric oracles covering 10,242 inputs each. All 119 wire/SQLite/C4 joins and the
dashboard totals/attribution reconciled: 80,548 fresh input, 363,520 cache-read and
19,013 output tokens, with explicit cache reporting for 119/119 calls. Maximum HTTP
latency was 8.936 seconds; maximum ledger settlement was 0.001888 seconds. This is
new evidence, not a replacement verdict for either failed earlier run. It proves
these ZAI buffered cases, not C5 mixed-team, origin cancellation, executed cache
reuse, tokenizer equivalence or full resource lifecycle acceptance.

The new Qwen ROCm baseline,
matrix-94d9707bc9, used the same clean Victor source and numeric contract. It failed
all 15 cases, predominantly missing member-written test files, with additional
conversation/ensemble response-contract failures. All 130 wire/SQLite/C4 joins and
aggregate dashboard conservation passed across 29 observed sessions: 457,640 fresh
input, 12,867 output and 44 reported cache-read tokens. This new ROCm cohort does not
replace C5's preserved CUDA runtime. Next evaluate a simpler, explicitly labelled
single-file task profile while retaining pytest, independent numeric oracles,
formation decisions, distinct sessions and full accounting. Neither the failed
baseline nor a future simpler pass establishes a model-size explanation.

The opt-in single-file profile landed in PR #1165.
The new Qwen run,
matrix-98a78c934d, passed 12/15 cases with all 125 HTTP-200 calls and 33 sessions
reconciled (449,330 fresh input, 11,373 output, 12 reported cache-read tokens).
Debate's judge never wrote its decision while reporting that pytest was unavailable;
multi-level hierarchy omitted the first member's file; the synthesizer's saved
answer differed from its final output. Those strict failures remain failures.
The ZAI reference attempt,
matrix-5920dd66b7, was interrupted after repeated rate limits: 26 HTTP 429s and
35 HTTP 200s, four completed failed cases and a cancelled in-flight case. Its
cancellation-time reconciliation also failed; some wire records finalized later
than that snapshot, so those HTTP-200 responses are not clean-join evidence. This
neither closes single-file ZAI acceptance nor invalidates the earlier standard
15/15 pass. Both used clean source 09f9894072c0c9dbe67cbb5e768e86a21a17f9fa.
Do not combine single-file and standard task counts. A model-size explanation is
still unproven; preserve tool-follow-through and output-contract failures separately
from transport, accounting and capacity observations.

The new actual-member ZAI experiment
passed sequential, parallel, hierarchical, pipeline, consensus, group chat, debate,
handoff, adaptive and dynamic router. Reflection lacked review.json; multi-level
hierarchy lacked second.py, test_second.py, third.py and test_third.py.
All three ensemble cases failed during file-descriptor exhaustion (G41), so they
do not measure model quality. The original overall verdict remains FAIL.
Separate read-only reconciliation matched all 83 calls across 25 sessions against
wire, SQLite, C4 and dashboard, with no further model calls or unrelated ledger
rows. It does not replace the failed verdict or establish lifecycle acceptance.

Before the renewed run, the union of historical and passing cases was 12/15 (80%), spanning different
models, tasks and gates: it is coverage evidence, not a matched comparison.
Historical WS-F strict acceptance remains Qwen ⅙ and LFM 0/6. No weighted overall
completion percentage is asserted, and case percentages do not estimate effort.
The remaining correctness work includes G32 completion, G34 buffered reporting
and G41 resource exhaustion. G39's native member task binding is implemented in
PR #1161; live acceptance remains
separate. G43 member-pytest cleanup landed in
PR #1160 after all CI gates passed;
the fix adds no live passes.
G36 structured verification landed in PR #1159
after all CI gates passed, including Vertical Py3.12. G42 independent numeric oracles landed in
PR #1157 with all CI green, including
Vertical Py3.12. The new contract-v2 experiment matrix-7cce287098 ran on clean
source f3792270d72db06c12093c2992ff1817c2e79859. All 12 formation cases passed
their local gates, including reflection and multi-level hierarchy; none of the
three ensemble modes passed. Across 80 HTTP-200 calls and 25 member sessions,
75 wire/SQLite joins passed and five failed, with an additional ledger call-count
failure. The overall verdict remains FAIL. File descriptors grew from 9 before
the first case to 253 after the ensemble failures; G41 remains open. These are
new actual-member results, not a replay or a retrospective change to v1 evidence.
Do not combine v1/v2 pass counts. The research evaluation
maps relevant papers to existing code, evidence and ordered follow-ups; it adds no
live passes. G41's scoped cache-owner correction landed in
PR #1155, with full CI including
Vertical Py3.12 green; complete matrix resource acceptance remains outstanding.
G40 reflection result retention landed in PR #1152
after all required CI, including Vertical Py3.12, passed. Both reflection members'
sessions and usage reconciled in the new run; its missing artifact still fails.
G31's cross-repository cache/lifecycle investigation remains open; G17/G21 durability
limitations remain explicitly deferred. A model-size diagnosis is not established
by these failures: ZAI also returned successful members with missing deliverables.
The 2026-09-21 read-only preflight restored the Mac loopback tunnel on 18081,
confirmed Qwen ready through the configured Sandhi route, and matched the preserved
gateway and origin binary hashes. The accepted origin is still partial CUDA,
not a new R9700/ROCm deployment. Readiness checks establish no new model-call or
formation acceptance. G45 separately tracks a test-collection MLX crash.

1.6 Surface and test pruning audit (2026-09-21)¶

Keep the 12 canonical formations and three aggregation policies. They already
share one registry, the conversation substrate, and execute_ensemble; aggregation
policies are not additional formations. Sequential continues after member failure,
whereas pipeline stops. Consensus iterates agreement; ensemble vote uses one
independent proposal wave. Debate judges a transcript; ensemble judge selects an
independent candidate. A synthesizer combines proposals instead of selecting one.
Router selects a member; adaptive switches registered strategies. Recursive
multi-level hierarchy differs from supervisor delegation. Removing these surfaces
would remove supported behavior rather than duplicate execution code.

Pruned three older adaptive tests whose metadata/switch-bound assertions are
covered more strongly by existing dispatch tests, and one unused nested writer
helper. All executed production line and branch sets were unchanged in the paired
coverage run (136 tests before, 133 after). Preserve compatibility, registry,
preset and dispatch tests because they exercise different boundaries. Identical
member/coordinator test helpers remain a possible mechanical consolidation; no
assertions were removed on that basis. No production formation was removed.

2. Industry pattern catalog (researched 2026-09-17)¶

Sources fetched for this section: LangChain "Choosing the right multi-agent
architecture", Anthropic "Building effective agents", AutoGen agent-chat team guides
(SelectorGroupChat, Swarm), OpenAI Agents SDK handoffs, CrewAI processes, Google ADK
multi-agent docs, and two 2026 surveys (MDPI Future Internet orchestration survey;
arXiv 2601.13671). URLs in §5.

Two orthogonal dimensions organize every pattern found: control topology (who
directs whom) and communication substrate (what carries information between
members). The original six used artifact/context handoff. WS-G subsequently added
a bounded shared transcript; the current substrate table below includes that work.

2.1 Control-topology patterns¶

Pattern (a.k.a.)	Mechanism	Victor status
Sequential chain (prompt chaining, CrewAI sequential, ADK `SequentialAgent`)	fixed order; each stage consumes prior output	✅ SEQUENTIAL / PIPELINE
Fan-out / fan-in (parallelization-sectioning, ADK `ParallelAgent`)	independent subtasks concurrently, aggregate after	✅ PARALLEL (aggregation gaps: G3)
Router (dispatch-and-synthesize; LangChain "router", Anthropic "routing")	classify input → invoke one/few specialists → synthesize	Integrated (`DynamicRouterFormation`, §1.3; PR #1107)
Supervisor / orchestrator-workers (LangChain subagents, CrewAI hierarchical with `manager_llm`)	central agent decomposes, delegates, synthesizes; workers stateless to each other	✅ HIERARCHICAL (single level)
Hierarchical multi-level (ADK transfer trees, org-chart topologies)	coordinator → leads → members, aggregate up	Integrated (`MultiLevelHierarchyFormation`, §1.3; PR #1107)
Group chat with speaker selection (AutoGen `SelectorGroupChat`, `RoundRobinGroupChat`)	members broadcast to a SHARED TRANSCRIPT; LLM/selector/round-robin picks next speaker; termination conditions	✅ GROUP_CHAT; bounded shared transcript, router/callback/round-robin selection (WS-G)
Swarm / peer handoff (OpenAI Agents SDK handoffs, AutoGen Swarm)	control MOVES agent-to-agent via handoff-as-tool-call; receiving agent continues with carried context	✅ HANDOFF; structured peer destination with carried transcript (WS-G)
Evaluator-optimizer (generator-critic loop)	generate → critique → refine until satisfied	✅ REFLECTION (verdict fragility: G2)
Adaptive / dynamic topology switching (MDPI "adaptivity" dimension; Magentic-One replanning)	monitor progress → switch topology or replan mid-run	Integrated (`AdaptiveFormation`, §1.3; PR #1107); Magentic-style ledger replanning not designed
Ensemble aggregation (self-consistency, "More Agents Is All You Need" voting, Mixture-of-Agents layered aggregation)	N proposals of the SAME task → vote / layered aggregation	✅ opt-in ensemble vote/judge/synthesizer; R9700 voting validated (WS-H)
Structured debate (Du et al. multiagent debate)	adversarial rounds with a judge; improves factuality	✅ DEBATE; bounded contributions followed by one judge (WS-G)
Blackboard shared memory (Hearsay-II lineage)	specialists watch/mutate a shared workspace opportunistically	❌ absent — Victor's `shared_state` dict is coordinator-curated, not opportunistic
Contract-net / auction task bidding (Smith 1980)	manager announces tasks; agents bid on capability/load	❌ absent
External/inter-system agents (A2A protocol, MCP ecosystems, FEP-0006)	members are remote/foreign agents behind a protocol	🚧 FEP-0006 Draft; Sandhi already gives the transport seam

2.2 Communication substrates (updated after WS-G)¶

Substrate	Who uses it	Victor today
Artifact/context handoff (task string in → result out)	LangChain subagents-as-tools, OpenAI `Agent.as_tool()`, ADK `AgentTool`	✅ members get the task + `shared_state`, return `MemberResult`
Shared transcript (broadcast conversation)	AutoGen group chats, OpenAI handoffs (full history carries), debate	✅ WS-G / FEP-0035; bounded immutable snapshots for GROUP_CHAT, HANDOFF and DEBATE, PR #1113
Shared state/scratchpad keyed per member	ADK session state (`output_key`), blackboard	⚠️ `TeamContext`/`shared_state` dict exists but is coordinator-curated, not member-writable by convention
Structured ledgers (task/progress)	Magentic-One TaskLedger/ProgressLedger	❌ (adjacent: session ledger FEP-0023, not team-facing)

Current conclusion: Victor supports both artifact handoff and bounded shared
transcripts through the existing formation coordinator. WS-G and WS-H implemented
the former conversation/ensemble gaps; their implementation does not establish
durable action recovery or measured advantage over a single agent. Prioritize the
common execution-boundary gaps and matched acceptance over adding more topologies.

2.3 Agent-role nomenclature (standardization proposal)¶

Role names are inconsistent across the ecosystem — and inside Victor. Sources for
this subsection: Anthropic's multi-agent research system (LeadResearcher / subagents /
CitationAgent), Magentic-One (Orchestrator + WebSurfer/FileSurfer/Coder/
ComputerTerminal), CrewAI (manager_llm/manager_agent), AutoGen (UserProxyAgent,
planning-agent example), OpenAI Agents SDK (triage/handoff examples), A2A (client
agent / remote agent, donated to the Linux Foundation), and the 2026 surveys
(worker/specialist/service/support role families).

Victor's terms today (from code):

Concept	Victor name(s)	Inconsistency
Control-plane agent	`TeamAgentCategory.SUPERVISOR`; `_active_supervisor()`	WS-I: `explicit_supervisor_id` emitted; deprecated manager input alias normalized with warning (PR #1109)
Team execution unit	`TeamMember` / "member"	"worker" (`max_workers`), "sub-agent" (docs), `_MemberContextAgent`
Spawned child agent	`SubAgent` / `SubAgentConfig`	consistent
Domain roles	`SubAgentRole` (researcher, planner, executor, reviewer, …)	consistent; but `formation_role` adds generator/critic strings for REFLECTION
Iterative evaluator	"critic" (REFLECTION formation_role)	"reviewer" (role) vs "critic" (formation role) vs "evaluator" (Anthropic's pattern name) used interchangeably in prose

Ecosystem synonym map (what external material calls each concept):

Victor canonical	Ecosystem synonyms	Source examples
supervisor (control plane)	orchestrator, manager, lead agent, coordinator, triage	Magentic-One "Orchestrator"; CrewAI `manager_agent`; Anthropic "LeadResearcher"/"lead agent"; Kore.ai/Medium "coordinator"; OpenAI "triage"
member (execution unit)	worker, specialist, subagent, surfers/coders (domain-named)	"supervisor-worker" literature; Magentic-One specialists; Anthropic "subagents"
subagent (spawned child)	subagent, sub-agent, child agent	LangChain/Anthropic
reviewer (single-pass review)	reviewer, inspector, checker	Victor's review preset
critic (iterative-loop evaluator)	critic, evaluator	REFLECTION; Anthropic evaluator-optimizer
judge (one-shot verdict over candidates)	judge, adjudicator, LLM-as-judge	debate/MoA literature — needed by WS-G/WS-H
synthesizer (composes final output)	synthesizer, aggregator, summarizer	Anthropic lead "synthesizes"; MoA "aggregation layer"
router (classifies → dispatches)	router, dispatcher, triage	LangChain router; OpenAI triage
approval gate (HITL stop)	user proxy, human-in-the-loop agent	AutoGen `UserProxyAgent` ↔ Victor `MemberApprovalPause`
client/remote member (external, FEP-0006)	client agent, remote agent (A2A)	A2A spec (Linux Foundation)

Mandate for the follow-up session:

One canonical term per concept, per the table above. Docs lead with the canonical
term and mention synonyms once; new APIs accept canonical names only.
Collapse the supervisor/manager dual keys (explicit_supervisor_id +
explicit_manager_id) to one key; keep the other as a deprecated alias.
Do NOT use "planner" for the control plane — it is a SubAgentRole domain role;
AutoGen's planning-agent example conflates the two and copying that usage would
break Victor's role/category split.
Reserve critic for iterative-loop evaluators (REFLECTION), judge for
one-shot verdicts over candidate outputs (WS-H ensembles, WS-G debate), and
reviewer for single-pass review — the WS-G/WS-H formation APIs must use these
names in their formation_role strings.
Use member when the formation-agnostic execution unit is meant; keep
max_workers as a compat API name but do not add new "worker" surfaces.
For FEP-0006 external members, adopt A2A's client/remote terminology verbatim.

2.4 Cross-cutting standards mandate (prompting, patterns, architecture)¶

The follow-up session's workstreams must follow these, drawn from the researched
sources and Victor's own codesign lessons:

Prompt engineering
- Member task prompts must state: objective, output format, tool/source guidance,
and explicit boundaries — Anthropic's research system found vague delegation
("research the semiconductor shortage") caused duplicated work across subagents.
- Prefer structured, machine-checkable output contracts over prose parsing: the
REFLECTION VERDICT: line is the right shape; generalize it (or move to
tool-call-shaped verdicts where the provider supports tools — G2), never add new
parse-the-prose contracts.
- Keep selector/speaker/aggregation prompts minimal for small local models — AutoGen
explicitly warns that condition-heavy selector prompts break on smaller models and
to move complexity into a programmatic selector function instead (maps to G13).
- Encode per-delegation scale guidance in supervisor/delegation prompts where
Anthropic does ("1 subagent with 3–10 tool calls for fact-finding; 10+ subagents
for complex research" is prompt text in their system): prompts control how much
work one member gets; member-COUNT adaptation is code-side and belongs to WS-C.
- Few-shot anchor one example per output contract for edge models (G13).

Software design patterns
- One registry, one dispatch: formations stay strategy classes behind the
_formations dict (no parallel dispatch chains — the #353 split-brain lesson).
- One derivation per identifier (session ids, formation roles, event names) — the
codesign consolidation rule; a second copy is a defect even when it matches today.
- Additive, opt-in contracts with byte-identical defaults (FEP-0028's "absent
checkpointer ⇒ byte-identical" is the model; apply to WS-G/WS-H surfaces).
- New event variants need a consumer-decision row before landing — the rule is
recorded in foundations-strategy-2026-07.md
(referred to elsewhere as the TD-0008 rule); applies to WS-C backpressure events
and WS-G speaker/handoff events.
- No silent fallbacks: every degrade path emits a warning-level event (G9 is the
counterexample being fixed, not the pattern).
- Dead code is either wired or archived with banner + canonical pointer — never left
green-and-unreachable (G10; the doc-cleanup hygiene registries apply).

Architectural principles
- Subagents are compression boundaries: members return condensed findings or file
references, not raw tool dumps (Anthropic's "game of telephone" and
pass-references-not-payloads findings); pairs with G12's supply budget.
- Capacity-aware defaults over static limits (WS-C): member counts and concurrency
derive from provider capacity and task class.
- Isolation at trust/capacity boundaries: session-id per member, worktree per member
where writes may collide (WS-D).
- Guard/classifier changes land through the FEP-0025 paired-gate process with a
recorded experiment — measure before tuning (G13).
- Definition-of-done for ANY new formation: strategy module + enum value +
_formations registration + preset + docs (features.md + formations doc) +
coordinator-dispatch tests + durability statement (supports_durable_pause()).
G10 exists because the orphan trio has only the strategy module and (non-dispatch)
unit tests — five of the seven are missing.

2.5 What this research changes in the plan¶

The orphan trio maps cleanly onto validated mainstream patterns (router,
multi-level hierarchy, adaptivity) — strengthening the INTEGRATE option in G10:
these are not exotic leftovers, they are the three topologies every major framework
ships, and all three are unit-tested in-repo.
Ensemble aggregation (G16) is new work but substrate-light: N-sample-one-task can
reuse PARALLEL execution + a vote/aggregate step; debate/group-chat need G14 first.
FEP-worthiness: a shared-transcript + peer-handoff substrate is a public-surface
change (new formation family, new communication contract) → draft an FEP rather
than landing it as a formation strategy (per the TD-0008 consumer-decision rule).

3. Gaps (learnings-motivated, for the follow-up session)¶

Ordered by risk-to-correctness first. G-numbers are the handoff's work items.
G1–G13 come from the co-design sessions and code audit; G14–G16 from the §2 research.

G1 — ✅ consensus semantics hardened (WS-B, PR #1108). Default rounds are 3;
agreement compares explicit consensus keys or exact output values rather than
successful execution. The consensus preset exposes rounds/threshold and optional
supervisor tie-break; unresolved disagreement fails the team. Live small-model
comparison validation remains part of the later sweep.
G2 — ✅ structured reflection contract added (WS-B, PR #1108). Opt-in JSON
verdicts have strict validation and immediate failure on malformed output. The
legacy default remains byte-compatible and warns on keyword fallback; use the JSON
contract for new local-model runs. Checkpoint resume preserves the verdict format.
G3 — ✅ partial failure surfaced (WS-B, PR #1108). Parallel synthesis includes
failed-member summaries; opt-in per-member retries retain attempt costs, stop at
approval pauses, and complete before durable member checkpointing.
G4 — ✅ opt-in PARALLEL worktrees (WS-D, PR #1111). parallel_worktree_isolation
materializes one worktree per member, forwards the assigned directory through
public spawn, and binds supported file/shell tools without process-wide chdir.
Missing worktrees or tool adapters fail explicitly. Worktrees are preserved for
review by default. The live test wrote identical relative filenames in all three
worktrees, with no parent-directory writes and three passing independent tests.
G5 — ✅ opt-in capacity-aware admission (WS-C, PR #1110). capacity_aware_parallelism
queries the provider declaration and bounds simultaneous members without dropping
assignments. Saturated members emit member_throttled through the sink and v1
stream bridge. R9700 live validation passed with three members at capacity two;
automatic ROCm discovery remains an explicit upstream limitation (G18).
G6 — ✅ nested and live session isolation verified (WS-D, PR #1111). Nested member
execution inherits the immediate parent's session and restores its caller.
Coordinator dispatch forwards configured member identities; observed live
x-inferflux-session-id headers match all three configured member IDs and the
per-member result metadata. Evidence is linked in the InferFlux formation recipe.
G7 — ✅ cross-vendor live validation (WS-E, PR #1115).
R9700 Qwen3-Coder-30B handled six members (24 calls); GLM-5.3 reviewed the local
writer's artifact (9 calls, 8,083 reasoning tokens). The local payloads omit
reasoning_effort. All traffic traversed Sandhi with seven distinct member sessions.
G8 — ✅ local/cloud durability validation (WS-E, PR #1115).
An injected MemberApprovalPause before the reviser preserved public pause fields;
resume restored the writer/reviewer and executed only the reviser. The live test
uses MemoryCheckpointer in-process; FEP-0028's iterative non-goals remain.
G9 — ✅ observable dynamic selection (WS-E, PR #1115). Exceptions and invalid formation
identifiers emit warning logs plus team_formation_warning through the member
sink, client stream, and v1 wire. The ZAI harness asserts PARALLEL selection and
warned default dispatch. Async selectors retain explicit TypeError rejection.
G10 — ✅ orphan trio: INTEGRATE (WS-A, PR #1107). All three have public enum,
registry, preset, docs, dispatch-test, and durability surfaces. Adaptive stale
names and duplicate dispatch were removed. Regression tests cover real member
execution/failure, concurrent adaptive calls, lossless task splitting, and invalid
trees. Original six defaults remain unchanged.
G11 — ✅ member accounting reconciliation (WS-E, PR #1115).
Opt-in capture_member_usage exposes neutral counters in metadata; retries and
recovery responses retain every attempt. Seven mixed-provider members reconciled
exact input/output/total counts with Sandhi, including ZAI cache/reasoning counts.
Fourteen Python files plus review.json and seven independent pytest tests passed
in 308.15s. Mixed-run evidence records IDs/routes.
G12 — ✅ formation-aware tool supply documented (WS-C, PR #1110). Member allowed_tools
narrows the registry before provider supply. The live capacity run supplied four
filesystem/shell tools per member; global pruning defaults remain unchanged.
G13 — ✅ edge-model battery executed (WS-F, PR #1118). The same
six-formation harness ran against Qwen3-Coder-30B/ROCm and the available
LFM2.5-8B-A1B/CPU small MoE through Sandhi. Strict artifact gates passed ⅙ and
0/6 respectively; failures and deadline limits are retained, not reported as
support. Matrix and evidence record the
differences and follow-ups G32/G33. No classifiers were tuned; dense 2B support
remains unvalidated.
G14 — ✅ shared-transcript substrate and conversation formations (WS-G, PR #1113).
FEP-0035 (PR #1112) defines bounded immutable transcript snapshots, explicit speaker
selection/termination, and consumer decisions. GROUP_CHAT and DEBATE have enum,
registry, preset, docs, dispatch-test, and explicit non-durable contracts.
G15 — ✅ peer-to-peer control transfer (WS-G, PR #1113). HANDOFF consumes validated
peer destinations and carries the shared transcript; invalid/self destinations
fail explicitly, and cycles are bounded by max_turns. Typed PeerHandoff
records cross the member sink and v1 wire bridge.
G16 — ✅ ensemble aggregation (WS-H, PR #1114). One shared policy implements independent
proposals followed by strict-majority vote, one-shot judge, or a synthesizer pass.
Public create_ensemble_team and CONSENSUS mode="vote" presets use validated
JSON contracts. R9700 voting passed with three deliverables/test pairs and
distinct member wire sessions. Judge/synthesizer modes have dispatch tests.

WS-I status: ✅ canonical FormationRole identifiers and supervisor-key normalization
implemented (PR #1109). Review and reflection presets bind reviewer/critic roles
without mutating caller specs. Compatibility manager methods and max_workers remain.

G17 — integrated trio has no durable partial resume. WS-A makes this explicit:
adaptive requires a topology/attempt cursor; hierarchy requires a recursive cursor;
router requires persisted selection. supports_durable_pause() is false, and
member approvals stay inline. A separate durability design/test increment is
required before claiming member-granular resume for these formations.
G18 — historical ROCm sequence-capacity discovery gap; current contract drift is G51. Verified live during
WS-C: /v1/admin/models omits max_parallel_sequences; /metrics exposes only
CUDA capacity gauges (zero on this ROCm backend). The active serving YAML declares
2 sequences and the process environment sets INFERFLUX_LLAMA_CTX_SIZE=65536.
WS-C accepts that verified operator declaration on the provider, and fails clearly
if admission is requested without a declaration. Automatic ROCm discovery requires
an upstream InferFlux admin/metrics addition; no model-window heuristic is used.
G19 — ✅ public spawn identity/context forwarding (WS-D, PR #1111).
The coordinator forwards configured member/session and worktree identity to spawn.
Compact result attribution retains the resolved wire session ID without copying
full response payloads. The live worktree run matches actual headers to all three
configured member IDs and result metadata.
G20 — generated test completion can overstate validation. During the WS-C
Qwen3-Coder-30B run, members wrote module-level assertions and reported success
after pytest exited 5 (no collected tests). The external validation harness
correctly rejected the run. Delegation now anchors an explicit def test_*
contract; general completion-classifier changes require the WS-F paired-gate
experiment process rather than an unmeasured heuristic patch.
G21 — conversation and ensemble durable replay is not implemented. New
conversation modes reject checkpoint/resume before execution. Pending speaker
selection, transcript restoration, and in-flight peer transfers need a dedicated
durable-state design. This is explicit; no partial replay is claimed.
G22 — ✅ public pipeline pause metadata loss (WS-E, PR #1115). The spawn adapter dropped
awaiting_approval and approval_request, and TeamResult dropped aggregate pause
fields. Both boundaries now preserve the structured signal. Absent pause state,
TeamResult serialization remains unchanged.
G23 — ✅ usage writes mutated snapshots (WS-E, PR #1115). SessionStateAccessor returned
a copy while runtime writers and metrics expected a live accumulator. Internal
access now preserves one dictionary's identity, including assignment; the public
SessionStateManager snapshot remains defensive. Real-runtime regression tests
cover inclusive input, output, cache, reasoning, and accumulator assignment visibility.
G24 — ✅ explicit member overrides bypassed gateways (WS-E, PR #1115). Overrides now use
the existing canonical gateway resolver for configured provider blocks/environment,
pass the gateway to the managed factory, and use its virtual key. Invalid explicit
gateway setup fails closed. Legacy direct-provider warned inheritance remains.
G25 — Sandhi transparent ZAI requests omitted JSON Content-Type. Fixed and
live-tested in Sandhi PR #265;
23 raw-forwarding tests passed and all CI gates are green. Repository policy
requires an approving review before merge; the patched local binary is in use.
G26 — ✅ lazy grammar availability in codegraph CI (PR #1117).
tree-sitter-language-pack 1.20 downloads grammars lazily. CI now preloads every
required grammar with bounded retries, failing explicitly instead of silently
skipping language tests. Both Python matrix jobs pass all 106 codegraph tests.
G27 — ✅ recovery responses omitted from member usage (WS-E, PR #1115).
ResponseCompleter now returns structured provider responses; the existing runtime
accumulator counts each once, including empty retry responses and error recovery.
A rejected first mixed run exposed the discrepancy; real-completer regression
tests cover both recovery paths. The successful rerun reconciled every member.
G28 — task completion can outlive missing deliverables. In the first mixed
run, a local member repeated a successful write, exhausted its loop, and returned
a successful recovery summary without the requested test file. The independent
artifact gate rejected it. A clearer task passed the rerun; classifiers were not
changed. Follow-up must use the paired guard experiment process before tuning.
G29 — ✅ task-report API tokens use the shared session accumulator (PR #1121).
Buffered members and recovery calls updated the live accumulator while task
reports preferred the streaming-only cost tracker, producing zero API tokens.
Reports now derive prompt/completion/total deltas from the same counters used by
member usage. Regression coverage includes task boundaries, failed/empty tasks,
empty recovery attempts, and real streaming finalization with mixed reasoning
conventions; 115 related tests passed. Remaining tracker fields are G34.
G30 — ✅ shared usage survives reset and checkpoint restore (PR #1120).
SessionStateManager retains the live accumulator when replacing execution state,
so runtime writers and metrics readers remain attached after either reset mode
and checkpoint restore. Restored values are copied to avoid aliasing caller-owned
checkpoint data. A regression reproduces the original stale-reference failure
and verifies subsequent response accounting through all three transitions;
124 session, metrics, runtime, and size-guard tests passed.
G31 — cache observability needs a paired workload replay. The mixed Victor run
reported zero InferFlux cache tokens, but controlled direct/gateway probes showed
426 cached tokens for repeated chat and 514 with tools. Sandhi stored both correctly.
JSON/logprob paths bypass reuse in the serving InferFlux build; this is not proven
to explain the original member workload. Owner handoffs were written on aiserver1
at /home/vsingh/code/sandhi/docs/upstream/inferflux-cache-codesign-2026-09-18.md and
/home/vsingh/code/inferflux/docs/planning/SANDHI_CACHE_CODESIGN_HANDOFF_2026-09-18.md.
Follow-ups cover actual-reuse accounting, path diagnostics, and distinguishing
absent cache fields from explicit zero. No caching heuristic was changed in Victor.
G32 — edge/baseline completion guard gaps (WS-F, PR #1118). Successful member status
did not imply complete artifacts. Qwen omitted requested test files in four
formations and emitted invalid REFLECTION JSON; LFM emitted proposed commands
as final text and literal backslash-n in Python files. Four LFM cases also hit
240s deadlines with gateway 504s, which are not proven classifier defects.
Follow-up: retain both model traces, isolate tool/prose and artifact-validity
decisions under FEP-0025, and separately measure CPU admission/deadline behavior.
Keep strict structured verdicts and independent pytest as acceptance gates.
A subsequent mixed gateway replay on G29's
accounting fix reproduced missing test_writer.py and test_fallbackb.py.
Five collected tests passed, but the full run correctly failed the required
artifact gate. Its seven task reports matched member counters and gateway totals
across 29 calls with seven distinct member sessions. This accounting regression
run is not a paired prompt experiment and does not establish model improvement.
The 2026-09-19 C5 mixed attempt
again failed artifact completeness: fallbacka.py and test_fallbacka.py were
absent. Six delivered tests passed; seven distinct member sessions made 27
successful calls. Wire/SQLite/C4/dashboard conservation passed, but this does
not close G32 or the full mixed-team gate. See G37/G38 for additional limits.
G33 — ✅ deterministic spin-guard regression coverage (PR #1119). The
failing test mixed classifier/plugin initialization with its loop deadline and
could pass the iteration assertion after an unrelated early failure. Tests now
supply deterministic TaskAnalysis while retaining the real perception/offload
seam, loop counters, and timeout limits. A nonterminal workload must execute
exactly 1 or 4 iterations; perception must run once per iteration. The original
20s assertion and 30s timeout remain. Five focused tests passed in 2.66s, and
135 completion/intent/perception tests passed. Production classifiers are unchanged.
G34 — buffered task-report cache/cost/request fields lack tracker integration.
G29 fixes API token deltas, but task-report cache read/write, monetary cost, and
request count still use SessionCostTracker, which only streaming finalization
updates. Buffered member usage/cache evidence remains separately available.
Follow-up must record each buffered provider response (including recovery) once
through the metrics owner, preserve per-call reasoning conventions, and reconcile
mixed buffered/streaming task boundaries without adding duplicated token totals.
Zero tracker values for buffered tasks are not evidence of zero cost or requests.
2026-10-14 scoped implementation merged (#1353), clean review and 40 passing CI checks: UX-09 in
the canonical tracker adds dispatch/settlement
accounting for normal buffered/streamed calls, recovery, synthesis, planning,
context-limit summaries and KV warm-up. Aggregate stream finalization no longer
counts a request or folds tokens twice; unknown usage is explicit. Mixed-call,
cancellation, early-close, reset and malformed-telemetry tests pass, and a direct
Codex OAuth UI run reports five calls matching five observed dispatches. Optional
judges, LLM compaction, resilience helpers and legacy continuation remain outside
qualification; do not treat this scoped result as full C5 or raw-wire reconciliation.
G35 — ✅ verification retry exhaustion cannot accept COMPLETE (PR #1122).
The shared buffered/streaming verification gate previously skipped zero-budget
checks and the last repair attempt, and could leave failed verification marked
COMPLETE when the outer iteration limit fired. It now checks every completion
claim, records structured results, and changes unsuccessful evaluations to RETRY
or FAIL with zero reward score. Configured verification bypasses cached prose;
unsupported StateGraph and iteration-stream paths fail explicitly. Default runs
without a verifier retain their behavior. Validation: 81 focused gate/loop tests
plus 127 loop/integration/session-ledger/size-guard tests passed. This establishes
prerequisite correctness for G32 experiments, not evidence that either model now
passes the formation battery.
G36 — ✅ structured built-in verifier acceptance (PR #1159).
LocalTestVerifier parses test-count prose and can ignore a nonzero process exit
if parsed passed/total counts match. LintVerifier derives success from colon-bearing
output lines rather than the exit status. Follow-up must use explicit process
success plus runner-owned structured reports, cover empty/failed/timeout runs,
and retain diagnostics without promoting model-written prose into evidence.
Implementation: LocalTestVerifier now requires a fresh pytest JUnit report,
validates its tree and outcome totals, excludes skipped-only/empty runs, and
counts process success as an additional explicit check. Nonzero exit, missing,
malformed or contradictory reports cannot pass. Other test runners require a
custom Verifier until their structured adapters exist; failed detection does not
substitute pytest. LintVerifier uses one process-status check instead of inferred
punctuation counts. Buffered subprocess execution retains diagnostic tails,
separately bounds cleanup, avoids inherited pipes and preserves cancellation
with cleanup notes. Already-exited processes are never signalled. These changes
affect configured built-in verifiers only; default runs remain unchanged. This
does not repair G43's separate live-harness pytest path or establish test quality
or live completion. The new direct suite replaces no existing tests: the audit
found no prior LocalTestVerifier/LintVerifier suite or duplicate coverage owner.
G37 — ✅ failure evidence retention (PR #1143).
In the C5 mixed attempt, the
unchanged multiagent_gateway_live.py asserted the review verdict before its
canonical member-usage reconciliation, independent pytest, and final
evidence.json write. Its finally block retained only request metadata.
An external observer preserved 27 wire/SQLite/C4 joins and dashboard deltas,
and an independent pytest invocation checked delivered files; neither substitutes
for the unexecuted canonical member-usage check. Follow-up must retain structured
partial team/member results and all applicable checks before returning a failed
verdict, including exception/timeout paths, without relaxing any assertion.
Implementation: the harness now collects review, per-member usage, artifact
presence and bounded independent pytest results before saving a structured failed
verdict. Execution failures and cancellation retain returned partial pipeline results;
one rejected review or failed usage lookup cannot suppress other checks. Private
reports include the task-contract version and restore the caller's working
directory and gateway environment after execution. This fixes evidence retention,
not G32 member completion or C5 acceptance. Cancellation during final checks,
unavailable Git provenance, and unsupported/cyclic member metadata also produce
failed reports without preventing process-state cleanup. In-flight outcomes not
returned by the runtime are not recovered. HTTP errors/timeouts followed by
successful provider retries still require the external gateway observer; this
change does not certify those paths.
G38 — ✅ explicit numeric task contract v2 (PR #1143).
The same run's ZAI reviewer returned structured needs_work for writer(x) = x * 2:
overflowing floats and sequence inputs violate the requested addition invariant.
Both counterexamples were independently reproduced from the delivered function.
The harness nevertheless requires approved; the reviewer verdict and failed
run remain intact. Follow-up must define and review the task's numeric domain
and expected review outcome before any new experiment. Do not relabel this
verdict or repeat calls merely to obtain an approved verdict.
New experiment contract v2: writer, reviewer and all other members receive
the same explicit domain: Python ints/floats that are integer multiples of 0.25
in [-1024, 1024]; x, y and x+y must remain in that domain for the invariant.
Booleans, strings/sequences, non-finite values and overflow are out of scope.
These bounded binary fractions preserve exact arithmetic for the required
operations. A correct implementation should receive a structured approved
review; needs_work, malformed findings, missing files or failed pytest still
fail acceptance. This is new evidence when run, not a reinterpretation of v1.
G39 — ✅ structured native member task binding (PR #1161).
The coordinator's SubAgent adapter suppresses the static member goal whenever
the dispatched task differs from the team goal, treating that difference as
dynamic delegation. Conversation and other structured formation tasks also
differ, so a member can receive its response contract without its declared
artifact assignment. An offline GROUP_CHAT reproduction returned success while
the captured SubAgent task omitted the unique member assignment. This is an
offline task-binding finding, not evidence of model quality or a live pass.
The opt-in gateway matrix explicitly carries assignments keyed by the preset's
canonical member IDs inside its structured team objective. Existing coordinator
defaults remain unchanged.
Implementation: member_task_binding="structured-v1" opts the native
SubAgent adapter into one structured input envelope binding the configured member
ID, name, role and assignment beside the unchanged formation task. The formation
task owns active delegation and its response contract; it outranks the static
assignment. No task-text comparison decides whether to include identity or
assignment in this mode. Unknown modes fail before spawning; absent/null values
preserve previous task bytes. The option uses run-local context and the existing
canonical member IDs, and all matrix cases opt in. The conversation dispatch
regression failed before repair; the hierarchy regression now checks each actual
member's bound identity/assignment instead of merely searching all assignments
in the shared goal. No new formation, provider call or live pass is established.
G40 — ✅ reflection per-member results and accounting retained (PR #1152).
An offline public-preset/coordinator reproduction supplied generator and critic
responses with distinct sessions and usage, but the successful TeamResult
contained only the synthetic reflection_formation aggregate. The context-agent
adapter reduces each response to text; the strategy returns that aggregate
without either member's metadata. Strict matrix session/usage acceptance cannot
pass this shape, even when both members deliver valid artifacts. Preserve the
assertions; fix result retention in a separate compatible runtime increment
before spending calls on new live reflection acceptance. This finding does not
invalidate the differently scoped historical reflection experiment.
Implementation: with the existing capture_member_usage=True opt-in,
reflection executes canonical participants and retains each generator/critic
result, session, accumulated counters and attempt history. Partial and terminal
iteration checkpoints retain the same evidence without replaying completed
iterations. A failed member, malformed verdict, missing usage or changed session
fails explicitly. The default aggregate result and legacy checkpoint payload stay
unchanged. Coordinator final output remains the generated solution rather than
concatenating critique text. This corrects result retention; live acceptance
still requires the matrix's artifact, pytest and independent accounting gates.
G41 — multi-case runtime exhausts file descriptors. The new actual-member
ZAI matrix reached 12 formations and 83 successful calls, then encountered
OSError: [Errno 24] Too many open files during ensemble setup/execution.
All three ensemble cases failed; SQLite/provenance access and final accounting
also failed. The original failed evidence is preserved. A separate read-only
reconciliation verified the original ledger boundary and all 83 calls without
new inference, but does not close this lifecycle defect. Diagnose resource
ownership with bounded offline measurements, add a failing lifecycle regression,
and fix the measured owner without closing borrowed providers/shared services.
Do not attribute these ensemble failures to model quality or hide them by
increasing descriptor limits. Root cause is not yet established.
Scoped lifecycle correction — ✅ PR #1155: an offline, no-inference probe isolated one
reproducible contributor: five parent/member pairs retained ten tool-cache
SQLite connections after parent shutdown and garbage collection. Explicit
owned-cache cleanup returns to the nine-descriptor baseline after every pair,
with no retained cache connections. Parent shutdown and terminal buffered/
streaming spawn cleanup now close their own handles through LifecycleManager;
borrowed providers and shared services are not shut down for member cleanup.
Persisted cache entries survive closure. Close errors remain explicit and
retryable; cancellation and primary failures retain their identity and cleanup
diagnostics. This does not prove that cache handles explain the entire live
failure. G41 stays open pending renewed multi-case measurement and acceptance.
Further measured owner — ✅ PR #1163: background conversation persistence
opens thread-local project SQLite connections on executor threads that outlive
members. An offline five-pair execution retained 15 project connections after
shutdown and garbage collection. ChatService now releases only the calling
worker's connection after each persistence job through ConversationStore;
committed data and other threads' handles remain available. Real SQLite tests
cover successful/failed writes and independent caller handles; cleanup failures
are observable and cannot replace a propagating cancellation. This is a scoped
repair, not a full-matrix acceptance claim.
Provider-owned typed handles — ✅ PR #1164: an offline real-binding probe
against a local mock HTTP server retained idle Rust transport pools after native
provider close: five closed providers grew descriptors from 8 to 21. Releasing
only each closing provider's cached typed providers/runtime held the same probe
flat at 11 after initialization. The mixin now releases these owned references
in finally, preserving native close errors and cancellation identity. Repeated
close and another live provider's ownership are covered; no member cleanup closes
a borrowed parent provider. This separate repair was not present in the passing
ZAI run above. The run removes the ensemble exhaustion blocker for this cohort,
but does not establish every provider lifecycle boundary.
TDD covered success, failure, timeout, cancellation, early stream closure,
persistence, and cleanup-error paths. The duplicate bootstrapper presence-only
test was removed: the stronger lazy-proxy test preserves the same 51 executed
source lines and branch coverage. Cache-clear unit tests now use temporary
directories instead of the developer's persistent cache.
G42 — ✅ independent matrix numeric oracles (PR #1157). The opt-in matrix's
contract-v1 ordinary and ensemble doubling tasks request a member-authored test of f(4) == 8;
independent pytest reruns that same test. A new isolated offline counterexample,
def first(x): return 8, passes the requested pytest while returning 8 rather
than 10 for input 5. This probes the test predicate only, with zero inference;
it is not an actual-member replay or a full matrix acceptance result. Preserve
historical verdicts under their recorded gates. Define a bounded task domain
before the next experiment, freeze runner-owned independent oracles, and use
TDD to reject known wrong implementations, missing/modified reports, nonzero
process exits and timeouts. Member-authored tests remain required deliverables.
The research audit records the
counterexample and relevance of ExecCritic/SWE-Bench Pro Verified without claiming
their training algorithms or benchmarks are reproduced in Victor.
Implementation (contract v2): the opt-in matrix now checks every implementation
against a frozen runner-owned oracle over 2,049 integer inputs and 8,193 quarter-step
float inputs in [-1024, 1024]. It requires complete structured counts, a zero
process exit and unchanged oracle/artifact hashes, independently of member-authored
pytest. Missing, malformed, oversized or partial reports, wrong numeric behavior,
changed files and cleanup failures cannot pass. The subprocess receives no gateway
credentials or pytest plugins. Execution and cleanup have separate deadlines;
cancellation remains primary, and file output prevents detached descendants from
retaining pipes and extending the wait. Detached child containment is not claimed.
The initial constant-return false pass and both adversarial cleanup findings were
reproduced before repair. Existing scenario/acceptance suites were extended;
their ownership audit found no redundant tests to remove. All prior artifact,
session, accounting and deadline checks remain required. No new live acceptance
is established, and G36's built-in framework verifiers remain separate work.
G43 — ✅ bounded member-pytest cleanup (PR #1160). The matrix's
existing member-authored pytest subprocess still captures output through a pipe
and awaits an unbounded process.wait() after killing pytest on timeout. A separate
disposable offline reproduction of that block, with only its deadline reduced
from 60 seconds to one second, returned after 3.610 seconds when a detached child
inherited the outer pipe. Pytest exited -9; the child was self-limited and cleaned
up. A control using pytest's normal capture returned after 1.003 seconds. This
did not invoke the corrected numeric oracle and is not actual-member evidence.
Repair this separate ownership/deadline path with TDD before the next live matrix:
bound execution and cleanup, preserve cancellation and diagnostics, and avoid
borrowed/shared process termination. Do not merely increase the timeout.
Implementation: the actual check_case regression reproduced a 5.151-second
return for a one-second deadline before repair. The member-pytest path now uses
the built-in verifier's buffered process helper: file-backed output, the unchanged
60-second execution deadline and a separate one-second cleanup grace. Evidence
distinguishes the actual child exit from runner timeout/cleanup status, retains
diagnostic tails (4,000 bytes per stream) with explicit truncation flags, and
records cleanup faults. A zero child exit cannot override failed cleanup.
Cancellation propagates; it is not converted into a normal failed subprocess.
The verifier tuple contract and unconfigured agent defaults remain unchanged.
Test ownership remains split between helper lifecycle tests and actual harness
integration; the audit found no redundant cases to remove. This offline repair
establishes neither detached-child containment nor new live formation acceptance.
G44 — ✅ isolated matrix scenario test imports (PR #1161).
The changed-file CI selection imported the scenario test before the gateway test;
console pytest did not inject the repository root, so the scenario's sibling
scripts.validation import failed. Local python -m pytest had masked that
dependency. A standalone safe-path collection reproduced the exact missing-module
error. The scenario test now loads repository scripts explicitly, independently
of another test's import side effects. The same five CI-selected suites are
exercised with the implicit current-directory import removed. Production
behavior and live evidence are unchanged; no duplicate test case was added.
G45 — ✅ isolated MLX unit-test collection (PR #1162). During the
2026-09-21 collection check, a Python child aborted in MLX 0.30.6's Metal device
initialization with an empty-array exception. test_mlx_provider.py evaluated a
runtime-availability subprocess in a module-level skip marker, even when pytest
was only collecting tests. Collection completed, but the child generated a macOS
crash report. This matches the upstream empty-device report;
it is not InferFlux server or gateway execution evidence.
Implementation: remove the collection-time probe and use a fake MLX backend
in adapter unit tests, retaining their assertions and deterministic loader-error
coverage. A guarded import reproduction rejects both subprocess probing and
direct native imports without invoking Metal. Existing registry laziness tests
remain separate: registry loading and test-module collection are different
boundaries. No redundant tests were found. The four previously skipped hardware
integration cases remain explicitly skipped; this fixes test isolation, not the
installed MLX native runtime, and establishes no MLX or formation live acceptance.
G46 — ✅ bounded ledger observation (PR #1163).
New actual-member run matrix-7cce287098 on 2026-09-21 recorded 80 HTTP-200
responses and 25 distinct member sessions. Its original reconciliation passed
75 joins, rejected ordinals 0, 3, 16, 22 and 43 as nonunique_request_join,
and failed wire_ledger_call_count. Each rejected request recorded identical
before/after SQLite row bounds and no origin request ID. This does not establish
whether rows were absent, delayed, or excluded by the correlation window.
Preserve the failed evidence; investigate the existing ledger read-only and
compare explicit session/step identities before changing any join logic.
A supplementary reconciliation must not overwrite the original FAIL, and no
correlation or conservation assertion may be weakened. The private original is
/private/tmp/victor-zai-matrix-v2-20260921/matrix-7cce287098/evidence.json.
Read-only inspection found all five exact session/step rows immediately above
the recorded response-time row bounds. The observer now allows up to one second
for ledger settlement, retaining the original response bound and recording its
wait and matched/ambiguous/timeout status. The final join still requires exactly
one row within the observed bounds and the same session/run/step/model identity;
HTTP attempts, 120-second acceptance deadline, C4, cache and token conservation
checks remain enforced. Missing/duplicate rows fail explicitly. This change
makes no retrospective change to the original failed verdict. Renewed run
matrix-aae4713703 passed all 119 exact joins and aggregate conservation checks.
G47 — consensus final-round usage omits earlier rounds. New actual-member
Qwen ROCm run matrix-94d9707bc9 exhausted three consensus rounds. Aggregate
wire/SQLite/C4/dashboard accounting passed, but both member usage checks failed:
the first member reported 6,725 input / 262 output against session totals
44,830 / 1,200; the second reported 41,104 inclusive input / 902 output against
76,233 / 1,681. ConsensusFormation returns the final round's results while
the same canonical member sessions cover all rounds. Follow-up must retain
per-attempt evidence and aggregate canonical usage under the existing opt-in
capture contract, preserving legacy defaults and round-boundary durability.
Missing/inconsistent session or usage data must fail explicitly. The simpler
task profile changes neither this accounting defect nor its acceptance gate.
The scoped repair reuses the reflection attempt reducer for consensus capture:
sum all retained deltas and tool/duration totals, preserve failed attempts and
reject inconsistent sessions/counters. Capture snapshots on intake and restore
prevent mutable member metadata or returned aggregates from corrupting history.
Round-boundary and terminal resume retain totals without replay; changing capture
mode during resume is rejected. Legacy capture-disabled output is unchanged.
TDD reproduced five accounting cases plus two independent-review alias defects;
existing durability tests were parameterized instead of duplicated. This repair
adds no live multi-round consensus acceptance by itself.
G48 — repeated conversation speaker usage is last-turn-only (code audit).
✅ Code repair landed in #1169
after all CI gates passed; repeated-speaker live acceptance remains separate.
ConversationFormation.record sums tool/duration counts across repeated speakers
but replaces usage with the latest turn's metadata. Current two-speaker matrix
cases execute each speaker once and do not test this boundary. Reuse the shared
attempt reducer under the existing opt-in capture contract and add a repeated-
speaker coordinator test before claiming complete conversation accounting.
The scoped repair now snapshots captured results before consuming each turn and
uses the existing attempt reducer for speaking members, routers and judges.
Captured usage, tool calls and duration cover the whole member session; malformed
final turns retain their failed attempt, and inconsistent session/usage fails
explicitly. Capture-disabled behavior remains unchanged. Public coordinator
regressions cover all three conversation formations and repeated router calls,
including shared mutable provider metadata. Existing protocol/selection tests
retain ownership; no durable partial resume or new live acceptance is claimed.
G49 — SSO migration: ZAI actual-member acceptance passed; local/mixed acceptance open. Sandhi's
default OIDC, dashboard roles and scoped machine authorization landed in
Sandhi #281; consistent 0.8.0
source versions landed in #282.
These source changes do not establish published-binary or Victor acceptance.
New evidence from source candidate d6dc91bbd6f1c748f0ee41d220467a1e385d8522
used a 900-second Kanidm machine token for one successful ZAI request and
correctly denied admin access. Run oidc-machine-1790121988166631691 reconciled
23 input / 20 output / zero cache / 43 billable tokens across wire, SQLite and
the TLS-verified browser dashboard, with explicit cache coverage 1/1. This was
a machine integration check, not an actual Victor member or C5 run.

Published-binary verification now passed separately: release source
7b634c8653c434a4f11afd9dd6916fd8bdae3aff, binary SHA-256
ee678487322c96487d51d8ccd19ab4fe0c3a4c08094c6c1280f57c414e82a083, and new run
oidc-machine-1790137208264702760 are recorded in the
release evidence. That run
conserves 57 tokens; it does not replace the earlier 43-token source-candidate
evidence or add formation acceptance. A gateway request ID was absent from the
wire response: C4/SQLite request-ID and run/session/step joins were checked
separately, without inventing an equality to the upstream request ID.

InferFlux strict token claims landed in
#212, and buffered/streaming
TLS peer identity verification landed in
#213. The audit credential
exposure fix landed in #214.
Promotion #216 merged these
repairs into main at 4c71bdc998580bab75bdbd5bb71972ed9a914019. Deployment was initially
held: that CUDA runtime gate failed before its model-backed step
(run 35818698581).
That failure is preserved; #217
repaired the missing TLS-probe build dependency, promoted through
#218. CPU, CUDA/ROCm and
same-process dual-GPU gates passed on 02cf22addb9f78309bb5b2807427f215353a7085;
the exact accepted binary is deployed. Actual-member liveness still fails (G52).
Verified issuer discovery, Kanidm access-token interoperability, explicit
authorization policy and bounded authority requests
still need acceptance. Do not infer these from signed-token unit tests or the
Sandhi browser sign-in result.

Keep gateway routing independent from authentication: direct origin access is
an explicit, authenticated route and bypasses gateway metering/budgets; an auth
failure must never switch routes or weaken credentials. Browser sessions,
machine credentials and upstream provider credentials have separate roles and
audiences. OIDC remains the default SSO posture; token compatibility requires
explicit selection. Preserve existing credentials, historical evidence and cache.

✅ #1173 landed after all CI
gates passed, including Vertical Py3.12. Both live validation harnesses expose an additive
OAuth broker profile, with one bounded credential
adapter, fixed routes and separate accounting identity. Legacy invocations still
read virtual-key and admin-token files. The fixed Kanidm broker and separate
accounting service account are provisioned; both new ZAI cohorts passed all
15 cases with the released OIDC gateway (§1.5). Local/mixed and inference-token
renewal acceptance remain open. Sandhi 0.8.0
deliberately requires admin for the read-only C4 diagnostics POST (ADR-0011);
a viewer cannot satisfy unchanged C4 assertions. A separately reviewed scoped
diagnostics permission merged through
Sandhi #285; it is a post-0.8.0
increment published and deployed in 0.9.0; live accounting uses viewer plus that
permission and is denied inference, config and budget mutation. Do not silently
grant admin or omit diagnostics. Keep renewable OAuth access tokens inside the
observer adapter rather than member environments or cached provider handles;
use fixed route/grant bindings and separate inference/accounting identities.
Bootstrap credentials stay with their trusted broker. Retain
all existing request/session, usage, dashboard, deliverable and pytest assertions;
a 120-second buffered gateway timeout remains an acceptance failure. Released-binary
SSO and both ZAI references passed. Next resolve origin liveness, validate the
simpler Qwen ROCm/CUDA cohorts and inference-credential renewal, then run the
six-Qwen/one-ZAI C5 gate. Measure performance after security and usability;
no formation row turns green from the SSO integration check alone.

G50 — subagent retry can conceal an authentication denial (code audit).
✅ Code repair landed in #1170
after all CI gates passed, including Vertical Py3.12.
The outer SubAgent retry catches ProviderError, including the canonical
ProviderAuthError which the provider layer already excludes from retry.
A denied request can therefore re-enter the whole chat and repeat earlier tool
work. The scoped correction propagates that typed error immediately and keeps
the existing failed-member result. Existing retry tests retain transient cooldown
coverage; new 401/403 regressions require one chat invocation, no backoff, and a
failed member even when a later response would succeed. TDD reproduced both
failures. This does not establish OAuth renewal, upstream identity, or live C5
acceptance; those remain G49. The redundant enum-count test was removed because
the existing exact role-set assertion already iterates and checks all five roles.
G51 — current InferFlux capacity metadata does not match Victor's lookup.
The deployed admin model response publishes runtime.sequence_capacity and
runtime.context_tokens_per_sequence. Victor's provider still requests a flat
max_parallel_sequences under the configured base URL's /admin/models suffix;
a /v1 base also changes that path. Qwen14's static 32,768-token policy exceeds
the currently served 16,384 tokens per sequence. Validate one authoritative
runtime capability contract and its authenticated direct/gateway access before
claiming capacity-aware acceptance. Do not change global model metadata to match
one deployment or silently treat missing capacity as unlimited.
G52 — consolidated-origin readiness did not establish actual-member liveness.
The new OIDC Qwen3 cohort failed at the unchanged 120-second gateway bound and
240-second case limit (§1.5). Readiness remained green while observed generation
completion counters were zero and queued work accumulated. Runtime-wide counters
can include other clients; they are not per-member proof. The
read-only 11:03 UTC snapshot
still reports ready, a queue depth of eight and zero model completion counters
after this cohort stopped. Encoder-context log
messages are not evidence of Qwen-to-BGE misrouting without request correlation.
Investigate accepted-source dispatch, shared embedding/generation scheduling and
cancellation before more matrix/C5 load. Preserve shared cache, failed evidence,
runtime identity and the prior passing setup gate; do not replace this failure
with a longer-timeout result or attribute it to model quality.

The authorized 2026-09-24 recovery
restarted the same accepted binary/configuration on loopback 8080 after preserving
private rollback state. PID 59055 required forced termination after a 15-second
grace period; PID 602210 loaded the same three model placements and reported ready.
Supplemental direct chat checks returned 200 for Qwen3/AMD in 0.577s and Qwen14/CUDA
in 0.551s. These were short service checks, not member replay, gateway reconciliation
or formation acceptance; the prior cohort failure and G52 remain open. Persisted
cache files were preserved; restarting necessarily reset volatile runtime state.

InferFlux #220 addresses a
separate reproduced defect: cancellation during the only/final embedding slice
returned success. Its publication check retains measured completed-work tokens
and suppresses cancelled vectors/requeueing. All 54 CPU CTest targets pass; the
existing admission fixture now covers single/final slices without a duplicate
suite. This is not native GPU preemption or a demonstrated stall diagnosis.

G53 — partially implemented: ✅ buffered route policy and opt-in Rust stream body owner.
Sandhi #297 adds opt-in startup
buffered_deadlines configuration: exact model within the authorized credential
reference → endpoint → global default. Values are positive integer milliseconds,
validated against an operator-owned ceiling; duplicate keys, unknown fields and
unsupported streaming settings fail rather than being silently ignored.
Admin config preview/apply expose active and desired effective values with their
source, and explicitly require restart. Policy is resolved once after identity,
model and attribution authorization. The existing transparent and translated
transports share one absolute monotonic deadline without rebuilding connection
pools, resetting it at inner boundaries, or enabling inference POST retries.
Custom host-owned transports cannot silently ignore the configured limit.

Before dispatch, actual reservation expiry (rounded to persisted-second
precision) must fit the buffered deadline plus 60 seconds of settlement headroom.
Otherwise admission returns 503, releases the lease, and sends no upstream call
or usage event. This reserves an opportunity for settlement; it does not bound
waits on ledger/SQLite contention or guarantee settlement before lease expiry.
The operator contract
records the limits and activation procedure. Local validation: 704 passing
workspace tests, 89.42% line coverage, formatting and all-target Clippy clean;
independent exact-commit review found no blocking findings or duplicate test
owners. Existing unit and real-HTTP timeout owners remain distinct.

Sandhi #298 adds a Rust-only
StreamBodyLifetime owner shared by both streaming planes. It closes the source
independently of client reads, including unpolled/full-queue bodies, disconnects
and shutdown grace expiry. Setup remains separately bounded; the new absolute
body timer starts after upstream headers. A copied-fragment delivery queue is
bounded at 64 KiB, excluding a pending fragment and source/parser/transport
buffers. The common actual-lease check runs before dispatch and after setup.
Real upstream errors now fail the opt-in body explicitly, without a misleading
translated completion tail; default bytes and finalization ordering stay intact.

The source drops before exactly one blocking finalizer takes accounting.
Admission capacity and lifecycle operations stay held until settlement finishes,
so a blocked ledger cannot delay the transport error or falsely report idle.
Observed final usage remains final if delivery fails. Opt-in transport success
does not imply a durable settlement receipt, and a closed upstream connection
does not prove GPU cancellation. Local validation: 711 passing workspace tests,
89.59% line coverage, formatting/Clippy and independent exact-commit review clean.
Both unread-body and real-origin-error regressions were observed failing before
their fixes. Existing wire/SQLite/ledger fixtures were extended; the duplicate
audit found distinct test owners. See the
body lifetime contract.

Sandhi #300 adds the opt-in
library settlement foundation: a frozen observed charge either returns the
existing atomic receipt or retains the original pending attempt with a structured
failure. Unknown usage, no lease, volatile storage, contention and poisoned locks
cannot claim durable success. Independent review reproduced and repaired an inner
shard-poison unwind. Existing ledger/store test owners were extended; 715 tests,
89.64% line coverage and strict lint passed. HTTP finalization remains unchanged;
unresolved ownership is volatile, and retries require the original ledger/topology.

Sandhi #301 subsequently added
standalone configurable stream setup/idle/body policy, now released in 0.10.1.
Sandhi #308 adds an inactive
durable intent library on develop; it is not HTTP recovery or a release claim.
#310 adds immutable terminal usage
snapshots, and #311 binds their
frozen charge to the existing receipt writer in one transaction. Current legacy
caller-charge APIs reject tracked reservations; untracked defaults stay unchanged.
Final provider-reported usage can settle, including explicit zero. Unknown,
partial and estimated usage retains liability through expiry. Older writers can
bypass the new guard, so mixed-version ownership or rollback with tracked work
needs an explicit compatibility plan. These library increments are not HTTP
activation, an amendment contract, recovery workers or released-runtime acceptance.
#312 adds a bounded read-only inventory
with frozen admission range and current state per page; it shares settlement eligibility
and validates receipt/reservation/observation consistency. Pagination is not a recovery
worker, a claim on work, or proof of quiescence. At that #312 checkpoint, tracked
owner integration, explicit never-dispatched abandonment, honest finalization
outcomes and bounded blocking ownership remained prerequisites for HTTP activation.
Current source progress: Sandhi #337
merged strict buffered usage qualification. #338
merged after clean review and all 13 applicable green checks: opt-in buffered
HTTP ownership, atomically correlated
admission, terminal settlement and bounded recovery through the original ledger.
Local process tests distinguish successful settlement from unavailable usage and
incomplete shutdown. Sandhi #339
merged after clean review and all six applicable green checks, with two
actual-process SIGKILL/restart drills:
unknown post-origin liability remains held; durable terminal usage recovers one
receipt after synthetic insertion failure, stable across a second restart without
inference/event replay. Sandhi #340
merged with all 11 applicable checks green and adds terminal-publication
contention/death acceptance. Gateway metrics witness
qualified usage while SQLite blocks publication; after the original worker ends,
survival retries the retained observation into one receipt, while SIGKILL leaves
unknown liability after restart. Exactly one origin call occurs in either case.
All 46 affected tests and 12 metrics tests pass; missing-usage and disabled-retry
controls fail as expected. Metrics can increase before durable terminal/receipt
persistence and are not a spend oracle. These isolated HTTP/token-mode checks add
no live formation pass. These source increments are published in
Sandhi 0.12.0;
all required artifact targets verified. The canonical tracker
owns consumer adoption and installed evidence. Subsequent source/release update:
tracked TLS/OIDC and bounded streaming process acceptance landed in Sandhi
#350–#356 and shipped in 0.13.0
through #357/#358.
All artifact targets verify; Victor pins the official wheel with 1,712 affected
tests passing. Still open: preserved-state managed tracked deployment,
broader lifecycle and actual-member C5 acceptance. SQLite operations can outlive a wait; unknown liability stays held,
and no provider call is replayed. Defaults and shared runtimes are unchanged. New live
acceptance evidence remains a separate gate. At #300, the source increment did
not change the then-running 0.9.1 gateway (buffered120s/setup30s/idle90s), config,
runtime, shared cache or credentials. The newer release checkpoint is recorded
in §1.5. Client headers/timeouts cannot
raise the operator limit; earlier body/auth/admission work is outside the transport
deadline. A timeout does not establish origin cancellation, and any future
changed-deadline cohort must retain a separate identity from the failed baseline.

G54 — ✅ raw streaming error-body deadline repaired and deployed in 0.9.1.
The Sandhi 0.9.0 audit for G53 found that both raw streaming entry points stop
their setup timer at headers, then read non-success response bodies outside
setup and idle bounds. Source repair merged through
Sandhi #291 at 679ad4dcdd8ee7c24d53192bd01bb6f283271a9c
after clean independent review and all CI gates: collect the rejection
body inside the same setup budget and retain observed status/request ID in one
terminal timeout event. TDD reproduced both escapes. One existing timeout suite
now owns stalled body, cumulative header/body deadline, and upstream EOF while
the client remains alive; the existing rate-limit test owns normal rejection
mapping. No duplicate fixture suite or default-timeout increase was added.
Workspace tests and 89.41% line coverage passed. Reviewed promotion
Sandhi #293, exact-main CI and
all-target publication put this repair in 0.9.1; both Homebrew commands were
upgraded through tap #68.
The OIDC listener now serves the published proxy (source 4968fd045550539f0bddfb1892e9c4f3f226ce5f,
binary SHA-256 ff4d7bd68ce4ea33a593416899acb431b845e2d217255451f98bb42593885b63).
This source repair is distinct from G52's buffered-origin liveness failure and
does not add a formation/C5 pass or prove origin cancellation.
G55 — ✅ dashboard session-check cancellation repaired and deployed in 0.9.1.
Sandhi's 0.9.1 release verification exposed an intermittent browser fixture race
in develop CI.
The delayed-response test could intercept Clear's anonymous refresh instead of
the old authenticated request. Investigation also reproduced a distinct runtime
defect: an older cancelled /auth/session check unconditionally cleared a newer
token submission. The repair scopes failures to their initiating authentication
revision while keeping current-revision authority failures fail closed. It merged
in Sandhi #294,
474d410ce88e61dd2ed3da7add4b1823a5cf4554, after independent review and green CI.
The existing delayed-response test now uses an authenticated-request barrier and
one shared helper; only the missing stale/current-revision pair was added. TDD
reproduced the stale-revision failure; all 31 dashboard browser tests and 239 proxy
tests passed, with five repeats of the three affected race cases. The same
reviewed 0.9.1 release/deployment in G54 includes this repair; its source tests
do not alter formation or C5 evidence.
G56 — full InferFlux acceptance is not yet driven by a canonical serving profile.
InferFlux #219 lands the reviewed
configuration-driven acceptance handoff,
not implementation. The existing two-model setup gate uses 2048 total context and
eight GPU layers, unlike the full three-model serving configuration. Extend its
existing configuration/test owners with strict versioned profiles, effective
global/model configuration comparisons, separate socket/queue/execution/harness
deadline semantics, and per-contract evidence. Direct-origin cohorts must mark
gateway accounting unexercised and cannot substitute for Sandhi/C5 acceptance.
Resolve G52 before additional load; no runtime, cache or credential was changed
by the handoff.
G57 — the published gateway missed its initial bounded startup check.
The 0.9.1 deployment helper's 25-second readiness window expired while the new
process stayed alive, both on deployment and on the later human-role restart.
Preserve both failed results. Subsequent independent
check verified the exact PID, binary hash, exclusive listener, served package
version and readiness; eight OIDC permission checks then passed. This establishes
later serving readiness, not startup within the original bound. Startup phase
timing and a repeatable unattended startup acceptance gate remain open. The cause
is unproven; do not attribute it to OIDC or keyring access, silently extend the
bound, or rewrite the original failed evidence.
G58 — ✅ human dashboard onboarding required both IdP admission and a subject role.
Administrator browser acceptance did not grant the user's account access. The
IdP audit for the reported operation ID showed successful authentication but no
application scopes; Sandhi also had no binding for that subject. A reviewed repair
verified the account UUID before adding existing viewer-group membership, then
added only a private viewer binding and restarted the same published binary.
Existing bindings, credentials and usage were preserved. Eight agent/accounting
checks passed again; the user confirmed that the dashboard opened. The
operator guide
in Sandhi #296
documents both steps, role selection and denial diagnosis. An authenticated role
editor/API is still unimplemented: current role changes need deployment-config
access and restart. No group-to-role synchronization or self-elevation is implied.
G59 — embedding batch allocation is independent of declared model context.
The original accepted InferFlux baseline hardcoded 32 sequences × 512 tokens for the dedicated
embedding context, batch and microbatch. The stalled runtime log records a 13432 MiB
CUDA embedding compute reservation, while AMD's existing model/KV/compute buffers
occupy approximately 23 GiB. BGE's small weights therefore do not establish that its
execution footprint fits remaining AMD memory. Configurable model-owned geometry
landed in InferFlux #221 and is
released in 0.3.0; the §1.5 deployment supersedes that baseline. Explicit BGE
batch size 1 now passes the synthetic ordered embedding check on NVIDIA.
Keep the placement while measuring comparable embedding-context allocations and
mixed-load capacity; no memory improvement follows from comparing different
contexts. Preserve pooling, token accounting and ordered outputs; actual-member
and mixed-traffic acceptance remain open after short liveness checks.
G60 — configured governance failures can permit dispatch. The 2026-09-24
workflow safety audit
reproduces ALLOW after a configured policy raises. Required policy and middleware
errors must fail closed; normal DENY/ASK handling already has useful controls.
✅ #1180 blocks pre-dispatch policy/middleware failures, malformed
decisions, configured-context failures and broken governance wiring. Invalid
content regexes and failed configured approval handlers also stop execution.
Existing test owners provide red/green regressions with executor-not-called
assertions; optional absence and no-policy behavior remain.
The result-publication follow-up enforces TOOL_RESULT DENY/ASK and configured
failures before pipeline result events, completion callbacks and fresh/cached
returns. Explicit null redaction is distinct from no transformation. Withheld
results are non-retryable and preserve known execution success/failure or unknown
outcome/reconciliation status; successful writes still invalidate caches.
Action approval never authorizes a later result-disclosure ASK. The chain retains
cancellation cleanup, and batch duplicates retain the original retry veto.
Still open: executor-side tracing/storage and earlier middleware observers
can see raw data before this boundary; direct executor calls do not acquire a
policy gate. Cached returns still require a separate pre-action authorization
contract. This is result-publication enforcement, not universal redaction,
durable receipt reconciliation, full G60 or external-write/C5 acceptance.
G61 — exact approval binding remains partial. The bounded single-agent repair
(#1188)
rejects changed/legacy/ambiguous calls and uses the service-owned tool runtime,
current policy and final executor checks. One-use grants bind call/proposal/payload,
schema/access contract, request/session/expiry, policy scope and local RBAC identity.
Every participating policy scope is freshly resolved at final dispatch; changed
scope or resolver failure blocks execution. Atomic policy-version/budget checks
remain outside this repair.
Authenticated principal ownership, implementation/data versions, inline/member
approval and whole-member replay remain open; do not treat local RBAC defaults or
model names as authenticated identities. See the FEP-0029 amendment and
agentic-workflow-safety-audit.md. Full G61 and C5 are not closed.
G62 — potentially committed tool effects lack a complete recovery contract.
Generic timeout retry does not first establish effect/idempotency safety. A
consumed approval or completed node can precede persistence of its result.
Add durable action identity, intent, unknown outcomes and receipt reconciliation;
do not equate checkpoints with exactly-once external writes. This extends G17/G21
without another formation implementation; see the
audit.
The PDF recheck also found automatic replay in the service wrapper, pipeline
fallback, and post-success bookkeeping error path. The bounded repair shares one
effect-free metadata gate and preserves structured unknown/reconciliation-required
errors through middleware; it does not implement durable action reconciliation,
exact approval binding or whole-member replay protection. Keep G62 open until
those boundaries have independent failure/restart evidence.
Partial implementation (PR #1209, merged 2026-10-03): opt-in single-action resume now persists
intent and invocation observations in the existing paused-run row, exposes a
session-scoped versioned status snapshot, rejects prior intent on restart and
rechecks authority after persistence. Strict result publication is required before
continuation. Retained pending/unknown/returned evidence never authorizes replay;
returned is not a verified backend receipt. Existing owners cover commit-then-timeout,
cancellation, competing stores, migration and post-effect publication failures.
See FEP-0029.
Bound receipt capability (#1255):
readonly lookup through an opt-in typed backend capability and immutable receipt
retention now reconcile one action without re-execution. Exact identity/authority
guards protect lookup and status; absent or failed lookup remains unknown.
Production adapters (G78), recovered-result publication, complete member
continuation and mixed-team C5 remain open; this is not live acceptance.
The #1249 follow-up moves async-path
journal writes off the event loop and rolls back failed commits and save/action mutations. It is a
post-v0.12.0 main change, not new backend or live acceptance. See the
closeout for integration and CI status.
#1253/G77 moved built-in resume admission off-loop with contention/cancellation
evidence. VAS-11d now covers initial buffered/streamed and chained pause writes
in the existing persistence owner (✅ #1257,
merge 440b8f46d; detailed evidence in the tracker). Built-in SQLite saves run off-loop;
a pause is published only after save returns and originating runtime identity still
matches. Cancellation can leave one pending
row after a late commit, without automatic retry or dispatch. Custom stores keep
caller-thread semantics. This does not supply lost-ack pause discovery, bounded
worker admission, production receipts or full continuation.
G63 — workflow HTTP lifecycle is not durable admission or owned cancellation.
The inspected routes store in-memory records, launch a background task, expose
run status without owner filtering and mark cancellation without stopping that
task. Configured API authentication is separate from these guarantees. The
audit
scopes reliable admission, request deduplication, ownership and truthful status
to the durable/shared service profile, with tests in the existing route suite.
G64 — concurrent budgets and argument redaction need consistent ownership.
Check-before-await/consume-afterward is not an atomic reservation; unavailable
cost is not zero spend. Argument logs/errors also need a shared sensitive-field
projection. The audit
identifies existing owners and separates tool counts from hard spend guarantees.
G65 — retrieval needs explicit authorization/provenance/error contracts.
The inspected gateway carries session filters but not authenticated evidence scope,
version and retrieval time; backend errors may become empty results. This is not
a demonstrated tenant leak. The audit
requires adapter-specific access checks and explicit unavailable/denied results
before claiming protected retrieval. Keep current facts in authoritative APIs.
G66 — InferFlux release identity needs a side-effect-free CLI contract.
Homebrew verification of 0.3.0 found that neither inferfluxd --version nor
inferctl --version provides a supported version response. The daemon treated
the flag as a normal startup attempt; its verification child was stopped and
the serving process was preserved. Use published source/artifact hashes for
current acceptance. InferFlux should reject unknown flags and provide a bounded
version command before config/model initialization, with packaging tests for
both binaries. Do not infer a successful version probe from startup output.
G67 — endpoint admission needs sustained mixed-load capacity acceptance.
The original persisted shared 120 requests/minute overrode YAML's 600. After the
new passage benchmark, the
user authorized 6,480 requests/minute per authenticated subject, verified by
admin readback. This is a shared quota with a burst allowance, not a concurrency
limit or a guarantee of throughput under competing generation.
#229 implements opt-in startup
generation/embedding buckets with atomic shared/class admission, effective policy
provenance and structured retry information, promoted via
#232. Released v0.4.0 deployment,
effective shared/embedding policy readback and bounded direct/gateway liveness now
pass; see the release evidence.
Keep one port 8080 and origin protection when Sandhi is optional.
Preserve the resolved policy path across config relocation. Endpoint limits add no
inference-lifetime bound or GPU scheduling isolation. Direct sampled capacity is now
measured; sustained mixed load and gateway embeddings remain unaccepted.
G68 — Sandhi has no embedding ingress/accounting contract. Source inspection
at Sandhi 6425697 found chat/messages/responses/Gemini ingress, with no
/v1/embeddings route or provider embedding transport. The ledger-only #311
does not add one. Keep embedding validation direct to InferFlux until a separate
Sandhi increment defines typed request/result/usage contracts, model/scope
authorization, bounded payloads, vector order/dimensions, explicit cache-reporting
coverage and request/session correlation through SQLite/C4/dashboard. Reuse the
existing identity, admission and settlement authorities. Do not substitute a chat
request or an unmetered direct call for gateway embedding evidence. This is an
additional retrieval/embedding integration gap, not a new formation failure.
G69 — deployment records can become stale after out-of-band restart/configuration changes.
The 2026-09-25 preflight found the same released InferFlux binary serving under a new
PID with changed configuration and a host-binding environment override, while the
canonical record still named the old PID/configuration hash. A record alone is not
live process evidence. Before stop, rollback or acceptance, reconcile process start
identity, executable hash, listener ownership, configuration hash and effective
overrides with the active operator. Preserve concurrent changes and take a fresh
origin-local rollback snapshot; do not kill a stale PID or restore an old configuration
blindly. Promotion-triggered GPU work must wait for coordinated device ownership.
A later checked restore reconciled the canonical identity and verified policy semantics
after startup rewrites the policy. Missing SSH forwards were restored without changing
credentials or OIDC policy; persistent reconnect/reboot supervision remains open.
This is an operational identity/ownership gap, not a model-quality or formation failure.
G70 — partially implemented: interrupted tool batches retain owned outcomes (PR #1208).
The shared dispatcher now propagates original approval/cancellation controls, stops
queued/later calls, and joins started siblings before exposing partial results.
Sequential and parallel paths reuse one result/duplicate assembly; per-call copies
preserve distinct provider IDs even when cache objects are shared. Known completed
results use the canonical strict persistence path before the pause boundary.
The chat service owns publication and history mutation; the facade delegates.
Unknown outcomes, bookkeeping/publication failures and member pauses with retained
results carry a versioned resume barrier. Both single-agent and member checkpoint
loaders reject that barrier instead of inferring safety from transcript presence.
Existing owners cover cancellation (including repeated parent cancellation), multiple
controls, joined siblings, cache aliasing, synchronous persistence failure and member
checkpoint roundtrip. Two shadowed TestAddMessage classes were removed; the same
353 existing test IDs remained collected before adding the new persistence cases.
Open: G62 action/receipt reconciliation across crashes, conversation cache/DB
atomicity, noncooperative/origin cancellation, multiple-approval continuation, and
G61 whole-member replay across prior batches/turns. Only known completed siblings
can support exact single-action resume; absent results do not prove nonexecution.
G71 — ✅ metadata-only cache observations preserve measured streaming usage (PR #1206).
Upgrading Victor's Python binding from Sandhi 0.7.0 to the published 0.10.1
exposed a consumer defect: minor-9 cache observations use completeness=unavailable
without supplying a new numeric verdict. Victor previously invented zero token
usage for an unmeasured stream and could downgrade earlier measured completeness.
The stream consumer now retains prior measured counts and diagnostics, while
preserving cache-read observations separately. Explicit measured zero remains
distinct from absent usage. Existing event-conformance and real-binding loopback
suites own the regressions; all deployment locks share the released pin. This
repairs the Python consumer only; it neither redeploys the standalone gateway nor
closes G31's paired workload replay or mixed-team C5 acceptance.
G72 — hierarchical supervisor selection/delegation retains permissive legacy paths (2026-09-30 code audit).
HierarchicalFormation._resolve_supervisor accepts role-name heuristics and falls
back to the first agent; an unresolved explicit supervisor ID can reach that same
fallback. In execute, a failed supervisor result or absent/empty delegated_tasks
starts specialists with the original task, and a task/member count mismatch only
warns before dispatching the matched subset. These are logged compatibility paths,
not evidence of a validated supervisor plan. Add an opt-in typed delegation/selection
contract with explicit failure and partial-plan behavior, through the existing
coordinator/strategy dispatch; retain unchanged legacy defaults and test both modes.
A supervisor remains subject to runtime policy and human approval. Peer formations
need not acquire a supervisor merely to satisfy this gap. Complete member continuation
and action recovery remain G61/G62/G70; this finding has not been live-validated or fixed.
G73 — shared agent-service API and IDE/web lifecycle parity (2026-10-07 audit; open).
The original VS Code streamChat() body matched only the separate web/server
application; the audit reproduced HTTP 422 from victor serve.
VAS-03a landed the request repair and executable client/router regression in
PR #1252. Audit-time compiled-client probes also reproduced lost paused
run fields, premature-EOF success and false cancellation acknowledgement.
Event authentication and session/principal ownership differ between surfaces.
The audit records source and
non-live evidence; FEP-0039
proposes one service and shared schemas/SDK. The VAS tracker
owns implementation status and TDD/smoke sequencing. Reuse G61/G62/G70 approval,
action and member owners; no parallel lifecycle/dispatch registry. Local
extension activation/package passes do not close this gap or C5. VAS-04a repairs
premature stream EOF and cancellation acknowledgement through existing client/UI
owners in #1262, after clean review
and all applicable CI passed. It does not add durable
terminal run status or prove remote action cancellation. VAS-04b additionally
repairs existing nonstream approval metadata and content consumers in
#1265, after clean review and
all 39 applicable CI checks passed. It does not
provide a new approval UI, restart-safe continuation or a new server contract.
Review also found legacy
per-field defaults in recognized stream events (for example missing/malformed
tool_result.success becomes true); VAS-04/09 must qualify result schemas before
those events can establish verified business outcomes.
G74 — ✅ web backend startup/auth settings migration (PR #1252).
Importing web/server/main.py failed because it read removed flat server/render
settings; the merged repair uses the nested settings owner. Credentials now live as SecretStr under settings.server; signing
and authentication must unwrap the real value. VAS-03a adds executable startup,
HMAC/authentication and compiled-client HTTP tests; source/release acceptance
remain separate. Track final PR/merge evidence in the VAS ledger.
G75 — workflow authoring and headed browser acceptance (2026-10-08; open).
Existing workflow HTML is an execution visualizer, not a formation/workflow
authoring surface. AgentBrowser 1.15.2 advertises no drag action and its egress
policy restricts page WS/SSE. VAS-14a–d own canonical authoring, accessible
drag/drop, browser co-design and actual headed acceptance; graph layout changes
and polling must not be mislabeled as authoring or streaming proof.
The 2026-10-09 headed audit of production routes with a synthetic graph found
the pinned Cytoscape CDN request returned HTTP 404/HTML, leaving the graph blank
(cytoscape is not defined) and status at Loading. Refresh fetched execution
status but did not initialize the graph. Preserve screenshot/network evidence;
VAS-14e owns bundled assets, and VAS-14b/d own actionable loading/retry states.
This is a visualizer failure, not provider execution or formation evidence. The bounded
repair packages graph assets, fixes safe node inspection/retry, and aligns local
light/dark/system tokens with fetched AnvaiOps/Identity references (VAS-14e).
VAS-14f/g track editor-library and notebook evaluation; none closes authoring,
OIDC, drag/stream or live mixed-model acceptance. A subsequent deterministic
real-router probe reused the completed-execution test fixture: POST /workflows/execute returned 200 and an execution ID, but its /graph returned
404 because the stored record contains steps without graph metadata. VAS-14a/14d
must join execution creation to the canonical graph projection and verify real
execution-to-visualization before any product demo. The synthetic screenshot
fixture deliberately supplies its graph and therefore does not cover this gap.
G76 — end-to-end caller delegation to Sandhi (2026-10-08; open).
Victor's inbound user attribution and configured outbound workload credentials
are separate. Sandhi correctly rejects wrong-audience tokens and forged subject
headers, then selects an authorized grant/vault credential. VAS-05e/f own verified
delegation and immutable per-run credentials; current shared-workload usage is
not human-scoped gateway authorization. Preserve issuer-qualified identities.
G77 — ✅ async durable approval admission (PR #1253).
At baseline, VictorClient.resume() called paused-store expiry, lookup and
single-use claim synchronously. ProjectDbPausedRunStore can wait for SQLite's 60-second busy
timeout; #1249 moved action observation writes off-loop, not these earlier
admission operations. Repair through the existing store owner, preserve
cancellation/single-use behavior and prove contended database responsiveness.
VAS-11a moves this admission sequence off-loop for the built-in persistent
backend, preserving injected stores' caller-thread behavior. Contended SQLite,
cancellation, competing claims and lost-acknowledgement regressions passed;
clean exact-head review and all applicable CI gates preceded squash merge
ec41c97b4 into develop. It does not close receipt reconciliation/C5.
G78 — production effect backends lack action-key receipt adapters. VAS-11b
discovery found no production tool consuming durable_action_id. Jira/Slack
mutation responses, arbitrary database SQL with volatile connection IDs, shell
results and file editing history do not establish an atomic effect/receipt
contract. Optional typed capability, bound backend identity and local receipt
retention landed in #1255
(VAS-11b, merge 76384b0e4); production adapter qualification
remains VAS-11c. A SQLite test adapter is conformance evidence only. Preserve
unsupported/unknown outcomes and keep G62/member continuation/C5 open.
G79 — ✅ bounded storage/coroutine cancellation repair (#1258, #1260); whole-member recovery remains open.
The previous coordinator treated failed checkpoint reads as fresh execution and
swallowed member/pause save failures. Concurrent members could then advance and
approval events could precede durable save acknowledgement; default cleanup could
delete materialized deliverables after failure. VAS-12a repairs these paths in
the existing hook/dispatch owners: sanitized member_checkpoint_failed results
require reconciliation, queued admissions and retries stop, and acknowledged
pause saves precede approval markers/events. Already-started siblings are joined
after storage failure. Storage exceptions preserve materialized worktrees and
return their paths even when cleanup was requested. VAS-12b adds owned-coroutine
cancellation joins, retention of worktrees on cancellation and guards against
checkpoint adapters returning late acknowledgements after a pending stop. Repeated
stop requests do not interrupt sibling cleanup; cancellation is propagated and
retained paths are emitted as best-effort team.cancelled telemetry, not a durable
run record. Memory-store fault injection and real git worktrees are local evidence;
neither is production durability or C5 acceptance. Detached thread/provider work,
explicit clearing of cancellation, callbacks that never finish, process crashes,
in-flight receipts, checkpoint identity validation and safe whole-member continuation
remain open. VAS-12a/12b merged after clean review and all applicable CI; follow the
VAS ledger for production receipt qualification and
remaining recovery work. Never blindly retry an ambiguous save.
G80 — public legacy HTTP protocol adapter loses paused and terminal outcomes (✅ repaired in #1268).
At b19f0f673, integrations/protocol/interface.py::ChatResponse.from_dict
discards status/run/approval metadata and defaults finish_reason to stop.
HTTPProtocolAdapter.stream_chat suppresses JSON decoding errors and accepts EOF
without a terminal marker. Local synthetic adapter probes reproduced both
outcome losses; no live-member acceptance is claimed. This exported package has
no discovered non-example internal production callers, but external use is
unknown. Do not remove it without compatibility/deprecation evidence. VAS-15a
merged bounded TDD repairs through the existing protocol suites and a real core
HTTP smoke: preserve paused fields, reject malformed/incomplete streams, bound
frames, expand core tool-call lists and close without POST replay. Follow the
canonical tracker for exact review/CI/merge evidence.
VAS-15 still owns eventual consolidation. Preserve unknown/pending effects.
G81 — live authorization revocation for established EventBridge sockets (open).
The core /ws/events gate authenticates the upgrade, not each later event.
VAS-05g repairs the extension's missing credential and client-side rotation,
stale callbacks, bounded retries and disposal through the existing transport.
It does not enforce server-side revocation on a socket already authenticated.
VAS-05 owns the reviewed revocation/authorization contract and its failure tests;
do not infer tenant isolation or live revocation from an authenticated handshake.
Follow the canonical tracker for VAS-05g PR status.
G82 — legacy direct adapter outcome parity is unqualified (open).
DirectProtocolAdapter.chat still invokes a supplied orchestrator and constructs
a response with finish_reason="stop"; its stream conversion drops tool calls.
VAS-15a's HTTP repair does not change this separate execution path. No internal
non-example production consumer was found; external compatibility remains unknown.
VAS-15 owns consumer qualification and migration through canonical framework
services before a parity or deprecation claim. This source audit is not evidence
of a live-member failure and does not justify removing public imports.
G83 — Provider tracked-stream compatibility needs released acceptance (open).
New isolated Sandhi 0.13.0/deployed-OIDC evidence on October 11 passes both
Qwen tracked streams with exact request/observation/receipt joins. ZAI GLM-5.3
instead returns HTTP 200 then a failed body; the persisted outcome is
stream_qualification:InvalidUsage(NonFinalUsage);delivery:error. Usage remains
unavailable, with no frozen charge or receipt; it is not reported zero. The
strict qualifier rejects non-null usage on nonempty choices. The failed call did not retain raw SSE. A separate new bounded capture
confirms usage on a nonempty final choice (finish_reason="length"), followed
by [DONE]; 19 prompt/32 completion tokens include 30 reasoning tokens, with
explicit zero cache. This is wire evidence, not task completion or a replay.
Provider documentation and separate DeepSeek wire evidence support catalog-scoped
terminal-choice contracts. Sandhi #362
implements them through the existing qualifier, parser, observer and settlement
owners. Strict OpenAI/custom/InferFlux defaults remain unchanged; malformed or
post-final data retain unresolved evidence. Both provider regressions reproduced
NonFinalUsage before the repair. Local workspace validation passes 879 tests;
exact-commit adversarial review is clean. Release, deployment and tracked live
acceptance remain required; no automatic replay or manufactured settlement. Buffered qualification and both default-mode managed
0.13.0 deployments pass; they do not close tracked lifecycle or C5. See the
canonical tracker and retained local evidence
var/gateway-upgrade-013-20261011/stream-observations.json.
G84 — DeepSeek discovery and validation-harness coverage lag its live API (open).
The October 11 live /models response lists deepseek-flash and deepseek-v4-pro;
Sandhi 0.13.0's curated descriptors still list deepseek-chat/deepseek-reasoner.
Verify capabilities and limits from primary sources before refreshing descriptors;
do not invent aliases. The Mac gateway now has deepseek:victor-multiagent, with
OIDC grant deepseek limited to deepseek-flash under multiagent-validation.
Buffered and streamed released-default-path smokes pass: two calls, 70 fresh input,
30 output, explicit zero cache, matching SQLite/run/dashboard totals. Forbidden
model/member-admin/unauthenticated-admin requests return 403/403/401. The key stays
in local Keychain; the remote gateway has not received it. The standalone
in-process probe also passes. This does not qualify tracked settlement or C5.
Harness admission is ✅ merged in #1292
(21b43fcac), with clean review and all 39 applicable CI checks. It admits
DeepSeek through an explicit OIDC profile, shared provider allowlist and the
existing credential/accounting owners. Route/model denial and separate accounting checks remain;
no InferFlux-token fallback is allowed. Source admission is not live formation
acceptance. Curated metadata is the reviewed source candidate
Sandhi #363; merge/release and
Victor consumer-policy qualification remain open. Preserve the required
six-Qwen/one-ZAI C5 verdict separately.
Evidence: var/gateway-upgrade-013-20261011/deepseek-registration/.
G85 — DeepSeek legacy response repair and capability policy need consolidation (open).
Source audit at 21b43fcac: ZAI and DeepSeek already share the Sandhi transport
through SandhiOpenAICompatPolicy. DeepSeek's stream() nevertheless collects
every chunk before yielding; its DSML repair converts text to tool calls and
emits a replacement final chunk without the buffered chunks' metadata. Its
_is_reasoner() uses name substrings and disables tools for that branch, while
current models expose thinking and tool use together. A synthetic parent-stream
injection reproduced first publication after upstream exhaustion and a repaired
tool-call chunk without the supplied usage/reasoning metadata. It made no HTTP,
model or tool calls; this is not live acceptance or a performance benchmark.
Script/report: var/gateway-upgrade-013-20261011/provider-consolidation/.
Follow the consolidation sequence:
existing test owners first; explicit strict structured-output behavior and a
documented legacy mode; preserve/version defaults, metadata and cancellation.
Qualify reasoning-history round trips and first-chunk/memory behavior before
removing wrappers or claiming live acceptance. No second registry/transport or
permissive parser fallback. G83 release and original C5 remain independent gates.
Merged #1294 adds opt-in structured text
pass-through and Python stream-close regressions in existing test owners.
Default legacy repair is intentionally unchanged, including its metadata-loss
limitation. Live qualification, legacy migration and model/history policy remain open.
Continuation audit at c79b8b347: Message.metadata is internal and
build_openai_messages drops reasoning; released Sandhi 0.13.0 has no assistant
reasoning-history field in ChatMessageV1. The streaming runtime counts reasoning
characters without retaining continuation data. Implement the typed Sandhi contract
before Victor history/checkpoint integration; do not leak arbitrary metadata via
an extensions override. Multiple tool rounds, persistence/resume and provider-scope
tests must precede any live continuation claim.
G86 — Cerebras reasoning presentation uses prose classification (open).
The broader OpenAI-compatible source audit at 21b43fcac found
cerebras_provider.py classifies a leading paragraph using regular expressions
and model-name matching. A synthetic helper call with
First I need your order number.\n\nPlease enter it in the form. classifies the
first, ordinary user-facing sentence as reasoning. No provider/model calls were
made; this is not a measured live frequency or evidence about current Cerebras
wire behavior. Qualify structured reasoning fields and make any retained legacy
presentation mode explicit with a compatibility migration. Preserve visible text,
usage, metadata and cancellation; add the negative case to an existing provider
test owner after duplicate-coverage audit. Follow the
broader qualification plan.
The same opt-in text_response_mode="structured" increment bypasses prose
classification and preserves provider metadata. Default legacy presentation is
retained; origin cancellation and live qualification are not established.
G87 — Groq Python stream ownership misses early-close cleanup (✅ source fix merged).
Merged #1295 at 62c4f4395
after clean independent review and all 39 applicable CI gates passed.
Audit at c79b8b347 finds the remaining SandhiOpenAICompatPolicy wrapper with
unowned re-yielding in GroqProvider.stream. An injected parent stream stays
suspended after explicit outer close. The source fix uses aclosing and extends
test_provider_stream_aclosing.py, preserving Groq's prompt-budget policy and
chunk identity. Shared cases cover early close, cancellation, cleanup failure,
upstream failure and full consumption; the CI selector retains both shared and
provider-specific owners. No duplicate lifecycle suite is added. This qualifies
Python generator ownership only; released native iterator/origin cancellation
and actual-provider lifecycle acceptance remain open.
G88 — Buffered reasoning depends on the optional native response echo (source qualification).
Released Sandhi 0.13.0 lacks typed assistant output reasoning for Chat/Responses.
Victor disables raw response duplication by design, but clients still need explicit
provider-supplied reasoning or summaries. Sandhi
#364 adds optional output.reasoning
(contract minor 11), typed extraction and nonretryable malformed-output errors.
The Victor consumer prefers this field, preserves explicit empty text and legacy
behavior when absent, and rejects malformed canonical values without fallback or
replay. Existing transport tests own these cases. This display-output increment
does not enable model thinking, retain opaque continuation, or implement G85
history/checkpoint replay. Released dependency pin remains 0.13.0; upstream
merge/release and matched provider qualification are still required.
G89 — failed member verdict preservation (✅ source repair #1306; release/live acceptance separate).
The 2026-10-12 SQLite/source audit
confirms that, when the failed loop's final response is empty, a successful earlier
tool plus nonempty synthesis can overwrite its verdict; the member consumes that
metadata as success. Preserve useful
synthesis without overriding failure/partial status unless the configured verifier
establishes completion. Extend the existing turn-runtime and member-result owners;
test failed verification and successful evidence gathering with an unfinished task.
The SA-01 source repair now uses the existing typed synthesis helper and retains
the loop's failure/error/iteration metadata. Four regression cases replaced the
unsafe expectation; the member owner verifies a failed result and parent handoff
despite completion prose. Independent review and all applicable CI are green; merged as
8f503cf24272c81520847ddd41406f0ffb7a99c7. 105 direct, 377 broader
runtime/member and 58 verifier/stream tests pass (direct tests overlap the broader
cohort). This is verdict propagation, not live verifier/C5 acceptance. See the
implementation checkpoint.
G90 — post-effect execution evidence retention (✅ source repair #1307; release/live acceptance separate).
The same audit finds unconditional state restoration after ordinary exceptions
from _execute_via_agentic_loop,
without distinguishing pre-dispatch failure from failure after an action. Preserve
execution evidence and monotonic consumption after dispatch; qualify a committed
fake write followed by provider failure, with no second effect. This is not evidence
that durable receipts are deleted or tools automatically replayed. Complements
G62/G70. The SA-02 repair removes obsolete wrapper snapshot/restore, retaining
accepted history and consumed work; temporary configuration cleanup is unchanged.
Its existing regression owner now covers pre-dispatch failure, a committed write
followed by policy denial or cancellation, and an unknown receipt without replay.
Two post-dispatch cases fail before the repair; all 55 owner tests and the broader
498-test cohort pass afterward. Full collection finds 34,526 tests; independent
review and all applicable CI are green; merged as
6ebacd4f806bfa0446d951cc2cbbdc10a41dbe2b. The bounded fake driver qualifies wrapper behavior,
not live provider propagation or durable restart recovery. See the
implementation checkpoint.
G91 — shared runtime identity ownership (✅ merged #1309).
The two fallback builders are replaced by one typed owner/resolver, with current
immutable contexts for root resume and explicitly bound member contexts. Missing
checkpoint identity fails before persistence; cross-member recovery fails before
hydration. Member dash/colon session formats remain unchanged. The
canonical checkpoint owns
verified merge 3031cd4f66f92118f5ebfc1428ec11b3ffd23aec and the audit scope
records limits. Universal root-provider correlation, release and C5 remain separate.
G92 — root transport/session correlation (✅ merged #1311).
The fix/root-provider-identity repair binds the existing core session
ContextVar from the shared resolver at canonical ChatService entry, including
memory-disabled roots and planning calls. It restores the caller before each
outward stream yield and scopes stream cleanup even when another task closes it.
Deprecated facade restamping is removed. Regression and local real-binding
checks cover buffered/streaming paths, cancellation, member isolation and resume
between turns. Gateway-mode fixture requests carry session/run headers for
ZAI, DeepSeek and InferFlux; embedded InferFlux carries its session header.
The local fixtures do not establish deployed gateway, account or C5 acceptance.
The canonical checkpoint
owns qualification and merge status. G93/G94 remain separate limits.
G93 — planning fallback can re-enter the held turn lock (✅ merged #1314).
ChatService.chat(use_planning=True) calls its planning handler under the turn
lock; the previous PlanningRuntimeService._direct_chat() called public chat
and attempted to reacquire that lock. A bounded synthetic run confirms the
timeout without model calls. The merged implementation routes fallback through a typed
already-owned turn operation with one executor, report and reset; retained or
wrong-task callbacks fail closed. The public planning alias shares the same
boundary. The canonical tracker
owns qualification and merge evidence.
G94 — concurrent resume is not isolated from an active turn (✅ merged #1314).
Root transition validation previously allowed session hydration while a stream
was suspended, splitting provider and lifecycle identity. The implementation reuses
the existing session turn lock to reject resume, recovery and member rebinding
before mutation. Same-session reload is also rejected until turn teardown and
stream cleanup finish; between-turn resume remains supported. Existing test
owners cover buffered/planning/aggregated/outward-stream calls and close/cancel.
The canonical tracker owns
evidence. Reset protection is tracked separately under G95.
G95 — conversation reset bypasses turn ownership and has a sync/async mismatch (✅ fixed: #1316).
Independent G93/G94 review found that VictorClient.reset_conversation() awaited
the synchronous ChatService.reset_conversation(): with the real binding the
messages could be cleared before TypeError was raised. The synchronous reset also
ignored the held session turn lock. Former client tests used AsyncMock and
concealed the mismatch. The merged repair qualifies the real binding with TDD,
rejects reset before mutation during active execution/stream cleanup, and
preserves between-turn reset compatibility. It complements G94 protection for
resume/recovery/member rebinding; SA-04 refactoring is next.
The implementation repairs the synchronous client/service binding and shares the
existing turn-lock precondition across service/facade resets and workspace
changes that invoke reset. Independent review exposed the workspace partial
mutation path; a regression verifies rejection before root/context/RL/prompt
effects and successful idle switching. Existing tests cover active buffered,
planning, aggregated and outward streams plus close/cancellation cleanup.
The canonical tracker owns
qualification and merge evidence (e9db76a9d4e05752413dc33aa82b0d8ea40ee167);
source work does not close release/C5.
G96 — broad MyPy suppression weakens runtime type qualification (open).
SA-04 inspection found pyproject.toml applies ignore_errors = true to
victor.*. A successful repository-wide mypy --strict command therefore
does not prove every checked module is type-safe. Enabling errors for the tool
execution runtime exposed four previously suppressed errors. SA-04a #1318
explicitly checks that runtime and its required collaborator
contracts, plus positive/negative constructor fixtures. Other modules,
including the compatibility adapter, retain their historical exception;
retire exceptions in bounded, behavior-qualified increments. Adapter dynamic
forwarding is not proof of explicit protocol implementation: retain real
delegation tests alongside static checks. No blanket typing-completion claim.
The user subsequently authorized repository-wide remediation. The unsuppressed
core audit reports 7,794 errors across 1,082 files (baseline ac3c15e8 plus the
SA-04a candidate). Independent Python packages are also in scope. The canonical
G96 typing sequence
owns ordered remediation and acceptance; this gap stays open until the final
unsuppressed matrix passes.
Definition-layer increments #1319, #1327, #1328 and #1329 are merged; the tracker
records subsequent qualification. Registration-test review also found that
tests/unit/conftest.py::reset_feature_flags checks a manager _instance
although the singleton owner is module _global_manager. The registration
suite initially isolated both owners locally. The TYPE-06 follow-up repairs
shared setup/failure teardown with the canonical reset API and removes duplicate
registration/formatter flag resets. Qualification and merge status live in the
tracker; the fixture repair is merged in #1330. Coordination assembly is the
TYPE-03 slice merged in #1332, retaining canonical service protocols and lazy dispatch.
This does not close adapter dynamic forwarding, optional host capabilities or
the broader G96 typing program.
G97 — active task and tool evidence can be evicted during long execution (open).
Actual subscription self-audits through Sandhi lost their original task before
provider serialization: a metadata-only replay crossed from 98 messages with the
request to 100 messages with no user message. ChatPersistenceMixin pre-trimmed
history independently of MessageHistory, whose count trimming also retained
only the system prompt. The repair makes history the sole count-retention owner
and protects genuine task intent, atomic tool exchanges and newest publication.
Oversized current exchanges require an observable retention floor, not silent
loss of executed results. Independent review reproduced and repaired final-answer
eviction at the floor. The canonical tracker
records source, test, review and live acceptance status for
PR #1336.
The merged #1336 repair also shares genuine-user detection with recent-turn assembly and
tags task guidance/verifier feedback. Follow-ups remain: context-limit final-summary
slices can lose task/tool pairing; CLI terminal errors
can return exit zero; buffered tool rendering may lose call IDs and pair by name.
Audit each existing owner with TDD. The present fix does not establish durable
transcript recovery, overlapping unfinished tool batches, member continuation or C5.
G98 — agent-loop termination and continuation lack complete execution-mode parity (open).
Initial source audit found buffered-only loop guards/controller evaluation/adaptive checks,
multiple completion authorities and generic write-oriented budget nudges without
original task intent. A model continuation is not renewed authorization or proof
of progress. Qualify one typed transition/terminal contract and run-wide attempt
accounting before expanding autonomous self-improvement. Optional planners,
judges and online learning require measured benefit, not automatic inclusion.
The agentic-loop audit
inventories responsibilities and LOOP-01–06 gates. G97 owns the immediate
task-provenance, context-retention and CLI/result-publication failures. ✅ #1336
resets completion scores across runs and records post-backslide decisions even
without a verifier (41 CI checks passed; merge cd018968e). ✅ #1337
qualifies normal no-tool streaming RESPONSE governance and explicit terminal
status through framework/client events and audit finalizers, with no regeneration
after denial or complete redaction. The canonical tracker records exact runtime
review, local and CI evidence. ✅ #1338
carries failed terminal events and thinking aborts through CLI exit 1. One-shot failure, partial buffered/JSON output and interactive streaming
continuation are covered; non-streaming/planning and approval presentation remain
separate. ✅ #1339 shares
controller stop dispatch and repairs a newly confirmed false-success path:
buffered search convergence could overwrite an explicit evaluator/effect failure.
Convergence never executes synthesis or proves completion; preserve evaluator
evidence and require the existing verifier. ✅ #1340 bounds owned awaits and
terminal/cache success in both modes against one cooperative elapsed budget.
Context and timeout scopes never span streaming yields; expiry is failure, not
safe-to-retry evidence. Awaited cleanup can exceed the budget; remote effects
and thread work are not proven stopped. ✅ #1341 addresses source-classified recovery/tool stops, preserves recovered
text and prevents a permissive evaluator or verifier retry from dispatching another
ACT after a terminal stop. It also makes evaluator escalation terminal in both live
modes. Review also confirmed that chat_stream_helpers recovered final content
bypassed RESPONSE governance before persistence. The same increment moves normal
and recovered publication to one governance capability, outside retry handling,
and qualifies denial/redaction/history without another provider call. Other
forced-summary/tool-bearing emissions still need publication qualification. Source
audit also found buffered post-loop synthesis outside ACT; include it in whole-run
attempt/deadline ownership rather than claiming the ACT stop covers every provider call.
✅ #1342 captures initial task
intent once per run and dispatches the controller-selected nudge without a second
policy evaluation. Unknown/read/display guidance cannot request mutations; effect
feedback takes precedence and terminal decisions suppress prompts. Internal
provenance remains distinct from permission; tool authorization is unchanged.
✅ #1343 records a newly
reproduced gap: buffered ordinary/recovery text entered assistant history before
the response gate; swallowed terminal or malformed policy failures could synthesize
again. Candidate producers now share governance before history/publication/evaluation,
preserving usage and prior effects. Tool-bearing narration is gated before dispatch;
tool-only envelopes retain tool authorization. Canonical result field validation
rejects truthy non-booleans and non-text content; cancellation remains cancellation.
Configured message policy with StateGraph fails explicitly before work, including
direct graph executors. No StateGraph parity, raw-model primitive, reasoning or
tool-result filtering guarantee is claimed.
✅ #1344 gates live tool-bearing
narratives before publication/dispatch and exhausted-recovery fallback text.
Existing public-loop tests qualify denial, malformed/error results, redaction
and unchanged no-policy delivery. Shared cancellation checks also prevent recovered
and summary history writes after policy awaits; source tests qualify natural/recovered and
terminal-summary candidates. The prior direct _execute_prepared_team
reproducer exercised an orphan helper: reachability audit found no production
or test caller for the prepared-team trio, now removed instead of reviving a
second dispatcher. Still open: streaming topology/team integration with the
canonical loop; streaming adapter routing for forced completion (the adapter
never passes forced_task_completion=True). Forced-summary primitive tests
do not establish that routing. No member-effect rollback or live C5 is claimed.
✅ #1345 addresses a reproduced
wrapper bypass: post-loop synthesis could regenerate after guard, terminal ACT
or escalation stops, and discard an ACT response completed before evaluation
timed out. A shared private admission predicate blocks generation at that boundary,
preserves current response/usage/receipts and the precise terminal error, and retains
ordinary failed-verification presentation recovery. No prose stop parsing or second
timer/counter is introduced. Local qualification and landing remain tracked in the
canonical agent-service plan. The fix/loop-config-ownership follow-up wires the
existing executor choice through Settings/SessionConfig and freezes the resolved
choice before admission. Invalid choices and unsupported token-streaming graph
execution fail explicitly. It adds no deadline/attempt knob; qualification and
landing are tracked in the canonical plan.
Run-wide attempt accounting, adaptive extension and full experimental
StateGraph/iteration parity remain open; phase-method reuse is not execution-mode parity.
G99 — self-audit dependency/session/history integrity and web-chat usability (open).
The 2026-10-13 incident executed a required dependent after inventory failure,
repeatedly compacted a detached history snapshot and failed 21 session-linked
compaction audit inserts. UX-01 in the canonical agent-service tracker owns the
regression repair merged in #1347
and its remaining live qualification. Required edges must remain intact; session
persistence must precede identity/cache publication; compaction must update live
provider history while preserving genuine task intent and tool-call/result groups.
UX-02 records actual headed victor ui/Chainlit evidence and remaining profile,
stop/accessibility, approval and recovery checks. The exact browser audit also
exposes console-only plan progress; downstream stream cleanup and failed terminal
rendering remain separate open contracts. victor serve is an API surface,
not a web-chat mode. Bounded successful reads do not close the original transport
failure, full audit, workflow-editor or mixed-team C5 gates.
UX-08 additionally tracks missing explicitly named account rejection before
provider creation. Its scoped Settings/from-settings repair leaves credential
backend None fallback, the legacy ProviderResolver account/ad-hoc path and
explicit direct-versus-gateway selection open; keep these distinct from transport
and model failures when qualifying UI/profile behavior.

UX-10 adds cross-visit continuity evidence: persisted-picker counts, synchronous
history bridge, metadata-filtered replay and selected-session continuation binding.
Its real SQLite/adapter tests replace misleading mocks; disabled persistence and
custom stores must retain their semantics. The graph refresh also exposed the
semantic-index detached-rebuild/cancellation gap recorded under CG-P2 in
the codegraph design.
These scoped repairs do not close G99 or full editor/C5 acceptance.

G100 — prompt assembly and efficiency lack end-to-end cache qualification (open).
UX-09's 2026-10-14 measured checkpoint found repository instructions appended
after the per-session nonce outside UnifiedPromptPipeline, truncating the
reusable system prefix. A scoped source repair consolidates complete assembly
in the existing service/pipeline and extends the existing integration tests;
merged in #1355 with 39 successful CI checks. Duplicate evolved tool-effectiveness
guidance (573 local
proxy tokens), stochastic completion variants, incorrect read-only/negation
classification and shell-triggered database guidance remain. A direct Codex
continuation observed 12,416 cached of 12,638 input tokens, but small uncontrolled
trials do not prove a latency/cost improvement or released C5 acceptance. The
canonical tracker owns counts, experiments, decisions and next gates. Preserve
all authoritative instructions and distinct session identities; do not equate
better prefix layout with guaranteed backend reuse. Project-instruction deletion
invalidation and persistent explicit-override lifetime also need separate tests.
Follow-up measurements found that VICTOR_FROZEN_PROMPTS did not cover learned
turn sections, few-shots or experiment prompt hints. The scoped control repair
gates these before cache access, retains static/error guidance and rejects
contradictory candidate bindings; merged in #1356 with 40 successful CI checks. It does
not freeze learned routing/planning or change an already-created session.
Sixteen successful direct model calls confirmed correct bounded answers and
reconciled usage, but freezing slightly increased first-request input and cache
results varied: keep it opt-in. Startup profiling additionally found repeated
feedback loading and YAML parsing; unprofiled cold client initialization took
1.842 seconds. A separate synthetic transport-interception diagnostic measured
6.565 additional seconds before the first request and peak RSS growth from
271 to 934 MB; all dispatches were intercepted, not actual-member evidence.
Profile dependency/retrieval activation and preserve service scope before
consolidating initialization or claiming a memory/latency improvement.
Synthetic document probes found that a disabled block can suppress a later
enabled duplicate in PromptDeduplicationProcessor. The next scoped repair
preserves disabled configuration without letting it suppress visible content;
two red regressions and 106 passing affected checks qualify the source change.
Default case-folding and
insertion-order deduplication also need explicit policy before reuse across
authoritative prompt placements. Extend the existing document/builder tests;
do not optimize away active guidance or distinct case-sensitive identifiers.
Six no-provider subprocess probes found only a 0.355-second median first-request
reduction when omitting conversation-store setup, with overlapping ranges and
ML imports retained in both arms. Do not ship that diagnostic omission or claim
retrieval/lifecycle acceptance; preserve the existing path and measure other
embedding consumers next. UX-09 owns the full data and decision.
A subsequent traced diagnostic located a 4.747-second synchronous embedding load
inside the skill matcher's nominal background task, reached by cached-dimension
validation. Scheduling an async task alone does not prevent event-loop blocking.
Qualify bounded initialization/offloading with loop-lag, cancellation, readiness,
cache validation and actual skill/task outcomes; do not bypass validation or
disable skills to improve startup numbers. Learned-example omission also leaves
most startup cost intact and is not a production change.
The visible-guidance correction is merged in #1357. The next A/B/B/A diagnostic
rejected an isolated collection dimension-load offload: median preparation
6.451 → 6.523 seconds and maximum loop gap 7.810 → 7.845 seconds, with zero
provider requests. That experiment was removed; UX-09 records the full evidence.
Retain only the independent collection-state repair: async initialization stages
publication, serializes writers on the owning loop and rejects overlapping sync
initialization. Cancellation/embedding failure preserves the prior complete
collection and valid cache. This does not qualify startup performance, stop a
running model worker, or resolve C5. Next investigate shared readiness across
synchronous first-turn embedding consumers rather than moving one caller alone.
Collection-state protection merged in #1358. The next prerequisite keeps a
newly loaded model private until dimension validation and metadata preparation
succeed, and rejects late publication after shutdown. Existing lazy-loading
tests own failure/recovery and controlled concurrent-load regressions.
Remaining ownership gap: per-client lifecycle cleanup shuts down the global
embedding service and closes registry providers shared by other clients. Define
application ownership/final-borrower cleanup before asynchronous readiness.
A private awaited-readiness prototype reduced median maximum heartbeat gaps
7.485 → 1.680 seconds but did not reduce total startup-to-dispatch time
(8.023 → 8.110 seconds); zero provider requests, no production scheduling change.
UX-09 records evidence and remaining cancellation, failure and task-quality gates.
Cached-model qualification also exposed implicit Hugging Face cache lookup under
an isolated test home. Explicit cache paths plus offline flags restored all three
semantic checks; the affected suite passed 409 tests (two opt-in slow skips).
Qualify explicit model preparation/cache-only runtime policy separately; existing
fallback vectors and a default dimension must not be mistaken for readiness.
G101 — edit history, operation parity and shared ownership (open). Headed
Chainlit self-editing reproduced millisecond-ID collisions and missing per-operation
before-state within a sequential edit call. UX-09's #1360 candidate
addresses IDs, stable reload order, successful-save publication, same-file undo/redo,
preview finalization, aborted queues and truthful history warnings. This is scoped
local evidence until the PR/CI milestone is recorded. Remaining qualification:
cross-client/process ownership of overlapping canonical paths and shared mutable
editor/tracker instances; restart reconstruction/invalidation of redo; reconciliation
when filesystem replay succeeds but database persistence fails; partially conflicted
replay bookkeeping and file modes; rename destination sandbox enforcement and chained
operation state; replace_lines prevalidation versus actual queue dispatch; and
whether session-scoped clearing is required instead of the current global clear.
Audit the legacy ToolService.execute_tools_parallel surface before adoption: it
does not share the canonical pipeline's read-only eligibility policy. Within one
canonical ToolPipeline batch, write/shell/unknown calls already run sequentially;
same-file safety does not require a second dispatcher or a dedicated OS thread.
The live candidate also exposed stale pipeline read results after batched edits;
canonical operation paths now invalidate that cache, with a logged conservative
clear for successful writes whose paths cannot be resolved. Native-list UI
read/edit/read and reopened durable undo/redo passed. Search/root cache freshness,
unknown shell effects, external writes and structured mutation receipts remain
open; do not interpret this scoped repair as universal cache coherence.

Validation-test audit: neither live harness had direct tests before this follow-up.
The new mixed-harness suite covers rejected/malformed/missing reviews, inclusive
cache accounting, missing artifacts, bad member usage, pytest timeout, startup and
team failures, partial pause results, cancellation and process-state restoration.
Existing coordinator dispatch/approval tests remain the single coverage owner for
those runtime contracts. One redundant constant-string test was removed after the
integration test covered domain injection: before/after coverage retained the same
176 executed script lines and 30 executed branches. No prior runtime tests were
removed.

The opt-in formation_gateway_matrix.py (PR #1149) adds artifact scenarios for all twelve
canonical formations and the three ensemble modes, using the existing presets
and coordinator dispatch. Its accounting observer requires physical request,
SQLite, C4 request/session/run, dashboard, and member-usage agreement. Timeouts
remain failures even when a provider subsequently retries successfully. The
recipe separates
ZAI reference and matched InferFlux runs. Adding the runner does not mark any live
coverage row passed. Its offline tests own scenario configuration, evidence
retention, decision artifacts and accounting fault injection; existing strategy
tests continue to own formation semantics. Removing one duplicate invalid-name
case preserved exactly 78 executed scenario-module lines and 25 branches.

The reflection follow-up combines the redundant context-shim invocation-count
test with its mapping-output test. Before/after coverage preserved exactly 123
reflection-module lines / 36 branches and 733 coordinator lines / 187 branches.
New tests cover opted-in public dispatch, multiple rounds, partial/terminal resume,
failed attempts, malformed verdicts, invalid accounting, snapshot independence and
unchanged behavior for unrelated formations. The earlier failure and duplicate-test
coverage measurements remain separate from live model evidence.

WS-E implementation/evidence: PR #1115.

WS-E consumer decisions:

Contract	Producer	Consumer decision	Compatibility
`team_formation_warning`	StateGraph selector failure	Member sink → client CUSTOM event → v1 wire; UI lanes intentionally ignore, warning log remains visible	Additive; successful/no selector emits none
Member `metadata.usage`	SubAgent with `capture_member_usage`	TeamResult and validation harness; Sandhi run tree comparison	Opt-in; absent flag retains old payload
TeamResult pause fields	Durable coordinator aggregate	API callers inspect status, paused member, approval request, thread ID	Serialized only when status is present

Live setup (2026-09-18): LAN access returned. Sandhi at 127.0.0.1:18788 routes
InferFlux through an SSH tunnel on 18080 and ZAI through its coding endpoint. The
loopback gateway walkthrough covers both providers,
dashboard authentication, usage traces, and reproducible validation commands.

Live follow-up (2026-09-19): the Mac gateway now runs repaired Sandhi eb38ff4
through 18081 -> aiserver1:8081, serving accepted InferFlux c5d4eb89f with
partial CUDA offload. The old 18080 -> 8080 route and rollback state remain.
The unchanged Victor harness at e25fdf751 ran six Qwen members and one ZAI member:
27 HTTP-200 calls, no observed timeouts, 82,837 inclusive input tokens, 18,276
output tokens, and explicit cache reporting for 27/27 requests. ZAI reported
41,664 cache-read tokens; Qwen reported zero. These are reporting observations,
not proof of backend executed reuse. The 120-second buffered deadline remained.
The recorded verdict is FAIL for
missing artifacts and the review verdict; canonical Victor member-usage
reconciliation was not reached. C5 / InferFlux #184
remains open pending review and follow-up. This buffered run does not certify
R9700/full Qwen GPU execution, enabled-session leases, origin cancellation,
completed-cache diagnostics or full lifecycle behavior. The earlier five-call
stream pass and original failed evidence were preserved and not repeated.

G102 — persistence, search eligibility and index publication integrity (open).
Assessment at develop 43756b90f342d3c645155235e81bd4130e86b72c reproduced
four defects using disposable local stores: successive LanceDB 0.30.2 filters
replaced earlier conditions, a quoted document ID broadened deletion, failed
migrations advanced schema version, and cancelled graph writes committed with a
later unrelated operation. Earlier semantic CLI evidence also showed readiness
publication before a destructive detached rebuild completed. These are not
evidence of production exploitation or external-effect loss. Current metric
rows retain missing files and the LCOM4 label is a size heuristic. Before wider
unattended/hosted acceptance, repair and qualify these boundaries using the
canonical DATA-01–10 plan.
That tracker owns status, ordered PRs, existing test owners, alternatives and
rollback. G100 retains token/cache/reasoning reporting ownership; VAS-05 owns
hosted authorization; G61/G62/G70/C5 remain open under their existing gates.
DATA-01 predicate/deletion repair is ✅ merged in #1362
after review and green CI; engine qualification is LanceDB 0.30.2. DATA-02
cancellation/admission repair is ✅ merged in #1363.
Its investigation additionally found
lifecycle calls bypassing admission, a first-edge schema probe racing close,
and file deletion reacquiring its own batch lock. See the canonical tracker
for evidence, exclusions and next gates. DATA-03 scoped, atomic migration
admission and version publication is ✅ merged in
#1364, including migrate-before-index
initialization and v9 data-preservation/rejection guards. DATA-04a is ✅ merged
in #1365 after review and green CI: owned rebuild completion, readiness invalidation,
strict CLI validation and propagated storage/publication errors. Its review
additionally found ignored incremental error results, silently disabled requested
embeddings and automatic deletion of nested project state; regression tests now
cover these repairs. Parser completeness and atomic generation replacement remain
DATA-04b; cross-representation reconciliation remains DATA-05. DATA-08a is ✅ merged
in #1366 after review and green CI:
its disposable WAL backup reproducer retained zero rows from a
source containing one committed row, and graph bulk deletion lowered configured
durability. Investigation also found nested deletion implicitly committing its
outer transaction. Existing-owner regressions now cover online backup publication,
retained policy/session state, rollback/FTS and cancellation. Migration ownership,
the separate DatabaseManager.backup() API and operational recovery remain
unqualified; see the canonical tracker for validation and exact merge status. No production migration, release
or live acceptance is claimed. DATA-04b review found differing parser/discovery
inventories, root-override identity mismatch and unsafe directory pruning in the
unmerged preflight candidate. The shared explicit-inventory prerequisite is ✅
merged in #1367 and released as
CodeGraph 0.10.3 after review, green CI and published-wheel verification. A bounded
follow-up probe found eight completed parse results despite queue capacity one,
and eight pending tasks after consumer failure; streaming ownership/settlement
repair is ✅ merged in #1368
after exact-commit review and all 39 applicable CI checks passed. It bounds
producers and settles native work on failure/cancellation, with existing-owner
regression coverage. Review also
identified retained prior result payloads; a failing regression now covers their
release. This is not atomic publication or a hard parser cancellation deadline.
The consumer preflight candidate now uses exact selected inputs, one owned root
and all-descendant-only pruning before force cleanup. Its review also found
broken installed-parser imports being treated as optional absence; regression
cases now require propagation. Existing downstream metrics/maintenance can target
an override-root database different from the supplied graph store; this alignment
remains unqualified. The canonical tracker owns validation, atomic publication
and remaining gates; DATA-04b remains open.

4. Suggested follow-up session plan¶

Execution record (2026-09-18):

Workstream	Result	PR
WS-A	✅ INTEGRATE orphan trio with all formation surfaces	#1107
WS-B	✅ Consensus, reflection, and partial-failure semantics	#1108
WS-C	✅ Opt-in capacity admission and R9700 validation	#1110
WS-D	✅ Member worktree isolation and wire-session validation	#1111
WS-E	✅ Mixed InferFlux/ZAI review, pause/resume, selection, accounting	#1115
WS-F	✅ Paired battery executed; regressions retained as G32/G33	#1118
WS-G	✅ FEP-0035, transcript, group chat, debate, handoff	#1112, #1113
WS-H	✅ Ensemble vote/judge/synthesizer and R9700 voting	#1114
WS-I	✅ Canonical role terms and supervisor-key normalization	#1109

WS-F's checkmark means the requested experiment and follow-up filing were completed,
not that either model passed every artifact gate. See its measured matrix above.

Each workstream is independently landable as PRs to develop. WS-A–WS-F are unchanged
from the first cut of this handoff; WS-G/WS-H are new from §2's research; WS-I from
§2.3's nomenclature mandate (it gates WS-G/WS-H API naming — land it first or fold it
into the first WS-G/WS-H PR).

WS-A "Orphan trio decision" (G10) — cheapest first: decide integrate-vs-archive,
fix AdaptiveFormation stale docstrings either way, wire presets if integrating
(enum values + _formations registration + AgentTeam preset + docs update).
§2.5 strengthens INTEGRATE: router / multi-level-hierarchy / adaptive are exactly
the three topologies mainstream frameworks ship, and all three are unit-tested
in-repo.
WS-B "Formation semantics hardening" (G1, G2, G3) — consensus max_rounds
default → 3 with a preset exposing it; tie-break policy (deterministic:
supervisor/synthesis member breaks ties); REFLECTION structured verdict with
hard-fallback; PARALLEL partial-failure synthesis in final_output + optional
member retry. Table-driven unit tests per aggregation contract.
WS-C "Capacity-aware parallelism" (G5, G12) — derive default max_workers from
provider-declared parallel capacity (InferFlux admin/metrics surface); emit a
backpressure/throttle event on the MemberEventSink; document the formation-aware
tool-supply pattern.
WS-D "Isolation defaults" (G4, G6) — PARALLEL opt-in per-member worktree;
nested-spawn session-id propagation test; live e2e assertion of distinct
x-inferflux-session-id per concurrent member.
WS-E "Live validation sweep" (G7, G8, G9, G11) — one session, live R9700:
cross-vendor review preset (local workers + cloud reviewer), mid-PIPELINE
pause/resume, dynamic formation_strategy e2e (+ warning event), member cost
rollup reconciliation.
WS-F "Edge-model guard battery" (G13) — run the six-formation matrix on a small
local model; file classifier deltas as follow-up fixes if they regress.
WS-G "Transcript substrate + conversation-native formations" (G14, G15) —
FEP first: transcript-backed team context, speaker-selection contract (LLM /
programmatic / round-robin — mirror AutoGen's selector_func/candidate_func
split), termination conditions, peer-handoff message type. Then GROUP_CHAT,
DEBATE, and SWARM/HANDOFF formations on top. Largest item; do not start without
the FEP's consumer-decision rows (the consumer-decision rule, §2.4).
WS-H "Ensemble aggregation" (G16) — substrate-light, can precede WS-G: add an
ensemble aggregation mode to PARALLEL-shaped runs (N samples of one task →
majority vote / judge / MoA-style synthesizer pass), expose as a CONSENSUS preset
(mode="vote") and a create_ensemble_team preset. Validate on the R9700
(voting is the pattern most likely to help small local models).
WS-I "Nomenclature standardization" (§2.3 mandate) — collapse the
supervisor/manager dual shared-state keys (canonical + deprecated alias), sweep
docs and formation-role strings to the §2.3 canonical terms, and land the
critic/judge/reviewer distinction before WS-G/WS-H name their APIs.

5. Pointers and sources¶

Live-matrix recipe and per-formation examples: multiagent-formations-inferflux.md
Durability contract: FEP-0028, ADR-023, TD-25 (roadmap)
Formation strategies: victor/coordination/formations/; coordinator dispatch: victor/teams/unified_coordinator.py (_formations, _execute_formation)
Session-id derivation: SubAgentConfig.resolve_member_session_id (victor/agent/subagents/base.py)
Heterogeneous members: victor/framework/teams.py (TeamMemberSpec, presets)
External-harness members: FEP-0006

Sources (fetched 2026-09-17)¶

LangChain — Choosing the right multi-agent architecture (subagents / skills / handoffs / router; per-pattern communication model and tradeoff tables)
Anthropic — Building effective agents (prompt chaining, routing, parallelization sectioning/voting, orchestrator-workers, evaluator-optimizer)
AutoGen — SelectorGroupChat and Swarm (speaker selection, broadcast transcript, handoff-as-tool-call)
OpenAI Agents SDK — Handoffs (control transfer, input_filter, agent-as-tool contrast)
CrewAI — Processes (sequential, hierarchical with manager_llm/manager_agent)
Google ADK — Workflows & multi-agent patterns (Sequential/Parallel/Loop workflow agents, LLM transfer, AgentTool; the former multi-agents URL redirects here)
MDPI Future Internet — LLM-Based Multi-Agent Orchestration survey (centralized/decentralized/hierarchical + adaptivity dimension; abstract via search)
arXiv 2601.13671 — The Orchestration of Multi-Agent Systems (orchestration control plane; MCP/A2A substrate roles)
Anthropic — How we built our multi-agent research system (LeadResearcher/subagents/CitationAgent roles; delegation-prompt principles; pass-references-not-payloads; scale heuristics)
Microsoft Research — Magentic-One (Orchestrator + specialist roles; TaskLedger/ProgressLedger two-loop mechanics)
Google — Announcing A2A (client agent / remote agent terminology; donated to Linux Foundation)
arXiv 2508.12683 — A Taxonomy of Hierarchical Multi-Agent Systems (five-axis HMAS taxonomy: control hierarchy, information flow, role/task delegation)
Classical/paper lineage cited from prior knowledge (stable references): contract-net (Smith 1980), blackboard/Hearsay-II (Nii 1986), multiagent debate (Du et al. 2023), self-consistency (Wang et al. 2022), Mixture-of-Agents (Wang et al. 2024), Magentic-One task/progress ledgers (Microsoft 2024).