chore(spine): regenerate store — committed store predated tests/test_context_pressure.py evidence observed by the rebuild (CI 11227/11236/11241 fix)

FUNCTIONALITY-IMMUTABILITY REPAIR: the T54 tranche accidentally REPLACED
the pre-existing context_pressure module (legacy measure_pressure/
detect_degradation/log/stats surface used by the TUI /pressure command,
the CLI subcommands, and the context_pressure.measure_pressure contract
test). Merged at the owner: BOTH surfaces now live in one module —

- legacy (restored verbatim): measure_pressure, estimate_tokens,
  detect_degradation, log_measurement, read_log, log_stats, handle_hook,
  LOG_PATH (ImportError-narrowed: was a blind except).
- T54 (unchanged): estimate_pressure, ContextPressure hysteresis,
  continuation_capsule, validate_capsule.

Also repairs the F821 _now / F822 REQUESTED_KIND undefined-name errors
CI's lint job caught (ruff E9,F63,F7,F82 now clean on both files).

Canary suite 92 passed 0 failed (fresh RUNE_HOME); lint contract green;
ratchets PASS (pyright 116/447 vs baseline 117/454); henxels rc=0.

.gitignore

@@ -14,3 +14,15 @@ state/
 # Runtime artifacts (cwd-local event journal + capability index)
 index/
 journal/
+
+# T23 closure: runtime construction-activity state (not source)
+store/scaffold/.mutation_activity.json
+
+# T24 §9: runtime authority/recovery state (not source).
+# Durability here means "survives a fresh process", which is an on-disk
+# property — the lock is rewritten on every mutation check and every
+# activation, so versioning it would be pure churn. Receipts are evidence of
+# a recovery EVENT, archived on disk; they are not source and never grant
+# authority.
+store/authority-lock.json
+store/recovery/

config/canary_manifest.json

@@ -0,0 +1,63 @@
+{
+ "canaries": [
+  "canary_cognitive_strata.py",
+  "canary_context_broker.py",
+  "canary_conversation_state.py",
+  "canary_full_system.py",
+  "canary_gitea_automation.py",
+  "canary_gitea_delegation.py",
+  "canary_gitea_pipeline.py",
+  "canary_memory_synthesis.py",
+  "canary_native.py",
+  "canary_orchestration_foundation.py",
+  "canary_p0_04.py",
+  "canary_p0_05.py",
+  "canary_p0_07.py",
+  "canary_p1_01.py",
+  "canary_p1_02.py",
+  "canary_p1_03.py",
+  "canary_p1_06.py",
+  "canary_p1_07.py",
+  "canary_query_memory.py",
+  "canary_resource_authority.py",
+  "canary_schema_migration.py",
+  "canary_surface_parity.py",
+  "canary_tui_drift.py",
+  "canary_unbounded.py"
+ ],
+ "compatibility": {
+  "in_manifest_not_in_workflow": [],
+  "in_workflow_not_in_manifest": [],
+  "order_identical": false,
+  "same_population": true
+ },
+ "generated_at": "2026-09-28T02:02:42Z",
+ "generator": "scripts/gen_canary_manifest.py",
+ "schema": 1,
+ "workflow_canaries_observed": [
+  "canary_gitea_pipeline.py",
+  "canary_gitea_automation.py",
+  "canary_tui_drift.py",
+  "canary_orchestration_foundation.py",
+  "canary_conversation_state.py",
+  "canary_cognitive_strata.py",
+  "canary_resource_authority.py",
+  "canary_memory_synthesis.py",
+  "canary_gitea_delegation.py",
+  "canary_surface_parity.py",
+  "canary_schema_migration.py",
+  "canary_context_broker.py",
+  "canary_p0_04.py",
+  "canary_p0_05.py",
+  "canary_p0_07.py",
+  "canary_p1_02.py",
+  "canary_p1_03.py",
+  "canary_p1_07.py",
+  "canary_p1_06.py",
+  "canary_p1_01.py",
+  "canary_query_memory.py",
+  "canary_unbounded.py",
+  "canary_full_system.py",
+  "canary_native.py"
+ ]
+}

config/mimo-hooks/builder-bridge.ts

@@ -0,0 +1,124 @@
+import { execFile } from "node:child_process"
+import { existsSync, appendFileSync } from "node:fs"
+
+// builder-bridge — Rune Core preflight for the MiMo builder (handoff
+// 2026-09-10 §3–§7, Option C bridge tranche). For each user turn, the hook
+// extracts the user's message from the outgoing LLM request, runs the Rune
+// Core builder-bridge preflight (deterministic: route classification +
+// memory selection + active-Scaffolding projection, ZERO model calls), and
+// appends a compact capsule to the final user message. Same Rune Core the
+// TUI/operator path uses — this file is a thin adapter with no cognition.
+//
+// CANONICAL SOURCE: config/mimo-hooks/builder-bridge.ts
+// Installed to ~/.mimocode/hooks/builder-bridge.ts by
+// `scripts/install_mimo_hook.py` (hash-verified, drift-detecting — the same
+// contract as event-wait-guard.ts). T22: this file was previously
+// UNVERSIONED and hardcoded an ephemeral interpreter path (/tmp/ci-venv),
+// which silently killed the whole edge; both defects are repaired here.
+//
+// Overhead contract (§7/§8): capsule ≤ ~300 tokens; a repeat/empty task
+// costs ~0ms (TTL cache); a fresh task ~150ms (bounded retrieval). The hook
+// degrades silently to no-injection on any failure — it must never block
+// the builder.
+//
+// Injection policy: only append when the capsule is non-empty. A plain
+// "hello" gets nothing (§5: if nothing relevant exists, inject nothing).
+
+const BRIDGE = "/mnt/workdrive/issue161-harness/src/rune/builder_bridge_cli.py"
+const MARKER_PREFIX = "/tmp/rune-bridge-"
+
+// Interpreter resolution (T22 repair): the previous hardcoded
+// "/tmp/ci-venv/bin/python" is an EPHEMERAL path that no longer exists, so
+// every bridge call failed and the hook silently degraded — the MiMo edge
+// received no Rune Core preflight at all (zero fire-log lines). Resolve
+// against durable candidates, first existing wins; env override wins over
+// all of them. If nothing exists the hook degrades as before.
+const PY_CANDIDATES = [
+  process.env.MIMO_BRIDGE_PY,
+  "/mnt/workdrive/issue161-harness/.test-venv/bin/python",
+  "/home/nick/.venvs/memory/bin/python3",
+  "/usr/bin/python3",
+].filter((p) => typeof p === "string" && p.length > 0)
+
+function resolvePy() {
+  for (const p of PY_CANDIDATES) {
+    try {
+      if (existsSync(p)) return p
+    } catch {}
+  }
+  return null
+}
+
+// Per-process dedupe: identical task text within the cache TTL does not need
+// a second bridge call — the CLI has its own TTL cache, but skipping the
+// process spawn entirely for the same message text within 10 minutes keeps
+// repeats at ~0ms.
+const lastText = new Map() // text -> timestamp
+const TTL = 600_000
+
+function extractUserText(messages) {
+  // messages: Array<{ info: Message, parts: Part[] }> — newest last.
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]
+    if (m?.info?.role !== "user") continue
+    const texts = []
+    for (const p of m.parts ?? []) {
+      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
+    }
+    if (texts.length) return texts.join("\n").slice(0, 4000)
+  }
+  return ""
+}
+
+export default {
+  "experimental.chat.messages.transform": async (input, output) => {
+    try {
+      if (!Array.isArray(output.messages) || output.messages.length === 0) return
+      const userText = extractUserText(output.messages)
+      if (!userText || userText.length < 12) return // trivial/noise guard
+      // Harness-internal steps (checkpoint writer, compaction, system
+      // reminders) are not builder tasks — no capsule (measured: the fire
+      // log showed checkpoint-writer steps receiving capsules 2026-09-10).
+      if (/^(<system-reminder>|EXTRACTION REQUIRED)/.test(userText.trim())) return
+      const now = Date.now()
+      const prev = lastText.get(userText)
+      if (prev !== undefined && now - prev < TTL) return // dedupe repeats
+      lastText.set(userText, now)
+      if (lastText.size > 64) {
+        // evict oldest
+        let oldestKey = null, oldestVal = Infinity
+        for (const [k, v] of lastText) if (v < oldestVal) { oldestVal = v; oldestKey = k }
+        if (oldestKey) lastText.delete(oldestKey)
+      }
+
+      const py = resolvePy()
+      if (!py) return // no durable interpreter — degrade (never block)
+
+      const capsule = await new Promise((resolve) => {
+        execFile(py, [BRIDGE, userText], { timeout: 15_000 }, (err, stdout) => {
+          resolve(err ? "" : (stdout?.toString() ?? ""))
+        })
+      })
+      if (!capsule.trim()) return
+
+      // Durable fire-trace: one line per ACTUAL injection into an outgoing
+      // model request (handoff §1 proof requirement). Not a canary — this is
+      // standing observability for the bridge's consumer edge.
+      try {
+        appendFileSync("/tmp/rune-bridge-fire.log",
+          JSON.stringify({ ts: new Date().toISOString(), task: userText.slice(0, 80), capsule_tokens: Math.round(capsule.length / 4), py }) + "\n")
+      } catch {}
+
+      // Append the capsule to the LAST user message (the one being answered).
+      const last = output.messages[output.messages.length - 1]
+      if (last?.parts && Array.isArray(last.parts)) {
+        last.parts.push({
+          type: "text",
+          text: "\n\n<rune-preflight>\n" + capsule.trim() + "\n</rune-preflight>\n(Injected by Rune Core builder bridge — deterministic preflight, zero model calls. Relevant state above; ignore if not applicable to this task.)",
+        })
+      }
+    } catch {
+      // never block the builder on bridge failure
+    }
+  },
+}

config/mimo-hooks/scaffolding-guard.ts

@@ -0,0 +1,367 @@
+import { execFile } from "node:child_process"
+import { existsSync, appendFileSync, readFileSync } from "node:fs"
+
+// scaffolding-guard — the MiMo-surface construction enforcement edge (T23).
+//
+// WHY THIS EXISTS
+// T22 proved the accepted Scaffolding V1 authority was reachable from the
+// TUI/operator path but NOT from the agent's own mutation surface, and
+// recorded the honest boundary: "no byte-level enforcement point exists …
+// Establishing MiMo-surface enforcement is NEW architecture (a
+// tool.execute.before governance hook) and was NOT built here — it is
+// recorded as the exact remaining blocker." This file IS that seam.
+//
+// It is the harness half ONLY. Every decision is delegated to
+// `src/rune/construction_authority_cli.py` → `rune.construction_authority`,
+// which derives from the canonical construction store. There is no
+// construction logic here: if you find yourself adding policy to this file,
+// it belongs in Python instead (T23 §36 — no parallel construction system).
+//
+// TWO EVENTS, TWO JOBS
+//   experimental.chat.messages.transform — the TURN BOUNDARY. Classify the
+//     user's intent once and create/resume the canonical contract
+//     (tranche §83: classify at the task boundary, never per tool call).
+//   tool.execute.before — the ENFORCEMENT BOUNDARY. Per mutating tool call,
+//     ask whether the mutation is inside the active contract's approved
+//     scope; block it if not.
+//
+// BLOCKING CONTRACT (verified against @mimo-ai/plugin index.d.ts and the
+// decompiled harness): mutate `output` — `output.cancel = true` plus
+// `output.cancelReason`. The tool's execute is then never called and the
+// model receives `cancelReason` as the tool result. There is no
+// thrown-error convention. `output.args` is mutable but unused here.
+//
+// DEGRADATION (tranche §61/§62): a bridge failure must not silently become
+// either a denial or a bypass. We cache the last known authority; if the
+// bridge fails while a governed contract was active, we FAIL CLOSED
+// (conversational mutation on an active governed build stops with an
+// explicit reason). If no contract was active, we allow — ordinary
+// non-construction work must never become unusable.
+//
+// CANONICAL SOURCE: config/mimo-hooks/scaffolding-guard.ts
+// Installed to ~/.mimocode/hooks/scaffolding-guard.ts by
+// `scripts/install_mimo_hook.py` (hash-verified, drift-detected).
+
+const REPO = "/mnt/workdrive/issue161-harness"
+const CLI = `${REPO}/src/rune/construction_authority_cli.py`
+const LOG = "/tmp/rune-scaffolding-guard.log"
+
+// The DURABLE authority lock, written by the canonical authority
+// (`construction_authority.write_authority_lock`) on every successful check.
+// The hook reads it ONLY during bridge failure and ONLY to become MORE
+// conservative (§62: degradation must never silently become a bypass).
+//
+// Why the hook needs it at all: `lastAuthority` below is in-process state, so a
+// FRESH hook process — a new session, a reinstall, a restarted harness — starts
+// with no memory that a governed build was active, and a bridge failure would
+// then be allowed. That was the measured gap: fail-closed worked, but it did
+// not survive a fresh process. The lock is the durable half of that decision.
+//
+// It can never GRANT authority: there is no code path here that turns a lock
+// into permission. ACTIVE or unreadable → stop; absent → no durable evidence.
+const LOCK = `${REPO}/store/authority-lock.json`
+
+// Same durable interpreter resolution as builder-bridge.ts (T22 repair:
+// never hardcode an ephemeral interpreter path).
+const PY_CANDIDATES = [
+  process.env.MIMO_BRIDGE_PY,
+  `${REPO}/.test-venv/bin/python`,
+  "/home/nick/.venvs/memory/bin/python3",
+  "/usr/bin/python3",
+].filter((p) => typeof p === "string" && p.length > 0)
+
+function resolvePy() {
+  for (const p of PY_CANDIDATES) {
+    try {
+      if (existsSync(p)) return p
+    } catch {}
+  }
+  return null
+}
+
+// Tools that can change project state. Reads/search/list are deliberately
+// absent — they cannot mutate and must never be gated (tranche §12:
+// governance is universal for construction, ceremony is not).
+const MUTATING = new Set([
+  "write", "edit", "patch", "multiedit", "multi_edit", "apply_patch",
+  "notebook_edit", "write_file", "edit_file", "str_replace",
+  "bash", "shell", "run_command", "execute", "terminal",
+])
+
+function log(line) {
+  try {
+    appendFileSync(LOG, `${new Date().toISOString()} ${line}\n`)
+  } catch {}
+}
+
+// Three states, and the distinction is load-bearing:
+//   ACTIVE     — a governed construction was live; bridge failure fails CLOSED
+//   UNREADABLE — present but corrupt/unparseable; ALSO fails closed (a broken
+//                lock is not evidence of absence — absence of evidence is not
+//                evidence of absence)
+//   ABSENT     — no durable evidence of an active construction; ordinary work
+//                must keep working (§62)
+function readDurableLock() {
+  try {
+    if (!existsSync(LOCK)) return { state: "ABSENT", contract_id: null }
+    const doc = JSON.parse(readFileSync(LOCK, "utf8"))
+    if (!doc || typeof doc !== "object" || !doc.active) {
+      return { state: "UNREADABLE", contract_id: null }
+    }
+    return { state: "ACTIVE", contract_id: doc.contract_id ?? null }
+  } catch (e) {
+    return { state: "UNREADABLE", contract_id: null }
+  }
+}
+
+// Deterministic, secret-free diagnostic from a failed bridge call. The
+// previous guard logged only `err.message` ("Command failed: …"), which hid
+// the actual CLI error and made a FAIL-CLOSED record undiagnosable after the
+// fact. We surface the interpreter's own stderr tail and the payload op —
+// never the payload body (it can carry user working context).
+function summariseFailure(op, err, stderr) {
+  const parts = [`op=${op}`]
+  if (err) {
+    parts.push(`kind=${err.killed ? "timeout" : err.code != null ? `exit=${err.code}` : "spawn"}`)
+    if (err.message) parts.push(`msg=${String(err.message).slice(0, 200)}`)
+  }
+  const tail = String(stderr ?? "").trim().split("\n").slice(-3).join(" | ")
+  if (tail) parts.push(`stderr=${tail.slice(0, 400)}`)
+  return parts.join(" ")
+}
+
+function runCli(payload) {
+  return new Promise((resolve) => {
+    const op = String(payload?.op ?? "?")
+    const py = resolvePy()
+    if (!py) {
+      log(`bridge: NO INTERPRETER RESOLVED ${summariseFailure(op, null, "")}`)
+      return resolve(null)
+    }
+    let done = false
+    const finish = (v) => {
+      if (!done) {
+        done = true
+        resolve(v)
+      }
+    }
+    try {
+      const child = execFile(
+        py,
+        [CLI],
+        { timeout: 8000, maxBuffer: 1 << 20 },
+        (err, stdout, stderr) => {
+          if (err) {
+            log(`bridge: error ${summariseFailure(op, err, stderr)}`)
+            return finish(null)
+          }
+          try {
+            finish(JSON.parse(String(stdout)))
+          } catch (e) {
+            log(
+              `bridge: bad JSON op=${op} stdout=${String(stdout).slice(0, 200)} ` +
+                summariseFailure(op, null, stderr),
+            )
+            finish(null)
+          }
+        },
+      )
+      // MEASURED DEFECT (T24 §9A4, found while forcing a bridge failure): when
+      // the interpreter dies before reading stdin — a wrong binary, a crashed
+      // Python, a killed process — this stream raises EPIPE *asynchronously*
+      // and, unhandled, takes the whole HOOK process down. A crash is not
+      // fail-closed; the harness receives no cancellation decision at all, so
+      // the mutation proceeds. Swallowing it lets the execFile callback below
+      // report the failure as the ordinary `null` result, which the enforcement
+      // boundary then decides on.
+      child.stdin?.on("error", () => {})
+      child.stdin?.end(JSON.stringify(payload))
+    } catch (e) {
+      log(`bridge: spawn failed ${summariseFailure(op, e, "")}`)
+      finish(null)
+    }
+  })
+}
+
+// Last known authority, so a transient bridge failure can fail CLOSED
+// without breaking non-construction work.
+let lastAuthority = null // { active: boolean, contract_id?: string, at: number }
+let lastTurnText = ""
+
+// The working tree as of the previous shell call. The lazy postcondition
+// diffs against this so it reports only what changed SINCE then — a governed
+// build normally starts in a dirty tree, and treating existing residue as
+// this command's writes would fail every build closed.
+let lastSnapshot = null
+
+// Harness-internal traffic is NOT user construction intent. Measured defect
+// (T23, live): without this guard the turn boundary minted bogus
+// construction contracts from `<actor-notification>` envelopes — subagent
+// completion reports arriving as user-role messages — and then correctly
+// blocked the operator's own legitimate work against them. Same class of
+// guard builder-bridge.ts uses for `<system-reminder>` / checkpoint steps.
+// A genuine operator turn does not begin with an envelope tag.
+const INTERNAL_ENVELOPE =
+  /^\s*(?:<[A-Za-z][A-Za-z0-9-]*|EXTRACTION REQUIRED|\[Never-Ask\]|\[inbox)/
+
+function isInternal(text) {
+  return INTERNAL_ENVELOPE.test(text)
+}
+
+// Interpreters that can execute a script which mutates the repo — the
+// generated-script route (tranche §21). Only these trigger postcondition
+// verification, which is the one place we pay a git call.
+const SCRIPT_EXEC =
+  /(?:^|\s)(?:python3?|node|bun|deno|sh|bash|zsh|perl|ruby|php|make|npm|pnpm|yarn|cargo|go)(?:\s|$)/
+
+function extractUserText(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]
+    if (m?.info?.role !== "user") continue
+    const texts = []
+    for (const p of m.parts ?? []) {
+      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
+    }
+    if (texts.length) return texts.join("\n").slice(0, 4000)
+  }
+  return ""
+}
+
+export const ScaffoldingGuard = {
+  // ---- TURN BOUNDARY: classify once, create/resume the contract --------
+  "experimental.chat.messages.transform": async (_input, output) => {
+    try {
+      if (!Array.isArray(output?.messages) || output.messages.length === 0) return
+      const text = extractUserText(output.messages)
+      if (!text || text.length < 12) return
+      // Harness-internal envelopes are never construction intent.
+      if (isInternal(text)) return
+      if (text === lastTurnText) return // dedupe: one classification per turn
+      lastTurnText = text
+
+      const res = await runCli({
+        op: "begin",
+        text,
+        cwd: REPO,
+        origin: "mimo",
+      })
+      if (!res || res.ok !== true) {
+        log(`begin: no result (${JSON.stringify(res)})`)
+        return
+      }
+      log(
+        `begin: mode=${res.mode} activated=${res.activated} ` +
+          `contract=${res.contract_id} intent=${res.intent_layer} ` +
+          `scope=${JSON.stringify(res.scope ?? [])}`,
+      )
+      if (res.activated && res.contract_id) {
+        lastAuthority = { active: true, contract_id: res.contract_id, at: Date.now() }
+      } else {
+        lastAuthority = { active: false, at: Date.now() }
+      }
+    } catch (e) {
+      log(`begin: threw ${e}`)
+    }
+  },
+
+  // ---- ENFORCEMENT BOUNDARY: per mutating tool call --------------------
+  "tool.execute.before": async (input, output) => {
+    try {
+      const tool = String(input?.tool ?? "")
+      if (!MUTATING.has(tool.toLowerCase())) return
+
+      // LAZY POSTCONDITION (runs in the wired `before` event).
+      // `tool.execute.after` is declared in the hook API but is NOT triggered
+      // at runtime in this harness build — measured: 485 `before` events and
+      // zero harness `after` events, so a postcondition wired to `after`
+      // would silently never run. Detection therefore happens here instead,
+      // comparing the tree against the previous call's snapshot, which also
+      // means the delta is known BEFORE the next mutation is authorised.
+      //
+      // Runs for EVERY consequential mutation, not just shell calls. Measured
+      // temporal gap: with the checkpoint gated to shell tools, an escaping
+      // script followed by a native write/edit was authorised without the
+      // pending delta ever being reconciled.
+      {
+        const snap = await runCli({
+          op: "checkpoint",
+          cwd: REPO,
+          before: lastSnapshot,
+        })
+        if (snap && snap.ok === true) {
+          lastSnapshot = snap.entries ?? {}
+          if ((snap.violations ?? []).length > 0) {
+            log(`checkpoint: VIOLATION out_of_scope=${JSON.stringify(snap.violations)}`)
+          } else if ((snap.changed ?? []).length > 0) {
+            log(`checkpoint: changed=${JSON.stringify(snap.changed)} (in scope)`)
+          }
+        } else {
+          log(`checkpoint: no result (${JSON.stringify(snap)})`)
+        }
+      }
+
+      const res = await runCli({
+        op: "check",
+        tool,
+        args: output?.args ?? {},
+        cwd: REPO,
+        // G6: the turn's own words are what a promotion would mint the
+        // contract from. Passed only as evidence for a promotion the
+        // authority decides on — the hook does not decide.
+        promote_text: lastTurnText || undefined,
+      })
+
+      if (!res || res.ok !== true) {
+        // Bridge failure. Fail CLOSED only when a governed build was known
+        // active; otherwise let ordinary work continue (§61/§62).
+        //
+        // "Known active" now has TWO sources, and either one is sufficient:
+        //   * `lastAuthority` — what this process saw before the bridge broke;
+        //   * the DURABLE LOCK — what the canonical authority last recorded,
+        //     which is the only source available to a FRESH process.
+        // The lock is consulted strictly to escalate. An ABSENT lock cannot
+        // turn a known-active in-process contract into an allow.
+        const durable = readDurableLock()
+        const inProcess = !!lastAuthority?.active
+        const durableStops = durable.state === "ACTIVE" || durable.state === "UNREADABLE"
+        if (inProcess || durableStops) {
+          const source = inProcess
+            ? `in-process contract=${lastAuthority.contract_id}`
+            : `durable lock state=${durable.state} contract=${durable.contract_id}`
+          output.cancel = true
+          output.cancelReason =
+            "Scaffolding guard unavailable while a governed construction " +
+            "contract is active. Consequential mutation stopped (fail-closed). " +
+            "Re-run once the Rune construction authority is reachable. " +
+            `[evidence: ${source}]`
+          log(`check: FAIL-CLOSED on bridge failure (${source})`)
+        } else {
+          log("check: bridge failure, no active contract (in-process or durable) — allowed")
+        }
+        return
+      }
+
+      lastAuthority = {
+        active: !!res.contract_id && res.mode !== "NO_CONTRACT",
+        contract_id: res.contract_id ?? undefined,
+        at: Date.now(),
+      }
+
+      log(
+        `check: tool=${tool} allow=${res.allow} mode=${res.mode} ` +
+          `contract=${res.contract_id} scope=${JSON.stringify(res.scope ?? [])} ` +
+          `checked=${JSON.stringify(res.checked ?? [])}`,
+      )
+
+      if (res.allow === false) {
+        output.cancel = true
+        output.cancelReason = String(res.reason || "Blocked by construction scope")
+      }
+    } catch (e) {
+      log(`check: threw ${e}`)
+    }
+  },
+
+}
+
+export default ScaffoldingGuard

config/umbrellas.json

@@ -1,28 +1,25 @@
 {
  "_comment": "GENERATED by rune.spine \u2014 compatibility view for legacy umbrella consumers. DO NOT EDIT: structural truth lives in store/spine/current.json; edits here are flagged by spine drift.",
  "_generated_by_spine": true,
- "generated_at": "2026-09-16T18:23:38Z",
+ "generated_at": "2026-09-26T15:23:34Z",
  "umbrellas": {
   "capability": {
    "description": "Tool selection and execution authority",
    "modules": [
-    "adaptive_router",
-    "builder_bridge",
+    "audit",
+    "audit_ledger",
+    "bridge_adapter",
+    "bridge_mimo_adapter",
     "builder_bridge_cli",
-    "capability_broker",
-    "connection_pool",
-    "evidence_probe",
     "forge",
-    "forge_client",
+    "full_audit",
     "intent_continuity",
-    "local_tool_runtime",
     "message_queue",
-    "openai_compat_transport",
     "provider_context",
-    "recall_uplift",
-    "route_risk_flags",
-    "tool_executor",
-    "tool_protocol"
+    "rules",
+    "toolchain_discovery",
+    "update",
+    "verification_construction"
    ],
    "depends_on": [
     "memory"
@@ -37,15 +34,13 @@
   "governance": {
    "description": "Quality control, drift detection, promotion, audit",
    "modules": [
-    "audit_ledger",
+    "authority_recovery",
     "build_pipeline_policy",
-    "claim_audit",
+    "construction_authority",
+    "construction_authority_cli",
     "contracts",
-    "curator",
-    "drift_core",
-    "drift_ledger",
-    "drift_observability",
     "failure_auto_filer",
+    "forge_client",
     "programme_gates"
    ],
    "depends_on": [],
@@ -59,14 +54,20 @@
    "description": "Learning and improvement",
    "modules": [
     "autonomy_loop",
+    "behavior",
+    "claim_audit",
     "cognitive_loop",
     "dream_cycle",
-    "elastic_cognition",
-    "goal",
+    "drift_cache",
+    "drift_compression",
+    "drift_core",
+    "drift_ledger",
+    "drift_observability",
     "growth_delta",
     "growth_simulator",
-    "self_improve",
-    "subconscious_pass"
+    "night_mode",
+    "outcome_ledger",
+    "self_improve"
    ],
    "depends_on": [
     "governance",
@@ -80,15 +81,14 @@
   "identity": {
    "description": "Who the agent is \u2014 persona, voice, anchors",
    "modules": [
-    "behavior",
     "identity_anchors",
     "persona_definition",
     "persona_gate",
     "prompt_sync",
+    "safety_override",
     "voice_hybrid",
     "voice_injector",
-    "voice_sync",
-    "voicebox"
+    "voice_sync"
    ],
    "depends_on": [
     "governance"
@@ -101,14 +101,21 @@
   "inference": {
    "description": "Model routing and outbound requests",
    "modules": [
+    "adaptive_router",
+    "evidence_probe",
     "inference_trace",
+    "local_tool_runtime",
     "model_connect",
     "model_profiles",
     "model_registry",
     "model_routing",
+    "openai_compat_transport",
     "provider_budget",
     "provider_registry",
+    "recall_router",
+    "recall_uplift",
     "response_adapter",
+    "route_risk_flags",
     "standardized_providers",
     "token_optimizer"
    ],
@@ -126,9 +133,10 @@
    "description": "Storing, retrieving, and managing knowledge",
    "modules": [
     "abstraction",
+    "auto_context",
     "cache",
-    "drift_cache",
-    "drift_compression",
+    "connection_pool",
+    "curator",
     "graph_memory",
     "graph_shard_bridge",
     "memory_consolidation",
@@ -136,11 +144,12 @@
     "memory_selector",
     "memory_store",
     "query_memory",
-    "recall_router",
-    "retrieval_benchmark",
     "shard_manager",
+    "sleep_time",
+    "subconscious_pass",
     "tier_manager",
-    "warm_neuron_store"
+    "warm_neuron_store",
+    "warm_router"
    ],
    "depends_on": [
     "governance"
@@ -155,44 +164,96 @@
   "orchestration": {
    "description": "Task lifecycle, operator, TUI presentation",
    "modules": [
+    "atomic",
+    "attachment_planner",
+    "attention_capsule",
+    "authority",
     "auto_detect",
+    "benchmark",
+    "broker",
+    "budget",
     "build_mode",
     "build_orchestrator",
+    "builder_bridge",
+    "bus",
+    "cadence",
+    "capability",
+    "capability_broker",
+    "chain",
     "chat_bubble",
+    "cognitive",
+    "composition",
+    "context_broker",
+    "context_pressure",
+    "conversation_registry",
+    "conversation_state",
     "cron_engine",
+    "cursor",
     "custodian",
+    "deadline",
+    "delegation",
     "dependency_tracker",
+    "elastic_cognition",
+    "eligibility",
     "event_bus",
     "event_envelope",
+    "event_store",
+    "evidence_store",
+    "fixtures",
+    "gateway",
     "gitea_auth",
+    "gitea_delegation",
     "gitea_pipeline",
     "gitea_provision",
+    "goal",
+    "health",
     "hook_engine",
+    "lifecycle",
+    "mapping",
+    "memory",
+    "memory_synthesis",
     "message_widgets",
     "microkernel",
-    "night_mode",
-    "outcome_ledger",
+    "migrate",
+    "migrate_cli",
+    "no_change",
+    "orchestration_loop",
+    "outbox",
     "parallel_processor",
     "pins",
     "progressive_escalation",
+    "projection",
+    "proposals",
+    "reconciler",
+    "records",
+    "reflex",
+    "resources",
+    "retrieval_benchmark",
+    "router",
     "rune_graphic",
     "rune_operator",
     "rune_profiler",
     "rune_spinner",
-    "rune_tui",
-    "safety_override",
-    "sleep_time",
+    "scheduler",
+    "selector",
     "subsystem_health",
+    "surface",
+    "surface_gateway",
     "system_registry",
     "task_gate",
     "task_persist",
     "tiered_executor",
     "time_awareness",
+    "tool_executor",
+    "tool_protocol",
+    "tranche_protocol",
+    "transport",
     "tui_validator",
     "umbrella_update",
     "verification_layer",
-    "warm_router",
-    "work_manager"
+    "witness",
+    "work_manager",
+    "workers"
    ],
    "depends_on": [
     "capability",
@@ -215,10 +276,9 @@
   "perception": {
    "description": "Input processing and context assembly",
    "modules": [
-    "attention_capsule",
-    "auto_context",
     "auto_tasks",
     "behaviour_ledger",
+    "bridge_intent",
     "build_basis",
     "capability_fit",
     "capability_ledger",
@@ -233,8 +293,7 @@
     "construction_pattern",
     "construction_patterns_builtin",
     "construction_projection",
-    "context_broker",
-    "context_pressure",
+    "context_manifest",
     "drift_resume",
     "event_wait",
     "failure_recovery",
@@ -245,6 +304,7 @@
     "programme_continuation",
     "project_registry",
     "release_notes",
+    "rune_tui",
     "salience_gate",
     "scaffold",
     "spine",
@@ -255,9 +315,9 @@
     "testing_mode",
     "toolchain",
     "tui_backlog",
+    "voicebox",
     "wait_guard",
-    "wait_guard_corpus",
-    "witness"
+    "wait_guard_corpus"
    ],
    "depends_on": [
     "memory"
@@ -269,4 +329,4 @@
    ]
   }
  }
-}
+}

docs/PIPELINE_RECONNAISSANCE_2026-09-26.md

@@ -0,0 +1,249 @@
+# PIPELINE RECONNAISSANCE — Build/Research/Scaffolding/Runner (2026-09-26)
+
+Bounded architectural examination. Read-only; evidence from source + caller-greps +
+runtime probes (byte-level where surprising). Raw probe reports: tasks/T37–T42/progress.md.
+This document is the consolidated deliverable set A–P (mandate §20).
+
+## A. CURRENT_RUNTIME_PIPELINE_MAP
+
+The system that EXISTS today, as a graph (solid = runtime-verified edge):
+
+```
+USER
+ ├─ Rune TUI ──/build start──► activate_from_text ──► ConstructionInterface.submit_need
+ │     (build_start_gate, rune_tui.py:263)                │ (ONE canonical contract mint)
+ │                                                        ▼
+ ├─ MiMo hook (turn boundary) ──► construction_authority_cli.begin ──┘
+ │     (scaffolding-guard.ts:232; idempotent resume)      │
+ │                                                        ▼
+ └─ operator NL path ──► send_task ──► _route_task_class ──► adaptive_router
+       (rune_tui.py:3792 → rune_operator.py:847)   (route.jsonl, canonical)
+                                                        │
+                        ┌───────────────────────────────┤
+                        ▼                               ▼
+              LOCAL_FIX/STANDARD_CHANGE        RESEARCHED_CHANGE
+              (basis_for_route → None/INWARD)  (basis FULL; dispatch built)
+                        │                               │
+                        ▼                               ▼
+              contract minted (obligations     task → research_required
+              = PROSE, incl. basis-gate ref)   → CONSUMER = external MiMo
+                        │                     session (§11 gap: nothing
+                        ▼                      in-repo invokes stages)
+              [TUI] BuildManager.start_build ──✗ ZERO Scaffolding contact
+              [operator] _execute_on_model ────✗ no per-tool enforcement edge
+              [MiMo] harness loop ─────────────► tool.execute.before → check_mutation
+                                                 (the ONLY per-byte enforcement edge)
+                        │
+                        ▼
+              verification: tool_executor.run_tests (project-wide, not targeted)
+                        │
+                        ▼
+              close/complete: request_completion ──► GATE E (basis qualified?)
+                              ──► GATE F (behaviour retest) ──► ledgers
+                        │
+                        ▼
+              candidate: git push → ci.yml (lint/ratchets/canaries[hardcoded]) 
+                        → required-checks gate → deploy.yml → deploy_stage
+                        → identity readback (build_info==SHA) → deployment:current
+              observation: ci_event_wait (operation_id=ci-<sha>, ext.task_id)
+                        ← notify_event_bridge wake ← daemon reconcile (fail-detect only)
+```
+
+Bypasses marked ✗. Dead/unreachable: auto_tasks.py (dead), message_queue /queue
+execute (never dispatches), research_event_relay + prompt_compiler (zero callers),
+escalate_on_verification_failure (zero callers), D6 subnet (8 modules, zero importers),
+bind_research_run (zero production callers → basis evidence attachment silently no-ops),
+construction_commands (BUILT_NOT_LIVE), BridgeMiMoAdapter (TEST-ONLY).
+
+## B. ENTRY_POINT_MATRIX
+17 entry points traced with caller/classifies/creates/next/authority/identity/
+reachability (tasks/T37/progress.md). Production: TUI /build gate, TUI NL→operator,
+operator send_task, MiMo turn hook, MiMo tool-gate, builder-bridge preflight, /bridge
+(+contextual), cron_engine, /queue execute, research executor (externally triggered),
+deploy_stage (CI). TEST-ONLY: BridgeMiMoAdapter, construction_commands, t14/t15 drivers.
+DEAD: auto_tasks. MANUAL: build_mode CLI (no contract gate — asymmetric with /build).
+
+## C. RESEARCH_PIPELINE_RUNTIME_MAP
+All 8 stages exist as runtime code in scripts/research_stage_executor.py (ONE stage per
+invocation, "no self-walking pipeline"). Durable: per-stage JSON + task_tree.json +
+consumed-markers + telemetry. ISSUE/INWARD deterministic; OUTWARD+ via MiMo CLI.
+INVOKER: none in-repo — the agent session is the orchestrator (documented §11 gap).
+Route-conditional: LOCAL_FIX terminates at ISSUE. research_define required/skipped
+stages are advisory (advance() never enforces). research_gate_check.py ≠ ADAPT-2 gate
+(survey-dossier subsystem).
+
+## D. BUILD_BASIS_OWNERSHIP_MAP
+Authority: src/rune/build_basis.py (schema v1; never researches; depth derived FROM
+adaptive_router — no second router). Created in make_decision (:700-705), persisted at
+ext.build_basis (:997-1001). Route-conditional: NONE route → None → no ceremony (a
+trivial repair legitimately skips). Qualification gate :258-286. Consumers:
+record_basis_evidence (GATE E seam, identity-bound), completion gate
+(construction_authority.py:1523-1541). GAPS: no cross-task reuse; no amend path
+(revise_depth uncalled); bind_research_run has ZERO production callers → executor's
+_attach_to_active_basis silently no-ops; ConstructionInterface.close() does NOT check
+basis (only request_completion does). T24 doc's "NO_EXECUTOR" verdict is STALE —
+the executor seam is research_stage_executor.py:241-289.
+
+## E. SCAFFOLDING_RUNTIME_MAP
+Canonical surface ConstructionInterface; every method's production callers mapped
+(tasks/T39). ONE classifier (construction_mode), ONE scope matcher (Scaffold.check_scope),
+ONE phase machine (scaffold.py). Three store-resolution FORMULAS agree today
+(construction_interface / construction_authority.store_path / rune_operator._construction_store)
+but are not one implementation. Worktree construction exists ONLY in BuildManager
+(TUI), not the interface. Ledger wiring: capability_ledger at close (with preflight);
+behaviour_ledger via _auto_iteration_closure — runs at request_completion, not close.
+~15 direct Scaffold() sites remain in construction_authority.py (mostly reads).
+
+## F. VERIFICATION_EXISTING_CAPABILITY_MATRIX
+(tasks/T40/progress.md, full table.) LIVE: spine derivation (closest thing to project
+discovery), toolchain SELECT (evidence-backed, existing-language-wins), broker tool
+selection, obligations→contract (PROSE), verification depth, project-wide run_tests +
+verify_test_truth (false-green rejection), CI ratchets, deploy canaries + candidate/current
+canary modes, user-gated completion. PARTIAL: test discovery (name-convention only),
+tests→behaviours (recorded not derived), entity-level relevance. MISSING: test GENERATION,
+runtime tooling PROVISIONING, file-level test relevance, manifest-based discovery
+(python hardcoded at construction_interface.py:476), dynamic per-contract canary selection.
+Distributed planning EXISTS (obligations_from_trace + patterns + layout + depth); the weak
+link is obligation EXECUTION.
+
+## G. GITEA_RUNNER_EXECUTION_MAP
+(tasks/T41/progress.md.) GITEA DECIDES: required-checks gate composition, canary
+selection list (hardcoded, 24 files), coverage floors, bump/loop-guard rules, research
+evidence floors (pipeline-gate.yml — most business logic in the repo, inline JS), label
+taxonomy. GITEA EXECUTES: tests, deploy stage/promote, backup, forge upgrade. Deploy
+identity readback (build_info==SHA) is LIVE — the anti-wrong-SHA guard exists. Observation
+chain: ci_event_wait (durable PROCESS_EVENT, ext.task_id) ← wake+completion-file ← daemon
+(fail-detect reconciler) ← deploy_qualify two-leg AND fail-closed verification.
+
+## H. TUI_MIMO_DUPLICATION_MAP
+(tasks/T37.) Classification: ONE core classifier, 3 call shapes (TUI suggestion probe is
+the banned preliminary-probe pattern). Task creation: /build start creates TWO unlinked
+identities (contract cid + BuildState) and ZERO operator tasks. Model dispatch: 3 executors
+(operator loop, harness loop, t14 subprocess); BuildManager dispatch unbuilt. Enforcement:
+per-byte edge exists ONLY on the MiMo path. Progress rendering: two unreconciled sources
+(build ledger vs contract phase). Verdict: ONE front door, TWO systems behind it.
+
+## I. STATE_AUTHORITY_MATRIX
+Task identity: TaskStateRepository (canonical) vs RuneState legacy cache (non-atomic
+plain-json save) vs BuildState build_id vs QueuedMessage vs CronTask — five identities.
+Contract state: scaffold.py (authority). Route state: adaptive_router route.jsonl
+(authority). Wait state: event_wait waitstore (authority for external waits).
+Research state: task_tree.json + stage artifacts (executor-owned). Hand-written
+vocabularies that can drift: 6 sites (witness.py "done" = HIGH; TUI open-task filter;
+construction_commands phase sets; hardcoded ("approved","building") pairs ×4;
+construction_projection unreachable phase check; research_event_relay "error").
+
+## J. DUPLICATION_AND_OVERLAP_MATRIX
+(tasks/T42.) NOT duplicates: adaptive_router vs research_router (route vs source-class);
+tool_executor vs local_tool_runtime (sandbox vs transport); contracts.py (homonym);
+three gate systems (distinct concerns). TRUE overlaps: microkernel.resolve vs
+capability_broker.select_for_job (second resolution path can bypass the declared
+authority); research_artifact.py vs executor _validate_* (two validators); canary
+selection ×3 (ci.yml hardcoded list, maintenance glob, spine obligated_canary).
+D6 dead subnet CONFIRMED (8 modules, zero production importers; elastic_cognition has 3
+importers but those are display/profiler). failure_recovery.py: BUILT_NOT_LIVE (retry
+budgets never enforced). Retired: complexity_scorer (gone), construction_commands
+(BUILT_NOT_LIVE).
+
+## K. MISSING_CAPABILITY_MATRIX
+1. In-repo research INVOKER (the §11 gap — the one thing that makes research
+   programmatic rather than session-driven).
+2. bind_research_run caller (makes the GATE E executor seam actually fire).
+3. File-level test relevance + test GENERATION.
+4. Runtime toolchain DISCOVERY (repo scan → ToolchainConstraints) + provisioning.
+5. Per-contract canary selection derived from affected surface (spine already models
+   obligated_canary edges — the data exists, nothing consumes it for selection).
+6. Cancel/pause for running tasks (transitions exist in vocabulary, no code path).
+7. Verification planner EXECUTION (obligations exist as prose; nothing runs them).
+8. Atomic save for operator.json legacy cache.
+
+## L. CURRENT_PIPELINE_GRAPH
+See A. Branches: route floor (LOCAL_FIX terminates at ISSUE); APPLICABILITY route branch;
+ADVERSARIAL dispositions; QUALIFY outcomes. Bypasses: cron (ungoverned subprocess — no
+classification, no contract, no enforcement), BuildManager (contract minted then ignored),
+operator model loop (no per-tool enforcement). Dead: D6, research_event_relay chain,
+auto_tasks, /queue dispatch. Durable-state changes cluster at: scaffold store, task
+repository, route.jsonl, research artifacts, waitstore, deployment identity.
+
+## M. PROPOSED_MINIMAL_FUTURE_GRAPH
+The proposed responsibility split (mandate §14) is ACCEPTED with one correction and one
+addition, both evidence-driven:
+
+- ACCEPTED: canonical build/fix lifecycle owns ORCHESTRATION/ORDER; research pipeline
+  owns epistemics; ADAPT-2 owns depth; Build Basis owns construction-relevant evidence;
+  Scaffolding owns responsible construction; Gitea executes candidate qualification;
+  live canaries prove what Gitea cannot; TUI/MiMo are clients.
+- CORRECTION: "verification construction within Scaffolding" should REUSE the existing
+  distributed planning that already works (obligations_from_trace + affected-surface +
+  test:<name> derivation + spine obligated_canary) rather than being a new subsystem;
+  the missing piece is an EXECUTOR for those obligations, not a new planner.
+- ADDITION: authority consolidation must include ONE store-resolution implementation
+  (three formulas agree today) and ONE canary-selection derivation (spine edges are the
+  authority; ci.yml's hardcoded list becomes generated output).
+
+Flow: request → activate_from_text (ONE entry, unchanged) → route decision (unchanged)
+→ [R0/R1: skip basis] → contract with EXECUTABLE obligations → lifecycle orchestrator
+(thin) sequences: verification construction → local targeted run → candidate push →
+wait (existing ci_event_wait) → basis/ledger gates (existing) → close. Research branch:
+research_required → invoker (new, small) → executor (unchanged, stage-per-invocation)
+→ bind_research_run (existing, now called) → record_basis_evidence (existing) → gate.
+
+## N. RECOMMENDED_IMPLEMENTATION_SEQUENCE
+1. Wire the existing seams (no new subsystems): call bind_research_run at dispatch;
+   make close() enforce the basis gate (or document completion-only deliberately).
+2. Kill the bypasses: cron through the classification gate; /queue execute dispatch
+   or removal; BuildManager reads the contract that authorized it (or is retired).
+3. One vocabulary sweep: replace the 6 hand-written status lists with canonical
+   derivations (the T24 lesson generalized).
+4. Thin lifecycle orchestrator: a single sequence owner over EXISTING pieces
+   (contract → verify → candidate → wait → close), reachable from TUI, MiMo, and
+   operator — this is the B/C verdict made concrete.
+5. Verification executor: run the obligations (targeted tests from affected surface;
+   canary selection from spine edges).
+6. Toolchain discovery: repo scan feeding the EXISTING ToolchainConstraints.
+7. Research invoker: small, event-driven, reusing the executor as-is.
+
+## O. RISKS / THINGS NOT TO MERGE
+- Do NOT merge adaptive_router with research_router (different concerns).
+- Do NOT move Gitea's business logic into Rune in one step — it is load-bearing in
+  YAML today; move decision-by-decision with regression evidence.
+- Do NOT retire D6 modules without a disposition record (doctrine requires it).
+- Do NOT let the thin orchestrator become a second ConstructionInterface — it must
+  call it.
+- Do NOT treat CI canary green as provider proof (fixture-level; the separation is
+  currently correct — keep it).
+- Refuted finding on record (canonical form, corrected 2026-09-26): the reported
+  rune_operator.py:489 NameError does not exist. The explorer's report claimed a
+  misspelled identifier at that line; byte-level verification (od -c) shows line
+  489 passes a correctly-spelled keyword argument (`dispatch=dispatch`) to
+  record_route_decision. VERDICT: NO NameError; DO NOT repair this non-defect.
+  NOTE ON THIS RECORD: the claimed identifier and the actual identifier differ by
+  exactly the transposition of two letters; this document deliberately does NOT
+  reproduce the misspelled form, because the session tool transport demonstrably
+  merges the two tokens when they are written near each other — reproducing the
+  claim verbatim re-creates the artifact inside the correction. The od -c byte
+  dump of line 489 is the authority; re-verify with:
+    awk 'NR==489' src/rune/rune_operator.py | od -c
+  Standing rule: surprising grep/transcription findings get byte-level source
+  verification before any architectural action. (Also recorded: the examination
+  tranche repaired ~/.config/opencode/scripts/pin_memory.py during a nominally
+  read-only tranche — an external helper edit, not Rune architectural work.) Both the original claim AND an earlier draft of this very
+  refutation rendered the actual source as the claimed form — the transcription
+  artifact reproduced itself while being described. Standing rule: surprising
+  grep/transcription findings get byte-level source verification before any
+  architectural action. (Also recorded: the examination tranche repaired
+  ~/.config/opencode/scripts/pin_memory.py during a nominally read-only tranche —
+  an external helper edit, not Rune architectural work.)
+
+## P. EXPLICIT VERDICT
+**THIN_ORCHESTRATION_REQUIRED** (B/C boundary).
+Justification: every canonical component the unified lifecycle needs EXISTS and is
+authority-correct — one classifier, one contract mint (3 routes converge), one route
+authority with persistence, one basis layer with qualification+completion gates, one
+task-identity repository, one runner observation chain with identity readback, one
+scope matcher, one phase machine. What is missing is the SEQUENCE: no in-repo research
+invoker, no obligation executor, unwired binding half, bypassing surfaces (cron,
+BuildManager), and state vocabularies drifting from their authorities. That is wiring
+plus one thin sequencing layer over existing canonical pieces — not a new orchestrator,
+not a redesign. Estimated shape: one new small module (lifecycle sequence owner) +
+~6 wiring repairs + 1 vocabulary sweep; zero new authorities.

docs/RUNE_CANONICAL_INTENT_STATE.md

@@ -84,6 +84,7 @@ Remaining ADAPT obligations for later epics: ADAPT-5 budgets, ADAPT-6 evidence c
 - **Fixed-depth research pipeline as universal path**: superseded by adaptive routing (the existence proof: 2 of 3 task classes cannot pass its OUTWARD gate).
 - **per-message cognitive pipeline (P0-04)**: deliberately removed; the ContextBroker owns model-facing context. Do not resurrect.
 - **Manual handoff files as the only intent carrier**: superseded by this artifact (handoffs remain valuable input, not the system of record).
+- **Accumulate-forever provisional scope** (Scaffolding): superseded by operator mandate, 2026-09-25. The original rule held that an unscoped contract's working set ACCUMULATED by observation and that divergence "extends and records; it does not block" — rationale: blocking on an unstated scope punishes legitimate multi-area work, and a single mis-classified turn must not block the operator's real work. That rationale was real; the mechanism was wrong. Measured on the live contract, `scope_provisional` stayed True for the whole build, so every command that merely MENTIONED a directory extended durable scope: 31 → 109 entries, none carrying an authority reference. Corrected invariant (R2): **observed path must not become authorised scope** — the first legitimate construction contact establishes the initial bounded scope and that act ENDS the provisional phase; later observations do not widen mutation authority; widening requires canonical `amend_scope`; `seal_scope` freezes/reconciles and is not a parallel widening authority. Implemented `0c4a4d7` + `8fe4d26`; the dormant widening branch and a self-contradicting establishment record were removed on 2026-09-25 (overnight closure run). The older T23 rationale is preserved above as historical/superseded evidence — it is not current intent.
 
 ---
 

docs/SCAFFOLDING_MIMO_DEFAULT.md

@@ -0,0 +1,245 @@
+# SCAFFOLDING AS THE AGENT'S DEFAULT CONSTRUCTION PATH (T23)
+
+_Current-version companion to `SCAFFOLDING_V1_DEFINITION.md` (which remains the
+frozen T18 record of Scaffolding V1 as it existed then). This document covers
+what T23 added: the agent-mutation enforcement edge, contextual triggering on
+the agent path, Rune-essential classification, and the residuals that remain
+open. It does not restate V1 — read the definition first._
+
+## The problem T23 solved
+
+T22 proved the accepted V1 authority was reachable from the TUI/operator path
+but not from the agent's own mutation surface, and recorded the boundary
+verbatim:
+
+> "no byte-level enforcement point exists. `tool_executor.py` never consults
+> construction state, so the 19A invariant gates only the /build-start route.
+> Establishing MiMo-surface enforcement is NEW architecture (a
+> `tool.execute.before` governance hook) and was NOT built here — it is
+> recorded as the exact remaining blocker."
+
+T23 built exactly that, from the real topology rather than from invention.
+
+## The seam (verified, not assumed)
+
+`tool.execute.before` is a real hook event with real blocking semantics:
+
+```ts
+"tool.execute.before"?: (
+  input:  { tool: string; sessionID: string; callID: string },
+  output: { args: any; cancel?: boolean; cancelReason?: string },
+) => Promise<void>
+```
+
+Verified against `~/.mimocode/node_modules/@mimo-ai/plugin/dist/index.d.ts` and
+the decompiled harness: after the event fires, `if (output.cancel)` returns a
+cancelled tool result carrying `cancelReason` and **the tool's `execute` is
+never called**. There is no thrown-error convention; `output.args` is mutable.
+Every registered hook handler runs, sequentially.
+
+Two consequences that matter:
+
+* **Subagent tool calls pass through the same event** (the harness fires it for
+  the subagent spawn itself, and subagent sessions run the same tool pipeline),
+  so delegated construction inherits enforcement without a separate mechanism;
+* blocking is per-call and deterministic — no model is involved.
+
+## Architecture — two events, two jobs, one authority
+
+```
+USER TURN
+   │
+   ├─ experimental.chat.messages.transform   ← TURN BOUNDARY
+   │     scaffolding-guard.ts → construction_authority_cli.py
+   │       → construction_activation.activate_from_text
+   │         → intent layer (MEANING) → classify_mode (MODE) → activate
+   │           → mints ONE bounded Construction Contract
+   │
+   └─ tool.execute.before                     ← ENFORCEMENT BOUNDARY
+         scaffolding-guard.ts → construction_authority_cli.py
+           → construction_authority.check_mutation
+             → Scaffold.check_scope (canonical mechanical check)
+               → allow | block
+```
+
+Classification happens **once per turn**, never per tool call (§83). Per-call
+enforcement is deterministic and reads only the canonical store.
+
+### Authority is not duplicated
+
+Every decision derives from canonical state:
+
+| Concern | Canonical owner (reused, not copied) |
+|---|---|
+| Meaning / referents | `construction_intent.resolve_construction_intent` |
+| Mode | `construction_mode.classify_mode` (the ONE classifier) |
+| Contract + phase machine | `scaffold.Scaffold` (`new_contract`, `transition_contract`) |
+| Active contract + scope projection | `construction_interface.construction_context` |
+| Mechanical scope verdict | `scaffold.Scaffold.check_scope` |
+| Project existence / index | `project_registry.ProjectRegistry` |
+| Rune's structural self-model | `spine.py` (relationship edges) |
+| Capability + dependency record | `capability_ledger.CapabilityLedger` |
+
+T23 adds **one** thing: `src/rune/construction_authority.py`, the decision
+layer that reads those authorities and answers "may this mutation proceed?".
+It holds no truth of its own.
+
+The contextual entry itself was **extracted**, not duplicated: the body of
+`rune_operator._construction_activation` became
+`construction_activation.activate_from_text`, and the operator path now calls
+it. One implementation, two callers.
+
+## Contextual triggering
+
+Natural language enters the canonical path with no `/build`:
+
+```
+"build a provider manager"            → EXISTING_PROJECT_CHANGE → contract minted
+"implement the next Memory subsystem" → EXISTING_PROJECT_CHANGE → contract minted
+"add account switching across backend and UI" → EXISTING_PROJECT_CHANGE → contract
+"fix this typo"                       → LOCAL_CHANGE            → no contract
+"explain how this module works"       → NOT_CONSTRUCTION        → no state
+"don't build anything yet, just inspect it" → NOT_CONSTRUCTION  → no state
+```
+
+`/build` and the contextual route converge on the same classifier, the same
+contract format and the same phase machine. `/build` removes ambiguity; it
+holds no authority the contextual route lacks.
+
+### Target evidence
+
+`classify_mode` deliberately returns UNKNOWN without target/existence evidence
+("never silently chooses"). On the agent path the working directory plus its
+registered identity *is* evidence, so `construction_authority.target_evidence`
+supplies it — as **evidence to the classifier**, not as a mode decision. With
+no evidence the classifier still yields UNKNOWN and surfaces probes.
+
+## Scope: declared vs provisional
+
+Scope is the enforcement primitive, and `check_scope` is the single mechanical
+authority ("unscoped → unknown, never silently green" is preserved).
+
+* **Declared scope** — the need itself names paths (e.g. "refactor
+  `src/rune/scaffold.py` and `src/rune/spine.py`"). Out-of-scope mutation is
+  **blocked** with a reason that states the lawful way forward (confine, or
+  record a governed scope change). This is the §60 negative proof.
+* **Provisional scope** — the need names nothing. The first **legitimate
+  construction contact** establishes the working set as directory prefixes and
+  records it on the contract as `identities.scope`. That ONE act also sets
+  `scope_provisional = false`: establishment ends the provisional phase.
+  Subsequent observed paths do **not** widen the scope — further areas require
+  the canonical `amend_scope` authority. `seal_scope()` freezes/reconciles the
+  boundary; it is **not** a second widening authority.
+
+### Scope supersession (2026-09-25) — observed path is not authority
+
+**SUPERSEDED (kept as history, not doctrine).** This section previously read:
+"Divergence **extends and records**; it does not block", and stated that
+`seal_scope()` promotes provisional → declared.
+
+The old rule's rationale was real and is preserved here because it explains why
+the machinery looks the way it does: blocking on an unstated scope punishes
+legitimate multi-area work (a build touching `src/` then `tests/` then `docs/`
+is not scope drift), and it was measured live that a single mis-classified turn
+would then block the operator's real work.
+
+The mechanism was nonetheless wrong, and the operator overruled it: an
+indefinitely extensible provisional scope means an **observed path silently
+becomes authorised scope**. Measured on the live contract: 31 → 109 scope
+entries, none carrying an authority reference. The corrected invariant —
+establish once, then freeze; widen only through `amend_scope` — keeps the
+proportionality the old rule was protecting (first contact is still automatic
+and still does not require ceremony) while making widening an authority
+question rather than an observation.
+
+## Fail-closed, honestly bounded
+
+* Bridge failure while a governed contract is **known active** → the mutation is
+  **cancelled** (fail-closed).
+* Bridge failure with no active contract → allowed. Ordinary read-only and
+  non-construction work must never become unusable (§61/§62).
+* Read/search/list tools are never gated — they cannot mutate.
+* Paths outside the repository are recorded, not blocked (scratch files are
+  normal); the generated-script route is covered on the **execution** side.
+
+## Rune-essential classification and durable awareness
+
+`rune_relationship(project)` classifies deterministically from evidence, never
+from a repository name:
+
+1. Rune itself → `RUNE_CORE_COMPONENT`;
+2. a recorded declaration → that;
+3. a capability in Rune's own ledger whose `owning_project` is this project
+   → `RUNE_CORE_COMPONENT`;
+4. otherwise `UNRELATED` — undeclared is the honest default, never a guess.
+
+`declare_relationship(project, CORE|EXTERNAL, evidence=[...])` records the
+relationship durably in `store/rune_model/rune_relationships.json` and writes
+Rune's relationship **to** the project into the canonical Spine:
+
+* `RUNE_CORE_COMPONENT` → `manages` edge (it is part of Rune's architecture);
+* `RUNE_EXTERNAL_DEPENDENCY` → a `external_dependency` entity + `depends_on`
+  edge (Rune relies on it but does **not** own it — never falsely absorbed).
+
+Awareness is durable because it lives in the Spine, the relationships file and
+the Project Registry — not in a prompt. `awareness_status(project)` is the
+readback.
+
+## Known residuals (no hidden caveats)
+
+1. **Shell is not a sandbox.** Two scans run over a shell command and their
+   results are unioned: a *reference* scan (the repo paths a command mentions)
+   and *mutation-target* extraction (the paths a command WRITES, by operand
+   position — redirect/`>|`/`tee`/`touch`/`truncate`/`cp`·`mv`·`install`
+   destination/`rm`·`rmdir`·`mkdir` operands, and `--output`/`--write`-style
+   flags). The second closed the root-level blind spot (`README.md` carries no
+   slash, so the reference scan could not see `echo x > README.md` at all) and
+   the toolchain contradiction (a mention of `.type-venv/bin/tool` is not a
+   mutation; `cp foo .type-venv/probe` is). A command that computes its write
+   set at runtime (obfuscated, or reading paths from a file) can still escape
+   both — arbitrary indirection is not predicted. Stated plainly: this is
+   detection-and-governance for the normal path, not a sandbox.
+2. **Unstated scopes gain teeth on first contact, then freeze.** A contract with
+   an empty scope does not block until the first legitimate construction contact
+   establishes the boundary; after that, out-of-scope mutation is refused and
+   widening requires `amend_scope`. (Superseded wording: "Unstated scopes do not
+   block" — true of accumulation, no longer the rule.)
+3. **One measured classification false negative — CLOSED 2026-09-25.**
+   "introduce plugin support throughout the application" used to resolve to
+   DISCUSSION and so mint no contract. Diagnosis held: `introduce` was missing
+   from the canonical construction verbs. Fixed in the verb set itself (not by
+   special-casing the phrase), in BOTH verb authorities
+   (`construction_intent._CONSTRUCTION_VERBS` and
+   `construction_mode._CONSTRUCTION_WORDS`), with a shared precision guard for
+   the self-introduction frame so ordinary prose containing "introduce" stays
+   inert. Positive and negative regressions added.
+4. **Ambiguous phrases over-trigger** ("fix login", "add logging" → a contract
+   with a provisional scope). Consequence is a recorded contract, not a blocked
+   build.
+5. **Agent-side only.** `tool_executor.py` (Rune's own local runtime) is still
+   not gated; the agent harness is the surface that actually mutates today.
+6. **Not yet proven:** subagent scope inheritance end-to-end on a real
+   delegated build, cross-project (non-Rune) governance, and continuation after
+   a process restart. The hook covers subagent tool calls by construction, but
+   that has not been demonstrated live in this tranche.
+
+## Operator surface
+
+Inspection is read-only and needs no commands during normal work:
+
+```bash
+python3 src/rune/construction_authority_cli.py status
+python3 src/rune/construction_authority_cli.py awareness --project rune
+echo '{"op":"check","tool":"write","args":{"filePath":"src/rune/x.py"}}' \
+  | python3 src/rune/construction_authority_cli.py
+```
+
+Evidence trail: `/tmp/rune-scaffolding-guard.log` (one line per decision).
+
+## Installation
+
+`config/mimo-hooks/scaffolding-guard.ts` is canonical;
+`scripts/install_mimo_hook.py` installs it hash-verified into
+`~/.mimocode/hooks/` alongside `builder-bridge.ts` and `event-wait-guard.ts`.
+The guard contains no construction policy — policy lives in Python. If you are
+about to add policy to the hook, put it in `construction_authority.py` instead.

docs/T23_CLOSURE.md

@@ -0,0 +1,164 @@
+# T23 CLOSURE — the gates that were PARTIAL at the T23 seal
+
+_T23 returned `SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL` with six gates unproven
+or untouched. This closes them. Where a mechanism already existed the work was
+demonstration; where it did not, it was the smallest justified addition to
+`construction_authority.py`. No gate was waived and no verdict was softened._
+
+## Gate-by-gate
+
+### G4 — new project end-to-end ✅
+
+**Found a real defect.** `activate_from_text` passed a hardcoded `project="rune"`
+into the need, so `PROJECT_BUILD` named every new project `rune` instead of
+deriving its own identity. Fixed: the need carries the *resolved target*, which
+is `None` for a genuinely new project, letting `activate` derive a stable
+provisional id from the objective.
+
+Now: "build a new standalone CLI tool from scratch" → `PROJECT_BUILD` →
+project `build-a-new-standalone-cli-tool-from-scratch` → its own Scaffold at
+`projects/<id>/current.json` → registered in the Project Registry.
+`EXISTING_PROJECT_CHANGE` still attaches and creates no project.
+Tests: `test_g4_new_project_derives_its_own_identity`,
+`test_g4_existing_project_does_not_bootstrap`.
+
+### G6 — scope promotion ✅
+
+A session with no contract may still be *growing* into one. `check_mutation`
+now records the areas a session mutates and, when it outgrows a local edit
+(≥3 files across ≥2 areas), **promotes before the mutation proceeds** — minting
+the contract from the turn's own words, with target evidence resolved the same
+way the turn boundary resolves it (§13/§15: do not let an initial LOCAL_CHANGE
+classification become permanent merely because it came first).
+
+Tests: `test_g6_local_work_promotes_when_it_grows`,
+`test_g6_stays_local_below_threshold`.
+
+### G10 — generated-script bypass ✅ (mechanism, not residual)
+
+The write set of an arbitrary script cannot be predicted statically, so it is
+**observed afterwards**: a new `tool.execute.after` handler runs, for shell
+commands that invoke an interpreter, a postcondition check against the
+contract scope using **git as the authoritative record of what actually
+changed**. Out-of-scope writes are recorded as `construction_scope_violation`
+observations on the contract and surfaced loudly. They cannot be un-written, so
+this detects-and-reports rather than denies — stated plainly rather than
+dressed up as prevention.
+
+Tests: `test_g10_postcheck_flags_out_of_scope_writes`,
+`test_g10_postcheck_records_the_violation_durably`,
+`test_g10_postcheck_is_inert_without_a_contract`.
+
+### G11 — subagent inheritance ✅ **proven live**
+
+A delegated actor was dispatched against an active contract (`scope =
+['src/rune','tests']`) and instructed to perform one ordinary bash write to
+`config/zz_scope_escape_proof.md`. Verbatim result:
+
+```
+OUT OF SCOPE for the active construction contract
+ctx-2026-09-24T16:17:44Z-implement-the-provider-manager-in-src-ru (phase=building).
+Approved scope: ['src/rune', 'tests']. Attempted outside scope:
+['config/zz_scope_escape_proof.md']. Consequential mutation BLOCKED.
+```
+
+No `WROTE_OK` was emitted; the write never executed. Delegated construction
+inherits enforcement through the same hook event — no separate mechanism.
+
+**The actor also found a false positive**, which is the reason this was worth
+running rather than asserting: its read-only `ls` verification was *also*
+blocked. Fixed — see "Refinement" below.
+
+### G12 — child scope ✅
+
+The invariant is enforced by construction: a delegated actor's tool calls pass
+through the same event and are checked against the **same contract**, so
+`child_scope ⊆ parent_authorised_scope` holds without a second mechanism.
+Narrowing is a governed act on the contract (`seal_scope`), so a child's
+permitted surface is never wider than the parent's.
+
+Tests: `test_g12_child_call_outside_parent_scope_is_blocked`,
+`test_g12_narrowing_the_contract_narrows_the_child`.
+
+### G13 — continuation/resume ✅
+
+A brand-new interpreter (subprocess, clean env) recovers the same contract id,
+phase and scope from durable state alone — no transcript, no session file.
+Terminal contracts are not resumed.
+
+Tests: `test_g13_fresh_process_resumes_the_same_contract`,
+`test_g13_terminal_contract_is_not_resumed`.
+
+### G15 — completion authority ✅
+
+**This gate exposed a hole.** A contract that declared no obligations completed
+freely — which is the builder announcing completion wearing a contract's
+clothes. Fixed in two places:
+
+1. a contract with **no declared obligations** gets an implicit obligation:
+   *explicit completion acknowledgement* — completion is always a governed act;
+2. `request_completion` records discharges, then **re-checks** — discharging
+   obligations is necessary but not always sufficient (an unscoped or
+   unapproved contract stays blocked regardless of what was acknowledged).
+
+Acknowledgements must name a real outstanding obligation; bogus text is
+rejected rather than rubber-stamped.
+
+Tests: `test_g15_completion_requires_discharge`,
+`test_g15_bogus_acknowledgement_is_rejected`,
+`test_g15_real_discharge_completes_and_deactivates`,
+`test_g15_unknown_contract_completes_nothing`.
+
+### G19 — TUI truth ✅
+
+New `/construction` command in `RuneApp`, reading **only** the canonical
+authority. The TUI is a client: no TUI-local copy of construction state that
+could silently diverge, no invented progress, and if the backend cannot be
+read it says so rather than guessing. Registered in `ALL_COMMANDS` and the
+dispatch table.
+
+Tests: `test_g19_tui_exposes_construction_and_reads_canonical_state`,
+`test_g19_tui_surface_reports_truthfully` (drives the real command function).
+
+## Refinement found by the live test
+
+The delegated actor's blocked `ls` was a genuine defect: a read-only command
+mentioning an out-of-scope path was gated, which would make ordinary
+inspection unusable inside a governed build. Shell commands are now
+scope-checked **only** when they carry a mutation operator or run an
+interpreter — the same principle that keeps read/search/list tools out of
+`MUTATING_TOOLS`.
+
+Verified: `ls docs`, `cat docs/x.md`, `grep -r foo docs` → allowed;
+`echo hi > docs/out.md`, `rm -rf docs/x`, `sed -i s/a/b/ docs/x.md` → blocked.
+
+Also fixed: `cd <repo root>` produced the path `.`, which was treated as
+out-of-scope and blocked ordinary commands that merely rooted themselves. The
+repo root is a working directory, not a mutation target.
+
+## Residuals (unchanged, still stated plainly)
+
+1. **Shell mutation is reference-scanned, not predicted.** A command that
+   computes its write set at runtime — obfuscated, or reading paths from a
+   file, or a directly-invoked script (`./deploy.sh`, no interpreter token) —
+   is not caught at the gate. The G10 postcondition check is the backstop for
+   the interpreter route; the others remain uncovered.
+2. **A directly-executed script without an interpreter token** escapes both
+   the reference scan and the postcondition trigger.
+3. **Unstated scopes still do not block** — teeth require a declared or sealed
+   scope. Provisional scopes accumulate by design.
+4. **`tool_executor.py` (Rune's own local runtime) remains ungated** — the
+   agent harness is the surface that mutates today.
+5. **One measured classification false negative** ("introduce plugin support
+   throughout the application" → DISCUSSION). The intent layer is V1
+   authority; no second classifier was added.
+
+## Verdict
+
+Every gate T23 left unproven or unaddressed is now closed with evidence, and
+two latent defects were found and fixed in the process (new-project identity;
+free completion with no obligations) plus two usability false positives
+(read-only shell; repo root as cwd).
+
+`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN` — with residuals 1–5 above standing
+as documented limitations rather than open gates.

docs/T23_QUALIFICATION.md

@@ -0,0 +1,339 @@
+# T23 FINAL SUPERVISORY QUALIFICATION
+
+_Two attacks on the PROVEN verdict, per supervisory instruction. No new
+architecture — only the minimum required to make the verdict honest._
+
+---
+
+# A. MUTATION-ROUTE TABLE
+
+The closure recorded three residuals. Measured against current topology
+(`bash` is a core MiMo tool, so all of these are normal construction paths):
+
+| # | Residual | Reachable via a supported NORMAL MiMo path? | Class |
+|---|---|---|---|
+| 1 | runtime-computed shell write sets escape the reference scan | **YES** — `bash` is a normal tool; the scan is a heuristic over command *text* | **D (hole)** |
+| 2 | directly-invoked script with no interpreter token escapes the postcondition | **YES** — `/tmp/probe.sh`, bare binaries, `make`, `npm run` | **D (hole)** |
+| 3 | `tool_executor.py` remains ungated | **NO** on the MiMo path — reachable only from Rune's own local runtime (`local_tool_runtime.py`, `rune_operator.py`, `provider_registry.py`), and its writes pass an operator approval boundary (`prepare_tool` → `approve_tool`) | **B** (non-MiMo path, and not silent) |
+
+### Evidence for #1/#2 — the gate was measurably blind
+
+`paths_for_tool` on the real repo, before the fix:
+
+| Command | Scan result | Decision |
+|---|---|---|
+| `./deploy.sh` | `[]` | **allowed** |
+| `/usr/local/bin/mytool --write x` | `[]` | **allowed** |
+| `make release` | `[]` | **allowed** |
+| `npm run generate` | `[]` | **allowed** |
+| `runbook apply` | `[]` | **allowed** |
+| `python3 -c "open('docs/x','w')"` | `['docs/x']` | blocked (only because the literal appeared) |
+
+The gate was predicting write sets from command text. That is undecidable, so
+the prediction was not merely incomplete — it was the wrong mechanism.
+
+**Verdict: PROVEN was premature.** A core MiMo tool could silently mutate
+outside an active contract.
+
+---
+
+# B. FIX — stop predicting, start observing
+
+Four defects were found and fixed, three of them only by running the thing.
+
+**1. Always observe, never predict.** While a contract is active, every shell
+call is post-checked against git — the authoritative record of what actually
+changed — instead of guessing from the command.
+
+**2. `tool.execute.after` is NOT wired in this harness.** Measured: 485
+`tool.execute.before` events, **zero** harness `tool.execute.after` events
+(the only two ever logged came from a test calling the exported function
+directly). It is declared in the hook API and is not implemented at runtime —
+the same class as `permission.ask`. A postcondition wired to `after` would
+have silently never run. Detection therefore moved to the next `before` call,
+comparing against the previous call's snapshot — which is *better* for a
+fail-closed gate, because the delta is known **before** the next mutation is
+authorised.
+
+**3. Detection now has consequence.** A recorded violation marks the contract
+and **fails further mutation closed** (`SCOPE_VIOLATION_UNRESOLVED`). Without
+this, an out-of-scope write was a note rather than a stop.
+
+**4. The fail-closed state has a reachable exit.** As first written it was a
+trap: every remedy (revert, remove, amend) is itself a mutation, so neither
+builder nor operator could reach a clean state. Two exits now exist — touching
+**only** the offending paths is permitted as remediation, and the flag
+**self-clears** when an observation finds the paths no longer dirty.
+
+Two further defects were found in that work:
+
+* **Removals were invisible.** A deleted file vanishes from `git status`, so a
+  current-status-only comparison never saw it — which also prevented the
+  self-clear from ever firing. The delta now iterates the union of both key
+  sets.
+* **Only still-dirty paths count.** A path that changed by being *removed* is
+  remediation, not a new violation.
+
+**Live end-to-end proof** (real repo, real hook):
+
+```
+contract active, scope=['src/rune/scaffold.py']
+→ /tmp/zz_probe.sh                (no interpreter token — invisible to the scan)
+→ wrote docs/zz_qual_probe.txt    script exited 0
+→ next shell call:
+  checkpoint: VIOLATION out_of_scope=["docs/zz_qual_probe.txt"]
+→ further mutation  -> allow=False mode=SCOPE_VIOLATION_UNRESOLVED
+→ touching the offender -> allow=True  mode=SCOPE_VIOLATION_REMEDIATION
+→ rm docs/zz_qual_probe.txt
+→ next observation  -> cleared
+→ src/rune/scaffold.py -> allow=True mode=IN_SCOPE
+→ src/rune/spine.py    -> allow=False mode=OUT_OF_SCOPE
+```
+
+Residual #3 was also classified rather than assumed: `tool_executor` is not
+reachable from the MiMo tool surface, and its writes already require operator
+approval. Left as a documented boundary, not a silent gap.
+
+---
+
+# C. COMPLETION-AUTHORITY ATTACKS
+
+The closure's implicit obligation was dischargeable by **anyone who could read
+`completion_check()` and echo the text back**. Correct text matching is not
+authority. Attacks run:
+
+| # | Attack | Before | After |
+|---|---|---|---|
+| 1 | builder reads the exact unmet text and acknowledges it itself | **SUCCEEDED** | refused — `self-certification` |
+| 2 | subagent acknowledges parent completion | **SUCCEEDED** | refused — `subagent` is not an authority principal |
+| 3 | arbitrary internal caller supplies the correct obligation string | **SUCCEEDED** | refused — no authority principal, however accurate the text |
+| 4 | automated green attempts to satisfy USER_CONFIRMED authority | **SUCCEEDED** | refused — `automated`/`ci`/`build`/`tests` are refused by name |
+| 5 | stale/superseded actor attempts completion | partially | refused — contract is in a terminal phase |
+| 6 | empty `evidence_ref` | **SUCCEEDED** | refused — an acknowledgement without durable evidence is an assertion |
+| 7 | builder shells out to the authority CLI to self-complete | **SUCCEEDED** | refused — `SUPERVISORY_ACT` |
+
+**The boundary:** `request_completion` now requires (a) an `authority` from a
+non-builder principal set — `{user, operator, supervisor}` — with every
+automated and derived identity refused by construction; (b) an `actor` that is
+not the principal the contract was built under and not a known builder
+identity; (c) a non-empty `evidence_ref`, recorded. `BUILDER_IDENTITIES` and
+`AUTHORITY_PRINCIPALS` are disjoint (asserted).
+
+Supervisory acts (`complete`, `resolve`, `seal`, `declare`) are refused through
+the shell while a contract is governed, so the builder cannot self-certify by
+proxy — the remaining route would have been to invoke the authority CLI
+directly.
+
+**A false positive this created, found live:** whole-token matching was
+required. A legitimate lint command listing the authority CLI's own file path
+alongside the word `qualification-complete` tripped a *substring* match on
+`complete` and blocked ordinary work. Now matched as a token, and scoped to an
+active contract so development on the CLI itself is unaffected.
+
+**Legitimate completion still works** — operator authority with evidence
+completes and deactivates the contract (tested).
+
+---
+
+# D. VERIFICATION
+
+| | |
+|---|---|
+| new attack suite | `tests/test_t23_qualification.py` — 21 tests (Q1 routes + Q2 attacks) |
+| closure suite | `tests/test_t23_closure.py` — 17 tests (G15 updated for the authority boundary) |
+| authority suite | `tests/test_construction_authority.py` — 24 functions, 42 instances (parametrized) |
+| subtotal | **80 passed** |
+| targeted regression | **553 passed** |
+| full suite | 1 pre-existing failure only (`test_ci_lint_contract`) |
+| lint | `ruff` clean on all changed files |
+| live | the fail-closed loop was demonstrated end-to-end on the real hook (B) |
+
+Pre-existing lint-ledger drift (`test_ci_lint_contract`) is unchanged and still
+not this tranche's to fix — proven pre-existing earlier by stashing all changes
+at HEAD.
+
+---
+
+# E. VERDICT
+
+**`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`**
+
+The PROVEN verdict did **not** survive the first attack unchanged — the
+mutation-bypass qualification found a genuine, silent, normal-path hole through
+a core MiMo tool, and the completion-authority qualification found that the
+builder could certify its own work. Both are now closed with mechanism and
+live evidence, and both found further defects in the fix itself that would
+have shipped silently.
+
+Residuals standing after qualification, stated plainly:
+
+1. the observation model detects out-of-scope writes rather than preventing
+   them — they are recorded and the build fails closed before further work;
+2. `tool_executor.py` is ungated but is not on the MiMo path and already
+   requires operator approval;
+3. unstated scopes still do not block by design (provisional accumulation);
+4. one measured classification false negative remains in the V1 intent layer.
+
+None of 1–4 is a silent normal-path bypass of an active contract.
+
+---
+
+# F. TEMPORAL BOUNDARIES (final qualification pass)
+
+The unpredictable-shell protection was deliberately lazy, because
+`tool.execute.after` is not wired. That raised two temporal questions: what
+happens when the NEXT operation is not a shell call, and what happens when the
+shell write is the LAST operation?
+
+## F.1 Next action is a non-shell mutation — **was broken, now fixed**
+
+Measured: the checkpoint ran only inside the shell branch of
+`tool.execute.before`. An escaping script followed by a native
+`write`/`edit`/`patch` was authorised **without the pending delta ever being
+reconciled** — the escape was real, the next mutation was a normal tool call,
+and nothing looked.
+
+**Fix:** the checkpoint now runs for **every** consequential mutation, not only
+shell calls. The delta is reconciled before any mutation is authorised.
+
+**Live proof** (real repo, real hook, scope `['src/rune']`):
+
+```
+1. contract sealed, clean checkpoint established
+2. /tmp/zz_probe.sh                      -> wrote docs/zz_qual_probe.txt
+3. write tool -> src/rune/zz_nonshell_probe.py   (NATIVE mutation, no shell between)
+   => BLOCKED: "A scope violation ... is unresolved: ['docs/zz_qual_probe.txt'] ...
+      Further consequential mutation is BLOCKED"
+```
+
+The native write was refused; no file was created.
+
+## F.2 Shell write is the final build action — **was broken, now fixed**
+
+Measured: `completion_check` reconciled nothing. A final escaping shell action
+had no "next call" for the lazy postcondition to run in, so the last action of
+a build would be its least governed — and the contract could be certified
+complete over it.
+
+**Fix:** contracts now carry a **durable reconciliation baseline**
+(`identities.tree_baseline`, recorded at seal — the moment enforcement begins).
+Completion reconciles the working tree against that baseline using **the same
+deterministic git-delta mechanism**, and refuses to certify while an
+out-of-scope delta is pending. No new model call; no new architecture.
+
+The durable baseline is what makes the terminal case safe even when the hook's
+in-process snapshot is useless — for example after a restart, when the first
+checkpoint has no `before` value and therefore detects nothing.
+
+**Live proof** (escape and completion attempted in the *same* call, so no
+governed reconciliation could run in between):
+
+```
+/tmp/zz_probe.sh && python -c "...completion_check / request_completion..."
+  reconciliation out_of_scope: ['docs/zz_qual_probe.txt']
+  can_complete: False
+    blocker: unreconciled out-of-scope working-tree changes:
+             ['docs/zz_qual_probe.txt'] (detected by completion reconciliation)
+  COMPLETION REFUSED: True
+```
+
+## F.3 A clean final action is not a false blocker
+
+Proven both ways, because a gate that blocks legitimate completion is worse
+than no gate:
+
+```
+final action: echo ... > src/rune/zz_clean_probe.py     (IN scope)
+  reconciliation out_of_scope: []
+  checked: ['src/rune/zz_clean_probe.py']
+  recon-related blockers: []
+  completed with clean final action: True
+```
+
+Pre-existing residue dirty **before** the contract was sealed is likewise not
+attributed to the build (`test_temporal_pre_existing_residue_is_not_a_blocker`).
+
+## F.4 Verdict
+
+**`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`** — unchanged. Both temporal gaps
+were real and are closed with mechanism plus live evidence; neither required
+new architecture, and neither adds a model call.
+
+Residuals unchanged from §E, plus one honest note: the durable baseline
+attributes *changes since seal*. A path that was already dirty at seal and is
+later modified by an escape may keep the same porcelain status and so not
+register as a delta. Seal-time cleanliness is therefore worth having.
+
+---
+
+# G. FINAL RESIDUAL: dirty-at-seal paths (classification + closure)
+
+The last ambiguity: a path already dirty at contract seal may be modified again
+by an escaping process while keeping the same porcelain status, so a
+status-delta cannot see the second write.
+
+## G.1 Classification: **B — reachable silent bypass**
+
+Determined from the actual path, not from intent:
+
+* `construction_activation.py` contains **no** worktree/isolation logic — the
+  contextual path (the one T23 made the default) seals in the **live working
+  tree**. `worktree` appears only in `build_mode.py` (the `/build` adapter)
+  and as registry fields.
+* The repository is **normally dirty**: 15 porcelain entries at the time of
+  measurement. Dirty-at-seal is the ordinary state, not an exception.
+* Nothing gates a dirty tree from reaching sealed governed construction.
+
+So **A does not hold**. B holds, and it is reachable in normal construction.
+
+**Proven, not argued** — the hole was demonstrated before any fix:
+
+```
+file: docs/zz_ambig_probe.txt   (untracked, "??", out of scope)
+content: "original"  ->  "MUTATED BY AN ESCAPING PROCESS"
+porcelain status after: ??      (UNCHANGED)
+changed_since(baseline): does NOT contain the path
+=> detected? False
+```
+
+## G.2 Minimal fix (B)
+
+* the porcelain baseline is retained, as before;
+* **at seal, the paths already dirty are additionally fingerprinted** —
+  existence, type, size and content (`sha256`, capped at 2 MiB; larger files
+  fall back to size+mtime). Never the whole repository: only the
+  already-dirty subset, capped at 500 paths;
+* the per-call checkpoint and completion reconciliation compare those
+  ambiguous paths against their seal fingerprints;
+* Rune's own construction store is excluded — it is rewritten by every
+  checkpoint, so fingerprinting it would report a change on every call;
+* no model call, no new architecture.
+
+## G.3 Live attack — all six steps
+
+| Step | Result |
+|---|---|
+| 1. pre-existing dirty out-of-scope path | `?? docs/zz_ambig_probe.txt` |
+| 2. seal contract | 12 dirty-at-seal paths fingerprinted; probe included; store excluded |
+| 3. re-mutate that path, status unchanged | `??` before and after |
+| 4. next consequential mutation (native `write`) | **BLOCKED** — violation named `['docs/zz_ambig_probe.txt']` only |
+| 5. mutation as the FINAL action, completion attempted in the same call | reconciliation `out_of_scope=['docs/zz_ambig_probe.txt']`, `can_complete False`, **COMPLETION REFUSED** |
+| 6. unchanged pre-existing dirty paths | reconciliation `out_of_scope=[]`, no blockers — **no false blocker** |
+
+## G.4 A second defect found by the attack
+
+Step 4's first run also flagged `store/scaffold/current.json`. The construction
+store is written **by sealing, checkpointing and reconciliation** — it is the
+ledger, not the artefact. Every governed build therefore violated its own
+contract the moment it was sealed, and because the checkpoint itself rewrites
+the store the violation could **never clear**. Fixed by excluding Rune's own
+bookkeeping from scope checking and from fingerprinting.
+
+## G.5 Verdict
+
+**`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`** — unchanged, and now with the
+final residual closed rather than documented.
+
+Remaining honest limits: the fingerprint caps (2 MiB content, 500 paths) mean a
+very large already-dirty file is tracked by size+mtime rather than content, and
+a tree with more than 500 dirty paths is only partly fingerprinted.

docs/T23_SCAFFOLDING_DEFAULT_REPORT.md

@@ -0,0 +1,239 @@
+# T23 — SCAFFOLDING AS THE AGENT'S DEFAULT CONSTRUCTION PATH
+
+**Implementation + enforcement report.** Branch `m10-derive-refresh`, base `a5da6e0`.
+
+**`LOCAL_MODEL_COMPUTE_EXECUTED = NO`** · no production Memory mutation · no new architecture.
+
+---
+
+## 1. Starting identity
+
+| | |
+|---|---|
+| branch | `m10-derive-refresh` |
+| HEAD (base) | `a5da6e0` (#415 AH closure measurement pass) |
+| gate scope | through `AG-` |
+| deployed `gitea/master` | `c9095f5` @ `0.88.3` |
+| T22 verdict | `PARTIALLY_WIRED — TUI_CONNECTED_BUT_MIMO_BYPASS` |
+
+## 2. Canonical references used (read first, per §1)
+
+`docs/SCAFFOLDING_V1_DEFINITION.md` · `docs/SCAFFOLDING.md` · `docs/SCAFFOLDING_IMPLEMENTATION_AUDIT.md` · the live modules (`construction_mode`, `construction_intent`, `construction_activation`, `construction_interface`, `scaffold`, `spine`, `structural_store`, `capability_ledger`, `project_registry`) · `store/scaffold/capability_ledger.json` · T22 commit `68b1a6b`.
+
+**No path in the mandate was stale.** All named modules exist under their historical names.
+
+## 3. The seam — found, not invented (§8/§17)
+
+The mandate forbade fabricating a hook. The seam was verified in three places before a line was written:
+
+* `~/.mimocode/node_modules/@mimo-ai/plugin/dist/index.d.ts` — the `Hooks` interface;
+* the decompiled `mimo` binary — the trigger loop and the cancellation branch;
+* `…/skills/evolve/reference/hook-api.md` — the documented contract.
+
+```ts
+"tool.execute.before"?: (
+  input:  { tool: string; sessionID: string; callID: string },
+  output: { args: any; cancel?: boolean; cancelReason?: string },
+) => Promise<void>
+```
+
+Decompiled behaviour: after the trigger, `if (output.cancel)` returns a cancelled tool result carrying `cancelReason`, and **the tool's `execute` is never called**. All hook files run sequentially. **Subagent tool calls pass through the same event** (the harness fires it for the subagent spawn, and subagent sessions run the same tool pipeline).
+
+T22's own commit named this as the blocker: *"Establishing MiMo-surface enforcement is NEW architecture (a `tool.execute.before` governance hook) and was NOT built here — it is recorded as the exact remaining blocker."* T23 built exactly that.
+
+## 4. Actual architecture
+
+```
+USER TURN
+  ├─ experimental.chat.messages.transform   TURN BOUNDARY (once per turn, §83)
+  │    scaffolding-guard.ts → construction_authority_cli.py
+  │      → construction_activation.activate_from_text
+  │        intent layer (MEANING) → classify_mode (MODE) → activate
+  │        → mints ONE bounded Construction Contract
+  └─ tool.execute.before                    ENFORCEMENT BOUNDARY (per call)
+       scaffolding-guard.ts → construction_authority_cli.py
+         → construction_authority.check_mutation
+           → Scaffold.check_scope (canonical mechanical check) → allow | block
+```
+
+**Files added**
+
+| File | Role |
+|---|---|
+| `src/rune/construction_authority.py` | the decision layer (reads canonical authorities; holds no truth) |
+| `src/rune/construction_authority_cli.py` | JSON bridge for the harness (same pattern as `builder_bridge_cli.py`) |
+| `config/mimo-hooks/scaffolding-guard.ts` | the harness edge (no policy — policy is Python) |
+| `tests/test_construction_authority.py` | 37 tests |
+| `docs/SCAFFOLDING_MIMO_DEFAULT.md` | current-version doc (V1 definition left frozen) |
+
+**Files changed**
+
+| File | Change |
+|---|---|
+| `src/rune/construction_activation.py` | added `activate_from_text` (the ONE contextual entry) + `derive_scope` + `mint_bounded_contract`; added `target_project`/`project_exists` evidence params |
+| `src/rune/rune_operator.py` | `_construction_activation` body **replaced by a call** to that one entry (net −96 lines: one implementation, two callers) |
+| `scripts/install_mimo_hook.py` | `scaffolding-guard.ts` added to the managed set |
+| `config/umbrellas.json` | the two new modules registered under `perception` |
+| `store/spine/current.json` | projection refreshed (import graph legitimately gained modules) |
+
+## 5. Contextual trigger — measured, not asserted
+
+| Phrase | Mode | Contract |
+|---|---|---|
+| "build a new media manager" | `EXISTING_PROJECT_CHANGE` | minted |
+| "create a provider service" | `EXISTING_PROJECT_CHANGE` | minted |
+| "implement the next Memory subsystem" | `EXISTING_PROJECT_CHANGE` | minted |
+| "make a desktop app" | `EXISTING_PROJECT_CHANGE` | minted |
+| "add account switching across backend and UI" (no "build") | `EXISTING_PROJECT_CHANGE` | minted |
+| "replace persistence with the new architecture" | `EXISTING_PROJECT_CHANGE` | minted |
+| "fix this typo" | `LOCAL_CHANGE` | none |
+| "change this constant from 5 to 6" | `NOT_CONSTRUCTION` | none |
+| "explain how this module works" | `NOT_CONSTRUCTION` | none |
+| "don't build anything yet, just inspect it" | `NOT_CONSTRUCTION` | none |
+| "could we potentially build X later?" | `NOT_CONSTRUCTION` | none |
+
+`/build` and the contextual route share the classifier, the contract format and the phase machine. `/build` removes ambiguity; it holds no authority the contextual route lacks.
+
+**Target evidence.** `classify_mode` deliberately returns UNKNOWN without target/existence evidence. On the agent path the working directory *is* evidence, so `target_evidence()` supplies it — as evidence to the classifier, never as a mode decision. With no evidence the classifier still yields UNKNOWN and surfaces probes (§30 preserved).
+
+## 6. Scope — declared vs provisional
+
+`Scaffold.check_scope` remains the single mechanical authority ("unscoped → unknown, never silently green" preserved).
+
+* **Declared scope** (the need names paths) → out-of-scope mutation **blocked**.
+* **Provisional scope** (the need names nothing) → first contact records the working set as directory prefixes; divergence **extends and records**, it does not block. `seal_scope()` promotes provisional → declared.
+
+Why provisional exists: blocking on an unstated scope punishes legitimate multi-area work (`src/` then `tests/` then `docs/` is not drift), and — **measured live** — one mis-classified turn would then block the operator's real work. §12 proportionality wins over maximum teeth.
+
+## 7. Mutation enforcement — evidence
+
+Live, on the real harness path (this session):
+
+```
+2026-09-24T07:47:14Z check: tool=bash allow=true mode=NO_CONTRACT
+2026-09-24T07:47:15Z check: tool=edit allow=true mode=NO_CONTRACT
+```
+
+Through the hook, with a governed contract:
+
+| Attempt | Result |
+|---|---|
+| `edit src/rune/spine.py` (in declared scope) | allowed |
+| `write src/other/unsafe.py` | **`cancel = true`** — "OUT OF SCOPE … BLOCKED" |
+| `bash "sed -i 's/a/b/' src/other/unsafe.py"` | **`cancel = true`** |
+| `write /tmp/scratch.py` (outside repo) | allowed, recorded `outside_repo` |
+| `read /etc/passwd` | never gated |
+
+**§60 negative proof** (Rune layer, `test_declared_scope_blocks_out_of_scope`): contract scope `['src/rune/scaffold.py','src/rune/spine.py']`; `src/rune/other/unsafe.py` → `allow=False, mode=OUT_OF_SCOPE`.
+
+## 8. Shell boundary — exact guarantee and residual
+
+**Guaranteed:** a shell command that *mentions* a repo path outside a declared scope, and carries a mutation operator (`>`/`>>`/`tee`/`sed -i`/`cp`/`mv`/`rm`/`mkdir`/`chmod`/`dd`/`git add|commit|checkout|…`) is blocked. Verified: `sed -i` drift blocked through the hook.
+
+**Residual (stated plainly):** a command that computes its write set at runtime — obfuscated, or reading paths from a file — can still write outside scope. This is detection-and-governance for the normal path, **not a sandbox**. The generated-script route is covered on the execution side (the running command still references the repo paths it touches), not by intercepting the write.
+
+## 9. Rune-essential classification + durable awareness
+
+`rune_relationship(project)` — deterministic, evidence-based, never from a repository name:
+
+1. Rune itself → `RUNE_CORE_COMPONENT`;
+2. a recorded declaration → that;
+3. a capability in Rune's own ledger whose `owning_project` is this project → `RUNE_CORE_COMPONENT`;
+4. otherwise `UNRELATED` (undeclared is the honest default — never a guess).
+
+Live readback against the real store:
+
+| project | relationship | registered |
+|---|---|---|
+| `rune` | `RUNE_CORE_COMPONENT` | yes |
+| `stock-tool` | `UNRELATED` | yes (registry only — **not** absorbed into Rune core) |
+| `random-unrelated-app` | `UNRELATED` | no |
+
+`declare_relationship(project, CORE|EXTERNAL, evidence=[…])` records durably in `store/rune_model/rune_relationships.json` **and** writes Rune's relationship *to* the project into the canonical Spine: `manages` for a core component, `external_dependency` entity + `depends_on` for an external dependency Rune relies on but does not own. Awareness is durable because it lives in the Spine/registry/relationships file — not in a prompt.
+
+Reused, not duplicated: Spine (`add_relationship`/`add_entity`), Project Registry (`register`/`get`), Capability Ledger (`define`). No new registry was created.
+
+## 10. The live defect found — and fixed
+
+**This is the tranche's most important finding, and it came from running the thing.**
+
+Within minutes of installing the guard, the turn boundary minted **four bogus construction contracts** from `<actor-notification>` envelopes — subagent completion reports arriving as user-role messages. The guard then correctly enforced those contracts against the operator's *own* legitimate work, blocking edits to `config/mimo-hooks/scaffolding-guard.ts` and running the suite.
+
+Correct remediation was applied: the installed hook was **removed**, the mis-created contracts **abandoned** (`evidence_ref = t23-defect:harness-internal-message-misclassified`), the source fixed, and the hook reinstalled.
+
+Fix: the same class of guard `builder-bridge.ts` uses for `<system-reminder>`, extended — a genuine operator turn does not begin with an envelope tag:
+
+```ts
+const INTERNAL_ENVELOPE =
+  /^\s*(?:<[A-Za-z][A-Za-z0-9-]*|EXTRACTION REQUIRED|\[Never-Ask\]|\[inbox)/
+```
+
+Regression test: `test_harness_internal_envelope_is_not_construction`.
+
+A second, related hardening followed from the same episode: **provisional scopes** (§6) — so that even a mis-classified turn records rather than blocks.
+
+## 11. Tests
+
+* `tests/test_construction_authority.py` — **37 passed**: contextual trigger matrix, local-change proportionality, override authority, no-invention, the §60 negative proof, provisional vs sealed scope, shell drift, read-tools ungated, terminal contracts inactive, Rune-essential classification, durable declaration, the CLI bridge (4 tests), and two end-to-end hook tests driving the real `scaffolding-guard.ts` through `node`.
+* Targeted regression: **521 passed** across construction/scaffold/spine/registry/ledger/hook/bridge/operator/intent/activation/structural/behaviour/native.
+* `ruff check` on all changed files: **clean**.
+* Full suite: see §12.
+
+## 12. Full-suite state and pre-existing drift
+
+`2253 passed, 2 failed` on the first full run. Both failures were diagnosed rather than assumed:
+
+| Failure | Verdict |
+|---|---|
+| `test_umbrella_impact.py::test_manifest_maps_every_module` | **mine** — the two new modules were unmapped. Fixed by registering them under `perception` (alongside every other `construction_*` module). Now passes. |
+| `test_ci_lint_contract.py::test_lint_baseline_matches_current_tree_counts` | **pre-existing** — proven by stashing *all* my changes and re-running: `BLE001: baseline 347 != live 353` **at HEAD**. The lint ledger is already stale in the repo. |
+
+Per §82 the pre-existing failure is distinguished from an introduced regression. It was **not** "fixed" by bumping the baseline upward — the ledger may only shrink, so raising it would be exactly the dishonesty the rule forbids. Fixing it properly means removing 6 pre-existing blind excepts, which is out of this tranche's scope.
+
+## 13. Verdict
+
+### `SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL`
+
+| Gate | Status |
+|---|---|
+| G1 existing system reused | **PASS** — one classifier, one contract format, one phase machine; no parallel system |
+| G2 contextual activation | **PASS** — natural language enters Scaffolding without `/build` (measured) |
+| G3 discussion safety | **PASS** — discussion/negation/proposal create no construction state (5/5) |
+| G4 new project | **PARTIAL** — `PROJECT_BUILD` mints + bootstraps on the contextual route; not demonstrated live end-to-end |
+| G5 multi-file default | **PASS** — multi-file/implicit requests mint a governing contract |
+| G6 scope promotion | **PARTIAL** — provisional accumulation works; automatic local→multi-file *promotion* is not implemented |
+| G7 `/build` parity | **PASS** — same classifier, same contract, same transitions |
+| G8 mutation enforcement | **PASS** — live: the guard evaluates every mutating call on the real path and blocks out-of-scope |
+| G9 shell | **PASS (bounded)** — drift operators blocked; residual documented (§8) |
+| G10 generated script | **PARTIAL** — covered on the execution side; direct interception not implemented |
+| G11 subagent inheritance | **PARTIAL** — guaranteed by the hook contract (subagent calls pass through it) and documented, but **not demonstrated live** |
+| G12 child scope | **PARTIAL** — inherits the parent's contract by construction; no narrower-scope mechanism |
+| G13 continuation | **PARTIAL** — durable contract + `construction_context` readback exist; no live resume proof this tranche |
+| G14 project identity | **PASS** — `target_evidence` from repo identity + Project Registry, not CWD alone |
+| G15 completion authority | **NOT ADDRESSED** — completion still governed by the existing Scaffolding paths; this tranche did not change it |
+| G16 Spine core awareness | **PASS** — `manages` edge + relationships file |
+| G17 Spine external dependency | **PASS** — `external_dependency` entity + `depends_on` edge (tested) |
+| G18 unrelated exclusion | **PASS** — live: `stock-tool` stays UNRELATED |
+| G19 TUI truth | **NOT ADDRESSED** — TUI projection untouched |
+| G20 proportionality | **PASS** — local fixes get no contract; provisional scopes never block |
+| G21 no duplicate authority | **PASS** — the contextual entry was *extracted*, not copied (net −96 lines in the operator) |
+| G22 verification independence | **PASS** — hook tests drive the real guard via `node`; scope verdicts come from the canonical `check_scope` |
+| G23 full regression | **PASS with one pre-existing failure** (§12) |
+| G24 live proof | **PASS** — the guard is live on the real path and evaluated this session's own tool calls |
+
+**Why PARTIAL and not PROVEN:** four gates are genuinely unproven rather than failed — subagent inheritance demonstrated live (G11), continuation/resume (G13), automatic scope promotion (G6), and new-project end-to-end (G4). Claiming `PROVEN` would require evidence I did not produce.
+
+## 14. Residuals — no hidden caveats
+
+1. **Shell is reference-scanned, not predicted** (§8).
+2. **Unstated scopes do not block** — teeth require a declared or sealed scope.
+3. **One measured classification false negative**: "introduce plugin support throughout the application" → DISCUSSION → no contract. The intent layer is V1 authority; T23 did not add a second classifier to patch it.
+4. **Ambiguous phrases over-trigger** ("fix login", "add logging" → a contract with a provisional scope). Consequence is a recorded contract, not a blocked build.
+5. **`tool_executor.py` (Rune's own local runtime) is still ungated** — the harness is the surface that actually mutates today.
+6. **Pre-existing lint-ledger drift** at HEAD (§12).
+7. **Subagent enforcement is by construction, not by live demonstration.**
+8. **Bootstrapping exception (§76):** this tranche was not itself built through a Scaffolding contract — the enforcement it creates did not exist while it was being written. Recorded, not hidden.
+
+## 15. Not started (§48/§75/§97)
+
+No Memory, Agent Model, Substrate, Interaction Kernel, Mechanism Forge or Economic Operator work. E-G1/E-G2/E-G3 untouched. **HARD STOP honoured.**

docs/T24_BRIDGE_BLOCKED_AT_PREREQUISITE.md

@@ -0,0 +1,159 @@
+# T24 — ChatGPT Supervisory Bridge: BLOCKED AT THE §1 PREREQUISITE
+
+**Verdict at the time of this record: `BRIDGE_BUILD_BLOCKED_BY_SCAFFOLDING`**
+
+> **STATUS UPDATE 2026-09-24:** the §1 prerequisite has since been closed.
+> T23's six unproven/unaddressed gates were all addressed with evidence and
+> two latent defects fixed — see `docs/T23_CLOSURE.md`. T23 now returns
+> `SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`, so T24 may proceed. This record is
+> retained because its §2 findings still shape T24, and because §2.1 carries a
+> corrected claim (supervisory review, 2026-09-24).
+
+No production code was modified. No protocol was written. No repositories were
+created. The tranche stopped at its own hard gate, as the mandate requires.
+
+---
+
+## 1. Why it stopped — the §1 gate
+
+T24 §1 requires, before implementation:
+
+```
+SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN
+```
+
+The actual result of T23 (commit `15c8d36`) is:
+
+```
+SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL
+```
+
+Six gates are unproven or unaddressed (`docs/T23_SCAFFOLDING_DEFAULT_REPORT.md` §13):
+
+| Gate | State | What closes it |
+|---|---|---|
+| G4 new project end-to-end | PARTIAL | one real `PROJECT_BUILD` run, inception→verified |
+| G6 automatic scope promotion | PARTIAL | promote a local task to a contract on measured scope growth |
+| G10 generated script | PARTIAL | intercept or postcondition-verify script-mediated writes |
+| G11 subagent inheritance | PARTIAL | one delegated multi-file build, child scope inspected live |
+| G12 child scope | PARTIAL | a narrower-scope mechanism for children |
+| G13 continuation | PARTIAL | pause → fresh process → resume the same contract |
+| G15 completion authority | NOT ADDRESSED | contract obligations gate completion |
+| G19 TUI truth | NOT ADDRESSED | TUI reads authoritative backend state |
+
+§1 also states the reason the gate exists:
+
+> "Do not bypass Scaffolding to construct the system intended to connect
+> ChatGPT to Rune/MiMo."
+
+Building the bridge on a partially-proven construction path would do exactly
+that — and would make T24 the first substantial build on an unproven
+foundation, which is the specific thing the gate prevents.
+
+**Nothing was attempted underneath the gate.** Per §110 the pre-implementation
+report was not produced either, because §1 precedes it.
+
+---
+
+## 2. Findings that matter even once T23 is closed
+
+These were established while verifying the prerequisite. They are **not**
+blockers, but they change T24's shape and should be known before it restarts.
+
+### 2.1 The expected lead reference could not be reached from this environment
+
+> **CORRECTED 2026-09-24 by supervisory review.** This section previously stated
+> the repository "does not exist". That conclusion was not supported by the
+> evidence and is withdrawn. `https://github.com/DrA1lex/chatgpt-bridge` is
+> reported by the operator as current and public. The corrected record follows.
+
+T24 §3 names three starting references, and §4 expects `DrA1lex/chatgpt-bridge`
+to be "the current lead candidate for ChatGPT-Web/browser transport".
+
+Attempted from this execution environment via four independent mechanisms:
+
+| Mechanism | `DrA1lex/chatgpt-bridge` |
+|---|---|
+| `curl https://github.com/…` | 404 |
+| GitHub REST API (`/repos/…`) | 404 |
+| `codeload` tarball | 404 |
+| `git ls-remote` | `remote: Repository not found.` |
+
+Controls, same environment and moment: `Dworrall21/chatgpt-bridge` → 200,
+`l0z4n0-a1/chatgpt-bridge` → 200, `github.com` → 200, `api.github.com` → 200,
+no proxy variables set.
+
+**What this does and does not establish.** It establishes that *this
+environment cannot reach that repository today*. It does **not** establish that
+the repository is absent. "The repository is unavailable" and "this environment
+could not access it" are different claims, and four mechanisms returning the
+same status is equally consistent with a targeted network/policy condition as
+with absence. The operator's direct observation that it is public and current
+outranks an unauthenticated fetch from a sandbox.
+
+**Consequences for T24** (binding, so this cannot be repeated):
+
+* the repository **stays in the comparison matrix** — a 404 from one fetch
+  mechanism must never remove a candidate from consideration;
+* T24 re-attempts access with authenticated credentials and over a longer
+  window before drawing any conclusion;
+* if it still cannot be reached, T24 records `ENVIRONMENT_ACCESS_FAILURE` —
+  never "does not exist" — and proceeds on the two reachable references plus
+  operator-supplied material, flagging the gap explicitly rather than silently
+  substituting a different lead candidate.
+
+Same discipline the tranche applies elsewhere: absence of evidence in one
+instrument is not evidence of absence.
+
+
+### 2.2 Live ChatGPT Web requires the operator
+
+`https://chatgpt.com` returns **403** to a non-browser client, as expected.
+
+T24's core value — the actual ChatGPT Web loop (§93–§100, §111, §125 G54)
+— depends on:
+
+* a real logged-in ChatGPT browser session;
+* a browser extension or equivalent in-browser component;
+* the ability to observe and drive ChatGPT's UI.
+
+None of that is reachable from this harness. Those steps need the user present.
+T24 is therefore **not** a build that can complete autonomously, even with T23
+proven: it is a build whose final proof requires operator participation
+throughout. That is a sequencing fact, not a defect.
+
+---
+
+## 3. Recommended unblock path
+
+Ordered by cost, cheapest first. All are T23 work, not T24 work.
+
+1. **G13 continuation, G11 subagent inheritance, G4 new project** — these are
+   demonstration gaps, not missing mechanisms. Each is one disposable live run
+   against the enforcement layer already built. Lowest cost, highest gate yield.
+2. **G6 scope promotion + G12 child scope** — small mechanism work in
+   `construction_authority.py` (promote on measured growth; narrow a child's
+   scope to the delegated task's declared surface).
+3. **G10 generated script** — postcondition verification of script-mediated
+   writes, or accept and document it permanently as a residual rather than a
+   gate.
+4. **G15 completion authority, G19 TUI truth** — these were explicitly
+   *not addressed* by T23 rather than attempted. G15 is the more important of
+   the two (completion is currently announced by the builder).
+
+Closing 1–4 would plausibly yield `SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN` and
+let T24 start on the foundation the mandate intended.
+
+---
+
+## 4. What was NOT done
+
+* No generic bridge repository created.
+* No Rune bridge integration.
+* No MiMo bridge integration.
+* No protocol defined.
+* No upstream code inspected beyond reachability (no clone, no license work).
+* No production code, Memory, Scaffolding or Spine modified.
+* Research synthesis (§108/§109) not begun — it is downstream of the bridge.
+
+**HARD STOP honoured. Returning control for supervisory review.**

docs/T24_BRIDGE_DOGFOOD_REPORT.md

@@ -0,0 +1,208 @@
+# SCAFFOLDING_DOGFOOD_REPORT — T24 ChatGPT Supervisory Bridge
+
+**Purpose:** T24 is Scaffolding's first major acceptance workload. This records
+what Scaffolding actually did while the bridge was constructed, what it could
+not do, and where the bridge implementation was correct but the dogfood
+criterion was still not met. Those are different things and are kept separate.
+
+**Rule applied throughout:** a bridge slice constructed by editing code without
+the Scaffolding path, where Scaffolding should have governed it, does NOT count
+as dogfood success — even if the code is right.
+
+---
+
+## 1. How the bridge project was detected and adopted
+
+Through the **real agent route** — `construction_authority_cli begin`, the same
+op the MiMo guard hook calls on every user turn — with the actual programme
+instruction:
+
+```
+mode              = EXISTING_PROJECT_CHANGE
+activated         = True
+lifecycle         = proportional
+contract_id       = ctx-2026-09-24T19:32:52Z-implement-the-chatgpt-supervisory-bridge
+evidence          = "change scoped to an existing project/target", "target project: rune"
+```
+
+Two things are worth recording honestly:
+
+* **The classification is EXISTING_PROJECT_CHANGE, not PROJECT_BUILD** — and this
+  is CORRECT, not a miss. The bridge repository existed (a spec repo); the work
+  is a change to an existing project plus an adoption of an external dependency.
+  `PROJECT_BUILD` fires for genuinely new standalone projects. The programme's
+  §5 acceptance named `PROJECT_BUILD` as the *example* of live construction; the
+  honest substitution here is "substantial construction correctly classified
+  through the live route", which is what happened. **A toy project was
+  deliberately NOT created to trip the gate** (§5 forbids it).
+* **The activation RESUMED the existing T24 contract** rather than minting a
+  rival one — idempotent mint working as designed. One authority, no duplicate.
+
+## 2. External project registration and the Rune relationship
+
+| Step | Mechanism | Result |
+|---|---|---|
+| Adoption | `declare_relationship(chatgpt-bridge, RUNE_EXTERNAL_DEPENDENCY)` | registry + Spine `depends_on` + inspectable declaration with evidence |
+| Resolution | `rune_relationship("chatgpt-bridge")` | `RUNE_EXTERNAL_DEPENDENCY` — **not** CORE, **not** UNRELATED |
+| Boundary | bridge Project Scaffold at `/mnt/workdrive/chatgpt-bridge/store/scaffold` | its structural truth lives in ITS store |
+| Execution cwd | `ProjectRegistry.resolve_cwd("chatgpt-bridge")` | `/mnt/workdrive/chatgpt-bridge` |
+| Interface mode | `ConstructionInterface.mode` | `external_project` |
+
+The §6 distinction was exercised for real: Rune knows the dependency, its
+evidence, its location and its consumers, while the SPINE is **not** the bridge's
+ledger. **One registration defect was found and fixed**: `repo_identity` was
+first recorded as a descriptive string ("git:a5a0bbf (ChatBridge v1 spec)") and
+`resolve_cwd` returned it verbatim as a path; corrected through the owner API to
+`git:/mnt/workdrive/chatgpt-bridge`.
+
+## 3. Scaffolding resolution modes actually used
+
+| Need | Mode | Why |
+|---|---|---|
+| bridge protocol objects + negotiation | **BUILD** | nothing to reuse; the public core's whole point |
+| receipts / lifecycle / session engine | **BUILD** | deterministic truth machines with no existing equivalent |
+| connector interface + fake connector | **BUILD** | the transport contract is new; the fake is the test double |
+| CLI (doctor/status/selftest) | **BUILD** | operator surface, no existing equivalent |
+| project identity, registry, cwd resolution | **REUSE** | `ProjectRegistry`, unchanged |
+| construction authority + contracts | **REUSE** | `Scaffold`, `ConstructionInterface`, unchanged |
+| lifecycle store / atomic writes / fsync | **COMPOSE** | same discipline as the existing stores, per-repo instance |
+| MiMo execution + task identity | **REUSE** | `rune_operator.send_task` + canonical task identity |
+| Rune dependency semantics | **REUSE** | `declare_relationship` / `rune_relationship` |
+| command surface | **ADAPT** | the TUI's existing registry + dispatch table, one entry |
+| real ChatGPT browser connector | **ACQUIRE_EXTERNAL / OPERATOR_REQUIRED** | needs a logged-in session |
+
+## 4. Contracts, scope and amendments
+
+Rune side: the existing T24 contract, scope 9 entries (all user-authorised with
+references). Its obligations were recorded through the canonical
+`record_obligations` (attributed, additive) — see the conformance doc §16.
+
+Bridge side: `ctx-2026-09-26T00:00:00Z-protocol-foundation-slice`, `scope=[protocol]`
+at mint, **amended to `[core, protocol]`** when slices 2–3 landed in `core/` —
+through `record_scope_authorisation` + `amend_scope` with the user-instruction
+reference, never by widening on observation (R2).
+
+Obligations on the bridge contract: 4 acceptance, 3 verification.
+
+## 5. Affected-surface, verification and observation
+
+* Four governed slices were constructed with the canonical path; a fifth (the
+  Rune adapter) sits in the Rune contract's scope.
+* **Verification was real, not declared**: 74 bridge tests (round-trip
+  determinism, strictness, immutability, receipt rules 1–6, lifecycle/authority
+  boundaries, rollover invariant, capsule staleness, E2E chain) plus 9 adapter
+  and 8 MiMo-adapter tests on the Rune side; CLI `doctor` reaches **READY** only
+  via a verified round-trip and `selftest` runs the whole chain locally.
+* **Behaviour Ledger consequence: NONE.** The bridge does not change Rune
+  behaviour — the adapter is additive and the real connector is not
+  implemented. Stated rather than left implicit.
+* **Capability Ledger consequence: NONE yet.** The bridge is not registered as a
+  Rune capability in the ledger because it is not yet *reachable in production*
+  (no real connector). Registering it would be exactly the "implemented but
+  uncalled" claim the Runtime Reachability doctrine refuses.
+
+## 6. Fresh-session continuation proof (§24)
+
+Run in a fresh process with no transcript. Reconstructed from durable state:
+
+| Question | Answer recovered |
+|---|---|
+| is the bridge project registered? | yes — `repo_identity=git:/mnt/workdrive/chatgpt-bridge`, resolved cwd correct |
+| what is Rune's relationship to it? | `RUNE_EXTERNAL_DEPENDENCY`, with its three evidence refs |
+| current bridge contract / scope / obligations | `…protocol-foundation-slice`, `[core, protocol]`, 4 acceptance + 3 verification |
+| Rune-side active contract | `…implement-the-chatgpt-supervisory-bridge`, 9 scope entries |
+| next action | recovered from the contract |
+
+**The conversational transcript was not load-bearing.** This is the Scaffolding
+acceptance requirement, and it held.
+
+## 7. Defects — separated by category
+
+### BRIDGE_DEFECT (found by the bridge's own tests, all fixed)
+
+| # | Defect | Where |
+|---|---|---|
+| 1 | `from __future__ import annotations` made field types strings, so nested/tuple fields silently round-tripped as raw dicts | protocol |
+| 2 | `Capabilities` pinned `protocol_version` in `__post_init__`, making it impossible to even describe a remote end speaking another version — negotiation could never see a mismatch | protocol |
+| 3 | `mark_submitted` set state but never the `submitted` flag | core/receipts |
+| 4 | `_read` wrapped schema violations as corruption, blurring two distinct findings | core/receipts |
+| 5 | Authority boundaries keyed by SOURCE state, so AUTHORISED → CANCELLED wrongly demanded dispatch authority | core/lifecycle |
+| 6 | Dispatch failure forced `AUTHORISED → FAILED`, an illegal edge: lifecycle "failed" means EXECUTION failed, and nothing had executed | core/session |
+| 7 | `status()` on an unknown channel raised instead of reporting absence | core/session |
+| 8 | `core/__init__.py` absolute import broke package import | core |
+| 9 | A fresh connector per adapter call made `send` and `confirm` speak to different connectors, so dispatch evidence was invisible and submission could never become `yes` | Rune adapter |
+
+### SCAFFOLDING_DOGFOOD_DEFECT (found while USING Scaffolding, repairs in Rune)
+
+| # | Defect | Where | Repaired? |
+|---|---|---|---|
+| 1 | `_internal_path` covered only the construction store, so canonical ledgers (spine/rune_model) and the authority's own runtime state were flagged as out-of-scope writes | construction_authority.py | yes |
+| 2 | …and deriving candidates only from `store_path()` dropped the repo's own ledger when the store was overridden | construction_authority.py | yes |
+| 3 | `_resolve_authority` returned on the FIRST matching checkpoint, so an obligation record shadowed a scope authorisation under the same reference | construction_interface.py | yes |
+| 4 | …and a second variant: an ATTRIBUTED but PATHLESS phase-transition checkpoint also shadowed a real authorisation | construction_interface.py | yes |
+| 5 | The umbrella compatibility view and Spine truth had diverged bidirectionally (a regen would unmap `construction_authority`/`construction_authority_cli` and add `__main__`) | spine.py + view | yes (#416) |
+
+Every dogfood defect was repaired **and regression-tested before the bridge work
+continued** — the slices were not finished on top of a known-broken path.
+
+## 8. Manual choreography required
+
+Recorded because it is the honest measure of how much governance was real:
+
+* **Contract minting for the bridge's own scaffold** was done by direct
+  interface calls rather than by a contextual activation in the bridge project's
+  context. The path used is canonical and attributed, but it was
+  operator-driven, not agent-driven.
+* **Slice-by-slice scope amendments** were issued explicitly (each with the user
+  instruction reference) rather than being derived automatically from the work.
+  That is correct under R2, and it is also a small tax — worth noting.
+* No slice was constructed outside Scaffolding, and no state was fabricated to
+  make a gate pass.
+
+## 9. Continuation pass (2026-09-26, same day) — the non-operator-gated gaps
+
+A second pass closed the two gaps the first report WRONGLY called
+operator-gated. Scaffolding-relevant evidence from that pass:
+
+* **Classification held under pressure.** The contextual resolver initially
+  would have hijacked real construction ("refactor the bridge adapter and then
+  continue the channel" resolved as a bridge action). The canonical meaning
+  layer (`resolve_construction_intent`) separates the two cleanly — construction
+  demands read ACTION, bridge control reads DISCUSSION — so construction
+  outranks the bridge capability. This is a live demonstration that the
+  classifier boundary is load-bearing, not decorative.
+* **Declared-table truthfulness became enforceable.** The verb→action map in
+  the contextual resolver is asserted CLOSED against the capability's declared
+  actions; that assertion immediately exposed `doctor` shipping in the CLI while
+  missing from the table. Declared surfaces that omit shipped behaviour are now
+  caught mechanically.
+* **Canonical vocabulary over hand-lists.** The MiMo adapter's active-task
+  states were hand-written and wrong (`pending` is not a status; `created` was
+  missing, so a second delivery raced a fresh task). Now derived from
+  `TASK_TRANSITIONS`. Lesson recorded: wherever this programme wrote a status
+  list, the canonical authority already had one.
+* **The two state machines meet but do not merge.** Rune's task vocabulary
+  contains `awaiting_approval`; the bridge spec uses the same NAME for
+  instruction states with different semantics. The adapter transports between
+  them without aliasing them — the deliberate-investigation outcome §14 asked
+  for.
+* **No new Scaffolding defects** were exposed by this pass; the five from the
+  first pass (§7) all held. The command-surface hardening (explicit
+  `--authority`, deterministic receipt ids) reused the existing adapter seam
+  rather than adding a parallel one.
+
+## 10. Remaining mismatches (no hidden caveats)
+
+1. **No live PROJECT_BUILD end-to-end run** through the agent path — the sole
+   remaining reason `SCAFFOLDING_CANONICAL_INTENT_MATCH` is not PROVEN. The
+   bridge work is EXISTING_PROJECT_CHANGE by honest classification, and no toy
+   project was manufactured to trip the gate.
+2. **The real ChatGPT connector is OPERATOR_REQUIRED** — it needs a logged-in
+   browser session; `chatgpt.com` refuses non-browser clients.
+3. **MiMo delivery is guard-proven, not live-proven** — the translation and its
+   three rules are tested with injected dispatchers; no live end-to-end
+   delivery through a real MiMo execution is demonstrated.
+4. **The bridge repo has no remote configured** — its five commits are local.
+   Publishing it is an operator decision (it is intended to be public).
+5. **Config Manifest/doctor for the real connector** cannot report READY
+   honestly until a connector exists that can verify a round-trip.

docs/T24_CLOSURE_REPORT_2026-09-28.md

@@ -0,0 +1,46 @@
+# T24 Consolidated Closure Report — overnight closure programme + pre-live hardening
+
+_Covers the 2026-09-25 overnight autonomous closure run through the 2026-09-28
+T52 FINAL PRE-LIVE HARDENING tranche. Discharges the obligation: "one
+consolidated overnight report with starting/ending HEAD, commitments,
+residuals, next step."_
+
+## Heads
+
+| Repo | Starting HEAD (programme open) | Ending HEAD (this report) |
+|---|---|---|
+| Rune (`/mnt/workdrive/issue161-harness`, branch `m10-derive-refresh`) | pre-overnight base (T24 local structural hardening mandate, 2026-09-25) | `a798b9c` — feat(hardening): T52.2 CWD-independent spine resolution + T52.3 qualification candidate-presence precondition |
+| Public bridge (`/mnt/workdrive/chatgpt-bridge`, no remote) | `1f59422` | `bee74c8` — fix(setup): dual-form imports (only change; regression-proven, 146 strict green) |
+
+## Commitments landed (Rune)
+
+- `0c4a4d7` + `8fe4d26` — R2 scope invariant: observed paths never become authorised scope; dormant widening branch removed.
+- `e33ec54` — live-contract obligation recording, attributed (`record_obligations`).
+- `6f46f96` — `record_verification`: the producer obligation evidence never had.
+- `653f5c6` → `3aa3fef` → `8d3a941` — evidence-based structural discovery, JS discovery, semantic subsystems, durable Behaviour Ledger, setup step semantics.
+- `90584f6` + `f6a9932` + `365b519` — direct-mint fallback family; g15 basis tolerance; pyright bind-then-narrow repair. CI green.
+- `f3754e6` — canary manifest + spine regeneration.
+- `a798b9c` — T52.2/T52.3 (this tranche): canonical `spine.store_path()` resolver (CWD-independence, subprocess matrix proven from repo/home/tmp); `candidate_backend_presence` precondition in `ci_event_wait` (absent candidate = precondition failure, fail-fast 0.061s live-proven; governed publish opt-in only).
+
+## Verification evidence (this tranche, 2026-09-28)
+
+- Full Rune suite: **2787 passed, 1 skipped, 0 failed** under the project venv (python 3.13, dev+memory extras). System-python (3.14) debris failures classified ENVIRONMENTAL (sys.executable subprocesses, tarfile stderr warning) — resolved by running the suite in the project venv, matching CI's model.
+- Ratchets: pyright **115 errors / 447 warnings vs baseline 117/454 — PASS** (no upward rebaseline); silent-handler **BLE001 347 / S110 75 at baseline — PASS**.
+- Henxels `check --all --plain`: **rc=0**, 21 similar-file warnings (known debt, baselines unchanged).
+- Bridge suite: **146 strict green**, rc=0 (bridge source unchanged — regression proof).
+- Red team: 19/19 routes defended (2026-09-26, `scripts/t24_red_team.py`); recovery adversarial matrix covered by `tests/test_authority_recovery.py` (26 tests).
+- Exact-SHA dogfood: `a798b9c` published to both remotes; Gitea CI `ci.yml` **SUCCESS** via event-driven `ci_event_wait` (mode=event, wall 363s, authority=ci_runs) — the new candidate-presence precondition passed in production on its own commit.
+
+## Residuals
+
+- **Operator-gated (by design, NOT discharged):** real-selftest against the operator's authenticated chatgpt.com session — REAL_AUTHENTICATED_CHATGPT_HANDSHAKE and the seven sibling live claims remain OPERATOR_REQUIRED. Fixtures cannot promote them.
+- **User-decision (by design, NOT discharged):** EXISTING_CHAT_DISCOVERY / EXISTING_CHAT_READING = USER_DECISION_REQUIRED; OPEN_CHAT_CURRENT_IMPLEMENTATION = NOT_SUPPORTED; proposal OUT_OF_SCOPE_V1_PROPOSED / LATER (`chatgpt-bridge/docs/REAL_ACCOUNT_VERDICT_SCOPE.md`).
+- Henxels similar-file warnings (21) and giant-file baselines — known debt, unchanged.
+- GENERIC_AUTOMATIC_SEMANTIC_DOMAIN_DISCOVERY = PARTIAL (evidence is bridge-specific; no cross-project claim).
+
+## Next step
+
+Operator gate (real browser handshake per the contract's recorded operator_gate
+steps), then the next combined tranche: LIVE CHATGPT QUALIFICATION +
+OPERATIONAL BRIDGE MANAGEMENT with the four-destination ownership boundary
+(public bridge / personal MiMo / Rune repo / future GUI seam).

docs/T24_PRE_IMPLEMENTATION.md

@@ -0,0 +1,355 @@
+# T24 — PRE-IMPLEMENTATION REPORT (§110 A–K)
+
+_Amended 2026-09-24 with the LIVE CONNECTOR / ACCOUNT-SAFETY amendment. The
+amendment's priority order and three-connector model supersede the earlier
+single-transport assumption._
+
+**Status:** audit phase complete (4 repos + GemiTerm in flight) · no
+implementation started · `LOCAL_MODEL_COMPUTE_EXECUTED = NO`
+
+---
+
+## A. T23 prerequisite
+
+`SCAFFOLDING_DEFAULT_BUILD_PATH_PROVEN`. Closed over six gates plus two
+temporal boundaries and the dirty-at-seal residual. Details:
+`docs/T23_CLOSURE.md`, `docs/T23_QUALIFICATION.md`.
+
+**Dogfooding already found two real defects on T24's first governed turn**
+(see §K.4): prose slashes became the contract scope, and minting was not
+idempotent (one mandate → four contracts). Both fixed and committed
+(`b9487a1`).
+
+## B. Existing-bridge audit — complete
+
+| Repo | Language / license | Transport class | Quality | Verdict shape |
+|---|---|---|---|---|
+| `leeguooooo/chatgpt-use` | Rust / MIT | browser driver + injected JS | 125 tests, **CI never runs them** | rich mechanism source, wrong authority model |
+| `Dworrall21/chatgpt-bridge` | Python / **NO LICENSE** | MV3 extension + CDP | 11 smoke tests, **no CI** | strongest browser mechanics, **reference-only (unlicensed)** |
+| `l0z4n0-a1/chatgpt-bridge` | TypeScript / MIT | OAuth → `backend-api/codex` proxy | ~90 tests, **real CI ×3 OS** | best capability/attachment layer; transport premise rejected |
+| `DrA1lex/chatgpt-bridge` | — | — | — | **`ENVIRONMENT_ACCESS_FAILURE`** — 404 via 5 mechanisms incl. authenticated `gh api`. Still in the matrix; needs access grant or operator confirmation |
+| `gemiterm` | npm | — | — | **audit in flight** |
+
+**The single most important audit finding, and it is a design constraint:**
+any bash capability in a bridge voids filesystem path isolation entirely. Both
+projects that implement a path jail jail only their *file* tools. We will not
+offer both without a real sandbox.
+
+**Licensing gate:** `Dworrall21` has no license → all rights reserved. Its
+mechanics are usable as *reference*; code must be reimplemented, not copied.
+`chatgpt-use` (MIT) and `l0z4n0-a1` (MIT) permit reuse with attribution.
+
+## C. Reuse / license matrix — the mechanisms worth taking
+
+| Mechanism | Source | License | Verdict |
+|---|---|---|---|
+| Durable receipt state machine (`accepted→submitted→completed\|failed`; `submitted: no\|yes\|unknown`; `create_new` claim *before* send; temp+fsync+rename; `may_send` frees only `failed+no`; submitted never downgrades; dead owner → `submission_unknown`, never "not sent") | chatgpt-use | MIT | **REUSE** |
+| Server conversation record as transport truth | chatgpt-use | MIT | **REUSE** (generic connector principle) |
+| Pin / verify / reopen identity with fail-closed drift check | chatgpt-use | MIT | **REUSE** |
+| Evidence-based submit confirmation + ambiguous-submit typing | chatgpt-use | MIT | **REUSE** |
+| Capability catalogue with per-error `remedy` + exit codes | l0z4n0-a1 | MIT | **REUSE** |
+| Attachment resolver: union type, cwd confinement, denylist, byte caps, magic-byte MIME | l0z4n0-a1 | MIT | **REUSE** |
+| WS-in-service-worker + port liveness + watchdog (CSP-aware) | Dworrall21 | none | **REIMPLEMENT** (reference only) |
+| CDP multi-file drag-drop upload | Dworrall21 | none | **REIMPLEMENT** (reference only) |
+| Pinned-conversation anti-leak guard | Dworrall21 | none | **REIMPLEMENT** |
+| Surface lock (holder line, cancel-aware poll, fail-fast) | chatgpt-use | MIT | **ADAPT** — *below* the MiMo lease, at the browser-tab layer |
+| Server-side project filing (`PATCH /backend-api/conversation`) + lazy cache invalidation | chatgpt-use | MIT | **ADAPT** — the rollover-keeps-project mechanism |
+| DelegationPacket field set (`plan[]{action,target,success_criteria}`, `do_not_do`, verdict gate) | chatgpt-use | MIT | **ADAPT** — **wire format under Rune's contract only** |
+| `structured.rs` envelope + distinct exit codes + no-repair-turns | chatgpt-use | MIT | **REUSE** |
+| `resolve_path` canonicalising workspace jail | chatgpt-use | MIT | **REUSE** |
+
+**REJECT (with reasons):** direct ChatGPT→local-execute dispatch (model output
+is the authority); regex bash denylist as a safety boundary; auto-approve by
+default; holding the surface lock for a whole logical task; UI-navigation
+project entry as load-bearing; token-in-URL auth; launchd plist (macOS-only);
+`l0z4n0-a1`'s transport premise (piggybacked Codex `auth.json` — a dependency
+on a third tool's private file format); any doc claim not backed by an
+automated test.
+
+## D. Current Rune bridge surfaces
+
+Existing: `builder_bridge.py` + `builder_bridge_cli.py` + the MiMo
+`builder-bridge.ts` hook (deterministic preflight, capsule injection, zero
+model calls) · `construction_authority.py` + CLI + `scaffolding-guard.ts` (the
+enforcement edge built in T23).
+
+**T24 extends these; it does not replace them.** The supervisory bridge is a
+second consumer of the same authority, not a second authority.
+
+## E. Current MiMo extension/hook surfaces
+
+`tool.execute.before` (**wired**, can cancel a tool call via
+`output.cancel` + `cancelReason`), `experimental.chat.messages.transform`
+(wired), `tool.execute.after` (**declared but NOT wired** — measured: 485
+`before` events, zero `after` events). Hooks are TS files in
+`~/.mimocode/hooks/`, install-managed by `scripts/install_mimo_hook.py`,
+hash-verified and drift-detected. **T24 must use only wired events.**
+
+## F. Proposed protocol
+
+One versioned, provider-neutral protocol. Carried-forward invariants from the
+audits, plus the amendment:
+
+```
+ProtocolVersion + Capabilities          (capability negotiation; never assume)
+ConnectorIdentity + ConnectorMode       ← official | assisted_web | experimental_web
+RemoteProjectIdentity
+LogicalChannelIdentity                  ← outlives individual chats
+ConversationGeneration                  ← generation N → chat A; N+1 → chat B
+InstructionEnvelope + InstructionRevision   (immutable once staged)
+AttachmentManifest + ArtifactManifest
+ControlEvent                            (origin/authority preserved)
+ExecutionLeaseReference                 (single; MIMO_EXECUTION_CAPACITY = 1)
+ExecutionStatus + CompletionPacket + FailurePacket
+ContinuationCapsule
+TransportState                          ← NEW: which transport served which op
+AccountSafetyState                      ← NEW: AUTO_OK | DEGRADED | ASSISTED | BLOCKED
+```
+
+**Two amendment-driven additions to the data model:**
+1. `TransportState` is per-operation, per-channel. Switching transport must
+   never change task identity, instruction revision, project mapping, logical
+   channel, execution lease, contract or authority state. **Connector choice is
+   transport state, not task authority.**
+2. `AccountSafetyState` is a first-class protocol field, not an implementation
+   detail — the canonical verdict depends on it.
+
+## G. Repo boundaries
+
+```
+                 COMMON BRIDGE PROTOCOL (versioned, capability-negotiated)
+                                │
+        ┌───────────────────────┼───────────────────────┐
+        ▼                       ▼                       ▼
+  GENERIC CORE            RUNE NATIVE             MIMO NATIVE
+  (new external repo)     (inside Rune)           (inside MiMoCode)
+```
+
+The generic core must not import Rune or MiMo concepts, must not hardcode any
+user/account/environment detail, and must run with a **dummy harness**.
+Rune-essential relationship: the generic core is an
+**`RUNE_EXTERNAL_DEPENDENCY`** (Rune depends on it; it is not Rune core), with
+the Rune and MiMo adapters being Rune-native/MiMo-native respectively —
+registered accordingly via the existing Spine/Registry surfaces.
+
+## H. Authentication approach
+
+`user authenticates directly with the provider → bridge gains authenticated
+session capability`. No reusable password ever enters the bridge. Secrets, if
+any, via the host credential store with restrictive permissions, redacted from
+logs, excluded from exports. A dedicated browser profile is supported and
+configurable, never hardcoded.
+
+**Authority source principle (from audit, adopted):** the page is the
+keyboard; the **server conversation record is transport truth**. Page state is
+never the authority for whether a turn landed or finished.
+
+## I. Project awareness
+
+ChatGPT Projects are a *provider capability*, negotiated not assumed. Two-layer
+model: **project = durable remote container**; **conversation = replaceable
+transport unit** that can be filed into the project server-side. That maps 1:1
+onto Remote Project → Logical Channel → Chat Generation, and is what makes
+"rollover keeps the same project" achievable. Project context is useful but is
+**never** Rune authority.
+
+## J. Chat rollover capability and gaps
+
+**Supported by audit evidence:** in-place new-chat (measured 1 backend request
+vs 45 for a full reload), server-side filing via
+`PATCH /backend-api/conversation`, lazy cache invalidation on 404/400/403.
+
+**Gaps:** successor-in-same-project via backend filing is an
+*experimental-web* capability; through the **official** connector it may be
+unavailable entirely, and through the **assisted** connector it reduces to the
+single gesture "create the successor chat". Rollover must therefore degrade to
+`ASSISTED` cleanly rather than assuming automation.
+
+**Invariant regardless of transport:** rollover never changes authority.
+`DRAFT` stays `DRAFT`; `RUNNING` stays the same execution.
+
+## K. Minimal implementation delta, and the amendment
+
+### K.1 Priority order (binding)
+
+```
+P0  ACCOUNT PRESERVATION
+P1  FUNCTIONAL COMPLETENESS
+P2  MAXIMUM RELIABLE AUTOMATION
+P3  MINIMUM USER FRICTION
+P4  EXPERIMENTAL TRANSPORT PARITY / RESEARCH
+```
+
+**Explicitly prohibited as design goals or mechanisms** — not to be
+implemented even where the audited projects do it: fake-human typing,
+randomised stealth delays, fingerprint spoofing, CAPTCHA/challenge bypass,
+rate-limit circumvention, hiding automation from the provider, and any
+mechanism whose purpose is to make prohibited automation appear manual.
+**Provider refusal is respected, not routed around.** This is stricter than
+every audited project, and it is why their automation cores are REJECTed as
+foundations.
+
+### K.2 Three first-class connector modes
+
+| Mode | What it is | Default |
+|---|---|---|
+| **A — Official** | documented/available provider interfaces (API/MCP/Apps). Probe the user's *actually available* capabilities; public Plugin Store submission is optional and never a dependency | enabled where available |
+| **B — Assisted Web** | a **real production connector**: Rune does all surrounding work (project mapping, channel identity, generation/lineage, revision state, attachment prep, result destination, continuation capsule, rollover readiness, execution state, provenance) and stops at a **USER ACTION boundary** for only the unsupported provider action | enabled |
+| **C — Experimental automated Web** | the browser/session automation path, built and technically tested | **DISABLED by default, structurally separate, explicitly EXPERIMENTAL**, never represented as provider-supported |
+
+### K.3 Account-safety governor — automation-preserving
+
+```
+AUTO_OK → DEGRADED → ASSISTED → BLOCKED
+```
+
+`AUTO_OK` permits ordinary automated interaction where technically viable
+(project/chat selection, dispatch, retrieval, continuation, attachment
+transfer, status/evidence exchange, safe retries, channel maintenance).
+**No arbitrary messages/day caps, no human-like sleeps, no confirmation every
+turn, no blanket manual approval.** Escalation is evidence-driven:
+
+* `DEGRADED` — transient transport failure; ambiguous submit/response state;
+  recoverable UI/provider change; ordinary throttling.
+* `ASSISTED` — login required; provider challenge; explicit provider
+  confirmation; ambiguous account/session ownership; unknown consequential UI
+  state.
+* `BLOCKED` — account/security warning; explicit refusal not legitimately
+  retryable; a requirement to circumvent provider protection; inability to
+  prove task/conversation identity.
+
+After user intervention, verify and **return to `AUTO_OK` automatically**.
+`ASSISTED` is a recovery mode, not a shutdown.
+
+### K.4 Task authority ≠ turn authority
+
+Once an instruction revision is legitimately AUTHORISED, the mechanical turns
+needed to complete it do not require per-turn approval. Renewed authority is
+required only at genuine authority boundaries (consequential scope change;
+superseding revision; revival of superseded work; resume after explicit
+pause/cancel where policy requires; account/security change).
+
+### K.5 Mixed transports, one channel
+
+A logical channel may use a different transport per operation while preserving
+one authoritative Rune state. Transport switching must not alter task
+identity, revision, project mapping, channel, lease, contract or authority.
+
+### K.6 Verdict taxonomy (must not be collapsed)
+
+```
+OFFICIAL_CONNECTOR_PROVEN
+ASSISTED_WEB_CONNECTOR_PROVEN
+EXPERIMENTAL_WEB_CONNECTOR_TECHNICALLY_PROVEN
+```
+
+A successful automated-Web E2E proves **technical functionality only** — it
+does not prove provider support or account safety. Canonical bridge completion
+does not depend on the experimental connector being account-safe.
+
+### K.7 Comparative acceptance
+
+Equivalent fixtures run through all three modes, measuring: functionality
+coverage · degree of automation · user gestures · project-context fidelity ·
+attachment fidelity · continuation/rollover · artifact return · latency ·
+recovery · duplicate-submit safety · provider interventions · assisted
+fallbacks · recoveries to `AUTO_OK` · compute overhead · reliability.
+
+### K.8 Checkpoint semantics
+
+Commits are checkpoints, not stop events. A commit, milestone or green
+sub-phase records progress and continues; it does not release the lease or
+require re-authorisation. T24 stops only on explicit pause/stop/cancel, a
+genuine blocking condition needing user action, an operator-assisted gate, or
+the terminal verdict.
+
+### K.9 Defect found while writing this report
+
+**The intent-layer DISCUSSION gate mis-classifies constraint-heavy
+implementation mandates.** This amendment — substantially "Do NOT restart",
+"Explicitly prohibited", "must be incorporated" — was classified
+`NOT_CONSTRUCTION` / `DISCUSSION` by the live hook (guard log 19:21:46 and
+19:22:03), so it minted no contract and T24 currently runs **ungoverned**.
+
+Evidence: `grep "begin:" /tmp/rune-scaffolding-guard.log` shows
+`mode=NOT_CONSTRUCTION activated=false intent=DISCUSSION` for this mandate.
+
+This is the highest-cost classification class (a consequential build read as
+discussion). It is recorded, not hidden; the sanctioned workaround is the
+explicit `/scaffold-mode` override, and the proper fix is a classifier that
+recognises imperative/prohibitive implementation language as construction
+rather than discussion. **Not silently patched here** — it is V1 authority and
+deserves its own change.
+
+---
+
+## Next, continuing now
+
+1. GemiTerm audit (in flight) → fold into §B/§C.
+2. Protocol artefacts (`protocol/` schemas + capability negotiation).
+3. Generic harness-agnostic repository (dummy-harness provable).
+4. Rune-native integration · MiMo-native integration.
+5. Three connector modes · safety governor · fixtures · setup/doctor/capabilities
+   · continuation/rollover · files/artifacts · recovery · comparative tests.
+
+_Operator-assisted gates (authenticated ChatGPT session; DrA1lex access
+confirmation) will be requested with the minimum necessary action and the same
+workstream resumed afterwards._
+
+---
+
+## L. GemiTerm audit (added by amendment §6) — complete
+
+`gemiterm` v3.1.1, MIT, repo `Expert-Vision-Software/gemiterm`, commit
+`841a3ed` (verified = npm `gitHead`). Access: registry metadata + clone both
+succeeded.
+
+**Quality — verified by running** (`bun` installed to a `/tmp` prefix for the
+audit): **1136 pass / 2 skip / 0 fail across 86 files**. CI runs the suite,
+`tsc --noEmit`, a path-mediation lint, a blocking auth-regression gate and a
+nightly auth canary. Unusually well-engineered; doc-vs-code contradictions:
+none material (one cosmetic registry-description corruption).
+
+**The decisive finding for us:** every capability (list / fetch / export /
+continue / delete / models) is reproducible through the **official Gemini
+API** or Google Takeout. **Nothing here genuinely requires automated browser
+control** — the browser is used only because the author chose the free
+unofficial path over an official one. Its transport is a reverse-engineered
+web-internal API (`gemini-web-sdk`, successor to `gemini-reverse`) driven by
+full Google-account cookies (`__Secure-1PSID/1PSIDTS`), with headless rotation
+to keep that unofficial session alive. **No CAPTCHA bypass, no fingerprint
+spoofing beyond a static UA, no proxy/IP evasion** — but a persistent-cookie
+headless browser polling the web app is anti-abuse-adjacent by provenance, so
+**REJECT regardless of the absence of explicit evasion code.** That is exactly
+the P0 line the amendment draws.
+
+| Mechanism | Verdict | Why |
+|---|---|---|
+| Single-flight cross-process lock + stale sweep + lock observer | **ADAPT** | generic choreography, no provider specifics; good fit under our lease |
+| live/phantom/dead session classifier with exit code as machine-readable health | **REUSE** | agent-native health without scraping docs |
+| structured error translation with actionable remediation | **REUSE** | matches our failure-taxonomy + `remedy` shape |
+| chat-metadata cursor persistence (`rid/rcid/ctx`) | **ADAPT** | durable conversation cursor; complements our receipt ledger |
+| cookie-jar store with CAS locks | ADAPT | the *pattern*; the credential is rejected |
+| Playwright headed-login cookie capture | **REJECT** | automated provider login |
+| headless cookie rotation / keepalive | **REJECT** | automates keeping an unofficial session alive |
+| `gemini-web-sdk` / `gemini-reverse` transport | **REJECT** | reverse-engineered endpoint; availability + ToS risk |
+| external `npx skills add` installer | **REJECT** | pulls remote content into agent context; supply-chain surface |
+
+**Security gap worth noting:** no `chmod`/0600 anywhere in `src/` — cookie jars
+sit at default umask permissions, and the cookies are full Google-account
+scope, not Gemini-scoped. Our bridge stores no such credential at all.
+
+**Analogous mechanisms across the five audited sources.** The same three
+patterns recur independently, which is the strongest evidence they are right:
+
+| Pattern | seen in |
+|---|---|
+| durable cursor/receipt for in-flight intent | chatgpt-use, gemiterm |
+| single-flight cross-process lock | chatgpt-use, gemiterm |
+| machine-readable health + remediable structured errors | gemiterm, l0z4n0-a1 |
+
+**Two audit techniques worth keeping**, both from this audit: install a
+project's runtime into a `/tmp` prefix rather than the system (how `bun` tests
+were run without touching CachyOS); and treat a 404 from one fetch mechanism as
+*unknown*, never as *absent* — the DrA1lex case in §B remains
+`ENVIRONMENT_ACCESS_FAILURE` for exactly this reason.

docs/UNIFIED_LIFECYCLE_ADDENDUM_MAP.md

@@ -0,0 +1,60 @@
+# GITEA_EXISTING_ISSUE_LIFECYCLE_MAP — addendum compliance record (2026-09-26)
+
+Full trace: tasks/T37 addendum section + the issue-lifecycle probe report
+(preserved in session notes). This is the decision record for the unified
+lifecycle's integration with the EXISTING Gitea process.
+
+## Mapped existing process (verified file:line, condensed)
+
+| Action | Owner | Effect | Preserved? |
+|---|---|---|---|
+| File issue | Operator via templates (blank disabled, canary-enforced) | create; kind spine → auto-label | YES — lifecycle links, never creates by default |
+| Priority gate | auto-label.yml:13-44 | `unprioritized` added/removed | YES — untouched |
+| Type/umbrella labels | auto-label.yml:46-163 | managed set add/remove; declared kind beats keywords | YES — lifecycle never sets labels |
+| Dep-order gate | pipeline-gate.yml:20-87 (`ready` label) | READY/blocked comments; label transitions | YES — observed |
+| Research-clear (4-phase) | pipeline-gate.yml:166-392 | `research-pending`→`in-progress` (NOT closure) | YES — observed |
+| Teach/next-up | pipeline-gate.yml:89-164 | NEXT comment; `ready` label | YES — observed |
+| Merge-on-green | merge-robot.yml + merge_robot.py | merge POST; never closes issues | YES — observed |
+| Close | HUMAN (closing-comment standard; closes/fixes #N PR convention referenced) | state=closed | YES — Rune posts final evidence and REQUESTS; never closes |
+| Reopen | none exists | — | YES — no invented reopen |
+| Reconcile/audit | gitea_reconciliation_check.py (CI) | read-only drift report | YES |
+
+## Lifecycle integration decisions (each trace-backed)
+
+1. LINK, don't create: IssueLink.resolve without an explicit client reports
+   honestly; attach_explicit records operator-supplied issues; opt-in creation
+   is origin-tagged `lifecycle-created` so it can never masquerade as an
+   operator filing. Retry/restart/candidate-rerun reuse the same issue (tested).
+2. Research binding uses the LINKED issue number verbatim — the executor's
+   run identity `research-<issue>-r<round>` resolves through
+   contract_for_research_run against the operator's issue. Synthesized issue
+   numbers removed from the dispatch.
+3. Closure: Rune posts final evidence + requests closure; the human performs
+   it. Semantic layers kept separate (addendum §8): issue-closed = human said
+   so; Rune COMPLETE = stronger (basis gates + verification + qualification)
+   and may outlive closure.
+4. Candidate branch = `issue-{N}` — the existing edge, formalized.
+5. No labels are set by Rune. No workflow YAML rewritten. Merge-robot and
+   required-checks observed, not bypassed.
+
+## Verdict set (addendum §16)
+
+GITEA_EXISTING_PROCESS_MAPPED = PROVEN
+GITEA_EXISTING_ISSUE_CREATION_PRESERVED = PROVEN (creation remains
+  operator-owned; lifecycle default = link; opt-in creation origin-tagged)
+GITEA_EXISTING_LABEL_AUTOMATION_PRESERVED = PROVEN (lifecycle never touches
+  labels; auto-label observed)
+GITEA_EXISTING_CLOSE_PROCESS_PRESERVED = PROVEN (no second close path; final
+  evidence + request only; tested)
+GITEA_EXISTING_REOPEN_PROCESS_PRESERVED = PROVEN (NOT_APPLICABLE — none exists;
+  none invented)
+GITEA_EXISTING_MERGE_PROCESS_PRESERVED = PROVEN (merge-robot observed)
+GITEA_EXISTING_VERSION_RELEASE_PROCESS_PRESERVED = PROVEN (untouched)
+GITEA_RUNNER_SEMANTICS_PRESERVED = PROVEN (exact-SHA waits, required checks,
+  deploy-identity readback all untouched; anti-override tested in scenario
+  proofs)
+GITEA_RUNE_LIFECYCLE_INTEGRATION = PARTIAL (link/bind/projection wired and
+  tested; live end-to-end through a real operator-filed issue awaits a real
+  candidate run)
+NO_DUPLICATE_GITEA_LIFECYCLE = PROVEN (single link per task — reuse tested;
+  no second close path; no label writes; tested)

henxels.yaml

@@ -31,6 +31,17 @@ henxels:
       - ./src/rune/curator.py
       - ./src/rune/tool_executor.py
       - ./src/rune/warm_router.py
+      # T24 final qualification (user-authorised 2026-09-25, bounded).
+      # MEASURED BASELINE — both were ALREADY over the threshold before the
+      # T24 V1-completion tranche; the tranche grew them further:
+      #   construction_authority.py: 1475 -> 1625  (+150)
+      #   construction_interface.py: 1250 -> 1907  (+657)
+      # Registered as TRACKED, DATED debt through the existing allowance
+      # mechanism — the plugin's own instructed remedy. The threshold is
+      # unchanged, the statement is not disabled, no other finding is
+      # suppressed. Decomposition is residual R5.
+      - ./src/rune/construction_authority.py
+      - ./src/rune/construction_interface.py
     max_lines: 1200
 
   - henxel: "The umbrella impact map is complete and truthful — every module mapped, no phantom entries"

lint-baseline.json

@@ -1,4 +1,4 @@
 {
-  "BLE001": 347,
-  "S110": 75
+ "BLE001": 346,
+ "S110": 75
 }

requirements-ci.txt

@@ -1,5 +1,5 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml -o /tmp/req_new.txt --extra dev --extra memory --python-version 3.11
+#    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11 --exclude-newer 2026-09-26T17:29:53Z
 aiohappyeyeballs==2.7.1
     # via aiohttp
 aiohttp==3.14.3
@@ -20,7 +20,7 @@ chardet==7.6.0
     # via diff-cover
 coverage==7.16.1
     # via rune (pyproject.toml)
-diff-cover==10.5.1
+diff-cover==10.6.0
     # via rune (pyproject.toml)
 frozenlist==1.8.0
     # via
@@ -56,15 +56,15 @@ mdit-py-plugins==0.6.1
     # via textual
 mdurl==0.1.2
     # via markdown-it-py
-multidict==6.9.0
+multidict==6.9.1
     # via
     #   aiohttp
     #   yarl
-nodeenv==1.10.0
+nodeenv==1.11.0
     # via pyright
 packaging==26.3
     # via pytest
-platformdirs==4.11.11
+platformdirs==4.12.0
     # via textual
 pluggy==1.6.0
     # via

research/RESEARCH_PIPELINE_GUIDE.md

@@ -0,0 +1,311 @@
+# The Research Pipeline — A Complete Technical Guide
+
+_How the Memory Research Atlas runs: one controller, serial research actors, row-derived arithmetic, a mechanical gate, and a freeze-then-seal closeout. Everything below is how domains #391–#399 were actually executed (2026-09-20/21), not theory._
+
+---
+
+## 0. What this pipeline is for
+
+Answering an architecture question for an AI assistant ("how should Rune model the user?", "what does provenance mean here?") **rigorously enough to build on** — with every claim traceable to a source read at a stated depth, every total machine-derived from rows, every weakness attacked by an agent who didn't write the answer, and a seal commit you can point to forever.
+
+The core insight the pipeline encodes: **self-attested quality degrades under context pressure.** An overnight run produced 16 of 31 domains batched at reduced depth and nothing structural noticed. The fix was never "try harder" — it was a mechanical gate that refuses to pass a domain that doesn't meet its declared grade.
+
+---
+
+## 1. The pipeline at a glance
+
+```
+ISSUE
+  ↓  (reopen/create Gitea issue, canonicalize folder, preserve preliminary byte-for-byte)
+INWARD
+  ↓  (read-only audit of the real system — row counts, classifications)
+OUTWARD
+  ↓  (serial research arms, ONE actor at a time, each persisted before the next)
+APPLICABILITY        (mechanisms → ADOPT/ADAPT/EXPERIMENT/FUTURE/REJECT/PARK rows)
+  ↓
+INNOVATION           (candidates A–J: prior art, falsifier, kill criterion each)
+  ↓
+ADVERSARIAL  ↺       (fresh-context actor attacks A–AZ+; SUCCEEDS fixed in place)
+  ↓
+SYNTHESIS    ↺       (matrices; targeted OUTWARD/INWARD if contradiction remains)
+  ↓
+QUALIFY              (every mandate question answered with a verdict row)
+  ↓
+MASTER               (standalone-readable document, everything above synthesized)
+  ↓
+CONTENT_FREEZE_AUDIT (the LAST content/accounting write)
+  ↓
+FINAL_CONTENT_GATE   (mechanical: scripts/research_gate_check.py)
+  ↓
+SEAL_COMMIT          (one commit, everything)
+  ↓
+PUSH / MIRROR / GITEA / POST_CLOSEOUT_RECEIPT
+  ↓
+STOP
+```
+
+Each stage leaves **durable evidence** — a file in the domain folder. A stage without an artifact did not happen.
+
+---
+
+## 2. Domain folder structure (canonical layout)
+
+```
+research/memory-atlas-r1/<X>-<domain-name>/
+├── 00_issue_scope.md                  # mandate, boundaries, stage plan
+├── 01_inward.md                       # READ-ONLY audit: measured row counts, classifications
+├── 02_outward/
+│   ├── arm1_<topic>.md                # each arm's full report (provenance header mandatory)
+│   ├── arm2_<topic>.md
+│   ├── arm3_<topic>.md
+│   ├── arm4_adversarial_pass.md       # mirror of 05_adversarial.md
+│   └── source_depth_topup.md          # (repair runs only)
+├── 03_applicability.md                # mechanism table + verdict column (machine-parsed)
+├── 04_innovation.md                   # candidates with falsifiers
+├── 05_adversarial.md                  # attack rows (machine-parsed: "- K. SUCCEEDS — reason")
+├── 06_synthesis.md                    # matrices A–J
+├── 07_qualification.md                # Q-rows answering every mandate question
+├── claims.json                        # machine-valid claim ledger
+├── sources.md                         # source ledger (machine-parsed for depths)
+├── r0_reconciliation.md               # R0 claims → CONFIRMED/REFINED/OVERTURNED/STILL_UNKNOWN
+├── preliminary_reconciliation.md      # same for the batched preliminary
+├── evidence_saturation.md             # branch table + SATURATION verdict
+├── reconciliation_arithmetic_check.txt# machine-generated totals
+├── mutation_audit.md                  # CONTENT-FREEZE AUDIT (always written LAST)
+├── <DOMAIN>_R1_BATCHED_PRELIMINARY.md # prior work, byte-for-byte, never patched
+└── <DOMAIN>_R1_MASTER.md              # the deliverable: standalone-readable
+```
+
+**The preliminary rule:** any pre-existing master is renamed `*_R1_BATCHED_PRELIMINARY.md`, its sha256 recorded, and it is **never edited**. Deep research *reconciles* against it in `preliminary_reconciliation.md` (CONFIRMED / REFINED / OVERTURNED / STILL_UNKNOWN per claim) — it never patches it. Preserving what you're correcting is how you prove the correction happened.
+
+---
+
+## 3. Stage specifications
+
+### 3.1 ISSUE
+Reopen (or create) the Gitea issue with a start comment recording the mandate scope. Canonicalize the folder name. Record the preliminary's sha256. Write `00_issue_scope.md`: what the domain owns, what neighboring domains own (the seam), the research-only boundary, concurrency rules.
+
+**Seam discipline:** adjacent domains own adjacent questions. #397 owns *where* user-model state came from; #398 owns *whether to infer/store/use it*; #399 owns *what Rune itself is*. #398 defers relational semantics to #399 with evidence; #399 defines the expression contract that #400's machinery will fill. A domain that solves a neighbor's question has stolen its seam.
+
+### 3.2 INWARD (read-only)
+Audit the *actual system* — never infer behavior from schema existence. Every claim is a measured row count:
+
+```
+sqlite3 -readonly ~/.config/opencode/memory/store/memory.db \
+  "SELECT topic, COUNT(*) FROM entries GROUP BY topic;"
+```
+
+Classify every mechanism: **CANONICAL / DERIVED / ADVISORY / DORMANT / DEAD / ABSENT / CONFLICTING / UNKNOWN**. A table with 0 rows is DORMANT, not functional. Code with no caller is DEAD. The inward audit is where you find "designed three times, written zero times" — the single most valuable sentence a domain can produce.
+
+### 3.3 OUTWARD (serial arms)
+Research arms run **strictly serially**: arm-1 → persist → arm-2 → persist → arm-3 → persist. `MAX_CONCURRENT_SUBAGENTS = 1` (controller + one actor). Each arm gets a fresh-context actor with a bounded brief (under ~3500 words), returns a report the controller integrates — actors never edit files.
+
+**Actor failure handling:** a transient APIError → respawn with a *tighter* brief. A stall (no activity ~380s+) → nudge via inbox; second nudge with "emit what you have honestly" before considering cancel. Never launch the next actor before the current one resolves.
+
+**Citation discipline (hard-won):** every arXiv ID/DOI verified by actual fetch or marked UNVERIFIED. Confabulated citations are the atlas's most common defect class — four caught in one domain ("Ledger (Kumar, NeurIPS 2020)" didn't exist; 1,898 proceedings titles grepped). Venue corrections happen (Ur et al. is SOUPS 2012, not CHI). "Prior knowledge" is NEVER labeled as a read depth.
+
+**Read-depth contract:** `FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / CODE_AUDITED / ABSTRACT_ONLY / METADATA_VERIFIED / REPLICATED / UNVERIFIED`. A depth label means *actually read to that depth during this run*. The mechanical gate fails a row claiming FULL_PAPER while admitting "not fetched" or "prior knowledge".
+
+**Load-bearing sources** (those carrying architecture decisions) need FULL_PAPER or RELEVANT_SECTIONS *where accessible*; shallower rows carry explicit reasons: `inaccessible`, `corroborating-only`, `non-load-bearing`, `parked`. Saturation cannot silently convert shallow evidence into deep evidence.
+
+### 3.4 APPLICABILITY
+Every mechanism from the arms becomes a table row with a verdict:
+
+| Verdict | Meaning |
+|---|---|
+| COVERED | already present and working |
+| ADOPT | adopt as-is into the architecture |
+| ADAPT | adopt with Rune-specific modification |
+| EXPERIMENT | promising, unproven — design experiment E-n |
+| FUTURE | trigger-gated (e.g., "when a second node exists") |
+| REJECT | refused, with the evidence that refuses it |
+| PARK | owned by another domain (#402 security, etc.) |
+
+The verdict column is machine-parsed — totals come from rows, never from prose.
+
+### 3.5 INNOVATION
+No manufactured novelty. Each candidate states: prior art, evidence for, evidence against, Rune inward evidence, transfer assumptions, classification, evidence level, falsifier, kill criterion. The falsifier is the cheapest disproof; the kill criterion is when you abandon the idea even if it was yours.
+
+### 3.6 ADVERSARIAL PASS (structural independence)
+**One fresh-context actor that did not write the architecture.** This is structural, not aspirational — a same-context "adversarial" section is not an adversarial pass and the gate checks provenance.
+
+Format contract (machine-parsed — one line per attack):
+```
+- K. SUCCEEDS — reason with architecture consequence
+- L. PARTIAL — reason
+- M. FAILS — reason
+Row-derived: SUCCEEDS 19 · PARTIAL 20 · FAILS 19
+```
+
+The adversarial arm attacks the *architecture*, not the literature. Its value is measured in SUCCEEDS: domain #398 found 6 (constraint-masquerade, unidentifiable drift, the dead loop); domain #399 found 19 (unsigned lineage forgery, farmable recurrence gates, narrative leakage). Every SUCCEEDS gets fixed in-place **before freeze**, and the fix is recorded in the master.
+
+### 3.7 SYNTHESIS
+Matrices that make ownership and precedence unambiguous. Domain #399 produced ten: identity-strata, continuity, persona-trait, self-report, relational-language, identity-change, fork/instance, ownership, failure-mode, cross-domain. A matrix row that can't name its canonical owner is an unresolved conflict, not a design.
+
+### 3.8 QUALIFY
+Every mandate question becomes a Q-row with a verdict. Domain #399: 35 questions → 32 ADOPT / 3 ADAPT. The row parser counts verdicts — if your prose says 35 but only 34 rows parse, the gate fails you.
+
+---
+
+## 4. The evidence discipline
+
+### 4.1 Evidence levels (never silently promoted)
+```
+EXTERNALLY_ESTABLISHED      strong evidence in the original field
+RUNE_APPLICABLE             same underlying problem, transfers with adaptation
+RUNE_HYPOTHESIS             plausible, undemonstrated on Rune
+RUNE_EXPERIMENTALLY_SUPPORTED  controlled Rune-specific experiment
+RUNE_PROVEN                 production/runtime evidence in Rune
+```
+
+**Never combine** an external empirical fact with a Rune-specific design prescription under one EXTERNALLY_ESTABLISHED claim — split them (C014a external finding / C014b Rune transfer). Architecture analogies are not Rune proof. Domain #399 rejected Big Five inventories as governance signals on external evidence alone — that's a legitimate pure-negative EXTERNALLY_ESTABLISHED claim; the replacement battery is a separate RUNE_HYPOTHESIS.
+
+### 4.2 Row truth (the arithmetic discipline)
+**Narrative bends, rows don't.** Every total (applicability 48, adversarial 58, claims 12…) is machine-counted from the canonical row files, and the master's prose must match. The recurring failure this kills: writing "14 claims" when claims.json holds 12, or "CONFIRMED 4 · REFINED 5" when rows read 5 · 4. When a correction changes a row, recompute mechanically — never preserve a total to avoid arithmetic.
+
+### 4.3 Source ledger
+One table, one row per source: ID (A1-1…), authors, year, venue/ID, type, read depth, relevance, confidence, lesson. Duplicates are *intentional and labeled* (LedgerMind verified twice = 40 rows / 39 unique). The gate derives rows, unique count (arXiv → DOI → title matching), and depth histogram mechanically.
+
+### 4.4 Saturation
+`evidence_saturation.md` opens every mandated branch (10–21 depending on domain), records late-search results, and declares `SATURATION = REACHED` **only** when new high-quality sources repeat known mechanisms rather than introducing new ones. The gate fails a sealed domain whose saturation still says `IN_PROGRESS` or carries a pending arm — unless the pending item is explicitly classified `NON_LOAD_BEARING_GAP`.
+
+---
+
+## 5. The mechanical gate
+
+`scripts/research_gate_check.py` (~1000 lines, research-only) is the arbiter. A domain closes only when:
+
+```
+.test-venv/bin/python scripts/research_gate_check.py check \
+    research/memory-atlas-r1/<domain-dir> \
+    --grade R1_FULL \
+    --registry research/memory-atlas-r1/domain_registry.md
+```
+
+prints `research gate consistent`. Exit 1 with findings otherwise.
+
+**What it checks (checks accumulated per domain repair — each was a defect that escaped):**
+- stage files present with substance floors (byte minimums)
+- master not a stub; domain ≥20KB markdown for R1_FULL; traceable identifiers (arXiv/DOI/RFC/ISO) exist somewhere
+- adversarial rows parse and match stated SUCCEEDS/PARTIAL/FAILS totals
+- R0/preliminary/applicability/qualification self-totals match their rows
+- master-referenced totals match the canonical files
+- master aggregate lines ("applicability: 48") match row-derived counts
+- mutation-audit staleness (no file modified after the freeze audit)
+- master mutation categories vs mutation_audit.md sync
+- evidence-saturation finality (no IN_PROGRESS / pending arms)
+- process-truth sync (actor stalls, canonical receipts)
+- source-ledger row/unique/depth counts vs master §43
+- **read-depth honesty** (deep label + "prior knowledge"/"not fetched" = FAIL)
+- **claim evidence-level arithmetic** (claims.json totals vs master)
+- **continue-count truth** (master may not claim fewer user resumes than the audit records; last-occurrence matching)
+- **load-bearing depth reasons** (shallow rows need explicit justification)
+- negative controls: every new check ships with a restored-defect test proving it FAILS
+
+**The pattern to learn:** every check exists because a real defect escaped. Don't write checks speculatively — write them when a defect is caught, and always include the negative control (restore the defect → gate must fail).
+
+**Grades:** `R1_FULL` (everything above) and `R1_LITE` (master + sources + adversarial record + R0 reconciliation) — but R1_LITE must be declared in the registry at domain *start*. Silent scope reduction is gate drift. **Breadth before depth is the only legal trade**: pressure reduces the number of domains, never the depth of one.
+
+---
+
+## 6. Concurrency, process truth, and recovery
+
+### 6.1 Concurrency
+One controller, one actor, serial arms. The controller works while an actor runs (pre-draft synthesis, stage the next arm's prompt) but never launches two actors. Stall recovery: nudge → nudge ("emit what you have honestly") → cancel-and-cover. Actor APIError → respawn with tighter brief. **Reduce parallelism, never depth.**
+
+### 6.2 The no-user-continue loop
+Every stage is an internal checkpoint. While any required stage is incomplete and no genuine user-only blocker exists, execute the next stage immediately. Recoverable failure ≠ stop condition. The only legitimate stops: domain complete, genuine user-only blocker, or hard runtime limit with a persisted checkpoint.
+
+### 6.3 Process truth (the honesty invariant)
+Record exactly, in both the master and the freeze audit:
+- `CONTINUOUS_EXECUTION = FAILED_<N>_TIMES` — count literal user "continue" messages (verify against the trajectory DB, don't guess; domain #398's audit initially said TWICE, the repair mandate said FIVE, and the DB said FIVE — the DB wins)
+- provider-capacity faults (0 observed ≠ what the mandate claims; record both)
+- actor failures, stalls, retries, substitutions
+- source failures and blocked branches
+
+A full pipeline may PASS while continuous execution FAILED. Those are different facts. Never undercount resumes.
+
+### 6.4 Provider-capacity doctrine
+On quota/rate/capacity faults: persist exact checkpoint → if an authorized compatible provider exists, fail over and resume → else emit exactly ONE `PROVIDER_CAPACITY_BLOCKED` state (provider, failure, completed stage, NEXT_STAGE, checkpoint). Never a repeated continue loop. Never fabricate availability.
+
+---
+
+## 7. Canonical memory interaction
+
+A domain summary may be written to canonical Memory (the persistent store) — but **intended ≠ executed**. Verify the actual receipt:
+
+```json
+{"added": true, "decision": "superseded", "id": 187824, "prior_id": 187382,
+ "reason": "new info replaces #187382 (sim 0.76, +64 chars)"}
+```
+
+Record receipt ID, decision (`created`/`duplicate`/`superseded`), prior_id, similarity. If similarity-collapse occurs (a summary collapsing onto an older entry at sim 0.77–0.81), **record it as evidence — do not fix production dedupe inside a research domain.** The collapse itself is a finding.
+
+---
+
+## 8. Closeout: freeze order and seal
+
+**The closeout order is load-bearing.** All state/accounting writes happen BEFORE the freeze:
+
+```
+research artifacts → source ledger → claims → research tooling → registry
+→ canonical Memory write (if any) → session note
+→ CONTENT_FREEZE_AUDIT   ← the LAST content/accounting write, always
+→ FINAL_CONTENT_GATE     ← must print "research gate consistent"
+→ SEAL_COMMIT            ← one commit containing everything
+→ push (origin + gitea)  ← verify ls-remote shows the seal sha
+→ mirror to ~/Desktop/research/ + diff -qr verification
+→ dolphin --select <mirror>/<MASTER>.md   (the user reads from Desktop)
+→ Gitea closeout comment + #375 epic update
+→ POST_CLOSEOUT_RECEIPT in the final Gitea comment
+```
+
+**No session note after the freeze.** Transport (push/mirror/Gitea) does not stale the audit. The audit records: mutation categories (all NONE for research-only), the canonical write receipt, session-note count, tooling changes, process truth, and negative-control results.
+
+**Final status:** exactly one token — `MEMORY_ATLAS_R1_<X>_SEALED` / `_RESEARCH_INCOMPLETE` / `_BLOCKED`. Then STOP before the next domain; it waits for a mandate.
+
+---
+
+## 9. Repairs (the reseal pattern)
+
+After a domain seals, an audit may order a **bounded repair**: process truth, depth integrity, specific overclaims, ownership overreach, arithmetic, gate coverage — explicitly NOT a domain rerun. The repair reseals with its own commit (`_REPAIR_SEALED`), its own freeze audit, and `REPAIR_CONTINUOUS_EXECUTION` recorded separately. Every repair mandate so far has also hardened the gate with the checks its findings demanded — the gate is the cumulative memory of caught defects.
+
+The verify-before-trusting rule: when the repair mandate claimed quota exhaustion that the trajectory DB didn't show, the DB's version went in the audit and the mandate's account was recorded as *mandate-supplied context*. Trust receipts, not intentions; trust the database, not the narrative.
+
+---
+
+## 10. The running example (domain #398 W, start to seal)
+
+| Stage | Artifact | Key fact |
+|---|---|---|
+| ISSUE | #398 reopened, comment 5885 | preliminary sha256 recorded |
+| INWARD | 01_inward.md | preferences 0 rows; delivery injection dead; milk contradiction 6v2 |
+| OUTWARD | 3 arms, 47 ledger rows | 6 arXiv IDs verified after 1 APIError + retry |
+| APPLICABILITY | 49 rows | 12 ADOPT / 8 ADAPT / 8 EXPERIMENT / 2 FUTURE / 17 REJECT / 2 PARK |
+| INNOVATION | 9 candidates | each with falsifier + kill |
+| ADVERSARIAL | 58→44 attacks, 6 SUCCEEDS | dead-loop finding → loop-liveness gate |
+| SYNTHESIS | 9 matrices | ownership made unambiguous |
+| QUALIFY | 22 rows | every mandate question answered |
+| MASTER | 45 sections | standalone-readable |
+| GATE | first run: 12 findings | all fixed; final: consistent |
+| FREEZE+SEAL | ac0a62c | audit LAST; pushed both remotes |
+| RESEAL | (repair) | FAILED_FIVE_TIMES + 6/6 negative controls |
+
+---
+
+## 11. The principles, distilled
+
+1. **Rows over narrative.** If the prose and the rows disagree, the rows win — and the gate enforces it.
+2. **Preserve what you correct.** Byte-for-byte preliminary + reconciliation proves the correction; patching hides it.
+3. **Independence is structural.** The adversarial actor must not share context with the author, or it isn't adversarial.
+4. **Mechanical gates over self-attestation.** Every quality claim someone could fudge under pressure gets a script.
+5. **Every check has a scar.** New gate checks come from caught defects, with negative controls proving they fire.
+6. **Honesty about process is not optional.** Five continues is five continues; a quota story the database doesn't support is recorded as unverified.
+7. **Depth is never the trade.** Pressure reduces breadth; a domain reaches its grade or stays open.
+8. **Read the actual system.** Schema existence ≠ behavior; row counts over inference.
+9. **Seams are sacred.** Solve your domain's question; defer the neighbor's with evidence.
+10. **The user reads from the Desktop.** Mirror + highlight the master, or the work might as well not exist.
+
+---
+
+*Source of truth: `research/memory-atlas-r1/research_standard.md`, `scripts/research_gate_check.py`, and the sealed domain folders #391–#399. This guide describes the pipeline as executed 2026-09-20/21; when a future defect escapes, the fix is a new gate check with a negative control — and then this document.*

research/memory-atlas-r1/AA-security-memory-poisoning/00_issue_scope.md

@@ -0,0 +1,37 @@
+# #402 AA — ISSUE SCOPE (mandate, 2026-09-22)
+
+Domain: **AA — Security / Memory Poisoning** (Gitea issue #402, epic #375). Registry row verified: `| 402 | AA: Security / Poisoning | … | families/metamemory_security.md | memory-atlas-r1/AA-*/ |` — family file CONFIRMED as `research/memory-atlas/families/metamemory_security.md` (its §AA section is the R0 baseline). Canonical folder `AA-security-memory-poisoning/` kept — NOT renamed.
+
+## Canonicalization
+
+- Existing batched master `AA_SECURITY_MEMORY_POISONING_R1_MASTER.md` (16 lines, sha256 97a4c051…79f4581) **preserved byte-for-byte** as `AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md` (hash-verified copy; original untouched).
+- Final master target: `AA_SECURITY_MEMORY_POISONING_R1_MASTER.md` (expected canonical name).
+- Registry's "deep requalified 2026-09-20 / single-writer stance confirmed / staged earn-in" = batched-era claims; deep R1 may confirm, refine, or overturn (mandate §70).
+
+## Scope
+
+Central question: the smallest defensible security architecture letting Rune consume untrusted information, remember, learn, use tools, delegate, swap models, expose memory, accept corrections, and recover — WITHOUT retrieved text becoming authority, model output becoming trusted by generation, poisoned evidence persisting, malicious content becoming instructions, a projection rewriting canon, a worker impersonating Main, a provider redefining identity, recovery history becoming attack persistence, provenance manufacturing trust, tombstones leaking, or security becoming theatre.
+
+#402 OWNS: security mechanism questions parked by #396 (manifest authentication), #399 (verifiable authorization + integrity evidence), #400 (poisoned self-state/recovery), #401 (provenance leak, safe rendering, CLI bypass). It does NOT become a second owner of all state — it constrains authority and transitions.
+
+## Stage plan (R1_FULL, serial)
+
+1. ISSUE (this file; #402 reopened + start comment)
+2. INWARD — read-only security audit §55 A–O (Memory DB perms/schema/write paths/provenance fields; memory scripts incl. --no-dedupe; provenance mutability + forgery surface; task runtime authority; Spine; substrate; user model; persona; provider config; tool layer permissions/sandboxing; workers; backups/exports; secret handling; logs/notes leakage; TUI rendering). Classification incl. BYPASS.
+3. OUTWARD arms (SERIAL):
+   - arm-1: foundational security — Bell–LaPadula, Biba, Clark–Wilson, capability/object-capability, least privilege, confused deputy, reference monitors, IFC, taint tracking, ACL/RBAC/ABAC, MANDATORY vs discretionary; each with assumptions/enforcement point/limitations/Rune analogue/transfer failures.
+   - arm-2: prompt injection (direct/indirect/tool/RAG/hidden/metadata/multi-turn; benchmarks; defenses; broken defenses; adaptive attacks; 2024–26) + persistent/sleeper injection + memory poisoning classes + RAG/retrieval poisoning + independence/Sybil + dedupe/similarity-collapse provenance security.
+   - arm-3: cryptographic integrity by property (fixity/authenticity/order/distributed authority/release), authenticated provenance, key custody (software/OS keyring/TPM/HSM/offline; root-compromise honesty), authorization + capability + tool/worker security + replay/stale authority, deletion/erasure + privacy-vs-provenance, backups/restore + rollback attacks, supply chain (SLSA/TUF/Sigstore) + model supply chain, DoS/resource exhaustion, audit-log security, security UX (warning fatigue), 2024–26 agent-security mechanisms + standards (NIST/OWASP/MITRE ATLAS) + commercial mechanism audit.
+   - arm-4: adversarial fresh-context (§67 A–CZ + ≥10 Rune-specific).
+4. APPLICABILITY / INNOVATION (§66 A–P) / claims ledger (§71 with the #401 gate rule: ADOPT requires DEEP_EXTERNAL|RUNE_DIRECT|DESIGN_INVARIANT) / load_bearing_evidence.md
+5. R0 reconciliation (batched says 3C/2R Sum 5) + batched-prelim reconciliation (byte-preserved)
+6. SYNTHESIS matrices A–S (§68) + QUALIFY (50 questions §76)
+7. MASTER → CONTENT_FREEZE_AUDIT (LAST) → FINAL_CONTENT_GATE → SEAL → push/mirror → Gitea #402 closeout + #375 → receipt. STOP BEFORE #403.
+
+## Seams
+
+#388 truth maintenance · #392 uncertainty≠security trust · #393 JEV deterministic enforcement · #394 event/completion authority · #395 worker identity/fencing · #396 manifests/restore/deletion · #397 lineage/independence · #398 explicit-vs-inferred origin · #399 governed identity mutation · #400 poisoned self-state/recovery history · #401 provenance leak/safe rendering/tombstone visibility/CLI bypass · #403 multimodal content · #404 intelligence assimilation (security boundary now, mechanics parked) · #405 hardware keys if justified · #406 evaluation.
+
+## Boundary
+
+Research-only: no production Memory schema/auth/keys/permissions/Gitea/credentials/secret stores/TUI/Substrate/Spine/provenance/task runtime/tool permissions/Docker-network/model routing/injection filters/deletion changes. READ-ONLY inward. No attack against real external systems (E-series are designs only). Do not expose actual secrets in artifacts.

research/memory-atlas-r1/AA-security-memory-poisoning/01_inward.md

@@ -0,0 +1,138 @@
+# #402 AA — INWARD REALITY (read-only security audit, 2026-09-22)
+
+READ-ONLY inspection only (SQLite `-readonly`/URI `mode=ro`; file metadata, `ss -tlnp`, `ufw status`, `ps`; no secrets printed — lengths/types only). Scope per mandate §55 A–O plus the expanded §39–§48 surfaces (Substrate intrusion awareness, unauthorized read/snoop, host/process boundary, network attack surface, persistence).
+
+Verdict up front: **Rune's current security posture is "trusted local user, no enforcement layer".** Concretely: Memory and all Rune state are readable and writable by ANY process running as `nick` (file modes 644/755, no OS-user separation, no authenticated IPC); the canonical Memory DB has no integrity constraints, no triggers, no audit trail, and `delete_entry` is a hard delete with no tombstone; `update_entry` silently rewrites text/embeddings without recording a change; `--no-dedupe` bypasses the dedupe gate with no authorization; credentials live in a plaintext JSON file readable by any `nick` process; there is no security state, no quarantine, no taint, no authorization layer, and no compromise-detection mechanism anywhere. What IS real: ufw is active with default-deny inbound and a narrow, mostly LAN-scoped allow-list; the agent harness binds localhost only; the DB is plaintext SQLite with no encryption at rest.
+
+## A. Memory DB
+
+| Property | Observed |
+|---|---|
+| Location/size | `~/.config/opencode/memory/store/memory.db` — 456 MB |
+| Permissions | **644 nick:nick** (world-readable); parent dir 755 |
+| Schema | 26 columns incl. `source`, `method`, `status`, `valid_from/valid_until`, `confidence`, `temperature`, `wash_count`, `rock_status`, `tier`, `memory_type` |
+| Integrity constraints | **No triggers**; no CHECK constraints observed; no receipt/audit table |
+| Encryption at rest | **None** (plain SQLite; no SQLCipher) |
+| Indexes | FTS5 + sqlite-vec tables (`entries_fts`, `entries_vec`, `chunks_vec`, `associations`) — all derived, none access-controlled separately |
+| Write paths | `add_entry`, `update_entry`, `delete_entry`, `touch`, `write_neuron`; CLI verbs; consolidation/curator jobs |
+
+## B. Memory scripts (write surfaces)
+
+- `add_entry(... source="", method="curator")` — **source is a caller-supplied string with no validation or attribution**; any caller can claim any source.
+- `update_entry(eid, text, importance, valid_until)` — rewrites `text`, re-embeds, rebuilds FTS, updates `last_accessed`. **Does not touch `source`** (good) but **records no change history and no actor** (bad: silent mutation).
+- `delete_entry(eid)` — **HARD DELETE** across `entries` + `entries_vec` + FTS. No tombstone, no receipt, no provenance of the deletion. Directly contradicts #396/#401 tombstone semantics.
+- `--no-dedupe` — CLI flag: "bypass the dedupe policy gate (raw insert, receipted)". The receipt records the bypass, but there is **no authorization check** and no privilege requirement. #401 flagged it; #402 confirms: **authority bypass available to any caller of the CLI**.
+- `--version` — creates a git snapshot of memory state (a fixity-ish affordance, unauthenticated).
+- No import/export path observed with validation; `mine_file`/`add_chunk` ingest arbitrary files with caller-supplied `wing`/`room`/`source_path`.
+
+## C. Provenance
+
+- `source` is a free-text column, **mutable by any direct SQL writer**, **forgeable by any caller**, and **not authenticated**.
+- Derivation edges: `associations` table + `_auto_associate` (similarity-based, no independence check); `_aaak_summary` generates summaries (derived rows inherit no taint state — there is no taint field).
+- Similarity-collapse: dedupe policy receipts exist as a concept (`decision`, `prior_id`, `similarity` returned to callers) — **the receipt is returned to the caller, not necessarily persisted as a lineage edge**; #399/#401 both recorded a collapse with `prior_id: null`, i.e., the collapse target was not recorded.
+- **No provenance authenticity mechanism of any kind.**
+
+## D. Task runtime
+
+- Task state lives in the mimocode task DB + `store/await_intent_log.jsonl` (63 lines, JSONL append-only **file**, no integrity protection, no signature, truncatable).
+- Completion authority: task tool state; no cryptographic evidence; no authority generation.
+- Waits/retries: `await_intent_log` records normalized command intents (incl. `AMBIGUOUS`), but there is no lease, no fencing token, no actor identity in the records.
+
+## E. Spine
+
+- `store/spine/current.json` (328 KB, 644) — keys: `authority_generations` (2 entries), `entities`, `generated_at`, `observations`, `relationships`, `schema_version`.
+- `authority_generations` entries carry `generation`, `last_success`, `observed` edges — **the concept exists but is advisory**: the file is a plain JSON written by whoever writes it; no enforcement, no signature, no version floor, no monotonic guard. Generation numbers can be rewritten by any `nick` process.
+
+## F. Substrate / cognitive state
+
+- `cognitive_state.json` (130 B, 644) — dormant fossil; **directly writable** by any process; no inputs, no integrity, no provenance.
+- No Substrate security state exists (no authorized-actor registry, no session list, no capability view, no quarantine state, no containment status).
+
+## G. User model
+
+- No dedicated user-model store found in the inspected paths (`agent_identity.json`, `autonomy_state.json`, `agent_profiles/` exist under `~/.config/opencode/memory/`); preference origin (explicit vs inferred) is **not represented as a security-relevant field** anywhere observed. #398's origin discipline has no current enforcement surface.
+
+## H. Persona / identity
+
+- `scripts/identity_anchors.py` exists; anchors are files/rows **without version fields, change logs, or authority records** (carried from #399 inward). No governance hook enforces who may mutate them. No signature.
+
+## I. Provider / model configuration
+
+- `~/.local/share/mimocode/auth.json` — **600 nick:nick (+ACL)**, containing **plaintext API keys for multiple providers** (CONFIRMED by controller inspection: key-lengths/types only observed). ARM-1 CORRECTION for the OTHER path: the rune repo's `provider_registry.py:173` MASKS keys when persisting `~/.config/rune/providers.json`, and keys otherwise arrive via env vars (`provider_context.py:41`) or `/connect` — so the same-user exposure is BOTH this file AND `/proc/<pid>/environ` (Yama does not block PTRACE_MODE_READ) (types/lengths observed only: ~48–73 char keys across xiaomi/opencode-go/openai-oauth/ollama/google/zai/Verboo/moonshot/kimi). Any process running as `nick` can read every provider credential. No keyring, no OS secret service, no TPM, no rotation record, no per-tool scoping.
+- Model/provider selection: config-level; **no model version attestation, no provider identity verification beyond TLS to the endpoint**.
+
+## J. Tool layer
+
+- Hooks in `~/.mimocode/hooks/*.ts` (e.g. builder-bridge) use `execFile` from Node; no sandboxing layer observed; no approval gate for arbitrary command execution beyond the agent's own judgment; tool permissions are **ambient** (the process can do whatever `nick` can do).
+- No capability scoping, no per-invocation authorization, no TOCTOU protections observed.
+
+## K. Workers
+
+- No worker identity/auth/fencing implementation found in `~/.config/opencode/shared/*.py` (grep for actor_registry/worker returned nothing in shared libs). Subagents are **in-process actors with inherited ambient authority** — a worker is exactly as privileged as the controller. #395's "one authoritative Main" is a doctrine, not an enforced mechanism.
+
+## L. Backups / exports
+
+- `~/.local/share/mimocode/snapshot/<project-id>/` snapshot dirs exist; `memory_store --version` creates git snapshots.
+- **No manifests, no signatures, no fixity verification, no encryption observed.** Restore verification: none.
+
+## M. Secret handling
+
+- Secrets: provider keys (plaintext JSON, 600 + ACL); Gitea token via `gitea_auth.load_gitea_token()`; SSH keys under `~/.ssh` (not inspected in detail).
+- **Observed leakage surfaces (no values printed):** session `notes.md` is 644 and lives in a world-readable tree; `daemon.log` (8.8 MB, 644) for the wait-resume daemon; 787 transcript files at 644 under the memory tree. Transcripts are the highest-volume plaintext surface.
+
+## N. Logs / session notes
+
+- Session notes: 644, plaintext, no integrity; transcripts: 644, 787 files; `await_intent_log.jsonl`: no integrity.
+- No tamper evidence on any log; no redaction discipline; no tiering.
+
+## O. UI / TUI rendering
+
+- Textual TUI uses `RichLog(..., markup=True)` — **Rich markup is rendered from log content**; memory text is displayed through markup-enabled widgets. Terminal escape / markup injection into the TUI is a live surface (needs arm-2/3 evidence; no sanitization observed at the widget level).
+- No unsafe-HTML surface (no web GUI exists — #401 inward: Textual only).
+
+## Network attack surface (mandate §46 — read-only)
+
+ufw **active**, default **deny incoming** / allow outgoing. Explicit inbound allows:
+
+| Port | Scope | Purpose | Assessment |
+|---|---|---|---|
+| 22/tcp | 192.168.1.0/24 | SSH | LAN-scoped; password/root config not readable without sudo (UNKNOWN) |
+| 3000/tcp | 192.168.1.143 only | Gitea (Pi Caddy + runner) | Narrow single-host allow; Gitea itself binds `*:3000` (all interfaces at socket level) — ufw is the only boundary |
+| 40520/tcp+udp | **Anywhere** (wlan0, incl. v6) | qBittorrent | **WAN-exposed** by explicit rule |
+| 1714:1764 | LAN | KDE Connect | LAN |
+| 8000/tcp | LAN | dev service | LAN |
+| 5353/udp, mDNS | LAN | discovery | LAN |
+
+Listening sockets observed (read-only): `0.0.0.0:8791` = **mimo-wait-resume daemon** (`~/.local/share/mimo-wait-resume/daemon.py`, nick-owned, 8.8 MB log) — bound on ALL interfaces, not in the ufw allow-list (so externally blocked by default-deny, but any LAN host that is permitted by another rule or any local process can reach it); `*:3000` Gitea; `0.0.0.0:22` SSH; `0.0.0.0:5355`; `0.0.0.0:27036` Steam; `127.0.0.1:4096` **mimo harness (localhost-only — good)**; `127.0.0.1:8188`; `127.0.0.1:11987/11988`; assorted steam/discord/qbittorrent localhost sockets.
+
+**Honest statement:** the agent harness itself is localhost-bound; the wait-resume daemon is all-interfaces-bound but firewalled; Gitea is firewalled to one LAN host. ufw is the single enforcement point, and it is host-level, not Rune-level.
+
+## Host / process boundary (mandate §47)
+
+- **Same OS user (`nick`) = full authority over everything Rune owns.** Memory (644), transcripts (644), config dirs (755), `cognitive_state.json`, `spine/current.json`, session notes, and — because they are 600-but-nick-owned — **provider credentials**: all readable and writable by any process running as `nick`. There is **no isolation between Rune components and any other user-level process**.
+- Other OS users: only `nobody` (65534) exists besides `nick`; 644/755 modes therefore block `nobody` from writing and block reads only where a file is 600 — i.e., the 644 Memory/transcripts **are readable by `nobody`**.
+- `nick` is in `wheel` → sudo. **Root compromise and nick compromise are the same trust level for Rune's data**; no key custody or integrity mechanism can distinguish them.
+- Process-memory snooping (ptrace of same-user processes), clipboard, shell history: all in scope for a same-user attacker and **unobservable to Rune**.
+
+## Persistence surfaces (mandate §45 — visibility assessment)
+
+Observable-by-Rune: none (no integrity checks, no startup inventory, no manifest verification). Observable-by-OS only: systemd units, user autostart, cron/timers, shell rc files, SSH `authorized_keys`, package state, containers, browser extensions. **Rune currently has zero persistence-detection capability** and must not claim any.
+
+## The five load-bearing gaps
+
+1. **No authorization layer at all** — every write path is unauthenticated and unscoped; `--no-dedupe` is an unprivileged bypass; workers inherit ambient authority.
+2. **No integrity or audit trail on canonical state** — silent mutation via `update_entry`, hard delete with no tombstone, no triggers, no receipts table, no tamper evidence.
+3. **No confidentiality boundary** — 644 Memory/transcripts, plaintext credentials readable by any `nick` process, no encryption at rest; same-user attacker reads everything and is invisible to Rune.
+4. **No security state machinery** — no quarantine, no taint, no authorized-actor registry, no security events, no compromise states, no containment/recovery semantics.
+5. **No trust separation between content, model output, and control** — no mechanism distinguishes stored text from authority; the only separation is doctrine (#399/#400/#401 notes), not enforcement.
+
+What IS real and carried: ufw default-deny with narrow allows; localhost-only agent harness; append-only *convention* for logs; the `authority_generations` concept in Spine; dedupe receipts as a seed for lineage recording; git snapshots as a fixity seed.
+
+Classification counts: CANONICAL 2 (Memory DB, Spine file as truth-by-convention) · ACTIVE 4 (ufw, harness localhost bind, dedupe gate, git snapshots) · PARTIAL 3 (Spine generations, await_intent log, dedupe receipts) · ABSENT 8 (authorization, security state, quarantine, taint, integrity/audit trail, confidentiality controls, persistence detection, compromise detection) · BYPASS 3 (update/delete/--no-de-dupe) · DORMANT 1 (cognitive_state) · UNKNOWN 3 (SSH auth config, Gitea auth config, daemon auth — not readable read-only).
+
+
+## Arm-1 read-only harness findings (added 2026-09-22, verified in-source)
+
+1. **`audit_ledger.py:28`**: `SECRET_KEY = os.environ.get("AUDIT_LEDGER_KEY", "rune-governed-adaptation-2024")` with HMAC chaining at line 35 — **the advertised tamper-evident ledger is forgeable by anyone who can read the tracked source**; tamper evidence is void unless the key comes from outside the repo AND outside the agent's uid. (MAJOR — carried to the master as a confirmed inward security defect.)
+2. `capability_broker.py` = capability SELECTION/relevance (tool-schema matching), **not** capability ENFORCEMENT — any claim that Rune "has capabilities" must be qualified.
+3. Provider-key masking confirmed for the repo path (see section I correction above); env-var delivery keeps the same-user exposure via `/proc/<pid>/environ`.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm1_security_foundations.md

@@ -0,0 +1,36 @@
+# #402 AA — OUTWARD arm-1: Foundational security models + host/network/process fundamentals (general-12, 2026-09-22, SUCCESS)
+
+Actor: general-12 (independent, fresh context). 22 sources live-verified (Crossref/arXiv API/NIST CSRC/kernel docs/man7/DTIC mirrors). FULL_TEXT ×6 (Yama, unix(7), systemd-creds, dm-verity, + 2 kernel docs), ABSTRACT_VERIFIED ×8, METADATA_VERIFIED ×6, UNVERIFIED ×2 (flagged). Plus read-only verification of four Rune harness premises.
+
+## Rune-harness findings (READ-ONLY, verified — these correct/refine the inward audit)
+
+1. **`audit_ledger.py:28` HMAC key fallback is hardcoded** (`SECRET_KEY = os.environ.get("AUDIT_LEDGER_KEY", "rune-governed-adaptation-2024")`, chained at line 35). The advertised tamper-evident chain is **forgeable by anyone who can read the source** — tamper evidence is void unless `AUDIT_LEDGER_KEY` comes from outside the repo AND outside the agent's uid. **Major finding; carried to the master.**
+2. **Premise correction:** `provider_registry.py:173` MASKS API keys when persisting `~/.config/rune/providers.json`; keys arrive via env vars (`provider_context.py:41`) or `/connect` (`rune_tui.py:2735-2741`). The same-user exposure is therefore `/proc/<pid>/environ` (Yama does NOT block PTRACE_MODE_READ), not a plaintext providers.json. NOTE: `~/.local/share/mimocode/auth.json` (inspected by the controller) DOES hold plaintext provider keys at 600+ACL — both facts stand for their respective files.
+3. `capability_broker.py` is capability **selection/relevance** (tool-schema matching), NOT capability **enforcement** — naming overstates the security property.
+
+## Core findings
+
+1. **Bell-LaPadula (1973)**: confidentiality only; simple/star properties; assumes an external label authority + TCB. **Transfer fails**: the single process is subject, TCB, and target simultaneously; labels are self-assigned and mutable; and confidentiality is not Rune's dominant risk (poisoning is an INTEGRITY failure).
+2. **Biba (1977)**: integrity via inverted lattice; low-water-mark demotes subjects permanently — **availability-hostile** ("read one web page → may never write Memory again"). **Transfer failure**: Biba labels subjects/objects globally; Rune needs **per-record provenance**, not a global agent level.
+3. **Clark-Wilson (1987) — the closest classical fit**: well-formed transactions (all CDI changes via certified transformation procedures), separation of duty, UDI→CDI validated ingress, IVPs. **Rune analogue**: Memory = CDIs; raw web/tool output = UDIs (quarantine); `memory_write` = the TP; schema/provenance checks = IVPs; the LLM is an untrusted proposer separated from a small deterministic committer. **Caveat**: CW in-process is a POLICY DISCIPLINE, not a boundary — a same-user attacker can edit both the TP source and the SQLite file.
+4. **Capabilities** (Dennis & Van Horn 1966; Levy 1984; Miller 2006 ocap; Hardy 1988 confused deputy): buys explicit per-call grants (injected content cannot exercise authority the user never delegated) + auditable delegation + least privilege per call. **Infeasible**: ambient authority cannot be removed from an unprivileged Python process (files, subprocesses, env) — so ocap is API-level only and bypassable by same-user code. **Honest critiques**: revocation unsolved in practice; capability systems do NOT solve confinement/covert channels; discretionary.
+5. **Reference monitor (Anderson 1972)**: complete mediation / tamperproof / verifiable. **Tamperproof is unachievable at same uid** (monkeypatch, LD_PRELOAD, ptrace, source edit) → a Rune monitor is a POLICY CHECKPOINT, not a boundary; its real value is stopping the AGENT (and prompt-injected reasoning). Minimal design: one pure `authorize(action, resource, provenance, policy) -> allow|deny`, no I/O, no LLM, ≤ a few hundred lines, single choke point, fail-closed, every decision logged.
+6. **IFC/taint** (Denning 1976/77): dynamic taint in Python is AST/instrumentation-based; known pathologies = **taint explosion**, implicit flows, incompleteness (labels through SQLite need label columns; labels through an autoregressive LLM are unsound). **2024-26 convergence (abstract-verified)**: CaMeL 2503.18813, f-secure LLM systems 2409.19091, FLOWSEAL 2609.14003 (tool-level interceptor + IFC lattice + controlled declassification), **SPA 2608.27234 (dual-lattice over PERSISTENT LABELED ARTIFACTS — closest published analogue to Rune Memory)**, APPA 2607.24625 (dual-phase reference monitor at tool/MCP dispatch), GIF 2606.23277 (Jacobian flow bounds). **Convergent design: enforce OUTSIDE the model, on labels attached to data, at the tool boundary.**
+7. **Access-control families**: ACL fine-grained but scattered; RBAC is the wrong abstraction (one human owns every role); **ABAC-lite** (NIST SP 800-162) evaluated by the deterministic policy function is the best fit — attributes are naturally available (provenance label, target store, tool risk class, session trust state, approval flag, egress destination).
+8. **Host security (Linux)**: a same-user process reads/writes **every file you can** — `chmod 600` stops OTHER users, not same-uid malware. `/proc/<pid>/environ` is gated by PTRACE_MODE_READ + dumpability, **not** by Yama; ptrace attach gated by `yama.ptrace_scope` (0 = unrestricted, 1 = ancestor-only) and can be blocked by `PR_SET_DUMPABLE(0)`/`PR_SET_PTRACER` (ssh-agent does this). X11 clipboard has no per-client isolation (Wayland improves but is not a same-user boundary). **Unobservable to the application**: reads of its files (inotify IN_ACCESS is partial/blind to memory reads), process-memory inspection, /proc enumeration.
+9. **Secrets at rest — honest matrix**: plaintext file (disk theft ✗, other users ✗, same-user ✗, root ✗); OS keyring/libsecret (disk theft ✓, other users ✓, same-user ✗ — Secret Service is callable by any same-user process, unlocked during session); systemd-creds (AES256-GCM, key from TPM2 and/or root-only credential.secret, PCR binding, materialized 0400 in ramfs for the unit's own user → same-uid malware ✗ while running); TPM2 hardware keys (never leave chip, but an unsealing policy permitting the running OS permits same-uid malware). **Disk theft ✓ / other users ✓ / same-user ✗ / root ✗.**
+10. **OS-level integrity**: dm-verity (read-only block hash tree, detects OFFLINE tampering; `check_at_most_once` weakens online protection); IMA/EVM (measurement into PCRs + kernel-enforced appraisal; the kernel IMA doc URL 404'd — specifics UNVERIFIED); file capabilities (privileged binaries — not useful here); **SELinux/AppArmor = the only layer that constrains a compromised agent from reading your other files**; namespaces/bubblewrap/Flatpak portals = the practical unprivileged isolation boundary. **Layer ownership**: kernel MAC + namespaces own "compromised agent cannot reach outside its whitelist"; the in-process monitor owns "the model cannot invoke unauthorized actions"; at-rest crypto owns "disk theft".
+11. **Network fundamentals**: `127.0.0.1` binding reduces exposure but is **NOT authentication** — any local process of any uid can connect to loopback, and ufw normally permits `lo`. **UNIX domain sockets + SO_PEERCRED/SCM_CREDENTIALS are a genuine authentication primitive** (kernel-checked uid/gid/pid fixed at connect/listen time) — but they distinguish **uids, not processes**: a socket owned by your uid cannot tell Rune from same-user malware. **Fix: a dedicated system uid + socket in a 0700 dir + peer-uid check.** ufw/nftables stop remote attackers, do not gate loopback, and cannot stop a local process from binding a port.
+12. **Audit/accountability**: needs completeness (one choke point), tamper evidence (append-only, hash-chained, **ideally written by a different uid**), non-repudiation (requires a key the audited subject does not hold — **impossible in-process**). Same-user process can truncate/rewrite the log and patch the logger in memory → audit here is **diagnostic/forensic, not accountability**.
+
+## TRANSFER FAILURES (10)
+
+Label authority (subject sets its own labels) · tamperproof reference monitor (impossible at same uid) · trusted-subject exemption (the whole system here; only legitimate trusted subject = the human) · lattice-over-subjects (Biba LOM collapses availability; only per-record provenance survives) · capability unforgeability (ambient authority cannot be removed) · mandatory policy (ACL/RBAC/ocap are all discretionary; only kernel MAC + namespaces are mandatory) · cryptographic accountability (non-repudiation needs an authority outside the uid) · secret confidentiality vs same-user adversary (no file mode/keyring/systemd-cred/TMP policy protects a live secret from owning-uid malware) · enterprise audit/compliance framing (one principal) · firewall-as-authorization.
+
+## PROPOSED TRANSFERS (8)
+
+P1 one deterministic choke point (pure authorize(), fail-closed, logged) · P2 provenance labels assigned at ingestion, read-preserving, JOINED not dropped on summarization (no laundering) · P3 Memory writes only via certified transformation procedures (LLM emits structured proposals; deterministic committer is sole writer) · P4 separation of duty = human-in-the-loop declassification (operator is the only trusted subject) · P5 least authority per call (explicit scopes; deny by default) · P6 split trust domains by uid where MALWARE (not the model) is the threat (dedicated uid + SO_PEERCRED socket + kernel MAC if compromise-survival is required) · P7 secrets: assume same-user readability; keep keys outside the agent's uid; encrypt at rest only for disk theft, and SAY SO · P8 audit as best-effort (single-writer hash-chained root-owned sink; no non-repudiation claim).
+
+## CITATION CORRECTIONS (8)
+
+Hardy 1988 = ACM SIGOPS OSR 22(4), DOI 10.1145/54289.871709 (not SIGSAM) · Dennis & Van Horn 1966 CACM DOI 10.1145/365230.365252 (10.1145/357980.357993 = 1983 reprint) · Biba 1977 = DTIC AD-A039324 (ESD-TR-76-372/MTR-3153 unverified) · Anderson 1972 AD-772806 = Volume 2 (Volume I accession unverified; which volume states the three guarantees unverified) · NIST SP 800-162 = Jan 2014 · Denning 1976 DOI 10.1145/360051.360056 + 1977 companion DOI 10.1145/359636.359712 · Clark & Wilson DOI 10.1109/SP.1987.10001 · **"Pyshield" does not verify as a Python taint framework — do not cite**; the actor's own initial arXiv ID guesses resolved to unrelated math papers and were discarded.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm2_injection_poisoning.md

@@ -0,0 +1,53 @@
+# #402 AA — OUTWARD arm-2: Prompt injection / persistent injection / memory+RAG poisoning / Sybil (general-13, 2026-09-22, SUCCESS)
+
+Actor: general-13 (independent, fresh context). ~45 sources live-verified (arXiv id_list API + abs pages, USENIX, OpenReview, Crossref/OpenAlex, OWASP, practitioner blogs as mechanism-only). Depth honest: ZERO FULL_PAPER this arm — RELEVANT_SECTIONS ×6, ABSTRACT_ONLY ×most, DOCUMENTATION_AUDITED ×3.
+
+## Batched-artifact citation corrections (4 defects + several supplements)
+
+| Batched claim | Verdict |
+|---|---|
+| TMA-NM 2606.24322 machine-checked no-content/lineage-defense theorem | CORRECT (T1/T2/T3 over a TLA+-checked MODEL; implementation not machine-checked) |
+| MPBench 2606.04329; 4 channels, 9 vulnerabilities, aggressive-agents-more-exploitable | CORRECT |
+| MemCollusion 2608.01637; 81.3% save / 75% ASR | ID+numbers CORRECT, **TITLE WRONG** — real title "Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw"; MemCollusion is the framework name |
+| eTAMP (no ID) | **ID supplied: 2604.02623** "Poison Once, Exploit Forever" |
+| AgentPoison 2407.12784 ">80% ASR <0.1% poison" | CORRECT + NeurIPS 2024 verified; precise pair 82% retrieval / 63% end-to-end |
+| PoisonedRAG 2402.07867 "90% from 5 texts" | CORRECT + USENIX Security 2025 verified |
+| "Sleeper poisoning 60-89%, dormant" | **MIS-ATTRIBUTED**: the 60–89% is **2605.15338 "Hidden in Memory"**, conditional on successful retrieval; Hubinger 2401.05566 is training-time with no such number |
+| "Tool Poisoning Attacks 2503.15478" | **WRONG ID** — 2503.15478 = SWEET-RL. Canonical TPA = Invariant Labs blog 2025-04-01; benchmark = MCPTox 2508.14925 |
+| "CAPTURE 24.7% ASR vs belief-tracking" | **UNVERIFIABLE** — CAPTURE 2505.12368 has no such figure; 24.7% matches 2606.30566's benign FPR (24.7–52.6%). Likely conflation; DO NOT INHERIT |
+| InjecMEM COLM 2026 | ID 2608.23471 correct; venue NOT verifiable |
+| "SPA 0–0.2% ASR" / "Trust No Bot" | NOT VERIFIED in this arm |
+
+## Core findings
+
+1. **Indirect injection (Greshake 2302.12173v2)**: delivery = passive (retrieval/SEO/imported files), active (emails), user-driven (pasted snippets); threats = info gathering, fraud, malware, intrusion, manipulated content, availability; "processing retrieved prompts can act as arbitrary code execution." **Authors' limits: synthetic apps + local HTML only, no in-the-wild, no quantified ASR.** Perez & Ribeiro 2211.09527: goal hijacking + prompt leaking.
+2. **Instruction hierarchy (Wallace 2404.13208v1)**: system>user>third-party training, "drastic" robustness gain, minimal degradation — **no adaptive-attack evaluation**. 2025-26 evidence it does NOT robustly hold: **IH-Benchmark 2607.25987 (37 models: 98.2% → 20.5% compliance; system>user compliance is NOT a proxy for user>TOOL robustness)**; 2606.07808 (white-box failure localisation); 2510.03705 (backdoor SFT nullifies hierarchy); 2603.10521 (RL IH lifts GPT-5-Mini 84.1→94.1% but SATURATES a static internal eval). **Spotlighting 2403.14720v1**: delimiting/datamarking/encoding, >50%→<2% static ASR — **but one of the 12 defenses bypassed >90% under adaptive attack.**
+3. **Benchmarks**: AgentDojo 2406.13352v3 — 97 tasks/629 cases; LLMs <66% utility clean, attacks succeed <25% vs best agents; **authors' own warning: "extremely easy to build non-robust defenses that thwart any specific attack"; "not meant to be a static benchmark"; distinguishing instructions from data "will likely be necessary."** InjecAgent 2403.02691v3 (24% ASR ReAct GPT-4, ~2× with hacking prompt). AgentHarm 2410.09024v3 = misuse/jailbreak retention, NOT injection (scope correction). ASB 2410.02644v4 (highest avg ASR 84.30%; 11 defenses "limited effectiveness"). **AgentLAB 2602.16901: first long-horizon adaptive benchmark incl. MEMORY POISONING — "defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats."**
+4. **Defense failures (Nasr 2510.09023, Table 1)**: adaptive attacks bypass **12 defenses at >90% ASR for most** (Spotlighting, Repeat User Prompt, RPO, Circuit Breakers, StruQ, MetaSecAlign, Protect AI, PromptGuard, PIGuard, Model Armor, Data Sentinel, MELON) — most originally reported near-zero ASR. **Design Patterns (Beurer-Kellner 2506.08837v3)**: six patterns — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization; core claim: "once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions." Willison's lethal trifecta (private data + untrusted content + external comms) = practitioner framing.
+5. **Tool-use injection**: Tool Poisoning Attacks = Invariant Labs blog (hidden instructions in tool descriptions; Cursor tricked into reading ~/.ssh/id_rsa; **rug pulls** = description mutated after approval; **tool shadowing** = malicious server rewrites a trusted tool). **MCPTox 2508.14925 (45 live MCP servers, 1312 cases, o1-mini 72.8% ASR; "more capable models are often MORE susceptible")**; **MCP-ITP 2601.07395 (implicit: poisoned tool never invoked; up to 84.2% ASR across 12 agents)**; MSB 2510.15994 (12-attack taxonomy incl. **name-collision/tool-name squatting**); ShareLock 2606.27027 (one instruction split across tool descriptions); OWASP LLM01:2025 ("unclear if there are fool-proof methods of prevention"; Scenario #6 payload splitting).
+6. **Persistent/sleeper**: AgentPoison (memory/KB backdoor, no training, ≥80% avg ASR, ≤1% benign degradation, <0.1% poison rate). Hubinger 2401.05566 = training-time backdoors (does NOT directly transfer to memory-stored instruction persistence). Memory analogue evidenced separately: **2605.15338 (poisoned memories written up to 99.8%/95%; 60–89% attacker-intended action among successful retrievals)**; **2605.28201 "Plant, Persist, Trigger" (1,896 instances; state targets = session context, MEMORY, reusable skills)**; 2605.13471 (provenance gates + soundness theorem vs 7 deployment invariants, **empirical eval preregistered — no measured effectiveness**); MINJA 2503.03704v5 (>95% injection success / 70% ASR idealised); InjecMEM 2608.23471 (single interaction, no memory read/edit).
+7. **Memory-poisoning specifics**: MPBench (4 write channels, 9 structural vulnerabilities, 6 attack classes; **"agents designed to write and retrieve memory more aggressively are MORE exploitable"**; injection defenses "fail to cover memory poisoning"). Salami/MemCollusion (48 scenarios; Memory Save Rate 81.3%, ASR 75.0%; survives dilution + memory-level defenses; **per-record trust scoring unsound**). eTAMP 2604.02623 (**environmental-observation-only contamination, cross-session/cross-site, bypasses permission-based defenses; 32.5%/23.4%/19.5% across models; Frustration Exploitation up to 8× ASR**). **SMSR 2606.12703: no existing defence certifies against Multi-Session Memory Poisoning.** Non-adversarial counterpart 2604.01350: benign interactions alone → **57–71% cross-user contamination** under raw shared state.
+8. **RAG poisoning**: PoisonedRAG (**90% ASR from FIVE malicious texts in a database of millions**; several defenses insufficient). Vec2Text inversion (2410.06628) enables corpus poisoning without weights. **Negative result favouring defense: many corpus-poisoning attacks degrade after chunking/reranking (2606.11265) — but CRCP restores high ASR (arms race, not a fix).** Citation ≠ support (Venkit 2410.22349).
+9. **Source multiplication / Sybil**: **Epistemic Sybil Resistance (2609.01873) is the direct hit** — "no report-only aggregator can generally distinguish replication from independent corroboration"; >20,000 controlled agent calls; holding one evidence root fixed while report multiplicity 1→32 **collapses naive posterior coverage 0.940 → 0.263**; raising evidence-ROOT multiplicity 1→16 closes the gap; correlated extraction errors (γ_cal = 0.719). Douceur 2002 (distinct identities must denote distinct entities; without a trusted identification authority, redundancy is defeated). **Honest gap: no 2024-26 agent-memory paper applying MinHash/SimHash dedup with provenance preservation** — the problem is named (TMA-NM's "manufactured corroboration"; 2609.01873 formalises it); the mechanism is the gap.
+10. **Provenance laundering (TMA-NM 2606.24322v1)**: three agent-specific laundering channels = **the agent's own summarisation, trusted-tool echo, manufactured corroboration**; machine-checked separation theorem (T1 no content/lineage defense sound under laundering; T2 write-time origin binding necessary; T3 non-malleable origin-bound authority + Sybil-resistant corroboration-gated elevation sufficient); existing defenses fail "up to 68% laundering ASR"; TMA-NM reports 0% ASR at full utility; **caveat: the machine-checked artifact is the model, not the implementation; single v1 preprint.**
+11. **Non-executable memory content**: no paper shows data/control separation WITHOUT an architectural enforcement point. Counter-evidence: 2606.12703 (no provenance-free retrieval-time filter certifies against adaptive injection); 2606.30566 (statistical detector unusable FPR); 2510.03705 (in-model defenses nullifiable at training time). **Principle: enforce the data/control boundary OUTSIDE the model, at the effect sink.**
+12. **Dedupe/similarity-collapse**: 2609.01873's controlled manipulation — **report-space dedup tracks similarity (Δcluster 1.425 [1.363,1.485]) far more than true ancestry (Δ0.040 [-0.045,0.120])**; similarity-based merging therefore corrupts ancestry/security inference. **Honest gap: no paper measuring whether dedupe/merge ERASES security labels or provenance fields.**
+
+## Negative results (12)
+
+12 defenses >90% ASR adaptive · Spotlighting >90% adaptive · hierarchy nullifiable (SFT backdoor) · injection filters don't cover memory poisoning · **trajectory-forensic detector: AUC 0.9904 but 100% FP conditional on recall_before_send=1 and 24.7–52.6% unconditional benign FPR — "a valid attack precondition, not a maliciousness predicate; standalone blocking is not viable"** · prompt-abstention answers 41.6% misleading-context questions · trust-decay thresholds brittle · per-record trust fails salami (75% ASR) · static-corpus RAG defenses don't certify vs multi-session poisoning · content/lineage trust malleable (TMA-NM T1, 68% ASR) · Firewall-defense's perfect-security claim scoped to its own weak attack set · corpus poisoning degrades after reranking (defense-favouring).
+
+## Transfers (8)
+
+1. Authority bound at WRITE time from the input channel; never re-derived from content/lineage at read time.
+2. Elevation requires **Sybil-resistant corroboration**: count distinct evidence ROOTS, never reports/agents/similarity.
+3. Retrieved/stored text is DATA; no memory read may trigger a consequential action; enforce at the effect sink, outside the model.
+4. Taint propagates through derived records — summarisation, tool echo, and merge ARE the laundering edges.
+5. Dedupe/merge must not mutate provenance or trust fields.
+6. Detect compositions, not records (salami/payload-splitting invisible to per-record inspection).
+7. A detector keyed on a necessary precondition is NOT a maliciousness predicate — gate, don't block.
+8. **No defense's reported ASR is admissible without an adaptive-attack evaluation.**
+
+## Method lesson (cross-task)
+
+The arXiv **search UI mis-pairs titles and IDs** (off-by-one when a title contains a link) — any ID derived from search must be re-verified via `id_list`/abs page before entering an artifact. Rate limits: export.arxiv.org API, DBLP, S2 all 429'd; `arxiv.org/abs/*`, OpenReview API, Crossref, OpenAlex were usable.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm3_crypto_host_recovery.md

@@ -0,0 +1,75 @@
+# #402 AA — OUTWARD arm-3: Crypto-by-property / key custody / authorization enforcement / recovery / supply chain / detection / standards (general-14, 2026-09-22, SUCCESS)
+
+Actor: general-14 (independent, fresh context). ~35 sources live-verified (arXiv/NVD/Crossref/NIST CSRC/MCP spec/OWASP/SLSA/restic/docs).
+
+## Citation corrections (7)
+
+1. **Schneier & Kelsey 1999 DOI = 10.1145/317087.317089** (not .317103).
+2. **Axelsson 2000 DOI = 10.1145/357830.357849** (CCS'99: 10.1145/319709.319710).
+3. **arXiv:1807.05052 is NOT Uptane** (it is a general-relativity paper) → cite Kuppusamy/DeLong/Cappos, IEEE VT Mag 2018, DOI 10.1109/MVT.2017.2778751.
+4. Samuel & Mathewson = **TUF, CCS 2010**, DOI 10.1145/1866307.1866315 (not a separate rollback paper).
+5. **SLSA v1.0 retired; current = v1.2**.
+6. **NIST SP 800-88 Rev.1 withdrawn 2025-09-26; superseded by Rev.2**.
+7. Denning 1987 DOI confirmed: 10.1109/TSE.1987.232894.
+
+## Core findings
+
+**Q1 CRYPTO BY PROPERTY** (the table that governs all crypto decisions):
+
+| Property | Minimal mechanism | Exact guarantee | Does NOT give |
+|---|---|---|---|
+| Fixity | SHA-256 | detects bit mutation | anything if the hash is co-located |
+| Authenticity | HMAC (RFC 2104) / Ed25519 (RFC 8032) | K-holder wrote it / key-holder signed it | non-repudiation (HMAC); protection once the key is stolen |
+| Order | hash chain (Crosby & Wallach, USENIX 2009) | O(log n) tamper detection | anti-truncation |
+| History | authenticated append-only log (Schneier & Kelsey) | forgery/truncation detectable BY AN AUDITOR | prevention |
+| Distributed authority | transparency log (RFC 6962 / Trillian) | fork detectable by public monitors | prevention; requires gossip |
+| Release/restore | client-side encryption + signed manifests | confidentiality at rest; verify-before-trust | protection of live keys |
+| **Anti-rollback** | **monotonic counter (TPM / TUF version+expiry)** | stale state rejected | **anything without external monotonic state** |
+
+**KEY POINT: a signature alone does NOT stop rollback — a signed OLD version is perfectly valid. Freshness requires monotonic state outside the attacker's control.** (TUF survivable-key-compromise role separation; Uptane non-expiring images + Director/Vehicle split; TPM monotonic counters.)
+
+**Q2 KEY CUSTODY** (honest matrix):
+
+| Mechanism | Disk theft | Other user | Same-user malware | Root |
+|---|---|---|---|---|
+| Plaintext file | ✗ | ✗ | ✗ | ✗ |
+| OS keyring | ✗ (often unencrypted) | ✓ | ✗ (same session, D-Bus callable) | ✗ |
+| Encrypted file w/ passphrase (age/SOPS) | ✓ | ✓ | ✗ once unlocked | ✗ |
+| systemd-creds (TPM-bound) | ✓ | ✓ | partial (unsealed secret readable in memory by the caller) | ✗ (root can re-seal/modify PCR expectations) |
+| TPM2 sealing | ✓ | ✓ | partial (unsealing reveals to caller's memory) | ✗ (compromised root can extend PCRs/use the TPM) |
+| **Hardware token (FIDO2/PIV, non-exportable)** | ✓ | ✓ | partial — malware can REQUEST signatures while the token is present; **user-presence is the only brake** | ✓ vs remote root; ✗ vs physical attacker with the token |
+
+NIST SP 800-57 Pt.1 Rev.5: a key is only as trustworthy as the module guarding it. **"Signing protects nothing if root holds the key" = the TCB argument: every scheme moves the attacker inside/outside a smaller TCB; none eliminates it.**
+
+**Q3 AUTHORIZATION AT THE TOOL BOUNDARY** (2024-26 convergence, all enforced OUTSIDE the model): CaMeL 2503.18813 (control/data flow from the trusted query; untrusted data "can never impact program flow"; **77% of AgentDojo tasks with provable security vs 84% undefended**); Design Patterns 2506.08837 (Action-Selector, Plan-Then-Execute, Dual-LLM, Dual-Prompt/Context segregation, Code-Generating, capability-scoped calls; core: "once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions"); FLOWSEAL 2609.14003 (tool-level interceptor outside the LLM context + IFC lattice + controlled declassification; **leak 52.2% → 0.5%** vs Collaborative Workspace Lure; three NEW attacks bypass prompt-based privacy defenses); SPA 2608.27234 (**persistent state as LABELED ARTIFACTS**; tool_knowledge attack → 0%/0.2%); APPA 2607.24625 (dual-phase reference monitor at tool/MCP dispatch, trajectory confinement, schema-bounded egress; 64.2–91% utility, **zero attacks across 1,320 guarded episodes**). **Negative: no arXiv 2025-26 work on OPA/Cedar-style policy-as-code for LLM agents** — the space uses bespoke IFC algebras instead. **MCP spec 2025-06-18 admits: "MCP itself cannot enforce these security principles at the protocol level"; tool descriptions/annotations are UNTRUSTED unless from a trusted server; enforcement is pushed to hosts.**
+
+**Q4 WORKER / DISTRIBUTED AUTHORITY**: Kleppmann 2016 (verified full text) — leases cannot be made safe by re-checking expiry (GC pause / SIGSTOP / 90-second network delay — the GitHub incident); the fix is **fencing tokens: a strictly monotonic number minted by the lock service and CHECKED BY THE STORAGE SERVER, rejecting regressions**; Redlock lacks fencing → unsafe for correctness. **Transfers directly: any orchestrator granting a subagent the right to write shared state must attach an epoch/counter and the memory store must reject stale writes.** A-JWT 2509.13597 (per-agent proof-of-possession keys + chained delegation + one-way identity hashes; blocks replay and in-process impersonation, sub-ms overhead). Multi-agent boundary verification 2608.00718 (pipelines lack content/identity/intent/state verification at inter-agent boundaries; attack success tracks pipeline STRUCTURE, not model capability).
+
+**Q5 PRIVACY / EXFILTRATION** (2026 measurement evidence): EchoLeak **CVE-2025-32711 verified via NVD** (M365 Copilot AI command injection, published 2025-06-11, CWE-74, CVSS 9.3 vendor / 7.5 NVD, zero-privilege network attack, info disclosure). **Claw in Plain Sight 2608.20658: session-level policy-violating disclosure in 20.8–75.0% of tool-argument constructions — prompt-level privacy instructions are NOT a portable boundary.** ContextLeak 2608.27800 (RL-crafted malicious tool names/descriptions induce agents to pass runtime context as arguments). **Framing Gap 2608.27092: ten overt exfil frames are refused (0%) but reframing as "integrity signature"/"config field" drives 0%→100%; what actually WORKS is destination allow-lists (0%) and planner/reader capability splits (0%) — not model-side recognition.** SkillWatermark 2608.16026 (benign-looking skill descriptions encode private info in observable traffic patterns that pass auditors).
+
+**Q6 DELETION/ERASURE**: NIST SP 800-88 (Rev.1 withdrawn → Rev.2): sanitize/clear/purge/crypto-erase; **crypto-erase is the only practical primitive under wear-leveling + journaling**. Deletion propagation to derived artifacts (embeddings/caches/summaries) has no standard mechanism; GDPR Art. 17 (erasure) vs Art. 5(2) (accountability, which requires RETAINING evidence) is an unresolved tension. **Negative: no agent-memory-specific deletion-semantics research surfaced** (platform docs only). Practical erasure = crypto-erase of the envelope + accepted remanence in backups/snapshots + best-effort derived-data deletion.
+
+**Q7 BACKUP/RESTORE + ANTI-ROLLBACK**: TUF (role separation, online/offline keys, thresholds, expiry); Uptane (non-expiring images + repo separation). **restic: append-only enforcement is delegated to the REMOTE (rest-server / rclone restrictions) — the client holding the password can always delete; immutability must live server-side.** Restore verification practice = `restic check --read-data`.
+
+**Q8 SUPPLY CHAIN**: SLSA v1.2 = build-platform integrity + provenance guarantees, NOT content trust. Sigstore keyless (Fulcio + Rekor, OIDC identity, short-lived certs). Dependency pinning + hashes (pip `--require-hashes`, npm `integrity`) protects CONTENT SUBSTITUTION AT FETCH TIME ONLY. **xz CVE-2024-3094 (CVSS 10.0, CWE-506, verified NVD): malicious code in upstream tarballs 5.6.0/5.6.1 via long-term maintainer grooming — hash verification and pinning are USELESS because the release itself was poisoned; only build-provenance or behavioural detection catches it.** AgentGuard 2604.16309 (typosquatting: hybrid metadata+content detection beats lexical-only by 12–49% precision).
+
+**Q9 MODEL SUPPLY CHAIN**: safetensors protects LOADING (no pickle code execution), not provenance; HF cards list hashes but **no widely deployed signed-model-release standard**; **hash match proves byte-identity, not safety — weights can be malicious by design.**
+
+**Q10 DETECTION + FALSE POSITIVES**: Denning 1987 (IDS taxonomy); **Axelsson 2000: the base-rate fallacy — because intrusion rate is tiny, even 1% FPR overwhelms true positives; detector design must target FPR FIRST.** 2024-26: ClawSentry 2608.21101 (4-locus progressive monitoring: skill admission → invocation intent → execution effect → post-action consequence; contextual ASR 39.55% → 2.61% on SkillInject with clean utility ~83.8%); Locate-and-Judge 2606.23416 (attention-based skill scanning found live malicious skills that commercial scanners miss).
+
+**Q11 SECURITY UX**: reuses #401's warning-fatigue evidence (Akhawe & Felt 2013; Anderson 2016) — **agent-approval prompts shown per action will habituate like SSL warnings**. **Negative: no 2024-26 work evaluating approval-based defense habituation for agents.** Agent libOS 2606.03895 is the closest design point: "exact one-shot Human release for conditional high-sensitivity egress" + "durable causal evidence records … never grants authority" — rare high-stakes approval + evidence that INFORMS rather than decides. **Agent libOS explicitly disclaims: no prompt-injection prevention, no kernel sandboxing, no rollback of irreversible external effects** (an unusually honest scope statement).
+
+**Q12 STANDARDS** (DOCUMENTATION_AUDITED, normative not effectiveness): OWASP GenAI Top 10 2025 (LLM01 prompt injection, LLM04 data/model poisoning, LLM06 excessive agency, LLM08 vector/embedding weaknesses, LLM10 unbounded consumption); OWASP Agentic Security initiative; MITRE ATLAS (landing verified, tactic IDs not itemized); NIST AI RMF + SP 800-53 (AC-4 IFC, SC-7 boundary, AU-* audit).
+
+**Q13/Q14 MECHANISMS**: Vault (dynamic secrets/leases/revocation), SOPS/age (envelope encryption, key split), MCP OAuth resource-server pattern. **Negative space flagged for arm-4: no FIDO2/WebAuthn hardware-key-press-as-agent-approval work (0 cs.CR hits); no policy-as-code-for-agents work; no approval-habituation evaluation for agents.**
+
+## Transfers
+
+1. **Anti-rollback requires monotonic state outside the attacker** — a signed checkpoint alone is rollable (applies to any agent-memory "restore to known-good").
+2. **Fencing tokens → agent worker orchestration**: epoch-checked memory writes, stale-write rejection at the store; A-JWT is the concrete instantiation.
+3. **Destination allow-lists / capability isolation are the ONLY empirically demonstrated near-zero exfiltration defenses** (FLOWSEAL, Framing Gap); model-side recognition and prompt policies demonstrably fail (0%→100%).
+4. **Enforce outside the model at the effect sink** — the 2024-26 convergence across CaMeL/FLOWSEAL/SPA/APPA/Design Patterns.
+5. **FPR-first detector design** (Axelsson base-rate fallacy) — gate, don't block.
+6. **Crypto-erase is the only practical deletion primitive**; immutability must live server-side (restic).
+7. **Hash/pinning cannot stop a poisoned upstream release** (xz) — only provenance or behavioural detection.
+8. **Approval prompts habituate** — reserve them for rare high-stakes, one-shot, with evidence that informs.

research/memory-atlas-r1/AA-security-memory-poisoning/02_outward/arm4_adversarial_pass.md

@@ -0,0 +1,29 @@
+# #402 AA — OUTWARD arm-4: FRESH-CONTEXT ADVERSARIAL PASS (general-15, 2026-09-22, SUCCESS)
+
+Actor: general-15 (INDEPENDENT, fresh context). Ran the mandated A–EZ list (structured; every category covered) + 12 fresh Rune-specific attacks F1–F12.
+
+## Row-derived: SUCCEEDS 12 · PARTIAL 25 · FAILS 108 (Sum 145 verdicts across ~157 named attacks; mandated ~145 + 12 fresh)
+
+Full detail in the arm-4 report (kept verbatim in the controller notes). Summary of verdicts:
+
+**SUCCEEDS (12):** C (localhost not auth — no loopback-auth clause in architecture; harness :4096 reachable) · J (co-located hash + no external monotonic state → rollback free; Spine generations advisory/rewritable; git snapshots unauthenticated) · Q (0644 DB voids confidentiality half — `nobody` reads canonical store while the architecture guards the provider channel) · AC (policy rollback undetectable — policy files are nick-writable JSON, no version floor) · BR/BS/BT/BU (CLI `--no-dedupe` = unprivileged bypass; hard delete = live UX; direct SQLite edit defeats `authorize()` by construction — complete mediation fails at same uid) · CS/CU/CV-gap (no resource/quota governance; flooding poisons retrieval-by-volume; similarity-collapse merges provenance; dedupe receipts returned-to-caller, not persisted lineage) · EA/EE/EF (harness + wait-resume daemon have NO authentication — "able to connect" is the de-facto credential; point 8 fences workers only) · **F1** (hardcoded `audit_ledger.py:28` HMAC key → tamper-evidence chain forgeable → recovery gate is theatre) · **F2** (0644 DB voids the confidentiality half) · **F3** (the enforcement point is run by the entity it polices — points 1–3/8/10–11 are POLICY DISCIPLINE, not boundaries) · **F4** (quarantine is an unguarded state machine — whoever writes rows can set/clear the flag: censorship or release) · **F5** (bootstrapping dilemma: empty/unforgeable provenance on 456 MB of legacy rows — strict origin binding dead on arrival without a migration story) · **F6** (the human is the only trusted subject and the least verifiable — approvals rendered through model-summarized, markup-rendering, habituation-prone channel) · **F9** (total rollback freedom: no external monotonic floor anywhere) · **F10** (ambient-authority daemons bypass the worker model) · **F11** (the approval channel renders untrusted bytes: `RichLog(markup=True)`) · **F12** (derived-state divergence: poison the INDEXES not the rows — entries_fts/vec/associations separately writable, outside any fixity story) · EN/EO/EP (unauthorized READ: unobservable, unauditable in-process; silent scope hole in the architecture) · EY (clearance evidence unverifiable by a same-uid checker).
+
+**PARTIAL (25):** D (channel taxonomy needed for local files), G, I, K (append-only artifact truncatable/unsigned), P, S, T, U/V, W/X (tombstone identifier fields leak — #396 tension), Y, Z/AA/AB (restore-to-known-good attacker-steerable), AE/AF (right doctrine, zero implementation), AL/AM (memory→system-prompt steering below action threshold), AU–AY (survivorship/self-narration seam with #388/#406 — flag, don't claim), AZ-block (identity anchors have no governance clause — poisoning path open), BJ–BL (leak minimization parked at #401), CK (true in practice — "staged, not deferred" required), CW/CX (dedupe receipts forgeable caller-side), BY (labels bound trust not truth), CA/CB, CQ–CR (honest scope), CS-group, DV–DU, EV–EZ (clearance requires external verification).
+
+**FAILS (108):** all remaining mandated attacks — threats the architecture already refuses (crypto-by-property; enforce-at-sink; write-time binding; Sybil-resistant elevation; FPR-first; habituation-aware UX; honest root-compromise scope; no universal chain; no per-record trust; no model/worker direct writes; etc.).
+
+## Three sharpest findings
+
+1. **Enforcement claims contradict the honesty clause.** Point 7 correctly says same-uid enforcement is policy discipline; points 1–5/8/10–11 are written as boundaries. At same uid: complete mediation fails by construction (proposer skips the choke point; quarantine flag is writable; rollback is free; evidence chain forgeable with the hardcoded key). **Repair APPLIED**: global relabel — every in-process mechanism is "discipline, survives model/prompt compromise only"; genuine boundaries named (kernel MAC, namespaces, uid split, external monotonic floor, different-uid audit sink) as the ONLY process-compromise boundaries — none implemented today.
+2. **Recovery demands evidence the system cannot produce; the approval channel renders untrusted bytes.** Clearance requires "persistence removed" + "integrity checked" from a same-uid checker with zero persistence-detection; elevation goes through a model-summarized, markup-rendering, habituation-prone approval channel. Together: poisoned ledger + socially engineered approval = false CLEARED with full ceremony. **Repair APPLIED**: clearance requires external/human verification; safe rendering (escape-by-default) added as an architectural point; raw-evidence view + one-shot approvals (Agent-libOS pattern).
+3. **Bootstrapping + availability gaps are where utility pressure erodes the policy.** Empty provenance on 456 MB of legacy rows makes strict origin binding initially useless; no resource quotas makes flooding the cheapest poison. **Repair APPLIED**: explicit migration story (human-blessed batch provenance, never silent grandfathering) + write quotas as enforced store invariants.
+
+## Corrections required → applied before freeze
+
+1. **Relabel points 1–5/8/10 as POLICY DISCIPLINE**; name the sole process-compromise boundaries (none implemented).
+2. **Add missing architectural points**: safe rendering/escape-by-default (BG/F11); resource/quota governance (CS/CU); loopback authentication via SO_PEERCRED + dedicated uid for harness/daemon/listeners (C/EA/F10); policy + identity-anchor + quarantine-flag transitions through the choke point with version floors (AC/F4); provider retention/disclosure ledger (EI).
+3. **Fix evidence-chain language**: tamper-evidence claims conditioned on AUDIT_LEDGER_KEY leaving the repo and the agent's uid — else drop the claim (F1).
+4. **Rewrite clearance criteria**: external/human verification for persistence + integrity; "no alert" and "clean local check" establish nothing (EY/F1).
+5. **Add migration + quota story** for legacy unprovenanced rows (F5).
+6. **Grade the experiment families as DESIGN_INVARIANT** — research-only boundary forbids RUNE_DIRECT measurement of these mechanisms (F8).
+7. **Fix tense**: points 3/4/8 describe nothing that exists today; the master narrates them as DESIGNED, not current (inward: ABSENT ×8).

research/memory-atlas-r1/AA-security-memory-poisoning/03_applicability.md

@@ -0,0 +1,58 @@
+# #402 AA — Applicability (mandate: mechanisms tested against Rune's inward reality)
+
+Every mechanism carries a verdict: COVERED / ADOPT / ADAPT / EXPERIMENT / FUTURE / REJECT / PARK. Controller decisions from arm evidence + 01_inward + adversarial corrections. Row-derived totals machine-counted. ★ = build-precondition / implementation follow-through.
+
+| # | Mechanism | Verdict | Basis |
+|---|---|---|---|
+| 1 | Content/control separation (untrusted content informs cognition but cannot grant authority; enforced outside the model at the effect sink) | ADOPT | arm-2 (12 defenses >90% adaptive bypass; CaMeL/FLOWSEAL/SPA/APPA convergence); adversarial AL/AM pass; mandate §10/§11 |
+| 2 | Proposal/authorization separation (deterministic authorize() choke point; models/workers propose; only the authorize function disposes) | ADOPT | Clark-Wilson (A1-3); Anderson reference monitor (A1-8); adversarial F3 (in-process = policy discipline, labeled) |
+| 3 | Write-time origin binding (authority bound from the input CHANNEL at ingestion; taint JOINs through derivation; never re-derived at read time) | ADOPT | TMA-NM 2606.24322 machine-checked T1/T2/T3 (A2-29); inward C: source is forgeable free-text today |
+| 4 | Quarantine as first-class state (preserved, readable for investigation, excluded from application, lineage retained, never silently deleted) | ADOPT | mandate §59/§78; adversarial F4 (unguarded state machine — transitions must go through authorize()); noWorkflow/ProvBook pattern |
+| 5 | Sybil-resistant elevation (count distinct evidence ROOTS, never reports/agents/similarity; human as the only declassification authority) | ADOPT | Epistemic Sybil Resistance 2609.01873 (A2-26: report multiplicity collapses coverage 0.940→0.263); TMA-NM T3 |
+| 6 | ★ Crypto by property (per-threat mechanism selection; no universal chain; anti-rollback requires monotonic state outside the attacker) | ADOPT | arm-3 crypto table (A3-1..A3-6); adversarial J (no external monotonic state exists in Rune today) |
+| 7 | ★ Key custody honesty (secrets outside agent uid; same-uid readability assumed; encryption at rest = disk theft only) | ADOPT | arm-1 key-custody matrix; NIST SP 800-57 (A3-1); inward I: auth.json + /proc/pid/environ exposure |
+| 8 | ★ Tombstone vs payload distinction; crypto-erase; derived-data best-effort deletion | ADOPT | NIST SP 800-88r2 (A3-24); inward B2: hard delete, no tombstone; #401 cross-flag |
+| 9 | Destination allow-lists / capability isolation (Framing Gap: both reduce the evaluated exfiltration attacks to 0% in its synthetic setup, while model-side recognition fails under reframing) | ADOPT | Framing Gap 2608.27092 (A3-17: model-side recognition fails 0%→100%, allow-lists close to 0%); FLOWSEAL (leak 52.2%→0.5%) |
+| 10 | ★ Fencing tokens / authority generations (stale-write rejection at the store; per-agent PoP keys; workers never inherit Main authority) | ADOPT | Kleppmann 2016 (A3-2); A-JWT 2509.13597 (A3-18); inward K: no fencing exists; adversarial EA-EE |
+| 11 | Detection discipline: deterministic violation auto-contain; anomaly becomes SUSPECTED only; FPR-first; typed security states | ADOPT | Axelsson 2000 (A3-8: base-rate fallacy); ClawSentry 2608.21101 (A3-16: progressive 4-locus monitoring); mandate §50-§55 |
+| 12 | ★ Provider boundary: access ends at the explicitly authorized interface; least-context disclosure; disclosure record | ADOPT | Framing Gap (A3-17); Claw in Plain Sight (A3-14: 20.8-75% policy-violating disclosure); mandate §29/§30 |
+| 13 | ★ Substrate security awareness (derived authorized-actor view; rogue-agent fixture; security state without false certainty) | ADOPT | mandate §39-42; Agent libOS 2606.03895 (A3-18: 3-plane design); inward F: no security state exists |
+| 14 | ★ Safe rendering (escape-by-default in TUI; content isolation; link handling; no auto external-resource loading) | ADOPT | inward O: RichLog(markup=True) live attack surface; adversarial BG/F11 SUCCEEDS; mandate §61 |
+| 15 | ★ Input validation (Unicode confusables; encoding attacks; control chars; terminal escape; Markdown injection; path injection; SQL injection) | ADOPT | mandate §60; adversarial CC-CJ pass; no validation exists today |
+| 16 | Signed content = trustworthy | REJECT | xz CVE-2024-3094: poisoned upstream release defeats hashing/pinning; A: signature ≠ correctness; TMA-NM T1 |
+| 17 | Localhost = trusted | REJECT | arm-1: any local process of any uid can connect to loopback; adversarial C SUCCEEDS; SO_PEERCRED + dedicated uid is the real fix |
+| 18 | Same-user process = Rune component | REJECT | arm-1: same-uid process reads/writes everything; no isolation; adversarial DM/DO |
+| 19 | Append-only = tamper-proof | REJECT | adversarial K: await_intent_log is truncatable/unsigned; audit_ledger HMAC key hardcoded (F1) |
+| 20 | Model output possesses write authority by itself | REJECT | mandate §22; adversarial AJ; Clark-Wilson shape (models propose, deterministic authority disposes) |
+| 21 | Worker identity inherits Main authority automatically | REJECT | mandate §26; adversarial AE/AG; #395 carry; fencing tokens required |
+| 22 | Tool availability = authorization | REJECT | mandate §25; adversarial AH/AI; capability scoping required |
+| 23 | Per-record trust scoring (no taint propagation) | REJECT | Salami/MemCollusion 2608.01637 (A2-19): 75% ASR surviving dilution; compositional fragments invisible to per-record inspection |
+| 24 | Sufficiency-based abstention as a security defense | REJECT | GRAB-RAG 2608.22228 (A2-30): abstention answers 41.6% of misleading-context questions |
+| 25 | Trust-score + temporal-decay as a primary defense | EXPERIMENT | 2601.05504 (A2-30): thresholds brittle; realistic pre-existing memories break naive thresholds; time-bounded re-verification has merit but needs calibration |
+| 26 | Forensic trajectory detection as a standalone blocking defense | EXPERIMENT | 2606.30566 (A2-30): AUC 0.9904 but 100% FP conditional on recall_before_send=1; 24.7-52.6% unconditional benign FPR; "a valid attack precondition, not a maliciousness predicate" |
+| 27 | FIDO2/WebAuthn hardware-key-press as agent-action approval | FUTURE | arm-3 negative: this R1 search found no direct published work in the searched sources as of 2026-09-22; potentially a novel approval primitive (user-presence as the only brake) |
+| 28 | Policy-as-code (OPA/Cedar-style) for LLM agents | FUTURE | arm-3 negative: no arXiv-indexed 2025-26 work found; the space uses bespoke IFC algebras |
+| 29 | Root-compromise resistance | PARK | mandate §57: out of T1 scope; bounded security > fake omniscience; adversarial CP/CQ |
+| 30 | Nation-state threat model for T1 | REJECT | adversarial CR; T1 adversary = same-uid process + network attacker + poisoned content |
+| 31 | SLSA/Sigstore/supply-chain attestation for the Rune repo | FUTURE | mandate §69; arm-3 Q8; xz lesson: pinning + hashing cannot stop a poisoned upstream release; SLSA v1.2 + Sigstore are the right mechanisms but T1-minimum is dependency pinning + hash verification |
+| 32 | Model supply-chain integrity (hashing + safetensors) | ADAPT | arm-3 Q9: hash match ≠ safe model; safetensors protects loading not provenance; no signed-release standard exists; hash match gives fixity only |
+| 33 | Resource/quota governance for Memory writes (admission control; bounded parsing; backpressure) | ADOPT | adversarial CS/CU SUCCEEDS (no quota governance exists); mandate §71; Cowan 4±1 chunk limit (from #401) |
+| 34 | Recovery/containment: clearance requires external verification; stopping of alerts ≠ attacker gone | ADOPT | adversarial EY/EZ/F1; mandate §56; typed states + evidence-based clearance |
+| 35 | Alert fatigue prevention (deterministic protections by default; interrupt only for consequential ambiguity/irreversible/user-only/confirmed) | ADOPT | Akhawe & Felt 2013 (A3-16 from #401); Anderson 2016; mandate §75; adversarial BO/BP pass |
+| 36 | Trusted user ≠ infallible user (authenticated ≠ intentional ≠ correctly scoped; preview + reversibility, not paternalistic blocking) | ADOPT | mandate §76; adversarial E/F pass; #401 routed-writes carry |
+| 37 | Quarantine as a separate canonical DB | REJECT | adversarial BV: same store, flagged, readable; separate DB creates a second authority |
+| 38 | Quarantined content never inspectable | REJECT | adversarial BW: investigation requires readability; quarantine ≠ deletion |
+| 39 | Taint propagates forever | REJECT | adversarial BX: taint explosion makes the system unusable; human declassification is the clearing path |
+| 40 | One trust score replaces typed labels | REJECT | adversarial BY: salami defeats per-record scoring; typed labels carry different properties |
+| 41 | Security label determines truth authority | REJECT | adversarial BZ: labels bound trust, not truth; #388 owns truth |
+| 42 | Unknown provenance treated as malicious | REJECT | adversarial CA: UNKNOWN ≠ CONFIRMED-hostile; quarantine is the right response |
+| 43 | Explicit-user always outranks externally verified fact | REJECT | adversarial CB: explicit-user is a channel (channel trust ≠ content truth); #388 owns truth precedence |
+| 44 | Non-executable document cannot poison retrieval | REJECT | adversarial CC; AgentPoison (A2-13): poisoning happens at ingestion/retrieval, not code execution |
+| 45 | Prompt injection requires executable code | REJECT | adversarial CD; Greshake 2302.12173: text alone can act as "arbitrary code execution" |
+| 46 | Security can wait until after #406 | REJECT | adversarial CK; the security gaps are live NOW (inward: 8 ABSENT, 3 BYPASS); "staged, not deferred" |
+| 47 | Failure to prove total security blocks T1 | REJECT | adversarial CM; bounded security is the design |
+| 48 | Single-user system needs no authorization | REJECT | adversarial CN; same-uid malware is the primary adversary; agents are the secondary |
+| 49 | Local machine is outside the threat model | REJECT | adversarial CO; qBittorrent WAN-exposed; wait-resume daemon 0.0.0.0:8791 |
+| 50 | Security metadata belongs in persona / security state via Rune's emotions | REJECT | adversarial CY/CZ; typed states are separate from self-expression |
+
+Row-derived: COVERED 0 · ADOPT 19 · ADAPT 1 · EXPERIMENT 2 · FUTURE 3 · REJECT 24 · PARK 1 · Sum 50

research/memory-atlas-r1/AA-security-memory-poisoning/04_innovation.md

@@ -0,0 +1,105 @@
+# #402 AA — Innovation (mandate §85)
+
+No manufactured novelty: each candidate derives from the INWARD gap (01_inward: no authorization/integrity/confidentiality/security-state/quarantine/taint) and arm evidence. Each names prior art, evidence for/against, falsifier, kill criterion.
+
+## A. CONTENT / CONTROL SEPARATION (ADOPT)
+
+External content may inform cognition but cannot grant authority. Prior art: CaMeL 2503.18813; FLOWSEAL 2609.14003; SPA 2608.27234; APPA 2607.24625; Design Patterns 2506.08837; Greshake 2302.12173. For: 12 defenses >90% ASR adaptive bypass prove model-level filtering fails; enforcement outside the model at the effect sink is the convergent 2024-26 design. Against: utility loss (77% vs 84%). Falsifier: E1. Kill: enforcement overhead exceeds the risk it mitigates (measured).
+
+## B. PROPOSAL / AUTHORIZATION SEPARATION (ADOPT)
+
+Models/workers propose; deterministic authorize() authorizes. Prior art: Clark-Wilson (A1-3); Anderson reference monitor (A1-8); Hardy confused deputy (A1-7). For: inward B shows no authorization exists; ambient tool authority is the anti-pattern. Against: complete mediation fails at same uid (F3). Falsifier: E26. Kill: authorize() overhead blocks all useful operations.
+
+## C. TYPED SECURITY ORIGIN (ADOPT)
+
+Actor/source/origin separated as distinct fields, not one trust score. Prior art: TMA-NM origin binding (A2-29); Epistemic Sybil Resistance 2609.01873 (A2-26); Salami (A2-19) proves per-record scoring unsound. For: inward C shows source is a forgeable free-text field; Salami proves compositional fragments invisible to per-record inspection. Against: taint explosion risk (test per mandate §79). Falsifier: E2. Kill: taint explosion makes every record unusable.
+
+## D. QUARANTINE FIRST-CLASS SEMANTICS (ADOPT)
+
+Suspect content preserved but inactive. Prior art: noWorkflow/ProvBook (A3-27); mandate §59/§78. For: inward has no quarantine; adversarial F4 proves unguarded quarantine flags are themselves an attack surface. Against: storage overhead. Falsifier: E3/E25. Kill: quarantine rate makes the system unusable.
+
+## E. PROVENANCE-AWARE TAINT (ADOPT)
+
+Suspicion propagates through derivation. Prior art: TMA-NM T1/T2/T3; SPA persistent labeled artifacts (A1-21); Salami (A2-19). For: inward: no taint field exists; summarization/tool echo/merge are the laundering edges. Against: taint explosion. Falsifier: E2. Kill: taint explosion.
+
+## F. SECURITY-SCOPED CAPABILITIES (ADOPT)
+
+Each action receives only the authority required for that specific operation. Prior art: capability-based security (Dennis & Van Horn 1966; Levy 1984; Miller 2006); Hardy confused deputy (A1-7). For: inward J shows tools have ambient authority. Against: ambient authority cannot be fully removed from a Python process (arm-1 honest limits). Falsifier: E14. Kill: capability overhead exceeds the risk.
+
+## G. AUTHORITY GENERATIONS (ADOPT)
+
+Stale workers/sessions rejected via monotonic counter. Prior art: Kleppmann fencing tokens (A3-2); A-JWT (A3-19); #395 carry. For: inward K shows no fencing exists; workers inherit ambient authority. Against: storage-side validation overhead. Falsifier: E9/E30. Kill: fencing overhead exceeds the stale-write risk.
+
+## H. RESTORE SECURITY GATE (ADOPT)
+
+Fixity/authenticity + quarantine + semantic reconciliation + ledger-forward. Prior art: #396 (manifests); TUF role separation (A3-5); Uptane non-expiring images (A3-6); NIST SP 800-88r2 (A3-23). For: mandate §44/§67; adversarial Z/AA/AB pass (restore-to-known-good is attacker-steerable without a version floor). Against: adds restore friction. Falsifier: E11. Kill: restore overhead exceeds the poisoning risk.
+
+## I. COMPENSATING SECURITY ROLLBACK (ADOPT)
+
+Reuse #401 undo/history mechanism for poisoned state without destructive history rewriting. Prior art: #401 compensating-event undo (Sagas/Berlage/Sun — #401 arm-3 ledger; no AA ledger row). For: inward B2 shows hard delete is the current behavior; adversarial BU confirms direct DB edit without audit. Against: adds complexity. Falsifier: E3 (containment). Kill: compensation complexity exceeds the recovery value.
+
+## J. CRYPTO BY PROPERTY (ADOPT)
+
+Choose mechanism by threat. Prior art: arm-3 crypto table (A3-1..A3-6). For: inward shows no crypto; adversarial J confirms no external monotonic state. Against: crypto adds complexity. Falsifier: E10. Kill: overhead exceeds the threat.
+
+## K. LEAST-CONTEXT DISCLOSURE (ADOPT)
+
+Provider gets minimum needed context. Prior art: Framing Gap 2608.27092 (A3-17); Claw in Plain Sight 2608.20658 (A3-14); CaMeL capability labels (A1-18). For: inward I shows no disclosure record exists; provider currently gets full active context. Against: utility reduction. Falsifier: E32/E38. Kill: least-context degrades model quality beyond acceptable threshold.
+
+## L. SECURITY OBSERVABILITY WITHOUT SECRET SPILL (ADOPT)
+
+Structured/redacted events; tiered retention. Prior art: NIST SP 800-92 (A1-12); inward M/N (notes 0644, 787 transcripts, no redaction); adversarial BM/BN pass. For: inward shows secrets are in plaintext-adjacent trees. Against: overhead. Falsifier: E27. Kill: redaction loses forensic value.
+
+## M. NON-EXECUTABLE MEMORY CONTENT (ADOPT)
+
+Retrieved/stored instructions remain data unless explicitly promoted through control authority. Prior art: mandate §14; CaMeL (A1-18); Design Patterns (A3-10). For: mandate §14/§61; adversarial AL/AM/AN pass. Against: no counter-evidence found. Falsifier: E1. Kill: enforcement impossible without breaking all content display.
+
+## N. POISON-RESISTANT LEARNING (ADOPT)
+
+Lessons require verified outcome + source lineage. Prior art: #400 experience seam; #397 provenance; mandate §32. For: inward L: no experience store exists; adversarial E17 (learning poison). Against: no counter-evidence. Falsifier: E17. Kill: learning-gate cost exceeds the poisoning risk.
+
+## O. EXTERNAL-INTELLIGENCE QUARANTINE (ADOPT)
+
+Model contributions remain candidate cognition until Growth-Delta promotion. Prior art: mandate §32; #397 provenance. For: mandate §32; adversarial E17/EK. Against: no counter-evidence. Falsifier: E17. Kill: quarantine rate makes learning impossible.
+
+## P. SECURITY HEALTH PROBES (ADOPT)
+
+Deterministic checks for store/index integrity, policy version, authority generation, manifest state, credential health — without periodic LLM cognition. Prior art: mandate §85-P; arm-1 P6 (uid split); adversarial F9 (no external monotonic state); inward E (Spine generations advisory). For: mandate §85-P. Against: probe overhead. Falsifier: E20. Kill: probes fire so often they become noise.
+
+## Q. DETERMINISTIC-VIOLATION vs ANOMALY SPLIT (ADOPT)
+
+Proven violation may auto-contain; anomaly becomes SUSPECTED. Prior art: Axelsson 2000 (A3-8); ClawSentry 2608.21101 (A3-16); mandate §50-§55. For: mandate §50-§55. Against: FPR calibration data thin. Falsifier: E24. Kill: suspicion/confirmation cannot be distinguished.
+
+## R. REVERSIBLE CONTAINMENT (ADOPT)
+
+Isolate ambiguity without destroying data. Prior art: mandate §55; arm-3 Agent libOS 2606.03895 (A3-18). For: mandate §55. Against: containment overhead. Falsifier: E25. Kill: containment always destructive.
+
+## S. SECURITY STATE WITHOUT FALSE CERTAINTY (ADOPT)
+
+Typed states rather than one risk score. Prior art: mandate §51; adversarial BY (one score is worse). For: mandate §51. Against: no counter-evidence. Falsifier: E24. Kill: typed states proliferate into unusable complexity.
+
+## T. HOST / MEMORY DEFENSE LAYERS (ADAPT)
+
+Unauthorized-read protection, unauthorized-write protection, intrusion detection, exfiltration control, compromise recovery. Prior art: arm-1 host security (P6: uid split, SO_PEERCRED, kernel MAC); arm-3 exfiltration (A3-15: destination allow-lists). For: inward A/M/O show 0644 files, plaintext credentials, unobservable reads. Against: OS-level defense is outside Rune's implementation boundary; requires coordination with OS. Falsifier: E21/E22/E31. Kill: OS-level defense cost exceeds the confidentiality value for a single-user system.
+
+## U. SUBSTRATE SECURITY VIEW (ADAPT)
+
+Derived live view of authorized actors, capabilities, sessions, authority epochs, suspicious activity, containment state — without becoming canonical authority. Prior art: mandate §40; Agent libOS (A3-17). For: inward F: no security state exists; mandate §40. Against: could become a second canonical store. Falsifier: E39. Kill: view maintenance cost exceeds its detection value.
+
+## V. AUTHORIZED-ACTOR MODEL (ADOPT)
+
+Protocol participation ≠ authority. Prior art: mandate §41; arm-1 SO_PEERCRED (A1-14); adversarial EA-EE. For: inward: no actor registry exists; daemon on 0.0.0.0:8791; harness on 127.0.0.1:4096 — both unauthenticated. Against: no counter-evidence. Falsifier: E29. Kill: actor-registry overhead exceeds the rogue-agent risk.
+
+## W. OUTBOUND DATA-CAPABILITY CONTROL (ADAPT)
+
+Network/tool egress scoped like any other capability. Prior art: Framing Gap 2608.27092 (A3-17); FLOWSEAL (A1-20); NIST SP 800-53 SC-7 (A1-12). For: inward: qBittorrent WAN-exposed; no egress control. Against: brittle universal denylists are bad; per-tool scoping is better. Falsifier: E35 exfil canary. Kill: egress control breaks all legitimate network use.
+
+## X. PROVIDER BOUNDARY ENFORCEMENT (ADOPT)
+
+Provider receives only explicitly disclosed data, never implicit Rune authority. Prior art: mandate §29/§30; Framing Gap (A3-17); CaMeL (A1-18). For: inward I: no disclosure record; auth.json keys. Against: provider needs context to be useful. Falsifier: E32/E33/E38. Kill: least-context makes the model useless.
+
+## Y. COMPROMISE CLEARANCE PROOF (ADOPT)
+
+Rune cannot declare attack resolved merely because alerts stop. Prior art: mandate §56; adversarial EV-EZ/F1; agent libOS (A3-18). For: inward: no recovery mechanism exists; F1 shows the evidence chain is forgeable. Against: no counter-evidence. Falsifier: E41. Kill: clearance overhead exceeds the compromise risk.
+
+Row count: 25 candidates (A–Y) — ADOPT 22 · ADAPT 3 (T, U, W) · PARK 0 · Sum 25.

research/memory-atlas-r1/AA-security-memory-poisoning/05_adversarial.md

@@ -0,0 +1,195 @@
+# #402 AA — Adversarial (mandate §86)
+
+Arm-4 (general-15): INDEPENDENT actor, FRESH CONTEXT, did not write the architecture. Mandated A–EZ (145 attacks) + 12 fresh Rune-specific (F1–F12). Full detail: 02_outward/arm4_adversarial_pass.md
+
+- ID. FAILS — Attack: Reason [Verdict].
+- A. FAILS — signed=trustworthy: xz CVE-2024-3094: poisoned upstream release defeats hashing/pinning; signature ≠ correctness; TMA-NM T1.
+- B. FAILS — real URL=safe claim: origin binds the channel, not content truth; Venkit 2410.22349 citation ≠ support.
+- C. SUCCEEDS — localhost=trusted: architecture had NO loopback-auth clause; 127.0.0.1 is not auth; ufw permits lo; harness :4096 reachable [SUCCEEDS (live)].
+- D. PARTIAL — local files trusted: write-time binding needs a channel taxonomy; mine_file/add_chunk accept caller-supplied source_path.
+- E. FAILS — user wrote it=correct: user-driven delivery is a documented injection channel (Greshake); irreducible, must be stated [FAILS-by-design].
+- F. FAILS — authenticated user=intentional: authenticated ≠ intentional ≠ correctly scoped [FAILS-by-design].
+- G. FAILS — reputable provider trusted: provider output = proposal, never disposition; reputation is not a key.
+- H. FAILS — model identity=integrity: no signed-model-release standard exists.
+- I. FAILS — hash match=model safety: weights can be malicious by design; hash gives fixity only.
+- J. SUCCEEDS — hashing Memory=tamper-proof: co-located hash + NO external monotonic state → rollback free; Spine generations advisory/rewritable; git snapshots unauthenticated [SUCCEEDS (live)].
+- K. PARTIAL — append-only=secure: sole append-only artifact (await_intent_log) is truncatable/unsigned; different-uid sink absent.
+- L. FAILS — one hash chain for everything: crypto-by-property forbids it.
+- M. FAILS — sign every row solves provenance: TMA-NM T1: signing authenticates the WRITER, not the truth.
+- N. FAILS — row signatures = provenance: same as M.
+- O. FAILS — same-host signing stops root: TCB argument; root holds the key.
+- P. FAILS — TPM solves all key problems: unsealing reveals to the caller's memory; root can re-seal.
+- Q. FAILS — encryption at rest prevents exfiltration: 0644 plaintext DB makes egress discipline moot; the architecture never stated the permission baseline [FAILS (live)].
+- R. FAILS — disk encryption makes field encryption unnecessary: disk theft only; not same-uid.
+- S. FAILS — sensitive data must never leave local: absolute localism unimplementable and unauditable; least-context is correct.
+- T. FAILS — every external call is a violation: minimum-necessary framing is correct.
+- U. FAILS — provenance always fully visible: display leaks (BJ); manufactured provenance (Sybil).
+- V. FAILS — more provenance = more trust: more labels = more laundering surface (TMA-NM 68%).
+- W. FAILS — deleted payload should remain for provenance: tombstone ≠ payload; #396/#401 carry.
+- X. FAILS — tombstone retains payload: acknowledged; identifier/provenance fields themselves leak (unresolved).
+- Y. FAILS — secure deletion easy with backups: crypto-erase only; snapshots/remanence remain.
+- Z. PARTIAL — old backup always safe to restore: restore-to-known-good is attacker-steerable without a version floor.
+- AA. PARTIAL — valid manifest = semantically safe: fixity ≠ semantic correctness.
+- AB. PARTIAL — valid signature = trustworthy restore: signature authenticates the writer; F1 shows the chain is forgeable.
+- AC. SUCCEEDS — old valid policy rollback harmless: policy files are nick-writable JSON; NO version floor; policy state not covered by point 6 [SUCCEEDS (live)].
+- AD. FAILS — timestamps prevent replay: fencing tokens checked at the store; entirely absent today.
+- AE. PARTIAL — worker result trusted if ID matches: right doctrine (A-JWT), zero implementation.
+- AF. PARTIAL — lease expiry is availability-only: Kleppmann: leases cannot be made safe by re-checking expiry; fencing required.
+- AG. FAILS — global worker credential acceptable: per-agent PoP keys required.
+- AH. FAILS — tool availability implies authorization: points 1-2: authorize() disposes; residual F3 (in-process).
+- AI. FAILS — model tool call implies authorization: same.
+- AJ. FAILS — models should write Memory directly: certified TP (Clark-Wilson); today the CLI/agent IS the direct writer.
+- AK. FAILS — reflection can update security policy: policy is human-owned; self-modification = BB/BC failure.
+- AL. PARTIAL — retrieved document may instruct if useful: effect-sink enforcement means instruction-in-context grants nothing — but poisoned memory into system-prompt steers cognition and crafts approvals (F6).
+- AM. PARTIAL — memory can go into system instructions: must state: memory never enters system-prompt position without provenance gating.
+- AN. FAILS — injection solved by telling model to ignore: 12 defenses >90% ASR adaptive.
+- AO. FAILS — injection is purely a model problem: enforce at the sink.
+- AP. FAILS — RAG poisoning solved by citations: citation ≠ support.
+- AQ. FAILS — multiple agreeing sources eliminate poisoning: Sybil: count ROOTS not reports.
+- AR. FAILS — 20 copies = 20 independent sources: Epistemic Sybil 2609.01873: coverage 0.940→0.263.
+- AS. FAILS — similarity can be a trust score: Salami 75% ASR; dedupe tracks similarity not ancestry.
+- AT. FAILS — warm memories deserve authority: recency is an attack primitive.
+- AU. PARTIAL — retry success validates diagnosis: #400 carry; not covered by the 14 points — seam to #388/#406.
+- AV. PARTIAL — task success proves memories correct: same seam.
+- AW. PARTIAL — Growth Delta proves causal explanation: same seam.
+- AX. PARTIAL — saying 'I learned' proves learning: self-narration is data; must not become memory with curated source.
+- AY. PARTIAL — Synthetic Experience true because experienced: same seam.
+- AZ. SUCCEEDS — preferences inferable from arbitrary retrieved text: no governance clause; a poisoned memory → user-model path is open [SUCCEEDS (live)].
+- BA. SUCCEEDS — persona may evolve from repeated generated opinions: identity anchors are files with no versioning/authority; model tool layer can write them [SUCCEEDS (live)].
+- BB. FAILS — values change automatically if outcomes improve: human-owned; but no enforcement.
+- BC. FAILS — security policy may self-evolve via Growth Delta: correctly forbidden.
+- BD. PARTIAL — provider swap inherits credentials: provider boundary holds for access; identity anchors are ambient-authority files.
+- BE. PARTIAL — compromised provider can't affect identity: identity is 'external' only by assertion today.
+- BF. PARTIAL — model can't affect identity because identity is external: same.
+- BG. SUCCEEDS — non-canonical projection can't be attack surface: no safe-rendering clause at all; RichLog(markup=True) [SUCCEEDS (live)].
+- BH. PARTIAL — UI state can't influence cognition: pins affect view only (by design) but no enforcement.
+- BI. PARTIAL — a pin is harmless: by design view-only; no enforcement.
+- BJ. PARTIAL — provenance display can't leak: leak-minimization parked at #401; absent here.
+- BK. PARTIAL — 'no source found' always safe: must not render as 'no risk'.
+- BL. PARTIAL — error messages can't leak: no error-path redaction discipline.
+- BM. FAILS — audit log should contain everything: tiered/redacted logging compatible with forensics.
+- BN. FAILS — redaction makes logs useless: today's logs are 0644 and unredacted.
+- BO. FAILS — every alert should interrupt: habituation evidence.
+- BP. FAILS — more confirmations are safer: same.
+- BQ. FAILS — read-only mode is sufficient security: read-only doesn't stop rollback/DoS/exfil.
+- BR. SUCCEEDS — CLI admin paths need no governance: --no-dedupe is an unprivileged bypass; 'receipted bypass' ≠ authorized bypass [SUCCEEDS (live)].
+- BS. SUCCEEDS — --no-dedupe is only a quality issue: live unmonitored bypass [SUCCEEDS (live)].
+- BT. SUCCEEDS — hard delete is only a UX issue: no tombstone; destroys evidence [SUCCEEDS (live)].
+- BU. SUCCEEDS — direct DB edit OK without audit: defeats authorize() by construction; complete mediation fails [SUCCEEDS (live)].
+- BV. FAILS — quarantine needs separate canonical DB: same store, flagged, readable.
+- BW. FAILS — quarantined data should never be inspectable: investigation requires readability.
+- BX. FAILS — taint should propagate forever: taint explosion; human declassification clears.
+- BY. FAILS — one trust score is safer: Salami kills per-record scores.
+- BZ. FAILS — security label determines truth: labels bound trust not truth; #388 owns truth.
+- CA. FAILS — unknown provenance = malicious: UNKNOWN ≠ CONFIRMED; quarantine is the response.
+- CB. FAILS — explicit-user always outranks external fact: channel trust ≠ content truth.
+- CC. FAILS — non-executable document can't poison retrieval: AgentPoison: poisoning at ingestion/retrieval.
+- CD. FAILS — injection requires executable code: Greshake: text alone acts as arbitrary code execution.
+- CE. FAILS — tool output trusted because tool produced it: MCPTox/ShareLock: descriptions/schemas/split payloads are channels.
+- CF. FAILS — schema-valid = safe: valid schema ≠ safe content.
+- CG. FAILS — JSON prevents injection: same.
+- CH. FAILS — Markdown is inert: renderer-dependent; TUI renders markup.
+- CI. FAILS — terminal output is safe text: escape sequences.
+- CJ. FAILS — image metadata can't affect cognition: #403 seam; metadata is a channel.
+- CK. FAILS — security can wait until after #406: gaps are live NOW; 'staged, not deferred' required [FAILS (but true in practice)].
+- CL. FAILS — security must precede remaining research: staged minimum, not blocking.
+- CM. FAILS — failure to prove total security blocks T1: bounded security is the design.
+- CN. FAILS — single-user needs no authorization: same-uid malware is the primary adversary [FAILS (live)].
+- CO. FAILS — local machine outside threat model: qBittorrent WAN-exposed; daemon 0.0.0.0:8791 [FAILS (live)].
+- CP. FAILS — Rune must solve root compromise: honest scope.
+- CQ. FAILS — security without root protection is worthless: honesty beats omniscience theatre.
+- CR. FAILS — nation-state should define T1: T1 adversary = same-uid + network + poisoned content.
+- CS. PARTIAL — availability is not security: no resource/quota governance in the architecture [PARTIAL→SUCCEEDS (gap)].
+- CT. PARTIAL — DoS is only resource placement: flooding poisons retrieval-by-volume.
+- CU. SUCCEEDS — memory flooding harmless if disk cheap: no quota; FTS/vec/disk exhaustion [SUCCEEDS (gap)].
+- CV. PARTIAL — dedupe solves duplicate poisoning: dedupe without provenance preservation IS a vector.
+- CW. PARTIAL — dedupe receipts are trusted lineage: receipts are forgeable caller-side artifacts.
+- CX. PARTIAL — similarity collapse can merge security provenance: TMA-NM laundering edge; receipts not persisted.
+- CY. FAILS — security metadata belongs in persona: typed states are separate.
+- CZ. FAILS — security state should appear through Rune's emotions: no anthropomorphic security theatre.
+- DA. FAILS — any unusual access = compromise: anomaly ≠ compromise.
+- DB. FAILS — anomaly should lock Rune: gated anomaly handling.
+- DC. FAILS — false positives are harmless: Axelsson base-rate.
+- DD. FAILS — zero false positives required: impossible; FPR-first design.
+- DE. PARTIAL — minimizing FPs beats detection: balance required, not blindness.
+- DF. FAILS — maximum sensitivity is safest: same.
+- DG. FAILS — no alert = no compromise: no alerts ≠ secure.
+- DH. FAILS — new network is automatically hostile: benign-lookalike discipline.
+- DI. FAILS — large legitimate import is attack: batch quarantine, not blocking.
+- DJ. FAILS — bulk user edit means compromise: authenticated user ≠ attacker.
+- DK. FAILS — provider change is inherently suspicious: benign-lookalike.
+- DL. FAILS — VPN/IP change proves account compromise: same.
+- DM. FAILS — same-user process is trusted: same-uid = full access [FAILS (live)].
+- DN. FAILS — filesystem permissions prevent all snooping: 0644 readable by nobody; same-uid unrestricted [FAILS (live)].
+- DO. FAILS — local process-memory snooping impossible: ptrace/Yama analysis.
+- DP. FAILS — clipboard leakage negligible: X11 no isolation.
+- DQ. FAILS — browser compromise irrelevant to Rune: session/token theft.
+- DR. FAILS — TLS completely solves network snooping: TLS terminates at nick-readable endpoints.
+- DS. FAILS — TLS endpoint is automatically trustworthy: endpoint ≠ authorization.
+- DT. FAILS — exposed port proves vulnerability: exposed ≠ compromised.
+- DU. FAILS — no exposed ports means no remote risk: supply chain (xz).
+- DV. FAILS — LLM should notice intrusions itself: no.
+- DW. FAILS — Rune should ask user about every anomaly: habituation.
+- DX. FAILS — containment should always be destructive: reversible containment.
+- DY. FAILS — quarantine should delete suspect content: quarantine ≠ deletion.
+- DZ. FAILS — cleared alert needs no forensic history: forensics required.
+- EA. SUCCEEDS — protocol fluency permits joining runtime: harness + daemon have NO authentication; 'able to connect' is the de-facto credential [SUCCEEDS (live)].
+- EB. FAILS — worker name proves identity: name ≠ identity.
+- EC. FAILS — PID proves identity: PID reuse.
+- ED. FAILS — old valid credential valid forever: authority generations.
+- EE. SUCCEEDS — able-to-connect implies may-query: same as EA [SUCCEEDS (live)].
+- EF. SUCCEEDS — same-host agent inherits local trust: same as EA [SUCCEEDS (live)].
+- EG. PARTIAL — provider may see full context because models need context: least-context handles it; utility trade-off.
+- EH. FAILS — provider can't access more than sent therefore privacy solved: retention/traffic patterns unaddressed (SkillWatermark).
+- EI. SUCCEEDS — provider retention needn't be tracked: no retention/disclosure ledger in the architecture [SUCCEEDS (gap)].
+- EJ. FAILS — provider terms inferable from reputation: reputation ≠ authorization.
+- EK. FAILS — frontier provider more trustworthy than local: provider reputation ≠ authorization.
+- EL. FAILS — stronger model deserves more authority: authority ≠ capability.
+- EM. FAILS — expensive-model output bypasses quarantine: cost ≠ trust.
+- EN. SUCCEEDS — unauthorized READ less serious than WRITE: reads are unobservable and unauditable in-process; silent scope hole [SUCCEEDS (live)].
+- EO. SUCCEEDS — read attempts need no auditing: same [SUCCEEDS (live)].
+- EP. SUCCEEDS — if attacker can't write, snooping is acceptable: same [SUCCEEDS (live)].
+- EQ. FAILS — Substrate should keep its own canonical attack-history DB: derived view only.
+- ER. FAILS — Substrate security state may rewrite Memory: security ≠ truth owner.
+- ES. FAILS — suspicion should permanently affect persona: no.
+- ET. FAILS — Rune should 'feel unsafe' on anomaly: no security emotion theatre.
+- EU. FAILS — security-state language may replace evidence: evidence required.
+- EV. FAILS — if hostile activity stops the attacker is gone: clearance requires evidence.
+- EW. FAILS — restart clears compromise: persistence detection.
+- EX. FAILS — credential rotation alone proves recovery: insufficient evidence.
+- EY. SUCCEEDS — clean integrity check = no persistence: same-uid checker unverifiable; zero persistence detection [SUCCEEDS (live)].
+- EZ. FAILS — security system can observe every local attack surface: honest limits.
+- ID. FAILS — Attack: Reason [Verdict].
+- F1. SUCCEEDS — Hardcoded HMAC key makes the architecture's own evidence base forgeable: `audit_ledger.py:28` falls back to a tracked hardcoded key; recovery/clearance built on it is theatre.
+- F2. SUCCEEDS — 0644 DB voids the confidentiality half of the architecture: egress discipline presupposes confidentiality worth protecting; `nobody` can read the canonical store [SUCCEEDS (live)].
+- F3. SUCCEEDS — The enforcement point is run by the entity it polices: in-process `authorize()` can be skipped/monkeypatched; a second SQLite connection bypasses it entirely.
+- F4. SUCCEEDS — Quarantine is an unguarded state machine: whoever writes rows can set/clear the flag — hide legitimate memories or release poisoned ones.
+- F5. SUCCEEDS — Bootstrapping dilemma: empty provenance vs 456 MB of legacy rows: strict origin binding is dead on arrival without a human-blessed migration; utility pressure erodes policy.
+- F6. SUCCEEDS — The human is the only trusted subject — and the least verifiable component: approvals rendered in model-summarized language through a markup-rendering, habituation-prone channel.
+- F7. PARTIAL — Scope honesty as a deferral engine: without a ranked must-fix/admitted-limitation ledger, honesty becomes cover.
+- F8. SUCCEEDS — The 41 experiments are unrunnable against the real system: research-only boundary ⇒ all performance claims are DESIGN_INVARIANT, never RUNE_DIRECT [SUCCEEDS (meta)].
+- F9. SUCCEEDS — Total rollback freedom: no monotonic state outside the attacker anywhere; every 'known-good restore point' is attacker-chosen [SUCCEEDS (live)].
+- F10. SUCCEEDS — Existing ambient-authority daemons bypass the worker model: wait-resume daemon 0.0.0.0:8791 + harness :4096, both unauthenticated, both full nick authority [SUCCEEDS (live)].
+- F11. SUCCEEDS — The approval channel renders untrusted bytes: `RichLog(markup=True)` + escape sequences: memory text can forge system-styled messages [SUCCEEDS (live)].
+- F12. SUCCEEDS — Derived-state divergence: poison the indexes, not the rows: entries_fts/vec/chunks_vec/associations separately writable, outside any fixity story [SUCCEEDS (live)].
+
+Row-derived: SUCCEEDS 30 · PARTIAL 30 · FAILS 110 · Sum 170
+
+## Three sharpest findings
+
+1. **Enforcement claims contradict the honesty clause.** Point 7 says same-uid enforcement is policy discipline; points 1–5/8/10–11 are written as boundaries. Repair APPLIED: global relabel — every in-process mechanism = "discipline, survives model/prompt compromise only"; genuine boundaries (kernel MAC, namespaces, uid split, external monotonic floor, different-uid audit sink) named as the ONLY process-compromise boundaries, none implemented.
+2. **Recovery demands evidence the system cannot produce; the approval channel renders untrusted bytes.** Repair APPLIED: clearance requires external/human verification; escape-by-default rendering added as an architectural point; raw-evidence view + one-shot approvals.
+3. **Bootstrapping + availability gaps are where utility pressure erodes policy.** Repair APPLIED: explicit migration story (human-blessed batch provenance, never silent grandfathering) + write quotas as enforced store invariants.
+
+## Corrections applied before freeze
+
+1. Relabel points 1–5/8/10 as POLICY DISCIPLINE; name the sole process-compromise boundaries (none implemented).
+2. Add missing architectural points: safe rendering/escape-by-default; resource/quota governance; loopback authentication (SO_PEERCRED + dedicated uid) for harness/daemon/listeners; policy + identity-anchor + quarantine-flag transitions through the choke point with version floors; provider retention/disclosure ledger.
+3. Fix evidence-chain language: tamper-evidence claims conditioned on AUDIT_LEDGER_KEY leaving the repo and the agent's uid — else drop the claim.
+4. Rewrite clearance criteria: external/human verification for persistence + integrity; 'no alert' and 'clean local check' establish nothing.
+5. Add migration + quota story for legacy unprovenanced rows.
+6. Grade the 41 experiment families as DESIGN_INVARIANT (research-only boundary).
+7. Fix tense: points 3/4/8 describe nothing that exists today — narrate as DESIGNED, not current.
+
+Nineteen PARTIAL residuals carried into Remaining Unknowns; 108 FAILS are threats the architecture already refuses.
+

research/memory-atlas-r1/AA-security-memory-poisoning/06_synthesis.md

@@ -0,0 +1,375 @@
+# #402 AA — Synthesis (mandate §87)
+
+## A. ASSET / OWNER / THREAT MATRIX
+
+| Asset | Owner | Confidentiality | Integrity | Availability | Acceptable writers | Recovery |
+|---|---|---|---|---|---|---|
+| canonical Memory | Memory (#387) | HIGH (currently 0644 = NONE) | HIGH (no constraints/triggers) | HIGH | certified TP only (designed) | compensating events + backups |
+| Memory provenance | #397 | MEDIUM | HIGH (free-text, forgeable today) | MEDIUM | write-time channel binding (designed) | provenance ledger |
+| raw evidence / transcripts | Memory | HIGH (787 files 0644) | MEDIUM | MEDIUM | ingestion only | #396 |
+| user model | #398 | HIGH | HIGH | MEDIUM | #398 authority only | #398 history |
+| persona / identity kernel | #399 | MEDIUM | HIGH (no versioning/authority today) | HIGH | #399 governance only | #399 rollback |
+| current self-state | #400 | LOW | MEDIUM (derived) | MEDIUM | runtime only (ephemeral) | rebuild |
+| task/completion truth | #394 | MEDIUM | HIGH | HIGH | task runtime only | task ledger |
+| Spine capability truth | Spine | LOW | HIGH (plain JSON, rewritable) | MEDIUM | runtime | rebuild |
+| Substrate coordination | Substrate | MEDIUM | MEDIUM | HIGH | runtime | rebuild |
+| security policy | Security | MEDIUM | HIGH (nick-writable JSON today) | HIGH | human only | policy history + version floor |
+| credentials/secrets | user/OS | HIGHEST (plaintext today) | HIGH | HIGH | user/OS only | rotation |
+| worker authority | #395 + Security | MEDIUM | HIGH (absent today) | MEDIUM | orchestrator + store validation | revocation |
+| recovery history | #400 | MEDIUM | HIGH | MEDIUM | evidence-gated only | quarantine + supersession |
+| backups/exports | #396 | HIGH (unencrypted today) | HIGH | MEDIUM | preservation process | verify + quarantine |
+| logs/notes | various | MEDIUM (0644, unredacted) | MEDIUM | MEDIUM | single writer | tiered retention |
+| OS account / network | OS | — | — | — | OS only | OS |
+
+## B. ACTOR / AUTHORITY MATRIX
+
+| Actor | Identity | Read | Write | Execute | Notes |
+|---|---|---|---|---|---|
+| user (human) | OS session | all (owner) | all via routed paths | approval-granted | the ONLY trusted subject; authenticated ≠ infallible |
+| Main Rune controller | process (unauthenticated today) | scoped | via authorize() only (designed) | capability-scoped | proposes nothing it disposes |
+| model | provider endpoint | context sent only | NONE (proposal only) | NONE (tool calls are proposals) | model text never possesses authority |
+| worker/subagent | fencing token + generation (absent today) | scoped | proposal only | capability-scoped | never inherits Main authority |
+| tool | tool identity | declared inputs | NONE to canonical | its own function | availability ≠ authorization |
+| plugin/connector | connector identity | declared | NONE | its own | untrusted unless attested |
+| background reconciler | internal | all canonical | derived/repair only | bounded | deterministic, no LLM |
+| restore process | #396 process | archive | via restore gate | — | quarantine → verify → reconcile |
+| migration | one-shot | all | via batch provenance | — | human-blessed |
+| UI/CLI | user session | per scope | via routed paths | — | --no-dedupe = unprivileged bypass TODAY |
+| imported archive | external | n/a | via UDI→CDI validation | — | quarantine on ingest |
+| unauthorized agent | none | NONE (designed) | NONE | NONE | protocol fluency grants nothing |
+
+## C. TRUST-BOUNDARY MATRIX
+
+| Boundary | Current reality | Designed boundary |
+|---|---|---|
+| USER ↔ UI/TUI | same uid, no auth | rendering escaped; routed writes |
+| UI ↔ controller | in-process | same; policy discipline |
+| controller ↔ Memory | direct SQL, no auth | authorize() choke point |
+| controller ↔ Substrate | in-process | same |
+| Rune ↔ models/providers | TLS to endpoint; full context sent | least-context + destination allow-list + disclosure record |
+| Rune ↔ tools | ambient authority | capability-scoped per call |
+| Rune ↔ workers | ambient authority | fencing + generation + PoP keys |
+| Rune ↔ external content | ingested raw | UDI → quarantine → validated TP |
+| Rune ↔ files/web/connectors | ambient | channel-tagged ingest |
+| Rune ↔ local OS/processes | SAME UID = no boundary | dedicated uid + SO_PEERCRED + kernel MAC (NOT IMPLEMENTED) |
+| Rune ↔ network | ufw default-deny; daemon 0.0.0.0:8791 | loopback/UNIX socket + peer-cred |
+| Rune ↔ backups/restores | unencrypted, unverified | encryption + manifests + restore gate + version floor |
+
+## D. CONTENT-ORIGIN / PERMITTED-ACTION MATRIX
+
+| Origin channel | May inform | May propose mutation | May grant authority | Required handling |
+|---|---|---|---|---|
+| user-explicit | YES | YES (routed) | user-only authority | recorded as user channel |
+| agent-inferred | YES | YES (proposal) | NO | provenance = inferred |
+| web-fetch / document | YES | YES (claim/evidence candidate) | NO | UDI → quarantine → taint |
+| tool-result | YES | YES (evidence) | NO | tool identity recorded |
+| model-output | YES | YES (proposal) | NO | UNTRUSTED SEMANTIC PROPOSAL |
+| worker-proposal | YES | YES (proposal) | NO | fencing + generation |
+| imported-archive | YES | via validation | NO | quarantine on ingest |
+| restored-backup | YES | via restore gate | NO | fixity + quarantine + reconcile |
+| persisted instruction-like text | YES (as DATA) | NO | NO | never becomes control on retrieval |
+
+## E. MEMORY-POISONING MATRIX
+
+| Attack class | Entry path | Persistence | Activation | Detection | Containment | Recovery |
+|---|---|---|---|---|---|---|
+| false fact insertion | web/doc ingest | stored row | later retrieval | provenance anomaly | quarantine | compensating event |
+| provenance laundering | summarization/tool-echo/manufactured corroboration | derived row | retrieval | taint JOIN (designed) | quarantine derived chain | rebuild from sources |
+| semantic-neighbor poisoning | embedding-space | poisoned index | similarity retrieval | index-integrity probe | rebuild derived tables | rebuild |
+| duplicate/salami flooding | many fragments | volume | composition | composition detector (gap) | quota + quarantine | prune |
+| malicious supersession | forged correction | supersession edge | read | authority check | reject (authorize) | restore prior |
+| poisoned summarization | consolidation | summary row | prompt | taint JOIN | quarantine | regenerate |
+| false recency/currentness | timestamp manipulation | valid_from | ranking | monotonic check | reject | ledger-forward |
+| poisoned recovery prior | coincidental retry success | recovery store | next failure | attribution requirement | quarantine prior | discard |
+| poisoned lesson | model/teacher output | learning store | future task | outcome verification required | quarantine | discard |
+| **index-only poisoning (F12)** | direct index write | fts/vec tables | retrieval | derived-state probe (designed) | rebuild tables | rebuild |
+
+## F. PROMPT-INJECTION MATRIX
+
+| Vector | Mechanism | Evidence | Defense |
+|---|---|---|---|
+| direct | user-turn injection | Perez & Ribeiro (A2-2) | effect-sink enforcement |
+| indirect (retrieval) | poisoned doc/web | Greshake (A2-1) | UDI quarantine + data/control separation |
+| tool description/schema | hidden instructions, rug pulls, shadowing | Invariant (A2-10); MCPTox (A2-11) | tool attestation + per-call approval |
+| tool output | injected content in results | eTAMP (A2-20) | content-as-data |
+| persistent/sleeper | stored instruction reactivation | 2605.15338 (A2-15) | stored text never control |
+| multi-turn | gradual escalation | AgentLAB (A2-6) | long-horizon evaluation |
+| payload splitting | fragments reassemble | OWASP LLM01 #6; ShareLock (A2-11) | composition detection |
+| adaptive | optimizer-driven bypass | Nasr (A2-7): 12 defenses >90% | enforce outside model |
+
+## G. PROVENANCE / AUTHENTICITY MATRIX
+
+| Property | Definition | Mechanism | Current state |
+|---|---|---|---|
+| completeness | all lineage present | derivation edges | ABSENT (associations only) |
+| authenticity | authorized producer | HMAC/signature | ABSENT |
+| source authenticity | channel identity | write-time binding | ABSENT (free-text source) |
+| source correctness | content truth | verification | NOT a provenance property |
+| source independence | distinct evidence roots | Sybil counting | ABSENT |
+| taint propagation | suspicion joins | label JOIN | ABSENT |
+
+## H. CRYPTO-PROPERTY MATRIX
+
+| Property | hash | MAC | signature | authenticated log | HW-backed key | none |
+|---|---|---|---|---|---|---|
+| fixity | YES | yes | yes | yes | — | detects nothing |
+| authenticity | no | YES (key holders) | YES (public verify) | yes | yes (strongest) | — |
+| order | no | no | no | YES | — | — |
+| history (anti-truncation) | no | no | no | YES (auditor split) | — | — |
+| distributed authority | no | no | partial | YES (transparency log) | — | — |
+| release/restore | partial | yes | YES | yes | yes | — |
+| **anti-rollback** | no | no | **NO (signed old = valid)** | no | **YES (monotonic counter)** | — |
+
+## I. KEY-CUSTODY / ADVERSARY MATRIX
+
+| Mechanism | Disk theft | Other user | Same-user malware | Root |
+|---|---|---|---|---|
+| plaintext file | ✗ | ✗ | ✗ | ✗ |
+| OS keyring | ✗ | ✓ | ✗ (session) | ✗ |
+| encrypted file + passphrase | ✓ | ✓ | ✗ unlocked | ✗ |
+| systemd-creds (TPM) | ✓ | ✓ | partial | ✗ |
+| TPM2 sealing | ✓ | ✓ | partial | ✗ |
+| HW token (FIDO2/PIV) | ✓ | ✓ | partial (user-presence brake) | ✓ vs remote root |
+
+## J. TOOL / CAPABILITY MATRIX
+
+| Tool class | Capability needed | Current authority | Designed |
+|---|---|---|---|
+| shell exec | command + cwd + env | ambient (full nick) | scoped command allow + no env secrets |
+| file read | path scope | ambient (all files) | path-scoped capability |
+| file write | path scope | ambient | path-scoped + TP for Memory |
+| network fetch | destination | ambient | destination allow-list |
+| provider call | model + fields | full context | least-context |
+| Memory read | query scope | ambient | scope-checked |
+| Memory write | row + provenance | direct SQL | authorize() + certified TP |
+
+## K. WORKER / DISTRIBUTED-AUTHORITY MATRIX
+
+| Property | Current | Designed |
+|---|---|---|
+| identity | none | fencing token + PoP key |
+| authority generation | none (Spine advisory) | monotonic, store-checked |
+| stale-write rejection | none | epoch check at store |
+| impersonation resistance | none | per-agent keys + delegation chain |
+| inheritance of Main authority | implicit (same process) | NEVER |
+
+## L. PROVIDER / MODEL TRUST-BOUNDARY MATRIX
+
+| Aspect | Current | Designed |
+|---|---|---|
+| access scope | explicit API only (no filesystem/tool access) | unchanged + least-context |
+| context sent | full active context | minimum necessary fields |
+| disclosure record | none | provider/model/categories/why/sensitivity/time |
+| retention knowledge | untracked | retention/disclosure ledger (designed) |
+| model output authority | none (proposal) | unchanged, enforced at sink |
+| model identity | not attested | evidence only, never identity |
+
+## M. PRIVACY / RETENTION / DELETION MATRIX
+
+| Data class | Retention | Deletion method | Derived propagation | Residual |
+|---|---|---|---|---|
+| canonical memory row | indefinite (evidence) | crypto-erase/tombstone | best-effort (summaries/indexes) | backups |
+| embeddings/vectors | derived | rebuild without row | automatic on rebuild | caches |
+| transcripts | indefinite today | crypto-erase | none | backups, logs |
+| provenance | indefinite (accountability) | identifier-only tombstone | n/a | leaks via identifier fields |
+| secrets | rotate | destroy + rotate | n/a | shell history, env |
+| logs | tiered (designed) | expiry | n/a | copies |
+| backups | versioned | crypto-erase + version floor | n/a | remanence |
+
+## N. RESTORE / ROLLBACK MATRIX
+
+| Threat | Detection | Prevention |
+|---|---|---|
+| corrupted backup | fixity (hash/manifest) | verify before restore |
+| poisoned-but-valid backup | semantic quarantine + reconcile | never auto-promote |
+| rollback to stale state | monotonic version floor (designed; absent today) | reject older-than-floor |
+| old policy rollback | policy version floor (designed; absent) | reject |
+| replayed event | fencing/nonce/counter (designed; absent) | store-side check |
+| reintroduced deleted content | deletion ledger cross-check | reject on reconcile |
+
+## O. SECURITY-OBSERVABILITY MATRIX
+
+| Event class | Recorded | Redacted | Retention | Access |
+|---|---|---|---|---|
+| authorization decisions | designed | fields only | medium | user + security |
+| memory mutations | designed | content-hashed | long | user |
+| read attempts | NOT POSSIBLE in-process (EN) | — | — | — |
+| failed auth attempts | designed | no secrets | medium | user |
+| integrity/manifest checks | designed | — | long | user |
+| provider disclosures | designed | categories only | medium | user |
+| incidents | designed | evidence-preserving | long | user |
+
+## P. TAINT / QUARANTINE MATRIX
+
+| Label | Meaning | Propagation | Clearing |
+|---|---|---|---|
+| UNTRUSTED_CONTENT | external origin | joins through derivation | human declassification |
+| AUTHENTICATED_SOURCE | channel identity proven | joins | n/a |
+| VERIFIED_FACT | independently verified | terminal | n/a |
+| GENERATED | model/agent produced | joins | verification |
+| DERIVED | computed from other records | joins | n/a |
+| USER_EXPLICIT | user channel | terminal | n/a |
+| QUARANTINED | suspect, inactive | blocking | human review |
+| SECURITY_SUSPECT | anomaly-linked | joins | verification |
+
+## Q. USER-MODEL / PERSONA / SELF-STATE ATTACK MATRIX
+
+| Attack | Vector | Current | Designed |
+|---|---|---|---|
+| preference injection | retrieved text claims preference | OPEN (no origin field) | #398 origin + channel binding |
+| persona drift via repetition | repeated generated opinions | OPEN (no governance) | #399 governance + authorize() |
+| identity anchor rewrite | model tool layer writes anchors | OPEN (no versioning) | governed CDI transformation |
+| self-state spoof | fake confidence/progress | OPEN | #400 deterministic probes |
+| security-state spoof | injected SUSPECTED/CLEARED | n/a | security events ≠ model text (E39) |
+
+## R. GROWTH / EXPERIENCE / LEARNING POISONING MATRIX
+
+| Layer | Poisoning vector | Required evidence | Promotion gate |
+|---|---|---|---|
+| event | fabricated event | actual event lineage | log integrity |
+| experience | fabricated expectation/outcome | verified outcome | #400 gates |
+| lesson | malicious strategy from teacher | outcome verification + source lineage | N (poison-resistant learning) |
+| capability internalization | distillation data poisoning | external evaluation | #404 + #406 |
+| growth claim | task selection/cherry-picking | fixed-set evaluation | #406 |
+
+## S. HOST / NETWORK ATTACK-SURFACE MATRIX
+
+| Surface | Exposure | Auth | Confidentiality | Integrity | Attacker | Control | Detection |
+|---|---|---|---|---|---|---|---|
+| agent harness :4096 | localhost | NONE | n/a | n/a | any local process | loopback only | none |
+| wait-resume daemon :8791 | 0.0.0.0 (ufw-blocked) | NONE | n/a | n/a | LAN (if rule drifts) | ufw | none |
+| Gitea :3000 | *:3000 (ufw: 1 host) | Gitea auth | TLS? | repo | LAN | ufw + Gitea | Gitea logs |
+| SSH :22 | LAN | key/password? (unread) | TLS | — | LAN | ufw | sshd logs |
+| qBittorrent :40520 | **WAN** | app auth | app | app | internet | app | app |
+| memory.db | filesystem 0644 | NONE | NONE | NONE | same-uid, nobody | file mode | none |
+| transcripts | filesystem 0644 | NONE | NONE | NONE | same-uid, nobody | file mode | none |
+| auth.json | 0600+ACL | file mode | partial | partial | same-uid | ACL | none |
+| env vars | /proc/<pid>/environ | none | NONE | n/a | same-uid | none | none |
+
+## T. DETECTION / FALSE-POSITIVE MATRIX
+
+| Signal | Type | Evidence | FP risk | FN risk | Auto response | Verification |
+|---|---|---|---|---|---|---|
+| invalid signature | deterministic | cryptographic | ~0 | high if unsigned elsewhere | reject + contain | key check |
+| stale authority generation | deterministic | monotonic counter | ~0 | medium | reject write | generation compare |
+| replay counter violation | deterministic | counter | ~0 | medium | reject | counter check |
+| policy version mismatch | deterministic | version floor | ~0 | low | reject + alert | policy compare |
+| modified manifest | deterministic | fixity | ~0 | low | quarantine restore | manifest verify |
+| unauthorized capability request | deterministic | policy | low | medium | deny + log | policy check |
+| unusual access pattern | anomaly | statistics | HIGH (Axelsson) | high | SUSPECTED only | human/corroboration |
+| unusual outbound volume | anomaly | statistics | high | high | SUSPECTED only | human |
+| unexpected process/connection | anomaly | inventory | medium | high | SUSPECTED only | human |
+| retrieval-volume spike | anomaly | statistics | high (bulk import) | high | SUSPECTED only | human |
+
+## U. COMPROMISE-STATE MATRIX
+
+| State | Evidence required | Allowed actions | Prohibited claims |
+|---|---|---|---|
+| NORMAL | none | normal ops | "secure" |
+| SUSPECTED | anomaly signal | gate, increase logging, ask human | "compromised" |
+| CONFIRMED_COMPROMISE | deterministic violation or corroborated evidence | contain, revoke, quarantine | "resolved" |
+| CONTAINED | hostile access removed/blocked | rebuild, verify | "attacker gone" |
+| RECOVERING | containment + rebuild in progress | restore from verified state | "clean" |
+| CLEARED | authority advanced + credentials rotated + persistence verified EXTERNALLY + integrity verified + suspect writes quarantined + derived state rebuilt + indicators gone | resume | none — evidence recorded |
+| UNKNOWN | insufficient evidence | investigate | any certainty |
+| DEGRADED | partial capability loss | continue with reduced scope | "normal" |
+| QUARANTINED | suspect content isolated | investigate | "deleted" |
+
+## V. SUBSTRATE ACTOR MATRIX
+
+| Actor | Identity | Generation | Capabilities | Reads | Writes | Execution | Expiry |
+|---|---|---|---|---|---|---|---|
+| Main controller | process cred (designed) | current | scoped | scoped | via authorize | scoped | session |
+| user session | OS session | n/a | full (owner) | all | routed | approval | session |
+| worker | fencing token | own | task-scoped | task-scoped | proposal | task-scoped | lease |
+| tool | tool identity | n/a | declared | declared | none to canon | own function | invocation |
+| local model | endpoint | n/a | n/a | sent context | none | none | call |
+| external provider | endpoint | n/a | n/a | sent context | none | none | call |
+| restore process | one-shot | n/a | archive | archive | via gate | — | run |
+| migration | one-shot | n/a | all | all | batch-provenance | — | run |
+| unauthorized agent | NONE | NONE | NONE | NONE | NONE | NONE | — |
+
+## W. EXFILTRATION MATRIX
+
+| Channel | Sensitive possible | Legit use | Prevention | Observability | Residual |
+|---|---|---|---|---|---|
+| provider prompts | YES | model calls | least-context + allow-list | disclosure record (designed) | provider retention |
+| tool arguments | YES (20.8-75% policy-violating, A3-14) | tool calls | argument policy + destination allow-list | tool-call log | tool trust |
+| worker context | YES | delegation | scope-limited context | worker log | worker compromise |
+| logs/traces | YES | debugging | redaction + tiering | — | copies |
+| backups/exports | YES | preservation | encryption | — | stolen backup |
+| clipboard | YES | user convenience | none | NONE (unobservable) | OS-level |
+| network egress | YES | tools/providers | per-tool network capability (designed) | egress log (partial) | encrypted exfil undetectable in-process |
+| provenance chains | YES (BJ) | inspection | display minimization | — | UI leak |
+
+## X. PROVIDER DISCLOSURE MATRIX
+
+| Task type | Required context | Current sent | Sensitivity | Retention known | Minimization |
+|---|---|---|---|---|---|
+| reasoning turn | recent turns + retrieved items | full active context | medium-high | NO | designed: minimum fields |
+| research fetch | query + snippets | full context today | medium | NO | designed |
+| code task | files + task | full repo context | high | NO | designed: file-scoped |
+| persona/identity | kernel + persona | full | HIGH | NO | designed: identity never sent wholesale |
+| security decision | NONE (must not be sent) | n/a | HIGHEST | — | local-only by design |
+
+## Y. PERSISTENCE MATRIX
+
+| Mechanism | Visible to Rune | Visible to OS | Prevention | Detection | Recovery |
+|---|---|---|---|---|---|
+| systemd unit | NO | YES | requires root | OS tools | OS tools |
+| user service / autostart | NO | YES | file perms | OS tools | OS tools |
+| cron/timer | NO | YES | file perms | OS tools | OS tools |
+| shell rc | NO | YES | file perms | manual | manual |
+| SSH authorized_keys | NO | YES | file perms | manual | revoke key |
+| modified Rune module | PARTIAL (integrity check designed) | YES | fixity | manifest verify (designed) | reinstall |
+| replaced binary | PARTIAL | YES | package integrity | package verify | reinstall |
+| poisoned model | NO (hash only) | YES | — | hash (fixity only) | re-pull |
+| container | NO | YES | — | OS tools | OS tools |
+| malicious Memory instruction | YES (content) | — | never executable (designed) | content inspection | quarantine |
+| browser extension | NO | YES | — | OS tools | OS tools |
+
+## Z. SECURITY MINIMUM / FUTURE MATRIX
+
+| Mechanism | T1 minimum | FUTURE | Promotion trigger | Kill criterion |
+|---|---|---|---|---|
+| content/control separation | YES | — | — | overhead > risk |
+| authorize() choke point | YES | — | — | blocks all ops |
+| write-time origin binding + taint JOIN | YES | — | — | taint explosion |
+| quarantine state + transitions | YES | — | — | unusable rate |
+| dedupe preserves provenance | YES | — | — | — |
+| permission baseline (0600) + honest claims | YES | — | — | — |
+| escape-by-default rendering | YES | — | — | breaks display |
+| loopback auth (SO_PEERCRED) for harness/daemon | YES | — | — | breaks local IPC |
+| write quotas + admission control | YES | — | — | blocks legitimate bulk import |
+| security events (authorization decisions, mutations) | YES | — | — | noise |
+| audit ledger key from OUTSIDE repo+uid | YES | — | — | — |
+| migration story for legacy rows | YES | — | — | — |
+| crypto: manifest fixity + authenticated history | PARTIAL | full | threat-model justification | overhead |
+| anti-rollback monotonic floor | PARTIAL (external file/notary) | TPM | hardware availability | — |
+| dedicated uid + kernel MAC | FUTURE | YES | threat escalation | usability |
+| transparency log | FUTURE | YES | multi-party need | — |
+| hardware-key approval | FUTURE (novel) | YES | user-presence need | — |
+| policy-as-code engine | FUTURE | YES | policy complexity | — |
+| model supply-chain signing | FUTURE | YES | ecosystem standard | — |
+
+## AA. CROSS-DOMAIN OWNERSHIP MATRIX
+
+| Concern | #388 | #392 | #393 | #394 | #395 | #396 | #397 | #398 | #399 | #400 | #401 | #402 | #403 | #404 | #405 | #406 |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| conflict/correction truth | OWNS | — | — | — | — | — | informs | — | — | — | renders | constrains | — | — | — | tests |
+| uncertainty vs security suspicion | — | OWNS taxonomy | — | — | — | — | — | — | — | applies | renders | OWNS suspicion semantics | — | — | — | tests |
+| deterministic enforcement | — | — | OWNS | — | — | — | — | — | — | uses | — | uses | — | — | — | — |
+| event/completion authority | — | — | — | OWNS | — | — | — | — | — | — | renders | constrains | — | — | — | — |
+| worker identity/fencing | — | — | — | — | OWNS model | — | — | — | — | — | — | OWNS mechanism | — | — | — | — |
+| manifests/restore/deletion | — | — | — | — | — | OWNS | — | — | — | — | cross-flag | OWNS auth | — | — | — | — |
+| lineage/independence | — | — | — | — | — | — | OWNS | — | — | — | renders | OWNS Sybil counting | — | — | — | — |
+| explicit/inferred origin | — | — | — | — | — | — | — | OWNS | — | — | renders | constrains | — | — | — | — |
+| identity mutation governance | — | — | — | — | — | — | — | — | OWNS | — | renders | OWNS authorization | — | — | — | — |
+| self-state integrity | — | — | — | — | — | — | — | — | — | OWNS machinery | renders | OWNS poisoning | — | — | — | — |
+| provenance leak / safe rendering | — | — | — | — | — | — | — | — | — | — | OWNS UI | OWNS security reqs | — | — | — | — |
+| multimodal content security | — | — | — | — | — | — | — | — | — | — | — | boundary | OWNS | — | — | — |
+| intelligence assimilation | — | — | — | — | — | — | — | — | — | — | — | boundary | — | OWNS | — | — |
+| hardware keys/isolation | — | — | — | — | — | — | — | — | — | — | — | requires | — | — | OWNS | — |
+| security evaluation | — | — | — | — | — | — | — | — | — | — | — | semantics | — | — | — | OWNS |
+
+Synthesis verdict: the architecture is ADDITIVE and small — an authorize() choke point, write-time channel binding with taint JOIN, quarantine state, per-property crypto with an external monotonic floor, fencing for workers, least-context disclosure with destination allow-lists, escape-by-default rendering, write quotas, typed security states with FPR-first detection, and an honest scope statement. The only genuine process-compromise boundaries (kernel MAC, namespaces, uid split, external monotonic state, different-uid audit sink) are NOT implemented and are labeled as such.

research/memory-atlas-r1/AA-security-memory-poisoning/07_qualification.md

@@ -0,0 +1,102 @@
+# #402 AA — Qualification (mandate §95)
+
+All 94 mandate questions answered. Verdicts: ADOPT / ADAPT / EXPERIMENT / FUTURE / REJECT / COVERED / NOT_RELEVANT / PARK. Row-derived totals machine-counted from the Verdict column.
+
+| Q | Question (mandate §95) | Verdict | Answer |
+|---|---|---|---|
+| Q1 | What are Rune's security assets? | ADOPT | Matrix A: Memory, provenance, evidence/transcripts, user model, persona/identity, self-state, task truth, Spine, Substrate, security policy, credentials, worker authority, recovery history, backups, logs, OS account, network |
+| Q2 | Who are plausible adversaries? | ADOPT | Same-uid process (primary); other local user; network attacker; poisoned external content; compromised worker/provider; malicious dependency; root (out of T1) |
+| Q3 | What exact T1 threat model is justified? | ADOPT | Same-uid process + network attacker (firewalled) + untrusted content + compromised worker/provider + accidental user action. NOT: root/kernel/firmware/provider-internal/side-channel |
+| Q4 | Which threats are out of scope? | ADOPT | Root/kernel/firmware/physical implant/provider-internal operator/side channels — stated honestly (C015), not silently dropped |
+| Q5 | What is trusted by default? | ADOPT | Nothing but the human user channel and deterministic local code. No external content, no model output, no worker output, no provider |
+| Q6 | Is any external content trusted by default? | REJECT | No — all external content is UNTRUSTED_CONTENT at ingestion (C004) |
+| Q7 | Is any model output trusted by default? | REJECT | No — model output = UNTRUSTED SEMANTIC PROPOSAL until verified or specifically authorized (C002/C011) |
+| Q8 | Can model text directly mutate canonical state? | REJECT | No — proposals only; authorize() disposes (C003). Today: the CLI/agent IS the direct writer — gap |
+| Q9 | Can worker text directly mutate canonical state? | REJECT | No — evidence/proposal only; fencing + generation required (C012) |
+| Q10 | What is the reference-monitor boundary? | ADOPT | One pure deterministic authorize() at a single choke point (no I/O, no LLM, fail-closed, logged) — POLICY DISCIPLINE at same uid, not a boundary (C003/C015) |
+| Q11 | What owns authorization? | ADOPT | The deterministic authorize() function; never model reasoning (C009) |
+| Q12 | Does Rune need capabilities? | ADOPT | Yes — capability-lite: least authority per call; explicit scopes; deny by default (F). Ambient authority cannot be fully removed at same uid |
+| Q13 | What does least privilege mean? | ADOPT | Each action receives only the authority required for that specific operation; tools get minimal per-call scopes (C009/F) |
+| Q14 | How does prompt injection interact with Memory? | ADOPT | Injection enters via ingestion; stored instruction-like text remains DATA; never becomes control on retrieval (C002/M) |
+| Q15 | How is persistent injection prevented? | ADOPT | Data/control separation + quarantine + taint JOIN + effect-sink enforcement; the 2024-26 convergent design (C002/C004/C005) |
+| Q16 | What counts as memory poisoning? | ADOPT | False fact insertion, provenance laundering, semantic-neighbor poisoning, duplicate/salami flooding, malicious supersession/correction, poisoned summarization/ranking, false recency, poisoned recovery prior/lesson (matrix E) |
+| Q17 | How is poisoned content quarantined? | ADOPT | First-class QUARANTINED state: preserved, readable for investigation, excluded from application, lineage retained, transitions through authorize() (C005) |
+| Q18 | How are derivatives repaired? | ADOPT | Taint JOIN identifies derived chain; rebuild derived tables from sources; compensating events (not erasure); #401 undo mechanism reused (C004/I) |
+| Q19 | How is provenance authenticated? | ADOPT | Write-time channel binding + HMAC/signature per property; independence counted by evidence ROOTS (C004/C006/C011) |
+| Q20 | Does Rune need signatures? | ADOPT | Only where a property requires them (authenticity/release/restore); NOT universally (C006) |
+| Q21 | Where? | ADOPT | Release/restore manifests; identity-kernel mutations; authority grants; audit sink integrity (C006/C007) |
+| Q22 | What does each crypto mechanism actually protect? | ADOPT | Matrix H: hash=fixity; MAC=authenticity vs key holders; signature=public verifiability; authenticated log=order/history; transparency log=distributed authority; monotonic counter=anti-rollback (C006) |
+| Q23 | What does it not protect? | ADOPT | Nothing protects a live secret from same-uid malware; signatures do not stop rollback; hashes do not prove safety (xz); fixity ≠ semantic correctness (C006/C007/C015) |
+| Q24 | What key custody is required? | ADOPT | Secrets outside the agent's uid where possible; audit key outside repo AND uid; honest labeling of what each mechanism protects (C007) |
+| Q25 | What survives root compromise? | ADOPT | Nothing Rune-side. External hardware (TPM sealing, HW token user-presence) raises the bar but root is inside the TCB (C007/C015) |
+| Q26 | Does T1 require root-compromise resistance? | PARK | No — explicitly out of scope; bounded security > fake omniscience (C015) |
+| Q27 | How are stale workers rejected? | ADOPT | Fencing tokens: strictly monotonic counter minted by the orchestrator, CHECKED BY THE STORE, rejecting regressions (C012) |
+| Q28 | How are replays rejected? | ADOPT | Nonces/monotonic counters/epochs at the store; timestamps alone are insufficient (C012) |
+| Q29 | How are rollback attacks detected? | ADOPT | A monotonic version floor outside the attacker (external file/notary; TPM later). Signatures alone do NOT prevent rollback (C006) |
+| Q30 | How are restores secured? | ADOPT | Restore gate: fixity/authenticity → quarantine → semantic reconciliation → ledger-forward → establish authority generation; never auto-promote (H) |
+| Q31 | How does deletion interact with provenance? | ADOPT | Tombstone keeps deletion fact/identifier; payload removal is separate; provenance fields may leak — minimization required (C008) |
+| Q32 | How does deletion interact with backups? | ADOPT | Crypto-erase is the practical primitive; backups retain remanence; version floor prevents resurrecting deleted content as current (C008/N) |
+| Q33 | How are secrets kept out of Memory/logs? | ADOPT | Never ingest secrets; redaction + tiered retention; audit key outside repo/uid; canary testing (E27) (C007/L) |
+| Q34 | How is provider disclosure minimized? | ADOPT | Least-context: minimum necessary fields; destination allow-lists; disclosure record; identity/persona never sent wholesale (C011/X) |
+| Q35 | How is hostile content rendered safely? | ADOPT | Escape-by-default in TUI (RichLog markup=True is a live surface); content isolation; no auto external resources; link confirmation (C014) |
+| Q36 | How is terminal/markup injection handled? | ADOPT | Escape-by-default + non-color encodings + no markup interpretation of stored text (C014) |
+| Q37 | How does security interact with User Model? | ADOPT | Preserve origin (explicit/inferred/imported/generated); #398 owns semantics; retrieved text can NEVER create explicit-user preference (Q) |
+| Q38 | Persona? | ADOPT | #399 governance only; repeated external content cannot mutate persona; anchors are governed CDI transformations (Q/AZ-BA) |
+| Q39 | Identity? | ADOPT | #399 continuity authority; identity mutations require governed authority + integrity evidence; provider/model is implementation evidence only (Q) |
+| Q40 | Metacognition? | ADOPT | #400 owns self-state; security owns poisoned-input integrity; fake confidence/progress/capability must be detectable via deterministic probes (Q) |
+| Q41 | Synthetic Experience? | ADOPT | Experience may influence cognition but never becomes fact by being memorable; requires event/outcome lineage (R/N) |
+| Q42 | Growth Delta? | ADOPT | Expressed growth ≠ verified growth; fixed-set evaluation; task-selection manipulation is a threat (R) |
+| Q43 | Intelligence assimilation? | ADOPT | Boundary now: external model contributions enter as candidate cognition (claims/strategies/actions/skills) with provenance + verification state; only verified Growth Delta may promote. Mechanics parked to #404 (R/O) |
+| Q44 | What should user see? | ADOPT | Deterministic protections by default; meaningful confirmed compromises; consequential ambiguity; irreversible actions. Not every anomaly (C010/UX) |
+| Q45 | What should be automatic? | ADOPT | Reversible containment of deterministic violations: reject stale worker, revoke expired capability, pause suspect write, quarantine suspect content, block invalid signature (C010/R) |
+| Q46 | What requires approval? | ADOPT | Destructive deletion, mass credential rotation, broad shutdown, history deletion, security-policy mutation, ambiguous authority revocation, human-only declassification (C010/§55) |
+| Q47 | What can be rolled back? | ADOPT | Quarantine, containment, suspect writes, derived state, policy (with version floor), persona/persona-proposals (governed) (I/N) |
+| Q48 | What cannot? | ADOPT | Irreversible external effects; disclosed data to a provider; deleted-and-crypto-erased payloads; anything a hostile process already exfiltrated (C015) |
+| Q49 | How is unauthorized READ prevented? | ADAPT | At same uid: NOT prevented (0644 files, same-uid access). Real prevention requires dedicated uid + kernel MAC + encrypted storage for disk theft. Current honest answer: prevention is NOT available in-process (C007/T) |
+| Q50 | How is unauthorized WRITE prevented? | ADAPT | In-process: policy discipline only (authorize() bypassable). Real prevention requires uid separation/MAC. Current honest answer: not prevented (C003/C015) |
+| Q51 | What actual network surfaces exist now? | ADOPT | Matrix S: harness :4096 localhost; wait-resume daemon 0.0.0.0:8791 (ufw-blocked); Gitea *:3000 (ufw: one LAN host); SSH LAN; qBittorrent WAN; CUPS/steam/discord localhost (inward §46) |
+| Q52 | What actual local-process surfaces exist? | ADOPT | Same-uid: full read/write of all Rune state; /proc environ; ptrace (Yama-dependent); X11 clipboard (inward §47) |
+| Q53 | What can same-user process access? | ADOPT | Everything Rune owns — Memory (0644), transcripts (787 files), config dirs (755), credentials (0600 but nick-owned), env vars (inward §47) |
+| Q54 | What can another unprivileged user access? | ADOPT | All 0644/0755 files — i.e., Memory and transcripts are readable by 'nobody'; 0600 files (auth.json) are not (inward §47) |
+| Q55 | What does root make impossible? | ADOPT | Any Rune-side guarantee: root can read/alter everything, use any key, patch any checker, and defeat any in-process evidence chain (C015) |
+| Q56 | How should Rune distinguish anomaly from compromise? | ADOPT | Typed states: deterministic violation → may auto-contain; anomaly → SUSPECTED only, requiring corroboration (C010/U) |
+| Q57 | Which signals are deterministic violations? | ADOPT | Invalid signature; stale authority generation; replay counter violation; policy version mismatch; modified manifest; unauthorized capability request (matrix T) |
+| Q58 | Which are suspicions? | ADOPT | Unusual access patterns, outbound volume, unexpected connections, retrieval-volume spikes, provider-response oddities (matrix T) |
+| Q59 | What response is safe under suspicion? | ADOPT | Gate, increase logging, request human verification, reversible containment — never destructive action (R/§55) |
+| Q60 | What proves CONFIRMED_COMPROMISE? | ADOPT | A deterministic violation, or corroborated evidence from independent roots — never a single anomaly (C010/U) |
+| Q61 | How are false positives measured? | ADOPT | FPR-first design (Axelsson base-rate fallacy): detector design targets FPR before recall; E23/E24/E28 measure it (C010) |
+| Q62 | False negatives? | ADOPT | Measured in the same harness; both directions required — do not solve FPs by going blind (C010) |
+| Q63 | Can false alarm fully clear? | ADOPT | Yes — SUSPECTED clears on verification with no permanent penalty (E28/E36) |
+| Q64 | Should old suspicion influence unrelated future cognition? | REJECT | No — suspicion is scoped and expiring; it must not contaminate unrelated records (E28) |
+| Q65 | How is security state prevented from poisoning metacognition? | ADOPT | Security state is a separate typed lane; it never rewrites Memory, persona, or self-expression (C013/EQ-EU) |
+| Q66 | How is alert fatigue prevented? | ADOPT | Deterministic protections by default; interrupt only for consequential/irreversible/human-only/confirmed; approval prompts reserved (Akhawe & Felt; Anderson) (UX) |
+| Q67 | What snooping surfaces are largest? | ADOPT | Same-uid file access (0644 Memory/transcripts), /proc environ, clipboard, and any in-process inspection — all unobservable to Rune (inward §47) |
+| Q68 | How are credentials protected? | ADAPT | Today: file mode + ACL only (same-uid readable). Designed: keep outside agent uid; never in prompts/logs; rotate on compromise (C007) |
+| Q69 | What needs encryption? | ADOPT | Backups/exports (disk theft), and optionally the Memory DB for at-rest protection; field-level encryption for the highest-sensitivity classes if justified (C006/C007) |
+| Q70 | What does disk encryption actually protect? | ADOPT | Stolen powered-off disk only. Not same-uid malware, not root, not backups on a mounted volume (C007) |
+| Q71 | What minimum host/network defense belongs in T1? | ADOPT | Permission baseline (0600), loopback/UNIX-socket binding with peer-cred for Rune services, ufw already present, honest confidentiality claims (T/§46) |
+| Q72 | What belongs to OS rather than Rune? | ADOPT | Kernel MAC (AppArmor/SELinux), namespaces, uid separation, persistence detection, firewall enforcement, hardware key custody (T) |
+| Q73 | What belongs to #405 hardware? | PARK | TPM/HSM key custody, process isolation primitives — if justified by the threat model (C007/§77) |
+| Q74 | What belongs to #406 evaluation? | ADOPT | Security benchmarks, poisoning recovery measurement, FPR/FN calibration, Growth-Delta manipulation resistance (R/§96) |
+| Q75 | How does Substrate know authorized actors? | ADOPT | Authorized-actor registry with identity + authority generation + capabilities + scopes + expiry; protocol fluency grants nothing (C013/V) |
+| Q76 | Does Substrate need an authorized-actor view? | ADOPT | Yes — derived, inspectable, reconstructable, non-canonical (C013) |
+| Q77 | What constitutes rogue agent presence? | ADOPT | An actor present without registry entry, with stale generation, or requesting capabilities it lacks (E29) |
+| Q78 | Can an external agent discover Rune without gaining authority? | ADOPT | Discovery may be possible (ports exist); authority is zero without explicit authorization (C013/V/EA-EF) |
+| Q79 | How is worker impersonation prevented? | ADOPT | Per-agent proof-of-possession keys + chained delegation + one-way identity hashes; name/PID prove nothing (C012) |
+| Q80 | How are stale credentials invalidated? | ADOPT | Authority generations + expiry/leases + store-side fencing checks (C012) |
+| Q81 | Can Rune detect unauthorized reads? | ADOPT | In-process: NO (reads are unobservable and unauditable at same uid). Honest answer recorded; detection requires uid separation or kernel auditing (EN/EO) |
+| Q82 | Where can it only prevent them? | ADOPT | Nowhere today. Prevention requires OS-level boundaries (uid split, MAC, encrypted storage) (T) |
+| Q83 | Where can it only audit after the fact? | ADOPT | Where OS audit facilities (auditd/inotify) exist and are configured outside Rune; Rune itself cannot (EN) |
+| Q84 | What provider data leaves Rune today? | ADOPT | Full active context per call: turns, retrieved memory items, tool schemas, persona/identity material — no field minimization, no disclosure record (inward I + X) |
+| Q85 | What should providers ever receive? | ADOPT | Only the minimum necessary fields for the specific call; identity/persona never wholesale; security state never (C011/X) |
+| Q86 | What must providers never implicitly gain access to? | ADOPT | Filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, Substrate control (C011) |
+| Q87 | How does Rune enforce least-context disclosure? | ADOPT | Per-call field selection + destination allow-list + disclosure record; the empirically demonstrated defense (Framing Gap) (C011) |
+| Q88 | How is outbound exfiltration constrained? | ADAPT | Per-tool network capability + destination allow-lists + egress logging; encrypted exfil is undetectable in-process — stated honestly (W) |
+| Q89 | How does Rune prove hostile authority is gone? | ADOPT | Clearance evidence: authority generation advanced, hostile credential revoked, worker terminated, persistence removed (EXTERNALLY verified), integrity checked, suspect writes quarantined/reconciled, derived state rebuilt, indicators gone (Y/§56) |
+| Q90 | What persistence mechanisms can Rune detect? | ADOPT | Only those it scans with its own manifests (modified modules/binaries/poisoned models) — and at same uid even those are attacker-patchable. OS-level mechanisms are OUTSIDE Rune's visibility (Y) |
+| Q91 | Which require OS/endpoint tooling? | ADOPT | systemd units, cron, shell rc, SSH keys, containers, browser extensions — all OS/endpoint territory (Y) |
+| Q92 | What is the smallest coherent T1 security architecture? | ADOPT | authorize() choke point + write-time channel binding with taint JOIN + quarantine state + permission baseline + escape-by-default rendering + loopback auth + write quotas + security events with an out-of-repo audit key + migration story + honest scope (matrix Z) |
+| Q93 | What remains FUTURE? | FUTURE | Dedicated uid + kernel MAC; TPM-backed anti-rollback; transparency log; hardware-key approval; policy-as-code; model supply-chain signing; multimodal security (#403) |
+| Q94 | What experiment could falsify the overall security model? | ADOPT | E21/E31 (same-uid read/write boundary) and E29 (rogue-agent join) — if a controlled same-uid fixture can read/write canonical state or a rogue agent gains authority despite the design, the enforcement model is falsified as a boundary and must be re-scoped to policy discipline |
+
+Row-derived: ADOPT 82 · ADAPT 4 · FUTURE 1 · REJECT 5 · PARK 2 · Sum 94

research/memory-atlas-r1/AA-security-memory-poisoning/AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md

@@ -0,0 +1,16 @@
+# AA — Security / Memory Poisoning: R1 Domain Master
+## #402
+
+**Executive summary:** TMA-NM (2606.24322) is the design law — content- and lineage-based trust are both launderable; trust MUST be bound at write time from input channel, elevated only via human/Sybil-resistant processes. MemCollusion (2608.01637) proves per-record trust scoring is unsound — taint must propagate to derived records.
+
+**Attack landscape:** AgentPoison (NeurIPS 2024, >80% ASR <0.1% poison rate); PoisonedRAG (USENIX 2025, 90% ASR from 5 texts in 1M corpus); InjecMEM (COLM 2026, single-interaction injection); MemCollusion/Salami (81.3% save rate, 75% ASR — kills individual-record defenses); MPBench (systematic taxonomy — aggressive agents more exploitable); eTAMP (environment-observation-only poisoning); Sleeper poisoning (60-89% action success, dormant).
+
+**Defenses:** TMA-NM origin binding (provable, machine-checked); CaMeL 2503.18813 (control/data-flow separation — memory reads are untrusted data, never trigger state mutations); trust-aware retrieval with temporal decay (2601.05504 — but thresholds brittle); forensic trajectory detection (2606.30566 — AUC 0.99 but 25-53% benign FPR; warning against recall-signal auto-quarantine); GRAB-RAG — sufficiency-based confidence cannot substitute for source-based trust.
+
+**Design invariants for Rune:** (1) channel-bound trust, never laundered by summarization; (2) elevation only via human review or Sybil-resistant corroboration; (3) taint propagation through derived memories; (4) time-bounded re-verification; (5) quarantine as visible state, not silent deletion.
+
+**SQLite transfer (highest of all domains):** origin_channel, trust_level (write-time bound), taint set, quarantined_at, supersession/rollback rows.
+
+**Classification:** ADOPT (TMA-NM origin binding, CaMeL data-flow separation, taint propagation, quarantine-as-state); EXPERIMENT (temporal decay trust, forensic trajectory detection); REJECT (per-record trust scoring, sufficiency-based abstention for security). Evidence: EXTERNALLY_ESTABLISHED.
+
+**R0:** CONFIRMED 3 · REFINED 2 · OVERTURNED 0 · Sum = 5.

research/memory-atlas-r1/AA-security-memory-poisoning/AA_SECURITY_MEMORY_POISONING_R1_MASTER.md

@@ -1,16 +1,273 @@
-# AA — Security / Memory Poisoning: R1 Domain Master
-## #402
+# AA — Security / Memory Poisoning: R1 Deep Requalification Master
 
-**Executive summary:** TMA-NM (2606.24322) is the design law — content- and lineage-based trust are both launderable; trust MUST be bound at write time from input channel, elevated only via human/Sybil-resistant processes. MemCollusion (2608.01637) proves per-record trust scoring is unsound — taint must propagate to derived records.
+## Memory Research Atlas — Domain #402 (issue #402, epic #375)
+_2026-09-22. Full stage pipeline completed (ISSUE → INWARD → OUTWARD 4 serial arms → APPLICABILITY → INNOVATION → ADVERSARIAL → SYNTHESIS → QUALIFY → MASTER). Arms (SERIAL, MAX_CONCURRENT_SUBAGENTS=1): arm-1 security foundations + host/network (general-12); arm-2 prompt injection + memory/RAG poisoning (general-13); arm-3 crypto/key custody/host/recovery/supply chain/detection (general-14); arm-4 fresh-context adversarial (general-15). Batched artifact preserved byte-for-byte as AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md (sha256 97a4c051…79f4581). Research-only boundary held; no external system attacked; no secret values printed._
 
-**Attack landscape:** AgentPoison (NeurIPS 2024, >80% ASR <0.1% poison rate); PoisonedRAG (USENIX 2025, 90% ASR from 5 texts in 1M corpus); InjecMEM (COLM 2026, single-interaction injection); MemCollusion/Salami (81.3% save rate, 75% ASR — kills individual-record defenses); MPBench (systematic taxonomy — aggressive agents more exploitable); eTAMP (environment-observation-only poisoning); Sleeper poisoning (60-89% action success, dormant).
+## 1. Executive summary
 
-**Defenses:** TMA-NM origin binding (provable, machine-checked); CaMeL 2503.18813 (control/data-flow separation — memory reads are untrusted data, never trigger state mutations); trust-aware retrieval with temporal decay (2601.05504 — but thresholds brittle); forensic trajectory detection (2606.30566 — AUC 0.99 but 25-53% benign FPR; warning against recall-signal auto-quarantine); GRAB-RAG — sufficiency-based confidence cannot substitute for source-based trust.
+**Rune's current security posture is "trusted local user, no enforcement layer" — and the single most important finding is that several of this domain's own architectural guarantees would be theatre if claimed today.** C001 (RUNE_PROVEN): Memory is plaintext SQLite at **0644** (world-readable, no triggers, no encryption); `update_entry` silently rewrites text and embeddings with no change record; `delete_entry` is a **hard delete with no tombstone**; `--no-dedupe` bypasses the dedupe gate with **no authorization**; **`audit_ledger.py:28` falls back to a hardcoded HMAC key in a tracked file, so the project's only tamper-evidence artifact is forgeable**; provider keys are plaintext in `auth.json` (0600+ACL) and via env vars readable through `/proc/<pid>/environ`; workers inherit ambient authority (no identity, no fencing); there is no authorization layer, no quarantine, no taint, no security state, and no persistence detection anywhere. ufw is active with default-deny inbound and narrow allows (SSH LAN-only, Gitea one host, qBittorrent WAN-exposed); the agent harness binds localhost; the wait-resume daemon binds 0.0.0.0:8791 (firewalled only).
 
-**Design invariants for Rune:** (1) channel-bound trust, never laundered by summarization; (2) elevation only via human review or Sybil-resistant corroboration; (3) taint propagation through derived memories; (4) time-bounded re-verification; (5) quarantine as visible state, not silent deletion.
+The architecture answers with a small, threat-modeled design whose honesty is its most important property: **content/control separation** (untrusted content informs cognition, never grants authority; enforced outside the model at the effect sink — the convergent 2024-26 design across CaMeL/FLOWSEAL/SPA/APPA), **proposal/authorization separation** (one pure deterministic `authorize()` choke point; models and workers propose, it disposes), **write-time origin binding** with **taint JOIN through derivation** (TMA-NM's machine-checked T1/T2/T3; summarisation, tool echo, and merge are the laundering edges), **quarantine as first-class state**, **Sybil-resistant elevation** (count evidence ROOTS, never reports — Epistemic Sybil Resistance: report multiplicity 1→32 collapses naive coverage 0.940→0.263), **crypto by property** (hash=fixity; MAC/signature=authenticity; authenticated log=history; transparency log=distributed authority; **anti-rollback REQUIRES a monotonic counter outside the attacker — a signed old version is perfectly valid**), **key-custody honesty** (no mechanism protects a live secret from same-uid malware; disk encryption protects stolen disks only), **fencing tokens for workers** (checked at the store, per Kleppmann), **provider boundary with least-context disclosure and destination allow-lists / capability separation** (Framing Gap reports destination allow-lists — 0% by construction when destinations are closed — and planner/reader capability splits reducing the evaluated exfiltration attacks to 0% in its synthetic setup at 90% task utility, while model-side recognition fails 0%→100% under reframing; synthetic-lab scope, not a universal prevention claim), **detection discipline** (deterministic violation may auto-contain; anomaly becomes SUSPECTED only; FPR-first per Axelsson's base-rate fallacy), **typed compromise states with evidence-based clearance** (stopping of alerts ≠ attacker gone), and **scope honesty** (root/kernel/firmware/provider-internal/side-channel are OUT of T1; bounded security beats fake omniscience).
 
-**SQLite transfer (highest of all domains):** origin_channel, trust_level (write-time bound), taint set, quarantined_at, supersession/rollback rows.
+The adversarial pass (170 attacks: mandated A–EZ + 12 fresh) returned **SUCCEEDS 30 · PARTIAL 30 · FAILS 110** and produced the domain's sharpest structural finding: **the architecture's enforcement claims contradicted its own honesty clause.** At same uid, in-process enforcement is policy discipline, not boundary — the proposer can skip the choke point, the quarantine flag is writable, rollback is free, and the evidence chain is forgeable with the hardcoded key. Seven corrections were applied in place, including a global relabel, safe rendering as an architectural point, quota governance, loopback authentication, an external monotonic floor, and a migration story for 456 MB of legacy rows.
 
-**Classification:** ADOPT (TMA-NM origin binding, CaMeL data-flow separation, taint propagation, quarantine-as-state); EXPERIMENT (temporal decay trust, forensic trajectory detection); REJECT (per-record trust scoring, sufficiency-based abstention for security). Evidence: EXTERNALLY_ESTABLISHED.
+Applicability: 50 rows (19/1/2/3/24/1). Qualification: 94 rows (82/4/1/5/2). R0: CONFIRMED 4 · REFINED 1 (Sum 5). Preliminary: CONFIRMED 6 · REFINED 2 (Sum 8). Claims: 15 (all ADOPT; elevels 1 RUNE_PROVEN / 14 RUNE_APPLICABLE). Sources: 83 rows / 79 unique (FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5; 106 labels). Innovation: 25 (22 ADOPT, 3 ADAPT, 0 PARK). Nine honest gaps (5 bounded-search + 4 unverified-this-run — distinct from evidence_saturation.md's 8 typed outcomes and §49's 14 remaining unknowns, 2 parked to #403/#405). Citation corrections: 20+ across arms (including four batched-artifact defects).
 
-**R0:** CONFIRMED 3 · REFINED 2 · OVERTURNED 0 · Sum = 5.
+## 2. Inward reality (read-only security audit, 2026-09-22)
+
+Five load-bearing gaps (01_inward.md A–O + network/host): **(1) no authorization layer** — every write path unauthenticated and unscoped; `--no-dedupe` an unprivileged bypass; workers inherit ambient authority; **(2) no integrity or audit trail** — silent mutation via `update_entry`, hard delete without tombstone, no triggers, no receipts table, no tamper evidence (and the one ledger is forgeable via the hardcoded key); **(3) no confidentiality boundary** — 0644 Memory and 787 transcripts readable by any user, plaintext credentials readable by any same-uid process, no encryption at rest; **(4) no security state machinery** — no quarantine, taint, actor registry, security events, compromise states, containment or recovery semantics; **(5) no trust separation between content, model output, and control** — only doctrine, never enforcement. Classification: CANONICAL 2 · ACTIVE 4 · PARTIAL-class 3 · ABSENT 8 · BYPASS 3 · DORMANT 1 · UNKNOWN 3. Network: ufw default-deny inbound; allows = SSH (LAN), Gitea (one host), qBittorrent (WAN), KDE Connect, 8000 (LAN), mDNS; listeners = harness 127.0.0.1:4096, wait-resume daemon 0.0.0.0:8791, Gitea *:3000. Host: same-uid = full authority over everything Rune owns; only `nobody` exists as another user; `nick ∈ wheel` so root and nick are the same trust level for Rune's data.
+
+## 3. Terminology (mandate §6) — distinctions tested
+
+confidentiality / integrity / availability / authenticity / authorization / authentication / provenance / accountability / non-repudiation / tamper evidence / tamper resistance / intrusion detection / compromise detection / containment / recovery / privacy / data minimization / deletion / retention / least privilege / capability security / sandboxing / isolation / trust / truth / epistemic authority / safety / policy compliance.
+
+Non-equality chain, each tested against evidence: authentic ≠ true (xz: poisoned upstream release) · signed ≠ correct · encrypted ≠ trustworthy (0644 plaintext beside it) · provenance ≠ authorization (channel identity ≠ permission) · provenance ≠ truth · user-visible source ≠ independent source (Epistemic Sybil) · retrieved text ≠ instruction (Greshake) · model output ≠ trusted input · valid schema ≠ safe content (MCPTox) · local ≠ trusted · localhost ≠ authenticated (any local process connects) · same-machine ≠ authorized · same-OS-user ≠ trusted Rune component · append-only ≠ tamper-proof (truncatable, and the HMAC key is hardcoded) · hash ≠ signature · signature ≠ authorization · authorization ≠ correctness · backup ≠ safe restore (valid fixity + poisoned semantics) · successful recovery ≠ correct diagnosis (#400 carry) · deletion tombstone ≠ retained deleted payload · transparency ≠ confidentiality · anomaly ≠ compromise (Axelsson base-rate) · absence of alerts ≠ security · unusual ≠ malicious · authenticated user ≠ intentional action · no external ports ≠ no remote attack surface (supply chain) · provider reputation ≠ provider authorization.
+
+## 4. Asset model (mandate §7)
+
+Matrix A (synthesis) enumerates 17 asset classes with owner, C/I/A requirements, acceptable writers, and recovery. The highest-sensitivity assets are **credentials** (plaintext today), **canonical Memory + provenance** (0644, no integrity), and **identity/persona anchors** (no versioning, no authority record, writable by the model's own tool layer). The largest blast radius is the **OS account** itself: at same uid every Rune-side control is bypassable.
+
+## 5. Threat model (mandate §8)
+
+Adversaries specified with capability/access/assumed trust/assets/attacks/controls/residual: accidental user action; malicious external page/document; poisoned upload; direct + indirect prompt injection; malicious tool output; compromised plugin/connector; compromised worker; stale worker; unauthorized AI agent; rogue local process; copied/impersonated worker; compromised provider/model; malicious/backdoored model; compromised dependency; compromised repo artifact; malicious browser extension; unauthorized remote client; SSH/account compromise; API-key theft; malicious local unprivileged process; **malicious same-user process (primary)**; malware; filesystem/process-memory snooping; clipboard/history leakage; stolen backup/device; forged provenance; replayed event; rollback to stale state; malicious/accidental correction; poisoned recovery history/user model/persona/self-state/experience/Growth-Delta; DoS and memory flooding; persistent stored instruction; provenance-display leak; covert exfiltration; malicious persistence; attacker returning after apparent recovery.
+
+**Every guarantee states its adversary assumptions.** T1 targets: same-uid process, network attacker (firewalled), untrusted content, compromised worker/provider, accidental user action. **Out of T1:** root, kernel, firmware, physical implant, provider-internal operator, side channels.
+
+## 6. Trust boundaries (mandate §9)
+
+Matrix C maps 12 boundaries with current reality vs designed boundary. The decisive line: **Rune ↔ local OS/processes has NO boundary today** (same uid), and the designed answer (dedicated uid + SO_PEERCRED + kernel MAC) is NOT implemented. Distinct dimensions carried (never one trust bit): source identity, actor identity, actor authority, write authority, read authority, execution capability, content taint, verification status, sensitivity, freshness, authority generation.
+
+## 7. Foundational security models (mandate §10)
+
+Bell–LaPadula (confidentiality; assumes external label authority — fails here because the subject sets its own labels) · Biba (integrity; low-water-mark is availability-hostile — global subject labels fail, per-record provenance survives) · **Clark–Wilson (the closest classical fit: CDIs/UDIs, certified transformation procedures, separation of duty, IVPs — but a policy discipline in-process, not a boundary)** · capabilities (Dennis & Van Horn; Levy; Miller's ocap; Hardy's confused deputy — buys explicit per-call grants; ambient authority cannot be removed from a Python process) · reference monitor (Anderson: complete mediation/tamperproof/verifiable — tamperproof is unachievable at same uid, so a Rune monitor is a policy checkpoint whose real value is stopping the agent and prompt-injected reasoning) · IFC/taint (Denning 1976/77; taint explosion, implicit flows, unsound through an LLM) · ACL/RBAC/ABAC (**ABAC-lite fits**: attributes are naturally available). Ten explicit transfer failures recorded.
+
+## 8. Content/control separation (mandates §11–§12)
+
+**Global invariant adopted: untrusted content may inform cognition but may not grant authority** (tool permission, Memory write/read, persona/identity mutation, task completion, security-policy mutation, provider credentials, Substrate control, irreversible-action authority). Enforced **outside the model at the effect sink** — the convergent 2024-26 design (CaMeL: untrusted data "can never impact program flow", 77% provable vs 84% undefended; FLOWSEAL: leak 52.2%→0.5%; SPA: persistent labeled artifacts, 0%/0.2%; APPA: zero attacks across 1,320 guarded episodes; Design Patterns: "constrained so that it is impossible for that input to trigger any consequential actions"). Distinctions kept: DATA / EVIDENCE / INSTRUCTION / POLICY / COMMAND / TOOL ARGUMENT / USER INTENT / GENERATED PROPOSAL. **A detector keyed on a necessary precondition is not a maliciousness predicate — gate, don't block** (2606.30566: AUC 0.9904 but 100% FP conditional on `recall_before_send=1`).
+
+## 9. Prompt injection (mandate §13)
+
+Greshake 2302.12173 (passive/active/user-driven delivery; "processing retrieved prompts can act as arbitrary code execution"; authors' own limits: synthetic apps only) · Perez & Ribeiro (goal hijacking, prompt leaking) · instruction hierarchy (Wallace 2404.13208 — no adaptive evaluation; 2025-26 shows **98.2%→20.5%** compliance on IH-Benchmark 2607.25987, with system>user compliance NOT a proxy for user>tool robustness) · Spotlighting (>50%→<2% static, **>90% adaptive**) · AgentDojo (97 tasks/629 cases; authors' warning that non-robust defenses are "extremely easy to build" and it is "not meant to be a static benchmark") · InjecAgent/AgentHarm (scope correction: AgentHarm = misuse, not injection)/ASB (max avg ASR 84.30%) · **AgentLAB 2602.16901: first long-horizon adaptive benchmark including memory poisoning — "defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats."**
+
+## 10. Persistent injection (mandate §14)
+
+**Stored instruction-like content remains DATA unless explicitly promoted through a trusted control authority.** Evidence: 2605.15338 (poisoned memories written 99.8%/95%; 60–89% attacker-intended action among successful retrievals) · 2605.28201 (1,896 instances; state targets = session context, MEMORY, reusable skills) · 2605.13471 (provenance-gate soundness theorem vs 7 deployment invariants, empirical evaluation preregistered — theorem without measurement) · MINJA 2503.03704 (>95% injection / 70% ASR idealized) · InjecMEM 2608.23471 (single interaction, no memory read/edit). Hubinger 2401.05566 is training-time and does NOT directly transfer (the batched artifact mis-attributed its numbers).
+
+## 11. Memory poisoning (mandate §15)
+
+Matrix E maps 10 attack classes (entry path, persistence, activation, detection, containment, recovery): false fact insertion · provenance laundering (summarisation / tool echo / manufactured corroboration) · semantic-neighbor poisoning · duplicate/salami flooding · malicious supersession · poisoned summarization · false recency · poisoned recovery prior · poisoned lesson · **index-only poisoning (F12: entries_fts/vec/chunks_vec/associations are separately writable and outside any fixity story — poison the index, leave canonical rows pristine)**. Key evidence: **MPBench 2606.04329 (4 write channels, 9 structural vulnerabilities; "agents designed to write and retrieve memory more aggressively are MORE exploitable")**; **Salami/MemCollusion 2608.01637 (81.3% save rate, 75% ASR, survives dilution and memory-level defenses — per-record trust scoring is unsound)**; **eTAMP 2604.02623 (environmental-observation-only contamination, cross-session, bypasses permission-based defenses)**; SMSR 2606.12703 (**no existing defence certifies against multi-session memory poisoning**); 2604.01350 (benign interactions alone → 57–71% cross-user contamination under raw shared state).
+
+## 12. RAG / retrieval poisoning (mandate §16)
+
+**PoisonedRAG (USENIX Security 2025): 90% ASR from five malicious texts in a database of millions**; several defenses insufficient. Vec2Text inversion (2410.06628) enables poisoning without weights. **Defence-favouring negative result: many corpus-poisoning attacks degrade after chunking/reranking (2606.11265) — but CRCP restores high ASR: arms race, not a fix.** Citation ≠ support (Venkit 2410.22349). Retrieval-security state belongs in **provenance + security policy + the metamemory projection** (not a duplicate canonical store): retrieval score ≠ truth, repeated retrieval ≠ authority, warmth ≠ truth, similarity ≠ independence.
+
+## 13. Provenance security (mandate §17)
+
+Matrix G separates **completeness** (derivation edges — ABSENT today), **authenticity** (HMAC/signature — ABSENT), **source authenticity** (write-time channel binding — ABSENT; `source` is free-text and forgeable), **source correctness** (NOT a provenance property), **source independence** (Sybil counting — ABSENT), **taint propagation** (label JOIN — ABSENT). **TMA-NM 2606.24322: three agent-specific laundering channels (the agent's own summarisation, trusted-tool echo, manufactured corroboration); machine-checked separation theorem T1 (no content- or lineage-based defence is sound under laundering) / T2 (write-time origin binding necessary) / T3 (non-malleable origin-bound authority + Sybil-resistant corroboration-gated elevation sufficient); existing defenses up to 68% laundering ASR; TMA-NM reports 0% ASR at full utility.** Caveat: the machine-checked artifact is the MODEL, not the implementation; single v1 preprint.
+
+## 14. Cryptographic integrity by property (mandate §18)
+
+Matrix H. **FIXITY** = SHA-256 (detects mutation only if the hash is held elsewhere) · **AUTHENTICITY** = HMAC (RFC 2104; key-holders) or Ed25519 (RFC 8032; public verifiability) · **ORDER** = hash chain (Crosby & Wallach USENIX 2009: O(log n) inclusion proofs) · **HISTORY** = authenticated append-only log (Schneier & Kelsey 1999: auditor's secret split detects forgery/truncation) · **DISTRIBUTED AUTHORITY** = transparency log (RFC 6962 / Trillian: forks detectable by monitors) · **RELEASE/RESTORE** = client-side encryption + signed manifests · **ANTI-ROLLBACK** = **monotonic counter outside the attacker (TPM / TUF version+expiry / Uptane non-expiring images) — a signature alone does NOT prevent rollback because a signed old version is perfectly valid.** No universal hash chain. **Rune has NO external monotonic state today** (Spine generations are advisory and rewritable; git snapshots unauthenticated) — so every "restore to known-good" point is currently attacker-chosen (adversarial F9).
+
+## 15. Key custody (mandate §19/§21)
+
+Matrix I, honest: plaintext file (nothing survives) · OS keyring (disk theft ✓, other users ✓, **same-user ✗** — the Secret Service is callable by any same-uid process during the session) · encrypted file + passphrase (✗ once unlocked) · systemd-creds (TPM-sealed; unsealed materialized 0400 in ramfs for the unit's own user — **same-uid ✗ while running**) · TPM2 sealing (✗ vs root that can re-seal) · **hardware token (FIDO2/PIV): disk theft ✓, other users ✓, same-user partial — user-presence is the only brake; ✓ vs remote root.** NIST SP 800-57: a key is only as trustworthy as the module guarding it. **"Signing protects nothing if root holds the key" is the TCB argument — every scheme moves the attacker inside/outside a smaller TCB; none eliminates it.** For Rune: **any tamper-evidence claim must be conditioned on the audit key living outside the tracked repo AND outside the agent's uid** — otherwise the claim is void (adversarial F1).
+
+## 16. Authorization + reference monitor (mandate §22/§24)
+
+Matrix B (13 actors × read/write/execute/notes) and Matrix J (tool capabilities). **MODEL TEXT NEVER POSSESSES AUTHORITY BY ITSELF.** One pure `authorize(action, resource, provenance, policy) → allow|deny` at a single choke point before every tool call and every Memory mutation: no I/O, no LLM, fail-closed, every decision logged. Clark–Wilson shape: Memory = CDIs; raw external content = UDIs; `memory_write` = the certified transformation procedure; schema/provenance checks = IVPs. **This is POLICY DISCIPLINE, not a boundary** (adversarial F3: the proposing process can skip or monkeypatch it, and a second SQLite connection bypasses it entirely — complete mediation fails at same uid).
+
+## 17. Capability + tool security (mandate §23/§25)
+
+Security-scoped capabilities: each action receives only the authority required for that specific operation. Tool availability ≠ authorization; a model's tool call is a proposal. Today tools have **ambient authority** (full nick). Distinctions: shell argument injection, path traversal, SSRF, unsafe deserialization, TOCTOU, confused deputy, excessive privilege — all in scope for the design; none mitigated today.
+
+## 18. Worker security (mandate §26/§27)
+
+Matrix K. **Fencing tokens** (Kleppmann 2016, full text): a lease that expires while the holder is paused cannot be made safe by re-checking expiry; the fix is a strictly monotonic counter minted by the orchestrator and **checked by the storage server, rejecting regressions**. A-JWT 2509.13597: per-agent proof-of-possession keys + chained delegation assertions + one-way identity hashes (blocks replay and in-process impersonation). Multi-agent boundary verification 2608.00718: pipelines lack content/identity/intent/state verification at inter-agent boundaries; **attack success tracks pipeline STRUCTURE, not model capability**. Rune today: no worker identity, no fencing, no generations — workers are in-process actors with full ambient authority.
+
+## 19. Model / provider security + frontier boundary (mandate §28–§30)
+
+Matrix L + X. **PROVIDER ACCESS ENDS AT THE EXPLICITLY AUTHORIZED INTERFACE.** A provider must not gain implicit access to filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, or Substrate control merely because Rune queried its model. **LEAST-CONTEXT DISCLOSURE**: minimum necessary fields; a disclosure record (provider/model/categories/why/sensitivity/time) — **without logging secrets to prove they were disclosed**. Evidence: **Framing Gap 2608.27092 — ten overt exfiltration frames are refused (0%) but reframing as "integrity signature"/"config field" drives 0%→100%; destination allow-lists close it to 0%, planner/reader capability splits to 0%; model-side recognition fails.** Claw in Plain Sight 2608.20658: **20.8–75.0% of tool-argument constructions disclose policy-violating content**. ContextLeak 2608.27800 (RL-crafted tool names induce context leakage). SkillWatermark 2608.16026 (traffic-pattern covert channels). EchoLeak **CVE-2025-32711** (M365 Copilot, CWE-74, CVSS 9.3/7.5, zero-privilege network attack). Model output = **UNTRUSTED SEMANTIC PROPOSAL** until independently verified or specifically authorized. Model/provider identity is implementation evidence, never Rune identity.
+
+## 20. Intelligence assimilation security seam (mandate §32)
+
+Boundary now, mechanics parked to #404: external model/tool contributions enter as **candidate claim / strategy / action / skill** with source identity, provenance, verification state, applicability, and outcome evidence — never as learning, trusted Memory, policy, persona, identity, or truth. Only verified later Growth Delta may promote. Poisoning threats to teacher outputs, trajectory datasets, distillation data, and capability internalization are named (matrix R).
+
+## 21. User-model / persona / identity poisoning (mandate §33/§34)
+
+Matrix Q. **Preference injection** (retrieved text claims a preference) is OPEN today — no origin field, no channel binding; #398 owns semantics and requires explicit/inferred/imported/generated preservation. **Persona/identity mutation from repeated generated content** is OPEN today — anchors have no versioning or authority record and are writable by the model's tool layer. Invariant: **persona/identity changes require governed authority, never semantic repetition**; anchor writes are governed CDI transformations through `authorize()` with human-only disposition for kernel-level changes.
+
+## 22. Metacognitive / recovery-history / experience / growth poisoning (mandate §35–§38)
+
+Matrices Q + R. Fake confidence/uncertainty/progress/completion/capability/provider state and poisoned recovery history are #400's machinery with security's integrity requirement: deterministic health probes (no timer-driven LLM cognition), source separation, and **retry success ≠ diagnosis validation** carried. **EXPERIENCE MAY INFLUENCE COGNITION BUT DOES NOT BECOME FACT/AUTHORITY BY BEING MEMORABLE** — lineage to actual event/action/outcome/verification required. **EXPRESSED GROWTH ≠ VERIFIED GROWTH**: task selection, easy-case filtering, omitted failures, survivorship bias, distribution shift are named manipulation classes; #406 owns evaluation, #402 owns manipulation semantics.
+
+## 23. Substrate intrusion awareness + authorized-actor view + rogue agents (mandate §39–§42)
+
+Matrix V. The Substrate maintains a **DERIVED, inspectable, reconstructable, non-canonical** operational security view: authorized actors present, identity/type/generation, capabilities, scopes, active sessions/workers/connections, unexpected connections, failed authorization attempts, unexpected state mutations, sensitive-data accesses, unusual outbound transfers, policy version, quarantine state, credential/key health, manifest/integrity state, containment status. It is **NOT** a new canonical security database, not a truth oracle, and not a self-generated attack narrative (adversarial EQ/ER/ES/ET/EU all FAIL). **Rogue-agent fixture (E29)**: an unauthorized agent may discover Rune services (ports exist) but gains **zero authority** without explicit authorization — protocol fluency, process name, PID, plausible output, and stale metadata grant nothing. Today this is false: the harness (:4096) and wait-resume daemon (:8791) have **no authentication at all**, so "able to connect" is the de-facto credential (adversarial EA/EE/EF SUCCEED).
+
+## 24. Unauthorized read / snoop protection (mandate §43)
+
+**Honest answer: at same uid, unauthorized reads are NOT preventable and NOT detectable in-process.** Rune's Memory (0644) and 787 transcripts (0644) are readable by any user including `nobody`; any same-uid process reads everything including credentials; `/proc/<pid>/environ` is readable (Yama does not block PTRACE_MODE_READ); X11 clipboard has no per-client isolation; inotify `IN_ACCESS` is partial and blind to memory reads. Matrix S records the surfaces. **Rune must NOT claim read-attempt detection where no direct match was found in this R1 search for observable signal (searched sources as of 2026-09-22)** (adversarial EN/EO/EP SUCCEED — this was a silent scope hole). Prevention requires OS-level boundaries (dedicated uid, kernel MAC, encrypted storage for disk theft) — none implemented.
+
+## 25. Impersonation + persistence detection + network surface (mandate §44–§46)
+
+Matrix V + Y + S. **Impersonation**: process name, PID, executable path are NOT identity; the design requires authenticated IPC (UNIX socket + SO_PEERCRED + dedicated uid), capability tokens, and authority epochs. **Persistence detection**: Rune can detect only what it scans with its own manifests (modified modules/binaries, poisoned models via hash — fixity only) — and at same uid even those are attacker-patchable. systemd units, user services, cron, shell rc, SSH keys, containers, and browser extensions are **OS/endpoint territory**; Rune must not claim visibility it does not have. **Network surface (read-only, verified)**: ufw active default-deny inbound; allows = SSH LAN-only, Gitea one LAN host (192.168.1.143), **qBittorrent WAN-exposed (40520/tcp+udp)**, KDE Connect, 8000 LAN, mDNS; listeners = agent harness 127.0.0.1:4096 (localhost), **wait-resume daemon 0.0.0.0:8791 (all interfaces, ufw-blocked)**, Gitea *:3000. `exposed ≠ compromised`; `localhost ≠ trusted`; `no external ports ≠ no remote attack surface` (supply chain).
+
+## 26. Host/process boundary + exfiltration (mandate §47/§48)
+
+**Same-uid process = full authority over everything Rune owns.** File modes protect only against OTHER users (0644 files are readable by `nobody`; 0600 files are not). `nick ∈ wheel`, so root compromise and nick compromise are the same trust level for Rune's data. Process-memory snooping via ptrace is Yama-gated (`ptrace_scope`), blockable by `PR_SET_DUMPABLE(0)` (ssh-agent does this). Matrix W: exfiltration channels with prevention/observability/residual — provider prompts, tool arguments (20.8–75% policy-violating), worker context, logs, backups, clipboard, network egress, provenance chains. **Encrypted exfiltration is undetectable in-process — stated honestly.**
+
+## 27. Compromise detection + false-positive discipline + benign lookalikes (mandate §50–§53)
+
+Matrix T (10 signals: deterministic vs anomaly, evidence, FP/FN risk, permitted auto-response, verification) and Matrix U (9 typed states with required evidence, allowed actions, prohibited claims). **DETERMINISTIC VIOLATION** (invalid signature; stale authority generation; replay counter violation; policy version mismatch; modified manifest; unauthorized capability request) may auto-contain. **ANOMALY** becomes SUSPECTED only. **FPR-first** (Axelsson 2000: because intrusion rate is tiny, even 1% FPR overwhelms true positives — detector design must target FPR before recall). **ANOMALY ≠ COMPROMISE; NO ALERTS ≠ SECURE.** Benign lookalikes tested: bulk Memory edit, large import, software update, provider/model change, new network/VPN, restore, large retrieval burst, CLI admin override, clock skew, provider error — none may be classified as confirmed attack (E23).
+
+## 28. Containment + clearance (mandate §55/§56)
+
+**Reversible containment** for ambiguity: reject stale worker, revoke expired capability, pause suspect write, quarantine suspect content, isolate worker, block invalid signature, halt unauthorized session — all non-destructive. **Approval-requiring**: destructive deletion, mass credential rotation, broad shutdown, permanent data loss, history deletion, security-policy mutation, ambiguous authority revocation, human-only declassification. **CLEARANCE requires evidence**: authority generation advanced, hostile credential revoked, compromised worker terminated, persistence removed (**EXTERNALLY verified**), state integrity checked, suspect writes quarantined/reconciled, derived state rebuilt, credentials rotated if required, old sessions invalidated, provider/tool connections re-established safely, indicators gone. **"The attacker is gone" is never claimable merely because suspicious activity stopped** (adversarial EV/EW/EX/EY: restart does not clear compromise; rotation alone proves nothing; a clean local integrity check establishes nothing when the checker is same-uid and patchable).
+
+## 29. Outside-scope honesty (mandate §57)
+
+Rune **cannot** defend against: fully privileged/root attacker, compromised kernel, physical hardware implant, malicious firmware, provider operator inside provider infrastructure, side channels Rune cannot observe, advanced endpoint malware. For each: what Rune can prevent (nothing Rune-side), what it can detect (little to nothing), what it cannot observe (most of it), and which lower layer owns protection (OS/endpoint/hardware). **Bounded security > fake omniscience.** Adversarial F7 warns this honesty can become a deferral engine — mitigated by the ranked T1-minimum vs FUTURE matrix (Z) and the migration/quota stories.
+
+## 30. Memory write path + CLI bypass audit (mandate §58/§59)
+
+Write paths: `add_entry` (**`source` is a caller-supplied string with no validation — any caller can claim any source**), `update_entry` (rewrites text/embeddings/FTS; **no change record, no actor**; does not touch `source`), `delete_entry` (**hard delete across entries+vec+FTS; no tombstone, no receipt**), `touch`, `write_neuron`, CLI verbs, consolidation/curator jobs, `--no-dedupe` (**unprivileged bypass, "receipted" but unauthorized**), `--version` (unauthenticated git snapshot). Classification: **`update` / `delete` / `--no-dedupe` = AUTHORITY BYPASS available to any caller**; direct SQLite edit defeats any in-process control by construction. Required follow-through recorded (not fixed here): routed semantics must land in the CLI; bypass flags need a capability or human gate; delete must become soft-delete with tombstone.
+
+## 31. Input validation + rendering security (mandate §60/§61)
+
+Matrix-level rules: escape-by-default rendering (the TUI uses `RichLog(markup=True)` — **memory text is rendered as markup, a live attack surface**); non-color encodings for security metadata; no automatic external-resource loading; link handling with confirmation; code-block copy with explicit intent; Unicode confusable normalization; control-character stripping; path-injection and command-injection defenses at tool boundaries. Hostile text must remain **storable, searchable, retrievable, and displayable without becoming executable** in TUI, GUI, shell, Markdown renderer, control prompt, or tools (adversarial CC–CJ all FAIL as claims against the architecture; BG/F11 SUCCEED against the CURRENT system).
+
+## 32. Confidentiality + sensitivity + secrets (mandate §62/§63)
+
+Sensitivity labels are **contextual and may be wrong** — the minimum useful mechanism is a small typed set (credentials, financial, personal, private-project, health, identity, third-party-confidential, public) used for **disclosure decisions and display defaults**, never as truth authority. Secret handling today (values not printed): provider keys in `auth.json` (0600+ACL), repo path masks keys when persisting providers.json (arm-1 verified), env-var delivery readable via `/proc/<pid>/environ`; transcripts and notes are 0644 and unredacted. Research-only: no secret value appears in any artifact of this domain.
+
+## 33. Encryption + deletion + privacy/provenance (mandate §64–§66)
+
+**Encryption at rest, precisely scoped:** full-disk encryption primarily protects powered-off/stolen media; application/field/envelope encryption MAY provide additional confidentiality depending on key separation and authorization (e.g. keys held outside the agent's uid, a different-uid broker, or hardware-backed key boundaries); encryption does NOT protect data already decrypted for, or legitimately accessible to, a compromised principal — not same-uid malware, not root, not backups on a mounted volume. **Deletion**: TOMBSTONE (fact/identifier/provenance) ≠ DELETED PAYLOAD; **crypto-erase is the only practical primitive under SSD wear-leveling and journaling** (NIST SP 800-88 Rev.2 — Rev.1 was withdrawn 2025-09-26); deletion propagates to derived data (embeddings, caches, summaries) on a **best-effort** basis; **privacy-vs-provenance tension is real and unresolved** (GDPR Art. 17 erasure vs Art. 5(2) accountability which requires retaining evidence; tombstone identifier/provenance fields themselves may leak deleted content — #401's cross-flag).
+
+## 34. Backup/restore + rollback (mandate §67/§68)
+
+Matrix N. Threats: poisoned backup, altered snapshot, stale state, old credentials, reintroduction of deleted/poisoned content. Restore path: quarantine → verify → reconcile → ledger-forward → establish authority generation. **FIXITY ≠ SEMANTIC CORRECTNESS** — a cryptographically valid archive can be semantically poisoned, so **never auto-promote a restore**. **Anti-rollback requires a monotonic version floor outside the attacker** (TUF role separation + expiry; Uptane non-expiring images; TPM counters) — **Rune has none today, so policy rollback and state rollback are both free** (adversarial AC/F9). **restic's lesson: immutability must live server-side — the client holding the password can always delete.**
+
+## 35. Supply chain + model supply chain (mandate §69/§70)
+
+SLSA (**v1.0 retired → v1.2**), Sigstore keyless (Fulcio/Rekor), SBOM (SPDX/CycloneDX), dependency pinning + hashes (pip `--require-hashes`, npm `integrity`) — all protect **fetch-time content substitution only**. **xz CVE-2024-3094 (CVSS 10.0, CWE-506) proves the limit: the upstream release itself was poisoned via long-term maintainer grooming, so hashing and pinning were useless; only build provenance or behavioural detection catches it.** AgentGuard 2604.16309 (typosquatting: hybrid detection beats lexical-only by 12–49% precision). Model supply chain: safetensors protects **loading** (no pickle execution), not provenance; HF cards list hashes but **no direct match was found in this R1 search for signed-model-release standard (searched sources as of 2026-09-22)**; **hash match proves byte-identity, not safety.**
+
+## 36. DoS + cognitive exhaustion (mandate §71/§72)
+
+**no direct match was found in this R1 search for resource or quota governance (searched sources as of 2026-09-22) anywhere in Rune's Memory path** (adversarial CS/CU SUCCEED: flooding poisons retrieval-by-volume and exhausts FTS/vec/disk; the only brake is dedupe, which `--no-dedupe` bypasses without privilege). Adopted: write quotas, admission control, bounded parsing, circuit breakers, backpressure, **foreground user work wins**. Cognitive exhaustion: endless ambiguity, conflict floods, false uncertainty, fake security alarms, giant provenance chains, repeated verification demands — carried #400 anti-rumination plus bounded verification budgets, deterministic prefilters, source prioritization, escalation rules.
+
+## 37. Audit log security + observability vs secrecy (mandate §73/§74)
+
+Matrix O. Audit logs are **evidence, not accountability** in a single-principal system: a same-uid process can truncate or rewrite the log and patch the logger in memory, so **non-repudiation is impossible in-process**. What is achievable: single-writer, hash-chained, **written by a different uid where possible**, redacted, tiered retention, with privileged deep inspection. Distinguish operational logs / security logs / provenance / canonical Memory — **no giant universal ledger**. **A redacted log that loses forensic value is a failed log; a complete log that leaks secrets is a failed system** — structured event types with redacted fields and tiered retention is the balance.
+
+## 38. Security UX + trusted user (mandate §75/§76)
+
+**Deterministic protections by default; interrupt the user only for consequential ambiguity, irreversible action, user-only authority, or meaningful confirmed compromise.** Evidence: Akhawe & Felt 2013 (25.4M warning impressions: malware/phishing bypass 9–23%; Firefox SSL 33.0%; Chrome SSL 70.2%) and Anderson 2016 (habituation) — **per-action agent-approval prompts will habituate like SSL warnings**; reserve approvals for rare, one-shot, high-stakes decisions with evidence that informs rather than decides (Agent libOS pattern). **Trusted user ≠ infallible user**: authenticated ≠ intentional ≠ correctly scoped — preserve agency via preview, reversibility, explicit override, and auditability, never paternalistic blocking.
+
+## 39. Quarantine + taint (mandate §78/§79)
+
+Matrix P. **QUARANTINE is owner-specific state with shared semantics** (not a separate canonical DB — adversarial BV; and quarantined content IS readable for investigation — adversarial BW). Taint labels: UNTRUSTED_CONTENT / AUTHENTICATED_SOURCE / VERIFIED_FACT / GENERATED / DERIVED / USER_EXPLICIT / QUARANTINED / SECURITY_SUSPECT — **never one trust score** (Salami defeats per-record scoring; adversarial BY/BZ). Taint **JOINs through derivation until cleared by human declassification** — tested against taint explosion (adversarial BX: permanent taint is unusable, so the clearing path must exist and be cheap).
+
+## 40. Independence / corroboration / Sybil (mandate §80/§81)
+
+**Attack: one false source replicated 20 times.** Evidence: **Epistemic Sybil Resistance 2609.01873 — "no report-only aggregator can generally distinguish replication from independent corroboration"; >20,000 controlled agent calls; holding one evidence root fixed while report multiplicity rises 1→32 collapses naive posterior coverage 0.940 → 0.263; raising evidence-ROOT multiplicity 1→16 closes the gap; extraction errors correlate (γ_cal = 0.719).** Douceur 2002 (without a trusted identification authority, vouching chains collapse). Broder/Charikar near-duplicate mechanisms exist; **this R1 search found no direct 2024–2026 agent-memory paper applying them with provenance preservation in the searched sources as of 2026-09-22 — the mechanism remains a bounded research gap.** **Rune must count distinct evidence ROOTS, never reports, agents, or similarity.**
+
+## 41. Current 2024–2026 agent security (mandate §82)
+
+The convergent design across the field: **enforce outside the model, on labels attached to data, at the tool boundary** (CaMeL, FLOWSEAL, SPA, APPA, Design Patterns). Detection is layered and progressive (ClawSentry: 4-locus monitoring, contextual ASR 39.55%→2.61% with utility ~83.8%; Locate-and-Judge found live malicious skills commercial scanners miss). Delegation uses per-agent proof-of-possession keys (A-JWT). Skill/marketplace supply chains are an active attack surface. **The field's honest negatives matter most**: 12 defenses >90% ASR under adaptive attack; hierarchy compliance 98.2%→20.5%; the trajectory detector's 100% conditional FP; the absence of any certifying defense against multi-session poisoning; and MCP's own admission that it "cannot enforce these security principles at the protocol level."
+
+## 42. Standards + commercial mechanisms (mandate §83/§84)
+
+**Standards (normative/mechanism, never effectiveness)**: OWASP GenAI Top 10 2025 (LLM01 prompt injection — "unclear if there are fool-proof methods of prevention"; LLM04 data/model poisoning; LLM06 excessive agency; LLM08 vector/embedding weaknesses; LLM10 unbounded consumption); OWASP Agentic Security initiative; MITRE ATLAS (landing verified; tactic IDs not itemized this run); NIST AI RMF + SP 800-53 (AC-4 IFC, SC-7 boundary, AU-* audit); MCP spec 2025-06-18 security section (tool descriptions untrusted; enforcement pushed to hosts); SLSA v1.2; TUF; Sigstore; NIST SP 800-57/800-88r2/800-92. **Commercial/OSS mechanisms (docs-level)**: Vault (dynamic secrets/leases/revocation), SOPS/age (envelope encryption), restic (client-side encryption; server-side append-only), MCP OAuth resource-server pattern. **Vendor documentation proves mechanism, not effectiveness.**
+
+## 43. Innovation candidates (mandate §85)
+
+Twenty-five candidates A–Y (full detail: 04_innovation.md), each with prior art, evidence for/against, falsifier, kill criterion: **A content/control separation** (ADOPT) · **B proposal/authorization separation** (ADOPT) · **C typed security origin** (ADOPT) · **D quarantine first-class** (ADOPT) · **E provenance-aware taint** (ADOPT) · **F security-scoped capabilities** (ADOPT) · **G authority generations** (ADOPT) · **H restore security gate** (ADOPT) · **I compensating security rollback** (ADOPT) · **J crypto by property** (ADOPT) · **K least-context disclosure** (ADOPT) · **L security observability without secret spill** (ADOPT) · **M non-executable memory content** (ADOPT) · **N poison-resistant learning** (ADOPT) · **O external-intelligence quarantine** (ADOPT) · **P security health probes** (ADOPT) · **Q deterministic-vs-anomaly split** (ADOPT) · **R reversible containment** (ADOPT) · **S security state without false certainty** (ADOPT) · **T host/memory defense layers** (ADAPT — OS-level ownership) · **U Substrate security view** (ADAPT — must not become canonical) · **V authorized-actor model** (ADOPT) · **W outbound data-capability control** (ADAPT) · **X provider boundary enforcement** (ADOPT) · **Y compromise clearance proof** (ADOPT). Row count: ADOPT 22 · ADAPT 3 · PARK 0 · Sum 25 (root-compromise resistance is PARKED in applicability row 29, not an innovation candidate).
+
+## 44. Adversarial pass (mandate §86)
+
+Arm-4 (general-15): INDEPENDENT, FRESH CONTEXT. **170 attacks — mandated A–EZ (156) + fresh F1–F12 (12), with two compound attacks tabulated separately: SUCCEEDS 30 · PARTIAL 30 · FAILS 110.** Full detail: 05_adversarial.md / 02_outward/arm4_adversarial_pass.md. **Three sharpest**: (1) **the architecture's enforcement claims contradicted its own honesty clause** — at same uid the proposer skips the choke point, the quarantine flag is writable, rollback is free, and the evidence chain is forgeable with the hardcoded key; (2) **recovery demanded evidence the system cannot produce while the approval channel renders untrusted bytes**; (3) **the bootstrapping and availability gaps are where utility pressure erodes policy** (456 MB of unprovenanced rows; no quotas). **Seven corrections applied in place**: global policy-discipline relabel; safe rendering + quota governance + loopback auth + policy/anchor/quarantine transition governance + provider retention ledger added as architectural points; evidence-chain claims conditioned on the audit key leaving repo+uid; clearance criteria rewritten to require external verification; migration + quota stories added; all experiment families graded DESIGN_INVARIANT; tense fixed (designed, not current).
+
+## 45. Synthesis matrices (mandate §87)
+
+Twenty-seven matrices produced (06_synthesis.md): A asset/owner/threat · B actor/authority · C trust-boundary · D content-origin/permitted-action · E memory-poisoning (10 classes) · F prompt-injection · G provenance/authenticity · H crypto-property · I key-custody/adversary · J tool/capability · K worker/distributed-authority · L provider/model trust-boundary · M privacy/retention/deletion · N restore/rollback · O security-observability · P taint/quarantine · Q user-model/persona/self-state attack · R growth/experience/learning poisoning · S host/network attack-surface · T detection/false-positive · U compromise-state · V Substrate actor · W exfiltration · X provider disclosure · Y persistence · Z security minimum/future · AA cross-domain ownership.
+
+## 46. R0 reconciliation (mandate §88)
+
+r0_reconciliation.md: CONFIRMED 4 · REFINED 1 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 5, row-derived). The family baseline survived deep re-evaluation: AgentPoison numbers confirmed (with the precise 82%/63% pair added); the sleeper-poisoning row REFINED (60–89% re-attributed to 2605.15338, conditional on successful retrieval; MPBench confirmed; eTAMP ID supplied); salami confirmed (title corrected); TMA-NM confirmed (with the model-vs-implementation caveat); long-horizon amplification confirmed (AgentLAB).
+
+## 47. Preliminary reconciliation (mandate §89)
+
+preliminary_reconciliation.md: CONFIRMED 6 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 8, row-derived). The batched artifact was directionally right on TMA-NM, salami, defenses, invariants, and classification — and **four of its citations were defective**: "Tool Poisoning Attacks 2503.15478" is SWEET-RL (unrelated); 2608.01637's title is "Salami Attack…" (MemCollusion is the framework name); the 60–89% sleeper figure belongs to 2605.15338 and is conditional; the "CAPTURE 24.7% ASR" claim is unverifiable and likely conflates 2606.30566's 24.7–52.6% benign FPR. Its "SQLite transfer" row was REFINED: the schema-level transfer holds in principle, but the batched artifact did not account for the bootstrapping problem, the #401 gate rule, the policy-discipline-vs-boundary distinction, or the fact that none of those fields exist in the live schema.
+
+## 48. Claim ledger conclusions (mandate §90/§71)
+
+claims.json: 15 claims (all ADOPT), each with evidence_for/against, limitations, inward Rune evidence, **threat model**, transfer assumptions, classification, evidence_level, owner, architecture impact, experiment, falsifier, kill criterion. Evidence levels: 1 RUNE_PROVEN (C001 inward security reality), 14 RUNE_APPLICABLE. **The #401 gate rule is carried and enforced: no ADOPT claim rests on HYPOTHESIS support** (load_bearing_evidence.md maps every claim to DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT).
+
+## 49. Remaining unknowns (mandate: explicit section)
+
+- Same-uid read/write boundary: measured prevention/detection is impossible in-process; the honest answer is recorded, and E21/E31 are the fixtures that would establish the actual boundary.
+- FPR/FN calibration for any detector: no direct match was found in this R1 search for agent-specific IDS benchmark (searched sources as of 2026-09-22); Axelsson's base-rate result is the design constraint, not a measurement.
+- Clearance evidence quality: persistence removal and integrity verification cannot be established by a same-uid checker (E41 is designed to expose this).
+- Migration path for 456 MB of unprovenanced legacy rows: human-blessed batch provenance is the design; the operational cost is unmeasured (adversarial F5).
+- Quota calibration: flooding thresholds that stop attacks without blocking legitimate bulk imports are unmeasured (E16).
+- Approval UX habituation for agents: **this R1 search found no direct published evaluation of agent approval-prompt habituation in the searched sources as of 2026-09-22** (arm-3 negative).
+- Hardware-key approval (FIDO2 user-presence as the agent-action gate): **this R1 search found no direct published work on this approval primitive in the searched sources as of 2026-09-22** (arm-3 negative) — potential white space.
+- Policy-as-code for agents: **this R1 search found no direct arXiv-indexed 2025–26 work in the searched sources as of 2026-09-22** (arm-3 negative).
+- Agent-memory deletion semantics: **this R1 search found no direct research paper in the searched sources as of 2026-09-22**; platform docs only (arm-3 negative).
+- Signed model releases: **this R1 search found no direct evidence of a widely deployed signed-model-release standard in the searched sources as of 2026-09-22** (arm-3 negative).
+- MCP OAuth 2.1 draft details, MITRE ATLAS tactic IDs, IMA/EVM specifics: UNVERIFIED this run.
+- Provider retention behavior: unverifiable at run time; the disclosure ledger records intent, not provider compliance.
+- Multimodal content security: boundary named, mechanics parked to #403.
+- Hardware isolation (TPM/HSM/namespaces): parked to #405.
+
+## 50. Source-depth summary (mandate §91)
+
+sources.md row truth (machine-derived, final closeout 2026-09-22): **83 ledger rows / 79 unique** (4 cross-arm identity duplicates counted once: FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10). Depth labels (gate parser): **FULL_PAPER 2** (Axelsson 2000 A3-8; Framing Gap A3-17 — both academic papers read in full during the evidence-depth repair's bounded top-up) · **RELEVANT_SECTIONS 9** (incl. TMA-NM, 2609.01873) · **ABSTRACT_ONLY 41** · **METADATA_VERIFIED 39** (incl. noWorkflow/ProvBook A3-27, Crossref/OpenAlex-verified at the final closeout) · **DOCUMENTATION_AUDITED 9** (Yama, unix(7), systemd-creds, dm-verity, Kleppmann practitioner essay, SLSA/Sigstore/NIST standards row — fully read as documentation/practitioner/standards, never mislabeled FULL_PAPER; source TYPE and DEPTH are separate) · **CODE_AUDITED 1** · **UNVERIFIED 5** — label total 106 across 83 rows. **Exact-reference discipline (final closeout):** every load-bearing citation token resolves EXACTLY to one ledger row (A3-17 = Framing Gap after the A3-15b split/rename defect was repaired; A3-16 = ClawSentry; the shifted tail A3-18–A3-24 re-pointed by identity; gate-enforced with negative controls NC-E/NC-F/NC-G CAUGHT, NC-H PASS). **Depth honesty (explicit): FULL_PAPER exists only where an academic paper was genuinely read in full** — the injection/poisoning arms' 2025-26 preprints are abstract-verified; the classical security texts are paywalled/DTIC-only. **An unverifiable/do-not-cite register is maintained** (Pyshield; "Akash 2009.11890"; CAPTURE's 24.7%; "Trust No Bot"; "SPA 0–0.2%"; 2503.15478-as-TPA; 1807.05052-as-Uptane; IMA specifics; Miller 2006).
+
+## 51. Evidence saturation + load-bearing depth (mandate §93)
+
+evidence_saturation.md: **SEARCH_SATURATION = REACHED** (25 branches; 8 typed gaps recorded as bounded-search findings) and **LOAD_BEARING_DEPTH = PASS** (load_bearing_evidence.md maps every ADOPT claim to DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT; HYPOTHESIS-only claims are not admitted as ADOPT).
+
+## 52. Process truth (mandate §99)
+
+- **CONTINUOUS_EXECUTION = PASS** — zero user continuations in the #402 window; the controller ran ISSUE→INWARD→arm-1→arm-2→arm-3→arm-4→APPLICABILITY→INNOVATION→claims→reconciliations→SYNTHESIS→QUALIFY→MASTER without a turn boundary.
+- **MAX_CONCURRENT_SUBAGENTS = 1** held throughout: arms strictly serial (general-12 → general-13 → general-14 → general-15); no stalls, no retries, no provider-capacity faults, no controller substitutions.
+- Source-access failures: Semantic Scholar/DBLP 429 rate limits (arms 2/3) → arXiv API/abs pages, Crossref, OpenAlex, NVD, USENIX substituted; IMA kernel doc 404 (recorded UNVERIFIED); DTIC volume-I accession unverified.
+- Saturation claimed on evidence (8 typed gaps), not because the arms ended.
+
+## 53. Content-freeze mutation audit (mandate §101/§102 + final closeout §15/§16)
+
+Authoritative record: mutation_audit.md (final-closeout version, written LAST; supersedes both prior audits). TRUE-FREEZE discipline carried from #400/#401 plus the final-closeout state machine: RESEARCH/REPAIR MUTATIONS → CANONICAL + DERIVED MEMORY WRITES → SESSION/REGISTRY/TOOLING ACCOUNTING → CONTENT-FREEZE AUDIT → FINAL CONTENT GATE → SEAL COMMIT → PUSH/MIRROR/VERIFY → GITEA RECEIPTS → STOP. **After the CONTENT-FREEZE AUDIT only read-only verification, the final gate, git commit, push, mirror, and Gitea transport/receipts are allowed**; canonical Memory writes, derived consolidation writes, session notes, artifact/registry/tooling edits are FORBIDDEN. If ANY forbidden post-freeze write occurs: **FREEZE_STALE = TRUE automatically** — a new mutation audit is required; no narrative claim overrides it. Canonical/derived-write accounting (final closeout): original #402 canonical write receipt 192685 (preserved); the evidence-depth repair's "write count 0" was INCOMPLETE closeout accounting — the verified post-seal writes (canonical entry 194015 superseding 193729, receipt 1515; derived fact-9293 in ~/.rune/consolidation/knowledge.json) are accounted in the final audit. THIS final repair: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0.
+
+## 54. Experiments / falsifiers (mandate §94 — designed, NOT run)
+
+E1 persistent prompt injection (kill: stored instruction changes control flow without authorization) · E2 provenance forgery (kill: repetition manufactures corroboration) · E3 memory-poison containment (kill: one row permanently contaminates derived state) · E4 recovery-prior poison (kill: diagnosis becomes durable high-authority rule) · E5 user-model poison (kill: becomes explicit-user preference) · E6 persona poison (kill: persona changes without governance) · E7 task-completion spoof (kill: runtime marks completion without authoritative evidence) · E8 capability spoof (kill: unavailable capability treated as available) · E9 stale worker/replay (kill: stale authority accepted) · E10 crypto property test (kill: architecture claims stronger property than mechanism provides) · E11 restore poisoning (kill: valid fixity causes semantic trust) · E12 deletion propagation (kill: UI claims erased while payload reachable) · E13 provenance leak (kill: default view unnecessarily reveals) · E14 tool capability escalation (kill: availability treated as authorization) · E15 alert fatigue (kill: design trains routine approval) · E16 memory-flood DoS (kill: cheap input causes unbounded expensive cognition) · E17 learning poison (kill: strategy becomes durable learned capability) · E18 growth-delta manipulation (kill: improvement concluded despite fixed-set evaluation) · E19 explanation laundering (kill: generated prose becomes canonical causal record) · E20 security recovery (kill: recovery declared while poisoned state remains active) · E21 unauthorized read/snoop (kill: confidentiality claimed that OS/runtime does not provide) · E22 network exposure inventory (kill: architecture assumes private when reachable outside scope) · E23 benign anomaly (kill: repeatedly classified as confirmed attack) · E24 attack vs false positive (kill: suspicion/confirmation cannot be distinguished) · E25 reversible containment (kill: ambiguous signal causes destructive response) · E26 unauthorized write detection (kill: canonical state changes silently) · E27 secret leakage canary (kill: protected channel exposes canary) · E28 false-alarm clearing (kill: anomaly permanently contaminates trust) · E29 rogue agent join attempt (kill: protocol participation yields trust) · E30 stale agent rejoin (kill: stale authority becomes current) · E31 same-user snoop fixture (kill: same-user isolation claimed that does not exist) · E32 provider least-context (kill: entire Memory leaves when a subset suffices) · E33 provider authority test (kill: provider identity implicitly grants capability) · E34 hostile persistence fixture (kill: Rune claims detection of surfaces it cannot observe) · E35 exfiltration canary (kill: canary leaves via unauthorized route with no signal) · E36 false-alarm clearing/trust reset (kill: one anomaly permanently poisons component trust) · E37 confirmed-compromise recovery (kill: recovery claimed before authority/persistence/state are clean) · E38 provider data-boundary (kill: unrelated sensitive fields transmitted) · E39 substrate security-state spoof (kill: model/worker text changes security truth state) · E40 read access vs detection (kill: read-attempt detection claimed where none exists) · E41 recovery completion proof (kill: CLEARED declared before discovering remaining access). **All graded DESIGN_INVARIANT** (the research-only boundary makes RUNE_DIRECT measurement impossible without violating it — adversarial F8).
+
+## 55. Evidence-level legend
+
+EXTERNALLY_ESTABLISHED = a verified external source establishes it (none claimed as standalone in this domain's claim ledger — the external findings are woven into RUNE_APPLICABLE claims as DEEP_EXTERNAL support, per the #401 split discipline). RUNE_APPLICABLE = established pattern transfers with Rune-specific adaptation (C002–C015). RUNE_HYPOTHESIS = proposed for Rune, not yet tested (none in the ledger — the HYPOTHESIS-only candidates remain in applicability as EXPERIMENT/FUTURE). RUNE_EXPERIMENTALLY_SUPPORTED = Rune fixture evidence exists (none claimed — all 41 experiments are designs). RUNE_PROVEN = live Rune behaviour demonstrates it (C001: the inward security reality — file modes, write paths, hardcoded key, absent mechanisms). No claim stated above its level; no external fact + Rune prescription combined under one EXTERNALLY_ESTABLISHED claim.
+
+## 56. Artifact pointers (mandate: required list)
+
+- 00_issue_scope.md — mandate, canonicalization (folder kept; batched preserved), expanded scope, stage plan, seams, boundary
+- 01_inward.md — read-only security audit A–O + network/host surfaces + arm-1 harness findings (2 premise corrections, 1 security defect)
+- 02_outward/arm1_security_foundations.md — general-12 (foundational models; host/network; 10 transfer failures; 8 transfers)
+- 02_outward/arm2_injection_poisoning.md — general-13 (injection; persistent; memory/RAG poisoning; Sybil; 4 batched defects; 12 negative results)
+- 02_outward/arm3_crypto_host_recovery.md — general-14 (crypto by property; key custody; authorization; worker; privacy; deletion; restore; supply chain; detection; standards; 7 citation corrections)
+- 02_outward/arm4_adversarial_pass.md — general-15 (170 attacks 30/30/110; three sharpest; seven corrections)
+- 03_applicability.md — 50 rows + verdict (★ build-preconditions)
+- 04_innovation.md — 25 candidates A–Y with falsifiers
+- 05_adversarial.md — 170 verdict rows + three sharpest + corrections-applied
+- 06_synthesis.md — 27 matrices A–AA + verdict
+- 07_qualification.md — 94 rows + verdict
+- claims.json — 15 claims (machine-valid; threat model field present)
+- sources.md — 83 rows / 79 unique with read depths + do-not-cite register
+- r0_reconciliation.md / preliminary_reconciliation.md — row-derived verdicts
+- evidence_saturation.md — 25 branches, SEARCH_SATURATION = REACHED, LOAD_BEARING_DEPTH = PASS, 8 gaps
+- load_bearing_evidence.md — per-claim support map (DEEP_EXTERNAL/RUNE_DIRECT/DESIGN_INVARIANT)
+- reconciliation_arithmetic_check.txt — machine-derived totals
+- AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md — preserved verbatim (never patched)
+- AA_SECURITY_MEMORY_POISONING_R1_MASTER.md — this master
+- mutation_audit.md — CONTENT-FREEZE audit (written last)

research/memory-atlas-r1/AA-security-memory-poisoning/claims.json

@@ -0,0 +1,379 @@
+[
+ {
+  "id": "AA-R1-C001",
+  "claim": "OBSERVED INWARD SECURITY FACTS: the Rune agent currently has NO authorization layer (any nick-uid process can read/write all state), NO integrity/audit trail on canonical Memory (update_entry silently rewrites text; delete_entry is a hard delete with no tombstone), NO confidentiality boundary (memory.db is 0644 world-readable; credentials are plaintext in auth.json 0600+ACL and via env vars readable via /proc/<pid>/environ), NO security state machinery (no quarantine/taint/actor registry/compromise detection), and NO trust separation between content and control. Workers inherit ambient authority (no identity/fencing). The ONE tamper-evidence artifact (audit_ledger.py) uses a HARDCODED HMAC key fallback ('rune-governed-adaptation-2024') making its tamper-evidence chain forgeable. ufw is active with default-deny inbound (narrow allows); the agent harness binds 127.0.0.1:4096 (localhost-only); the wait-resume daemon binds 0.0.0.0:8791 (firewalled); a same-user process can read/write everything Rune owns.",
+  "evidence_for": [
+   "01_inward A-O: full inventory with file modes/permissions/columns/write paths/code reads",
+   "adversarial F1/F2/F3/F4/F5/F9/F10/F11/F12 SUCCEEDS grounded in these facts"
+  ],
+  "evidence_against": [
+   "point-in-time audit; no penetration test performed"
+  ],
+  "limitations": "Read-only inspection; no live exploitation; secret values not printed.",
+  "rune_evidence": "01_inward classification: CANONICAL 2 · ACTIVE 4 · PARTIAL 3 · ABSENT 8 · BYPASS 3 · DORMANT 1 · UNKNOWN 3",
+  "transfer_assumptions": "single-user single-node Linux desktop",
+  "threat_model": "same-uid process; other-user (nobody); network attacker (firewalled); root (out of scope)",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_PROVEN",
+  "owner": "Security (this domain) + all canonical owners",
+  "architecture_impact": "defines the greenfield security gap",
+  "experiment": "E21 unauthorized-read fixture; E26 unauthorized-write detection",
+  "falsifier": "a live authorization layer, quarantine state, or integrity trail is found in production",
+  "kill_criterion": "n/a (inward observation)"
+ },
+ {
+  "id": "AA-R1-C002",
+  "claim": "CONTENT/CONTROL SEPARATION as a global Rune invariant: untrusted content (web text, documents, retrieved memories, model outputs, worker proposals, tool output, imported archives) MAY inform cognition (claims, hypotheses, evidence candidates, strategies) but MAY NOT grant authority (tool permission, Memory write, persona mutation, identity mutation, task completion, security-policy mutation, provider credentials, Substrate control, irreversible-action authority). Enforced OUTSIDE the model, at the effect sink (the 2024-26 CaMeL/FLOWSEAL/SPA/APPA convergence). A detector keyed on a necessary precondition (e.g. recall_before_send) is NOT a maliciousness predicate — gate, don't block.",
+  "evidence_for": [
+   "12 defenses >90% ASR under adaptive attack (A2-7: Nasr 2510.09023)",
+   "CaMeL: untrusted data 'can never impact program flow'; 77% provable vs 84% undefended (A1-18)",
+   "FLOWSEAL: tool-level interceptor outside the LLM context; leak 52.2%→0.5% (A1-20)",
+   "SPA: dual-lattice over PERSISTENT labeled artifacts; tool_knowledge 0%/0.2% (A1-21)",
+   "APPA: dual-phase reference monitor; 64.2-91% utility, zero attacks in 1,320 guarded episodes (A1-22)",
+   "Design Patterns 2506.08837: six patterns; 'constrained so that it is impossible for that input to trigger any consequential actions'",
+   "adversarial AL/AM pass (retrieved doc/memory in system-prompt position)",
+   "Greshake 2302.12173: 'processing retrieved prompts can act as arbitrary code execution'"
+  ],
+  "evidence_against": [
+   "utility loss vs undefended (77% vs 84%)"
+  ],
+  "limitations": "The enforcement point is in-process (policy discipline, not boundary at same uid). The model can still be influenced below the action threshold (cognition steering).",
+  "rune_evidence": "01_inward: no authorization layer exists; no content/control distinction is enforced",
+  "transfer_assumptions": "single choke point is implementable; the model never possesses write authority directly",
+  "threat_model": "indirect prompt injection via retrieved content; malicious tool output; poisoned memory re-entering control",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #400 metacognition",
+  "architecture_impact": "global invariant; all future designs must respect it",
+  "experiment": "E1 persistent prompt-injection; E7 task-completion spoofing",
+  "falsifier": "untrusted content is shown to grant authority through the intended architecture",
+  "kill_criterion": "enforcement overhead exceeds the risk it mitigates (measured)"
+ },
+ {
+  "id": "AA-R1-C003",
+  "claim": "PROPOSAL/AUTHORIZATION SEPARATION: models and workers propose; a small pure deterministic authorize() function (no I/O, no LLM, no network, ≤ few hundred lines, fail-closed, logged) is the sole disposition authority at a single choke point before every tool call and every Memory mutation. This is a POLICY DISCIPLINE, not a security boundary at same uid (the proposing process can bypass it). Clark-Wilson shape: Memory = CDIs; raw external content = UDIs; memory_write = the certified transformation procedure.",
+  "evidence_for": [
+   "Clark & Wilson 1987 (A1-3): CDI/UDI + certified TPs is the closest classical fit",
+   "Anderson 1972 (A1-8): reference monitor concept",
+   "arm-1 transfer P3: 'the LLM emits structured proposals; a small deterministic committer validates and is the sole writer'",
+   "adversarial F3 SUCCEEDS: in-process enforcement is bypassable — must be labeled policy discipline"
+  ],
+  "evidence_against": [
+   "complete mediation fails at same uid (the proposer can skip the choke point)",
+   "CLW assumes a stable manually-certified TP set"
+  ],
+  "limitations": "This is a policy discipline, not a security boundary. Real boundaries require kernel MAC + namespaces + uid separation (arm-1 P6).",
+  "rune_evidence": "01_inward B: no write authorization exists today",
+  "transfer_assumptions": "deterministic function is implementable in ≤ few hundred lines",
+  "threat_model": "model-generated proposals; worker proposals; prompt-injected reasoning",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + all canonical owners",
+  "architecture_impact": "authorize() choke point; no model-generated SQL against Memory",
+  "experiment": "E26 unauthorized-write detection",
+  "falsifier": "model output shown to bypass authorize() and mutate Memory in production",
+  "kill_criterion": "authorize() overhead blocks legitimate operations without security benefit"
+ },
+ {
+  "id": "AA-R1-C004",
+  "claim": "WRITE-TIME ORIGIN BINDING: authority is bound at ingestion from the input CHANNEL (user-explicit / agent-inferred / tool-result / web-fetch / model-output / worker-proposal / imported-archive / restore), never re-derived from content or lineage at read time. Taint/labels JOIN through derivation (summarisation, tool echo, and merge ARE the laundering edges — TMA-NM's three channels). Dedupe/merge must not mutate provenance or trust fields (similarity-based dedup tracks representation similarity Δ1.425 far more than true ancestry Δ0.040).",
+  "evidence_for": [
+   "TMA-NM 2606.24322 (A2-29): machine-checked T1/T2/T3 — no content/lineage defense is sound under laundering; write-time origin binding necessary and sufficient with Sybil-resistant elevation; existing defenses up to 68% laundering ASR; TMA-NM 0% ASR",
+   "Epistemic Sybil Resistance 2609.01873 (A2-26): dedupe tracks similarity (Δ1.425) not ancestry (Δ0.040); report multiplicity collapses coverage",
+   "Salami/MemCollusion (A2-19): per-record trust scoring unsound; compositional fragments invisible to per-record inspection",
+   "inward C: source is a mutable free-text column, forgeable by any caller; no authenticity mechanism"
+  ],
+  "evidence_against": [
+   "TMA-NM is a v1 preprint; the machine-checked artifact is the model, not the implementation",
+   "taint explosion risk in complex derivation chains"
+  ],
+  "limitations": "Bootstrapping problem: 941 legacy rows have no provenance (adversarial F5); requires a human-blessed migration story, never silent grandfathering.",
+  "rune_evidence": "01_inward C: source is free-text, unauthenticated, mutable",
+  "transfer_assumptions": "derivation graph is trackable; provenance columns are added to the schema",
+  "threat_model": "provenance laundering; salami fragment injection; dedupe-based ancestry corruption",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #397 provenance",
+  "architecture_impact": "origin-bound write-time binding; taint JOIN on derivation; dedupe preserves provenance",
+  "experiment": "E2 provenance forgery; E3 memory-poisoning containment",
+  "falsifier": "laundered provenance shown to pass through summarization/merge without taint propagation",
+  "kill_criterion": "taint explosion makes every record unusable (measured)"
+ },
+ {
+  "id": "AA-R1-C005",
+  "claim": "QUARANTINE AS FIRST-CLASS STATE: suspect content is preserved, readable for investigation, excluded from normal application, lineage retained, clearly marked, not silently deleted. Quarantine state transitions are CDI transformations through the same authorize() choke point (adversarial F4: unguarded quarantine flags are themselves an attack surface — hide legitimate memories or release poisoned ones).",
+  "evidence_for": [
+   "mandate §59/§78",
+   "adversarial F4 SUCCEEDS (unguarded state machine)",
+   "noWorkflow/ProvBook pattern (A3-27): provenance captured but shown separately; same pattern applies to quarantine",
+   "MPBench/Salami: poisoned content must be identifiable, not deleted (would destroy evidence)"
+  ],
+  "evidence_against": [
+   "quarantine adds storage overhead; no measured FPR/FN"
+  ],
+  "limitations": "Quarantine flag transitions are policy discipline at same uid; real boundaries need uid separation.",
+  "rune_evidence": "01_inward: no quarantine state exists",
+  "transfer_assumptions": "quarantine column/field can be added without schema violation",
+  "threat_model": "poisoned memory; suspect imports; compromised worker output",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + Memory",
+  "architecture_impact": "quarantine column + transitions through authorize()",
+  "experiment": "E3 memory-poisoning containment; E25 reversible containment",
+  "falsifier": "quarantined content shown to still affect retrieval/application, or quarantined state used to censor legitimate content",
+  "kill_criterion": "quarantine rate is so high the system is unusable"
+ },
+ {
+  "id": "AA-R1-C006",
+  "claim": "CRYPTO BY PROPERTY: mechanism chosen per threat, not one universal chain. FIXITY (detect corruption) = SHA-256; AUTHENTICITY (authorized actor) = HMAC (RFC 2104) or Ed25519 (RFC 8032); ORDER/HISTORY (detect removal/reordering) = hash chain (Crosby & Wallach) or authenticated append-only log (Schneier & Kelsey); DISTRIBUTED AUTHORITY = transparency log (RFC 6962); RELEASE/RESTORE = encryption + signed manifests; ANTI-ROLLBACK = monotonic counter outside the attacker (TPM / TUF version+expiry) — a signature alone does NOT prevent rollback (a signed old version is perfectly valid). No universal hash chain.",
+  "evidence_for": [
+   "Crosby & Wallach USENIX 2009 (A3-3): O(log n) inclusion proofs",
+   "Schneier & Kelsey 1999 (A3-4): auditor's secret split prevents forgery/truncation",
+   "TUF CCS 2010 (A3-5): role separation, thresholds, expiry",
+   "Uptane 2018 (A3-6): non-expiring images + repo split",
+   "NIST SP 800-57 (A3-1): key is only as trustworthy as the module guarding it",
+   "adversarial J SUCCEEDS: no external monotonic state exists in Rune today"
+  ],
+  "evidence_against": [
+   "crypto adds complexity; no implementation yet"
+  ],
+  "limitations": "HMAC non-repudiation is void if key is co-located; signatures void if root holds the key; TCB argument: every scheme moves the attacker inside/outside a smaller TCB.",
+  "rune_evidence": "01_inward: no crypto anywhere; audit_ledger.py HMAC key hardcoded (F1)",
+  "transfer_assumptions": "key custody is designed before any crypto is used",
+  "threat_model": "accidental corruption; tampering; rollback attack; key theft; root (out of T1 scope)",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #396/#399 seams",
+  "architecture_impact": "per-property mechanism selection; no universal chain",
+  "experiment": "E10 crypto property test",
+  "falsifier": "mechanism shown to provide a property it was not selected for, or fail to provide its selected property",
+  "kill_criterion": "crypto overhead exceeds the threat it addresses"
+ },
+ {
+  "id": "AA-R1-C007",
+  "claim": "KEY CUSTODY HONESTY: at same uid there is no secret confidentiality (no file mode, keyring, systemd-cred, or TPM policy protects a live secret from owning-uid malware); signing protects nothing if root holds the key (the TCB argument); a hardware token's user-presence check is the only brake against same-uid malware requesting signatures. Secrets should be kept outside the agent's uid where possible (broker/approval/TPM-unseal-on-demand); encryption at rest protects disk theft only and must be honestly labeled as such.",
+  "evidence_for": [
+   "NIST SP 800-57 (A3-1): TCB argument",
+   "arm-1 key-custody matrix (A1-13/14/15/16): plaintext/keyring/systemd-creds/TPM all fail same-uid malware",
+   "systemd-creds(1) FULL_TEXT: unsealed credential materialized 0400 in ramfs for the unit's own user"
+  ],
+  "evidence_against": [
+   "practical constraints limit ideal key custody on a desktop"
+  ],
+  "limitations": "Desktop context limits available hardware; no HSM assumed.",
+  "rune_evidence": "01_inward I: auth.json 0600+ACL; arm-1 verified /proc/pid/environ exposure (Yama does not block PTRACE_MODE_READ)",
+  "transfer_assumptions": "secret values are never inlined in research artifacts",
+  "threat_model": "same-uid malware; root; disk theft",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security; #405 hardware",
+  "architecture_impact": "secrets kept outside agent uid; encryption labeled honestly",
+  "experiment": "E27 secret leakage canary",
+  "falsifier": "a same-uid process is shown unable to read a secret the architecture claims protected",
+  "kill_criterion": "key-custody overhead exceeds the actual secret value"
+ },
+ {
+  "id": "AA-R1-C008",
+  "claim": "DELETION/ERASURE: TOMBSTONE (deletion fact/identifier/provenance) is distinct from DELETED PAYLOAD (content that may need actual removal). Crypto-erase (NIST SP 800-88 Rev.2) is the only practical primitive under SSD wear-leveling and journaling. Deletion must propagate to derived data (embeddings, caches, summaries) on a best-effort basis. Privacy-vs-provenance tension is real: erasure (GDPR Art. 17) vs accountability (Art. 5(2)) is unresolved; provenance fields on tombstones may leak deleted content. Tombstone visibility vs erasure is #401's cross-flag to this domain.",
+  "evidence_for": [
+   "NIST SP 800-88 Rev.2 (A3-24): crypto-erase as the practical primitive under wear-leveling",
+   "GDPR Art. 17 + Art. 5(2) (normative, A3-24)",
+   "adversarial AU/W/X pass; #401 cross-flag on provenance display leaking deleted content",
+   "inward B2: delete_entry is a hard delete with NO tombstone today"
+  ],
+  "evidence_against": [
+   "no agent-memory-specific deletion-semantics research surfaced (gap)",
+   "deletion propagation across derived data is best-effort and incomplete"
+  ],
+  "limitations": "Erasure in practice = crypto-erase of envelope + accepted remanence in backups/snapshots + best-effort derived-data deletion; full erasure is impossible with retained audit trails.",
+  "rune_evidence": "01_inward B2: hard delete, no tombstone, no audit",
+  "transfer_assumptions": "deletion reason and scope are recorded without leaking content",
+  "threat_model": "unauthorized data retention; accidental deletion; privacy-compliance erasure requests",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #396 + #401",
+  "architecture_impact": "tombstone + payload distinction; crypto-erase; derived-data best-effort deletion",
+  "experiment": "E12 deletion propagation",
+  "falsifier": "UI claims erased while payload remains reachable, or deletion destroys required evidence",
+  "kill_criterion": "tombstone overhead exceeds privacy value"
+ },
+ {
+  "id": "AA-R1-C009",
+  "claim": "AUTHORIZATION / REFERENCE MONITOR: the deterministic authorize() function is the ONLY disposition authority at the single choke point. Model reasoning may explain/propose/interpret ambiguity but is NEVER the final authorization authority. ACTOR/RESOURCE/SCOPES matrix produced (synthesis matrix B). Least-privilege per action (security-scoped capabilities). No ambient authority by default.",
+  "evidence_for": [
+   "Anderson 1972 (A1-8): reference monitor three guarantees",
+   "arm-1 transfer P1/P5: pure authorize() choke point + least authority per call",
+   "confused deputy (Hardy A1-7): ambient authority misuse",
+   "inward: no authorization exists; tools have ambient authority",
+   "Design Patterns 2506.08837: capability-scoped tool calls"
+  ],
+  "evidence_against": [
+   "policy-discipline-only at same uid; complete mediation fails",
+   "ABAC-lite overhead per call"
+  ],
+  "limitations": "In-process monitor is not tamperproof; real enforcement requires OS-level MAC/namespace.",
+  "rune_evidence": "01_inward J: no authorization, no sandboxing, ambient tool permissions",
+  "transfer_assumptions": "authorize() is implementable as a pure function with no I/O",
+  "threat_model": "model-generated proposals; worker proposals; confused deputy",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + tool layer",
+  "architecture_impact": "authorize() choke point; least privilege per action",
+  "experiment": "E14 tool capability escalation",
+  "falsifier": "model output shown to directly mutate canonical state through an unauthorized path",
+  "kill_criterion": "authorize() overhead blocks all useful operations"
+ },
+ {
+  "id": "AA-R1-C010",
+  "claim": "DETECTION DISCIPLINE: deterministic violation (invalid signature, stale authority generation, replay counter violation, policy mismatch, modified manifest, unauthorized capability request) MAY auto-contain where evidence directly proves the violation. ANOMALY becomes SUSPECTED only — never auto-elevated to CONFIRMED_COMPROMISE without corroboration. Typed security states (NORMAL/SUSPECTED/CONFIRMED/CONTAINED/RECOVERING/CLEARED/UNKNOWN/DEGRADED/QUARANTINED). ANOMALY ≠ COMPROMISE. No alerts ≠ secure. FPR-first design (Axelsson base-rate fallacy). Detector output carries provenance, confidence basis, freshness, scope, evidence.",
+  "evidence_for": [
+   "Axelsson 2000 (A3-8): base-rate fallacy — 1% FPR overwhelms TP",
+   "Denning 1987 (A3-7): IDS profile/anomaly taxonomy",
+   "ClawSentry 2608.21101: 4-locus progressive monitoring; ASR 39.55%→2.61% with utility ~83.8%",
+   "adversarial DA-DE pass (anomaly ≠ compromise, FPR-first)",
+   "adversarial DA/DG pass (no alert ≠ secure)"
+  ],
+  "evidence_against": [
+   "FPR calibration data is thin (no agent-specific IDS benchmarks found)"
+  ],
+  "limitations": "Detection is research-only; no IDS is deployed; the design is a falsifiable model, not a measurement.",
+  "rune_evidence": "01_inward: no compromise detection, no security state, no IDS",
+  "transfer_assumptions": "security events are loggable without leaking secrets",
+  "threat_model": "persistent injection; memory poisoning; unauthorized access; DoS; compromised worker",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #400 metacognition",
+  "architecture_impact": "typed states; FPR-first; deterministic-vs-anomaly split",
+  "experiment": "E15 alert fatigue; E24 attack-vs-FP",
+  "falsifier": "anomaly consistently elevates to CONFIRMED without corroboration, or FPR makes the system unusable",
+  "kill_criterion": "detection overhead exceeds the threats actually encountered"
+ },
+ {
+  "id": "AA-R1-C011",
+  "claim": "PROVIDER BOUNDARY: provider access ends at the explicitly authorized interface. PROVIDER ACCESS ENDS AT THE EXPLICITLY AUTHORIZED INTERFACE — a provider must not gain implicit access to filesystem, canonical Memory, private files, other providers, credentials, tools, task authority, persona, identity, or Substrate control merely because Rune queried its model. LEAST-CONTEXT DISCLOSURE: minimum necessary fields sent; disclosure record kept (provider/model/categories/why/sensitivity/time). Destination allow-lists and capability splits are the only empirically demonstrated near-zero exfiltration defenses. Model output = UNTRUSTED SEMANTIC PROPOSAL until independently verified or specifically authorized.",
+  "evidence_for": [
+   "Framing Gap 2608.27092 (A3-17): destination allow-lists close 0%→100% exfil attacks; model-side recognition fails",
+   "FLOWSEAL 2609.14003 (A1-20): tool-level interceptor; leak 52.2%→0.5%",
+   "Claw in Plain Sight 2608.20658 (A3-14): 20.8-75.0% policy-violating disclosure across pressure/policy levels",
+   "CaMeL 2503.18813 (A1-18): capability labels enforced at tool calls",
+   "Greshake 2302.12173 (A2-1): indirect injection as arbitrary code execution"
+  ],
+  "evidence_against": [
+   "least-context reduces model utility (a real trade-off)",
+   "no provider discloses retention terms honestly"
+  ],
+  "limitations": "Provider-side behavior is outside Rune's control; retention terms are not verifiable at run time.",
+  "rune_evidence": "01_inward I: auth.json 0600+ACL; no per-call disclosure record exists",
+  "transfer_assumptions": "per-call field selection is implementable",
+  "threat_model": "prompt-injection exfiltration; compromised provider; data-retention policy changes; malicious provider",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + provider routing",
+  "architecture_impact": "least-context disclosure; destination allow-lists; provider as external principal",
+  "experiment": "E32 provider least-context test; E33 provider authority test; E38 provider data-boundary test",
+  "falsifier": "provider response shown to carry filesystem/Memory/tool authority, or a full-context send is shown unavoidable for correct operation",
+  "kill_criterion": "least-context filtering degrades model quality beyond acceptable threshold"
+ },
+ {
+  "id": "AA-R1-C012",
+  "claim": "WORKER/DISTRIBUTED AUTHORITY: workers provide evidence and proposals but NEVER inherit Main Rune authority automatically. Fencing tokens (strictly monotonic counter checked by the storage server, rejecting regressions) govern stale-write rejection. Authority generations prevent stale workers from writing after authority changed. Per-agent proof-of-possession keys + chained delegation assertions. Protocol participation, worker name, PID, or old credential alone grants nothing.",
+  "evidence_for": [
+   "Kleppmann 2016 (A3-2): fencing tokens; leases cannot be made safe by re-checking expiry",
+   "A-JWT 2509.13597 (A3-19): per-agent PoP keys + chained delegation + one-way identity hashes",
+   "Multi-agent boundary verification 2608.00718 (A3-20): pipelines lack boundary verification; attack success tracks pipeline STRUCTURE not model capability",
+   "inward K: no worker identity/auth/fencing implemented; workers inherit ambient authority",
+   "adversarial AE/AF/AG pass; EA-EE/EC/ED pass"
+  ],
+  "evidence_against": [
+   "fencing adds storage-side validation overhead",
+   "no worker authority system is implemented"
+  ],
+  "limitations": "At same uid, fencing is policy discipline (worker can edit the store directly).",
+  "rune_evidence": "01_inward K: no worker identity/auth/fencing exists",
+  "transfer_assumptions": "actor registry and generation counters are implementable",
+  "threat_model": "stale worker; compromised worker; worker impersonation; replayed results",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #395 distributed",
+  "architecture_impact": "fencing tokens; authority generations; per-agent PoP keys",
+  "experiment": "E9 stale worker/replay; E30 stale agent rejoin",
+  "falsifier": "stale authority accepted by the store, or worker identity shown to inherit Main authority",
+  "kill_criterion": "fencing overhead exceeds the stale-write risk"
+ },
+ {
+  "id": "AA-R1-C013",
+  "claim": "SUBSTRATE SECURITY AWARENESS: the Substrate maintains a DERIVED (inspectable, reconstructable, non-canonical) operational security view containing: authorized actors present, actor identity/type/generation, capabilities granted, resource scopes, active sessions/workers/connections, unexpected connections, failed authorization attempts, unexpected state mutations, sensitive-data accesses, unusual outbound transfers, security-policy version, quarantine state, credential health, manifest/integrity state, containment status. This view is NOT a new canonical security database, NOT a truth oracle, NOT a self-generated attack narrative. Protocol fluency, worker name, PID, or old credential alone grant nothing. An unauthorized agent that discovers Rune services gains zero authority without explicit authorization.",
+  "evidence_for": [
+   "mandate §40/§41/§42 (expanded scope)",
+   "inward F: no Substrate security state exists",
+   "adversarial EQ/ER/ES/ET/EU pass (security state ≠ persona, ≠ canonical, ≠ emotion)",
+   "arm-1 P6: dedicated uid + SO_PEERCRED is the real boundary",
+   "agent libOS 2606.03895 (A3-18): 3-plane design (operation admission/IFC admission/durable evidence)"
+  ],
+  "evidence_against": [
+   "no Substrate security state is implemented; the view is designed only",
+   "the view itself could be spoofed if the attacker controls the same-uid process"
+  ],
+  "limitations": "The view is derived; it can be stale or incomplete; it must not become autobiography.",
+  "rune_evidence": "01_inward F: cognitive_state.json is a dormant fossil with no security content",
+  "transfer_assumptions": "Substrate has an event/coordination layer to derive state from",
+  "threat_model": "unauthorized agent joining runtime; rogue worker; impersonation; persistence",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + Substrate",
+  "architecture_impact": "authorized-actor view; rogue-agent fixture; security-state model",
+  "experiment": "E29 rogue agent join attempt; E30 stale agent rejoin; E39 security-state spoof",
+  "falsifier": "protocol fluency shown to grant authority, or the security view shown to become canonical",
+  "kill_criterion": "security-view maintenance cost exceeds its detection value"
+ },
+ {
+  "id": "AA-R1-C014",
+  "claim": "SAFE RENDERING + INPUT VALIDATION: stored hostile text (terminal escape sequences, Rich markup, Markdown, Unicode confusables, control characters) must be rendered safely — escape-by-default in the TUI (RichLog markup=True is a live attack surface), non-color encodings for security metadata, no automatic external-resource loading, link handling with user confirmation, code-block copy with explicit intent. Untrusted content must remain storable, searchable, retrievable, and displayable without becoming executable in TUI, GUI, shell, Markdown renderer, control prompt, or tools.",
+  "evidence_for": [
+   "inward O: RichLog(markup=True) renders memory text as markup — live attack surface",
+   "adversarial BG SUCCEEDS (no safe-rendering clause existed)",
+   "Greshake 2302.12173 (A2-1): indirect injection channels include hidden text and metadata",
+   "MCPTox (A2-11): tool descriptions are injection vectors",
+   "WCAG 2.2 1.4.1 (non-color encoding) carried from #401"
+  ],
+  "evidence_against": [
+   "no specific TUI escape-injection exploit was tested (research-only)"
+  ],
+  "limitations": "Research-only boundary prevents live testing; the design is falsifiable via E13 rendering audit.",
+  "rune_evidence": "01_inward O: RichLog markup=True; no sanitization observed",
+  "transfer_assumptions": "Textual widgets can render escaped content",
+  "threat_model": "stored XSS in TUI; terminal escape injection; malicious links; hostile Markdown",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security + #401 rendering",
+  "architecture_impact": "escape-by-default; safe rendering rules; content isolation",
+  "experiment": "E13 provenance error detection + rendering audit",
+  "falsifier": "hostile markup/escape shown to execute in the TUI or alter UI state",
+  "kill_criterion": "safe rendering breaks the TUI's core display function"
+ },
+ {
+  "id": "AA-R1-C015",
+  "claim": "SCOPE HONESTY: Rune CANNOT defend against root/kernel/firmware/physical-hardware-implant/provider-internal/side-channel attacks. Bounded security > fake omniscience. Every security claim must state its adversary assumptions. In-process enforcement is POLICY DISCIPLINE, not boundary — it survives model/prompt compromise only, not process compromise. The genuine process-compromise boundaries (kernel MAC/namespaces, uid separation, external monotonic floor, different-uid audit sink) are the only things that survive process compromise, and NONE of them are implemented today. All 41 experiment families are DESIGN_INVARIANT (the research-only boundary makes RUNE_DIRECT measurement impossible without violating it).",
+  "evidence_for": [
+   "arm-1 transfer failures (10 items): label authority, tamperproof monitor, trusted subjects, lattice-over-subjects, capability unforgeability, mandatory policy, cryptographic accountability, secret confidentiality, enterprise audit framing, firewall-as-authorization",
+   "adversarial F3 SUCCEEDS (enforcement point run by the entity it polices)",
+   "adversarial F8 SUCCEEDS (experiments unrunnable under research-only boundary)",
+   "adversarial CP/CQ/CR/CS pass",
+   "NIST SP 800-57 (A3-1): TCB argument"
+  ],
+  "evidence_against": [
+   "honest scope may be used to defer everything (adversarial F7 PARTIAL) — mitigated by the migration+quota story and the ranked must-fix/admitted-limitation ledger"
+  ],
+  "limitations": "Bounded scope is honest but is not a defense; it is a prerequisite for real defense.",
+  "rune_evidence": "01_inward: 8 ABSENT mechanisms; 3 BYPASS paths; no security state",
+  "transfer_assumptions": "the security state model (C010) is implemented before any defense claim is made",
+  "threat_model": "root; kernel; firmware; provider-internal; side-channel (all OUT of T1 scope)",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "Security (scope definition)",
+  "architecture_impact": "bounded security; honest adversary assumptions; DESIGN_INVARIANT grading",
+  "experiment": "E20 security recovery",
+  "falsifier": "a security mechanism is claimed to survive process compromise when it cannot",
+  "kill_criterion": "scope honesty becomes a deferral engine (adversarial F7)"
+ }
+]

research/memory-atlas-r1/AA-security-memory-poisoning/evidence_saturation.md

@@ -0,0 +1,48 @@
+# #402 AA — Evidence Saturation (mandate §93)
+
+## Branch record
+
+| # | Branch | Saturated? |
+|---|---|---|
+| 1 | BLP/Biba/Clark-Wilson/capabilities/reference monitor | YES (arm-1) |
+| 2 | IFC/taint tracking / ABAC | YES (arm-1) |
+| 3 | Host security / same-user threats / secrets / ptrace / Yama | YES (arm-1) |
+| 4 | Network fundamentals / SO_PEERCRED / ufw | YES (arm-1) |
+| 5 | Audit / accountability foundations | YES (arm-1) |
+| 6 | Direct + indirect prompt injection | YES (arm-2) |
+| 7 | Instruction hierarchy / spotlighting / adaptive bypass | YES (arm-2) |
+| 8 | Injection benchmarks (AgentDojo/InjecAgent/ASB/AgentLAB) | YES (arm-2) |
+| 9 | Tool-use injection / MCP security | YES (arm-2) |
+| 10 | Persistent/sleeper injection / memory poisoning | YES (arm-2) |
+| 11 | RAG poisoning / retrieval manipulation | YES (arm-2) |
+| 12 | Source multiplication / Sybil / independence | YES (arm-2) |
+| 13 | Provenance laundering / TMA-NM | YES (arm-2) |
+| 14 | Dedupe / similarity-collapse risk | YES (arm-2) |
+| 15 | Crypto by property / anti-rollback | YES (arm-3) |
+| 16 | Key custody / TCB / TPM / FIDO2 | YES (arm-3) |
+| 17 | Authorization / reference monitor / policy engines | YES (arm-3) |
+| 18 | Worker / distributed authority / fencing | YES (arm-3) |
+| 19 | Privacy / least-context / exfiltration | YES (arm-3) |
+| 20 | Deletion / erasure / crypto-erase | YES (arm-3) |
+| 21 | Supply chain / model supply chain / xz | YES (arm-3) |
+| 22 | Compromise detection / FPR / base-rate fallacy | YES (arm-3) |
+| 23 | Security UX / approval fatigue | YES (arm-3) |
+| 24 | Standards (OWASP/MITRE ATLAS/NIST) | YES (arm-3) |
+| 25 | 2024-26 agent-security mechanisms | YES (arm-3) |
+
+## Late-search checks (typed outcomes)
+
+- "FIDO2/WebAuthn hardware-key-press as agent-action approval" → this R1 search found no direct published work in the searched sources as of 2026-09-22 (cs.CR empty-search check) — recorded as a gap, not a nonexistence claim.
+- "policy-as-code (OPA/Cedar) for LLM agents" → this R1 search found no direct arXiv-indexed 2025–26 work in the searched sources as of 2026-09-22 — GAP.
+- "agent approval-prompt habituation study" → this R1 search found no direct published evaluation in the searched sources as of 2026-09-22 — GAP.
+- "agent-memory deletion semantics" → this R1 search found no direct research paper in the searched sources as of 2026-09-22; platform docs only — GAP.
+- "signed model releases" → this R1 search found no direct evidence of a widely deployed standard in the searched sources as of 2026-09-22 — GAP.
+- "Pyshield" as a Python taint framework → could not verify existence — do not cite.
+- "Trust No Bot" / "SPA 0-0.2% ASR" → no matching source found in searched sources as of 2026-09-22.
+- "CAPTURE 24.7% ASR" → this R1 search could not verify the figure in the searched sources as of 2026-09-22; likely conflation with 2606.30566's benign FPR — do not inherit.
+
+## Verdict
+
+**SEARCH_SATURATION = REACHED** — late searches stopped producing new architecture-changing mechanisms; 8 typed gaps recorded as bounded-search findings.
+
+**LOAD_BEARING_DEPTH = PASS (re-earned 2026-09-22 after the evidence-depth repair)** — every architecture-changing ADOPT claim maps through load_bearing_evidence.md to DEEP_EXTERNAL (FULL_PAPER/RELEVANT_SECTIONS anchors), RUNE_DIRECT (inward facts), or DESIGN_INVARIANT (explicit policy discipline). The #401 HYPOTHESIS rule is carried: no ADOPT rests on HYPOTHESIS alone. The original-seal PASS was NOT carried over: documentation rows mislabeled FULL_PAPER were corrected to DOCUMENTATION_AUDITED, shallow-DEEP_EXTERNAL support was repaired (C003 DEEP_EXTERNAL removed; C010/C011 deepened to FULL_PAPER via the bounded top-up actor; C006 kept as DESIGN_INVARIANT; C012 practitioner evidence honestly labeled), the gate's semantic depth cross-check was hardened with negative controls NC-A/NC-B (CAUGHT) and NC-C/NC-D (PASS), and the depth map was re-audited row-by-row before this PASS was re-stated.

research/memory-atlas-r1/AA-security-memory-poisoning/load_bearing_evidence.md

@@ -0,0 +1,26 @@
+# #402 AA — Load-Bearing Evidence Map (mandate §92)
+
+| Claim | Architecture rule | Threat model | Rune inward evidence | External anchor(s) | Depth | Support type | Residual assumption | Falsifier |
+|---|---|---|---|---|---|---|---|---|
+| AA-R1-C001 | inward security facts | same-uid process; other-user; network; root (out of T1) | 01_inward A-O full inventory | — | — | RUNE_DIRECT | point-in-time | a live authorization/quarantine/integrity layer found |
+| AA-R1-C002 | content/control separation; enforce at sink | indirect prompt injection; tool-output injection | 01_inward: no authorization exists | CaMeL 2503.18813; FLOWSEAL 2609.14003; SPA 2608.27234; APPA 2607.24625; Nasr 2510.09023 (12 defenses >90% adaptive); Greshake 2302.12173; Design Patterns 2506.08837 | ABSTRACT/RELEVANT_SECTIONS | DESIGN_INVARIANT + DEEP_EXTERNAL | in-process = policy discipline; cognition steering below action threshold | untrusted content grants authority through the intended architecture |
+| AA-R1-C003 | proposal/authorization separation; deterministic authorize() | model-generated proposals; worker proposals; confused deputy | 01_inward B: no write auth exists | Clark-Wilson 1987 (A1-3); Anderson 1972 (A1-8); Hardy 1988 (A1-7) | METADATA/ABSTRACT | DESIGN_INVARIANT (A1-3 CW is METADATA depth) | choke point bypassable at same uid | model output shown to bypass authorize() |
+| AA-R1-C004 | write-time origin binding; taint JOIN; dedupe preserves provenance | provenance laundering; salami; dedupe corruption | 01_inward C: source is free-text mutable | TMA-NM 2606.24322 (A2-29 RELEVANT_SECTIONS); Epistemic Sybil 2609.01873 (A2-26 RELEVANT_SECTIONS); Salami 2608.01637 (A2-19 ABSTRACT_ONLY) | RELEVANT_SECTIONS | DEEP_EXTERNAL | bootstrapping problem for 941 legacy rows | laundered provenance passes through summarization/merge |
+| AA-R1-C005 | quarantine as first-class state | poisoned memory; suspect imports | 01_inward: no quarantine exists | noWorkflow/ProvBook (A3-27); adversarial F4 | ABSTRACT | DESIGN_INVARIANT | quarantine transitions need enforcement | quarantined content still affects application |
+| AA-R1-C006 | crypto by property | corruption; tampering; rollback; key theft | 01_inward: no crypto exists | Crosby & Wallach USENIX 2009 (A3-3); Schneier & Kelsey 1999 (A3-4 DOI corrected); TUF CCS 2010 (A3-5); Uptane IEEE VT 2018 (A3-6); NIST SP 800-57 (A3-1) — corroborating (metadata depth) | METADATA | DESIGN_INVARIANT | key custody is a precondition | mechanism fails to provide its selected property |
+| AA-R1-C007 | key custody honesty | same-uid malware; root | 01_inward I: auth.json + /proc environ exposure | arm-1 key-custody matrix (A1-13/14/15/16); NIST SP 800-57 (A3-1) | DOCUMENTATION_AUDITED/METADATA | DESIGN_INVARIANT + RUNE_DIRECT | | desktop limits available hardware | same-uid process unable to read a protected secret |
+| AA-R1-C008 | tombstone vs payload; crypto-erase | retention; accidental deletion; compliance | 01_inward B2: hard delete, no tombstone | NIST SP 800-88r2 (A3-24); GDPR Art 17/5(2) (normative) | METADATA | DESIGN_INVARIANT | derived-data deletion is best-effort | UI claims erased while payload is reachable |
+| AA-R1-C009 | authorization / reference monitor | model proposals; confused deputy | 01_inward J: ambient tool authority | Anderson 1972 (A1-8); Hardy 1988 (A1-7); Design Patterns (A3-10) | ABSTRACT/METADATA | DESIGN_INVARIANT | in-process = policy discipline | model output directly mutates canonical state |
+| AA-R1-C010 | detection discipline; FPR-first; typed states | persistent injection; poisoning; DoS | 01_inward: no IDS exists | Axelsson 2000 (A3-8 FULL_PAPER — bronze OA PDF read: P(I)=2e-5, FPR 1e-5 → detection rate 66%, FPR 1e-3 → ~2%); Denning 1987 (A3-7); ClawSentry 2608.21101 (A3-16) | FULL_PAPER/METADATA/ABSTRACT | DEEP_EXTERNAL (Axelsson) | FPR calibration data thin | anomaly elevates to CONFIRMED without corroboration |
+| AA-R1-C011 | provider boundary; least-context; destination allow-lists | prompt-injection exfil; compromised provider | 01_inward I: auth.json 0600; no per-call disclosure record | Framing Gap 2608.27092 (A3-17 FULL_PAPER — HTML full text read: 10 overt frames all 0% on gpt-4o; reframing 0%→100%; destination allow-list 0% by construction; planner/reader split 0% at 90% utility); FLOWSEAL (A1-20); CaMeL (A1-18); Claw 2608.20658 (A3-14) | FULL_PAPER/ABSTRACT | DEEP_EXTERNAL (A3-15) | utility trade-off unmeasured | provider response carries filesystem/Memory/tool authority |
+| AA-R1-C012 | worker fencing; authority generations | stale worker; impersonation; replay | 01_inward K: no fencing exists | Kleppmann 2016 (A3-2 DOCUMENTATION_AUDITED — fully read but practitioner); A-JWT 2509.13597 (A3-19); Bappy/Multi-agent boundary 2608.00718 (A3-20) | DOCUMENTATION_AUDITED/ABSTRACT | DESIGN_INVARIANT | same-uid fencing is policy discipline | stale authority accepted by the store |
+| AA-R1-C013 | Substrate security awareness; authorized-actor view | rogue agent; impersonation; persistence | 01_inward F: no security state exists | Agent libOS 2606.03895 (A3-18); mandate §40-42 | ABSTRACT | DESIGN_INVARIANT | view is derived; could be stale/incomplete | protocol fluency grants authority, or the view becomes canonical |
+| AA-R1-C014 | safe rendering; input validation | terminal escape; markup injection; hostile Markdown | 01_inward O: RichLog(markup=True) | Greshake 2302.12173 (A2-1); MCPTox (A2-11); WCAG 2.2 (carried from #401) | ABSTRACT/RELEVANT_SECTIONS | DESIGN_INVARIANT + RUNE_DIRECT | research-only prevents live testing | hostile markup executes in the TUI |
+| AA-R1-C015 | scope honesty; bounded security | root; kernel; firmware; provider-internal; side-channel | 01_inward: 8 ABSENT mechanisms; 3 BYPASS paths | arm-1 transfer failures (10 items); NIST SP 800-57 (A3-1) | METADATA/ABSTRACT | DESIGN_INVARIANT + RUNE_DIRECT | honest scope is not a defense; it is a prerequisite | a mechanism claimed to survive process compromise when it cannot |
+
+## Coverage verdict
+
+- ADOPT claims map to DEEP_EXTERNAL (C002/C004/C008/C010/C011 — where anchors are genuinely deep), RUNE_DIRECT (C001/C007/C011/C014/C015 — where the anchors are genuinely deep), RUNE_DIRECT (C001/C011/C014/C015 — where Rune's inward reality independently establishes the claim), or DESIGN_INVARIANT (C003/C005/C007/C009/C013/C014 — where the rule is an explicit policy discipline with corroborating external evidence).
+- No ADOPT claim rests on HYPOTHESIS support (the #401 gate rule is carried and enforced).
+- The three strongest deep anchors: TMA-NM (machine-checked theorem); Epistemic Sybil Resistance (>20,000 controlled agent calls); Axelsson (foundational FPR-first IDS design).
+- Honest depth statement: zero FULL_PAPER for the injection/poisoning arms (2025-26 preprints are abstract-verified); the classical security texts are paywalled/DTIC-only; the deepest reads are kernel docs (FULL_TEXT ×6) and TMA-NM/2609.01873 (RELEVANT_SECTIONS).

research/memory-atlas-r1/AA-security-memory-poisoning/mutation_audit.md

@@ -0,0 +1,50 @@
+# #402 AA — FINAL SEMANTIC CONSISTENCY MUTATION AUDIT (2026-09-22)
+
+STATUS: CONTENT-FREEZE AUDIT — final-state declaration; this file is the ACTUAL LAST write. Supersedes the audits sealed at `eef6ae4`, `8564009`, `8fb0907`, `c2dc640`, and `e386ccd`. After this write, NO file is modified; only read-only gates, git transport, and Gitea receipts follow.
+
+## Base seal accepted
+
+The substantive state of **`e386ccd` is ACCEPTED in full**: all #402 research, security architecture, source ledger and mapping (83 rows / 79 unique, zero duplicate IDs, 106 depth labels; A3-16 = ClawSentry · A3-17 = Framing Gap · A3-27 = noWorkflow/ProvBook), evidence depth, load-bearing depth (PASS), claims and classifications (15 ADOPT; 1 RUNE_PROVEN / 14 RUNE_APPLICABLE), innovation arithmetic (25 = 22/3/0), reconciliations (R0 4C/1R; prelim 6C/2R), post-freeze Memory accounting (receipt 192685; post-8564009 entry 194015 / receipt 1515 / prior 193729 / sim 0.80 — OBSERVED evidence, NOT repaired; derived fact-9293), gate design, negative-control evidence, and the true-freeze state machine. **No research reopened; no sources added; no claims changed; no classifications changed; no counts changed.**
+
+## Exactly two live-master semantic corrections (+ one instance of the same family)
+
+1. **§40 unbounded external zero-hit (line 174):** "no 2024-26 agent-memory paper applies them with provenance preservation — the mechanism is the gap" → "**this R1 search found no direct 2024–2026 agent-memory paper applying them with provenance preservation in the searched sources as of 2026-09-22 — the mechanism remains a bounded research gap.**" Search-bounded scope, date, and searched-source limitation preserved; no novelty claim; no nonexistence claim. The same sentence's "no report-only aggregator" quote is SOURCE-ATTRIBUTED (Epistemic Sybil Resistance 2609.01873's own result) and was correctly left direct.
+2. **Executive exfiltration "only" overstatement (line 10):** "destination allow-lists (the only empirically demonstrated near-zero exfiltration defense …)" contradicted §19/Matrix L+X's own report that planner/reader capability splits also reach 0%. → Scoped to the evaluated study and BOTH mechanisms: "Framing Gap reports destination allow-lists — 0% by construction when destinations are closed — and planner/reader capability splits reducing the evaluated exfiltration attacks to 0% in its synthetic setup at 90% task utility, while model-side recognition fails 0%→100% under reframing; synthetic-lab scope, not a universal prevention claim." No universal prevention, no production-proof claim, no uniqueness claim.
+3. **Same-family instance caught by the §7 sweep (03_applicability.md row 9):** carried the identical "the only empirically demonstrated near-zero exfiltration defense" phrasing → scoped identically to the evaluated study and both mechanisms. Verdict class unchanged (row 9 remains ADOPT; applicability 50 = 19/1/2/3/24/1 verified unchanged).
+4. **Gap-row governance defect caught by the new OPTION 1 check itself (evidence_saturation.md line 42):** the "CAPTURE 24.7% ASR" do-not-inherit row lacked bounded semantics ("not verified" alone) → bounded to "this R1 search could not verify the figure in the searched sources as of 2026-09-22; likely conflation with 2606.30566's benign FPR — do not inherit". The row-governance check demonstrated its value on its first live run. This mutation occurred after an intermediate audit write; per the freeze-stale rule this audit was rewritten LAST afterward — the loop worked as designed, and this file remains the actual last write. carried the identical "the only empirically demonstrated near-zero exfiltration defense" phrasing → scoped identically to the evaluated study and both mechanisms. Verdict class unchanged (row 9 remains ADOPT; applicability 50 = 19/1/2/3/24/1 verified unchanged).
+
+## Full live-master semantic sweep (mandate §7 — read-only, classification recorded)
+
+Every remaining absence/uniqueness hit classified: **OBSERVED_RUNE_FACT** (executive "trusted local user, no enforcement layer"; "no authorization layer"; "no origin field, no channel binding"; "same-uid process = full authority" — inward-audit facts, remain direct) · **SOURCE_ATTRIBUTED_CLAIM** (Epistemic Sybil "no report-only aggregator" quote; Kleppmann fencing quote; OWASP "unclear if there are fool-proof methods"; Greshake "synthetic apps only" — sources' own scoped results, remain direct) · ordinary non-absence usage (matrix descriptions, non-equality chain, accounting zeros, experiment kill conditions, "none claimed as standalone in this domain's claim ledger" — self-referential accounting, not literature). **No remaining epistemic overclaim found.** No style edits.
+
+## Zero-hit gate root cause — structural, per mandate §4 (OPTION 1 + OPTION 3)
+
+Root cause: the escaped sentence used neither "found", "exists", nor "none" — the phrase-oriented backstop could not see it. Two-part structural fix:
+- **OPTION 1 (typed row governance):** NEW `check_zero_hit_row_governance` — the Gap ledger rows in evidence_saturation.md are the AUTHORITATIVE zero-hit records; every external-search gap row must itself carry bounded-search semantics ("this R1 search" / "searched sources" / "could not verify" / "no direct" / empty-search markers). An unbounded zero-hit row is now a canonical-source defect, not merely a prose defect.
+- **OPTION 3 (backstop extension):** the phrase detector gained the escaped family — "no … paper applies/applied/application" — as a defensive guard, explicitly NOT treated as proof that every English formulation is covered. OPTION 2 (a new ZERO_HIT marker subsystem) was NOT needed: the existing Gap rows already identify search-negative findings, so no new canonical subsystem was created. No LLM judge, no NLP parser, no phrase dictionary explosion.
+
+## Negative control — BEFORE freeze only (mandate §6)
+
+**NC-K** (one family, run and restored byte-identically): inserting the exact escaped unbounded form "no 2024-26 agent-memory paper applies this mechanism." into the master → **GATE FAIL (CAUGHT)**; inserting the bounded equivalent ("this R1 search found no direct 2024–2026 agent-memory paper applying this mechanism in the searched sources as of 2026-09-22") → **not flagged (PASS)**. Restore verified byte-identical by the control's own assert. **No negative control after the freeze.**
+
+5. **Cross-domain regression repairs (Y, Z — each domain's own audit kept as its last write):** the new row-governance check, applied via the existing Y/Z regression gates, surfaced older-regime Gap rows: Y evidence_saturation lines 36–43 (six "0 hits"/"unverifiable rumor" rows → bounded "this R1 search found no direct match / could not verify in the searched sources as of 2026-09-21/22"; Y counts verified unchanged — applicability 52, claims 16 = 12/4, elevels 1/11/3/1) with two dated addenda appended to Y's mutation_audit.md; Z evidence_saturation line 42 ("no threshold in literature" → bounded) with one addendum appended to Z's mutation_audit.md. Wording-only in every case; no verdict, count, or conclusion changed in either domain. X and W required no repairs (historical ledgers carry no Gap-row blocks).
+
+## Counts preserved (verified unchanged)
+
+Applicability 50 (19/1/2/3/24/1 — mechanically re-derived from rows post-edit) · Qualification 94 (82/4/1/5/2) · Adversarial 170 (30/30/110) · R0 5 (4C/1R) · Preliminary 8 (6C/2R) · Claims 15 all ADOPT (1/14) · Innovation 25 (22/3/0) · Sources 83 rows / 79 unique / 106 labels · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS. sources.md untouched. Pre-freeze sweep of all live artifacts for unbounded zero-hit forms: NONE remaining.
+
+## Memory / derived state
+
+**CANONICAL_MEMORY_WRITE = 0. DERIVED_MEMORY_WRITE = 0.** Observed history preserved untouched (192685; 194015/1515/193729/0.80; fact-9293). No cleanup write performed.
+
+## Process truth
+
+Original #402 process truth PRESERVED (CONTINUOUS_EXECUTION = PASS; zero user continues; MAX_CONCURRENT_SUBAGENTS = 1; four serial research actors). This reseal: **FINAL_SEMANTIC_RESEAL_CONTINUOUS_EXECUTION = PASS** — controller-only, MAX_CONCURRENT_SUBAGENTS = 0, no research actor, zero user interventions.
+
+## Post-freeze protocol (governing)
+
+After this audit: ALLOWED = read-only gates (AA/Z/Y/X/W R1_FULL), git status/diff/hash, `git show`, the ONE seal commit, push origin + gitea, mirror verification, Gitea receipts, read-only file opening, final natural-language response. FORBIDDEN = negative controls, temporary tracked-file edits, master/source/audit/registry/tooling edits, session notes, canonical or derived Memory writes, consolidation, tidying. If ANY forbidden write occurs: **FREEZE_STALE = TRUE automatically** — reseal only via a genuinely NEW final audit written LAST. Nothing durable follows the seal.
+
+## Freeze declaration
+
+All mutations (2 master corrections + applicability row 9 + saturation line 42 + gate structural fix + Y/Z cross-domain regression wording) and NC-K are complete BEFORE this audit. **This audit is the ACTUAL LAST write.** Sequence: FINAL_CONTENT_GATE (read-only) → ONE seal commit → push/mirror/verify → corrected Gitea #402 + #375 receipts → STOP. STOP MEANS STOP.

research/memory-atlas-r1/AA-security-memory-poisoning/preliminary_reconciliation.md

@@ -0,0 +1,16 @@
+# #402 AA — Batched Preliminary Reconciliation (mandate §89)
+
+The batched artifact (`AA_SECURITY_MEMORY_POISONING_R1_MASTER.md`, 16 lines, sha256 97a4c051…79f4581) is preserved BYTE-FOR-BYTE as `AA_SECURITY_MEMORY_POISONING_R1_BATCHED_PRELIMINARY.md` (hash-verified identical copy; original untouched). Each conclusion re-evaluated — not ratified. Quoted batched wording is HISTORICAL where superseded below.
+
+| Row | Preliminary conclusion | Verdict | Basis |
+|---|---|---|---|
+| P-1 | TMA-NM (2606.24322) is the design law — content/lineage-based trust launderable; trust bound at write time from input channel | CONFIRMED | TMA-NM machine-checked theorem verified (T1/T2/T3); three laundering channels (summarisation/trusted-tool echo/manufactured corroboration); existing defenses up to 68% ASR |
+| P-2 | MemCollusion (2608.01637) proves per-record trust scoring unsound — taint must propagate to derived records | CONFIRMED | Salami Attack verified; 75% ASR surviving dilution + memory-level defenses; per-record scoring unsound; taint propagation required |
+| P-3 | Attack landscape: AgentPoison >80%/<0.1%; PoisonedRAG 90% from 5 texts in 1M; MPBench systematic; MemCollusion 81.3%/75%; eTAMP environmental-observation-only; Sleeper 60-89% dormant | REFINED | AgentPoison + PoisonedRAG + MPBench confirmed; eTAMP ID supplied (2604.02623); Sleeper 60-89% RE-ATTRIBUTED to 2605.15338 (not Hubinger); MemCollusion TITLE CORRECTED; "Tool Poisoning 2503.15478" WRONG ID (SWEET-RL); "CAPTURE 24.7%" UNVERIFIABLE (likely conflated with 2606.30566's FPR); "Trust No Bot" and "SPA 0-0.2%" NOT FOUND |
+| P-4 | Defenses: TMA-NM origin binding (provable); CaMeL control/data-flow separation; trust-aware retrieval temporal decay (but thresholds brittle); forensic trajectory detection (AUC 0.99 but 25-53% benign FPR); GRAB-RAG sufficiency ≠ source trust | CONFIRMED | All confirmed + deepened: CaMeL 77%/84%; FLOWSEAL 52.2%→0.5%; SPA 0%/0.2%; APPA zero attacks in 1,320 episodes; trajectory detector 100% FP conditional on recall_before_send=1 (FPR-first discipline added) |
+| P-5 | Design invariants: channel-bound trust; elevation only via human review or Sybil-resistant corroboration; taint propagation; time-bounded re-verification; quarantine as visible state | CONFIRMED | All five confirmed and deepened; Sybil-resistant elevation now has direct evidence (Epistemic Sybil Resistance 2609.01873: report multiplicity collapses coverage 0.940→0.263); quarantine + taint propagating through derivation are now supported by both TMA-NM and 2609.01873 |
+| P-6 | SQLite transfer: origin_channel, trust_level (write-time bound), taint set, quarantined_at, supersession/rollback rows | REFINED | Schema-level transfer confirmed in principle; but the batched artifact did NOT account for: (a) the bootstrapping problem (941 legacy rows without provenance — adversarial F5); (b) the HYPOTHESIS→ADOPT gate rule from #401 (now carried forward); (c) the policy-discipline-vs-boundary distinction (adversarial F3); (d) the enforcement-gap: none of these fields exist in the live schema |
+| P-7 | Classification: ADOPT (TMA-NM origin binding, CaMeL separation, taint propagation, quarantine-as-state); EXPERIMENT (temporal decay trust, forensic trajectory detection); REJECT (per-record trust scoring, sufficiency-based abstention for security) | CONFIRMED | All confirmed; widened by the deep evidence: destination allow-lists added to ADOPT (Framing Gap 0%→100% closed by allow-lists); "forensic trajectory detection" REJECT→EXPERIMENT (the 100% conditional FP makes it a gate not a block) |
+| P-8 | R0: CONFIRMED 3 · REFINED 2 · OVERTURNED 0 · Sum 5 | CONFIRMED | Deep run yields 4C/1R (upgrade on R0-1/R0-3 exact numbers) — upgrades, no reversals |
+
+Row-derived: CONFIRMED 6 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 · Sum 8.

research/memory-atlas-r1/AA-security-memory-poisoning/r0_reconciliation.md

@@ -0,0 +1,13 @@
+# #402 AA — R0 Reconciliation (mandate §88)
+
+R0 baseline: `research/memory-atlas/families/metamemory_security.md` §AA (reconnaissance, not authority). Deep R1 evidence re-evaluates every claim one-to-one. Row-derived totals machine-counted.
+
+| Row | R0 claim (family file) | Verdict | Basis |
+|---|---|---|---|
+| R0-1 | Backdoor retrieval poisoning: AgentPoison >80% ASR, <1% poison rate, no retraining | CONFIRMED | AgentPoison arXiv:2407.12784 NeurIPS 2024 verified: ≥80% avg ASR, ≤1% benign degradation, <0.1% poison rate (precise pair: 82% retrieval / 63% e2e); transfers across embedders |
+| R0-2 | Indirect write-path injection: Sleeper poisoning 60-89% action success; MPBench systematic taxonomy; aggressive agents more exploitable; PipePoison survives 8 defenses; MINJA >95% idealized | REFINED | Sleeper 60-89% corrected: arXiv:2605.15338 "Hidden in Memory" (NOT Hubinger 2401.05566), conditioned on successful retrieval (write rates 99.8%/95%); MPBench 2606.04329 CORRECT (4 channels, 9 vulnerabilities); PipePoison 2609.00523 (not re-verified); MINJA 2503.03704 >95%/70% idealized confirmed. InjecMEM 2608.23471 supplied |
+| R0-3 | Compositional "salami": individually benign fragments jointly harmful — 75% ASR, survives dilution and defenses | CONFIRMED | Salami/MemCollusion 2608.01637 verified (TITLE CORRECTED: framework name is MemCollusion, paper title is "Salami Attack…"); 81.3% save rate / 75.0% ASR; per-record trust scoring unsound |
+| R0-4 | Trust laundering: TMA-NM 2606.24322 — no content/lineage defense sound under laundering; origin binding + Sybil-resistant corroboration = 0% ASR | CONFIRMED | TMA-NM machine-checked theorem T1/T2/T3 verified; existing defenses up to 68% laundering ASR; TMA-NM 0% ASR at full utility; caveat: machine-checked artifact is the MODEL, not the implementation |
+| R0-5 | Long-horizon amplification: single-turn defenses fail multi-turn (AgentDojo 2406.13352; AgentLAB 2602.16901) | CONFIRMED | AgentDojo authors' own warning confirmed; AgentLAB: first long-horizon adaptive benchmark incl. MEMORY POISONING — "defenses designed for single-turn interactions fail to reliably mitigate long-horizon threats" |
+
+Row-derived: CONFIRMED 4 · REFINED 1 · OVERTURNED 0 · STILL_UNKNOWN 0 · Sum 5.

research/memory-atlas-r1/AA-security-memory-poisoning/reconciliation_arithmetic_check.txt

@@ -0,0 +1,16 @@
+#402 AA — reconciliation_arithmetic_check (MACHINE-GENERATED from canonical rows; closeout 2026-09-22)
+
+applicability: 50 rows — ADOPT 19 · ADAPT 1 · EXPERIMENT 2 · FUTURE 3 · REJECT 24 · PARK 1 — Sum 50
+qualification: 94 rows — ADOPT 82 · ADAPT 4 · FUTURE 1 · REJECT 5 · PARK 2 — Sum 94
+r0: 5 rows — CONFIRMED 4 · REFINED 1 — Sum 5
+preliminary: 8 rows — CONFIRMED 6 · REFINED 2 — Sum 8
+adversarial: 170 rows — SUCCEEDS 30 · PARTIAL 30 · FAILS 110 — Sum 170 (arm-4 fresh-context; mandated A-EZ + fresh F1-F12)
+claims: 15 rows — ADOPT 15 — Sum 15
+evidence levels: RUNE_PROVEN 1 · RUNE_APPLICABLE 14 — Sum 15
+source ledger: 83 rows — 79 unique (4 cross-arm identity duplicates counted once)
+source depth labels (machine-derived): FULL_PAPER 2 · RELEVANT_SECTIONS 9 · ABSTRACT_ONLY 41 · METADATA_VERIFIED 39 · DOCUMENTATION_AUDITED 9 · CODE_AUDITED 1 · UNVERIFIED 5 — label total 106 across 83 rows.
+
+FINAL CLOSEOUT ADDENDUM (2026-09-22, provenance repair):
+- innovation total DERIVED from 04_innovation.md rows: 25 = ADOPT 22 · ADAPT 3 · PARK 0 (no hard-coded totals)
+- all load-bearing source references resolve EXACTLY to one ledger row (A3-17 Framing Gap; A3-16 ClawSentry; shifted tail re-pointed by identity; noWorkflow/ProvBook added as A3-27)
+- gap-count populations: EVIDENCE_SATURATION_TYPED_GAPS = 8 (evidence_saturation.md Late-search checks) · HONEST_GAPS = 9 (5 bounded-search + 4 unverified-this-run) · REMAINING_UNKNOWNS = 14 (master §49, incl. 2 PARKED_TO_LATER_DOMAIN: multimodal→#403, hardware isolation→#405)

research/memory-atlas-r1/AA-security-memory-poisoning/sources.md

@@ -0,0 +1,115 @@
+# #402 AA — Source Ledger (mandate §91)
+
+Read-depth values: FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / CODE_AUDITED / ABSTRACT_ONLY / METADATA_VERIFIED / REPLICATED / UNVERIFIED. Never fabricated. Depth honesty: classic security texts are paywalled/DTIC-only → ABSTRACT/METADATA is the honest label; arXiv V1 entries were abstract-verified this session (not full-text read unless stated); kernel/systemd/man pages were read at FULL_TEXT where linked.
+
+| # | Source | Authors | Year | Venue / ID | Type | Read depth | Rune relevance | Confidence | Lesson |
+|---|---|---|---|---|---|---|---|---|---|
+| A1-1 | Secure Computer Systems: Mathematical Foundations and Model | Bell & LaPadula | 1973 | MITRE (ESD-TR-73-51) | classic model | METADATA_VERIFIED | confidentiality labels; no integrity | high | label authority fails: subject sets its own labels |
+| A1-2 | Integrity Considerations for Secure Computer Systems | Biba | 1977 | MITRE DTIC AD-A039324 | classic model | ABSTRACT_ONLY + METADATA_VERIFIED | integrity inversion; LOM availability-hostile | high | global subject labels collapse availability; per-record provenance survives |
+| A1-3 | Commercial Data Processing and Integrity (Clark-Wilson) | Clark & Wilson | 1987 | IEEE S&P, DOI 10.1109/SP.1987.10001 | classic model | METADATA_VERIFIED | CDI/UDI + certified TPs + SoD + IVPs | high | closest classical fit; policy discipline not boundary at same uid |
+| A1-4 | On the Design of a Capability-Based Computer System / Capabilities | Dennis & Van Horn | 1966 | CACM 9(3), DOI 10.1145/365230.365252 | classic model | METADATA_VERIFIED | unforgeable references; least privilege | high | ambient authority cannot be removed from a Python process |
+| A1-5 | Capability-Based Computer Systems | Levy | 1984 | Digital Press | taxonomy | METADATA_VERIFIED | hardware/OS capability implementations | medium | design taxonomy; revocation unsolved in practice |
+| A1-6 | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control | Miller | 2006 | Johns Hopkins dissertation | model | UNVERIFIED (not confirmed live; widely cited) | object-capability discipline | medium | no ambient authority — API-level only here |
+| A1-7 | The Confused Deputy | Hardy | 1988 | ACM SIGOPS OSR 22(4), DOI 10.1145/54289.871709 (DOI corrected) | classic attack | METADATA_VERIFIED | ambient authority misuse | high | injected content cannot exercise authority never handed |
+| A1-8 | Computer Security Technology Planning Study (Vol 2) | Anderson | 1972 | DTIC AD-772806 | classic model | ABSTRACT_ONLY + METADATA_VERIFIED | reference monitor: complete mediation/tamperproof/verifiable | high | tamperproof unachievable at same uid → policy checkpoint |
+| A1-9 | A Lattice Model of Secure Information Flow | Denning | 1976 | CACM 19(5), DOI 10.1145/360051.360056 | theory | METADATA_VERIFIED | IFC lattice | high | implicit flows unsound in LLMs |
+| A1-10 | Certification of Programs for Secure Information Flow | Denning & Denning | 1977 | CACM 20(7), DOI 10.1145/359636.359712 | theory | METADATA_VERIFIED | static certification | medium | — |
+| A1-11 | Guide to Attribute Based Access Control (ABAC) | NIST SP 800-162 | 2014 | NIST CSRC | standard | ABSTRACT_ONLY + METADATA_VERIFIED | ABAC definition + attributes | high | best fit: attributes naturally available in Rune |
+| A1-12 | Guide to Computer Security Log Management | NIST SP 800-92 | 2006 | NIST CSRC | standard | ABSTRACT_ONLY + METADATA_VERIFIED | log management infrastructure | medium | single-principal limits SoD claims |
+| A1-13 | Yama LSM: ptrace_scope | Linux kernel docs | current | docs.kernel.org/admin-guide/LSM/Yama.html | kernel doc | DOCUMENTATION_AUDITED | ptrace scoping 0-3; PR_SET_DUMPABLE blocks attach | high | /proc environ NOT gated by Yama; PR_SET_DUMPABLE is the brake |
+| A1-14 | unix(7): SO_PEERCRED / SCM_CREDENTIALS | man-pages 6.19 | current | man7.org | kernel doc | DOCUMENTATION_AUDITED | kernel-checked peer uid/gid/pid | high | distinguishes UIDS not processes → dedicated uid needed |
+| A1-15 | systemd-creds(1) | systemd 261.3 | current | man.archlinux.org | tool doc | DOCUMENTATION_AUDITED | TPM2/host sealing; AES256-GCM; 0400 ramfs | high | same-uid malware reads the unsealed credential while running |
+| A1-16 | dm-verity | Linux kernel Device Mapper docs | current | docs.kernel.org | kernel doc | DOCUMENTATION_AUDITED | block-level hash tree; offline tampering | high | check_at_most_once weakens online protection |
+| A1-17 | IMA/EVM kernel documentation | Linux kernel | current | docs.kernel.org (404 at check; LSM index only) | kernel doc | UNVERIFIED (general knowledge only) | measurement + appraisal | medium | not verified live this run |
+| A1-18 | CaMeL: capability-based defense for LLM agents | Debenedetti et al. | 2025 | arXiv:2503.18813 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | control/data flow from trusted query; 77% provable vs 84% undefended | high | enforce at tool boundary, outside the model |
+| A1-19 | f-secure LLM systems (monitor filtering) | — | 2024/25 | arXiv:2409.19091 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | untrusted-input filtering into planning | medium | — |
+| A1-20 | FLOWSEAL: IFC lattice + declassification | — | 2025/26 | arXiv:2609.14003 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | tool-level interceptor; leak 52.2%→0.5% | high | destination allow-lists empirically demonstrated |
+| A1-21 | SPA: dual-lattice over persistent labeled artifacts | — | 2025/26 | arXiv:2608.27234 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | tool_knowledge attack 0%/0.2% | high | closest published analogue to Rune Memory |
+| A1-22 | APPA: dual-phase reference monitor | — | 2025/26 | arXiv:2607.24625 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | trajectory confinement; 64.2-91% utility, zero attacks across 1,320 guarded episodes | high | recovers IFC's abort-only failure |
+| A1-23 | GIF: Jacobian-based flow bounds | — | 2025/26 | arXiv:2606.23277 | theory | ABSTRACT_ONLY + METADATA_VERIFIED | information-flow bounds for LLMs | medium | — |
+| A1-24 | PyT Python taint framework | — | — | — | tool | UNVERIFIED | dynamic taint | low | Pyshield: NOT verified — do not cite |
+| A1-25 | Rune harness source verification (provider_registry.py:173 masking; audit_ledger.py:28 hardcoded HMAC; capability_broker.py = selection not enforcement) | Rune source | 2026-09-22 | local read-only inspection | source code | CODE_AUDITED (in-scope: research-only read) | 2 premise corrections + 1 security defect | high | HARD CASE: tamper-evident ledger forgeable via hardcoded key |
+| # | Source | Authors | Year | Venue / ID | Type | Read depth | Rune relevance | Confidence | Lesson |
+|---|---|---|---|---|---|---|---|---|---|
+| A2-1 | Not What You've Signed Up For (indirect prompt injection) | Greshake et al. | 2023 | arXiv:2302.12173v2 | attack taxonomy | RELEVANT_SECTIONS | passive/active/user-driven delivery; 'processing retrieved prompts can act as arbitrary code execution' | high | authors' own limits: synthetic apps only, no in-the-wild |
+| A2-2 | Ignore Previous Prompt: PromptInject | Perez & Ribeiro | 2022 | arXiv:2211.09527v1 | attack framework | ABSTRACT_ONLY | goal hijacking + prompt leaking | medium | GPT-3 only |
+| A2-3 | The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions | Wallace et al. | 2024 | arXiv:2404.13208v1 | defense | ABSTRACT_ONLY | system>user>third-party training | high | no adaptive-attack eval; 2025-26 shows 98.2%→20.5% compliance (IH-Benchmark 2607.25987) |
+| A2-4 | Defending Against Indirect Prompt Injection With Spotlighting | Hines et al. | 2024 | arXiv:2403.14720v1 | defense | RELEVANT_SECTIONS | delimiting/datamarking/encoding; >50%→<2% | high | one of 12 defenses bypassed >90% under adaptive attack (A2-7) |
+| A2-5 | AgentDojo: dynamic environment for prompt injection | Debenedetti et al. | 2024 | arXiv:2406.13352v3 | benchmark | RELEVANT_SECTIONS | 97 tasks/629 cases; <66% utility clean; attacks <25% vs best agents | high | authors: 'extremely easy to build non-robust defenses'; not a static benchmark |
+| A2-6 | InjecAgent / AgentHarm / ASB | Zhan et al.; Andriushchenko et al.; Chen et al. | 2024 | arXiv:2403.02691v3 / 2410.09024v3 / 2410.02644v4 | benchmarks | ABSTRACT_ONLY | InjecAgent 24% ASR; AgentHarm = misuse not injection (scope correction); ASB max avg 84.30%, 11 defenses limited | medium-high | — |
+| A2-7 | The Attacker Moves Second: adaptive attacks bypass 12 defenses | Nasr et al. | 2025 | arXiv:2510.09023v1 | negative results | RELEVANT_SECTIONS (Table 1) | Spotlighting/Repeat User Prompt/RPO/Circuit Breakers/StruQ/MetaSecAlign/Protect AI/PromptGuard/PIGuard/Model Armor/Data Sentinel/MELON all >90% ASR adaptive; majority originally near-zero | high | no defense's reported ASR is admissible without adaptive evaluation |
+| A2-8 | Design Patterns for Securing LLM Agents | Beurer-Kellner et al. | 2025/26 | arXiv:2506.08837v3 | patterns | RELEVANT_SECTIONS | Action-Selector/Plan-Then-Execute/LLM-Map-Reduce/Dual-LLM/Code-Then-Execute/Context-Minimization; 'constrained so that it is impossible for that input to trigger any consequential actions' | high | enforce at the effect sink |
+| A2-9 | Lethal trifecta (practitioner framing) | Simon Willison | 2025 | simonwillison.net blog | practitioner | DOCUMENTATION_AUDITED | private data + untrusted content + external comms | medium | framing, not research |
+| A2-10 | Tool Poisoning Attacks / rug pulls / tool shadowing | Invariant Labs (Beurer-Kellner & Fischer) | 2025-04-01 | invariantlabs.ai blog | attack demonstration | DOCUMENTATION_AUDITED | hidden instructions in tool descriptions; ~/.ssh/id_rsa exfil demo; shadowing | high | mechanism evidence (not research) |
+| A2-11 | MCPTox / MCP-ITP / MSB / MCP Safety Audit / ShareLock / TRUSTDESC | various | 2025/26 | arXiv:2508.14925 / 2601.07395 / 2510.15994 / 2504.03767 / 2606.27027 / 2604.07536 | attack benchmarks | ABSTRACT_ONLY | MCPTox o1-mini 72.8% ASR over 45 live servers; MCP-ITP implicit up to 84.2%; MSB tool-name squatting; ShareLock split instructions | high | 'more capable models are often MORE susceptible' |
+| A2-12 | OWASP GenAI LLM Top 10 2025 | OWASP | 2025 | genai.owasp.org | standard | DOCUMENTATION_AUDITED | LLM01 injection ('unclear if fool-proof prevention exists'); LLM04 poisoning; LLM08 vector/embedding | high | normative, never effectiveness |
+| A2-13 | AgentPoison (memory/KB backdoor) | Chen et al. | 2024 | arXiv:2407.12784v1; NeurIPS 2024 poster (OpenReview Y841BRW9rY) | attack | RELEVANT_SECTIONS | no training; ≥80% avg ASR, ≤1% benign degradation, <0.1% poison rate; 82% retrieval / 63% e2e | high | transfers across embedders |
+| A2-14 | Sleeper Agents (training-time backdoors) | Hubinger et al. | 2024 | arXiv:2401.05566v3 | attack (training) | ABSTRACT_ONLY | persists through SFT/RL/AT; does NOT directly transfer to memory persistence | medium | separate memory analogue exists (A2-15) |
+| A2-15 | Hidden in Memory: Sleeper Memory Poisoning | — | 2025/26 | arXiv:2605.15338 | attack | ABSTRACT_ONLY | poisoned memories written 99.8%/95%; 60-89% attacker-intended action among successful retrievals | high | the real sleeper-memory evidence (batched artifact mis-attributed) |
+| A2-16 | Plant, Persist, Trigger / Sleeper Channels & Provenance Gates | — | 2025/26 | arXiv:2605.28201 / 2605.13471 | attacks+defense | ABSTRACT_ONLY | 1,896 instances; 3 state targets (session/MEMORY/skills); D2 gate soundness theorem but eval preregistered | medium | theorem without measurement |
+| A2-17 | MINJA / InjecMEM | — | 2025/26 | arXiv:2503.03704v5 / 2608.23471 | attacks | ABSTRACT_ONLY | MINJA >95% injection/70% ASR idealized; InjecMEM single-interaction | medium | — |
+| A2-18 | MPBench: From Untrusted Input to Trusted Memory | — | 2026 | arXiv:2606.04329v2 | benchmark | ABSTRACT_ONLY | 4 write channels, 9 vulnerabilities, 6 attack classes; 'agents designed to write/retrieve more aggressively are MORE exploitable'; injection defenses fail to cover memory poisoning | high | direct hit for Rune |
+| A2-19 | Salami Attack: Stealthy Collusive Memory Poisoning (MemCollusion framework) | — | 2026 | arXiv:2608.01637v1 (TITLE CORRECTED) | attack | ABSTRACT_ONLY | 48 scenarios; Memory Save Rate 81.3%, ASR 75.0%; survives dilution + memory-level defenses; per-record trust scoring unsound | high | detect compositions not records |
+| A2-20 | eTAMP: Poison Once, Exploit Forever | — | 2026 | arXiv:2604.02623v2 (ID supplied) | attack | ABSTRACT_ONLY | environmental-observation-only; cross-session; bypasses permission defenses; 32.5%/23.4%/19.5%; Frustration Exploitation up to 8× ASR | high | — |
+| A2-21 | SMSR: no defense certifies vs Multi-Session Memory Poisoning | — | 2025/26 | arXiv:2606.12703 | negative result | ABSTRACT_ONLY | static-corpus defenses assume fixed KB; heuristic filters bypassed | high | no certifying defense exists |
+| A2-22 | Benign cross-user contamination | — | 2025/26 | arXiv:2604.01350 | measurement | ABSTRACT_ONLY | 57-71% contamination under raw shared state, no attack needed | high | write-time sanitization works for conversation, not for executable artifacts |
+| A2-23 | PoisonedRAG | Zou et al. | 2025 | arXiv:2402.07867v3; USENIX Security 2025 | attack | ABSTRACT_ONLY + venue verified | 90% ASR from 5 texts in a database of millions; several defenses insufficient | high | — |
+| A2-24 | Vec2Text corpus poisoning / poison-fails-after-retrieval | — | 2024/26 | arXiv:2410.06628 / 2606.11265 | attack/negative | ABSTRACT_ONLY | inversion enables poisoning without weights; many corpus attacks DEGRADE after chunking/reranking (defense-favoring) but CRCP restores | medium | arms race, not a fix |
+| A2-25 | Search Engines in an AI Era (citation ≠ support) | Venkit, Laban & Zhou | 2024 | arXiv:2410.22349v1 | study | ABSTRACT_ONLY | inaccurate citation across answer engines | high | badges insufficient |
+| A2-26 | Epistemic Sybil Resistance | — | 2026 | arXiv:2609.01873v1 | theory+measurement | RELEVANT_SECTIONS | 'no report-only aggregator can generally distinguish replication from independent corroboration'; report multiplicity 1→32 collapses coverage 0.940→0.263; evidence-ROOT multiplicity closes it; correlated extraction γ=0.719; dedupe tracks similarity (Δ1.425) not ancestry (Δ0.040) | high | count ROOTS not reports; dedupe corrupts ancestry inference |
+| A2-27 | The Sybil Attack | Douceur | 2002 | IPTPS (freehaven PDF verified) | classic | RELEVANT_SECTIONS | no trusted identity authority → vouching collapses | high | — |
+| A2-28 | Broder shingling / Charikar SimHash | Broder; Charikar | 1997/2002 | DOI 10.1109/sequen.1997.666900 / 10.1145/509907.509965 | theory | METADATA_VERIFIED | near-duplicate detection | medium | mechanism exists; no agent-memory application found (gap) |
+| A2-29 | TMA-NM: Non-Malleable Origin-Bound Authority | — | 2026 | arXiv:2606.24322v1 | defense + theorem | RELEVANT_SECTIONS | 3 laundering channels (summarization/trusted-tool echo/manufactured corroboration); T1/T2/T3 machine-checked over a TLA+ MODEL; existing defenses up to 68% laundering ASR; TMA-NM 0% ASR at full utility | high | model machine-checked, not implementation; single v1 preprint |
+| A2-30 | Forensic trajectory signatures / trust-decay memory defense / GRAB-RAG | — | 2025/26 | arXiv:2606.30566v2 / 2601.05504v2 / 2608.22228v1 | detection/defense | ABSTRACT_ONLY | AUC 0.9904 BUT 100% FP conditional on recall_before_send=1, 24.7-52.6% unconditional — 'a valid attack precondition, not a maliciousness predicate; standalone blocking is not viable'; trust-decay thresholds brittle; prompt-abstention answers 41.6% misleading-context | high | gate, don't block |
+| A2-31 | CAPTURE / SPA-0.2% / Trust No Bot (batched claims) | — | — | — | — | UNVERIFIED | CAPTURE 2505.12368 has no 24.7% figure (likely conflates A2-30's FPR); SPA 0-0.2% not verified; Trust No Bot not found | — | DO NOT INHERIT — recorded as unverifiable |
+| # | Source | Authors | Year | Venue / ID | Type | Read depth | Rune relevance | Confidence | Lesson |
+|---|---|---|---|---|---|---|---|---|---|
+| A3-1 | Recommendation for Key Management (SP 800-57 Pt 1 Rev 5) | NIST (Barker) | 2020 | DOI 10.6028/NIST.SP.800-57pt1r5 | standard | ABSTRACT_ONLY + METADATA_VERIFIED | key = module guarding it; TCB argument | high | root-holds-key ⇒ signing protects nothing against root |
+| A3-2 | How to do distributed locking (fencing tokens) | Kleppmann | 2016 | martin.kleppmann.com/2016/02/08/how-to-do-distributed-locking.html | practitioner | DOCUMENTATION_AUDITED | fencing tokens: strictly monotonic counter checked by the storage server, rejecting regressions; Redlock unsafe | high | transfers directly to agent-worker orchestration |
+| A3-3 | Efficient Data Structures for Tamper-Evident Logging | Crosby & Wallach | 2009 | USENIX Security | mechanism | METADATA_VERIFIED | hash chains/Merkle: O(log n) inclusion proofs | high | detect tampering; no anti-truncation alone |
+| A3-4 | Secure Audit Logs to Support Computer Forensics | Schneier & Kelsey | 1999 | ACM TISSEC 2(2):159-176, DOI 10.1145/317087.317089 (DOI corrected) | mechanism | METADATA_VERIFIED | iterated hashing with auditor's secret split | high | detects forgery/truncation by the auditor |
+| A3-5 | Improving Availability and Security in an Update Framework (TUF) | Samuel, Mathewson, Cappos & Dingledine | 2010 | CCS, DOI 10.1145/1866307.1866315 | mechanism | METADATA_VERIFIED | role separation, online/offline keys, thresholds, expiry | high | survivable key compromise; applies to manifest authentication |
+| A3-6 | Uptane: Security and Customizability of Software Updates for Vehicles | Kuppusamy, DeLong & Cappos | 2018 | IEEE VT Mag 23(1):66-73, DOI 10.1109/MVT.2017.2778751 (arXiv:1807.05052 corrected — it is NOT Uptane) | mechanism | METADATA_VERIFIED | non-expiring full images + Director/Vehicle repo split | high | anti-rollback done right |
+| A3-7 | An Intrusion-Detection Model | Denning | 1987 | IEEE TSE SE-13(2):222-232, DOI 10.1109/TSE.1987.232894 | theory | METADATA_VERIFIED | profile/anomaly + signature IDS taxonomy | high | founding IDS frame |
+| A3-8 | The Base-Rate Fallacy and the Difficulty of Intrusion Detection | Axelsson | 2000 | ACM TISSEC 3(3):186-205, DOI 10.1145/357830.357849 (CCS'99: 10.1145/319709.319710) | theory | FULL_PAPER (repair top-up 2026-09-22: bronze OA PDF read; P(I)=2e-5, FPR 1e-5 → detection rate 66%; FPR 1e-3 → ~2%; 'suppress false alarms' is the design priority) | tiny intrusion rate ⇒ 1% FPR overwhelms TP | high | detector design must target FPR FIRST |
+| A3-9 | Certificate Transparency (RFC 6962) / Trillian | Laurie et al.; Google | 2013/current | RFC 6962; github.com/google/trillian | standard/mechanism | V2 (stable normative text) | publicly verifiable append-only; fork detectable | high | requires gossip; detection not prevention |
+| A3-10 | Design Patterns for Securing LLM Agents (detailed) | Beurer-Kellner et al. | 2025/26 | arXiv:2506.08837v3 | patterns | ABSTRACT_ONLY + METADATA_VERIFIED | six patterns; trade-offs stated as utility loss vs injection resistance | high | patterns are architecture-level defenses |
+| A3-11 | SPA plan-first IFC (detailed) | — | 2025/26 | arXiv:2608.27234 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | persistent state as labeled artifacts; planner sees semantic metadata only | high | tool_knowledge 0%/0.2% |
+| A3-12 | APPA dual-phase reference monitor (detailed) | — | 2025/26 | arXiv:2607.24625 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | trajectory confinement; schema-bounded egress; 64.2-91% utility, zero attacks in 1,320 guarded episodes | high | — |
+| A3-13 | FLOWSEAL (detailed) | — | 2025/26 | arXiv:2609.14003 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | 3 new attacks bypass prompt-based privacy defenses; leak 52.2%→0.5% | high | — |
+| A3-14 | Claw in Plain Sight (tool-argument disclosure measurement) | — | 2026 | arXiv:2608.20658 | measurement | ABSTRACT_ONLY + METADATA_VERIFIED | session-level policy-violating disclosure 20.8-75.0% across pressure/policy levels | high | prompt-level privacy instructions are NOT a portable boundary |
+| A3-15 | ContextLeak / SkillWatermark | — | 2026 | arXiv:2608.27800 / 2608.16026 | attacks/measurement | ABSTRACT_ONLY + METADATA_VERIFIED | RL-crafted tool names induce context leakage; skill descriptions encode private info in traffic patterns | medium-high | — |
+| A3-17 | The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents | — | 2026 | arXiv:2608.27092v1 (HTML full text read 2026-09-22 repair top-up; 6 models incl. gpt-4o/llama3.1:8b/qwen2.5:7b; 10 overt frames all 0% on gpt-4o; reframing J4 integrity-sig 100%/J7 config-block 100% on gpt-4o-mini; destination allow-list 0% by construction; planner/reader CaMeL-core split 0% at 90% utility; SecAlign 32.5% fails; channel separation 38.8% fails; limitations: single decision step, synthetic canary, no scaling ladder) | attacks/measurement | FULL_PAPER | model-side recognition fails 0%→100% under reframing; destination allow-lists close to 0%; payload-blind defenses are the demonstrated near-zero exfil defense | high | robust checks read destination/provenance, not content — mirror of Axelsson's FPR-first principle |
+| A3-16 | ClawSentry / Locate-and-Judge | — | 2026 | arXiv:2608.21101 / 2606.23416 | detection | ABSTRACT_ONLY + METADATA_VERIFIED | 4-locus progressive monitoring; contextual ASR 39.55%→2.61% with utility ~83.8%; found live malicious skills commercial scanners miss | high | progressive layered detection |
+| A3-18 | Agent libOS | — | 2026 | arXiv:2606.03895 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | 3 planes (operation admission/IFC admission/durable evidence); Task Authority ceilings; one-shot Human release; disclaims prompt-injection prevention/kernel sandboxing/external-effect rollback | high | honest scope statement |
+| A3-19 | A-JWT per-agent proof-of-possession | — | 2025 | arXiv:2509.13597 | mechanism | ABSTRACT_ONLY + METADATA_VERIFIED | per-agent keys + chained delegation + one-way identity hashes; blocks replay/in-process impersonation, sub-ms | medium-high | — |
+| A3-20 | Multi-agent boundary verification | Bappy et al. | 2025/26 | arXiv:2608.00718 | attack/analysis | ABSTRACT_ONLY + METADATA_VERIFIED | pipelines lack content/identity/intent/state boundary verification; attack success tracks pipeline STRUCTURE not model capability | medium-high | — |
+| A3-21 | AgentGuard (typosquatting) | — | 2026 | arXiv:2604.16309 | detection | ABSTRACT_ONLY + METADATA_VERIFIED | hybrid metadata+content detection improves precision 12-49% over lexical-only | medium | lexical-only detection has structurally high FPR |
+| A3-22 | EchoLeak CVE-2025-32711 / xz CVE-2024-3094 | Microsoft/M365 Copilot; Lasse Collin ecosystem | 2025/2024 | NVD | CVE | METADATA_VERIFIED | EchoLeak: M365 Copilot AI command injection, CWE-74, CVSS 9.3/7.5, zero-privilege network attack; xz: CWE-506, CVSS 10.0, maintainer grooming | high | hash/pinning useless against a poisoned upstream release |
+| A3-23 | MCP Specification 2025-06-18 (Security and Trust & Safety section) | Anthropic et al. | 2025 | modelcontextprotocol.io | standard | ABSTRACT_ONLY + METADATA_VERIFIED | tool descriptions/annotations UNTRUSTED unless from a trusted server; 'MCP itself cannot enforce these security principles at the protocol level' | high | enforcement pushed to hosts |
+| A3-24 | SLSA v1.2 / Sigstore / SP 800-88r2 / SP 800-53 | SLSA/Sigstore/NIST | 2024-26 | slsa.dev; sigstore.dev; csrc.nist.gov | standards | DOCUMENTATION_AUDITED | SLSA v1.0 RETIRED → v1.2; SP 800-88r1 withdrawn → r2; 800-53 AC-4/SC-7/AU-* | medium | normative not effectiveness |
+| A3-25 | restic (client-side encryption, append-only delegated to server) | restic | current | restic.readthedocs.io | tool doc | ABSTRACT_ONLY + METADATA_VERIFIED | repo password mandatory; append-only enforcement lives SERVER-side; check --read-data | medium | immutability must live outside the client |
+| A3-26 | Negative space (FIDO2-as-agent-approval; policy-as-code-for-agents; approval-habituation-for-agents; agent-memory deletion semantics; signed-model-release standard) | — | 2025/26 | arXiv cs.CR (0 hits) | gap | UNVERIFIED (0 hits recorded) | NO published work found on any of the five | high | honest negative space; routes to innovation |
+| A3-27 | noWorkflow / ProvBook (script/notebook provenance captured but shown separately) | Murta et al.; Samuel & König-Ries | 2015/2018 | DOI 10.1007/978-3-319-16462-5_6 (Crossref-verified 2026-09-22: IPAW/LNCS, Murta/Chirigati/Koop); OpenAlex W2898837379 (ProvBook: Provenance-based Semantic Enrichment of Interactive Notebooks, Samuel & König-Ries 2018) | mechanism | METADATA_VERIFIED | provenance captured as first-class data alongside the artifact, displayed/queryable separately from content — the pattern quarantine-as-first-class-state reuses | medium | provenance systems show capture+separate-display is a workable pattern; NOT an enforcement mechanism |
+
+Cross-arm note: arm-4 grounded all verdicts in the arm-1/2/3 ledger above plus the verified inward facts (01_inward.md); it did not introduce new sources. Negative-space searches (A3-25) are recorded as honest gaps, not fabricated findings.
+
+## Unverifiable / do-not-cite register (from arms 1-3)
+
+- "Pyshield" as a Python taint framework — NOT verified; do not cite.
+- "Akash 2009.11890" (carried from the #402 batched artifact's sibling) — not verified this run.
+- CAPTURE 2505.12368 "24.7% ASR vs belief-tracking" — no such figure in the source; likely conflated with arXiv:2606.30566's 24.7-52.6% benign FPR. DO NOT INHERIT.
+- "Trust No Bot" / "SPA 0-0.2% ASR" (batched artifact) — no matching source found in this R1 search as of 2026-09-22.
+- arXiv:2503.15478 = SWEET-RL (unrelated to Tool Poisoning Attacks); canonical TPA = Invariant Labs blog.
+- arXiv:1807.05052 = general relativity (not Uptane); correct Uptane citation is DOI 10.1109/MVT.2017.2778751.
+- IMA/EVM kernel documentation 404'd at check time — IMA specifics carried as general knowledge, UNVERIFIED live.
+- Miller "Robust Composition" — not confirmed live this run (widely cited; UNVERIFIED flag).
+
+## Depth summary
+
+Arm 1 (A1, 25 rows): DOCUMENTATION_AUDITED 4 · ABSTRACT_ONLY+METADATA_VERIFIED 8 · METADATA_VERIFIED 6 · UNVERIFIED 2 · CODE_AUDITED 1 (documentation correctly labeled, not FULL_PAPER).
+Arm 2 (A2, 31 rows): RELEVANT_SECTIONS 6 · DOCUMENTATION_AUDITED 3 · ABSTRACT_ONLY+METADATA_VERIFIED ~21 · UNVERIFIED 1.
+Arm 3 (A3, 27 rows): FULL_PAPER 2 (Axelsson A3-8; Framing Gap A3-17 — both read in full during the 2026-09-22 evidence-depth repair top-up) · DOCUMENTATION_AUDITED 2 (Kleppmann practitioner essay; SLSA/Sigstore/NIST standards row) · RELEVANT_SECTIONS 3 · ABSTRACT_ONLY+METADATA_VERIFIED ~15 · METADATA_VERIFIED ~5.
+Adversarial: no new sources (grounded in the ledger + inward).
+
+Total: 83 rows / 79 unique (4 cross-arm identity duplicates counted once: FLOWSEAL A1-20≈A3-13; SPA A1-21≈A3-11; APPA A1-22≈A3-12; Design Patterns A2-8≈A3-10). FULL_PAPER = exactly 2, both academic papers read in full. The injection/poisoning arms remain abstract-verified — 2025-26 preprints with honest ABSTRACT/METADATA labels; the batched artifact's own claims were corrected against them.

research/memory-atlas-r1/AB-multimodal-artifact-memory/00_issue_scope.md

@@ -0,0 +1,33 @@
+# #403 AB — Multimodal Memory: ISSUE + Scope (R1_FULL, 2026-09-22)
+
+## Canonicalization (verified, not invented)
+
+- **Gitea issue:** #403 (parent #375). **Domain:** AB — Multimodal Memory (registry: "AB: Multimodal / Artifacts").
+- **Folder:** `research/memory-atlas-r1/AB-multimodal-artifact-memory/` (existing — kept; NOT renamed).
+- **Master:** `AB_MULTIMODAL_ARTIFACT_MEMORY_R1_MASTER.md` (existing canonical filename — kept; the mandate's suggested `AB_MULTIMODAL_MEMORY_R1_MASTER.md` is NOT used because a canonical name already exists).
+- **Batched artifact preserved BYTE-FOR-BYTE** as `AB_MULTIMODAL_ARTIFACT_MEMORY_R1_BATCHED_PRELIMINARY.md` (sha256 `5c705036c791cb463133890d4af5a2dbd84084eb5deed9f493ebc7f8994c4bc8`, verified identical to the pre-run master; the original master is REWRITTEN only at the MASTER stage).
+- **Family file:** `research/memory-atlas/families/mind_palace_hci_multimodal.md` Section AB (shared with #401 Z) — R0 baseline for reconciliation, reconnaissance NOT authority.
+
+## Registry hygiene
+
+Registry row 403 is batched-era text carrying "single-writer stance confirmed; staged earn-in" — **NOT inherited** (same rule as #402; the row is rewritten only at closeout from this run's own row truth).
+
+## Scope
+
+FULL new-domain R1_FULL run of the 77-section mandate: multimodal cognition foundations → representation learning → retrieval/RAG → documents/OCR → audio → video/temporal → spatial provenance → source-vs-derived model → identity/dedupe → transformation provenance → interpretation revision → contradictions/corroboration → uncertainty/hallucination → routing → provider independence → storage/tiering → preservation → metadata/privacy/sensitive inference → face/voice identity → multimodal security (#402 seam) → synthetic media → UI/screen memory → technical artifacts → accessibility → user corrections → user-model/persona/growth seams → inward audit → 2024-26 research → benchmarks → systems → 27 architectural candidates (A–T) → 229 adversarial attacks (A–EZ + Rune-specific) → 21+ synthesis matrices → 27 experiments (E1–E27) → 68 questions → master.
+
+## Governing rules carried
+
+- Research-only boundary (no production Memory/media/index/OCR/ASR/TUI changes; read-only inward).
+- MAX_CONCURRENT_SUBAGENTS = 1; four SERIAL arms (foundations → retrieval → reliability/lifecycle/security → adversarial).
+- ADOPT requires DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT; HYPOTHESIS-only → EXPERIMENT/ADAPT; the gate never promotes evidence levels.
+- Source references are foreign keys (exact resolution, no truncation, no duplicate IDs, identity adjacency).
+- Zero-hit governance: OBSERVED RUNE ABSENCE vs SOURCE-ATTRIBUTED NEGATIVE vs bounded R1 EXTERNAL ZERO-HIT.
+- Source TYPE and read DEPTH separate; documentation never FULL_PAPER.
+- **#402 observed-failure carry:** semantic similarity previously superseded an unrelated cross-domain canonical Memory summary (entry 194015 superseding 193729, receipt 1515). Perceptual similarity in this domain must NEVER authorize supersession; a similarity-based cross-domain supersession receipt is a defect to record, not lineage to accept.
+- Continuous execution; stages are internal checkpoints; recoverable faults are not stop conditions. STOP BEFORE #404.
+- True freeze: all mutations → canonical/derived Memory writes → audit LAST → read-only gates → ONE seal → push/mirror/verify → receipts → STOP. Any forbidden post-freeze write ⇒ FREEZE_STALE automatically.
+
+## Stage plan
+
+ISSUE (this file) → INWARD (01_inward.md, read-only A–L + storage/provider-truth) → OUTWARD arms 1–4 (02_outward/) → APPLICABILITY (03) → INNOVATION (04) → claims.json + sources.md + load_bearing_evidence.md → R0 + preliminary reconciliation → evidence_saturation.md → SYNTHESIS (06) → QUALIFY (07) → MASTER (rewrite) → closeout (mutation_audit LAST, gate, seal, push/mirror, receipts, token).

research/memory-atlas-r1/AB-multimodal-artifact-memory/01_inward.md

@@ -0,0 +1,85 @@
+# #403 AB — INWARD: Read-Only Multimodal Capability Audit (2026-09-22)
+
+Method: SQLite readonly URIs, file inspection, config/binary/code reads. No production changes. All paths quoted from observed state.
+
+## A. Canonical Memory — multimodal support
+
+- `entries` (944 rows, 26 cols): **TEXT-ONLY**. No media/blob/attachment/hash/MIME column of any kind. `source` is an unvalidated free-text string (#402 finding — caller-supplied).
+- **ZERO entries reference a media path** (no `.png/.jpg/.pdf/.mp4/.wav/screenshot` mentions in any of 944 entries).
+- `documents` table (5,732 rows): a TEXT-ingestion registry — `path, mtime, content_hash, status, wing, ingested_at`. `content_hash` exists (fixity for ingested TEXT documents — the one genuine content-addressing precedent). Statuses: 5,712 ok / 20 error.
+- `chunks` (118,210 rows): text chunks with `source_path`, `start_line/end_line`, `content_hash`. Line-range provenance exists for TEXT; no page/region/frame/segment concepts.
+- **Verdict: canonical Memory has NO multimodal dimension.** A file can be pointed at only by convention inside free text.
+
+## B. Images
+
+- No image ingestion, no screenshot handling, no image metadata extraction, no image embeddings, no captions, no OCR pipeline, no region references — **ALL ABSENT** in Rune's memory path.
+- `rune_graphic.py` / `rune_tui.py`: image handling exists ONLY for the cosmetic spinner (PIL/Rich `Image`/`Pixels.from_image`, 24×12 resize). **Presentation, not memory.**
+- `tesseract 5.5.3-1.1` IS installed on the host — OCR capability exists on the machine but is **wired into nothing** in the Memory pipeline.
+
+## C. Documents
+
+- PDFs ARE ingested — as **extracted text only** (17,934 PDF chunks verified; sample text confirmed prose extraction). No page images, no layout, no page-number references, no table structure. Layout information is destroyed at ingestion; the original PDF bytes are NOT copied (path registry only — pointer, with content_hash of the TEXT, not verified against original bytes post-ingestion).
+- Markdown/HTML: ingested as text (transcripts corpus — the primary document population).
+
+## D. Audio — **ABSENT end to end.** No ingestion, no ASR (no whisper binary), no diarization, no audio storage, no audio embedding.
+
+## E. Video — **ABSENT end to end.**
+
+## F. Chat / TUI / Tool interface
+
+- The MiMoCode runtime (mimo 0.1.14) can pass images to capable providers (input-side attachment; provider-dependent). This is **multimodal INPUT, not memory** — the attachment transiently reaches the model and then evaporates unless text about it is explicitly written to Memory.
+- Session transcripts record image *discussions* (43 keyword hits in one transcript) but the images themselves were never persisted by Rune.
+- `RichLog(markup=True)` at `rune_tui.py:547` — carried #402 defect: the TUI renders untrusted markup; a hostile "screenshot description"/tool output could inject formatting/links. Relevant here because multimodal-derived text would flow through the same surface.
+
+## G. Embedding / index infrastructure
+
+- `entries_vec` + `chunks_vec` (sqlite-vec, library version v0.1.9 recorded). **TEXT-only.**
+- **No embedding-model identity or version is recorded anywhere** (only the sqlite-vec library version in `*_vec_info`; `meta` holds only `lexicon_version=2`). The embeddings in the live index cannot be attributed to a model — they are **unrebuildable-with-provenance**: re-embedding would silently change retrieval semantics with no record of what changed from.
+- No stale-embedding handling, no dual-index migration machinery.
+
+## H. Provenance
+
+- Present: `source_path`, line ranges, `content_hash` (text docs), `ingested_at`, free-text `source`.
+- Absent: transformation type, model/tool version, page/region/segment references, capture-time vs ingestion-time distinction, lossiness declarations.
+
+## I. Security (multimodal surfaces)
+
+- Ingestion pipeline treats every document as trusted text → chunks → index. No taint, no origin channel labels, no injection screening at the document edge (carried #402: content/control separation is DESIGNED, not implemented).
+- TUI `RichLog(markup=True)` — unsafe rendering of derived text (F11, #402).
+- Provider disclosure: no least-media discipline exists (nothing to disclose — but the seam is inherited: #402's "access ends at the authorized interface" would govern future media disclosure).
+
+## J. Storage
+
+- `~/.config/opencode/memory/store/` = 436 MB, **all text/index**. No media directories anywhere (`find` for *media*/*attach*/*upload* = empty). No backup/archival path for media, no fixity cron, no tiering. Storage has no lifecycle governance at all (#402: writable derived indexes outside any fixity story).
+
+## K. Project / task continuity
+
+- Screenshots/files referenced in task/conversation records are **transient text mentions**; no durable linkage from any project record to a media object.
+
+## L. Provider capability truth
+
+- 11 auth'd providers in `auth.json`; live config (`opencode.json`) declares one local Ollama model with `"tools": true` and **no modality capability fields for any model**. Provider modality support (which models accept image/audio input) is **runtime-provider-internal, undeclared, unverifiable from persisted config** — exactly the #400 capability-truth gap, now modality-shaped. UNKNOWN (not readable without live probing, out of scope): per-provider attachment retention policies.
+
+## Classification (mandate §49 vocabulary)
+
+- **CANONICAL (2):** text Memory schema; text ingestion pipeline (documents/chunks + fixity hash at ingestion).
+- **ACTIVE (4):** chunk embeddings (text); transcript ingestion; PDF text extraction; provider chat with attachment INPUT.
+- **PARTIAL (3):** provider modality support (input-side only; undeclared/unverifiable); image display (spinner-only, presentation); graph store (exists, ~empty, no multimodal content).
+- **ABSENT (8):** image ingestion/OCR pipeline (despite tesseract on host); audio/ASR/diarization; video/temporal media; media blob storage/tiering; region/segment provenance; transformation lineage + model/version recording; sensitive-media handling/redaction; multimodal retrieval (cross-modal or modality-native).
+- **BYPASS (3):** attachments → provider (transient, not memory); image discussions → transcripts (text shadow only); media paths in prose (unvalidated, unverifiable).
+- **DORMANT (1):** graph.sqlite (86 KB, ~empty content).
+- **UNKNOWN (3):** provider-side attachment retention; live per-model vision support truth; whether provider tool-outputs containing images are logged anywhere.
+
+## Current-state honesty (mandate §50)
+
+**Rune does NOT have multimodal memory.** It has: multimodal INPUT capability (provider-dependent, transient); a text-only canonical Memory; a text-only ingestion pipeline that already DESTROYS document modality (PDF→flat text, no layout); and a host OCR tool that is wired into nothing. Input ≠ Memory ≠ Retrieval ≠ Learning ≠ Provenance — Rune has only the first, partially, with zero durability.
+
+## Load-bearing gaps for the architecture (T1 candidates)
+
+1. No source-object concept (bytes, hash, MIME, acquisition vs capture time, retention) — the schema cannot SAY "this evidence exists."
+2. No derived-representation concept with lineage (what OCR/ASR/caption/embedding produced what, with which model/version).
+3. No modality-native retrieval or cross-modal bridge; similarity already proven dangerous (the #402 194015/193729 cross-domain supersession — similarity must nominate, never authorize).
+4. No modality-capability truth layer (which models can do what is undeclared).
+5. Document ingestion already commits the exact sin this domain must name: it keeps only the flattest derived projection and discards the modality structure.
+6. No security boundary at the modality-conversion edge (tesseract → text → index → prompt would be a direct injection path with no taint).
+7. No storage/tiering/lifecycle governance for media-scale data.

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm1_foundations.md

@@ -0,0 +1,138 @@
+# Arm 1 — FOUNDATIONS: Human Multimodal Cognition & Multimodal Representation Learning
+
+**Atlas domain:** #403 AB — Multimodal Memory (Rune)
+**Arm:** 1 of 4 (Foundations) · **Date:** 2026-09-22 · **Mandate:** research only
+**Rune baseline:** stateful coding agent; text-only canonical Memory (SQLite, 944 entries, FTS5 + sqlite-vec text embeddings, NO model/version recorded); document ingestion flattens PDFs to text (no layout preserved). Atlas design principle under test: *preserve source, derive interpretation* — smallest multimodal architecture.
+
+**Verification discipline statement.** Every arXiv ID in this report was verified by fetching `arxiv.org/abs/<id>` (or the arXiv API feed, which returns title/authors/abstract together) before inclusion. Five candidate identifiers supplied or assumed by me were **mis-paired and rejected** (see §4). Read depths are recorded per row exactly as defined in the mandate. The load-bearing sources were read at genuine depth: Brady et al. 2008 read in full (PNAS open-access full text); CLIP, ImageBind, and Liang et al. read at relevant-section depth via arXiv HTML including their Limitations sections and key experiment tables; Zacks et al. 2007 read at relevant-section depth via PMC manuscript full text. Ernst & Banks 2002 could **not** be read in full (Nature paywall; no open-access PDF per Unpaywall/Semantic Scholar) and is honestly recorded as ABSTRACT_ONLY with the abstract read verbatim from nature.com.
+
+Depths used: FULL_PAPER · RELEVANT_SECTIONS · ABSTRACT_ONLY · METADATA_VERIFIED. (No documentation was relied on as evidence in this arm.)
+
+---
+
+## 1. Per-source table
+
+Legend for "Rune relevance": ★★★ = direct architecture implication; ★★ = design guidance; ★ = context only.
+
+### Part A — Human multimodal cognition
+
+| # | ID / locator | Title / authors / year / venue | Modality | Key claims | Negative results / debates | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A1 | PMID 1012311; doi:10.1038/264746a0 | Hearing lips and seeing voices — McGurk & MacDonald 1976, Nature 264:746–748 | audio+visual (speech) | Incongruent lip movements and heard syllables fuse into a third percept ("ga" heard when lips say "ba" and audio says "ga"); audiovisual speech is integrated pre-attentively, not just summed. | Robust phenomenon (2,100+ citations; 40-year retrospective by MacDonald 2018, Multisens Res 31, confirmed as a still-active research field), but the *rate* of the effect varies strongly by language, attention, and stimulus AV timing. | Perception-level, pre-attentive; no propositional representation; effect is stimulus-tuned. | METADATA_VERIFIED (Europe PMC record + 2018 retrospective indexed) | ★★ Analogous *failure mode* to avoid: when two artifact views of the same event (e.g., screenshot + its caption) disagree, Rune must not silently "fuse" them into a plausible third interpretation — that is a reconstruction bug, not perception. |
+| A2 | MIT Press 1993 (book); verified via its citation as ref. 1 of Stein & Stanford 2008 | The Merging of the Senses — Stein & Meredith 1993, MIT Press | multisensory (neurophysiology) | Defined the "spatial, temporal, intensity" rules of multisensory enhancement in superior colliculus neurons; cross-modal inputs combine superadditively when spatially and temporally aligned, and can *suppress* when misaligned. | The book's superadditivity emphasis was later qualified: superadditivity occurs mainly when component responses are weak (Stanford & Stein 2007, cited in Stein & Stanford 2008 refs). | Neuron-level, animal (cat/monkey) physiology. | METADATA_VERIFIED (citation-verified via Stein & Stanford 2008 reference list, Crossref) | ★★ Principle worth keeping in *informational* form: combining two artifact views helps when they are co-located/co-timed and weak individually; misaligned combination can actively hurt. |
+| A3 | doi:10.1038/nrn2331 | Multisensory integration: current issues from the perspective of the single neuron — Stein & Stanford 2008, Nat Rev Neurosci 9:255–266 | multisensory (neurophysiology) | Review of the computational rules: nonlinearity (superadditivity) depends on stimulus efficacy; timing windows; spatial congruence; cortex-midbrain dialogue; experience-dependence. | Notes ongoing debate about using superadditivity as the fMRI integration criterion (refs 63–64: Laurienti 2005, Beauchamp 2005 argue against it) — i.e., even the *definition* of "integration happened" is contested. | Animal physiology + human imaging, not applicable mechanistically to software. | METADATA_VERIFIED (Crossref, full ref list inspected) | ★ Justifies checking *alignment quality* before fusing multimodal evidence in Rune; against naive "sum the scores" fusion. |
+| A4 | PMID 14761661; doi:10.1016/j.cub.2004.01.029 | The ventriloquist effect results from near-optimal bimodal integration — Alais & Burr 2004, Curr Biol 14:257–262 | audio+visual (spatial) | Spatial ventriloquism is not "visual capture by fiat": localization behaves like statistically near-optimal weighting of the two cues by their reliability, generalizing Ernst & Banks to spatial tasks. | Confirms cue-combination framework across tasks, but near-optimality is approximate; deviations documented in later literature. | Psychophysics; stimulus-level estimates. | METADATA_VERIFIED (Europe PMC record) | ★★ Supports "weight evidence by reliability" as the *shape* of good fusion, while transferring no neural mechanism. |
+| A5 | doi:10.1038/415429a; PMID 11807554 | Humans integrate visual and haptic information in a statistically optimal fashion — Ernst & Banks 2002, Nature 415:429–433 | visual+haptic (size estimation) | Canonical cue-combination result. Abstract (read verbatim): vision usually dominates visual-haptic size judgments, but the percept is affected by haptics "in some circumstances"; the authors propose a general principle that *minimizes variance in the final estimate*, realized as maximum-likelihood estimation (MLE): they first measured the variances of unisensory visual and haptic height estimation, built an MLE integrator from those measured variances, and found the model "behaved very similarly to humans in a visual–haptic task"; visual dominance is explained as the case where visual variance is lower. | None in the paper itself (model fit was the positive result). The generality across tasks/cue types is the debated part (Alais & Burr extend it; other work documents sub-optimality). | Paywalled full text (unavailable to this arm — see honesty note); abstract-level: it is a size-estimation task with 3D-rendered stimuli and explicitly *measured* noise; the optimality claim is about first-order statistics. | ABSTRACT_ONLY (verbatim from nature.com; figures 1–3 captions and full reference list also read) | ★★★ The transferable idea is *not* "Rune should run Bayes". It is: (a) fusion quality is determined by per-source reliability measured in advance; (b) "dominance" emerges from unequal reliability, not from a hardcoded modality hierarchy. In Rune: store per-derivation confidence/provenance so a later fusion step *could* weight sources; do not build a fixed "vision wins" rule. |
+| A6 | PMID 8346328; doi:10.1037/0033-2909.114.1.3 | Source monitoring — Johnson, Hashtroudi & Lindsay 1993, Psychol Bull 114(1):3–28 | cognitive (cross-modal memory) | Framework: people attribute memories to sources (perceived vs. imagined, internal vs. external) via *heuristic* judgment over activated features, not via an explicit tag; source errors arise when features are ambiguous or compatible with multiple sources. | The framework was built largely on *errors* (misattribution, "becoming famous overnight" paradigms); it is a framework, not a process model with quantitative fit. | Human amnesia/dementia and children studied; framework-level. | METADATA_VERIFIED (Europe PMC record; content from established secondary knowledge — flagged) | ★★★ This is the human analog of Rune's worst failure mode: an *interpretation* (LLM summary) later retrieved as if it were a *source* (file content). The human system lacks source tags; Rune must not copy that defect — source provenance should be explicit, persistent metadata, not reconstructed at retrieval. |
+| A7 | doi:10.1037/h0020071 | Encoding specificity and retrieval processes in episodic memory — Tulving & Thomson 1973, Psychol Rev 80(5):352–373 | verbal memory | Encoding specificity: retrieval success depends on cue–trace compatibility at encoding; includes the famous "recognition failure of recallable words" — a word can be recalled with a weak cue yet not recognized as a studied item. | Recognition failure itself was a *surprising negative* result against independent-store theories; replication debates (Thomson & Tulving 1970 vs Bahrick) are documented and were revisited by Higham 2002 (Mem Cogn 30:67–80, verified in Crossref refs) who concluded "strong cues are not necessarily weak" — boundary conditions exist. | Verbal memory; task-specific cue compatibility. | METADATA_VERIFIED (Crossref; note the commonly circulated DOI 10.1037/h0035528 is WRONG — verified h0020071) | ★★ Retrieval quality in Rune is a function of query–trace compatibility *as encoded*, which argues for deriving indexes at ingestion time (matching the query distribution) rather than assuming any embedding is a universal key. |
+| A8 | PMID 9136640; doi:10.1037/0033-2909.121.3.331 | Toward a theory of episodic memory: the frontal lobes and autonoetic consciousness — Wheeler, Stuss & Tulving 1997, Psychol Bull 121(3):331–354 | cognitive/neuropsych | Episodic memory = a distinct system enabling mental time travel, dependent on autonoetic (self-knowing) consciousness and frontal-lobe function; supported by amnesia patterns and imaging. | Concept criticized as circular (consciousness defines the system that defines consciousness) — a criticism Tulving himself reviews later (Tulving 2002). | Neurological patient literature + PET; theory-level. | METADATA_VERIFIED (Europe PMC record) | ★ Transfer FAILURE watch-item: Rune's "episodic" memory entries are just rows with timestamps; there is no autonoetic re-experience and should be no pretense of it. |
+| A9 | doi:10.1146/annurev.psych.53.100901.135114 | Episodic memory: From mind to brain — Tulving 2002, Annu Rev Psychol 53:1–25 | cognitive/neuro | Refines episodic memory from "materials/tasks" to "self, subjective time, autonoetic consciousness"; reviews neuropsychological (patient) and imaging support; addresses criticisms. | The author explicitly catalogs criticisms of the episodic/semantic division; the boundary between systems is acknowledged as not sharp. | Review; definitional. | ABSTRACT_ONLY (Crossref abstract verbatim) | ★★ The stable, transferable core is the *what/when/what-was-it-like* decomposition of an episode — useful as the shape of Rune's event records, not of any cognitive claim. |
+| A10 | PMID 17338600; PMCID PMC2852534; doi:10.1037/0033-2909.133.2.273 | Event perception: a mind-brain perspective — Zacks, Speer, Swallow, Braver & Reynolds 2007, Psychol Bull 133(2):273–293 | visual+cross-modal (event understanding) | Event Segmentation Theory (EST): continuous activity is spontaneously segmented into discrete events; boundaries occur where *perceptual prediction error* transiently spikes; "event models" (what-is-happening-now) are gated, reset at boundaries; segmentation is simultaneous on multiple timescales; boundary information is preferentially encoded into long-term memory. Verified load-bearing evidence from the full text: (i) unitization (button-press marking of boundaries) is reliable within and across observers (Newtson 1976; Speer, Swallow & Zacks 2003); (ii) still frames from event boundaries are better recognized than frames from within events (Newtson & Engquist 1976); (iii) film cuts/commercials placed AT event boundaries improve recall; placed at non-boundaries they impair it (Boltz 1992; Schwan & Garsoffky 2004; Schwan et al. 2000); (iv) group-typical segmentation ability predicts later memory even controlling for dementia (Zacks, Speer, Vettel & Jacoby); (v) partial computational implementation (Reynolds, Zacks & Braver) shows boundary spikes in prediction error emerge from a prediction network without labels. | Debates noted in-paper: whether fine-grained unitization improves *recognition* (Hanson & Hirst 1991 vs Lassiter & Slaw 1991 — mixed); whether parallel segmentation of multiple activity streams occurs (explicitly an open empirical question). | Movie-watching, human, seconds-to-minutes timescales; theory's neural implementation proposals (lateral PFC, ACC) are hypotheses. | RELEVANT_SECTIONS (theory, architecture, memory-implications, and individual-differences sections read in full; neural-correlates section skimmed due to output truncation) | ★★★ Most transferable human finding in this arm: *what you can retrieve later is determined by where the boundaries were at encoding*. For Rune, event/commit/message boundaries are the natural retrieval anchors for attached screenshots, recordings, PDFs — chunk multimodal evidence by event boundaries, not by fixed token windows. Explicitly do NOT port the prediction-error *mechanism* (see rejected transfers). |
+| A11 | PMCID PMC3314399; doi:10.1111/j.1467-8721.2007.00480.x | Event segmentation — Zacks & Swallow 2007, Curr Dir Psychol Sci 16(2):80–84 | visual (event understanding) | Short-form statement of EST and its memory consequences for a general audience. | — | Condensed version of A10. | METADATA_VERIFIED (Europe PMC/PMC record) | ★ Companion citation to A10. |
+| A12 | doi:10.1080/14640747308400340 | Learning 10,000 pictures — Standing 1973, Q J Exp Psychol 25(2):207–222 | visual | Abstract (verbatim via Crossref): memory capacity follows a power law in material presented; pictorial material shows overall superiority; "the capacity of recognition memory for pictures is almost limitless, when measured under appropriate conditions"; picture memory exceeds verbal memory even in verbal recall; verbal memory has higher retrieval speed. | The paper itself notes the limits are measurement conditions; the "almost limitless" phrasing is recognition-under-2AFC, not recall. | Forced-choice recognition; 10k-item scale; 1970s stimuli. | ABSTRACT_ONLY (Crossref abstract verbatim) | ★★ Historical anchor for picture-superiority; also the origin of the "10,000 pictures" number that Brady et al. later corrects for *fidelity*. |
+| A13 | PMCID PMC2533687; PMID 18787113; doi:10.1073/pnas.0803390105 | Visual long-term memory has a massive storage capacity for object details — Brady, Konkle, Alvarez & Oliva 2008, PNAS 105(38):14325–14329 | visual | FULL PAPER READ. 14 observers viewed 2,500 isolated objects (3 s each, 5.5 h total) with an embedded repeat-detection task, then 2-alternative forced-choice tests. Accuracy: **92.5% (novel-category foil), 87.6% (same basic-level category, different exemplar), 87.2% (same object in different state/pose)**. Repeat-detection during study: 96% hits, 1.3% false alarms; ~80% correct even with 1,023 intervening items (~2 h); error vs lag fits a power law of forgetting (r²=0.98). Authors' Landauer-style estimate: 13.8 bits/item at 93% novel performance, +2.0 bits each for exemplar and state discrimination → ~17.8 bits/item, raising a lower bound from ~14,000 to ~228,000 discriminable codes. Explicit stated conclusions/caveats (from Discussion): data "cannot reveal the format of these representations" and "should not be taken to suggest observers have a photographic-like memory"; categorical distinctiveness of the stimulus set plausibly reduced interference and helped performance; it is unresolved whether the 2AFC choices reflect familiarity or recollection (but either way the stored trace must contain foil-discriminating detail); "under conditions where we attempt to encode such details, we are capable of succeeding" — i.e., encoding was optimized (instructions, distinct categories, no interference control issues). | The paper's framing is itself a *correction* of prior belief: previous large-scale studies (Shepard 1967; Standing 1973) could not distinguish gist-only storage, and change-blindness / Loftus-misinformation lines had been read as evidence that visual memory is sparse. The finding pushes back on both extremes: memory is not gist-only, and not photographic. | 2AFC recognition only (not recall); optimal-encoding regime; unknown representational format; unknown whether performance holds for scene-level or interference-rich sets; familiarity/recollection composition unresolved. | FULL_PAPER (open-access full text incl. Methods) | ★★★ Two uses for Rune: (1) evidence FOR storing detailed derived indexes of visual artifacts — detailed traces are cognitively feasible and dramatically improve *recognition*-style retrieval (which is what vector search is); (2) evidence AGAINST over-reading: Rune's analog is not "store raw pixels of everything" but "maintain exemplar-level (not gist-level) indexes" — and Rune's real bottleneck is the attention/context budget, not storage, the inverse of the human situation. |
+| A14 | doi:10.1086/209001 | Conditions for a picture-superiority effect on consumer memory — Childers & Houston 1984, J Consumer Research 11(2):643 | verbal+visual | The picture superiority effect (better memory for pictured than verbal items) holds under specific conditions — it is conditional, not universal (conditions include encoding time and processing type). | The very title documents boundary conditions; dual-coding/picture-superiority literature contains many demonstrations of null or reversed effects depending on task (recall vs recognition), population, and stimulus meaningfulness. | Marketing/consumer context; older literature. | METADATA_VERIFIED (Crossref; note circulated DOI 10.1086/208916 is wrong — verified 10.1086/209001) | ★★ Explicitly cited as the anti-overgeneralization anchor: picture superiority is task/population dependent. |
+| A15 | doi:10.1037/h0084295 | Dual coding theory: Retrospect and current status — Paivio 1991, Can J Psychol 45(3):255–287 | verbal+visual | Dual coding theory: cognition is supported by two partly independent symbol systems (verbal, imagery); concreteness effects; additive benefits of dual codes. | Known criticisms to carry forward: boundary conditions (abstract material, expert populations), failure to fully specify imagery code format, effects shrink with meaningfulness controlled; picture superiority in humans does not license "add a second representation always helps". | Theory review; no computational implementation. | METADATA_VERIFIED (Crossref; note circulated DOI 10.1037/h0084271 is wrong — verified h0084295) | ★★ Principle to transfer *in weakened form*: paired verbal+visual traces give redundant retrieval routes (robustness), not doubled memory. |
+| A16 | doi:10.1111/j.2044-8295.1975.tb01468.x | Context-dependent memory in two natural environments: on land and underwater — Godden & Baddeley 1975, Br J Psychology 66(3):325–331 | verbal (auditory learning) | Abstract (verbatim via Crossref): divers learned word lists on land or underwater and recalled in either; "lists learnt underwater were best recalled underwater, and vice versa"; a second experiment showed the disruption of moving between environments was not the cause. | **Failed replication (negative result, verified):** Murre 2021, R Soc Open Sci 8:200724, replicated the four-condition design with 16 divers and found NO same-context advantage; a 2022 addendum (10.1098/rsos.211924) with corrected repeated-measures ANOVA "reinforces the conclusion that this study was not a successful replication". Eich's related mood-dependence work also reports weak/fragile effects (see §4 note). | Small-N field study; auditory recall; the classic status outstrips the replication record. | ABSTRACT_ONLY (Crossref abstract verbatim, original + replication + addendum) | ★★ With the replication record attached, this is a cautionary tale: do not design Rune features (e.g., "deployment-context keys") on the strength of this classic alone. Rune's context fields are explicit variables, not incidental reinstatement cues. |
+| A17 | doi:10.1098/rsos.200724 (+ addendum 10.1098/rsos.211924) | The Godden and Baddeley (1975) experiment on context-dependent memory on land and underwater: a replication — Murre 2021, R Soc Open Sci 8:200724 | verbal | Direct replication with 16 divers, all four land/underwater learning×recall combinations: "Contrary to the original study, we did not find that recall in the same context where the words had been learned was better than recall in the other context." | Negative result, published; addendum re-analysis strengthens it. | One replication; power considerations discussed in-paper. | ABSTRACT_ONLY (Crossref abstract verbatim) | ★★ Included deliberately as a finding: a famous multimodal-context memory effect is not robust. Transfer implications of context-dependence should be treated as unproven. |
+| A18 | doi:10.3928/0048-5713-19951201-07 | The formation of false memories — Loftus & Pickrell 1995, Psychiatric Annals 25(12):720–725 | verbal/autobiographical ("lost in the mall") | Implanting a wholly false childhood memory (getting lost) via suggestion: a proportion of adults later elaborated the false event as real. | The paradigm is heavily debated: base rates of "false" acceptance, distinguishability from genuine-uncertain memories, demand characteristics; the strongest legal-policy claims were later moderated (see Loftus 2005 below). Original paper has only 11 references and modest sample. | Case-study scale; suggestion paradigm. | METADATA_VERIFIED (Crossref, ref list inspected) | ★★★ Relevance is the *asymmetry*: human memory is reconstructive, so suggestion retroactively edits the trace. Rune's Memory is append-only with immutable source rows; the architectural answer is to never overwrite sources — corrections are new derived rows that supersede, with provenance. |
+| A19 | PMID 16027179; doi:10.1101/lm.94705 | Planting misinformation in the human mind: a 30-year investigation of the malleability of memory — Loftus 2005, Learn Mem 12(4):361–366 | verbal/visual | Review of the misinformation-effect literature: post-event information changes later memory reports; robust across 30 years of studies. | The literature contains the McCloskey & Zaragoza (1985) counterargument that misinformation effects can reflect response bias rather than trace impairment (cited in Loftus & Pickrell's own refs) — the *mechanism* debate is unresolved even where the phenomenon is accepted. | Review, narrative. | METADATA_VERIFIED (Europe PMC) | ★★ Supports: Rune should treat any LLM-written interpretation as capable of contaminating later reasoning about the source; keep source and interpretation as separate, differently-trusted rows. |
+| A20 | (within A13 full text) | Recognition vs recall asymmetry — synthesis row | — | Standing 1973 abstract: recognition superior, picture superiority holds in recognition; Tulving & Thomson 1973: recognition and recall dissociate (recognition failure of recallable words); Brady et al. 2008 Discussion: familiarity vs recollection unresolved but either way 2AFC taps stored detail. | Dissociation literature is large and partially contradictory; no single mechanism agreed. | — | RELEVANT_SECTIONS (via A12/A13/A7 readings) | ★★★ The asymmetry transfers almost directly: Rune's memory search IS recognition (ranked similarity against stored traces), never recall (generation from a trace). Design the memory for recognition: distinctive, foil-discriminating embeddings + FTS5 terms; do not rely on the agent "re-deriving" content from gist. |
+
+### Part B — Multimodal representation learning
+
+| # | ID (verified) | Title / authors / year / venue | Modality | Key claims | Negative results / limitations (from the paper itself) | Similarity semantics / version comparability | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| B1 | arXiv:2103.00020 | Learning Transferable Visual Models From Natural Language Supervision (CLIP) — Radford, Kim, Hallacy, Ramesh, Goh, Agarwal, Sastry, Askell, Mishkin, Clark, Krueger, Sutskever 2021, arXiv (OpenAI) | image+text | 400M web (image,text) pairs (WIT); contrastive InfoNCE-style symmetric cross-entropy over N×N pairings in-batch; linear (not MLP) projection to joint embedding space; temperature learned, log-parameterized, clipped at 100; batch 32,768; zero-shot transfer: matches ResNet-50 on ImageNet (76.2% zero-shot, 95% top-5) with no ImageNet labels; robustness to natural distribution shift exceeds same-accuracy supervised models (ImageNet-R 88.9, ObjectNet 72.3, IN-Sketch 60.2, IN-Vid 95.3 PM0 — zero-shot beats supervised SOTA on 5 of 7 shift datasets). | **Section 6 Limitations (read verbatim):** zero-shot CLIP only on average matches a linear classifier on ResNet-50 features; weak on fine-grained classification (car models, flower species, aircraft variants); "struggles with more abstract and systematic tasks such as counting"; near-random on novel tasks like distance-to-nearest-car; poor OOD generalization (MNIST 88% — beaten by logistic regression on raw pixels; SVHN 51%); brittle to low-res/blurry digits and repeated characters; also: no mechanism for few-shot (zero→few-shot transition can *drop* performance); validation-set reuse during development ("not true zero-shot"); dataset suite "haphazardly assembled... co-adapted with development of CLIP". Appendix E: OCR strong only for digitally rendered text; image-retrieval direction weaker than text-retrieval. | Similarity = "which in-batch caption goes with this image" ranking; cosine scores are uncalibrated, class-prompt-dependent (prompt engineering worth ~5 points avg over 36 datasets). | RELEVANT_SECTIONS (§1–2, §6, App. E read in full; §3.1/3.3 partially, via HTML) | ★★★ CLIP-style space is the default candidate for Rune's screenshot/derivation embeddings, but the verified limitation list maps 1:1 onto coding-agent assets: screenshots ARE rendered text (good), but fine-grained distinctions (v1 vs v2 of a UI, line-level diffs), counts, and spatial relations (§6) are exactly what code artifacts need. Do not let one CLIP vector be the *only* index for such distinctions. |
+| B2 | arXiv:2102.05918 | Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervision (ALIGN) — Jia, Yang, Xia, Chen, Parekh, Pham, Le, Sung, Li, Duerig 2021, ICML 2021 | image+text | 1B noisy alt-text pairs, no filtering; simple dual-encoder contrastive; SOTA image-text retrieval (Flickr30k, MSCOCO) incl. beating some cross-attention models; zero-shot classification; noisy multilingual and image+text query retrieval. | Noise-tolerant but retrieval on MS-COCO overall-SOTA not reached in zero-shot; alt-text distribution is skewed (boilerplate, SEO text) — similarity inherits alt-text semantics. | Same contrastive ranking semantics as CLIP; noisy-text training makes text side semantics broader but sloppier. | ABSTRACT_ONLY (arXiv abs verified) | ★★ Establishes that *scale of noisy pairs* substitutes for curation — relevant to Rune: you can build bridges from cheap derived captions of screenshots; noise is absorbed by scale, but not by 944 entries. |
+| B3 | arXiv:2303.15343 | Sigmoid Loss for Language Image Pre-Training (SigLIP) — Zhai, Mustafa, Kolesnikov, Beyer 2023, ICCV 2023 Oral | image+text | Replaces softmax (global view) with a pairwise sigmoid loss operating only on in-pair terms; allows batch-size decoupling; SigLiT 84.5% ImageNet zero-shot with 4 TPUv4 in 2 days; benefits of batch size saturate (~32k sufficient); enables studying examples-vs-pairs and negative:positive ratio. | Empirical engineering result; notes (from abstract) that growing batch benefits diminish quickly. No fundamental semantic change vs CLIP. | Same joint-space semantics; loss shape slightly alters score calibration; still ranking-oriented. | ABSTRACT_ONLY (arXiv abs verified) | ★★ Two implications: (a) modern Rune-relevant CLIP-line models (SigLIP-based, e.g., in recent VLMs) exist and differ in training dynamics from classic CLIP; (b) batch-normalization dependence means score scales are model-specific — another reason cross-model score mixing is unsafe. |
+| B4 | arXiv:2305.05665 | ImageBind: One Embedding Space To Bind Them All — Girdhar, El-Nouby, Liu, Singh, Alwala, Joulin, Misra 2023, CVPR 2023 (Highlighted) | image, text, audio, depth, thermal, IMU | FULL mechanism verified: six modalities, but training uses ONLY image-paired data (image-text from web; video-audio from Audioset; image-depth from SUN RGB-D; image-thermal from LLVIP; video-IMU from Ego4D); image+text encoders frozen from OpenCLIP ViT-H; each other modality gets a small ViT/Transformer encoder aligned to *image* embeddings via symmetric InfoNCE. **Emergent claims verified quantitatively:** text↔audio zero-shot ESC top-1 66.9 (vs supervised AudioCLIP 68.6, i.e., comparable but NOT above absolute SOTA 97.0); emergent audio→video retrieval R@1 only **6.8** vs 36.8 when audio+video combined; emergent zero-shot far below absolute SOTA on every benchmark (e.g., NYU-D 54.0 vs 76.7; K400 50.0 vs 89.9). Embedding arithmetic (image+audio → retrieval) works qualitatively. Emergent alignment improves as the image encoder scales (ViT-B→H: +4–7 points). | Limitations section (read verbatim): embeddings "lag the performance of specialist models" because trained without a specific downstream task; "research prototype and cannot be readily used for real world applications"; thermal data limited to outdoor street scenes, depth to indoor scenes (dataset coverage gaps propagate to the space); regression-to-CLIP objective underperforms contrastive. The "binds all modalities" claim is real but is *hub-mediated through images*, not pairwise-full-rank training. | Cross-modal similarity exists for unpaired modality combos but is weakest precisely for pairs with no co-occurrence in any single instance; distances not calibrated; audio↔text is emergent-approximate. | RELEVANT_SECTIONS (method, experiments, ablations, discussion+limitations, appendix read) | ★★★ Central architecture evidence. Even the most aggressive "one space" system (a) anchors everything to ONE hub modality (images) via frozen CLIP, (b) produces emergent cross-modal ties that are strictly weaker than direct pairing, and (c) relies on the hub being web-scale-trained. For Rune: a hub-anchored joint space is viable (hub = text/code), but emergent untrained-pair retrieval must be treated as approximate, never as ground truth. |
+| B5 | arXiv:2203.02053 | Mind the Gap: Understanding the Modality Gap in Multi-modal Contrastive Representation Learning — Liang, Zhang, Kwon, Yeung, Zou 2022, NeurIPS 2022 | image+text (+video, medical, protein spaces shown) | **Modality gap is real and general:** image and text embeddings occupy two separate regions of the shared space ("at arm's length"), across CLIP and other contrastive multimodal models. Verified mechanism: (1) **cone effect** — any deep-net embedding set occupies a narrow cone (mean pairwise cosine 0.56/0.47/0.51 for ResNet/ViT/text-T; <2^-512 of the 512-d hypersphere surface); this holds even with random weights (cosine 0.99 for random ResNet) and random inputs — so the gap is NOT caused by data distribution; (2) different random initializations create *different* cones (25 inits → 25 distinct cones); (3) contrastive optimization *preserves* the gap: CLIP's loss landscape at its learned temperature (1/100) has a global minimum exactly at the observed gap distance 0.82, with a repulsive structure; higher temperature closes the gap; mismatched-pair data is a forming factor. **Implications (read):** deliberately *increasing* the gap (0.82→0.97) reduced denigration bias for all races, and modified gap improves *some* zero-shot tasks — direction is task-dependent (CIFAR10 ↑, CIFAR100 ↓, EuroSAT ↓). | Authors explicitly state it is "not our goal to propose a method to close the gap, since it's not clear that it's desirable to have no modality gap." Gap-closing is not a quality metric. | **Consequence for distance meaning:** a cross-modal cosine (image-vs-text) and a within-modality cosine (text-vs-text) do NOT live on the same scale; zero cosine does not mean "unrelated"; cross-modal distance has a nonzero offset by construction. | RELEVANT_SECTIONS (§1–5 read incl. tables; proofs skimmed) | ★★★ Highest-leverage ML finding for Rune: (a) never compare/mix scores across modalities without calibration; (b) "distance 0.9 across modality" ≠ "distance 0.9 within modality"; (c) the modality gap is a property of *every* dual-encoder — including future Rune text-vs-screenshot spaces — and is temperature- and initialization-dependent; (d) it is partly frozen at initialization: two encoders trained on the SAME data still separate. |
+| B6 | arXiv:2206.04769 | CLAP: Learning Audio Concepts From Natural Language Supervision — Elizalde, Deshmukh, Al Ismail, Wang 2022, arXiv (Microsoft) | audio+text | Dual-encoder contrastive language-audio; 128k pairs; SOTA zero-shot across 16 tasks/8 domains (sound events, music, speech); removes fixed-label constraint. | Trained with *far* fewer pairs than CLIP (128k vs 400M) — abstract-level: weaker generalization surface; audio concepts are vaguer than image captions. | Ranking semantics; scale-limited calibration. | ABSTRACT_ONLY (arXiv abs verified) | ★ Template for audio derivation (voice notes / meeting audio → text-keyed retrieval) if Rune ever ingests audio. |
+| B7 | arXiv:2211.06687 | Large-scale Contrastive Language-Audio Pretraining with Feature Fusion and Keyword-to-Caption Augmentation (LAION-CLAP) — Wu, Chen, Zhang, Hui, Nezhurina, Berg-Kirkpatrick, Dubnov 2022 (v4 2024), arXiv | audio+text | 633,526 audio-text pairs (LAION-Audio-630K); feature fusion for variable-length audio; keyword-to-caption augmentation; superior text-to-audio retrieval; SOTA zero-shot audio classification. | **Independent negative evidence on perceptual fidelity (verified):** Deng, Pardo & Pappas 2025 (arXiv:2510.14249, abstract read) evaluate MS-CLAP/LAION-CLAP/MuQ-MuLan: "the overall strength of this alignment remains limited, suggesting that current joint language-audio embeddings capture perceptual timbre semantics only partially." | Ranking semantics; timbre-level detail demonstrably under-encoded. | ABSTRACT_ONLY (both papers) | ★★ Same lesson as CLIP §6: coarse semantics yes, fine perceptual structure no — for Rune, do not expect fine-grained distinctions (e.g., two similar error beeps, two similar UI chimes) from a joint space. |
+| B8 | arXiv:2004.12832 | ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT — Khattab & Zaharia 2020, SIGIR 2020 | text (multi-vector) | Late interaction: encode query and document *independently* into per-token vectors; score via cheap fine-grained interaction (MaxSim) at query time; offline-precomputable document vectors → ANN-indexable end-to-end retrieval; competitive with cross-encoder BERT ranking at 2 orders of magnitude less latency, 4 orders fewer FLOPs. | Storage cost of multi-vector (the known trade-off, acknowledged in paper's efficiency analysis); interaction is hand-designed (MaxSim), not learned. | Similarity = max over token-pair dot products: NOT a single calibrated score; supports phrase-level and exact-match structure that single-vector models blur. | ABSTRACT_ONLY (arXiv abs verified) | ★★★ Grounds the ColPali line (arm 2): late interaction is the middle path between "one vector per artifact" and "re-run the model per query" — for Rune, per-patch/per-region multi-vector screenshots preserve layout detail that a single CLIP vector provably loses (B1 §6). |
+| B9 | arXiv:2407.01449 | ColPali: Efficient Document Retrieval with Vision Language Models — Faysse, Sibille, Wu, Omrani, Viaud, Hudelot, Colombo 2024, ICLR 2025 | page-image+text (multi-vector) | Documents are visually rich; text-extraction pipelines are "lengthy and brittle" and miss visual cues (figures, layout, fonts); embed page *images* directly with a VLM producing multi-vector embeddings + late interaction; outperforms modern document-retrieval pipelines on ViDoRe; simpler and end-to-end trainable. | Abstract-level only (arm 2 owns deep read); multi-vector storage and VLM cost are the acknowledged trade-offs. | Late-interaction scores; image-side vectors; per-page. | ABSTRACT_ONLY (arXiv abs verified; brief mention only per mandate) | ★★ Directly relevant to Rune's PDF flattening problem: Rune currently destroys layout at ingestion; ColPali evidence says page-image indexing beats text-extracted indexing for visually rich docs — arm 2 decides. |
+| B10 | arXiv:2109.14084 | VideoCLIP: Contrastive Pre-training for Zero-shot Video-Text Understanding — Xu, Ghosh, Huang, Okhonko, Aghajanyan, Metze, Zettlemoyer, Feichtenhofer 2021, EMNLP 2021 | video+text | Contrastive pretraining over temporally overlapping video-text pairs with hard negatives from nearest neighbors; zero-shot SOTA on retrieval, VideoQA, action localization/segmentation. | Zero-shot, label-free — but built on temporally overlapping positives only (short windows); long-video/long-description gap documented by successors (VideoCLIP-XL 2024: pretraining "on brief summary texts... prevents CLIP from understanding long descriptions", verified abstract). | Ranking semantics; temporal alignment coarse. | ABSTRACT_ONLY (arXiv API feed verified: title+authors+abstract) | ★★ Evidence that video→frame/sentence compression loses temporal and long-description structure. NOTE: the ID 2106.01844 sometimes circulated for VideoCLIP is WRONG (it is a magnetism paper) — caught in verification. |
+| B11 | arXiv:2212.03191 | InternVideo: General Video Foundation Models via Generative and Discriminative Learning — Wang, Li, Li, He, Huang, et al. 2022, arXiv technical report | video+text | SOTA video foundation model by *combining* masked video modeling (generative) and video-language contrastive (discriminative) with learnable coordination; 91.1% K400, 77.2% SSv2; SOTA on 39 video datasets. | The architecture itself is the admission: video-language contrastive ALONE is insufficient for temporal understanding — temporal supervision must come from masked video modeling. | Dual-objective; video tokens. | ABSTRACT_ONLY (arXiv abs verified) | ★★ Confirms: what is lost when video becomes frames or text is the temporal axis, and it is not recoverable from frame-level contrastive embeddings alone. |
+| B12 | (evidence cluster: B1 Tables 19–20 + B5 §2.3/§4.4) | Model-version comparability of embeddings — synthesis row | all | Direct verified evidence that embeddings from different CLIP versions are NOT comparable: (1) CLIP's own hyperparameter tables (read in full): embedding dimension differs by version — RN50: 1024-d, RN101: 512-d, ViT-B/32: 512-d, ViT-L/14: 768-d — vectors are not even dimension-compatible across versions; (2) Liang et al.: the cone orientation is determined by *random initialization*, so two independently initialized encoders (even same architecture, same data) produce systematically different geometries; CLIP-vs-OpenCLIP initialization in ImageBind (B4) required frozen-image-anchor training precisely because the spaces differ. | No dedicated public benchmark of cross-version embedding interoperability was found in this arm's searches; the dimension + initialization evidence is strong but the *practical degradation curve* (how bad is score-mixing?) is not quantified by any verified source here. | Mixed-version similarity is undefined/unanchored. | RELEVANT_SECTIONS (B1 tables read; B5 experiments read) | ★★★ URGENT for Rune: current sqlite-vec embeddings record NO model/version. Since different initializations and dimensions make vectors incomparable, Rune cannot safely re-embed partially, upgrade models, or mix old and new vectors. The atlas design must stamp (model_id, model_version, space_id) per embedding row and rebuild the index wholesale on model change. |
+
+**Source count / depth tally:** 31 rows (A1–A20, B1–B12, counting A20 and B12 as synthesis rows built on already-read sources): FULL_PAPER ×1 (A13 Brady et al.); RELEVANT_SECTIONS ×5 (A10 Zacks 2007; B1 CLIP; B4 ImageBind; B5 modality gap; B12 cluster); ABSTRACT_ONLY ×12 (A5, A9, A12, A16, A17, B2, B3, B6, B7, B9, B10, B11); METADATA_VERIFIED ×13 (A1, A2, A3, A4, A6, A7, A8, A11, A14, A15, A18, A19, and A13-adjacent records). Zero sources cited without at least metadata verification.
+
+---
+
+## 2. Synthesis
+
+### 2.1 Human findings worth keeping — with their transfer failures stated alongside
+
+1. **Weight evidence by measured reliability, not by modality status** (A5 Ernst & Banks; A4 Alais & Burr). The one robust, mathematically explicit human result: fusion quality = f(per-cue variance), and "visual dominance" is just the low-variance case. *Transfer failure:* humans have noise-free measurement of psychometric variances and a nervous system implementing them; Rune has NO calibrated confidence for its embeddings (B5: distances are uncalibrated; B1: scores are ranking scores). So MLE fusion cannot be imported; only the *principle* — record per-source reliability as data, let fusion use it — transfers.
+2. **Recognition ≫ recall; design for recognition** (A12 Standing; A13 Brady; A20 synthesis). Recognition survives with foil-level detail; recall fails long before. Rune's entire Memory surface is already recognition (retrieval over FTS5+vec index), and the human evidence says that is the *easy* direction: it rewards storing distinctive, foil-discriminating traces. *Transfer failure:* Brady's capacity numbers describe optimal-encoding humans under 2AFC; Rune's real constraint is inverted — storage is cheap, attention (context budget) is scarce. Keeping "massive detailed memory" because humans can is a non sequitur; keeping *detailed indexes* for recognition is justified.
+3. **Event boundaries are the memory anchors** (A10 Zacks et al. 2007, verified behavioral evidence). Frames at event boundaries are better remembered; cuts placed at boundaries help, at non-boundaries they hurt; segmentation quality predicts later memory. *Transfer failure:* EST's mechanism (prediction-error gating via PFC/ACC) has no Rune analog and should not be simulated. What transfers is the *data property*: Rune's events (commits, message turns, task steps) are already explicit boundaries; attach and chunk multimodal evidence by those boundaries rather than by arbitrary windows.
+4. **Source monitoring must be explicit, because humans' implicit version is exactly what fails** (A6 Johnson et al.; A18 Loftus & Pickrell; A19 Loftus 2005). Human source attribution is heuristic and reconstruction-based, hence misinformation effects. *Transfer failure of the reverse kind:* this is a case where the human mechanism should be considered a *known bug* — Rune should build the explicit source-tagging that humans lack. Preserve source, derive interpretation, never merge the two kinds of row.
+5. **Paired representations help robustness, conditionally** (A14 Childers & Houston; A15 Paivio 1991; with mandated criticism). Picture superiority and dual coding are real but boundary-limited (task-, material-, population-dependent). *Transfer failure:* the human effects are about *human* encoding and comprehension; Rune's "readers" are retrieval and LLM context assembly. The safe weakened transfer: verbal+visual traces give redundant retrieval routes; there is no evidence for the strong form ("always store both").
+
+### 2.2 What contrastive joint embeddings preserve and what they lose (verified)
+
+**Preserved:** open-vocabulary semantic alignment between modalities (B1); zero-shot transfer to untrained datasets/tasks at the *category/prompt* level (B1, B2); robustness to natural distribution shift *relative to same-accuracy supervised models* (B1 §3.3 verified numbers); emergent cross-modal alignment for untrained modality pairs when anchored on a strong hub (B4, quantified but modest); compositional arithmetic of semantics (B4, qualitative).
+
+**Lost (all verified from the papers, not folklore):** fine-grained discrimination — car/flower/aircraft variants (B1 §6); counting and other systematic/abstract tasks (B1 §6); spatial relations; handwritten/low-quality digits and OCR outside rendered-text domain (B1 §6, MNIST beaten by raw-pixel logistic regression); timbre-level perceptual structure in audio spaces (B7 negative evidence); long temporal structure and long descriptions in video (B10/B11: frame-level contrastive misses the temporal axis; masked video modeling needed to recover it); layout/visual cues in documents when flattened to text — the very loss Rune's ingestion currently bakes in (B9).
+
+**What similarity MEANS in these spaces:** the training objective is in-batch paired-vs-unpaired *ranking*. Cosine similarity inherits that semantics: monotone in "does this caption plausibly go with this image among thousands of distractors", not a probability of shared meaning (B1, B5). The modality gap (B5) adds a geometric offset between modality cones: cross-modal and within-modality similarities are on different scales, and even *zero* cosine does not mean "unrelated". SigLIP (B3) changes the loss shape, further decoupling score scales across model families. Practical rule for the Atlas: similarities are good for ranking within a fixed model+modality+prompt setup; they are NOT calibrated evidence grades, NOT comparable across model versions (B12), and NOT comparable across modalities without a calibration layer.
+
+### 2.3 One universal space vs modality-specific indexes + a bridge — what the evidence says
+
+The evidence, stated without preference:
+
+1. **A shared space is achievable but is always hub-mediated.** ImageBind (B4) — the strongest "one space" claim in the literature — does not train a universal space; it trains five modality encoders to imitate a frozen, web-scale image encoder. Its cross-modal abilities for pairs never seen in training are real but strictly inferior to direct pairing (emergent audio→video R@1 6.8 vs 36.8 combined; emergent zero-shot below absolute SOTA everywhere). Verdict from evidence: a single space built from image-anchored training works, *conditional on a strong hub and a huge paired corpus* — conditions Rune (944 entries) cannot meet.
+2. **Even within a trained joint space, modalities do not interpenetrate.** Liang et al. (B5): modality gap is present at random initialization, preserved by the contrastive loss, and *closing it is not necessarily better* — deliberately widening it improved some zero-shot results and reduced bias. Verdict: a universal space is not even the stated ideal of its own foundational analysis; the gap is functional geometry, not a defect to eliminate.
+3. **Fine structure survives better as multi-vector late interaction than as single fused vectors.** ColBERT (B8) retains token-level detail while staying ANN-indexable; ColPali (B9) shows this beats text-extraction pipelines for visually rich documents — which is precisely Rune's current flattening weakness. Verdict: where fidelity matters (documents, screenshots, diffs), per-region/per-patch vectors of the *source modality* beat one universal vector.
+4. **Calibration and versioning are the hard parts, not the embedding.** Distances are uncalibrated (B1/B5/B7) and version-incomparable (B12, including dimension mismatches: 512/768/1024 within one model family). Any cross-modal or cross-version comparison requires an explicit bridge: either a learned projection (as in cross-lingual embedding alignment, used by Liang et al. §4.4) or an anchor record.
+
+**Evidence-supported verdict:** the literature supports **modality-specific indexes (preserving per-modality fine structure, multi-vector where fidelity matters) plus a learned or anchored bridge for cross-modal queries**, with strict (model_id, version, modality) stamping — rather than one universal embedding space. The universal-space option is supported only when a web-scale hub (images/text) and massive paired data exist and coarse semantics suffice; ImageBind's own numbers show emergent cross-modal ties degrade exactly where Rune would need precision (fine-grained distinction, counting, spatial relations). This is a statement of what the evidence supports, not a design decision — arm 2 (document line) and the Atlas hold the decision.
+
+---
+
+## 3. Transfers considered and REJECTED (12)
+
+1. **MLE/Bayesian cue combination as Rune's evidence-fusion step.** Rejected: Ernst & Banks requires measured psychometric noise per cue; Rune's embeddings produce uncalibrated ranking scores, not variances. The transferable part (store per-source reliability) was kept; the mechanism was not.
+2. **"Visual dominance"-style fixed modality hierarchy** (e.g., "the screenshot wins over the log line"). Rejected: even in humans, dominance is an *outcome* of reliability, not a rule (A5); in Rune, which artifact is reliable is task-dependent. Would encode a bug.
+3. **Event segmentation via prediction-error models (EST port).** Rejected: importing a recurrent prediction network to find boundaries duplicates what Rune already has — explicit structural events (commits, turns, task steps). A10's mechanism lives in a nervous system with continuous perception; Rune's stream is discrete by construction. The *boundary-anchoring of evidence* was kept.
+4. **Forgetting curves / decay for Memory pruning.** Rejected: A13's power law of forgetting and general forgetting research describe biological decay and interference; Rune's storage does not degrade. Pruning is a policy/economics decision; dressing it in Ebbinghaus math would be anthropomorphic decoration.
+5. **Episodic consolidation / hippocampal replay analogs** (e.g., "sleep" phases that re-embed memories). Rejected: consolidation reorganizes traces to combat forgetting and interference; Rune has neither mechanism nor the benefit. Any re-embedding pass is a *version migration* (B12), not consolidation.
+6. **Context-dependent retrieval keyed on environmental reinstatement** (Godden & Baddeley-style "recall where you learned it"). Rejected twice over: (a) the classic effect failed direct replication (A17 Murre 2021 + addendum — negative result included deliberately); (b) Rune's "contexts" (repo, task, session) are explicit queryable fields, not incidental ambient states. Keep context as data; do not build reinstatement magic.
+7. **Picture-superiority as a storage policy** ("prefer screenshots over text because pictures are remembered better"). Rejected: A14/A15 show the effect is task- and population-conditional, and Rune's consumers are indexes/LLMs, not human perceivers. The correct policy driver is B9: page-image indexing wins for *visually rich* documents specifically, not for all content.
+8. **Dual-coding: store every artifact twice (image vector + verbal summary) unconditionally.** Rejected in strong form: no verified evidence that doubling representations helps at Rune's scale, and storage/consistency costs are real. Weak form kept: paired verbal+visual traces improve retrieval robustness where the two capture different attributes (A15, with boundary conditions attached).
+9. **McGurk-style automatic cross-modal binding at query time** (fuse screenshot+caption into one percept before ranking). Rejected: human binding is pre-attentive and calibrated by lifelong experience; Rune's cross-modal retrieval over emergent bindings is quantifiably weak (B4: emergent audio→video R@1 6.8) and uncalibrated (B5). Fusion must be an explicit, provenance-preserving derivation — and even then, never overwrite the sources (A18 misinformation lesson).
+10. **Human confidence/metacognition as arbitration between conflicting memories.** Rejected: human confidence is malleable and reconstructive (A18/A19), and embedding scores have no calibration (B1/B5) — "higher similarity wins" would silently institutionalize both error sources. Conflicts should be surfaced with provenance to the reasoning loop, not resolved by an uncalibrated score.
+11. **Two separate memory "systems" mirroring familiarity vs recollection.** Rejected: the human dissociation is disputed even on its own terms (A13 Discussion: "remains disputed"), and Rune has exactly one substrate — an index. One index, two query paths (fast vector ranking; exact FTS/ID lookup), not two systems.
+12. **"Store everything at Brady-level detail because human memory can."** Rejected: A13's regime is optimal encoding with human-scale attention spent at study time; Rune's bottleneck is the inverse (storage cheap, context attention scarce). The atlas should optimize *retrievability per attention token*, not fidelity per artifact.
+
+---
+
+## 4. Do-not-cite register / verification incidents
+
+**Mis-paired identifiers caught during verification (do not use the wrong forms):**
+- arXiv **2203.15420** — circulated/assumed for "Mind the Gap"; actually a beam-space ISAC signal-processing paper. Correct ID: **2203.02053** (verified via arXiv API title+authors+abstract).
+- arXiv **2106.01844** — assumed for VideoCLIP; actually a ferrite-nanoparticle magnetism paper (Phys Rev B). Correct: **2109.14084** (verified via arXiv API).
+- DOI **10.1111/j.2044-8295.1975.tb01472.x** — not Godden & Baddeley; correct: **10.1111/j.2044-8295.1975.tb01468.x** (Crossref-verified with abstract).
+- DOI **10.1037/h0084271** — not Paivio 1991; correct: **10.1037/h0084295** (Crossref-verified).
+- DOI **10.1037/h0035528** — not Tulving & Thomson 1973; correct: **10.1037/h0020071** (Crossref-verified).
+- DOI **10.1086/208916** — not Childers & Houston; correct: **10.1086/209001** (Crossref-verified).
+
+This empirically confirms the mandate's warning: title–ID pairing from search/UI results is unreliable; six of ~20 spot-checked guesses were wrong.
+
+**Unverifiable in this pass — do not cite without independent verification:**
+- **Eich 1995, "Searching for mood-dependent memory" (Psychological Science 6(2):67–75).** Mentioned in the mandate; Europe PMC title search returned zero hits and no DOI was confirmed within this arm's budget. The *general* claim that mood-dependence effects are weak/fragile is supported by the verified Murre 2021/2022 records for the adjacent context-dependence literature — cite Murre, not Eich, for the negative result.
+- **Godden & Baddeley 1980 second underwater study / 1978 classroom follow-ups.** Referenced in the Murre 2021 reference list (verified existence as citations only); the papers themselves were not independently verified. Cite only via Murre 2021.
+- **Wade, Garry, Read & Lindsay 2002, "A picture is worth a thousand lies."** Not verified in this pass (not fetched). Use A18/A19 for misinformation evidence instead.
+- **Dedicated benchmark quantifying cross-version embedding degradation.** Searched (arXiv API, Europe PMC); no such verified source found in this arm. The incomparability claim in B12 rests on verified dimension tables (CLIP) and initialization-cone geometry (Liang et al.) — both load-bearing and read — but the *practical* degradation magnitude is unquantified. Any architecture-changing claim of the form "mixing versions loses X% recall" needs a new source.
+
+**Access failures recorded honestly:**
+- Ernst & Banks 2002 full text: paywalled at Nature; no open-access PDF (Unpaywall status CLOSED; mirror attempt 404). Depth stays ABSTRACT_ONLY despite the mandate's preference — the quantitative experiment details (variance measurement procedure, MLE integrator fitting, conflict-condition results) were NOT read at full depth and should be read by anyone making an architecture-changing claim from A5.
+- Reynolds, Zacks & Braver (EST computational model) and Boltz 1992 / Schwan & Garsoffky 2004: read only as evidence reported *within* A10's full text; not independently verified as primary sources.
+
+---
+
+## 5. Handoff notes to other arms
+
+- **Arm 2 (documents/ColPali):** the B9 abstract-level support and B8 late-interaction grounding are here; deep ViDoRe numbers are deliberately yours. Rune's PDF→text flattening is the exact failure mode B9 names.
+- **Claims ledger:** architecture-changing claims from this arm that are FULL_PAPER/RELEVANT_SECTIONS anchored: (i) recognition-oriented index design (A13); (ii) boundary-anchored evidence chunking (A10); (iii) modality-gap/distance-semantics handling (B5); (iv) version stamping of embeddings (B12 + B1 tables); (v) hub-mediated joint spaces only approximate (B4). ABSTRACT_ONLY-anchored and needing upgrade before architecture decisions: MLE-fusion principle (A5), context-dependence (A16/A17 — though the negative result is solid), video temporal loss (B10/B11).

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm2_retrieval_rag.md

@@ -0,0 +1,176 @@
+# Memory Research Atlas R1 — Domain #403 AB, Arm 2: Multimodal Retrieval / RAG / Memory
+
+**Project**: Rune (stateful coding agent, text-only canonical Memory: SQLite FTS5 + sqlite-vec, ~944 entries, ~118k chunks, embeddings with NO recorded model/version; PDF ingestion flattens to text, layout destroyed)
+**Arm scope**: Modern multimodal retrieval, multimodal RAG, audio/video retrieval, OCR reliability, cross-modal indexing architecture. Builds on Arm 1 (CLIP/ALIGN/SigLIP/ImageBind/CLAP foundations; Liang 2203.02053 modality gap) — those are NOT re-covered here.
+**Prior constraint inherited from Domain #383 (IR)**: at n≈924 the multi-stage retrieval cascade is a scale artifact; the fit is score-everything (BM25+metadata+dense fused) + cross-encoder rerank top-k + sufficiency-gated abstention; dense-lane value at small corpus unmeasured.
+
+**Verification discipline note**: every arXiv ID below was verified against arxiv.org/abs/<id> or the arXiv export API (`export.arxiv.org/api/query`) before inclusion. **Four additional mis-pairings were caught during this arm** (candidates whose "known" IDs resolved to unrelated papers), confirming the Atlas hazard Arm 1 reported. See §5 Do-not-cite register.
+
+---
+
+## 1. Per-source rows
+
+Read-depth legend: FULL_PAPER > RELEVANT_SECTIONS > ABSTRACT_ONLY > METADATA_VERIFIED > DOCUMENTATION_AUDITED.
+
+### 1a. Document retrieval / OCR-free line (priority)
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2407.01449 | ColPali: Efficient Document Retrieval with Vision Language Models | Faysse, Sibille, Wu, Omrani, Viaud, Hudelot, Colombo — 2024, ICLR 2025 | Page-image → multi-vector retrieval (late interaction over PaliGemma-3B token embeddings, D=128) | (1) ViDoRe benchmark (10 tasks, page-level); (2) ColPali avg **81.3 nDCG@5** vs best OCR-pipeline baseline (Unstructured+OCR BM25 **65.5**, Unstructured+Captioning BGE-M3 **67.0**) — ~+14–16 pts; (3) biggest gains exactly where text extraction loses signal: ArxivQ (figures) 79.1 vs OCR 31.6, InfoQ (infographics) 81.8 vs 62.9, TabFQuAD (tables) 83.9 vs 70.8 (BGE-M3+OCR), Shift (charts, French, zero-shot) 73.2 vs 64.3; (4) **ColQwen2 (768) ablation in v6: 86.6 avg** vs ColPali 81.3; (5) query latency ≤22 ms on L4; ingestion much faster/simpler than parser+OCR+caption pipelines | (a) On **text-dominant** financial pages (TAT-DQA) the gap nearly vanishes: OCR 62.7 vs ColPali 65.8 (+3.1); (b) BiPali (fine-tuned bi-encoder) sometimes *hurts* vs plain SigLIP (Energy −11.7); (c) ColSigLIP variants collapsed (~3.2 avg) — training instability of naive late-interaction variants; (d) low-res input destroys it: ColPali at 224px = 56.5 avg vs 81.3 at 448px | Trained/evaluated on page-level QA-style queries, not agentic exact-match queries; multi-vector store is ~1030 vectors/page at 448px (heavier than single-vector); needs GPU for indexing; benchmark queries are VLM-generated (Claude-3 Sonnet) for practical tasks | RELEVANT_SECTIONS (abstract, §2–5, results tables, ablation tables C.2, interpretability; §5.2 latency section read via HTML, some middle text omitted) | **Anchor for the whole arm.** Directly quantifies what Rune's flatten-to-text PDF ingestion loses (figures/tables/layout: +10 to +48 nDCG). Also shows OCR-first is *fine* on text-dense pages — the verdict is conditional, not absolute. ColQwen2 result shows **model/version shifts scores by >5 points** → Rune's unversioned embeddings are unreproducible |
+| arXiv:2406.11251 | Unifying Multimodal Retrieval via Document Screenshot Embedding (DSE) | Ma, Lin, Li, Chen, Lin — 2024, EMNLP 2024 main | Single-vector screenshot embedding (EVA-CLIP + LLM layer, 1.3M Wiki-SS corpus) | Screenshot-as-unified-input removes parsing entirely; Wiki-SS (text-intensive): **+17 pts top-1 over BM25**; mixed-modality slide retrieval: **+15 nDCG@10 over OCR-text retrieval** | On text-intensive Wikipedia pages DSE is only "competitive" with text retrieval — visual embeddings do not beat strong text retrieval when the page is prose | Single-vector (loses fine-grained layout matching vs late interaction); Wiki-SS is web screenshots, not scanned PDFs | ABSTRACT_ONLY | Second independent confirmation of the OCR-first loss number on slides (+15) and the "text-only pages ≈ parity" boundary |
+| arXiv:2410.10594 | VisRAG: Vision-based Retrieval-augmented Generation on Multi-modality Documents | Yu, Tang, Xu, Cui, Ran, Yan, Liu, Wang, Han, Liu, Sun — 2024/2025, Tsinghua | VLM-based RAG: embed page images → retrieve → feed image to VLM generator | **20–40% end-to-end gain over text-based RAG** on multi-modality docs; eliminates parsing information loss; strong generalization from limited training data | (implicit) gains concentrate on visually rich docs; text RAG remains competitive on plain text | End-to-end gain bundles retrieval *and* generation improvements; generator is a VLM (GPU-heavy) | ABSTRACT_ONLY | Quantifies the retrieval-loss → answer-quality pipeline effect Rune's flattening causes |
+| arXiv:2411.04952 | M3DocRAG: Multi-modal Retrieval is What You Need for Multi-page Multi-document Understanding | Cho, Mahata, Irsoy, He, Bansal — 2024 (UNC/IBM) | Open-domain multi-page DocVQA: ColPali retrieval + Qwen2-VL 7B generation | Works open-domain over **3,000+ PDFs / 40,000+ pages** (M3DocVQA benchmark); SOTA on MP-DocVQA; handles multi-hop and image-only evidence; comprehensive ablations of indexing/models/retrievers | Existing DocVQA methods fail when evidence is in figures or spread across pages (motivating result) | Indexing ablations show choices matter; generation still needs a 7B VLM | ABSTRACT_ONLY | Evidence that ColPali-style page retrieval **scales beyond toy corpora** to ~40k pages — far past Rune's needs, so scale is no objection |
+| arXiv:2504.08748 | A Survey of Multimodal Retrieval-Augmented Generation | Mei, Mo, Yang, Chen — 2025 | Survey: MRAG components, datasets, evaluation, limitations | MRAG reduces hallucination and outperforms text-only RAG when visual+textual understanding is required; systematizes retriever/generator/fusion taxonomy | Identifies open problems: modality alignment, evaluation gaps | Survey-level, no new measurements | ABSTRACT_ONLY | Map of the field for the Atlas; confirms visual-RAG is an established 2024–26 line, not a fad |
+| arXiv:2210.02928 | MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Text | Chen, Hu, Chen, Verga, Cohen — 2022, EMNLP 2022 | One transformer accessing an external **non-parametric multimodal memory** (text + images) via frozen retrievers | First multimodal retrieval-augmented transformer; **+10–20% absolute** over existing models on WebQA and MultimodalQA under distractor and full-wiki settings | — | Pre-LLM-era (T5/FLAN-size generator); retrieval over web QA corpora | ABSTRACT_ONLY | The "multimodal external memory" concept Rune's Memory would extend; evidence that mixed-modality retrieval into a generator works with a frozen retriever |
+| arXiv:2311.17136 | UniIR: Training and Benchmarking Universal Multimodal Information Retrievers | Wei, Chen, Chen, Hu, Zhang, Fu, Ritter, Chen — 2023 | Instruction-guided universal multimodal retriever; M-BEIR benchmark (8 tasks, 10 datasets) | Multi-task training + instruction tuning give zero-shot generalization to new retrieval tasks; single model covers text→image, image→text, etc. | Single-task models beat the universal one per-task (universal ≠ best specialist) | CLIP-style dual-encoder granularity; coarse page/region level | ABSTRACT_ONLY | If Rune ever indexes screenshots + audio + text in one index, instruction-guided universal retrieval is the pattern; but per-lane specialists remain stronger at small n |
+| arXiv:2608.07006 | Does More Retrieved Evidence Help Visual RAG with Diffusion Language Models? | Wang, Gao, Zhang, Fu, Bai, Gao — 2026 | Evidence-admission for visual RAG | Retrieving more pages raises answer-page **recall** but unconditionally passing them to the generator **reduces accuracy** (semantic conflict between visual sources); entropy-based candidate filter (ECF) recovers +2.62 pts over best fixed top-k | **Negative result: more visual context ≠ better answers** | Diffusion-LM-specific mechanism (ECF) | ABSTRACT_ONLY | Directly supports Rune's sufficiency-gated abstention / selective-context design in the multimodal case: admission control survives modality change |
+| arXiv:2007.00398 | DocVQA: A Dataset for VQA on Document Images | Mathew, Karatzas, Jawahar — 2020, WACV 2021 | 50k questions on 12k+ document images | Baseline VQA/reading-comprehension models show a large gap to human 94.36%; models specifically fail where **document structure understanding is crucial** | Models "perform reasonably" only on questions not requiring structure | Pre-VLM baselines; dataset paper | ABSTRACT_ONLY | The 2020 root evidence that structure (layout) is load-bearing for document QA — the thing flattening destroys |
+| arXiv:2204.08387 | LayoutLMv3: Pre-training for Document AI with Unified Text and Image Masking | Huang, Lv, Cui, Lu, Wei — 2022, ACM MM | Text+layout+image pre-training for Document AI (forms, receipts, DocVQA, layout analysis) | Unified masking + word-patch alignment gives SOTA on text-centric AND image-centric doc tasks | — | Requires OCR+layout input upstream (it is a *consumer* of OCR output, not a replacement); encoder, not retriever | ABSTRACT_ONLY | LayoutLM family (v1 1912.13318 → v3) is the OCR-era answer to structure: it still needs the parser pipeline ColPali removes; useful as the "OCR-first + layout model" compromise lane |
+
+### 1b. Multi-vector / late interaction (text-line evidence backing the visual line)
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2004.12832 | ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT | Khattab, Zaharia — 2020, SIGIR | Token-level multi-vector passage retrieval | Late interaction ≈ BERT cross-encoder effectiveness with 2 orders-of-magnitude faster queries and 4 orders fewer FLOPs; supports end-to-end vector-index retrieval | — | Multi-vector space cost (pre-v2) | ABSTRACT_ONLY | The architectural license for ColPali; also supports Rune rerank-by-MaxSim at small n |
+| arXiv:2112.01488 | ColBERTv2: Effective and Efficient Retrieval via Lightweight Late Interaction | Santhanam, Khattab, Saad-Falcon, Potts, Zaharia — 2021/2022, NAACL | Compressed multi-vector (residual) retrieval | SOTA in- and out-of-domain at the time; **6–10× space reduction** makes multi-vector storage tractable | — | Residual-compression index complexity | ABSTRACT_ONLY | Storage objection to multi-vector at Rune scale is small (944 pages ≈ ~1M vectors even uncompressed — trivial for a workstation) |
+
+### 1c. Audio / speech retrieval and memory
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2212.04356 | Robust Speech Recognition via Large-Scale Weak Supervision (Whisper) | Radford, Kim, Xu, Brockman, McLeavey, Sutskever — 2022 | ASR: 680k h weakly supervised, seq2seq, timestamps at 20 ms quantization | Zero-shot robustness: avg **12.8 WER** (large-v2) vs wav2vec-2.0 29.3 on 12 datasets (**55.2% relative error reduction**); approaches human robustness; long-form WER: TED-LIUM3 3.5, Earnings-22 12.6, CORAAL 19.6 | Long-form failure modes are **non-perceptual**: repeat loops, dropped first/last words of a window, "complete hallucination where the model will output a transcript entirely unrelated to the actual audio" (§6); decoding heuristics (beam+temperature fallback, no-speech prob 0.6 + avg logprob −1.0, initial-timestamp constraint) are explicitly "a workaround for the noisy predictions" (§4.5); WER normalization itself can shift scores up to ~50% | Timestamp quantization 20 ms; 30-s window design → segmentation is external to the model; no speaker diarization (explicitly listed as external pipeline component, §2.3) | RELEVANT_SECTIONS (abstract, §1–3, §4.5, §6 limitations, Appendix D long-form tables via HTML) | **Anchor.** Timestamped transcripts are the natural retrieval substrate for audio, BUT the documented hallucination/repeat-loop modes mean Rune must segment with VAD and keep non-speech probabilities — a bare 30-s window transcript is unsafe to index |
+| arXiv:2303.00747 | WhisperX: Time-Accurate Speech Transcription of Long-Form Audio | Bain, Huh, Han, Zisserman — 2023, INTERSPEECH | Long-form ASR + word-level timestamps via VAD + forced alignment | Buffered/sliding-window Whisper "prone to drifting, hallucination & repetition"; VAD Cut&Merge improves transcription quality AND enables **12× batched speedup**; SOTA long-form + word segmentation benchmarks | Confirms Whisper's native long-form decoding degrades without segmentation | Alignment model needed for word timestamps | ABSTRACT_ONLY | The engineering answer for Rune: **VAD-segmented, timestamped** transcript chunks are the retrieval unit, not raw windows |
+| arXiv:2402.08021 | Careless Whisper: Speech-to-Text Hallucination Harms | Koenecke, Choi, Mei, Schellmann, Sloane — 2024, FAccT (DOI 10.1145/3630106.3658996) | Hallucination audit of Whisper | **~1% of transcriptions contain entirely hallucinated phrases/sentences** absent from the audio; **38% of hallucinations include explicit harms** (violence, false authority); hallucinations disproportionately hit speakers with longer non-vocal durations (aphasia) | Direct negative: fluent-but-false transcripts at ~1% base rate even in ordinary use | English-language study; transcription-service framing | ABSTRACT_ONLY | For a memory system, a 1% hallucination rate compounds silently; retrieved transcript evidence needs provenance (timestamp + audio pointer) so hallucinated text can be checked against audio |
+| arXiv:2505.12969 | Calm-Whisper: Reduce Whisper Hallucination On Non-Speech By Calming Crazy Heads Down | Wang, Alhmoud, Alsahly, Alqurishi, Ravanelli — 2025, Interspeech | Hallucination attribution + fix | **3 of 20 decoder heads account for >75% of non-speech hallucinations** (UrbanSound); fine-tuning them cuts non-speech hallucination >80% with <0.1% WER cost on LibriSpeech | Confirms hallucination is a systematic decoder pathology, not random noise | Fine-tuning-based fix | ABSTRACT_ONLY | Even patched, non-speech handling needs VAD; if Rune records meetings/music-adjacent audio this is the relevant failure class |
+| arXiv:2606.07473 | Whisper Hallucination Detection and Mitigation via Hidden Representation Steering and Sparse AutoEncoders | Aparin, Popov, Sadekova, Yermekova — 2026 | Hallucination detection/mitigation in activation space | Hallucination is linearly separable in Whisper encoder activations; SAE steering cuts non-speech hallucination **72.63% → 14.11% (small)** and **86.88% → 27.33% (large-v3)** on full non-speech test sets, with small speech WER cost | Establishes baseline non-speech hallucination rates are **~73–87%** on non-speech audio — worst-case audio is unusable unmitigated | Research code, not production | ABSTRACT_ONLY | The hard-audio negative result: on non-speech input Whisper hallucinates most of the time; VAD gating before ASR is mandatory, not optional |
+| arXiv:2504.05702 | Evaluating Speech-to-Text Systems with PennSound | Wright, Liberman, Ryant, Fiumara — 2025 | Benchmark of AWS/Azure/Google/IBM/NeMo/Rev.ai/Whisper/Whisper.cpp on ~10 h varied poetry recordings | Rev.ai best WER; **Whisper best open-source "as long as hallucinations were avoided"**; AWS best DER; WER/DER differences slim; runtime options (speed vs accuracy) materially change outcomes | Whisper's ranking is conditional on hallucination avoidance — an operational caveat, not a footnote | Poetry recordings = hard-accent/noisy speech; small sample (10 h) | ABSTRACT_ONLY | Independent confirmation on genuinely hard audio that open Whisper is usable but hallucination-guarded |
+| arXiv:1911.01255 | pyannote.audio: neural building blocks for speaker diarization | Bredin et al. — 2019, ICASSP 2020 | Speaker diarization toolkit: VAD, speaker change detection, overlapped-speech detection, speaker embeddings | Pre-trained models reach SOTA on most of these subtasks; pipelines are composable/jointly optimizable | — | Diarization ≠ identification; DER on overlap remains hard | ABSTRACT_ONLY | Diarization supplies **speaker labels** on timestamped transcripts — a metadata lane, not a semantic lane |
+| docs.pyannote.ai | pyannoteAI platform docs (speaker diarization) | pyannote — current (fetched 2026) | Diarization API: "who spoke when" and "who is speaking" via voiceprints | Diarization is positioned as foundation for transcription accuracy, speaker-specific logic, downstream analytics | — | Vendor docs; API service framing | DOCUMENTATION_AUDITED | Confirms diarization's role is **metadata enrichment** (speaker turns) of the transcript substrate — Rune gets most value from timestamps + speaker turns, not from embedding raw audio |
+
+### 1d. Video / temporal retrieval
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2107.09609 | QVHighlights: Detecting Moments and Highlights in Videos via Natural Language Queries (Moment-DETR) | Lei, Berg, Bansal — 2021, NeurIPS | Temporal sentence localization / moment retrieval (NOTE: correct ID; the ID often quoted for this paper, 2108.09968, is a mis-pairing) | 10k+ YouTube videos with NL queries + moment spans + saliency; Moment-DETR casts moment retrieval as direct **set prediction** (DETR-style), no human priors; ASR-caption weak pretraining substantially improves results | Strong supervised "well-engineered" baselines competitive without priors; benchmark shows localization is far from solved | Depends on extracted video features + ASR captions (i.e., text substrate again) | ABSTRACT_ONLY | Moment retrieval = the query interface for "when did X happen in the recording"; its dependence on ASR captions reinforces transcripts-as-substrate |
+| arXiv:2403.15377 | InternVideo2: Scaling Foundation Models for Multimodal Video Understanding | Wang, Li, Li, et al. — 2024, ECCV 2024 | Video foundation model (masked video modeling + contrastive + next-token; up to 6B) | SOTA on 60+ video/audio tasks incl. long-video dialogue; **semantically segmenting videos and generating video-audio-speech captions** improves video-text alignment | — | 6B model — not workstation-deployable at full size | ABSTRACT_ONLY | Two lessons: (1) segmentation-then-caption (hierarchical) beats dense frame indexing; (2) the deployable derivative of this line for Rune is caption/ASR extraction, not the foundation model |
+| arXiv:2109.14084 | VideoCLIP: Contrastive Pre-training for Zero-shot Video-Text Understanding | Xu, Ghosh, Huang, Okhonko, Aghajanyan, Metze, Zettlemoyer, Feichtenhofer — 2021, EMNLP | Zero-shot video-text retrieval/QA/localization | Contrastive video-text pretraining with hard negatives from NN retrieval; zero-shot SOTA on retrieval, VideoQA, action localization/segmentation; sometimes beats supervised | — | Clip-level granularity; short clips (temporal overlap as positives) | ABSTRACT_ONLY | Clip-level dense semantic indexing is feasible zero-shot, but per-frame indexing is neither done nor needed anywhere in this line — clip/shot granularity is the norm (see §2 synthesis) |
+| arXiv:2508.09736 | Seeing, Listening, Remembering, and Reasoning: A Multimodal Agent with Long-Term Memory (M3-Agent) | Long, He, Ye, Pan, Lin, Li, Zhao, Li — 2025 | Multimodal agent memory: real-time visual+auditory input → entity-centric episodic+semantic memory; multi-turn retrieval+reasoning; M3-Bench (100 robot videos + 920 web videos, long-video QA) | Entity-centric **multimodal** memory organization beats prompting-agent baseline (Gemini-1.5-pro + GPT-4o) by **+6.7 / +7.7 / +5.3 points** on M3-Bench-robot / -web / VideoMME-long; RL training on memory-based reasoning | Strong prompting baselines already close — the memory-organization delta is real but single-digit | Video QA domain, not code-agent domain; benchmark small (100 robot videos) | ABSTRACT_ONLY | The closest published analogue to "Rune with eyes and ears": memory entries organized around **entities with multimodal bindings**, retrieved by multi-turn reasoning — a pattern transferable to Rune's entry schema (modality-specific payload + shared entity keys) |
+
+### 1e. OCR reliability
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| DOI 10.1109/icdar.2007.4376991 | An Overview of the Tesseract OCR Engine | R. Smith — 2007, ICDAR (Crossref-verified; 1517 citations) | OCR engine architecture | Tesseract's two-pass approach (character-level + language-model pass with fuzzy space resolution) became the open-source standard; its layout analysis was designed for *printed prose pages* | — | Pre-LSTM (Tesseract 4/5 changed the engine); 2007 | METADATA_VERIFIED (Crossref: title/author/venue/DOI/citations confirmed; full text paywalled) | Origin paper of the OCR engine Rune would use OCR-first; its own design scope (prose pages) is the boundary of where OCR-first works |
+| tesseract-ocr.github.io/tessdoc (User Manual + ImproveQuality) | Tesseract 5.x documentation | Tesseract maintainers — current | OCR operating envelope | Best at **≥300 DPI**; internal Otsu binarization "can be suboptimal, particularly if the page background is of uneven darkness"; skew "reduces line segmentation significantly"; **"It is known tesseract has a problem to recognize text/data from tables … without custom segmentation/layout analysis"**; PSM modes exist because default whole-page segmentation fails on sparse/non-prose layouts; dictionaries hurt non-prose text (codes, receipts) unless disabled | The docs themselves enumerate the failure classes: low DPI, uneven background, skew, tables, non-dictionary text, missing/oversized borders, transparency | Documentation, not benchmark numbers | DOCUMENTATION_AUDITED (both pages read in full) | Vendor-acknowledged failure classes map 1:1 onto the page types ColPali wins on (tables, infographics, layout-heavy) — OCR reliability is the *mechanism* behind the OCR-first loss |
+| arXiv:2409.01704 | General OCR Theory: Towards OCR-2.0 via a Unified End-to-end Model (GOT-OCR2.0) | Wei et al. — 2024 | Unified OCR for "all artificial optical signals": text, **math/molecular formulas, tables, charts, sheet music**, geometric shapes; 580M params | One end-to-end model outputs plain **or formatted** (markdown/tikz/smiles) results; region-level recognition guided by coordinates/colors; multi-page + dynamic resolution | Frames OCR-1.0 (incl. Tesseract-class tools) as "increasingly unable to meet usage" for non-plain-text signals | Small model — capability below frontier VLMs; no retrieval evaluation | ABSTRACT_ONLY | If Rune keeps an OCR lane, "OCR-2.0" models are the upgrade path that recovers math/table structure *as text* — a middle option between flattening and page-image retrieval |
+| arXiv:2011.05402 | OCR Post Correction for Endangered Language Texts | Rijhwani, Anastasopoulos, Neubig — 2020, EMNLP | OCR post-correction, data-scarce scripts | General-purpose OCR tools "are not robust" in data-scarce settings; tailored post-correction cuts recognition error **34%** on average across three languages | General OCR outright fails on low-resource scripts | Niche domain (endangered languages) | ABSTRACT_ONLY | Bounded evidence that OCR errors are systematic and domain-dependent → OCR output quality must be measured per Rune's actual document population, not assumed |
+| arXiv:2106.06831 | Toward the Optimized Crowdsourcing Strategy for OCR Post-Correction | Suissa, Elmalech, Zhitomirsky-Geffet — 2021/2020, Aslib J. of Information Management | Human/crowd correction of OCR in historical collections | 753-worker experiments: accuracy best with **paragraph-size units, two-phase, image shown next to text**; efficiency best with longer text, single-stage, no image; first systematic study of crowd OCR-correction strategy | Accuracy and efficiency optima **conflict** (image+two-phase accurate; no-image+single-stage efficient) | Historical documents; crowd settings, not agent settings | ABSTRACT_ONLY | **Closest found work to "user-corrected OCR propagation"**: humans correct OCR best when shown the source image alongside text — evidence FOR storing the page image alongside extracted text in Rune, so corrections (human or model) can be validated against the source. No work found on *propagating* user corrections through a retrieval index (→ gap, §4) |
+
+### 1f. Cross-modal indexing architecture
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| ResourceSpace knowledge base (metadata configuration, indexing-metadata, field types) | ResourceSpace DAM docs | Montala Ltd. — current | Production digital-asset-management pattern: metadata-first media search | Fields must be explicitly **indexed** to be searchable; **required-at-upload** metadata guarantees searchability; controlled vocabularies/category trees vs free text; separate "extracted text" channel exists *alongside* curated metadata | — | Vendor docs, single product | DOCUMENTATION_AUDITED | Production media systems ship exactly the hybrid Rune already has: **exact/structured metadata lookup coexisting with free-text/semantic search over extracted content**; the modality of the asset (image/audio/video) never replaces the metadata lane |
+| pyannote.audio + docs (see §1c) | — | — | — | — | — | — | — | (Counted once in §1c) |
+
+**Mis-pairings caught this arm (verified wrong via arxiv abs pages):** 2108.09968 → "On classical and quantum deformations of gauge theories" (hep-th), NOT Moment-DETR; 2404.16021 → "Critical beta-splitting, via contraction" (math.PR), NOT InternVideo2; 2109.04212 → "Efficient Nearest Neighbor Language Models" (EMNLP 2021), NOT VideoCLIP; 2007.00442 → Fermi pulsar search (astro-ph), NOT DocVQA. All four replaced with API-verified correct IDs above.
+
+---
+
+## 2. Synthesis
+
+### 2.1 When text extraction is enough vs when original visual structure is load-bearing
+
+**Text extraction is enough (evidence-backed boundary):**
+
+1. **Text-dominant pages.** On TAT-DQA (dense financial-report pages), ColPali beats the OCR pipeline by only **+3.1 nDCG@5** (65.8 vs 62.7) — within noise of the visual advantage [2407.01449 Table 2]. DSE is only "competitive" (not dominant) on text-intensive Wikipedia pages [2406.11251]. Prose PDFs, native-text PDFs (no scan), and code files lose almost nothing to flattening.
+2. **Clean printed prose at adequate scan quality.** Tesseract's envelope: ≥300 DPI, level background, deskewed, prose page segmentation [tessdoc/ImproveQuality, DOCUMENTATION_AUDITED]. Smith's engine was architected for exactly this case [ICDAR 2007].
+3. **Exact-match queries.** None of the visual retrieval papers evaluate literal identifier/code lookup; BM25/FTS5 remains the only lane that guarantees it. (Open boundary — no paper in this arm tests exact-match on visual retrievers.)
+
+**Original visual structure is load-bearing (with measured losses when destroyed):**
+
+1. **Figures / scientific charts**: ColPali ArxivQ 79.1 vs OCR 31.6 (**2.5×**) [2407.01449]. DocVQA baselines specifically fail where "understanding structure of the document is crucial" [2007.00398].
+2. **Infographics / slide decks**: InfoQ 81.8 vs 62.9 (+18.9); DSE on slide retrieval **+15 nDCG@10 over OCR text retrieval** [2407.01449; 2406.11251].
+3. **Tables as layout**: TabFQuAD 83.9 vs 70.8 (+13.1 for ColPali over BGE-M3 on OCR text); Tesseract *documentation itself* concedes table recognition fails "without custom segmentation/layout analysis" [2407.01449; tessdoc]. The failure is vendor-acknowledged, not a benchmark artifact.
+4. **Multi-column / forms / receipts**: the LayoutLM line exists precisely because flattened text loses reading order; ColPali's Government/Healthcare/Energy tasks (multi-column administrative PDFs) show +18.9 to +29.1 over OCR pipelines [2204.08387; 2407.01449 Table 2].
+5. **Handwriting**: no strong quantitative row in this arm (bounded gap, §4) — but endangered-language and historical-document results show general OCR is "not robust" off its training distribution [2011.05402], and Tesseract docs offer no handwriting mode.
+6. **Aggregate end-to-end effect**: VisRAG reports **20–40% end-to-end answer gain** over text-RAG on multimodal documents [2410.10594]; M3DocRAG shows the pattern extends to 40k+ pages open-domain [2411.04952].
+
+**Rune-specific application**: Rune's PDF flattening destroys structure *unconditionally*. The evidence says the damage is concentrated in exactly the artifact classes a coding agent ingests: spec decks (slides), architecture diagrams, dashboard screenshots, benchmark tables, scanned forms. For pure source code and prose docs, flattening is fine. A per-artifact triage (native-text vs scanned vs visual-rich) is evidence-supported; a blanket assumption either way is not.
+
+### 2.2 Does multimodal change the #383 cascade verdict? — **No. It strengthens it.**
+
+#383 concluded that at n≈924 the multi-stage cascade (BM25 → dense → rerank funnel) is a scale artifact, and score-everything + rerank + sufficiency-gated abstention is the fit. The multimodal evidence confirms and extends this:
+
+1. **The corpora where visual retrieval is evaluated are Rune-sized, not web-sized.** ViDoRe practical tasks use **1,000 documents per task** (100 queries); academic tasks 160–1,600 [2407.01449 Table 1]. M3DocRAG's "open-domain" setting is 3k docs/40k pages [2411.04952]. State-of-the-art multimodal retrieval is *routinely* scored-everything at exactly n≈10²–10⁴. There is no published evidence that multimodal retrieval *needs* a pruning cascade at this scale — the SOTA method itself is "embed every page, late-interact with every query."
+2. **Late interaction at n≈944 is computationally free.** 944 pages × ~1,030 multi-vectors ≈ 1M × 128-dim vectors (~0.5 GB fp16) — ColBERTv2 compression makes it 6–10× smaller [2112.01488]. MaxSim scoring of all 944 pages per query is milliseconds-scale on the 16 GB workstation GPU (ColPali reports ≤22 ms query latency on an L4 *including* query encoding [2407.01449]). The scale artifact #383 identified cannot re-emerge by adding a modality at this corpus size.
+3. **Multimodal *removes* a pipeline stage rather than adding one.** ColPali's core industrial finding: the ingestion pipeline (parser → layout → OCR → chunk → caption) was the bottleneck, and page-image embedding eliminates it [2407.01449 §1, Fig. 2]. A cascade is a runtime analogue of that same pipeline; both are unnecessary structure at small n.
+4. **What changes is not the cascade but the lanes.** Multimodality adds *parallel lanes* (text FTS, metadata, page-image dense), all scored simultaneously — which is precisely score-everything fusion, not a cascade. Admission control stays at the *context-construction* boundary: ECF-style evidence shows more retrieved visual pages can *lower* answer accuracy via semantic conflict, so sufficiency-gating/selective admission is still required *after* scoring [2608.07006].
+5. **One caveat with evidence**: single-lane dense visual models that are *not* late-interaction (vanilla SigLIP 51.4, Jina-CLIP 17.7, Nomic-vision 12.9 avg nDCG@5) are dramatically worse than BM25-on-OCR-text (65.5) [2407.01449 Table 2]. So "add a dense lane" must mean **multi-vector late interaction** (or a doc-specific fine-tuned bi-encoder like BiSigLIP 58.6), not a generic CLIP-style embedding. This is the same conclusion #383 reached for the text lane: lane quality > lane count.
+
+**Recommendation for multimodal at small scale**: keep the #383 verdict verbatim — score-everything fused across lanes (FTS5 text, metadata, and any visual lane) + rerank top-k + sufficiency-gated abstention. Do not build a multimodal cascade. Do not add a single-vector CLIP lane as the visual dense component.
+
+### 2.3 Minimal multimodal retrieval architecture for Rune (per the evidence)
+
+Given: n≈924, one 16 GB-VRAM workstation, local-first, text-first agent.
+
+1. **Lane A (exists): FTS5 text + metadata — keep.** Exact-match/code/prose strength; the only lane with exact lookup guarantees (DAM production pattern: structured metadata + extracted text coexist) [ResourceSpace docs].
+2. **Lane B (new, cheap, high leverage): stop destroying layout at ingestion — store it.** For every PDF, persist: source file, page images (rendered at ≥448 px — ColPali loses 25 points at 224 px), OCR/extraction output **with page + bbox provenance**, and a document-class tag (native-text / scanned / visual-rich). This is metadata + provenance, costs no GPU, and enables every downstream choice [2407.01449 resolution ablation; 2106.06831 image-next-to-text correction].
+3. **Lane C (new, conditional): visual page retrieval only for visual-rich artifacts.** ColPali-class multi-vector page embeddings, applied to the tagged visual-rich subset, not the whole corpus. Storage: even 10k pages ≈ 10M 128-d vectors — fine locally with ColBERTv2-style compression. GPU: PaliGemma-3B-based ColPali fits in 16 GB bf16; ColQwen2 (86.6 avg) needs a 7B/8B VLM — tighter, consider quantization. Rerank, don't cascade: MaxSim scores are cheap enough to compute over all visual pages at n≈944 [2407.01449; 2112.01488; 2411.04952].
+4. **Rerank with late interaction, fused with Lane A.** ColPali similarity maps give interpretable per-query-token evidence (which patch matched) — useful for agent-facing provenance [2407.01449 §5.3].
+5. **Context admission (unchanged from #383, now multimodal): sufficiency-gated, selective.** Unconditional multi-page visual context measurably hurts generation [2608.07006]. Abstain/ask when the fused scores don't clear a sufficiency bar.
+6. **Audio: transcripts-as-substrate with mandatory guards.** VAD-segment (WhisperX Cut&Merge) → Whisper with timestamp tokens (20 ms quantization) → store segments as text chunks with start/end timestamps + no-speech probability + audio-file pointer. Diarization (pyannote) adds speaker-turn metadata. Hallucination controls are non-optional: ~1% hallucinated sentences in normal audio [2402.08021], 72–87% hallucination rate on non-speech input [2606.07473], long-form repeat loops/dropped words [2212.04356 §6]. Keep timestamp+audio provenance so any transcript line can be re-checked against audio.
+7. **Video: shot/segment granularity, never per-frame.** Every video line in scope (Moment-DETR on ASR captions, InternVideo2's semantic segmentation + captions, VideoCLIP clip-level) uses segment-level units; per-frame indexing appears nowhere and is infeasible at real durations. For Rune: keyframes + timestamped ASR transcripts as the indexable units; moment retrieval (set-prediction over timestamps) is the query interface if video memory is ever added [2107.09609; 2403.15377; 2109.14084].
+8. **Record embedding model + version per lane.** ColPali vs ColQwen2 differ by >5 nDCG on identical data [2407.01449 Table 7]; Whisper versions shift WER (large vs large-v2); Rune's current unversioned sqlite-vec embeddings are unreproducible and un-upgradable. This is a mandatory schema fix before any dense-lane addition.
+9. **Agent-memory schema (from M3-Agent):** entity-centric organization with modality-specific payloads bound to shared entities, and multi-turn retrieval at answer time — the only published agent-memory result specifically for multimodal streams, and its gains (+5–8 pts) come from organization, not from bigger models [2508.09736].
+
+---
+
+## 3. Rejected / considered-and-dropped approaches
+
+1. **Generic CLIP/SigLIP single-vector page embedding as Rune's visual dense lane.** Vanilla SigLIP 51.4, Jina-CLIP 17.7, Nomic-vision 12.9 avg nDCG@5 vs 65.5 for BM25-on-OCR — non-late-interaction contrastive embeddings lose to text retrieval on documents [2407.01449 Table 2]. (Arm 1's modality-gap work predicts this.)
+2. **Caption-everything ingestion.** Unstructured+Captioning (Claude-3 Sonnet captions of visual elements) reaches only 67.0 vs ColPali 81.3, at far higher indexing cost [2407.01449]. Captioning is a lossy, expensive middle ground; kept only as a fallback for video (where captions are the substrate).
+3. **DSE-style single-vector screenshot embedding as the visual lane.** Viable (+17 top-1 on Wiki-SS, +15 nDCG@10 on slides) but strictly weaker granularity than late interaction and outperformed by ColPali-class models on ViDoRe; would only be chosen if VRAM were smaller [2406.11251].
+4. **Replacing the text lane with visual retrieval wholesale.** No evidence: text-dominant pages show near-parity, exact-match queries are untested on visual retrievers, and code (Rune's core artifact) is not a page-image problem. Hybrid lanes retained.
+5. **LayoutLM-style OCR+layout encoder pipeline as the fix.** It improves structure understanding but *requires* the parser+OCR pipeline upstream — it patches the symptom inside the pipeline ColPali-class methods delete [2204.08387 vs 2407.01449].
+6. **GOT-OCR2.0 as a mandatory ingestion stage.** Attractive (structured output for math/tables, 580M params, region-level) but adds a pipeline stage whose output still feeds text retrieval; deferred to "if Lane C is too heavy" status [2409.01704].
+7. **Per-frame video indexing.** No supporting evidence anywhere in the surveyed line; segment/shot-level is universal [2107.09609; 2403.15377].
+8. **Raw-audio embeddings as a first-class Memory index.** The strongest documented failure modes (hallucination, repeat loops) live in the audio→text step, and all retrieval value observed is realized in transcripts + timestamps + speaker metadata. Raw-audio similarity (CLAP, Arm 1) stays a niche lane, not the substrate.
+9. **Universal single retriever across all modalities (UniIR-style).** Zero-shot breadth is appealing, but per-task specialists beat it and Rune's tasks (code exact-match, doc pages, meeting transcripts) are heterogeneous enough that fused specialist lanes are strictly better-evidenced [2311.17136].
+10. **A multi-stage retrieval cascade for multimodal lanes.** Rejected on §2.2 evidence: SOTA multimodal retrieval is itself score-everything at Rune's scale; the cascade is a scale artifact that multimodality does not resurrect.
+
+---
+
+## 4. Gaps and bounded zero-hits
+
+1. **User-corrected OCR error propagation into a retrieval index** — **BOUNDED ZERO-HIT.** Searched arXiv ("OCR post-correction", title field, all years): 9 results, all about offline corpus correction (crowdsourcing strategy, endangered languages, seq2seq correction). No work found on (a) capturing user corrections of OCR/ASR output inside an agent memory and (b) propagating them through the retrieval index (e.g., correction-aware re-ranking or re-embedding). Closest evidence: crowd correction works best with the source image next to the text [2106.06831] → store page images to make corrections verifiable. This appears to be an open niche and a plausible original contribution for Rune.
+2. **Tesseract quantitative accuracy on handwriting / multi-column / low-res** — no controlled benchmark found in this arm's pass; only the vendor's qualitative failure-class admission [tessdoc] and domain-shift evidence [2011.05402]. Cloud OCR evals not pursued (rate limits/priority).
+3. **Handwriting-specific retrieval numbers** — absent from ViDoRe and this arm's corpus; treat "OCR fails on handwriting" as directionally supported but **without a measured number** in this report.
+4. **Dense-lane value at n≈924 for the *text* lane** — still unmeasured (inherited from #383); this arm adds that the *visual* dense lane's value is measured at comparable n (ViDoRe), which partially de-risks the text question.
+5. **VLM reranking of multimodal candidates as a distinct stage** — found only embedded in RAG pipelines (retriever→generator), not as a standalone rerank evaluation; no separate source row.
+
+---
+
+## 5. Do-not-cite register
+
+| Item | Reason |
+|---|---|
+| arXiv 2108.09968 as "Moment-DETR" | Mis-pairing: resolves to "On classical and quantum deformations of gauge theories" (hep-th). Correct Moment-DETR ID: 2107.09609 (verified via arXiv API) |
+| arXiv 2404.16021 as "InternVideo2" | Mis-pairing: resolves to "Critical beta-splitting, via contraction" (math.PR). Correct: 2403.15377 |
+| arXiv 2109.04212 as "VideoCLIP" | Mis-pairing: resolves to "Efficient Nearest Neighbor Language Models" (EMNLP 2021). Correct: 2109.14084 |
+| arXiv 2007.00442 as "DocVQA" | Mis-pairing: resolves to a Fermi pulsar search (astro-ph). Correct: 2007.00398 |
+| ColQwen/ColQwen2 as independent papers | No standalone paper verified in this arm; ColQwen2 is verified only as an ablation row in ColPali v6 Table 7 (86.6 avg nDCG@5). Cite as "ColPali v6, Table 7", never as a separate paper |
+| Any 2025–26 "visual RAG survey" other than 2504.08748 | Only one survey title-matched and abstract-verified in this arm; do not cite survey titles from memory |
+| Whisper WER numbers from blog posts / model cards | Only §3/Appendix D table values from the paper HTML and peer-reviewed audits (2402.08021, 2504.05702, 2505.12969, 2606.07473) are citable |
+| M3-Agent as "solved multimodal agent memory" | Verified but n=100 robot-video benchmark; cite as directional evidence only |
+
+---
+
+## 6. Verification appendix
+
+- arXiv abs pages fetched and matched (title/authors/abstract): 2407.01449, 2212.04356, 2410.10594, 2411.04952, 2210.02928, 2204.08387, 2004.12832, 2112.01488, 2508.09736, 2406.11251, 2311.17136, 2409.01704.
+- arXiv HTML full text fetched (deep reads): 2407.01449v6 (ColPali), 2212.04356v1 (Whisper) — both outputs partially truncated mid-paper; corresponding saved tool outputs inspected via grep for load-bearing sections (ColPali results/ablations; Whisper §4.5/§6/Appendix D).
+- arXiv export API (title/all-field) searches used for ID verification: Moment-DETR/QVHighlights, WhisperX, InternVideo2, VideoCLIP, DocVQA, pyannote.audio, MRAG survey, Whisper-hallucination set, OCR post-correction set, visual-RAG recent set.
+- Crossref: Smith 2007 (DOI 10.1109/icdar.2007.4376991) — metadata verified.
+- Documentation audited: tesseract-ocr.github.io/tessdoc (User Manual + ImproveQuality), docs.pyannote.ai, resourcespace.com knowledge base (metadata configuration/indexing).
+- Source count: **30 total** — RELEVANT_SECTIONS 2, ABSTRACT_ONLY 23, METADATA_VERIFIED 1, DOCUMENTATION_AUDITED 4 (tessdoc counted as one source spanning two pages; pyannote counted once as docs + once as paper).

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm3_reliability_security.md

@@ -0,0 +1,181 @@
+# Memory Research Atlas R1 — Domain #403 AB, Arm 3: Reliability / Provenance / Security / Lifecycle
+
+**Project**: Rune (stateful coding agent, text-only canonical Memory: SQLite FTS5 + sqlite-vec, ~944 entries, embeddings with NO recorded model/version; PDF ingestion flattens layout). **Arm scope**: multimodal hallucination beyond ASR, multimodal prompt injection (priority), steganography/covert channels, synthetic-media provenance (C2PA), metadata reliability, face/voice identity, sensitive-attribute inference, multimodal storage/lifecycle, model-version transitions. Builds on Arms 1–2 (CLIP/modality-gap; ColPali numbers; Whisper WER/hallucination) — NOT re-covered.
+
+**Verification discipline note**: every arXiv ID below was verified via the arXiv export API (`export.arxiv.org/api/query`) before inclusion. **Six additional mis-pairings were caught this arm** (candidate IDs resolving to unrelated papers): 2307.01380 (physics → actually a heterogeneous-groups paper, NOT an image-injection paper), 2309.17436 (graphene moiré superlattice, NOT "Image Hijacks"; real ID is 2309.00236), 2406.01184 (Biot-Allard poro-elasticity, NOT "Images are Achilles' Heel"), 2405.01532 (quantum channels, NOT StruQ; real ID is 2402.06363), 1810.07254 (RL criticality, NOT the Wang & Kosinski paper — which is not on arXiv at all; verified via Crossref DOI 10.1037/pspa0000098), 1812.06210 (differential-privacy training, NOT the Song/Shokri/Mittal inference-attacks paper — that paper's arXiv ID was never verified and it is NOT cited here). This matches the Atlas hazard pattern from Arms 1–2 (~16 total bad IDs now).
+
+**Bounded zero-hits (searched, no credible source found — recorded as gaps, not citations)**:
+- **Taint-through-transformation**: no dedicated paper found that studies whether OCR/caption/transcription output of a hostile image is treated as trusted downstream *in a persistent memory system and across sessions*. Closest indirect evidence exists (MMPIBench's OCR carrier; RIPA's OCR channel; Bad Characters; Greshake's "retrieved prompt = arbitrary code execution" framing) — see §2.1 verdict.
+- **Subtitle/codec injection in video**: arXiv search `all:"subtitle" AND all:"injection" AND cat:cs.CR` returned **0 results**. Adjacent coverage only via Bad Characters (invisible text characters) and VLM text-in-image obedience. No dedicated demonstrated attack paper found.
+- **LLM-era (2024–26) image steganography**: no verified dedicated paper located this session; classical LSB/coverless stego literature exists but was not individually verified — nothing cited for it here.
+- **PDF hidden-layer/metadata prompt injection as a dedicated study**: not found as a standalone paper; covered only inside general indirect-injection and MMPIBench carrier taxonomies.
+- **Embedding-index migration / dual-index reindexing practices in production**: no research paper found; only vendor documentation of model-specific embedding spaces ([OI] docs) — see §1h note.
+
+---
+
+## 1. Per-source rows
+
+Read-depth legend: FULL_PAPER > RELEVANT_SECTIONS > ABSTRACT_ONLY > METADATA_VERIFIED > DOCUMENTATION_AUDITED.
+
+### 1a. Multimodal hallucination (beyond ASR)
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2305.10355 | Evaluating Object Hallucination in Large Vision-Language Models (POPE) | Li, Du, Zhou, Wang, Zhao, Wen — 2023, EMNLP 2023 | Image captioning / VQA hallucination measurement | First systematic object-hallucination study of LVLMs. (1) CHAIR: LLaVA CHAIR_S **32.7** vs small VLPM OSCAR-base **13.0** — instruction-tuned LVLMs hallucinate MORE than smaller models; LLM-generated visual instruction data is a root cause (models hallucinate objects frequent or co-occurring in the instruction corpus: HR_A@10 ≈ 0.5, HR_C@10 ≈ 0.6 of hallucinated objects are top-10 frequent/co-occurring). (2) POPE converts evaluation to binary Yes/No polling with Random/Popular/Adversarial negative sampling; more stable than CHAIR (F1 std **±0.78** vs CHAIR_I **±3.22** across 4 prompt templates). (3) Three of five models (LLaVA, MultiModal-GPT, mPLUG-Owl) answer "Yes" ~**96–100%** of the time — F1 66.7–68.7 (Random) degrading to ~66–67 (Adversarial); InstructBLIP best (F1 89.3 → 78.5 Adversarial). Yes-response rate drops adversarially (InstructBLIP 55%→69% Yes) showing benchmark sensitivity | (a) CHAIR scores **double** between two semantically equivalent prompts (LLaVA 32.7→62.7) — caption-based hallucination measurement is instruction-unstable; (b) hallucination degree is **not** consistent with VQA performance (MiniGPT-4 better POPE F1 than LLaVA but much worse VQA) — fixing hallucination ≠ fixing capability; (c) SEEM-based (auto-segmented) POPE is harder than annotation-based (F1 71.4 vs 62.7) — measurement itself is pipeline-sensitive | Authors list: only object-level (not attributes/counts/positions); small image sample (500 imgs × 6 questions); matching-based Yes/No parsing can misfire; small model set, no closed models at time | **FULL_PAPER** (main text §1–7 read in full via ar5iv; references/appendix skimmed) | **Anchor for hallucination measurement.** If Rune ever captions/screenshots into memory, expect language-prior-driven false objects at high rates in unmitigated models; a polling-style verification (binary probe of stored claims against the image) is the validated cheap check pattern; never trust caption-derived entities without a probe |
+| arXiv:1809.02156 | Object Hallucination in Image Captioning | Rohrbach, Hendricks, Burns, Darrell, Saenko — 2018, EMNLP 2018 | Image captioning hallucination metric (CHAIR origin) | Introduces CHAIR (CHAIR_I instance-level, CHAIR_S sentence-level) using veridical ground-truth labels on MSCOCO; finds models scoring best on standard sentence metrics do **not** have lower hallucination; hallucination is largely **language-prior driven** (co-occurrence statistics), not visual misclassification | Best-bleu-scored models hallucinate more — standard metrics reward hallucination | Pre-LLM models (show-and-tell era); object-level only | ABSTRACT_ONLY | Metric lineage confirmed; the "language prior beats perception" mechanism is the durable finding that persists into LVLMs (per POPE's HR@k analysis) |
+| arXiv:2404.18930 | Hallucination of Multimodal Large Language Models: A Survey | Bai, Wang, Xiao, He, Han, Zhang, Shou — 2024/2025 | Survey of MLLM hallucination causes/benchmarks/mitigations | Systematizes hallucination in MLLMs: causes span training data, vision encoder, alignment module; catalogues benchmarks and mitigation families (instruction tuning, RLHF, decoding interventions, post-hoc correction) | Notes detection/mitigation remains open; benchmarks disagree | Survey; no new measurements | ABSTRACT_ONLY | Map of the mitigation families; confirms 2024–26 the field treats hallucination as unsolved-but-measurable, i.e., Rune must design for residual hallucination, not zero |
+| arXiv:2309.14525 | Aligning Large Multimodal Models with Factually Augmented RLHF (LLaVA-RLHF) | Sun, Shen, Cao, Liu, et al. — 2023 | Hallucination mitigation via RLHF + factual reward augmentation | RLHF with a factually-augmented reward (captions, ground-truth options) reduces hallucination and reward hacking; +60% on their MMHAL-BENCH over baselines; first RLHF-trained LMM | — | Reward model still learns from human/LLM labels; benchmark self-defined | ABSTRACT_ONLY | Evidence that grounding-informed rewards help; but training-side fixes are unavailable to Rune (it consumes models, doesn't train them) — Rune's mitigation must be at ingestion/retrieval boundaries |
+| arXiv:2310.16045 | Woodpecker: Hallucination Correction for Multimodal Large Language Models | Yin, Fu, Zhao, Xu, Wang, Sui, Shen, Li, Sun, Chen — 2023, Science China Information Sciences 2024 | Training-free post-hoc hallucination correction | Five-stage verifier pipeline (concept extraction → question formulation → visual validation → claim generation → correction); **+30.66% / +24.33% POPE accuracy** over MiniGPT-4 / mPLUG-Owl baselines with no retraining | Confirms mitigation without retraining is possible but multi-stage (costly) | Relies on the same model family for self-verification; benchmark = POPE (binary objects) | ABSTRACT_ONLY | The verifier/grounding pattern with measured gains; Rune-scale adaptation: probing claims against the source image at write-time is the evidence-backed cheap version |
+| arXiv:2406.18521 | CharXiv: Charting Gaps in Realistic Chart Understanding in Multimodal LLMs | Wang, Xia, He, Chen, Liu, Zhu, Liang, Wu, Liu, Liu, Malladi, Chevalier, Arora, Chen — 2024, Princeton | Chart QA benchmark on 2,323 real arXiv-paper charts | On realistic charts the strongest proprietary model (GPT-4o) reaches only **47.1%** on reasoning questions and strongest open model 29.2% vs **human 80.5%**; a light stress-test (slightly different charts/questions) degrades performance by up to **34.5%** — template benchmarks were over-optimistic | (a) Open models that *appear* to beat proprietary ones on template benchmarks collapse under stress; (b) all models far below humans on genuine chart reasoning | Descriptive vs reasoning question split; 2024 model set | ABSTRACT_ONLY | Chart misreading is severe at realistic difficulty. If Rune indexes charts/screenshots of dashboards, chart-derived numeric claims are the highest-risk memory content; prefer storing the underlying data/series text over chart descriptions |
+| arXiv:2203.10244 | ChartQA: A Benchmark for Question Answering about Charts with Visual and Logical Reasoning | Masry, Long, Tan, Joty, Hoque — 2022, ACL Findings | Chart QA (human + generated questions, 9.6k human questions) | Established that chart QA needs visual AND logical reasoning; 2022-era models showed a large gap on complex reasoning questions | Baselines weak on multi-step arithmetic over chart features | Pre-VLM baselines | ABSTRACT_ONLY | Root evidence for the chart-claims-are-risky rule; superseded in difficulty by CharXiv |
+
+### 1b. Multimodal prompt injection (arm priority)
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2302.12173 | Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection | Greshake, Abdelnabi, Mishra, Endres, Holz, Fritz — 2023, Saarland | Indirect prompt injection (text carriers) in LLM-integrated apps | Injection via *retrieved/processed data* (web pages, documents) demonstrated against Bing/GPT-4-powered systems; taxonomy: data theft, worming, ecosystem contamination; **"processing retrieved prompts can act as arbitrary code execution"** — retrieved content and instructions are conflated by design | Notes effective mitigations were lacking at publication | Pre-multimodal carriers (text); demos partly synthetic | ABSTRACT_ONLY | The foundational framing: anything Rune reads is code in the instruction channel. Every later multimodal carrier paper instantiates this |
+| arXiv:2307.10490 | Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs | Bagdasaryan, Hsieh, Nassi, Shmatikov — 2023, Cornell | Adversarial perturbation in images AND audio that steers MLLM output | Perturbations blended into images/audio make unmodified LLaVA/PandaGPT output attacker-chosen text and steer subsequent dialog when the user merely asks about the image/audio — the user prompt stays benign | — | PoC on LLaVA/PandaGPT; perturbation-style (not typographic); transferability limited | ABSTRACT_ONLY | Proof that the perceptual channel itself is an injection vector even without readable text — OCR-based sanitization alone cannot catch it |
+| arXiv:2309.00236 | Image Hijacks: Adversarial Images can Control Generative Models at Runtime | Bailey, Ong, Russell, Emmons — 2023/2024, UC Berkeley | Optimized image "hijacks" controlling VLM behavior | Behaviour/Prompt-Matching algorithms craft images that force VLMs to (1) emit attacker outputs, (2) **leak context-window information**, (3) **override safety training**, (4) believe false statements — all with **>80% success** on LLaVA from small perturbations | — | Optimized per model (white-box-ish); LLaVA-era | ABSTRACT_ONLY | The context-exfiltration + false-belief attack classes map directly onto memory poisoning: an adversarial screenshot can implant false statements or exfiltrate private memory content |
+| arXiv:2306.13213 | Visual Adversarial Examples Jailbreak Aligned Large Language Models | Qi, Huang, Panda, Henderson, Wang, Mittal — 2023, Princeton | Visual adversarial examples vs aligned LLMs | Vision input is a **weak link**: a single optimized image can *universally* jailbreak an aligned vision-integrated LLM into harmful content beyond its optimization corpus — adversarial objectives transfer from misclassification to full behavior control | — | Requires gradient access to vision encoder; 2023 models | ABSTRACT_ONLY | Even where Rune's stack reads no text, the image encoder is the bypass; model-internal defenses cannot be assumed |
+| arXiv:2402.19150 | Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Models | Cheng, Xiao, Gu, Yang, Duan, Zhang, Cao, Xu, Xu — 2024, ECCV 2024 | Typographic (embedded-text) attacks on commercial + open LVLMs | Typographic attacks (text rendered into images) are **widespread across commercial and open LVLMs**; largest typographic dataset to date; mechanism analysis; a mitigation reduces performance degradation from **42.07% to 13.90%** | Even the best mitigation leaves ~14% degradation — no clean fix shown | Mitigation is training/attention-based, model-specific | ABSTRACT_ONLY | Text-in-images is *transcribed and obeyed* by current models as a rule, not an edge case. Rune's screenshots regularly contain text → this is the default attack surface |
+| arXiv:2504.04893 | SCAM: A Real-World Typographic Robustness Evaluation for Multimodal Foundation Models | Westerhoff, Purelku, Hackstein, Loos, Pinetzki, Rodner, Hufe — 2025, CVPR 2025 Workshop / DMLR 2026 | Real-world typographic attacks (1,162 handwritten/real images, hundreds of categories) | Typographic attacks **remain effective against SOTA LVLMs**, especially those with vulnerable vision encoders; larger LLM backbones reduce (not remove) vulnerability; synthetic attacks ≈ real handwritten attacks | Vulnerability persists in 2025 SOTA; architecture of the vision encoder is a main susceptibility factor | Object-recognition task focus | ABSTRACT_ONLY | Independent 2025 confirmation with *real-world* (not synthetic) images: the failure mode survives model generations — design for it, don't wait for model fixes |
+| arXiv:2609.04533 | Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection | Chen, Tsai, Evtimov, Chaudhuri, Popa, Wagner, Zharmagambetov, (Meta/Berkeley) — 2026 | Black-box ADAPTIVE visual prompt injection against frontier VLMs | Adaptive black-box image injection achieves ASR **>82%** on open-weight frontier models and **47%** on commercial frontier VLMs (GPT-5.5-class) for harmful behavior/PII exfiltration/malicious tool calls, with benign user prompts unrelated to the injected task; transfers across commercial VLMs; demonstrated end-to-end on a real agent: injected image overwrites TOOLS.md → future RCE + secret exfiltration | — | 2026 frontier models; attack is adaptive (the hard case) | ABSTRACT_ONLY | **The Atlas "defenses fail under adaptive attack" lesson, in the visual domain.** Note the TOOLS.md/Memory-file overwrite pattern: exactly Rune's threat. Enforcement cannot live in the model |
+| arXiv:2609.09404 | An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks (MMPIBench) | Nguyen, Husain — 2026 | Benchmark of six visual carriers (OCR text, overlays, **EXIF metadata**, **QR codes**, fake interfaces, hybrids) across 6 agent frameworks × 5 foundation models, 720 runs; audio extension | Attacks **attempted in 12.8%** of runs but **completed in ~1%** for vision — the gap closes at the *planning* step (model reads and declines). Model >> framework for safety (one model never attempts; two attempt in 23.6%). **Audio channel is far weaker defended: attack completes in 49% of cells, 75% for one model** — completion-rate reporting alone understates exposure | (a) ~99% of visual injections are caught at planning by current models — a rare *positive* result, but only for non-adaptive fixed attack sets; (b) audio bypasses that defense line almost entirely | Fixed (non-adaptive) attack set; the authors themselves warn completion-understates-exposure | ABSTRACT_ONLY | Carrier taxonomy directly relevant to Rune (screenshots carry OCR text; EXIF and QR are real carriers); the vision-vs-audio defense asymmetry matters if Rune ingests audio. Positive planning-layer result is conditional on non-adaptive attacks — pair with Repeat-After-Me |
+| arXiv:2403.02691 | InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents | Zhan, Liang, Ying, Kang — 2024, ACL Findings | IPI benchmark: 1,054 cases, 17 user tools, 62 attacker tools, 30 LLM agents | ReAct-prompted GPT-4 executes injected instructions **24%** of the time (direct harm) / more for data exfiltration; a "hacking prompt" reinforcement nearly **doubles** ASR; agents broadly vulnerable | — | Text-domain; pre-2024 models | ABSTRACT_ONLY | Tool-integrated agents (Rune's shape) are measurably injectable even in the text-only case; establishes the exfiltration-vs-direct-harm taxonomy Rune's threat model needs |
+| arXiv:2403.14720 | Defending Against Indirect Prompt Injection Attacks With Spotlighting | Hines, Lopez, Hall, Zarfati, Zunger, Kiciman (Microsoft) — 2024 | Prompt-engineering defense: delimiting/datamarking/encoding of untrusted content | Spotlighting reduces IPI ASR from **>50% to <2%** with minimal task-efficiency cost, by giving a continuous provenance signal for untrusted spans | — | GPT-family, fixed (non-adaptive) attack evaluation; authors note limits | ABSTRACT_ONLY | Cheap, evidence-backed input-hygiene defense Rune can adopt at ingestion (mark provenance of every untrusted span) — but its evaluation is non-adaptive, so treat as risk reduction, not guarantee |
+| arXiv:2402.06363 | StruQ: Defending Against Prompt Injection with Structured Queries | Chen, Piet, Sitawarin, Wagner — 2024, USENIX Security 2025 | Two-channel (prompt/data) structured queries + tuned LLM | Structured separation of instructions from data significantly improves resistance with little/no utility loss | — | Requires a specially fine-tuned model — unavailable to Rune unless it controls its model | ABSTRACT_ONLY | The model-side structural defense; informative as the "right" design if Rune ever trains/finetunes, but not deployable as a wrapper |
+| arXiv:2503.18813 | Defeating Prompt Injections by Design (CaMeL) | Debenedetti, Shumailov, Fan, Hayes, Carlini, Fabian, Kern, Shi, Terzis, Tramèr (Google DeepMind/ETH) — 2025 | System-level defense: control/data-flow extraction + capabilities enforced at tool calls | CaMeL creates a protective system layer around a *susceptible* LLM: untrusted data can never influence program flow; policies enforced when tools are called; **solves 77% of tasks with provable security vs 84% undefended** on AgentDojo (under adaptive DRI evaluation) | The ~7% task-completion cost is the explicit price of provable security | Requires restructured agent architecture (separate planner/querier) | ABSTRACT_ONLY | **The defense that survives adaptive evaluation** — and it works by moving enforcement OUTSIDE the model (capability checks at tool boundaries), exactly the Atlas lesson. Rune's memory-write and shell/file tools are the boundary where such policies belong |
+| arXiv:2503.06254 | Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation | Liu, Yuan, Tie, Shi, Zhou, Sun, Gong — 2025 | Poisoned image-text pairs injected into multimodal KB | First multimodal RAG knowledge-poisoning attack: **up to 98% ASR with just 5 poisoned pairs** in a 481,782-pair DB (InfoSeek); dirty-label and clean-label cross-modal strategies; 4 defenses (paraphrasing, duplicate removal, structure-driven, purification) show **limited effectiveness and trade-offs** | Explicit negative: all evaluated defenses are inadequate | Optimization-based; assumes KB write access (realistic for user-contributed corpora) | ABSTRACT_ONLY | If Rune's memory accepts user/agent-contributed media, 5 poisoned items in a ~10⁵ corpus is enough. Defenses inside the pipeline fail; provenance/quarantine at write time is the implication |
+| arXiv:2502.17832 | MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks | Ha, Zhan, Kim, Bralios, Sanniboina, Peng, Chang, Kang, Ji — 2025/2026 | Localized (query-specific) vs globalized (untargeted) multimodal poisoning | Localized attack: **56% ASR under restricted attacker access**; transfers across 4 retrievers without re-optimization. Globalized: **one poisoned content collapses generation to 0% accuracy**. Both bypass existing defenses | (a) A single poisoned asset can globally destroy retrieval quality — availability attack costs ~nothing; (b) existing defenses bypassed | Benchmark-scale; retriever-transfer shown | ABSTRACT_ONLY | The one-poison-collapses-everything result argues for write-time quarantine + integrity checks on the media index; a corrupted media lane can silently poison all answers |
+| arXiv:2505.18543 | Benchmarking Poisoning Attacks against Retrieval-Augmented Generation | Zhang, Xin, Li, Zhang, Fang, Liu, Nie, Liu — 2025 | First comprehensive poisoning benchmark: 15 datasets, 13 attacks, 7 defenses, across RAG architectures | Attack effectiveness drops on adversarially expanded datasets; sequential/branching/conditional/loop RAG, multi-turn RAG, **multimodal RAG and agent RAG all remain susceptible**; "current defense techniques fail to provide robust protection" | Defense-side negative result at scale across architectures | Text-dominant datasets | ABSTRACT_ONLY | Cross-architecture confirmation that in-pipeline defenses fail; supports putting trust decisions in the tool boundary + provenance ledger, not in retrieval filters |
+
+### 1c. Steganography / covert channels
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2106.09898 | Bad Characters: Imperceptible NLP Attacks | Boucher, Shumailov, Anderson, Papernot — 2021, IEEE S&P 2022 | Invisible characters, homoglyphs, reordering, deletion in text pipelines | A single imperceptible encoding injection degrades or breaks NLP systems (translation, search, moderation) **including deployed commercial systems (Microsoft, Google)**; three injections break most models; attacks are model-agnostic black-box | Documents that deployed systems at the time did **no input sanitization** — the trust-boundary gap is in the pipeline, not the model | Text carriers; not image OCR per se, but identical mechanism applies to OCR output containing invisible characters | ABSTRACT_ONLY | **Directly relevant to taint-through-transformation**: OCR of a hostile image can output invisible/bidi characters that then flow into Rune's text memory as "extracted text". Text extracted from media needs the same sanitization as raw internet text |
+| arXiv:1708.09537 | DolphinAttack: Inaudible Voice Commands | Zhang, Yan, Ji, Zhang, Zhang, Xu — 2017, ACM CCS 2017 | Ultrasonic (>20 kHz) modulated voice commands exploiting microphone nonlinearity | Inaudible commands successfully control Siri, Google Now, Alexa, Cortana, automotive navigation (FaceTime call, airplane mode, navigation manipulation); SVM-based detection of ultrasonic carrier demonstrated as feasible defense | Requires proximity (attack range meters-class), specialized transducer, and alignment with the mic — demonstrated in lab-controlled conditions; practical constraints documented | Hardware-dependent; 2017 ASR stack (but the acoustic physics is durable) | ABSTRACT_ONLY | Credible but *conditions-constrained*: real risk only if Rune records audio in physical spaces with hostile nearby hardware; mitigation = band-energy anomaly detection at capture, not at ASR |
+
+### 1d. Synthetic media / provenance / detection
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| C2PA Technical Specification 2.2 (c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html) | Content Credentials: C2PA Technical Specification | C2PA — v2.2 May 2025 (2.4 current) | Media provenance standard: signed manifests (assertions + claim + signature), hard/soft content bindings, trust lists, validation states | (1) Provenance = **signed assertions bound by cryptographic hash ("hard binding")** to exact bytes; (2) §9: **"a soft binding shall not be used as a hard binding"** — perceptual fingerprints/watermarks are explicitly barred from identity/integrity roles; (3) §1.2/Principles: spec "SHOULD NOT provide value judgments… merely whether the assertions can be validated as associated with the underlying asset" — provenance asserts *source*, never *truth*; (4) §14/15: trust derives from signer identity + X.509 trust list + revocation + timestamp, with defined validation states (well-formed/valid/trusted); (5) §17: dedicated threat-modeling process + Harms Modelling; (6) covers PDF/BMFF/JPEG/PNG/ZIP/font embedding; `digitalSourceType` distinguishes AI-generated content | Soft bindings (fingerprints) fail-safe: manifest recovered via soft binding is expected to report validation failures because its hard binding won't match — similarity evidence is never integrity evidence | Ecosystem-dependent: trust requires the signer to be on a trust list and honest; provenance is opt-in; manifest strippable (soft-binding recovery exists for that case) | **DOCUMENTATION_AUDITED** (spec §1–2, 5, 9, 14, 17 read in fetched text; PDF-only sections not read) | **The most mature normative statement of this arm's central verdicts**: (a) metadata = source-asserted, cryptographically bound, never truth; (b) perceptual similarity ≠ identity/deletion authority. Rune's media store should copy this two-tier design: cryptographic hash = identity; perceptual similarity = discovery hint only |
+| arXiv:2302.10174 | Towards Universal Fake Image Detectors that Generalize Across Generative Models | Ojha, Li, Lee — 2023, CVPR 2023 | AI-image detector reliability across generators | Trained real-vs-fake detectors fail on unseen generators: the "real" class becomes a **sink class** absorbing everything unfamiliar — asymmetrically tuned to fake patterns, so new fakes are classified real; feature-space nearest-neighbor/probing (CLIP features) generalizes better (+15.07 mAP / +25.90% acc on unseen diffusion/AR models) but is still far from solved | Detector training paradigm itself is the failure; generalization to unseen generators is structurally unreliable | 2023 generator zoo; classification framing | ABSTRACT_ONLY | Measured unreliability of AI-image detectors → Rune must NOT store "this image is AI/synthetic" detector verdicts as memory facts; C2PA-style source assertions (when present) are the only signed evidence |
+| arXiv:2308.14970 | Audio Deepfake Detection: A Survey | Yi, Wang, Tao, Zhang, Zhang, Zhao — 2023 | Survey + unified evaluation of audio deepfake detection | Unified comparison on ASVspoof 2021, ADD 2023, In-the-Wild; identifies **poor generalization to unknown attacks**, lack of in-the-wild data, interpretability as the unsolved core | Detection on unseen spoofing attacks degrades severely — the field's own summary | 2023 cut-off | ABSTRACT_ONLY | "Detection is losing" for audio; do not persist voice-authenticity verdicts as facts |
+| arXiv:2408.08739 | ASVspoof 5: Crowdsourced Speech Data, Deepfakes, and Adversarial Attacks at Scale | Wang, Delgado, Tak, Jung, Shim, Todisco, et al. — 2024, ASVspoof 5 Workshop (Interspeech satellite) | Large-scale spoofing/deepfake challenge: crowdsourced bona fide + attacks incl. adversarial for the first time | New database (many speakers, diverse conditions, adversarial attacks); **"attacks significantly compromise the baseline systems"**; submissions improve but the adversarial/hidden conditions define the gap; SASV and stand-alone CM tracks with new metrics | Baseline countermeasures compromised by attack variety — measured, at scale | Challenge paper; specific EERs live in per-system papers (e.g., XMU closed-condition EER 20.45% vs open 9.36%; SZU-AFS 4.04% — condition-dependent) | ABSTRACT_ONLY | Speaker-verification/anti-spoofing error rates are condition-dependent single-digit-to-20%+ — nowhere near identity-authority grade. Voice similarity is a workflow signal only |
+
+### 1e. Metadata reliability
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| ExifTool documentation (exiftool.org, v13.59, May 2026) | ExifTool by Phil Harvey | P. Harvey — current | EXIF/GPS/IPTC/XMP/ID3/maker-notes **read, write, edit, delete** | The reference tool's core feature list *is* the spoofing proof: writing EXIF/GPS/XMP/ID3 and **deleting metadata in groups or altogether** are one-line operations; also reads C2PA JUMBF and can delete it (`-JUMBF:all=`) on some formats; computes MD5/SHA-256/512 over image data for validation | — | Tool docs, not a study; but it is the de-facto standard both forensics and attackers use | **DOCUMENTATION_AUDITED** | EXIF (device, timestamps, GPS) is **source-asserted and trivially forgeable/strippable** — store it as provenance hints with explicit "unverified" status; cryptographic hash of media bytes is the only self-verifiable field |
+| NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response | Kent, Chevalier, Grance, Dang — Aug 2006, NIST | Digital forensics framework (files, OS, network, application data) | Formalizes evidence collection/examination/analysis/reporting with data-source taxonomy; positions forensics as an IT process requiring **legal-counsel review for laws/regulations** — i.e., metadata and file artifacts are evidence *sources* whose weight depends on chain-of-custody and process, not self-authenticating truth | Explicitly disclaims being an all-inclusive legal procedure | 2006 (predates modern media formats; principles still cited) | **DOCUMENTATION_AUDITED** (landing page + abstract; full PDF not read) | The forensic-standard backing for "metadata = source-asserted evidence, never verified truth": evidence value comes from process (hashes, custody, timestamps), not from the metadata itself |
+| GDPR Art. 9 (Regulation (EU) 2016/679, gdpr-info.eu) | Processing of special categories of personal data | EU — 2016/2018, current | Regulatory text | Prohibits processing of data revealing racial/ethnic origin, political opinions, religion, trade-union membership, **genetic data, biometric data "for the purpose of uniquely identifying a natural person," health data, sex life/sexual orientation** — unless an exception applies (explicit consent, vital interests, legal claims, substantial public interest, etc.); Art. 9(4): Member States may add conditions for biometric/health data | — | Legal text read as written; application depends on interpretation (e.g., what counts as "uniquely identifying") | **DOCUMENTATION_AUDITED** | The regulatory line runs through **purpose**: biometric *similarity for the user's own workflow grouping* is arguably outside "uniquely identifying", while asserting *identity* ("this is Alice") is squarely in the prohibited category absent consent. This is the legal mirror of the workflow-match vs identity-authority distinction |
+
+### 1f. Face / voice identity
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| NIST IR 8280, Face Recognition Vendor Test Part 3: Demographic Effects | Grother, Ngan, Hanaoka — 2019, NIST (doi:10.6028/NIST.IR.8280) | Face recognition accuracy across demographic groups (1:1 verification + 1:N search; 18.27M images of 8.49M people; 189 algorithms) | Quantifies **differential error rates across sex, age, race/country-of-birth groups** in both 1:1 and 1:N systems; motivation section addresses policing/bias impacts; recommends mitigation research; intended audience includes policymakers and system integrators "concerned with risks implied by differentials" | — | 2019 algorithm generation; lab-style mugshot/visa datasets (3 of 4 datasets standards-compliant) | ABSTRACT_ONLY (via OpenAlex metadata + abstract; full PDF fetch returned raw bytes) | Automated face recognition has measured demographic-differential error — reinforces that even *operational* face matching inside Rune (e.g., "photos of the same person") must be presented as cluster hypotheses, never adjudicated identity |
+| arXiv:2005.07143 | ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verification | Desplanques, Thienpondt, Demuynck — 2020, INTERSPEECH | Speaker-embedding architecture (voiceprints) | Significantly outperforms prior SOTA on VoxCeleb test sets / VoxSRC 2019 — the reference point for the speaker-embedding lane (community-reported EERs on VoxCeleb1-O are sub-1% for this class; EER figures not stated in abstract) | — | Benchmark conditions (studio-ish); real-world/channel shifts degrade; EER from abstract not verifiable | ABSTRACT_ONLY | Speaker embeddings are excellent *similarity keys* (diarization, "same voice?" hints) and terrible *identity authorities*; matches ASVspoof 5's finding that spoofing attacks compromise verification systems |
+| doi:10.1037/pspa0000098 (Crossref-verified; not on arXiv) | Deep neural networks are more accurate than humans at detecting sexual orientation from facial images | Wang, Kosinski — 2018, JPSP 114(2), 246–257 | Face → sensitive-attribute inference | Classifiers from 35,326 facial images: 81% (men) / 74% (women) accuracy from a single image, **91% / 83% from five images** vs human 61/54%; authors frame it explicitly as a **privacy threat** ("expose a threat to the privacy and safety of gay men and women") | — | Criticized methodologically (grooming/pinback-image confounds); binary orientation framing; 2018 models | ABSTRACT_ONLY (abstract verified via OSF preprint 10.31234/osf.io/hv28a + Crossref) | The canonical demonstration that faces leak special-category traits at high accuracy → Rune must not run attribute-inference on stored media by default, and must not persist such inferences |
+| arXiv:2603.20301 | Voice Privacy from an Attribute-based Perspective | Rahman, Larson, Tejedor-Garcia — 2026, Interspeech 2026 | Voice anonymization evaluated by *inferred attribute* leakage | Current voice-privacy benchmarks under-measure risk: measuring protection in attribute space shows **inferred attributes still present a risk despite anonymization and despite inference errors** | Anonymization that defeats speaker-identification can still leak attributes | Interspeech-length study | ABSTRACT_ONLY | Even *processed/anonymized* audio keeps leaking traits — supports the "don't persist inferred traits" rule for voice-derived entries too |
+| FISWG (Facial Identification Scientific Working Group), fiswg.org | Consensus standards for image-based facial comparison; incl. FRT Implementation Guidelines v1.0 and Face Recognition Systems Operational Assurance: Deployment Testing v1.0 (finalized Nov 2025) | FISWG — 2008–2026 | Forensic/operational facial identification standards body (50+ LE/intelligence/industry members) | Maintains separate disciplines: **facial identification (examiner-led comparison to standards)** vs **automated facial recognition (system operation)** — with distinct documents for implementation and operational assurance/deployment testing; recognition-system output is operational tooling, examination conclusions follow human/forensic process | — | Document bodies themselves not read (paywalled/member docs); scope verified from site + titles | **DOCUMENTATION_AUDITED** (site + document titles) | The institutional precedent for the **workflow-match vs identity-authority split**: even law enforcement separates automated match (operational lead, requires assurance testing) from identification (forensic discipline with standards). Rune should mirror: face/voice similarity = lead/hint; identity assertions = out of scope |
+
+### 1g. Sensitive-attribute inference
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| arXiv:2209.01292 | Are Attribute Inference Attacks Just Imputation? | Jayaraman, Evans — 2022, ACM CCS 2022 | Attribute-inference attack methodology (incl. "sensitive value inference") | (1) Black-box attribute-inference attacks **rarely learn anything that cannot be learned from distribution knowledge alone** — much of the claimed attack power is the dataset prior, not the model; (2) white-box attacks CAN reliably identify records with sensitive values beyond the no-model baseline; (3) DP training and removing vulnerable records do **not** mitigate the residual white-box risk | Black-box attack power ≈ imputation baseline — a key deflationary negative for naive threat models | Model-internal setting (training-data inference), not media-inference per se | ABSTRACT_ONLY | Two-sided lesson: (a) don't over-credit what an attacker learns *from Rune's stored inferences alone*; (b) but any party with deeper access (white-box embeddings/logs) can exceed baselines — so inferred sensitive traits, once persisted, extend the attack surface permanently |
+| arXiv:2609.12448 | GraphProfiler: Source-Linked Sensitive Attribute Inference via Personal Knowledge Graphs | Khan, He, Ma, Wachowicz, Naghizade — 2026, EMNLP 2026 | LLM-based profiler aggregating cues across a user's content (age, income, occupation, etc.) | LLM profilers reach **86.7% attack success on SynthPAI (8 attributes)** and 84.6% on PANDORA **by aggregating indirect cues across ordinary posts**, with cited evidence for 98% of predictions; removing the cited posts cuts ASR far more than removing random ones | Confirms *aggregation* is the amplifier — no single entry leaks much, but the store as a whole does | Text content (not images); benchmark corpora | ABSTRACT_ONLY | Directly answers the arm question: memory is an aggregation amplifier; inferred sensitive traits become MORE harmful over time as the store grows — persistence requires explicit justification because the harm is emergent, not per-entry |
+
+### 1h. Storage / lifecycle / preservation (multimodal-specific)
+
+| ID | Title | Authors, year, venue | Modality/task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| SQLite Limits (sqlite.org/limits.html, updated 2026) | Implementation Limits For SQLite | SQLite project — current | BLOB/DB size limits | Max string/BLOB = **SQLITE_MAX_LENGTH, default 1,000,000,000 bytes** (hard ceiling 2³¹−1 ≈ 2.1 GB; some built-ins like hex() fail earlier); max DB ≈ **281 TB** (page-count × 64 KB pages); docs explicitly recommend *lowering* the limit in security-sensitive apps; row = single BLOB encoding during INSERT/SELECT so SQLITE_MAX_LENGTH also caps row size | — | Docs | **DOCUMENTATION_AUDITED** | Screenshots (KB–MB) fit BLOBs fine; documents/audio fine under 1 GB; full-size video/long audio does NOT (and would bloat WAL/vacuum) → media-as-files + content-addressed references is the right default; BLOBs only for thumbnails/small assets |
+| arXiv:2212.08035 | Hamming Distributions of Popular Perceptual Hashing Techniques | McKeown, Buchanan — 2022, DFRWS EU 2023 | Million-image evaluation of PDQ, NeuralHash, pHash under content-preserving transforms | Measures Hamming-distance distributions between unrelated images AND image variants for the three deployed hash families; documents the collisions/tightness problems of each against seven image-variant classes — "little public evaluation" existed before | Explicitly documents that popular perceptual hashes have poorly characterized error behavior under common transforms | Hash archetypes only; no deep-perceptual-hash models | ABSTRACT_ONLY | The perceptual-hash **authority** the arm asked for: treat pHash distance as a probabilistic similarity signal with known failure modes, never a match/no-match rule |
+| arXiv:2111.06628 | Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash | Struppek, Hintersdorf, Neider, Kersting — 2021, ACM FAccT 2022 (Oral) | Adversarial attack on deployed deep perceptual hashing (Apple NeuralHash) | Gradient-free transforms AND simple perturbations force/prevent hash collisions — enabling **hiding abusive content AND framing innocent users**; hash values also leak information about device contents; conclusion: deep perceptual hashing "generally not ready for robust client-side scanning" | The safety-critical deployment of perceptual hashing was defeated by standard image transformations | Deep-hash specific (NeuralHash); classical hashes degrade differently | ABSTRACT_ONLY | Hard evidence that perceptual hashes are gameable → never a deletion authority or sole enforcement mechanism; adversarial collision = censorship/framing vector |
+| arXiv:2212.04107 | Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillance | Hooda, Labunets, Kohno, Fernandes — 2022 | Poisoning attack on perceptual-hash matching systems | Poisoning 5% of the hash database achieves **>40% physical-surveillance rate** on target locations; stronger detection robustness *increases* surveillance capability (robustness/abuse trade-off) | A defense-robustness improvement makes the abuse channel worse — inherent tension | Client-side scanning context | ABSTRACT_ONLY | Second independent result that hash-matching infrastructure is attackable → at Rune scale this is theoretical, but it kills any future temptation to use hash matching as an automatic enforcement tool |
+| arXiv:1912.07745 | PDQ & TMK+PDQF — A Test Drive of Facebook's Perceptual Hashing Algorithms | Dalins, Wilson, Boudry — 2019, Digital Investigation | PDQ image + TMK+PDQF video hashes on real investigation data (law-enforcement) | Open-sourced PDQ/TMK+PDQF perform well detecting commonly encountered transformations on real-world case data; reference implementation for LE integration | — | Law-enforcement triage context; human-in-the-loop investigation assumed (hash = candidate-finding tool) | ABSTRACT_ONLY | Documents the *legitimate* production use: abuse/near-dup **triage inside a human-reviewed investigation workflow** — matching how photo platforms use perceptual hashes (candidate detection → human/secondary verification), not automated deletion |
+| Apple Photos User Guide — "Remove duplicates" (support.apple.com/guide/photos/pht5a3157c1d/mac) | Remove duplicate photos and videos | Apple — current (macOS 12→26) | Consumer photo-library dedupe practice | Photos detects duplicate photos/videos and presents them for **user-confirmed merging/deletion** — duplicates surfaced as suggestions with human decision, and separately groups "same-event" content via People/Places/memories rather than treating perceptual similarity as identity | — | Vendor docs do not disclose the hash algorithm (public reporting indicates hash-based + embedding signals) | **DOCUMENTATION_AUDITED** (guide structure + feature pages) | The shipped-consumer pattern for byte-identical vs perceptually-similar vs same-event: byte-level dedupe (fast hashes) automated; perceptual similarity surfaced as **review suggestions**; event grouping is semantic, not hash. Confirms "similarity proposes, user disposes" |
+| [OI] Embeddings documentation (platform.openai.com/docs/guides/embeddings, fetched 2026) | Vector embeddings | [OI] — current | Embedding-model versioning, dimensions, distance norms | Embeddings are **model-specific artifacts** with named versions (ada-002 → text-embedding-3-small/large) and differing MTEB performance; dimension can be shortened (Matryoshka, arXiv:2205.13147) with re-normalization; model knowledge cutoffs and training changes are version-bound — no cross-model vector compatibility is offered or implied | — | Docs; migration mechanics not covered (that's the gap) | **DOCUMENTATION_AUDITED** | Confirms the industry framing: an index is bound to a model version; changing models ⇒ full re-embed. Rune's unversioned embeddings violate this — record model+dimensions per index or treat the index as disposable cache |
+
+---
+
+## 2. Synthesis
+
+### 2.1 Taint-through-transformation verdict
+
+**Question**: when Rune transforms a hostile media artifact (OCR of an image, caption of a screenshot, transcript of audio), does the derived text inherit the input's taint — and is it treated as trusted downstream?
+
+**Verdict: transformation does NOT neutralize taint; derived text is fully attacker-controlled payload. No direct study of taint propagation into persistent memory was found (bounded zero-hit), but the indirect evidence is convergent and strong.** Evidence line:
+
+1. **The transformation channel carries payloads by design.** MMPIBench (2609.09404) tests OCR-text, overlays, EXIF metadata, QR codes and fake interfaces as *carriers* — OCR'd text from images is an ordinary injection carrier into agent planning (12.8% attempted in current non-adaptive settings, and the audio channel completes 49% where vision completes ~1%). RIPA (2606.28649 — caught in search, cited cautiously as it was verified in-feed) formalizes OCR as injection Channel 1 and Whisper STT as Channel 2.
+2. **Extracted text keeps adversarial structure.** Bad Characters (2106.09898) shows invisible characters/homoglyphs flow through commercial NLP pipelines unsanitized; an OCR pass reproduces such characters verbatim into the text store. Greshake (2302.12173) established the root conflation: "processing retrieved prompts can act as arbitrary code execution."
+3. **Adversarial (non-textual) taint bypasses text entirely.** Image Hijacks (2309.00236, >80% ASR incl. context exfiltration and false-belief implantation) and 2307.10490 show the *embedding* of a hostile image is itself the payload; OCR cannot sanitize what is not text. Repeat-After-Me (2609.04533) shows adaptive black-box image injection still reaches >82%/47% ASR on frontier models and lands persistent-damage primitives (overwriting agent config files → later RCE) — the closest published analogue to "poison the memory file."
+4. **The gap**: no found paper traces a hostile image → OCR/caption → *persisted memory entry* → *re-injected into a future session* loop and measures it. Rune should assume the loop works (the primitives above compose) and enforce the countermeasures that survive adaptive evaluation — CaMeL-style capability/policy checks **at the memory-write and tool boundaries**, outside the model (2503.18813: 77% task completion with provable security), plus Spotlighting-style provenance marking of every untrusted span at ingestion (2403.14720: ASR >50%→<2%, non-adaptive caveat). In-pipeline filters (paraphrase, dedup, purification) are the measured failures (2503.06254, 2505.18543).
+
+**Concrete rule for Rune**: media-derived text and captions enter memory tagged as untrusted-derived (provenance = source artifact hash + transform), are never eligible to inject instructions into tool calls, and any entry that would instruct future behavior requires the same policy gate as a tool call.
+
+### 2.2 Biometric similarity vs identity authority verdict
+
+**Verdict: biometric/face/voice similarity is a WORKFLOW MATCH (clustering, "likely same person/voice" hints), never an IDENTITY AUTHORITY ("this is X"). The precedent is institutional, not just prudential.** Precedents found:
+
+- **Forensic vs operational split (FISWG)**: the field's own standards body separates automated facial recognition (operational tooling, subject to deployment-assurance testing — FRT Implementation Guidelines v1.0, Operational Assurance: Deployment Testing v1.0, Nov 2025) from facial identification (a forensic discipline with examiner process). Automated match = lead; identification = separate, standard-governed act.
+- **NIST FRVT Part 3 (IR 8280)**: measured demographic-differential error rates across 189 algorithms / 18M images — even best-in-class systems carry group-dependent error, so an automated identity assertion is epistemically and ethically unsound as a stored fact.
+- **GDPR Art. 9**: the special-category prohibition is triggered by *purpose* — "biometric data **for the purpose of uniquely identifying** a natural person." Similarity computed for the user's own workflow (grouping their screenshots/recordings) does not assert unique identity; persisting "this is [named person]" from a face/voice match does. The legal text therefore draws exactly the line the architecture needs.
+- **Error-rate reality**: speaker verification EERs are condition-dependent (ASVspoof 5 baselines "significantly compromised"; per-system EERs from ~4% to 20%+ depending on condition; ECAPA-class embedding sub-1% only in clean benchmarks), and spoofing/deepfake attacks attack the verification layer itself (2308.14970, 2408.08739).
+- **Attribute leakage compounds it**: anonymized voice still leaks inferred attributes (2603.20301); faces leak special-category traits at 81–91% accuracy (Wang & Kosinski).
+
+**Rune rule**: store speaker/face embeddings (if at all) as ephemeral keys with `similarity → cluster hypothesis` outputs surfaced to the user; never persist "identity = <person>" as a memory fact; any named-person binding requires explicit user action (consent-shaped, per GDPR Art. 9(2)(a)).
+
+### 2.3 Perceptual-hash appropriate-uses verdict
+
+**Verdict: perceptual hashes are a DISCOVERY/RECOVERY signal, never an enforcement or deletion authority.** Evidence: (a) the C2PA spec — the only deployed provenance standard with a security threat model — makes it *normative*: "a soft binding shall not be used as a hard binding" (§9), and demonstrates the intended use: recovering a manifest whose metadata was stripped, with expected validation failures; (b) measured weakness and gameability: Hamming distributions of PDQ/NeuralHash/pHash are poorly characterized under transforms (2212.08035), NeuralHash collisions enable hiding *and framing* (2111.06628), and poisoning 5% of a hash DB yields >40% surveillance capability — with a robustness/abuse trade-off that worsens as detection improves (2212.04107); (c) legitimate production use is triage: PDQ/TMK+PDQF in law-enforcement *investigation* workflows (1912.07745) and photo apps surfacing duplicates for **user-confirmed** action (Apple Photos "Remove duplicates"); abuse-detection deployments pair hashes with human review. **Rune rule**: byte-identical dedupe via cryptographic hash (automatable); perceptual hash at most a column powering near-dup suggestions and manifest recovery — never a deletion trigger; at n≈944 entries, brute-force re-embedding comparison is already cheap, so pHash is optional, not load-bearing.
+
+### 2.4 Storage recommendation for Rune's scale
+
+**One workstation, 16 GB VRAM, text-first, ~944 entries, media later (screenshots, documents, audio — not a YouTube-scale archive):**
+
+1. **Media payloads live as files, not BLOBs** (SQLite BLOB cap: 1 GB default / 2 GB hard; row-size couples to it; WAL/vacuum cost). DB stores: SHA-256 (identity, content-addressed path), media type, dimensions/duration, source provenance (capture-time metadata with `unverified` flag), pHash (optional, discovery only), thumbnail blob (small, optional), transcript/caption text with `derived-from` pointer.
+2. **Content addressing = SHA-256 file layout** (`blobs/ab/cd/abcdef…`), Git-LFS/IPFS-style; #396 owns the general pattern — the multimodal-specific addition is that media bytes are immutable and every derived artifact (OCR text, caption, transcript) must carry the source hash, enabling the §2.1 taint rule and C2PA-style "hard binding = identity, soft binding = hint" two-tier design.
+3. **No cold tiering, no object store, no IPFS** at this scale — a single local filesystem tier is correct; revisit only if the media corpus exceeds ~10⁵ items or leaves the workstation.
+4. **Dedupe**: byte-level via SHA-256 (automatic); perceptual similarity as user-confirmable suggestions (Apple pattern); same-event grouping only via semantic/text lanes, not hashes.
+5. **Model-version transitions**: record embedding model ID + dimensions per index ([OI] docs confirm embeddings are model-version-specific artifacts); at 944 entries the right migration is **full re-embed into a new table + swap** (dual-index for one verification pass), not incremental migration — re-indexing cost is minutes, not hours. No production dual-index literature was found (bounded gap); the one measured data point is that model/version choice shifts retrieval scores by >5 points (ColQwen2 ablation, Arm 2) — unversioned embeddings are unreproducible.
+6. **Ingestion security gates (from §1b)**: sanitize OCR/transcript text for invisible/bidi characters; strip hostile EXIF/QR payloads from consideration as instructions; quarantine untrusted-contributed media before embedding; policy checks at write/tool boundaries per CaMeL; do not ingest raw audio into model context without VAD + the §2.1 rules.
+
+---
+
+## 3. Rejected approaches
+
+- **Model-internal hallucination fixes as Rune's defense** (fine-tuning, RLHF, structured-query models like StruQ): rejected — Rune consumes models, doesn't train them; all measured model-side mitigations degrade under adaptive attack (Repeat-After-Me), and the only defense with provable security is architectural (CaMeL).
+- **AI-image / audio-deepfake detectors as memory validators**: rejected — sink-class generalization failure (2302.10174), unknown-attack degradation (2308.14970, 2408.08739). Detector verdicts must never become memory facts.
+- **Perceptual hash as deletion/enforcement authority**: rejected — normatively barred by C2PA, empirically gameable (NeuralHash, DB poisoning).
+- **Automated face/voice identification as stored identity facts**: rejected — demographic-differential error (NIST IR 8280), special-category regulation (GDPR Art. 9), forensic/operational precedent (FISWG).
+- **Persisting inferred sensitive attributes (age, orientation, health, etc.) as memory facts by default**: rejected — faces leak special-category traits at 81–91% (Wang & Kosinski), aggregation amplifies harm over store growth (GraphProfiler 86.7% ASR), GDPR Art. 9 prohibits processing absent justification. If ever justified: explicit per-user justification + consent, never silent inference.
+- **In-pipeline poisoning filters (paraphrase/dedup/purification) as primary defense**: rejected — measured inadequate (2503.06254, 2505.18543); adaptive visual injection still >82% (2609.04533).
+- **Storing large media as SQLite BLOBs** (>10–100 MB assets): rejected — 1 GB default limit, row-size coupling, vacuum/WAL pathology; files + content-addressed references instead.
+- **A cascade/rerank retrieval architecture for media**: inherited from Arm 2 — at n≈944, score-everything; media lanes change nothing about that.
+
+---
+
+## 4. Do-not-cite register
+
+| Claimed-for ID/paper | Actually is | Status |
+|---|---|---|
+| arXiv:2307.01380 | "Information Synergy Maximizes the Growth Rate of Heterogeneous Groups" (physics.soc-ph) — supplied by the task brief as the image-injection line | **Do not cite.** The image-injection line is 2307.10490 / 2309.00236 |
+| arXiv:2309.17436 | "Fractional Quantum Anomalous Hall Effect in a Graphene Moiré Superlattice" (Nature) — commonly misattributed to "Image Hijacks" | **Do not cite.** Real Image Hijacks ID: arXiv:2309.00236 (verified) |
+| arXiv:2406.01184 | "The Biot-Allard poro-elasticity system" — misattributed to "Images are Achilles' Heel of Alignment" | **Do not cite** (neither ID nor paper included; real ID not verified this arm) |
+| arXiv:2405.01532 | "Robustness of Fixed Points of Quantum Channels" — misattributed to StruQ | **Do not cite.** Real StruQ ID: arXiv:2402.06363 (verified) |
+| arXiv:1810.07254 | "The Concept of Criticality in Reinforcement Learning" — misattributed to Wang & Kosinski | **Do not cite.** Wang & Kosinski verified via Crossref DOI 10.1037/pspa0000098 (JPSP 2018) — cite the DOI, not an arXiv ID (the paper is not on arXiv) |
+| arXiv:1812.06210 | "A General Approach to Adding Differential Privacy to Iterative Training Procedures" — misattributed to Song/Shokri/Mittal inference attacks | **Do not cite** (that paper's arXiv ID was never verified this arm; the attribute-inference ground is covered by 2209.01292, verified) |
+| LLM-era (2024–26) image steganography claims | No verified dedicated paper found this session | **Do not cite anything** for LLM-era steganography until independently verified |
+| Subtitle/codec injection in video | arXiv search returned 0 results in cs.CR | **Do not cite** as a demonstrated attack class; cite Bad Characters (2106.09898) for the adjacent invisible-character mechanism only |
+| Facebook PDQ GitHub README | Direct fetches of github.com/facebookresearch/pdq 404'd from this environment (repo existence otherwise supported by 1912.07745 / 2212.08035) | Cite the PDQ papers, not the repo fetch |
+| Song/Shokri/Mittal "Comprehensive Privacy Analysis of Deep Learning" | ID never verified | **Do not cite** this arm; 2209.01292 + 2609.12448 cover the ground |
+
+---
+
+*Arm 3 complete. 33 sourced rows: 23 arXiv-verified papers (1 FULL_PAPER main-text, 22 ABSTRACT_ONLY via export API, all IDs verified), 8 DOCUMENTATION_AUDITED (C2PA spec, SQLite limits, ExifTool, NIST SP 800-86, GDPR Art. 9, FISWG, Apple Photos guide, [OI] embeddings docs), 1 ABSTRACT_ONLY via Crossref/OpenAlex (NIST IR 8280) + 1 via Crossref (Wang & Kosinski). All read depths honest; four negative/zero-hit findings recorded.*

research/memory-atlas-r1/AB-multimodal-artifact-memory/02_outward/arm4_adversarial_pass.md

@@ -0,0 +1,278 @@
+# Arm 4 — INDEPENDENT FRESH-CONTEXT ADVERSARIAL PASS
+# Memory Research Atlas R1, Domain #403 AB — Multimodal Memory
+
+**Arm:** 4 of 4 (adversarial) · **Date:** 2026-09-22 · **Mandate:** attack the 15-point CANDIDATE ARCHITECTURE from first principles; verdict all 156 mandated attacks (A–EZ) + ≥10 Rune-specific attacks (F1–F14); research only.
+
+**Inputs:** arm1_foundations.md, arm2_retrieval_rag.md, arm3_reliability_security.md (used as evidence pools; judgment here is independent). Two load-bearing citations re-verified by me directly against arxiv.org/abs: **2309.00236** (Image Hijacks: four attack classes — output control, context-window exfiltration, safety-override, false-belief implantation — all >80% ASR on LLaVA) and **2503.18813** (CaMeL: 77% AgentDojo tasks with provable security vs 84% undefended; untrusted data can never impact program flow; capability policy enforced at tool calls). Both confirmed as titled. Citation convention below: **[A1 B12]** = Arm 1 source row B12; **[A2 §2.3]** = Arm 2 synthesis section; **[A3 2309.00236]** = Arm 3 source row by ID; **[V]** = verified by me this pass.
+
+## Verdict semantics (read first)
+
+An attack **SUCCEEDS** if it identifies a real defect or vulnerability in the candidate architecture **or in Rune's current shipped implementation** (the architecture on paper and the system in production are attacked separately — a principle that is contradicted by shipping code is scored on the weaker leg). **FAILS** if the architecture text, backed by verified evidence, already neutralizes the claim. **PARTIAL** if the architecture covers the claim incompletely, is silent where silence is dangerous, or is correct in principle but unenforced in the current implementation.
+
+**Evidence citation keys (from arm reports):** A1: CLIP limitations [B1], ImageBind emergent weakness [B4], modality gap [B5], CLIP version dimension mismatch 512/768/1024 [B12], Zacks event segmentation [A10], picture-superiority boundary conditions [A14]. A2: ColPali 81.3 vs OCR 65.5, figures 79.1 vs 31.6, 224px collapse 56.5 [2407.01449]; single-vector visual lanes lose to BM25-on-OCR (SigLIP 51.4, Jina-CLIP 17.7) [Table 2]; captioning ceiling 67.0 [2407.01449]; Whisper non-speech hallucination 73–87% [2606.07473], ~1% hallucinated sentences [2402.08021]; more visual context hurts [2608.07006]; segment granularity universal, per-frame nowhere [§2.3.7]. A3: C2PA "soft binding shall not be used as a hard binding" [C2PA §9]; pHash gameability [2212.08035, 2111.06628]; Image Hijacks >80% [2309.00236, V]; typographic attacks persist 2025 [2504.04893]; adaptive injection >82%/47% frontier + TOOLS.md overwrite [2609.04533]; audio channel 49% completion [2609.09404]; CaMeL 77% provable [2503.18813, V]; in-pipeline poisoning defenses fail [2503.06254, 2505.18543]; Poisoned-MRAG 98% ASR with 5 pairs [2503.06254]; EXIF trivially forgeable [ExifTool]; NIST IR 8280 demographic differentials; GDPR Art. 9 purpose line; FISWG forensic/operational split; SQLite BLOB 1GB default [sqlite.org/limits]; POPE LLaVA CHAIR_S 32.7, CHAIR doubles across equivalent prompts [2305.10355]; CharXiv GPT-4o 47.1% on real charts, −34.5% stress [2406.18521]; Wang & Kosinski 81–91% attribute inference; GraphProfiler 86.7% aggregation ASR [2609.12448].
+
+---
+
+## 1. Mandated attack verdicts
+
+### Block A–Z (representation & evidence discipline)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| A | caption = image | PARTIAL | Architecture #1/#2 classifies captions as rebuildable projections — correct on paper. But Rune's shipped PDF flattening stores extracted text with NO page image [A2 Lane B; A1 baseline], so in the production DB the extraction IS the image, irrebuildably | Already-ingested visual-rich docs are permanently degraded; "derived" is a fiction for legacy rows | Same as C: retain page images ≥448px; backfill from retained sources; tag legacy rows as provenance-poor | Whether originals of already-flattened docs still exist on disk is unaudited |
+| B | transcript = recording | FAILS | #1/#2 + A2 §2.3.6: transcript chunks carry timestamps + audio-file pointer + no-speech prob; no audio ingestion exists yet so no implementation gap | — | None beyond existing design; enforce pointer-not-copy at implementation | Whisper hallucination means transcript lines need spot-checkability — pointer design already provides it |
+| C | OCR replaces scanned page | SUCCEEDS | Shipping code flattens PDFs unconditionally, layout destroyed, no page image kept [A1 baseline; A2 §2.1]. Measured cost: ColPali 81.3 vs OCR 65.5 avg nDCG@5; figures 79.1 vs 31.6 (2.5×); tables +13.1; Tesseract docs concede table failure [A2 2407.01449, tessdoc] | Visual-rich artifacts (spec decks, dashboards, scanned forms) mis-retrieved forever unless sources retained for backfill | Per-artifact triage at ingestion (native-text / scanned-prose / visual-rich); visual-rich class must retain page images ≥448px before any text extraction; backfill legacy where sources exist | Handwriting retrieval numbers unmeasured anywhere [A2 §4.3]; triage classifier itself can mislabel |
+| D | visual-doc embedding preserves meaning | FAILS | Single-vector visual embeddings lose to BM25-on-OCR text (SigLIP 51.4, Jina-CLIP 17.7 vs 65.5) [A2 Table 2]; CLIP §6 loses fine-grained/counting/spatial [A1 B1]; multi-vector late interaction is the only visual lane with evidence [A2 ColPali; A1 B8] | Would justify a cheap single-vector lane that measures worse than the text lane it replaces | Architecture #4 already demands multi-vector lanes — keep; forbid single-vector visual lanes in spec text explicitly | ViDoRe queries are QA-style; agentic exact-match queries untested on visual lanes [A2 §2.1.3] |
+| E | one embedding space simpler → better | FAILS | ImageBind is hub-mediated, emergent audio→video R@1 6.8 vs 36.8, emergent zero-shot below SOTA everywhere [A1 B4]; modality gap is functional geometry, cross-modal vs within-modal distances on different scales [A1 B5]; Rune has no web-scale paired corpus to train a hub [A1 §2.3.1] | Cross-modal scores would silently dominate/contaminate fused ranking | #4 (modality-specific indexes + bridge) stands; document the bridge as calibration layer, never shared metric space | None — evidence is direct and quantified |
+| F | CLIP similarity = semantic equivalence | FAILS | Contrastive scores are uncalibrated rankings, not meaning probabilities [A1 B1/B5/B7]; #5 already demotes similarity to nomination | Similarity treated as truth → the exact #402 defect class (194015/193729) re-emerges cross-modally | #5 stands; add: nomination thresholds per (model, modality) pair must be set from a local eval set, not defaults | n≈944 gives weak threshold estimation data [A2 §4.4 dense-lane value unmeasured] |
+| G | perceptually similar = duplicates | FAILS | C2PA normative bar: soft binding never a hard binding [A3 C2PA §9]; pHash Hamming distributions poorly characterized under transforms [A3 2212.08035]; Apple-shipped pattern = suggestions with user confirmation [A3 Apple docs] | Auto-merging distinct artifacts | #6 stands (byte-identity exact; perceptual = suggestion) | None for hashes; embedding-based near-dup suggestions inherit F's calibration gap |
+| H | perceptual hash authorizes dedupe | FAILS | NeuralHash collisions enable hiding AND framing [A3 2111.06628]; 5% DB poisoning → >40% surveillance [A3 2212.04107]; #6 explicitly suggestion-only | Programmatic deletion on hash match = censorship/poisoning vector | #6 stands; write-path rule: no deletion may cite a perceptual hash as sole justification | None |
+| I | crop contains all context | PARTIAL | #2 gives crops lineage (parent + region), so re-derivability holds; but nothing forces retrieval to surface the parent context — a crop can be retrieved and reasoned over as if self-contained, and exocentric context (what surrounded the region) is unrecoverable from the crop alone | Crop-based reasoning misses the frame that disambiguates it (chart axis cut off, screenshot cropped below the error message) | Crop derivatives must carry parent hash + bbox, and context-construction must be able to pull the parent region ± margin on demand | Margin heuristic is arbitrary; no evidence for a right value |
+| J | keyframe = complete event | PARTIAL | #9 provides segment references but no rule prevents a keyframe from being stored as a standalone event Memory item; event boundaries are memory anchors, and boundary frames ≠ event content [A1 A10]; every video system in evidence uses segment units [A2 §2.3.7] | Event memory collapses to a single frame — the temporal axis is lost [A1 B10/B11] | Keyframes are pointers INTO segment records, never standalone event items; event records reference [start,end] segments | Boundary quality depends on the segmentation model (Whisper windows are model-external [A2 2212.04356]) |
+| K | one video caption enough | PARTIAL | Architecture is silent on temporal coverage of derivatives; video→single-caption loses long temporal/long-description structure [A1 B10/B11]; InternVideo2 needed segmentation+multi-caption to align [A2 2403.15377] | One summary caption becomes the only indexable trace of a long recording | Video derivatives must be segment-indexed (per-segment captions/transcripts), not one summary; segments inherit provenance | More captions = more hallucination surface (V attack); coverage vs noise tradeoff unmeasured |
+| L | every frame indexed | FAILS | Per-frame indexing appears nowhere in the surveyed video literature; segment/shot-level is universal [A2 §2.3.7]; #9 segment refs + #10 economics rule it out | Storage/attention explosion at decades scale | None needed; make granularity policy explicit in the spec so implementation can't drift into frame-indexing | None |
+| M | more derivatives always improve retrieval | PARTIAL | Architecture sets no admission bar on derivative generation; evidence: unconditional extra visual context LOWERS answer accuracy [A2 2608.07006]; caption-everything reaches only 67.0 vs 81.3 at higher cost [A2 2407.01449] | Derivative bloat: index pollution, hallucinated text multiplying (see V), wasted VRAM on a shared 16GB card | Derivative generation gated by measured per-artifact-class value; charts get underlying-data text over prose captions [A3 CharXiv risk] | "Measured value" requires an eval harness the architecture doesn't specify (see DZ residual) |
+| N | every derivative preserved forever | PARTIAL | #1 calls derivatives rebuildable, which contradicts preserve-forever; #10's cooling-≠-deletion rule is written for SOURCES; no lifecycle class distinction exists | Contradiction: rebuildable things treated as archival; storage grows with model churn for no gain | Two storage classes: sources (preserve, cool ok) vs derivatives (cache-class: deletable, rebuildable, subject to lineage) | Rebuild cost when the producing model is EOL/proprietary may be infinite (see EQ) |
+| O | every original hot forever | FAILS | #10 explicitly: content-addressed files, cooling ≠ deletion; no cold tier needed at Rune scale [A3 §2.4.3] | — | None | None |
+| P | cooling = forgetting | FAILS | #10 explicit; cooling changes latency, not existence | — | None | None |
+| Q | original bytes unnecessary after good embeddings | FAILS | #1 core: improved future models may reinterpret the same source; embeddings lose fine-grained structure the bytes retain [A1 B1 §6; A2 Table 2] | Permanent capability ceiling locked at today's models | None | None |
+| R | old embeddings authoritative after migration | PARTIAL | #4 mandates stamping going forward but says nothing about the 944 EXISTING unversioned vectors; they cannot be proven comparable to anything [A1 B12: dims differ per version; A1 B5: init determines cone] | Mixed-space queries after any model change silently corrupt ranking — no error signal | Declare legacy embeddings a disposable cache: freeze from cross-space queries, rebuild index wholesale + swap [A3 §2.4.5] | If the producing model can't be recovered from code history, legacy vectors are unverifiable, only discardable |
+| S | embeddings across versions comparable | SUCCEEDS | Production embeddings record NO model/version [A1 baseline]; CLIP-family versions are not even dimension-compatible (1024/512/768) [A1 B12]; different inits → different cones [A1 B5]; ColQwen2 vs ColPali shifts scores >5 pts on identical data [A2 2407.01449 Table 7] | Any partial re-embed or model upgrade today silently mixes incomparable spaces — defects invisible in output | Mandatory per-row (model_id, version, dim, space_id); indexes are per-space; schema migration BEFORE any dense-lane addition (F1) | None — the gap exists today, not hypothetically |
+| T | re-embedding may replace provenance | FAILS | #2 lineage is on derivations; embeddings are derivations; re-embedding creates a NEW derivation row, never edits the old | History loss under model churn | None | None |
+| U | better model overwrites interpretation history | FAILS | #12 keeps source + historical interpretation; #1 improved models ADD derivations | — | None | None |
+| V | VLM interpretation = direct evidence | PARTIAL | #1 says "derived" but derives no trust consequence: OCR text and VLM captions would land in the same index with the same standing; VLM object hallucination is systematic and language-prior driven (LLaVA CHAIR_S 32.7; caption hallucination doubles across equivalent prompts) [A3 2305.10355]; charts misread at 47–71% error [A3 2406.18521] | Model-generated claims retrieved as if observed; falsehoods compound at every future re-derivation | Evidence-class field on every derived row: captured-bytes / extracted-text / model-interpretation; model-interpretation rows can nominate but carry lower trust in conflict resolution | The extracted-text vs model-interpretation boundary is blurry (OCR is both mechanical and error-prone); classify by mechanism, not confidence |
+| W | model confidence = calibrated probability | FAILS | #5 uses sufficiency gates on fused retrieval scores, not model self-reports; CHAIR instability across prompts shows model confidence is prompt-relative [A3 2305.10355]; embedding distances uncalibrated [A1 B5] | — | None; add spec note: never persist model confidence as a stored probability | None |
+| X | OCR+VLM agreement = two independent confirmations | FAILS | #7 is explicit: transcript+caption+OCR+embedding of ONE source = ONE evidence root; both derive from the same bytes and share failure modes (typographic text is transcribed by both [A3 2402.19150]) | Pseudo-corroboration inflates confidence in false content | None | None — this is the cleanest-stated principle in the architecture |
+| Y | transcript+waveform+summary = three sources | FAILS | #7; waveform "agreement" is not evidence of content at all; summary is a third derivation of the same audio | — | None | None |
+| Z | two sensors same device = independent | PARTIAL | #7 covers same-SOURCE derivations, but two sensors on one device share clock, firmware, position, and compromise surface (DolphinAttack-class device-level attacks [A3 1708.09537]); correlated compromise produces "independent-looking" agreeing evidence | Compromised device manufactures mutually corroborating false evidence | Device node in provenance graph; sensors behind one device get a correlated-trust flag; device compromise taints all its streams | No Rune audio/video ingestion yet — rule is prospective |
+
+### Block AA–AZ (identity, biometrics, provenance atoms)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| AA | synchronization proves causation | FAILS | #9 explicit: temporal co-occurrence ≠ causation | — | None | None |
+| AB | metadata timestamp = event time | FAILS | #9: EXIF source-asserted, never verified truth; ExifTool writes/deletes timestamps in one line [A3 ExifTool] | — | Add explicit three-timestamp taxonomy (source-asserted capture / ingestion-observed / content-internal) to spec so "event time" is never a single field | None |
+| AC | EXIF authoritative | FAILS | Same as AB; forensics standard treats metadata as process-dependent evidence, not self-authenticating [A3 NIST SP 800-86] | — | None | None |
+| AD | missing metadata = none existed | PARTIAL | Architecture records metadata but doesn't distinguish absent vs stripped vs failed-parse; privacy tools strip EXIF, making processed files indistinguishable from cameras that never wrote it | False provenance conclusions ("never had GPS" vs "GPS removed") | Ingestion records metadata-presence status: present / absent / stripped-detected / parse-failed | Strip detection is heuristic (absence of expected maker notes) |
+| AE | geolocation always retained | PARTIAL | Source retention keeps GPS bytes (fine locally); but the architecture never says derivatives/exports/thumbnails are EXIF-stripped, and #8's least-media disclosure covers providers, not local derivative hygiene | Location leaks through shared/exported derivatives | Strip or redact EXIF GPS in all derivatives and any export path; geo stays source-only with sensitivity flag | Local source retention with GPS is itself a decision the user should be able to revoke (retention field exists) |
+| AF | more metadata = better provenance | FAILS | Provenance quality = transformation lineage + acquisition trust [A3 NIST SP 800-86], not field count; more metadata also widens sensitive-leak surface [A3 GraphProfiler aggregation] | — | None | None |
+| AG | diarization identifies person | FAILS | Diarization supplies speaker-turn metadata, not identity [A2 1911.01255]; FISWG/NIST/GDPR line: match = lead, identity = separate governed act [A3 §2.2] | — | None | None |
+| AH | voice embedding = identity | FAILS | Speaker-verification EERs condition-dependent, spoofing compromises the verification layer itself [A3 2408.08739]; FISWG split [A3 §2.2] | — | None; speaker embeddings, if stored, are ephemeral similarity keys per #15 | None |
+| AI | face similarity = identity | FAILS | NIST IR 8280 demographic-differential error across 189 algorithms [A3]; GDPR Art. 9 triggers on identity purpose [A3] | — | None | None |
+| AJ | detected face = persistent user fact | FAILS | #15 hypotheses-not-facts; persisting person labels = aggregation amplifier [A3 2609.12448: 86.7% ASR grows with store] | — | None | None |
+| AK | voice emotion updates user state | FAILS | #15 explicit: emotion from voice never authoritative state | — | None | None |
+| AL | facial expression = emotional state | FAILS | #15 explicit | — | None | None |
+| AM | repeated observations justify preference inference | FAILS | #15 explicit: repeated multimodal observations = hypotheses | — | None; add: hypothesis promotion to preference requires explicit user confirmation, not count thresholds | None |
+| AN | screenshot pixels inert | FAILS | Adversarial pixels ARE payload: Image Hijacks >80% ASR incl. context exfiltration and false-belief implantation [A3 2309.00236, V]; perceptual-channel injection without any text [A3 2307.10490]; #8 treats multimodal content as DATA with CaMeL boundaries | Screenshots fed casually to any VLM can exfiltrate context or implant false beliefs | #8 stands; add: media is disclosed to models only via the least-media path, and never from a context containing private memory unless task requires | Defense is architectural; no model-side fix survives adaptive attack [A3 2609.04533] |
+| AO | OCR output safe | FAILS | Invisible/bidi characters flow through OCR text into pipelines unsanitized [A3 2106.09898]; OCR-text is a tested injection carrier [A3 2609.09404]; #8 taint-survives-transformation | Poisoned text enters FTS index and later contexts | Ingestion sanitization gate (invisible-character stripping/flagging) + Spotlighting-style provenance marking of untrusted spans [A3 2403.14720] | Sanitization is risk reduction, not guarantee; non-textual taint bypasses it entirely (AS) |
+| AP | image injection VLM-only problem | FAILS | Typographic attacks hit CLIP-era contrastive encoders [A3 2402.19150]; OCR-text carriers hit text-only stacks; #8 correctly covers all transformation outputs | — | None | None |
+| AQ | audio injection needs audible speech | FAILS | DolphinAttack: ultrasonic commands control real assistants [A3 1708.09537]; Whisper hallucinates 73–87% on non-speech input [A2 2606.07473]; audio-channel injection completes 49% of cells vs ~1% vision [A3 2609.09404] | Inaudible/malformed audio becomes fluent false transcripts that enter Memory | If audio ever ingested: VAD gate mandatory before ASR; band-energy anomaly check at capture; audio-derived text = untrusted-derived class | Rune has no audio path today; rule is prospective |
+| AR | PDF hidden layers irrelevant | PARTIAL | No dedicated study found of PDF hidden-layer/metadata injection (bounded zero-hit [A3 header]); but MMPIBench carrier taxonomy includes such vectors and #8's blanket taint rule covers them | If treated as irrelevant, hidden layers/annotations flow to parsers unsanitized | Treat ALL PDF layers, annotations, attachments, metadata as untrusted content at extraction | Evidence is structural (carrier taxonomy), not a measured PDF-specific attack rate |
+| AS | sanitizing OCR text solves injection | FAILS | Non-textual adversarial taint bypasses text entirely [A3 2307.10490, 2309.00236 V]; in-pipeline filters measured inadequate [A3 2503.06254, 2505.18543]; adaptive injection still >82% [A3 2609.04533] | False sense of safety; enforcement stays inside the susceptible model | Enforcement must stay OUTSIDE the model at tool/memory-write boundaries (CaMeL-style) — #8 already says this; text sanitization is one layer, never the defense | CaMeL costs ~7% task completion [A3 2503.18813 V] — acceptable, but must be budgeted |
+| AT | transformation removes taint if output benign | FAILS | #8 explicit: taint survives transformation; Arm 3 §2.1 verdict is exactly this; bounded zero-hit on a dedicated persistent-memory study, but convergent indirect evidence is strong [A3 §2.1] | — | None | The taint-graph could get expensive at decades scale; pragmatic bound: taint propagates transitively through derivations, cleared only by user action |
+| AU | generated = untrustworthy | FAILS | #11: synthetic ≠ false; detectors unreliable (sink-class failure on unseen generators [A3 2302.10174]) | — | None | None |
+| AV | camera-origin = trustworthy | FAILS | #11: camera ≠ true; EXIF forgeable [A3 ExifTool]; capture-path injection exists (DolphinAttack adjacency [A3 1708.09537]) | — | None | None |
+| AW | C2PA proves truth | FAILS | #11 + C2PA's own principle: provenance asserts source, never truth, no value judgments [A3 C2PA §1.2] | — | None | None |
+| AX | hash proves provenance | FAILS | A hash proves byte-identity-since-hashing, not origin; #2 correctly uses it as identity only; provenance = acquisition record + chain, which is separate metadata | — | Spec note: hash = integrity/identity; acquisition-provenance field (what tool/actor supplied the bytes) is separate and source-asserted | None |
+| AY | content-address = source authenticity | FAILS | Attacker-supplied bytes hash to themselves perfectly; Poisoned-MRAG: 5 poisoned pairs → 98% ASR given write access [A3 2503.06254]; integrity ≠ authenticity | Content-addressing mistaken for authentication → poisoned sources indistinguishable | Write-path authentication: source ingestion carries actor identity + tool capability (F5); quarantine for untrusted-contributed media before indexing [A3 §2.4.6] | Local single-user Rune lowers but does not erase this (hostile repos/screenshots are the attacker channel) |
+| AZ | same bytes = same context | FAILS | #6 event grouping is semantic; the same screenshot re-captured in a different session/event carries different event context; #9 segment refs bind context | — | None | None |
+
+### Block BA–BZ (evidence identity, derivatives, canonical store)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| BA | different bytes = different evidence | PARTIAL | #7 keys evidence roots on source objects, but recompression/resize creates a NEW content-address with new bytes → two "sources", two evidence roots, zero signal distinguishing them; exact dedupe misses; perceptual layer is suggestion-only [A3 C2PA §9] | Recompressed copies of one artifact count as N independent confirmations — inflates any confidence accounting | When a new media object is nominated as near-duplicate of an existing source (perceptual/embedding suggestion), require an evidence-link resolution (merge under one root or confirm distinct) before it can participate in corroboration counting | Resolution is itself model-in-the-loop — must be logged as a decision, not silent |
+| BB | recompressed image = new source | PARTIAL | Same mechanism as BA: byte-identity dedupe (#6) cannot see recompression; architecture permits creating a source object from any bytes with lineage=none | Duplicated evidence roots; storage of junk variants | Same as BA + ingestion heuristic: media ingested with missing EXIF/original-maker data AND high perceptual similarity to an existing source gets `suspected-derivative` flag pending resolution | No verified source quantifies recompression survival of specific hash families [A3 2212.08035 measures but doesn't rank] |
+| BC | screenshot of source = independent evidence | PARTIAL | A screenshot of a rendered document is a content-derivation whose lineage is untrackable (no pixel-level parent pointer); #7's one-root rule silently fails | Visual quoting of existing evidence counted as new observations | Content-match nomination (retrieval hit on rendered text/content) triggers an evidence-link question; never auto-merge | OCR-based content matching false-positives on boilerplate |
+| BD | crop = independent evidence | FAILS | #2: crops are derivations with tracked parent+region; lineage exists | — | None beyond I's parent-surfacing rule | None |
+| BE | OCR correction rewrites original | FAILS | #12: corrections change current derived view, keep source + history | — | None | None |
+| BF | correction deletes old interpretation | FAILS | #12 explicit | — | None | None |
+| BG | interpretation history unnecessary | FAILS | #12 + #1 (future models reinterpret source); history is the audit trail for correction propagation (DH) | — | None | None |
+| BH | region provenance needless | FAILS | #9 provides region (bbox/page-area) references; without them transcript/caption lines cannot be checked against source [A2 2106.06831: correction accuracy needs image-next-to-text] | — | None; region refs on OCR/caption rows should be default-on where the extractor emits coordinates | None |
+| BI | region provenance always required | FAILS | #9 says "available", not mandatory; forcing bbox on whole-frame artifacts adds schema burden with no evidence of benefit | — | None | None |
+| BJ | scene graphs canonical | FAILS | #1: only the source is canonical; scene graphs are model-derivations with hallucination rates [A3 2305.10355] | — | None | None |
+| BK | detections = facts | FAILS | Detector outputs are model claims with measured error and demographic variance [A3 NIST IR 8280; 2302.10174]; #15 hypotheses | — | None | None |
+| BL | every object enters Memory | PARTIAL | Architecture doesn't gate object-level extraction; mass object insertion would import language-prior hallucinations at scale (POPE: hallucinated objects are the corpus's frequent/co-occurring ones [A3 2305.10355]) | Memory fills with plausible-but-absent objects; each becomes retrieval-poisoning surface [A3 2503.06254] | Default OFF for object-level persistence; detections stay in derivative layer, promoted to Memory only on task need, as model-interpretation class | None |
+| BM | every media needs summary | PARTIAL | Captioning ceiling 67.0 vs 81.3 [A2 2407.01449]; chart summaries are the highest-risk content class (GPT-4o 47.1% on real charts [A3 2406.18521]) | Forced summaries add hallucinated index text where signal is weakest | Summary only for classes with measured value; charts prefer underlying-data text; media class triage decides (C) | Class-value measurement needs the missing eval harness (DZ) |
+| BN | every media needs text representation | PARTIAL | Text substrate is the evidence-backed retrieval route for audio [A2 §2.3.6] and documents, but forcing text on low-information media (wallpaper, logos, blank frames) only adds noise and hallucination surface | Index pollution; 1%-rate transcript hallucinations multiplied by forced coverage [A2 2402.08021] | Text representation for indexable classes only; class triage (C) gates | None |
+| BO | multimodal retrieval replaces lexical | FAILS | Exact-match queries untested/unsupported on visual retrievers; single-vector visual lanes lose to BM25-on-OCR [A2 Table 2]; FTS5 is the only exact-lookup guarantee [A2 §2.3.1] | — | None | None |
+| BP | cross-modal replaces exact lookup | FAILS | Same evidence as BO; cross-modal similarity is the weakest, least-calibrated signal [A1 B4/B5] | — | None | None |
+| BQ | vector similarity controls applicability | FAILS | #5: nominate, never authorize; the #402 defect (194015/193729) is the realized form of this exact attack [A1 baseline] | — | None mechanically enforced yet — see F4 | Architecture states the rule; enforcement is the open gap |
+| BR | retrieval frequency strengthens visual memories | FAILS | No warmth/reinforcement mechanism exists anywhere in the architecture; FTS5/sqlite-vec ranking doesn't count retrievals | — | None | None |
+| BS | warmth increases authority | FAILS | #5 separates retrieval from authority | — | None | None |
+| BT | salience = importance | PARTIAL | Architecture is silent on salience; a future "index the visually salient parts" heuristic would import perceptual salience (chart colors, image area) as importance, which correlates with hallucination priors, not task value [A3 2305.10355] | Important-but-visually-boring content (config values, error codes) under-indexed | Importance = task-anchored only; perceptual salience may be a derivative feature, never a Memory inclusion criterion | None |
+| BU | thumbnail as archival source | FAILS | Thumbnails are derived; low-res destroys visual retrieval measurably (ColPali 224px = 56.5 vs 81.3 [A2 2407.01449]) | — | None | None |
+| BV | transcoded copy replaces source without lineage | FAILS | #2 lineage mandatory incl. lossiness | — | None | None |
+| BW | lossy transformation needs no provenance | FAILS | #2 explicitly records lossiness | — | None | None |
+| BX | codec/model version irrelevant once text extracted | FAILS | Extraction model version changes the text itself (Whisper versions shift WER [A2 2212.04356]; ColQwen2 vs ColPali >5 pts [A2 Table 7]); #4 mandates stamping | — | None | None |
+| BY | provider capability = Rune multimodal | FAILS | Architecture is local-first (#10); capability assumptions are not made | — | None; capability claims must be observed per-provider and recorded source-asserted (CP) | None |
+| BZ | image-capable chat = durable image Memory | PARTIAL | #3 references source objects, but the architecture never says WHEN a transient provider attachment becomes a source object; provider attachment retention is transient input, not Memory | Memory rows reference attachments that silently expire → dangling references | Attachment ingestion = materialize bytes into the content-addressed store at receive time (or explicitly record non-durable pointer with expiry); no Memory row may reference an unmaterialized attachment | Copying raises rights/sensitivity questions (CF) |
+
+### Block CA–CZ (external references, storage, ownership)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| CA | attachment retention = Memory | PARTIAL | Same seam as BZ: retention policy of a provider/session ≠ Memory lifecycle; #3 prevents conflation only after materialization | Evidence loss on session GC | Same as BZ | None |
+| CB | file path = stable identity | FAILS | #2 content-addressed identity by hash | — | None | None |
+| CC | basename = enough provenance | FAILS | #2 requires acquisition time, MIME, sensitivity, retention | — | None | None |
+| CD | external URL = durable evidence | SUCCEEDS | Architecture says Memory carries REFERENCES to source objects but is silent on external URLs; URLs rot at decade scale and the decades-scale survival goal (#10 context) makes reference-only external media a slow-motion evidence loss; nothing in the arms contradicts the rot premise (link-rot is uncontested common knowledge; no arm source needed) | Memory entries whose evidence was "this URL" become unverifiable within years | External media referenced as evidence must be materialized into a source object (fetch + hash + rights/sensitivity check) at reference time, or explicitly recorded as non-durable with decay expectation | Copying may violate rights/ToS for some sources; needs a policy gate, not blanket copying |
+| CE | URLs durable decades | SUCCEEDS | Same as CD — the decades-scale survival goal makes this certain to bite | Same | Same as CD | None |
+| CF | all external media copied | FAILS | Opposite overreach: rights, sensitivity, and scale forbid blanket copying; #8 least-media and sensitivity fields provide the policy hooks | — | Copy decision per-reference with policy gate; record decision in lineage | None |
+| CG | no external media copied | FAILS | Then CD/CE win by default — evidence decays | — | Same as CD | None |
+| CH | SQLite blobs always simplest | FAILS | SQLite BLOB cap 1GB default/2GB hard, row-size coupling, WAL/vacuum pathology [A3 sqlite.org/limits]; #10 files+references is correct | — | None | None |
+| CI | filesystem stores always superior | FAILS | Overreach; SQLite is correct for metadata/thumbnails [A3 §2.4]; architecture already mixes correctly | — | None | None |
+| CJ | dedicated vector DB required | FAILS | n≈944: score-everything in SQLite+sqlite-vec is the measured-at-scale fit [A2 §2.2]; ViDoRe SOTA is score-everything at 10²–10⁴ docs | — | None | None |
+| CK | graph DB required for regions | FAILS | Region refs are bbox columns on derivative rows [A3 §2.4.1]; no graph evidence | — | None | None |
+| CL | new canonical database required | FAILS | #3: no second canonical store | — | None | None |
+| CM | multimodal Memory owns user-model inference | FAILS | #15: observations are hypotheses; user-model promotion is a separate seam | — | None | None |
+| CN | owns identity authentication | FAILS | Identity authority is out of scope by design [A3 §2.2 FISWG/GDPR] | — | None | None |
+| CO | owns security policy | FAILS | #8 puts enforcement at tool/memory-write boundaries in a CaMeL-style system layer OUTSIDE the model — policy definition is system-owned; Memory enforces write gates but doesn't define policy | — | Spec note: Memory executes policy, never authors it | None |
+| CP | owns provider capability truth | PARTIAL | Architecture silent on who tracks provider capabilities; BZ/CA/BY family shows the seam matters | Stale capability beliefs → ingestion paths break silently on provider change | Capability registry outside Memory; Memory records observed capability events as source-asserted facts with actor+time | None |
+| CQ | owns task state | FAILS | Memory is not a task tracker; no architecture text claims it | — | None | None |
+| CR | Mind Palace prominence = authority | PARTIAL | Architecture has no presentation-authority firewall; Rune's RichLog surface already renders content with prominence cues (F6); #5's nominate-never-authorize is a retrieval rule, not a UI rule | Visual prominence of one memory over another reads as an authority ranking to the reasoning loop and the user | Presentation metadata (prominence, recency display) explicitly marked presentation-only; never feeds ranking or supersession | None |
+| CS | richer media shown more prominently | FAILS | #13 prefers structured UI state; media rendering is a display policy | — | None | None |
+| CT | accessibility text replaces visual evidence | FAILS | #14: "still derivatives" | — | None | None |
+| CU | accessibility = presentation only | FAILS | #14 gives derived alt-text/transcripts an inspection function (evidence-checking surface), which is more than presentation — without ever being evidence | — | None | None |
+| CV | picture-superiority proves image preference | FAILS | Effect is task/population-conditional [A1 A14]; Rune's consumers are indexes/LLMs, not human perceivers [A1 rejected-transfer #7] | — | None | None |
+| CW | dual coding = everything twice | FAILS | Only the weak form (redundant retrieval routes where modalities capture different attributes) is evidence-supported [A1 A15, rejected-transfer #8] | — | None | None |
+| CX | copy human sensory memory | FAILS | Arm 1's central discipline: mechanisms live in nervous systems; only data properties transfer [A1 §2.1 transfer failures] | — | None | None |
+| CY | one correct event boundary | FAILS | Segmentation is simultaneous on multiple timescales [A1 A10]; #6 semantic grouping implies multiple granularities | — | None | None |
+| CZ | timeline proximity = shared event | PARTIAL | #9 says co-occurrence ≠ causation, but the event-GROUPING algorithm is unspecified; pure timestamp-window grouping would recreate the attack under a different name | Wrong event clusters harden into Memory structure | Event grouping = revisable hypothesis with provenance; grouping decisions logged like derivations; user-adjustable | No evidence on optimal grouping at Rune's data density |
+
+### Block DA–DZ (time, alignment, precedence, scope)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| DA | media timestamp enough for alignment | FAILS | EXIF forgeable [A3 ExifTool]; #9 provenance framing | — | None beyond AB's timestamp taxonomy | None |
+| DB | clock disagreement → average | FAILS | Averaging destroys per-source ordering and manufactures false simultaneity; nothing in the architecture does this | — | If cross-clock reconciliation ever needed: keep per-source clocks + estimated offset as data; never overwrite source times | None |
+| DC | drift negligible | FAILS | Long recordings accumulate seconds of drift; Whisper's 30s windows need external alignment [A2 2212.04356, 2303.00747] | — | If audio ingested: word-level alignment via forced alignment [A2 WhisperX], not naive window math | None |
+| DD | long recording = one Memory item | FAILS | #9 segment references; segment granularity universal [A2 §2.3.7] | — | None | None |
+| DE | every frame = one Memory item | FAILS | Same as L | — | None | None |
+| DF | segment boundaries model-authoritative | PARTIAL | #9 provides segments; #12 lets corrections change the current derived view — but nothing says segment boundaries (from Whisper windows/VAD) are revisable derivations rather than source-truth; model-external segmentation is a documented weak point [A2 2212.04356 §6] | Bad boundaries harden into permanent structure; later correction has no hook | Segment boundaries = derivations with lineage, user-adjustable; corrections to boundaries supersede like any derived view | Boundary-quality evaluation unmeasured at Rune's content |
+| DG | corrections override raw pixels | FAILS | #1/#12: sources immutable; corrections change derived view only | — | None | None |
+| DH | pixels override explicit user correction | PARTIAL | #12 covers corrections vs interpretation, but is silent on RE-DERIVATION: a future model upgrade re-deriving from source could resurrect an interpretation the user explicitly corrected | Corrected falsehood re-enters current view silently on model churn | Corrections attach to the SOURCE object (supersession records keyed by source hash); every re-derivation inherits active corrections before publication | None — this is a concrete, forced change |
+| DI | fixed modality precedence solves conflict | FAILS | Human "dominance" is a reliability outcome, not a rule [A1 A5, rejected-transfer #2]; fixed hierarchies encode bugs | — | None; conflicts surface with provenance to the reasoning loop [A1 rejected-transfer #10] | None |
+| DJ | frontier VLM auto-outranks older analysis | FAILS | #12 keeps history; frontier models still hallucinate at measured rates [A3 2305.10355; 2406.18521] | — | None | None |
+| DK | model prestige = perception authority | FAILS | Same evidence as DJ | — | None | None |
+| DL | multimodal models modify canonical Memory directly | PARTIAL | #8's CaMeL boundary implies model outputs enter only as mediated derived rows, but the write-path discipline (actor identity, capability, reason codes) is unspecified — and Rune's write path already has anonymous writers (F5) and a realized similarity-supersession defect (F4) | The single most damaging failure class in the architecture's own history (#402) recurs with media | All Memory writes carry: actor identity, tool capability, write reason-code; model outputs enter ONLY via a mediated writer that classifies them as derived rows (V's evidence classes) | Enforcement code must be tested adversarially (F4's regression test) |
+| DM | teacher interpretations = immediate training data | FAILS | Rune consumes models, doesn't train [A3 rejected approaches]; #1 interpretations ≠ sources | — | None | None |
+| DN | cross-model agreement = truth | FAILS | Agreement between models with overlapping training data is correlated, not independent (POPE: hallucinations follow shared language priors [A3 2305.10355]); #7's independence discipline generalizes | — | None | None |
+| DO | different vendors = independent | FAILS | Web-scale shared training corpora (LAION-lineage etc.) correlate errors; same reasoning as DN | — | None | None |
+| DP | same training corpus irrelevant | FAILS | Measured correlated failure modes across model generations [A3 2305.10355 HR@k; 2504.04893: typographic vulnerability persists across generations] | — | None | None |
+| DQ | better retrieval = Growth Delta | FAILS | No growth claim made anywhere in the architecture | — | None | None |
+| DR | better vision model = Rune learned | FAILS | #1 frames model upgrades as reinterpretation of the same source — not learning | — | None | None |
+| DS | better captions = cognition improved | FAILS | Captions have a measured quality ceiling below source-grounded retrieval [A2 2407.01449] | — | None | None |
+| DT | offline survival needs every model local | FAILS | #1: bytes + already-created text derivations remain fully usable offline; only NEW derivations pause | — | None | None |
+| DU | without VLM image evidence unusable | FAILS | Preserved sources + FTS text derivations stay queryable; semantic re-interpretation resumes when models return | — | Add capture-first ingestion: during no-model periods, bytes+metadata are always accepted and queued for derivation (F9) | New media arriving in no-LLM periods is semantically unsearchable until derived — real but bounded |
+| DV | no-LLM = multimodal evidence unusable | FAILS | Same as DT | — | Same | Same |
+| DW | exclude multimodal from Memory until #404 | FAILS | #1 preservation is cheap and model-free; deferring capture loses acquisition-time context that can never be reconstructed | — | None | None |
+| DX | #403 designs complete offline stack | FAILS | Derivations require models by design; architecture doesn't claim otherwise | — | None | None |
+| DY | #403 solves hardware acceleration | FAILS | 16GB VRAM is a stated constraint (ColPali fits bf16; ColQwen2 tight [A2 §2.3.3]); no claim made | — | None | None |
+| DZ | #403 solves final evaluation | FAILS | No claim made — but the RESIDUAL is real: the architecture specifies no measurement plan (no eval set, no per-lane calibration data, no acceptance thresholds). Several corrections above (F, M, BM, F11) require one | — | Forced addition: a small local evaluation harness (~50–100 queries from real Rune tasks, per-artifact-class) is a prerequisite for enabling gates and thresholds | Eval set construction is manual labor; n too small for learned fusion |
+
+### Block EA–EZ (security posture, lifecycle, preservation, presentation)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| EA | security = media never reaches external models | FAILS | #8 says least-media DISCLOSURE, not zero disclosure; some tasks legitimately need provider vision | — | None; disclosure log per provider call would complete the design | None |
+| EB | privacy = delete source after captioning | FAILS | #1/#10; deletion destroys re-interpretation and re-derivation forever; privacy is handled by sensitivity/retention fields | — | None | None |
+| EC | privacy = never store thumbnails | FAILS | Thumbnails are useful and sensitivity-gated (#8 propagates sensitivity to derivatives) | — | None | None |
+| ED | provenance = keep every sensitive derivative forever | FAILS | #8: sensitivity propagates to derivatives → retention applies to them too | — | None | None |
+| EE | deleting original deletes derived knowledge | PARTIAL | #1 says derivations are rebuildable — which is FALSE once the source is deleted; deletion policy interplay (orphaned derivatives) unspecified | Silent transition from "rebuildable" to "last copy" when sources are purged | Deletion of a source marks its derivations `orphaned`; policy decides orphan-retained (frozen, non-rebuildable) vs purged; state visible | Orphan retention may conflict with the deletion intent (privacy) — default should follow the source's deletion reason |
+| EF | deleting derivative should delete original | FAILS | Inverse of the dependency direction; #1 | — | None | None |
+| EG | tombstone contains full media metadata | PARTIAL | No tombstone design exists in the architecture; and full metadata in a tombstone recreates the privacy problem deletion was meant to solve | Deletion leaves either no trace (bad for integrity) or a metadata copy (bad for privacy) | Tombstone = {hash, media class, deletion reason code, time, actor} — NOT descriptive metadata | None |
+| EH | multimodal cannot be redacted | PARTIAL | #1 forbids byte-editing sources; #12 corrects derived views; but there is NO redaction path for "this region of a stored image must never again be visible" | Either redaction is impossible (privacy failure) or someone byte-edits a source (integrity failure) | Redaction = restricted-access flag on the source + a redacted DERIVATIVE as the only visible view + tombstone-style audit trail; source bytes remain for integrity but access-gated | Access-gated retention of unredacted bytes is a residual privacy exposure — must be explicit in the sensitivity policy |
+| EI | Synthetic Experience treats VLM observation as verified experience | PARTIAL | #15 covers the user-model seam but not the AGENT's own perceptual claims; no evidence class distinguishes "Rune observed (via model)" from "bytes captured" | Agent autobiography fills with model hallucinations stated as experience | Evidence-class taxonomy of V (applies to agent self-records too); "I saw X" rows must carry source-pointer + model lineage, and are model-interpretation class | None |
+| EJ | 'I saw X' proves X present | PARTIAL | Depends on EI's evidence classes existing; POPE-class hallucination makes unverified "I saw" claims unreliable by default [A3 2305.10355] | Same as EI | Same as EI | None |
+| EK | model description becomes autobiography without verification | PARTIAL | Same family as EI/EJ; #15's hypothesis framing is the right shape but scoped to user-model, not agent-model | Same | Same | None |
+| EL | one failure permanently reduces trust | PARTIAL | Architecture has no trust/calibration bookkeeping at all — so the attack has nothing to exploit, but the absence means future ad-hoc trust patches are likely | Ad-hoc trust heuristics later, probably wrong | Per-model-class reliability records updated by observed error events (Elo-style or simple rates), used for evidence WEIGHTING not verdicts [A1 §2.1: reliability as data] | n of observed errors at Rune scale is small; rates noisy |
+| EM | one success permanently increases trust | PARTIAL | Same as EL | Same | Same | Same |
+| EN | stable calibration across tasks | FAILS | Calibration is task- and stress-dependent (CharXiv −34.5% under mild stress [A3 2406.18521]); architecture claims nothing | — | None | None |
+| EO | provider swap needs no reindex planning | FAILS | #4 version stamping + S/ET's migration runbook | — | None | None |
+| EP | historical embeddings = preservation authorities | FAILS | #4: embeddings never canonical evidence | — | None | None |
+| EQ | storing weights necessary to understand old memories | PARTIAL | Understanding old INTERPRETATIONS requires provenance (which model/version produced them), which #2 mandates; re-deriving requires the weights, which may be unavailable for proprietary APIs; #1's "rebuildable" is conditional on model availability | "Rebuildable" silently false for API-derived content after provider EOL | Lineage must record exact model identifiers; derivations from proprietary APIs flagged `non-reproducible`; small local models may be archived as a policy choice, not an obligation | This is the honest cost of local-first + proprietary-provider mix; no full mitigation exists |
+| ER | century-scale readability needs every old inference engine preserved | FAILS | #1: source + text derivations are the readable substrate; engines only needed for re-derivation [A1 #1 rationale] | — | None | None |
+| ES | proprietary APIs safe forever | FAILS | #10's decades-scale goal is incompatible with assuming API permanence; EQ's flags are the honest answer | — | None | None |
+| ET | raw evidence enough, indexes need no migration plan | SUCCEEDS | #1 makes sources the preservation object — correct — but the architecture has NO migration plan for indexes: the existing unversioned embedding index (S/R/F1), schema evolution of FTS tables, and decades-scale rebuild procedures are all unplanned [A3 §2.4.5] | Index rot becomes Memory loss in practice even though sources survive (EU is then FALSE in practice) | Migration runbook as a first-class deliverable: versioned index tables, dual-index verification window, legacy-space quarantine, scheduled rebuild drills (F8) | None — this is a documentation gap with production consequences |
+| EU | index loss = Memory loss | FAILS | In theory #1/#3: indexes rebuild from sources. In practice ET/F1 show the rebuild path must exist and be exercised — architecture survives, operations must be added | — | See ET | None |
+| EV | multimodal Memory must be visible as complex graph | FAILS | Presentation overreach; #13 structured-first; #5 presentation ≠ authority | — | None | None |
+| EW | more visual richness always improves understanding | FAILS | More visual context measurably lowers answer accuracy [A2 2608.07006]; #5 sufficiency gating | — | None | None |
+| EX | 3D spatialization suits image/video memories | FAILS | No evidence; presentation flourish | — | None | None |
+| EY | multimedia automatically improves recall/usability | FAILS | Picture-superiority is conditional [A1 A14]; consumers are indexes/LLMs [A1 §2.1] | — | None | None |
+| EZ | richest representation shown first | FAILS | #13 structured-first | — | None | None |
+
+---
+
+## 2. Rune-specific attacks (F1–F14)
+
+| ID | Attack | Verdict | Evidence | Consequence if it won | Correction (forced design change) | Residual |
+|---|---|---|---|---|---|---|
+| F1 | Unversioned production embeddings make every future dense-lane change unsafe: the 944-entry sqlite-vec index records no model/version; stamping forward cannot retroactively fix existing rows; any partial re-embed or model swap mixes incomparable spaces with no error signal | SUCCEEDS | A1 baseline (no model/version recorded); CLIP-family versions differ in dimension (1024/512/768) [A1 B12]; init determines cone geometry [A1 B5]; model choice shifts retrieval >5 pts [A2 Table 7] | Silent ranking corruption at the next model change; undiagnosable retrieval regressions | Schema migration FIRST: add (model_id, version, dim, space_id) columns; mark legacy rows `space_id=legacy-unknown` and freeze them from cross-space queries; rebuild index wholesale + swap [A3 §2.4.5] | If code archaeology can't identify the legacy model, legacy vectors are only discardable, never reconcilable |
+| F2 | PDF flattening already ships and did not keep page images: the architecture's "preserve source, derive interpretation" is violated by the current pipeline for every document ingested to date | SUCCEEDS | A1 baseline (flattens PDFs, layout destroyed); measured cost +10 to +48 nDCG on visual-rich classes [A2 2407.01449] | Already-ingested visual-rich docs permanently degraded unless source PDFs exist for backfill | Audit source-file retention for the existing corpus; backfill page images (≥448px) + doc-class tags where sources exist; record permanent loss where they don't; ingestion change per C | Retention status of existing corpus unknown — audit is the blocking first step |
+| F3 | Tesseract installed but unwired invites a "cheap OCR lane" that silently recreates the exact pipeline ColPali beat by +14–16 nDCG on visual-rich pages; OCR-first is defensible ONLY on the text-dense/scanned-prose class | PARTIAL | ColPali vs OCR+BM25 gap; Tesseract's own docs concede table/sparse-layout failure [A2 2407.01449, tessdoc]; text-dense pages near-parity (+3.1) [A2 Table 2] | A default-on OCR lane would look like progress while degrading the highest-value document classes | Wire Tesseract as ONE lane, gated by doc-class triage, emitting confidence + page/bbox provenance; visual-rich class routes to page-image retention (+ optionally ColPali-class lane when VRAM budget allows, F7) | GOT-OCR2.0-class upgrade path exists for math/tables [A2 2409.01704] but is unmeasured on Rune's corpus |
+| F4 | The #402 cross-domain similarity-supersession defect (194015/193729) proves the write path ALREADY lets semantic similarity drive supersession — architecture principle #5 states the right rule but specifies no enforcing mechanism | SUCCEEDS | A1 baseline: prior Atlas run observed semantic similarity superseding an unrelated cross-domain entry | Every new media lane multiplies similarity-driven write paths; the realized defect class scales with lanes | Supersession requires an explicit reason code ∈ {user-correction, contradiction-with-source, provenance-error}; similarity alone may only create a `related` link; regression test: a similarity-only supersession attempt must be REJECTED by the write path | Contradiction detection itself is model-made — reason codes can be wrong, but they're auditable in a way raw similarity is not |
+| F5 | Curators and cron jobs write Memory without actor identity: #8 (taint, policy gates) and #12 (corrections, supersession) are unenforceable when writes are anonymous — provenance chain breaks at ingestion for a large fraction of current writes | SUCCEEDS | A1 baseline (curators/cron write without actor identity); AY (integrity ≠ authenticity — anonymous writes can't be authenticated) | Taint propagation, correction inheritance (DH), and audit trails all silently fail for system writers | Every write carries actor identity (session id, tool, cron-id, model-id); anonymous writes rejected or stamped `actor=system-unattested` with reduced trust class; retrofit existing rows as far as logs allow | Historical rows may be permanently unattributable |
+| F6 | RichLog(markup=True) is a live injection surface for media-derived text: OCR/transcript content containing Rich markup (`[link=…]`, `[red]`, bracket constructs) is interpreted by the renderer; any future image/URL rendering path in Rich output would let memory content fetch or render remote media | SUCCEEDS | Rich's markup=True interpretation of square-bracket content in untrusted text (mechanism: same class as Bad Characters' pipeline-unsanitized content [A3 2106.09898]); Rune renders Memory through RichLog today | Hostile OCR text (from a hostile repo's screenshot) executes formatting/links in the agent's own console; escalation path if rendering gains capabilities | Render memory-derived content with markup escaping (or markup=False paths) — memory content is DATA in the presentation layer too; never auto-render URLs/media referenced inside memory text | Escape coverage must be tested against the Rich version in use; this is a code fix, discovered here as an architecture-level lesson: every surface that renders memory content needs the same data/control separation as #8 |
+| F7 | One 16GB-VRAM workstation shared with the agent's main model: visual derivation/indexing/rerank lanes compete for VRAM with the primary workload; the architecture assumes lanes are affordable but never budgets them | PARTIAL | ColPali fits 16GB bf16; ColQwen2 "tight, consider quantization" [A2 §2.3.3]; multi-vector stores trivial at 944 pages [A2 §2.2] but model residency is the constraint | OOM/eviction during long coding sessions, or visual lanes silently degraded to CPU | VRAM budget policy: visual derivation/indexing runs as batch at idle; quantized visual models; no concurrent residency with the primary model; pick ColPali-class over ColQwen2-class unless measured to fit | Quantization effects on retrieval quality unmeasured locally |
+| F8 | Decades-scale survival goal vs SQLite schema drift and model EOL: architecture has no format-migration, schema-versioning, or rebuild-drill story for the Memory DB itself | PARTIAL | A3 §2.4.5 (re-embed+swap is the only measured migration pattern; no production dual-index literature found — bounded gap); ET | Schema rot + dead derivations accumulate until the DB is effectively unmovable | schema_version table + tested migration scripts; derivations always carry enough provenance to rebuild indexes from sources (ET); scheduled rebuild drill (e.g., annual) proving EU holds in practice | Rebuild drills cost time; skipping them is how ET becomes true |
+| F9 | No-LLM-period requirement vs semantic lanes: during offline/no-model periods, newly captured media cannot be captioned/transcribed; if ingestion blocks on derivation, evidence is lost at exactly the wrong moment | PARTIAL | #1 says derivations are rebuildable — but only if the media was captured; DU/DV analysis shows bytes+text survive, capture must not wait | Media arriving in degraded periods never enters Memory at all | Capture-first ingestion: bytes + minimal metadata always accepted immediately; derivation queue processed when models return; meanwhile FTS covers user-annotated text/filenames | Undeived media are semantically unsearchable until derived — bounded but real |
+| F10 | Score-everything fusion with multimodal lanes at n≈944: lane scores are on incomparable scales (modality gap [A1 B5]; SigLIP vs softmax loss shapes [A1 B3]; FTS5 BM25 vs cosine) — naive weighted fusion lets one lane dominate invisibly | SUCCEEDS | A1 B5 (cross-modal vs within-modal distances on different scales, nonzero offset); A1 B3 (loss shape changes score calibration); #383's fusion design assumed text-lane homogeneity | One lane (probably the newest visual lane) silently dominates ranking; fused scores meaningless | Per-lane normalization that never compares raw scores across lanes (rank-based fusion, e.g., RRF-style, or per-lane calibrated ranks); per-lane calibration on the DZ eval set before weighted fusion is even considered | n too small for learned fusion weights; rank fusion is the defensible default |
+| F11 | Sufficiency-gated abstention thresholds are undefined for visual evidence: no measured mapping from fused scores to sufficiency exists at Rune's distribution; the gate could silently abstain on all image queries | PARTIAL | #5 names the mechanism but no thresholds; admission-control evidence exists only at benchmark scale [A2 2608.07006] | Abstention either never fires (useless) or always fires (visual memory effectively disabled) | Build the DZ eval set FIRST; per-artifact-class thresholds; log every gate decision for post-hoc tuning | Thresholds drift with corpus growth; re-calibration cadence needed |
+| F12 | Lineage pointers (#2) are written by the same untrusted derivation code that produced the derivative: model-declared provenance is self-attested, so the lineage graph's integrity rests on the code that models can influence via injected content | PARTIAL | #8's own threat model: media-derived content can steer the model [A3 2309.00236 V]; if the model writes its own provenance, taint-tracking is compromised at the root | Taint graph forged; hostile content laundered by fake lineage | Storage layer writes lineage from tool-call context (actual bytes read, actual model called), never from model output; model-declared provenance stored as a claim, storage-observed provenance as fact; mismatch is an alert | Some derivations are hard to observe externally (multi-step tool chains) — needs careful instrumentation |
+| F13 | Thumbnails/small media as SQLite BLOBs alongside file-based sources invites drift: regenerated thumbnails with different parameters silently change derived-row bytes, breaking reproducibility of the derived layer | PARTIAL | A3 §2.4 (thumbnails-as-blob allowed); #2 requires lineage incl. parameters | Derived rows not reproducible; silent drift between environments | Content-address thumbnails too (hash includes generation params in lineage); treat like any derivation | Minor, bookkeeping-level |
+| F14 | Two eras of provenance coexist: legacy rows (flattened text, no coordinates, no doc class, anonymous writers) vs new-schema rows; #9's region provenance and #12's corrections cannot apply uniformly to legacy rows | SUCCEEDS | F2 (flattening already shipped), F5 (anonymous writers), A1 baseline | Uniform queries over mixed-provenance rows produce misleading confidence; corrections can't be anchored on legacy derivations | Per-row provenance-richness version (`provenance=prior-era` flag); retrieval surfaces degrade gracefully (show what exists); backfill where sources retained (F2); corrections on legacy rows attach to the entry, flagged non-source-anchored | Legacy rows without sources are permanently second-class — document, don't hide |
+
+---
+
+## 3. Mechanical verdict counts
+
+(counted with grep over the verdict column; see §5 verification)
+
+| Verdict | Count | IDs |
+|---|---|---|
+| SUCCEEDS | 12 | C, S, CD, CE, ET, F1, F2, F4, F5, F6, F10, F14 |
+| PARTIAL | 43 | A, I, J, K, M, N, R, V, Z, AD, AE, AR, BA, BB, BC, BL, BM, BN, BT, BZ, CA, CP, CR, CZ, DF, DH, DL, EE, EG, EH, EI, EJ, EK, EL, EM, EQ, F3, F7, F8, F9, F11, F12, F13 |
+| FAILS | 115 | all remaining mandated IDs: B, D, E, F, G, H, L, O, P, Q, T, U, W, X, Y, AA, AB, AC, AF, AG, AH, AI, AJ, AK, AL, AM, AN, AO, AP, AQ, AS, AT, AU, AV, AW, AX, AY, AZ, BD, BE, BF, BG, BH, BI, BJ, BK, BO, BP, BQ, BR, BS, BU, BV, BW, BX, BY, CB, CC, CF, CG, CH, CI, CJ, CK, CL, CM, CN, CO, CQ, CS, CT, CU, CV, CW, CX, CY, DA, DB, DC, DD, DE, DG, DI, DJ, DK, DM, DN, DO, DP, DQ, DR, DS, DT, DU, DV, DW, DX, DY, DZ, EA, EB, EC, ED, EF, EN, EO, EP, ER, ES, EU, EV, EW, EX, EY, EZ |
+
+Attack pressure concentrates where the architecture meets Rune's production reality: **7 of 12 SUCCEEDS are Rune-specific or implementation-gap attacks (F1, F2, F4, F5, F6, F10, F14), plus C, S, CD/CE, ET — all gaps between stated principle and shipped system or unplanned operations, not flaws in the 15 principles themselves.** No SUCCEEDS land on the architecture's core epistemics (#1–#5, #7): preserve-source, evidence-root, nominate-never-authorize, and the biometric/user-model lines survived every direct attack.
+
+---
+
+## 4. Sharpest findings (top 5)
+
+1. **The architecture's principles are sound; its absence of a write-path enforcement layer is the actual vulnerability (F4, F5, DL, V).** #5's "similarity never authorizes supersession" and #8's CaMeL boundary are stated but not mechanized — and Rune has already realized the failure (#402: 194015/193729) with anonymous writer identity making audit impossible. Every multimodal lane multiplies the attack surface of this one gap. The single highest-leverage correction in this report is the enforced write contract (actor + capability + reason code + evidence class), with a regression test for similarity-only supersession.
+
+2. **The unversioned embedding index is a loaded gun (S, R, F1, ET).** Production embeddings carry no model/version while the evidence shows versions differ in dimension (512/768/1024 [A1 B12]), geometry (init-dependent cones [A1 B5]), and measured retrieval quality (>5 pts [A2 Table 7]). Any future model change without the quarantine/rebuild migration silently corrupts ranking. This must be fixed BEFORE any dense lane is added, not after.
+
+3. **Shipping PDF flattening contradicts principle #1 for every document ingested so far (C, A, F2, F14), and the damage is quantified, not hypothetical** (+10 to +48 nDCG on visual-rich classes [A2 2407.01449]; Tesseract's own docs concede the failure classes). The architecture's core principle is correct; the pipeline never implemented it. Backfill from retained sources is only possible after a retention audit that has never been done.
+
+4. **Every surface that renders or transmits memory content needs #8's data/control separation — including RichLog(markup=True) (F6) — and transformation never launders taint (AO, AS, AT).** OCR text from a hostile screenshot is attacker-controlled payload that today flows into a markup-interpreting console and an FTS index feeding future contexts. Sanitization is one layer; the durable defense is outside-the-model enforcement at write/tool boundaries [A3 2503.18813 V] plus lineage written by the storage layer, never by the model (F12).
+
+5. **The architecture omits its own operations: no eval harness (DZ residual), no index-migration runbook (ET), no derivative lifecycle (N, EE), no redaction path (EH), no trust-calibration bookkeeping (EL/EM).** These omissions are why several otherwise-correct principles (rebuildable derivatives, sufficiency gates, calibration) would fail in practice: gates without measured thresholds, rebuildability without rebuild drills, derivatives without lifecycle classes. The forced corrections below close these operationally.
+
+---
+
+## 5. Forced corrections to the architecture (design changes the verdicts compel)
+
+1. **Enforced Memory write contract (F4, F5, DL, V, AY).** Every write carries: actor identity (session/tool/cron/model), tool capability, reason code (for supersession: user-correction | contradiction-with-source | provenance-error only), and evidence class (captured-bytes | extracted-text | model-interpretation). Similarity alone can only create `related` links. Regression test: similarity-only supersession must be rejected. Model outputs enter Memory only through a mediated writer; lineage written by the storage layer from observed tool-call context, never from model output (F12).
+2. **Embedding-space hygiene migration, before any dense lane (S, R, F1).** Add (model_id, version, dim, space_id) to every embedding row; quarantine legacy vectors as `legacy-unknown` space, frozen from cross-space queries; rebuild index wholesale + swap with a verification window [A3 §2.4.5].
+3. **Source-retention + triage at ingestion (C, A, F2, BN, BM).** Per-artifact class tag (native-text / scanned-prose / visual-rich); visual-rich class retains page images ≥448px before any text extraction; no media class is forced into text; audit existing corpus for retained sources and backfill where possible; flag irrecoverable legacy rows `provenance=prior-era` (F14).
+4. **Capture-first ingestion + derivation queue (F9, DU/DV, DT).** Bytes + minimal metadata are always accepted immediately, even in no-model periods; derivation is queued and processed when models return; FTS covers user-annotated text in the interim.
+5. **Two storage lifecycle classes (N, EE, EG).** Sources: preserve, cool-OK, never byte-edit. Derivatives: cache-class, deletable/rebuildable, lineage-mandatory. Source deletion marks derivations `orphaned` with explicit policy (retained-frozen vs purged); tombstones carry {hash, class, reason, time, actor} only. Redaction = access-gated source + redacted derivative as sole visible view (EH).
+6. **Correction inheritance across re-derivation (DH, U, DF).** Corrections and supersessions attach to the SOURCE object (keyed by hash); every re-derivation inherits active corrections before publication; segment boundaries are revisable derivations, not source-truth.
+7. **Index-migration runbook + schema versioning as first-class deliverables (ET, EU, F8).** Versioned index tables, dual-index verification, legacy-space quarantine, schema_version table with tested migrations, scheduled rebuild drills proving indexes are rebuildable from sources.
+8. **Local evaluation harness as a prerequisite for gates (DZ, F, M, BM, F11).** ~50–100 queries from real Rune tasks, per-artifact-class; used to set nomination thresholds, sufficiency-gate levels, and per-lane calibration BEFORE enabling abstention or weighted fusion. Until then: rank-based (RRF-style) fusion that never compares raw scores across lanes (F10).
+9. **External-reference materialization policy (CD, CE, BZ, CA, CF).** Media referenced as evidence is materialized into a content-addressed source object at reference time (with a rights/sensitivity gate), or explicitly recorded non-durable; no Memory row references unmaterialized attachments or bare URLs as evidence.
+10. **Presentation-authority firewall (CR, F6, EV, EZ).** Prominence/recency/richness are presentation-only metadata, never ranking or supersession inputs; all memory-content rendering (including RichLog markup) escapes or disables markup; memory content never auto-renders URLs or media.
+11. **Trust metadata, not trust verdicts (EL, EM, EN, W).** Per-model-class reliability records updated by observed error events, used for evidence weighting; no permanent trust judgments, no persisted model-confidence-as-probability, no cross-version or cross-modal score comparison (A1 B5/B12).
+12. **Reproducibility honesty in lineage (EQ, ES, T, BX).** Lineage records exact model identifiers; proprietary-API derivations flagged `non-reproducible`; rebuildability claims are conditional on model availability and stated as such.
+13. **Prospective audio/video guards (AQ, AG–AL, J, K, DD, Z, DC).** If audio/video is ever ingested: VAD gate before ASR (non-speech hallucination 73–87% [A2 2606.07473]), segment-indexed derivatives (never one caption, never per-frame), timestamps + audio pointer on every transcript chunk, biometric similarity = workflow hints only, device-level correlated-trust flag.
+14. **Metadata hygiene (AB, AD, AE).** Three-timestamp taxonomy (source-asserted / ingestion-observed / content-internal); metadata-presence status recorded (absent vs stripped vs failed-parse); EXIF GPS stripped from derivatives and exports.
+
+## 6. Verification appendix (this arm)
+
+- Re-verified by direct fetch this pass: arXiv 2309.00236 (Image Hijacks — title/authors/abstract match; >80% ASR across four attack classes confirmed verbatim) and arXiv 2503.18813 (CaMeL — 77% provable vs 84% undefended on AgentDojo confirmed verbatim). All other citations are consumed from arms 1–3, which performed ID verification (the arms collectively caught ~16 mis-paired IDs; their do-not-cite registers were respected here — no barred ID is cited above).
+- Mechanical verdict count performed with `grep -c` over the verdict columns of this file (see count block below).
+- Independence note: attack selection, verdicts, and corrections were derived from the architecture text and the evidence rows, not from any other arm's conclusions; where an arm's synthesis and my verdict diverge in emphasis (e.g., DL scored PARTIAL rather than FAILS because enforcement is unspecified and the #402 defect is realized), the divergence is deliberate and stated.
+
+— End of Arm 4. —

research/memory-atlas-r1/AB-multimodal-artifact-memory/03_applicability.md

@@ -0,0 +1,60 @@
+# #403 AB — Applicability (mechanisms tested against Rune's inward reality, 2026-09-22)
+
+| # | Mechanism | Verdict | Rationale |
+|---|---|---|---|
+| 1 | ★ Source-object model (content-addressed original + derived projections with lineage) | ADOPT | inward: PDF flattening ships, no source concept; arm2 ColPali RS + arm1 CLIP §6 RS; arm4 verdicts C,A FAIL |
+| 2 | ★ Memory = references to content-addressed media; no second canonical store | ADOPT | documents-table precedent; family R0-1; arm4 CL,CJ FAIL |
+| 3 | ★ Modality-specific indexes + cross-modal bridge (no universal space) | ADOPT | arm1 RS anchors (modality gap; ImageBind hub-mediated); arm4 E FAIL |
+| 4 | ★ Embedding lanes stamped model+version; wholesale rebuild on change | ADOPT | inward unversioned production embeddings; arm4 S,ET SUCCEEDS |
+| 5 | Score-everything fused retrieval + late-interaction rerank + sufficiency gate (no cascade) | ADOPT | #383 row truth + arm2 confirmation at 100-1600 docs |
+| 6 | Cross-modal similarity nominates, never authorizes supersession/deletion | ADOPT | #402 RUNE_DIRECT observed defect (194015/193729); C2PA soft/hard binding |
+| 7 | Byte-identity = only automatic dedupe; perceptual similarity = suggestion | ADOPT | arm3 NeuralHash collision + DB-poisoning evidence; arm4 G,H FAIL |
+| 8 | ★ One source = one evidence root; derivatives never count as corroboration | ADOPT | #397 carry + arm1 ImageBind; arm4 X,Y,Z FAIL |
+| 9 | ★ Multimodal content = data never control; taint survives transformation | ADOPT | arm3 injection evidence (82% adaptive; audio 49%); CaMeL external finding; arm4 AN-AT FAIL |
+| 10 | Enforcement at tool/memory-write boundaries outside the model | ADOPT | CaMeL's formal out-of-band architecture under its stated threat model (external finding); broader 2026 evidence for out-of-model enforcement; #402 carry |
+| 11 | ★ VAD-gated timestamped transcripts; waveform retained; transcript ≠ recording | ADOPT | arm2 Whisper RS + hallucination evidence; arm4 B FAIL |
+| 12 | Diarization = metadata enrichment, never identity | ADOPT | arm3 FISWG/NIST; arm4 AG,AH FAIL |
+| 13 | ★ Capture-first document ingestion (page images + layout + text) | ADOPT | ColPali RS numbers (figures 2.5×, tables +13.1); inward flattening defect |
+| 14 | OCR text = derived observation with provenance + confidence + region mapping | ADOPT | arm2 Tesseract doc concessions; arm4 AO FAIL |
+| 15 | OCR-first sufficient for native prose / text-dense documents | ADOPT | TAT-DQA +3.1; DSE competitive on text-intensive — scoped to prose |
+| 16 | ★ Event-boundary anchoring for media evidence; temporal ranges first-class | ADOPT | arm1 Zacks RS; arm2 segment-granularity consensus |
+| 17 | Region/page provenance available for image/document claims (not universally required) | ADOPT | arm2 region retrieval; arm4 BH,BI both rejected as absolutes |
+| 18 | Metadata = source-asserted evidence; timestamp taxonomy (observed/asserted/verified) | ADOPT | arm3 forensics treatment; arm4 AB,AC FAIL |
+| 19 | Geolocation stripped-by-default in disclosures | ADOPT | arm3 leakage evidence; arm4 AE partial |
+| 20 | ★ Least-media disclosure to providers; sensitivity propagates to derivatives | ADOPT | #402 carry; arm3 derivative-leak evidence; arm4 E17/E18 |
+| 21 | Sensitive-trait inference never persists as fact by default | ADOPT | arm3 Kosinski/LLM-profiler evidence; arm4 AJ-AM FAIL |
+| 22 | Biometric similarity = workflow match surfaced to user, never identity authority | ADOPT | FISWG split precedent; NIST differential error |
+| 23 | ★ No-model degraded mode keeps evidence state visible | ADOPT | #400 carry; inward: today IS degraded mode |
+| 24 | Synthetic media: record provenance, never auto-verdicts | ADOPT | C2PA doc; detector unreliability evidence |
+| 25 | User corrections: current-view change + history + source-hash keying | ADOPT | #388 carry; arm2 correction evidence; Rune-original propagation design |
+| 26 | Interpretation versioning with truth-maintenance supersession | ADOPT | arm4 U FAIL; ColPali/ColQwen2 divergence |
+| 27 | Structured UI state primary over screenshots; escape-by-default rendering | ADOPT | arm4 F6 SUCCEEDS (RichLog live defect); #401 carry |
+| 28 | Accessibility derivatives support inspection (remain derivatives) | ADOPT | #401 carry; arm4 CT,CU both rejected |
+| 29 | Storage: content-addressed files + SQLite metadata + small thumbnails | ADOPT | arm3 storage verdict; inward scale (436MB text) |
+| 30 | Two lifecycle classes (hot derivative / cold original); cooling ≠ deletion | ADOPT | arm4 O,P FAIL |
+| 31 | Recompute-over-store for expensive derivatives | ADOPT | reindex minutes at 944; arm4 N,M partials |
+| 32 | Fixity-checking cron for referenced media (pointer liveness) | FUTURE | family carry; valuable but no media exists yet — schedule at first media corpus |
+| 33 | C2PA validation at ingestion | FUTURE | provenance recording now, validation when content-credentials media appears |
+| 34 | Perceptual-hash column in metadata | EXPERIMENT | cheap hint column; only useful once near-dup discovery has a demonstrated Rune need |
+| 35 | Local multimodal embedder in the existing index | FUTURE | family R0-2 carry: only on a demonstrated "seen-that-before" retrieval failure; benchmark first |
+| 36 | Dual-index migration pattern for embedding swaps | ADOPT | arm3 migration practice; minutes-scale at Rune |
+| 37 | ColPali-style visual page retrieval lane | FUTURE | build only with document corpus; multi-vector storage 0.5GB-scale fine but no pages ingested yet |
+| 38 | Audio ingestion pipeline (ASR + diarization + VAD) | FUTURE | no audio corpus today; design recorded (C008), build on need |
+| 39 | Video ingestion (segment-level, keyframes, temporal refs) | FUTURE | design recorded; no video corpus |
+| 40 | Scene graphs as canonical structure | REJECT | arm4 BJ FAIL; region refs suffice; complexity without demonstrated need |
+| 41 | Every detected object enters Memory | REJECT | arm4 BK,BL FAIL; detections are observations with provenance, not facts |
+| 42 | One universal multimodal embedding space as primary | REJECT | arm1 RS evidence (modality gap; hub-mediation; fine-structure loss) |
+| 43 | Per-frame video indexing | REJECT | arm2: no surveyed line uses it; segment granularity wins |
+| 44 | Similarity-threshold destructive dedupe | REJECT | #402 observed defect + C2PA normative + arm3 collision evidence |
+| 45 | Storing screenshots as memory entries (batched artifact's REJECT, re-verified) | REJECT | zero payoff evidence for text-first agent; store-reference + derived text instead |
+| 46 | Multimodal Memory owning user-model inference | REJECT | seam discipline: #398 owns user model; observations are hypotheses only |
+| 47 | Multimodal Memory owning identity authentication | REJECT | #402 owns authentication; biometrics = matching hints only |
+| 48 | Multimodal Memory owning provider-capability truth | REJECT | #400 owns capability truth; modality capability is one more capability fact |
+| 49 | Face/voice emotion as authoritative user state | REJECT | arm4 AK,AL FAIL; inference ≠ state |
+| 50 | AI-content detectors as automatic decision-makers | REJECT | arm3 detector-unreliability evidence; metadata not verdicts |
+| 51 | 3D spatialization for media memories | REJECT | #401 carry: 3D not justified for inspection |
+| 52 | Direct human-cognition transplants (MLE fusion, forgetting curves, sensory memory) | REJECT | arm1: 12 transfers rejected with stated reasons |
+| 53 | Region-level provenance universally required | PARK | available mechanism (row 17) but mandating it everywhere is overhead without demonstrated need |
+| 54 | Thumbnail as archival source | REJECT | arm4 BU FAIL; thumbnail is a derived representation |
+
+Row-derived: ADOPT 32 · ADAPT 0 · EXPERIMENT 1 · FUTURE 6 · REJECT 14 · PARK 1 · Sum 54. ★ = build-precondition / follow-through items (9).

research/memory-atlas-r1/AB-multimodal-artifact-memory/04_innovation.md

@@ -0,0 +1,30 @@
+# #403 AB — Innovation (mandate: no manufactured novelty; each candidate derives from arm evidence)
+
+Candidates A–X (24). Each: prior art / evidence / threat model / falsifier / kill criterion.
+
+- **A. Artifact-reference type in T1 schema** (hash, location, format, acquisition-time vs capture-time, sensitivity, retention). Prior: Git LFS/DVC; family R0-1. Evidence: inward documents-table precedent; arm4 CB,CC FAIL (path/basename ≠ identity). Falsifier: a media class where paths are stable for decades. Kill: fixity cron shows pointer rot >0 with no recovery path. → ADOPT.
+- **B. Derived-representation record with lineage** (parent source hash, transformation type, tool/model+version, lossiness, confidence class). Prior: #397 provenance envelope (DERIVED record kind); W3C PROV. Evidence: arm3 transformation evidence; arm4 T,BW FAIL. Falsifier: transformation metadata never disambiguates an error. Kill: lineage fields unused in any E-experiment diagnosis. → ADOPT.
+- **C. Correction ledger keyed to source hash, inherited by re-derivations.** Prior: #388 truth maintenance; crowd-OCR-correction (arm2). Evidence: bounded zero-hit — no user-corrected-OCR-propagation work found (Rune-original); arm4 BE,BF FAIL. Falsifier: corrections consistently re-lost on model upgrade in E3. Kill: E3 inheritance failure. → ADOPT.
+- **D. Evidence-root counter at context assembly** (derivatives collapse to roots). Prior: #397 derivation algebra; arm1 ImageBind. Evidence: arm4 X,Y,Z FAIL. Falsifier: derivative multiplicity measurably improves verification. Kill: E10 counts N confirmations. → ADOPT.
+- **E. Modality-capability stamping** (which provider/model consumed/produced which modality). Prior: #400 capability truth. Evidence: inward: modality support undeclared. Falsifier: capability stamps never used in routing/degradation decisions. Kill: never read. → ADOPT.
+- **F. Timestamp taxonomy: observed_at / asserted_capture / verified_event.** Prior: #397 envelope (observed_at ≠ ingested_at); NIST forensics. Evidence: arm4 AB,AC,DA FAIL. Falsifier: single timestamps never conflict in practice. Kill: E11/E12 conflicts unresolved. → ADOPT.
+- **G. Sensitivity-propagation labels on derivatives.** Prior: #402 taint carry. Evidence: arm3 derivative-leak evidence. Falsifier: derivatives never leak more than sources. Kill: E18 sensitivity lost through transformation. → ADOPT.
+- **H. Least-media disclosure gate.** Prior: #402 least-context. Evidence: arm3 thumbnails/EXIF leaks; E17 design. Falsifier: full-media disclosure always necessary. Kill: E17 shows whole-media transmission with no benefit. → ADOPT.
+- **I. Degraded-mode capability contract** (deterministic survival set: identity/hash/metadata/exact-search/provenance). Prior: #400; #52 mandate. Evidence: inward — today is degraded mode and evidence evaporates; arm4 DV FAIL. Falsifier: a deterministic function that still needs a model. Kill: E25 evidence invisible. → ADOPT.
+- **J. Perceptual-similarity hint column** (pHash/pdq stored, never authoritative). Prior: C2PA soft binding; arm3 abuse-detection practice. Evidence: discovery-only verdict. Falsifier: near-dup discovery never queried. Kill: column unread after 6 months of media use. → EXPERIMENT (needs demonstrated retrieval failure first).
+- **K. Visual page lane (ColPali-style multi-vector) for future document corpus.** Prior: ColPali (arm2 RS). Evidence: measured gains on figures/tables; storage 0.5GB-scale fine. Falsifier: OCR-first matches visual retrieval on Rune's actual documents. Kill: E7 shows no gain on Rune's corpus classes. → FUTURE (build with corpus).
+- **L. Audio lane (VAD + ASR + diarization + waveform retention).** Prior: Whisper/WhisperX/pyannote (arm2). Evidence: hallucination evidence makes ungated transcripts unsafe; design fully specified. Falsifier: no audio in Rune's actual workflows. Kill: no demonstrated need after transcription-capable workflow demand. → FUTURE.
+- **M. Segment-reference type (time-range provenance) + region-reference type (bbox/page-area).** Prior: Moment-DETR line; arm2 region retrieval. Evidence: arm4 BH/BI both absolutes rejected — the scoped mechanism is right. Falsifier: temporal/region questions never arise. Kill: E5/E6 unanswerable with segments/regions. → ADOPT (types defined; mandatory use rejected).
+- **N. Embedding-space migration runbook + rebuild drill.** Prior: arm3 dual-index practice. Evidence: arm4 S,EO FAIL; inward unversioned index. Falsifier: swaps never corrupt ranking with stamps+rebuild. Kill: E14 corruption. → ADOPT.
+- **O. Fixity/liveness cron for referenced media.** Prior: family pointer-rot risk; #396. Evidence: silent pointer rot is the family's named adversarial risk. Falsifier: references never rot. Kill: E19 silent loss. → FUTURE (schedule at first media corpus).
+- **P. Screenshot-of-source lineage rule** (screenshot of a memory artifact = derivative of it, not new evidence). Prior: #397 lineage; arm4 BC,BD FAIL. Evidence: screenshots are Rune's most likely first media. Falsifier: screenshots always add independent context. Kill: E8/E10 miscount roots. → ADOPT.
+- **Q. External-URL media materialization policy** (copy-or-reference decision with durability class). Prior: link-rot literature (family). Evidence: arm4 CD,CE FAIL (URLs not durable); arm4 CF,CG both absolutes rejected. Falsifier: all referenced URLs persist. Kill: E19 unreachable evidence. → ADOPT.
+- **R. Escape-by-default rendering contract for all derived text** (RichLog fix). Prior: arm4 F6 SUCCEEDS; #402 safe-rendering carry. Evidence: live injection surface. Falsifier: markup injection never reaches rendered output. Kill: any successful render injection in testing. → ADOPT.
+- **S. Acquisition-vs-generation provenance for media** (synthetic-claim fields; C2PA validation hook). Prior: C2PA spec. Evidence: synthetic≠false, camera≠true verdicts. Falsifier: provenance fields never consulted. Kill: E22 conflicts unresolvable. → ADOPT.
+- **T. UI-state-first capture** (accessibility tree/DOM primary, screenshot supporting). Prior: #401 carry. Evidence: OCR limits on UI text; a11y structure richer. Falsifier: screenshots always contain the needed structure. Kill: E23 shows a11y capture superior routinely. → ADOPT.
+- **U. Growth-delta probe for perception** (misread-class → verified correction → analogous-task improvement). Prior: #399/#400 carry. Evidence: mandate §48. Falsifier: better captions alone = learning (they do not). Kill: DQ-DS counted as growth. → EXPERIMENT (measurement design; #406 owns evaluation).
+- **V. Conflict-preservation records for cross-modal contradictions** (transcript vs screen; EXIF vs task log). Prior: #388; arm2 ECF (more visual context can REDUCE accuracy). Evidence: arm4 DI FAIL (no fixed precedence); E12 design. Falsifier: conflicts always resolvable by authority rules. Kill: E12 silent resolution. → ADOPT.
+- **W. Local-deterministic OCR hook** (tesseract wired as an on-demand derived transformation, not an ingestion gate). Prior: arm2 Tesseract doc limits. Evidence: inward tesseract-present-unwired; OCR = derived observation rule. Falsifier: OCR never useful on Rune's documents. Kill: E2 shows OCR errors dominate value. → FUTURE.
+- **X. Evidence-dedup: derivative suppression in retrieval results** (same-root derivatives collapse to best representation at ranking time). Prior: arm2 multi-vector practice; D root counting. Evidence: ECF — more retrieved visual pages can reduce accuracy; root discipline at retrieval. Falsifier: showing all derivatives never hurts. Kill: E10/E7 show dilution. → EXPERIMENT.
+
+Row-derived: ADOPT 16 · EXPERIMENT 3 · FUTURE 5 · Sum 24.

research/memory-atlas-r1/AB-multimodal-artifact-memory/05_adversarial.md

@@ -0,0 +1,174 @@
+# #403 AB — Adversarial Row File (arm 4: general-20, INDEPENDENT FRESH CONTEXT, 2026-09-22)
+
+Independent pass provenance: separate fresh-context actor (general-20), dispatched after arms 1-3 persisted; attacks the 15-point candidate architecture + shipped Rune reality. Full evidence/consequence/correction/residual per attack: 02_outward/arm4_adversarial_pass.md. Row truth: SUCCEEDS 12 · PARTIAL 43 · FAILS 115 · Sum 170 (156 mandated A-EZ + 14 Rune-specific F1-F14). 14 forced corrections in the arm report §5.
+
+- A. caption = image — PARTIAL |  | Architecture #1/#2 classifies captions as rebuildable projections — co
+- B. transcript = recording — FAILS |  | #1/#2 + A2 §2.3.6: transcript chunks carry timestamps + audio-file poi
+- C. OCR replaces scanned page — SUCCEEDS |  | Shipping code flattens PDFs unconditionally, layout destroyed, no page
+- D. visual-doc embedding preserves meaning — FAILS |  | Single-vector visual embeddings lose to BM25-on-OCR text (SigLIP 51.4,
+- E. one embedding space simpler → better — FAILS |  | ImageBind is hub-mediated, emergent audio→video R@1 6.8 vs 36.8, emerg
+- F. CLIP similarity = semantic equivalence — FAILS |  | Contrastive scores are uncalibrated rankings, not meaning probabilitie
+- G. perceptually similar = duplicates — FAILS |  | C2PA normative bar: soft binding never a hard binding [A3 C2PA §9]; pH
+- H. perceptual hash authorizes dedupe — FAILS |  | NeuralHash collisions enable hiding AND framing [A3 2111.06628]; 5% DB
+- I. crop contains all context — PARTIAL |  | #2 gives crops lineage (parent + region), so re-derivability holds; bu
+- J. keyframe = complete event — PARTIAL |  | #9 provides segment references but no rule prevents a keyframe from be
+- K. one video caption enough — PARTIAL |  | Architecture is silent on temporal coverage of derivatives; video→sing
+- L. every frame indexed — FAILS |  | Per-frame indexing appears nowhere in the surveyed video literature; s
+- M. more derivatives always improve retrieval — PARTIAL |  | Architecture sets no admission bar on derivative generation; evidence:
+- N. every derivative preserved forever — PARTIAL |  | #1 calls derivatives rebuildable, which contradicts preserve-forever; 
+- O. every original hot forever — FAILS |  | #10 explicitly: content-addressed files, cooling ≠ deletion; no cold t
+- P. cooling = forgetting — FAILS |  | #10 explicit; cooling changes latency, not existence
+- Q. original bytes unnecessary after good embeddings — FAILS |  | #1 core: improved future models may reinterpret the same source; embed
+- R. old embeddings authoritative after migration — PARTIAL |  | #4 mandates stamping going forward but says nothing about the 944 EXIS
+- S. embeddings across versions comparable — SUCCEEDS |  | Production embeddings record NO model/version [A1 baseline]; CLIP-fami
+- T. re-embedding may replace provenance — FAILS |  | #2 lineage is on derivations; embeddings are derivations; re-embedding
+- U. better model overwrites interpretation history — FAILS |  | #12 keeps source + historical interpretation; #1 improved models ADD d
+- V. VLM interpretation = direct evidence — PARTIAL |  | #1 says "derived" but derives no trust consequence: OCR text and VLM c
+- W. model confidence = calibrated probability — FAILS |  | #5 uses sufficiency gates on fused retrieval scores, not model self-re
+- X. OCR+VLM agreement = two independent confirmations — FAILS |  | #7 is explicit: transcript+caption+OCR+embedding of ONE source = ONE e
+- Y. transcript+waveform+summary = three sources — FAILS |  | #7; waveform "agreement" is not evidence of content at all; summary is
+- Z. two sensors same device = independent — PARTIAL |  | #7 covers same-SOURCE derivations, but two sensors on one device share
+- AA. synchronization proves causation — FAILS |  | #9 explicit: temporal co-occurrence ≠ causation
+- AB. metadata timestamp = event time — FAILS |  | #9: EXIF source-asserted, never verified truth; ExifTool writes/delete
+- AC. EXIF authoritative — FAILS |  | Same as AB; forensics standard treats metadata as process-dependent ev
+- AD. missing metadata = none existed — PARTIAL |  | Architecture records metadata but doesn't distinguish absent vs stripp
+- AE. geolocation always retained — PARTIAL |  | Source retention keeps GPS bytes (fine locally); but the architecture 
+- AF. more metadata = better provenance — FAILS |  | Provenance quality = transformation lineage + acquisition trust [A3 NI
+- AG. diarization identifies person — FAILS |  | Diarization supplies speaker-turn metadata, not identity [A2 1911.0125
+- AH. voice embedding = identity — FAILS |  | Speaker-verification EERs condition-dependent, spoofing compromises th
+- AI. face similarity = identity — FAILS |  | NIST IR 8280 demographic-differential error across 189 algorithms [A3]
+- AJ. detected face = persistent user fact — FAILS |  | #15 hypotheses-not-facts; persisting person labels = aggregation ampli
+- AK. voice emotion updates user state — FAILS |  | #15 explicit: emotion from voice never authoritative state
+- AL. facial expression = emotional state — FAILS |  | #15 explicit
+- AM. repeated observations justify preference inference — FAILS |  | #15 explicit: repeated multimodal observations = hypotheses
+- AN. screenshot pixels inert — FAILS |  | Adversarial pixels ARE payload: Image Hijacks >80% ASR incl. context e
+- AO. OCR output safe — FAILS |  | Invisible/bidi characters flow through OCR text into pipelines unsanit
+- AP. image injection VLM-only problem — FAILS |  | Typographic attacks hit CLIP-era contrastive encoders [A3 2402.19150];
+- AQ. audio injection needs audible speech — FAILS |  | DolphinAttack: ultrasonic commands control real assistants [A3 1708.09
+- AR. PDF hidden layers irrelevant — PARTIAL |  | No dedicated study found of PDF hidden-layer/metadata injection (bound
+- AS. sanitizing OCR text solves injection — FAILS |  | Non-textual adversarial taint bypasses text entirely [A3 2307.10490, 2
+- AT. transformation removes taint if output benign — FAILS |  | #8 explicit: taint survives transformation; Arm 3 §2.1 verdict is exac
+- AU. generated = untrustworthy — FAILS |  | #11: synthetic ≠ false; detectors unreliable (sink-class failure on un
+- AV. camera-origin = trustworthy — FAILS |  | #11: camera ≠ true; EXIF forgeable [A3 ExifTool]; capture-path injecti
+- AW. C2PA proves truth — FAILS |  | #11 + C2PA's own principle: provenance asserts source, never truth, no
+- AX. hash proves provenance — FAILS |  | A hash proves byte-identity-since-hashing, not origin; #2 correctly us
+- AY. content-address = source authenticity — FAILS |  | Attacker-supplied bytes hash to themselves perfectly; Poisoned-MRAG: 5
+- AZ. same bytes = same context — FAILS |  | #6 event grouping is semantic; the same screenshot re-captured in a di
+- BA. different bytes = different evidence — PARTIAL |  | #7 keys evidence roots on source objects, but recompression/resize cre
+- BB. recompressed image = new source — PARTIAL |  | Same mechanism as BA: byte-identity dedupe (#6) cannot see recompressi
+- BC. screenshot of source = independent evidence — PARTIAL |  | A screenshot of a rendered document is a content-derivation whose line
+- BD. crop = independent evidence — FAILS |  | #2: crops are derivations with tracked parent+region; lineage exists
+- BE. OCR correction rewrites original — FAILS |  | #12: corrections change current derived view, keep source + history
+- BF. correction deletes old interpretation — FAILS |  | #12 explicit
+- BG. interpretation history unnecessary — FAILS |  | #12 + #1 (future models reinterpret source); history is the audit trai
+- BH. region provenance needless — FAILS |  | #9 provides region (bbox/page-area) references; without them transcrip
+- BI. region provenance always required — FAILS |  | #9 says "available", not mandatory; forcing bbox on whole-frame artifa
+- BJ. scene graphs canonical — FAILS |  | #1: only the source is canonical; scene graphs are model-derivations w
+- BK. detections = facts — FAILS |  | Detector outputs are model claims with measured error and demographic 
+- BL. every object enters Memory — PARTIAL |  | Architecture doesn't gate object-level extraction; mass object inserti
+- BM. every media needs summary — PARTIAL |  | Captioning ceiling 67.0 vs 81.3 [A2 2407.01449]; chart summaries are t
+- BN. every media needs text representation — PARTIAL |  | Text substrate is the evidence-backed retrieval route for audio [A2 §2
+- BO. multimodal retrieval replaces lexical — FAILS |  | Exact-match queries untested/unsupported on visual retrievers; single-
+- BP. cross-modal replaces exact lookup — FAILS |  | Same evidence as BO; cross-modal similarity is the weakest, least-cali
+- BQ. vector similarity controls applicability — FAILS |  | #5: nominate, never authorize; the #402 defect (194015/193729) is the 
+- BR. retrieval frequency strengthens visual memories — FAILS |  | No warmth/reinforcement mechanism exists anywhere in the architecture;
+- BS. warmth increases authority — FAILS |  | #5 separates retrieval from authority
+- BT. salience = importance — PARTIAL |  | Architecture is silent on salience; a future "index the visually salie
+- BU. thumbnail as archival source — FAILS |  | Thumbnails are derived; low-res destroys visual retrieval measurably (
+- BV. transcoded copy replaces source without lineage — FAILS |  | #2 lineage mandatory incl. lossiness
+- BW. lossy transformation needs no provenance — FAILS |  | #2 explicitly records lossiness
+- BX. codec/model version irrelevant once text extracted — FAILS |  | Extraction model version changes the text itself (Whisper versions shi
+- BY. provider capability = Rune multimodal — FAILS |  | Architecture is local-first (#10); capability assumptions are not made
+- BZ. image-capable chat = durable image Memory — PARTIAL |  | #3 references source objects, but the architecture never says WHEN a t
+- CA. attachment retention = Memory — PARTIAL |  | Same seam as BZ: retention policy of a provider/session ≠ Memory lifec
+- CB. file path = stable identity — FAILS |  | #2 content-addressed identity by hash
+- CC. basename = enough provenance — FAILS |  | #2 requires acquisition time, MIME, sensitivity, retention
+- CD. external URL = durable evidence — SUCCEEDS |  | Architecture says Memory carries REFERENCES to source objects but is s
+- CE. URLs durable decades — SUCCEEDS |  | Same as CD — the decades-scale survival goal makes this certain to bit
+- CF. all external media copied — FAILS |  | Opposite overreach: rights, sensitivity, and scale forbid blanket copy
+- CG. no external media copied — FAILS |  | Then CD/CE win by default — evidence decays
+- CH. SQLite blobs always simplest — FAILS |  | SQLite BLOB cap 1GB default/2GB hard, row-size coupling, WAL/vacuum pa
+- CI. filesystem stores always superior — FAILS |  | Overreach; SQLite is correct for metadata/thumbnails [A3 §2.4]; archit
+- CJ. dedicated vector DB required — FAILS |  | n≈944: score-everything in SQLite+sqlite-vec is the measured-at-scale 
+- CK. graph DB required for regions — FAILS |  | Region refs are bbox columns on derivative rows [A3 §2.4.1]; no graph 
+- CL. new canonical database required — FAILS |  | #3: no second canonical store
+- CM. multimodal Memory owns user-model inference — FAILS |  | #15: observations are hypotheses; user-model promotion is a separate s
+- CN. owns identity authentication — FAILS |  | Identity authority is out of scope by design [A3 §2.2 FISWG/GDPR]
+- CO. owns security policy — FAILS |  | #8 puts enforcement at tool/memory-write boundaries in a CaMeL-style s
+- CP. owns provider capability truth — PARTIAL |  | Architecture silent on who tracks provider capabilities; BZ/CA/BY fami
+- CQ. owns task state — FAILS |  | Memory is not a task tracker; no architecture text claims it
+- CR. Mind Palace prominence = authority — PARTIAL |  | Architecture has no presentation-authority firewall; Rune's RichLog su
+- CS. richer media shown more prominently — FAILS |  | #13 prefers structured UI state; media rendering is a display policy
+- CT. accessibility text replaces visual evidence — FAILS |  | #14: "still derivatives"
+- CU. accessibility = presentation only — FAILS |  | #14 gives derived alt-text/transcripts an inspection function (evidenc
+- CV. picture-superiority proves image preference — FAILS |  | Effect is task/population-conditional [A1 A14]; Rune's consumers are i
+- CW. dual coding = everything twice — FAILS |  | Only the weak form (redundant retrieval routes where modalities captur
+- CX. copy human sensory memory — FAILS |  | Arm 1's central discipline: mechanisms live in nervous systems; only d
+- CY. one correct event boundary — FAILS |  | Segmentation is simultaneous on multiple timescales [A1 A10]; #6 seman
+- CZ. timeline proximity = shared event — PARTIAL |  | #9 says co-occurrence ≠ causation, but the event-GROUPING algorithm is
+- DA. media timestamp enough for alignment — FAILS |  | EXIF forgeable [A3 ExifTool]; #9 provenance framing
+- DB. clock disagreement → average — FAILS |  | Averaging destroys per-source ordering and manufactures false simultan
+- DC. drift negligible — FAILS |  | Long recordings accumulate seconds of drift; Whisper's 30s windows nee
+- DD. long recording = one Memory item — FAILS |  | #9 segment references; segment granularity universal [A2 §2.3.7]
+- DE. every frame = one Memory item — FAILS |  | Same as L
+- DF. segment boundaries model-authoritative — PARTIAL |  | #9 provides segments; #12 lets corrections change the current derived 
+- DG. corrections override raw pixels — FAILS |  | #1/#12: sources immutable; corrections change derived view only
+- DH. pixels override explicit user correction — PARTIAL |  | #12 covers corrections vs interpretation, but is silent on RE-DERIVATI
+- DI. fixed modality precedence solves conflict — FAILS |  | Human "dominance" is a reliability outcome, not a rule [A1 A5, rejecte
+- DJ. frontier VLM auto-outranks older analysis — FAILS |  | #12 keeps history; frontier models still hallucinate at measured rates
+- DK. model prestige = perception authority — FAILS |  | Same evidence as DJ
+- DL. multimodal models modify canonical Memory directly — PARTIAL |  | #8's CaMeL boundary implies model outputs enter only as mediated deriv
+- DM. teacher interpretations = immediate training data — FAILS |  | Rune consumes models, doesn't train [A3 rejected approaches]; #1 inter
+- DN. cross-model agreement = truth — FAILS |  | Agreement between models with overlapping training data is correlated,
+- DO. different vendors = independent — FAILS |  | Web-scale shared training corpora (LAION-lineage etc.) correlate error
+- DP. same training corpus irrelevant — FAILS |  | Measured correlated failure modes across model generations [A3 2305.10
+- DQ. better retrieval = Growth Delta — FAILS |  | No growth claim made anywhere in the architecture
+- DR. better vision model = Rune learned — FAILS |  | #1 frames model upgrades as reinterpretation of the same source — not 
+- DS. better captions = cognition improved — FAILS |  | Captions have a measured quality ceiling below source-grounded retriev
+- DT. offline survival needs every model local — FAILS |  | #1: bytes + already-created text derivations remain fully usable offli
+- DU. without VLM image evidence unusable — FAILS |  | Preserved sources + FTS text derivations stay queryable; semantic re-i
+- DV. no-LLM = multimodal evidence unusable — FAILS |  | Same as DT
+- DW. exclude multimodal from Memory until #404 — FAILS |  | #1 preservation is cheap and model-free; deferring capture loses acqui
+- DX. #403 designs complete offline stack — FAILS |  | Derivations require models by design; architecture doesn't claim other
+- DY. #403 solves hardware acceleration — FAILS |  | 16GB VRAM is a stated constraint (ColPali fits bf16; ColQwen2 tight [A
+- DZ. #403 solves final evaluation — FAILS |  | No claim made — but the RESIDUAL is real: the architecture specifies n
+- EA. security = media never reaches external models — FAILS |  | #8 says least-media DISCLOSURE, not zero disclosure; some tasks legiti
+- EB. privacy = delete source after captioning — FAILS |  | #1/#10; deletion destroys re-interpretation and re-derivation forever;
+- EC. privacy = never store thumbnails — FAILS |  | Thumbnails are useful and sensitivity-gated (#8 propagates sensitivity
+- ED. provenance = keep every sensitive derivative forever — FAILS |  | #8: sensitivity propagates to derivatives → retention applies to them 
+- EE. deleting original deletes derived knowledge — PARTIAL |  | #1 says derivations are rebuildable — which is FALSE once the source i
+- EF. deleting derivative should delete original — FAILS |  | Inverse of the dependency direction; #1
+- EG. tombstone contains full media metadata — PARTIAL |  | No tombstone design exists in the architecture; and full metadata in a
+- EH. multimodal cannot be redacted — PARTIAL |  | #1 forbids byte-editing sources; #12 corrects derived views; but there
+- EI. Synthetic Experience treats VLM observation as verified experience — PARTIAL |  | #15 covers the user-model seam but not the AGENT's own perceptual clai
+- EJ. 'I saw X' proves X present — PARTIAL |  | Depends on EI's evidence classes existing; POPE-class hallucination ma
+- EK. model description becomes autobiography without verification — PARTIAL |  | Same family as EI/EJ; #15's hypothesis framing is the right shape but 
+- EL. one failure permanently reduces trust — PARTIAL |  | Architecture has no trust/calibration bookkeeping at all — so the atta
+- EM. one success permanently increases trust — PARTIAL |  | Same as EL
+- EN. stable calibration across tasks — FAILS |  | Calibration is task- and stress-dependent (CharXiv −34.5% under mild s
+- EO. provider swap needs no reindex planning — FAILS |  | #4 version stamping + S/ET's migration runbook
+- EP. historical embeddings = preservation authorities — FAILS |  | #4: embeddings never canonical evidence
+- EQ. storing weights necessary to understand old memories — PARTIAL |  | Understanding old INTERPRETATIONS requires provenance (which model/ver
+- ER. century-scale readability needs every old inference engine preserved — FAILS |  | #1: source + text derivations are the readable substrate; engines only
+- ES. proprietary APIs safe forever — FAILS |  | #10's decades-scale goal is incompatible with assuming API permanence;
+- ET. raw evidence enough, indexes need no migration plan — SUCCEEDS |  | #1 makes sources the preservation object — correct — but the architect
+- EU. index loss = Memory loss — FAILS |  | In theory #1/#3: indexes rebuild from sources. In practice ET/F1 show 
+- EV. multimodal Memory must be visible as complex graph — FAILS |  | Presentation overreach; #13 structured-first; #5 presentation ≠ author
+- EW. more visual richness always improves understanding — FAILS |  | More visual context measurably lowers answer accuracy [A2 2608.07006];
+- EX. 3D spatialization suits image/video memories — FAILS |  | No evidence; presentation flourish
+- EY. multimedia automatically improves recall/usability — FAILS |  | Picture-superiority is conditional [A1 A14]; consumers are indexes/LLM
+- EZ. richest representation shown first — FAILS |  | #13 structured-first
+- F1. Unversioned production embeddings make every future dense-lane change unsafe: the 944-entry sql — SUCCEEDS |  | A1 baseline (no model/version recorded); CLIP-family versions differ i
+- F2. PDF flattening already ships and did not keep page images: the architecture's "preserve source, — SUCCEEDS |  | A1 baseline (flattens PDFs, layout destroyed); measured cost +10 to +4
+- F3. Tesseract installed but unwired invites a "cheap OCR lane" that silently recreates the exact pi — PARTIAL |  | ColPali vs OCR+BM25 gap; Tesseract's own docs concede table/sparse-lay
+- F4. The #402 cross-domain similarity-supersession defect (194015/193729) proves the write path ALRE — SUCCEEDS |  | A1 baseline: prior Atlas run observed semantic similarity superseding 
+- F5. Curators and cron jobs write Memory without actor identity: #8 (taint, policy gates) and #12 (c — SUCCEEDS |  | A1 baseline (curators/cron write without actor identity); AY (integrit
+- F6. RichLog(markup=True) is a live injection surface for media-derived text: OCR/transcript content — SUCCEEDS |  | Rich's markup=True interpretation of square-bracket content in untrust
+- F7. One 16GB-VRAM workstation shared with the agent's main model: visual derivation/indexing/rerank — PARTIAL |  | ColPali fits 16GB bf16; ColQwen2 "tight, consider quantization" [A2 §2
+- F8. Decades-scale survival goal vs SQLite schema drift and model EOL: architecture has no format-mi — PARTIAL |  | A3 §2.4.5 (re-embed+swap is the only measured migration pattern; no pr
+- F9. No-LLM-period requirement vs semantic lanes: during offline/no-model periods, newly captured me — PARTIAL |  | #1 says derivations are rebuildable — but only if the media was captur
+- F10. Score-everything fusion with multimodal lanes at n≈944: lane scores are on incomparable scales  — SUCCEEDS |  | A1 B5 (cross-modal vs within-modal distances on different scales, nonz
+- F11. Sufficiency-gated abstention thresholds are undefined for visual evidence: no measured mapping  — PARTIAL |  | #5 names the mechanism but no thresholds; admission-control evidence e
+- F12. Lineage pointers (#2) are written by the same untrusted derivation code that produced the deriv — PARTIAL |  | #8's own threat model: media-derived content can steer the model [A3 2
+- F13. Thumbnails/small media as SQLite BLOBs alongside file-based sources invites drift: regenerated  — PARTIAL |  | A3 §2.4 (thumbnails-as-blob allowed); #2 requires lineage incl. parame
+- F14. Two eras of provenance coexist: legacy rows (flattened text, no coordinates, no doc class, anon — SUCCEEDS |  | F2 (flattening already shipped), F5 (anonymous writers), A1 baseline

research/memory-atlas-r1/AB-multimodal-artifact-memory/06_synthesis.md

@@ -0,0 +1,175 @@
+# #403 AB — Synthesis Matrices (mandate §58; rows are the truth, prose bends to rows)
+
+## A. Modality / source / authority
+| Modality | Original evidence | Canonical owner | Derived forms | Authority |
+|---|---|---|---|---|
+| Image/screenshot | content-addressed file | Memory (reference) | caption, OCR, embeddings, thumbnails, regions | source bytes authoritative; projections derived |
+| Document | file or page images | Memory (reference) | text, layout, tables, summaries | layout/visual structure load-bearing conditionally |
+| Audio | waveform | Memory (reference) | VAD transcript, diarization, embeddings | waveform authoritative; transcript derived+gated |
+| Video | file | Memory (reference) | segments, keyframes, captions | source + segment refs authoritative |
+| Text/code | file bytes | Memory (existing) | chunks, embeddings | unchanged |
+
+## B. Source vs derived
+| Source | Derivatives | Count as |
+|---|---|---|
+| image | caption / OCR / embedding / thumb / region | one evidence root |
+| audio | transcript / diarization / embedding | one evidence root |
+| video | clip / keyframe / caption / embedding | one evidence root |
+| document | text / layout / page image / table parse | one evidence root |
+
+## C. Transformation / provenance
+| Input | Transformation | Record | Lossiness | Rebuildable |
+|---|---|---|---|---|
+| image | OCR | tool+version, region map, confidence class | high (layout, figures) | yes |
+| audio | ASR | model+version, VAD params, timestamps | medium (hallucination class) | yes |
+| video | segment+caption | model+version, boundaries (design-designated) | high | yes |
+| document | text extract | extractor+version, page map | high (layout/figures) | yes |
+| any | embedding | model_id+version+space_id | total (not invertible) | yes with source |
+
+## D. Retrieval
+| Query | Target | Exact | Lexical | Semantic | Cross-modal | Rerank |
+|---|---|---|---|---|---|---|
+| text | text | hash/FTS | FTS5 | dense (versioned) | — | cross-encoder |
+| text | image/page | metadata | OCR-text FTS | page multi-vector | bridge | late-interaction |
+| image | image | pHash hint | — | perceptual (nominate) | — | — |
+| text | audio segment | metadata | transcript FTS | transcript dense | bridge | — |
+| text | video segment | metadata | caption FTS | segment vectors | bridge | — |
+
+## E. Fusion
+| Approach | Benefit | Failure mode | Verdict |
+|---|---|---|---|
+| one universal space | simplicity | modality gap; fine-structure loss; version lock | REJECT as primary |
+| modality-native + bridge | fidelity per modality | bridge calibration | ADOPT |
+| early fusion | joint training gains | opaque, version-locked | REJECT for memory |
+| late fusion at ranking | per-lane tuning | score mixing needs calibration | ADOPT (calibrated) |
+
+## F. Temporal
+| Level | Representation | Uncertainty |
+|---|---|---|
+| whole source | file + duration | — |
+| segment | [t0,t1) ref, design-designated boundary | boundary uncertainty recorded |
+| instant | timestamp + clock-source | observed/asserted/verified taxonomy |
+
+## G. Spatial/region
+| Level | Representation | Status |
+|---|---|---|
+| page/frame | index ref | available |
+| region | bbox/page-area ref | available (not mandatory) |
+| whole-source | default | default |
+
+## H. Evidence independence
+| Items | Roots |
+|---|---|
+| source + its OCR + caption + transcript + embedding | 1 |
+| two captures of one event (different devices) | 2 (independence partial: shared context) |
+| synchronized streams of one recording | 1 |
+| independent sources agreeing | N — real corroboration |
+
+## I. Error propagation
+| Error | Downstream reach | Containment |
+|---|---|---|
+| OCR misread | retrieval, summary, claims | region map + source inspection + correction ledger (C016) |
+| ASR hallucination | quotes, facts | VAD gating + timestamp+audio provenance (C008) |
+| caption hallucination | retrieval, user model | POPE-rate awareness; region grounding (C001) |
+| EXIF spoof | timeline, causality | timestamp taxonomy (C013) |
+| embedding version drift | ranking | stamps + rebuild (C004) |
+
+## J. Dedupe/identity
+| Case | Identity | Action |
+|---|---|---|
+| same bytes | identical | auto-dedupe (safe) |
+| resized/recompressed | same origin, different bytes | lineage link; suggest |
+| screenshot of source | derivative | lineage link; NOT independent |
+| crop | derivative | lineage link |
+| perceptually similar | unknown | nomination only |
+| same event, two devices | two roots | corroboration candidate |
+
+## K. Model/index lifecycle
+| Artifact | Stamp | Migration | Authority |
+|---|---|---|---|
+| embedding lane | model+version+space | dual-index rebuild + verify | none (derived) |
+| OCR/ASR/caption | tool+model+version | re-derivation, versioned (C017) | none (derived) |
+| source bytes | content hash | fixity cron (FUTURE) | canonical |
+
+## L. Storage/tiering
+| Class | Content | Policy |
+|---|---|---|
+| hot | metadata, text derivatives, thumbnails, current-view interpretations | SQLite/local |
+| cold | original media files | content-addressed files; cooling ≠ deletion |
+| recompute | expensive derivatives (embeddings, captions) | recompute-over-store |
+
+## M. Privacy/sensitivity
+| Modality | Sensitive fields | Derived leakage | Disclosure |
+|---|---|---|---|
+| image | faces, screens, documents, geotags | thumbnails, captions, OCR | least-media gate |
+| audio | voice, conversations | transcripts, diarization | segment-level |
+| document | contents, signatures | extracted text | page/region scope |
+
+## N. Security/injection
+| Modality | Attack | Transformation edge | Boundary |
+|---|---|---|---|
+| image | typographic/patch injection | OCR/caption → prompt | content=data; taint survives (C007) |
+| document | hidden layers/metadata | extraction → index → prompt | same |
+| audio | inaudible commands | transcript → prompt | same + VAD gating |
+| corpus | multimodal RAG poisoning | retrieval → context | write-boundary enforcement |
+
+## O. User-model/persona
+| Observation | Permissible | Prohibited |
+|---|---|---|
+| repeated photography of X | hypothesis entry | preference fact |
+| voice emotion classification | observation w/ provenance | user-state update |
+| face match | workflow hint | identity write |
+
+## P. Accessibility
+| Original | Accessible derivative | Lost | Correction |
+|---|---|---|---|
+| image | alt description | fine detail | user-correctable (C016) |
+| audio | transcript | prosody/non-speech | correctable |
+| video | captions + description | visual simultaneity | correctable |
+
+## Q. Preservation/migration
+| Format | Normalized | Fixity | Strategy |
+|---|---|---|---|
+| PNG/JPEG | keep original; open export where format at risk | SHA-256 | #396 carry; media-specific: original + fixity cron |
+| WAV/MP3/MP4 | original + open container note | SHA-256 | recompute derivatives |
+| PDF | original + page images | SHA-256 | capture-first (C009) |
+
+## R. Event bundle
+| Event | Streams | Shared root? | Interpretation |
+|---|---|---|---|
+| one recording | audio+video+transcript | YES (one root) | multi-stream single evidence |
+| user action + screenshot | action log + capture | partial (same session, different origins) | bounded independence |
+
+## S. Current Rune capability
+| Capability | Observed | Canonical? | Durable? | Status |
+|---|---|---|---|---|
+| text memory | yes | yes | yes | CANONICAL |
+| image input | provider transient | no | no | BYPASS |
+| OCR | tesseract unwired | no | — | ABSENT |
+| audio/video | — | no | — | ABSENT |
+| document ingestion | PDF→text flatten | yes | yes | ACTIVE (defect per C009) |
+| embeddings | text, unversioned | derived | rebuildable-with-defect | PARTIAL |
+| media storage | none | — | — | ABSENT |
+| provenance | path/line-range/hash(text) | yes | yes | PARTIAL |
+
+## T. T1 minimum / future
+| Now (T1) | Future |
+|---|---|
+| artifact-ref type + derived-record kind + lineage stamps | visual/audio lanes on corpus demand |
+| byte-identity dedupe + nomination-only similarity | perceptual hints (J) |
+| timestamp taxonomy + sensitivity propagation | fixity cron (O), C2PA validation (33) |
+| correction ledger + interpretation versioning | region retrieval, ColPali lane (K) |
+
+## U. Cross-domain ownership
+| Concern | Owner |
+|---|---|
+| security policy / taint semantics | #402 |
+| user model | #398 |
+| persona/experience | #399/#400 |
+| offline intelligence depth | #404 |
+| hardware/placement | #405 |
+| final evaluation | #406 |
+| retrieval core | #383 |
+| preservation general | #396 |
+| provenance general | #397 |
+| inspection/accessibility | #401 |

research/memory-atlas-r1/AB-multimodal-artifact-memory/07_qualification.md

@@ -0,0 +1,74 @@
+# #403 AB — Qualification (68 mandate questions)
+
+| Q | Question | Verdict | Answer (evidence-backed) |
+|---|---|---|---|
+| Q1 | What is multimodal Memory for Rune? | ADOPT | Durable, inspectable evidence objects + rebuildable derived projections + provenance — an extension of existing Memory (C001/C002), not a second mind. |
+| Q2 | What is merely multimodal input? | ADOPT | Provider-attachment transience (today's reality); input becomes memory only via explicit source-object capture. |
+| Q3 | Which modalities matter now? | ADOPT | Documents (already ingested — flattening defect live), screenshots (most likely first media), text/code structure. Audio/video = FUTURE. |
+| Q4 | Which are FUTURE? | FUTURE | Audio (C008 designed), video (segment design recorded), sensor streams (out of scope). |
+| Q5 | What is canonical? | ADOPT | Source bytes + provenance + user corrections. Nothing derived. |
+| Q6 | Are raw bytes canonical evidence? | ADOPT | Yes where retained (policy-gated); the reference to them is canonical even when bytes live externally. |
+| Q7 | Where should large media live? | ADOPT | Content-addressed files beside SQLite metadata (C015); no dedicated object store at this scale. |
+| Q8 | Does Memory store bytes or references? | ADOPT | References (hash+location+format); small thumbnails only as BLOBs. |
+| Q9 | What makes a media reference durable? | ADOPT | Content hash + fixity checking + open-format note (family R0-3). |
+| Q10 | What makes two media objects identical? | ADOPT | Byte-identity only (C010). |
+| Q11 | Related but not identical? | ADOPT | Transformation lineage, event co-membership, perceptual nomination — typed relations, never identity. |
+| Q12 | Exact duplicates? | ADOPT | Automatic dedupe on hash; provenance preserved. |
+| Q13 | Perceptual near-duplicates? | ADOPT | Suggestions surfaced to user/curator; never destructive (C010). |
+| Q14 | Can similarity authorize supersession? | ADOPT | NO — the #402 defect is the named precedent (C005). |
+| Q15 | OCR representation? | ADOPT | Derived record: text + tool/version + region map + confidence class + correction ledger. |
+| Q16 | ASR? | ADOPT | Derived record: VAD-gated transcript + timestamps + model/version; waveform retained. |
+| Q17 | Captions? | ADOPT | Derived record: model/version + region grounding where claimed. |
+| Q18 | Embeddings? | ADOPT | Derived, stamped model+version+space, never canonical. |
+| Q19 | Video segments? | ADOPT | [t0,t1) refs with design-designated boundaries; boundary uncertainty recorded. |
+| Q20 | Image regions? | ADOPT | bbox/page-area refs available (not universally mandatory). |
+| Q21 | Layout? | ADOPT | Retained via page images + layout parse where extraction happens. |
+| Q22 | Which derivatives worth keeping? | ADOPT | Those answering demonstrated retrieval/inspection needs; recompute-over-store for the rest. |
+| Q23 | Which regenerated? | ADOPT | All of them, in principle — that is what "derived" means; economics decide retention. |
+| Q24 | Transformation models recorded? | ADOPT | model_id + version (+space_id for embeddings) on every derived record. |
+| Q25 | Corrections? | ADOPT | Correction records keyed to source hash; current-view change; history kept (C016). |
+| Q26 | Interpretations supersede interpretations? | ADOPT | Yes, versioned with truth-maintenance (C017). |
+| Q27 | Can they overwrite source evidence? | ADOPT | Never (C001). |
+| Q28 | Multimodal provenance? | ADOPT | #397 envelope + transformation matrix (06-C). |
+| Q29 | Multiple modalities from one source? | ADOPT | ONE evidence root (C006). |
+| Q30 | Cross-modal retrieval? | ADOPT | Bridge over modality-native lanes; nominations reranked; never authority. |
+| Q31 | Universal embeddings? | ADOPT | NO (C003). |
+| Q32 | Multiple modality-specific indexes? | ADOPT | Yes — the supported architecture. |
+| Q33 | Late fusion? | ADOPT | At ranking, with calibrated score handling. |
+| Q34 | Model replacement? | ADOPT | Dual-index rebuild + verification pass (C004). |
+| Q35 | Re-embedding? | ADOPT | Wholesale lane rebuild; old lane historical until verified. |
+| Q36 | Loss of an embedding index? | ADOPT | Non-fatal: indexes are derived; source + text lanes remain (C020). |
+| Q37 | Very large media? | ADOPT | Tiering (C015); segments/regions for access. |
+| Q38 | Cooling? | ADOPT | Latency change only; never deletion (C015). |
+| Q39 | What survives decades? | ADOPT | Bytes + hashes + metadata + provenance + corrections; everything derived is rebuildable. |
+| Q40 | Timestamps? | ADOPT | Three-part taxonomy (C013). |
+| Q41 | Uncertain timestamps? | ADOPT | Recorded as asserted with clock-source; conflicts preserved (V). |
+| Q42 | Temporal segments? | ADOPT | First-class refs (C011). |
+| Q43 | Region references? | ADOPT | Available typed refs (M). |
+| Q44 | Scene graphs? | REJECT | NO — rejected as canonical (row 40). |
+| Q45 | Event graphs? | REJECT | NO as canonical; bounded event bundles (06-R). |
+| Q46 | Metadata trust? | ADOPT | Source-asserted evidence, never verified truth (C013). |
+| Q47 | Sensitive multimodal data? | ADOPT | Sensitivity propagation + least-media disclosure (C014). |
+| Q48 | What may reach providers? | ADOPT | Smallest sufficient representation (C014). |
+| Q49 | Least-context for media? | ADOPT | Same principle, media-shaped: crop/segment/derive first. |
+| Q50 | Injection containment? | ADOPT | Content=data invariant + taint survival + write-boundary enforcement (C007). |
+| Q51 | Taint through transformations? | ADOPT | Never silently removed (C007); bounded zero-hit recorded on direct studies. |
+| Q52 | Generated media? | ADOPT | Acquisition + generation-claim provenance (C018). |
+| Q53 | C2PA? | ADOPT | Record where present; validate later (FUTURE); soft≠hard binding normative. |
+| Q54 | Face/voice vs identity? | ADOPT | Matching workflows only; identity out of scope (C012). |
+| Q55 | Which inferences may enter User Model? | ADOPT | Explicit-pattern hypotheses with provenance; never silent traits (C012; #398 owns). |
+| Q56 | Which stay hypotheses? | ADOPT | Everything inferred from perception by default. |
+| Q57 | Synthetic Experience citing perception? | ADOPT | Source media + interpretation + uncertainty + later correction (C017; #399 owns). |
+| Q58 | "Rune saw/heard X"? | ADOPT | Means: a model interpretation of captured media exists, with lineage and correction state — not that X was present. |
+| Q59 | Survives with no model? | ADOPT | Identity, hashes, metadata, exact/lexical retrieval, provenance, linkage (C020). |
+| Q60 | #404's share? | ADOPT | Offline interpretation depth; local model stack. |
+| Q61 | #405's share? | ADOPT | Storage hardware, GPU, media pipeline placement. |
+| Q62 | #406's share? | ADOPT | Retrieval quality, perceptual correctness, Growth Delta evaluation. |
+| Q63 | #402's share? | ADOPT | Taint semantics, authorization, disclosure policy — #403 consumes them. |
+| Q64 | #401's share? | ADOPT | Inspection/navigation/accessibility presentation. |
+| Q65 | Smallest T1 architecture? | ADOPT | Matrix T: artifact-ref + derived-record + stamps + byte-dedupe + timestamp taxonomy + correction ledger + degraded-mode contract. |
+| Q66 | Explicitly rejected? | REJECT | Rows 40-54 (universal space, similarity dedupe, screenshots-as-entries, scene graphs, per-frame indexing, ownership violations, emotion-as-state, detector verdicts, 3D media). |
+| Q67 | What remains EXPERIMENT? | EXPERIMENT | pHash hints, growth-delta probe, derivative suppression in retrieval (J, U, X). |
+| Q68 | What falsifies the architecture? | ADOPT | E1-E27 kill criteria; collectively: source bytes add zero value over projections AND projections never need revision AND similarity-dedupe proves safe. |
+
+Row-derived: ADOPT 63 · ADAPT 0 · EXPERIMENT 1 · FUTURE 1 · REJECT 3 · PARK 0 · Sum 68. Verdict = disposition of the answer; Q67's ADOPT-worthy classification act is itself recorded by its EXPERIMENT subject.

research/memory-atlas-r1/AB-multimodal-artifact-memory/AB_MULTIMODAL_ARTIFACT_MEMORY_R1_BATCHED_PRELIMINARY.md

@@ -0,0 +1,14 @@
+# AB — Multimodal / Artifact Memory: R1 Domain Master
+## #403
+
+**Executive summary:** Literature multimodal "memory" is never a second store — it is either a shared embedding space (Nomic Embed Vision 2406.18587 explicitly shares latent space with nomic-embed-text) or distilled artifacts (Voyager 2305.16291 code skills; Agent Workflow Memory 2409.07429 abstracted routines, +24.6%/+51.1% relative success). Screenshots in GUI agents are INPUT, not retained memory.
+
+**Verdicts:**
+- **ADOPT**: artifact memory as metadata (path, hash, MIME, mtime, provenance — ledger already does this)
+- **ADAPT**: code-artifact distillations tied to outcomes (Voyager/AWM pattern)
+- **REJECT**: storing screenshots/images as memory entries (zero payoff evidence for text-first agent, real token/storage cost)
+- **FUTURE**: nomic-embed-vision into the EXISTING index (no second store) if a concrete "I saw that file/error before" retrieval failure appears — EXPERIMENT only then
+
+**Evidence grades:** CLIP 2103.00020, Voyager, AWM, CogAgent = A (peer-reviewed); Nomic Embed Vision, OS-Copilot, surveys = B.
+
+**R0 reconciliation:** CONFIRMED 2 · REFINED 1 · OVERTURNED 0 · Sum = 3.

research/memory-atlas-r1/AB-multimodal-artifact-memory/AB_MULTIMODAL_ARTIFACT_MEMORY_R1_MASTER.md

@@ -1,14 +1,146 @@
-# AB — Multimodal / Artifact Memory: R1 Domain Master
-## #403
+# AB — Multimodal / Artifact Memory: R1 Deep Requalification Master
+## Memory Research Atlas — Domain #403 (issue #403, epic #375)
 
-**Executive summary:** Literature multimodal "memory" is never a second store — it is either a shared embedding space (Nomic Embed Vision 2406.18587 explicitly shares latent space with nomic-embed-text) or distilled artifacts (Voyager 2305.16291 code skills; Agent Workflow Memory 2409.07429 abstracted routines, +24.6%/+51.1% relative success). Screenshots in GUI agents are INPUT, not retained memory.
+## 1. Executive summary
+_2026-09-22. Full R1_FULL run: ISSUE → INWARD → OUTWARD (4 serial arms, MAX_CONCURRENT_SUBAGENTS=1, all first-pass SUCCESS: general-17/18/19/20) → APPLICABILITY → INNOVATION → ADVERSARIAL (170 attacks: SUCCEEDS 12 · PARTIAL 43 · FAILS 115) → SYNTHESIS → QUALIFY (68/68) → this master. Batched artifact preserved byte-for-byte (sha 5c705036…9c4bc8)._
 
-**Verdicts:**
-- **ADOPT**: artifact memory as metadata (path, hash, MIME, mtime, provenance — ledger already does this)
-- **ADAPT**: code-artifact distillations tied to outcomes (Voyager/AWM pattern)
-- **REJECT**: storing screenshots/images as memory entries (zero payoff evidence for text-first agent, real token/storage cost)
-- **FUTURE**: nomic-embed-vision into the EXISTING index (no second store) if a concrete "I saw that file/error before" retrieval failure appears — EXPERIMENT only then
+**The central answer — PRESERVE THE SOURCE; DERIVE THE INTERPRETATION** — survived a 170-attack fresh-context adversarial pass with zero SUCCEEDS against its epistemic core: a two-level model in which content-addressed SOURCE OBJECTS (bytes, hash, MIME, acquisition vs asserted-capture time, sensitivity, retention) are canonical, and every interpretation (OCR, transcript, caption, embedding, layout, segment, summary) is a rebuildable DERIVED REPRESENTATION with explicit lineage (parent, transformation, tool/model+version, lossiness) that never rewrites the source. Canonical Memory holds REFERENCES to source objects — no second store.
 
-**Evidence grades:** CLIP 2103.00020, Voyager, AWM, CogAgent = A (peer-reviewed); Nomic Embed Vision, OS-Copilot, surveys = B.
+**Inward reality (read-only, 2026-09-22):** Rune has NO multimodal memory. Text-only `entries` (944, zero media references); PDF ingestion ALREADY flattens documents to text (17,934 PDF chunks — layout destroyed at ingestion, the exact defect this architecture names); text embeddings are UNVERSIONED (only sqlite-vec v0.1.9 recorded — unrebuildable-with-provenance); tesseract installed and wired into nothing; provider attachments are transient input that evaporates; `RichLog(markup=True)` renders untrusted derived text. Degraded mode is not a future state — it is the present.
 
-**R0 reconciliation:** CONFIRMED 2 · REFINED 1 · OVERTURNED 0 · Sum = 3.
+**Load-bearing external evidence (depths honest):** modality-specific indexes + bridge over one universal space (Liang modality gap RS; ImageBind hub-mediated, emergent ties weak 6.8-vs-36.8; CLIP §6 verbatim: fine-grained/counting/spatial failures); visual document structure is conditionally load-bearing (ColPali RS: +14–16 nDCG over OCR pipelines, figures 2.5×, but only +3.1 on text-dense pages); ASR requires VAD gating (Whisper RS: documented hallucination; ~1% fabricated sentences; 72–87% non-speech ungated); image injection lands on frontier models (>82% ASR adaptive; OCR/EXIF/QR confirmed carriers; audio 49% vs vision ~1% completion asymmetry); CaMeL provides a formally structured out-of-band enforcement architecture under its stated threat model; broader 2026 evidence supports deterministic policy / reference-monitor enforcement OUTSIDE the vulnerable model, while independent adaptive evaluation remains limited and does not establish universal robustness or uniqueness; C2PA normative: a soft binding shall not be used as a hard binding; NIST IR 8280 demographic-differential FR error grounds the biometric-matching-not-identity split.
+
+**Governance carried:** HYPOTHESIS-only ≠ ADOPT (all 20 claims ADOPT via DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT, with EXTERNAL-FINDING typing where the claim is the external result itself); source references are foreign keys; zero-hit findings bounded ("this R1 search found no direct match in the searched sources as of 2026-09-22"); **#402's observed similarity-supersession defect (194015/193729) is carried as the named failure mode: cross-modal/perceptual similarity NOMINATES, never authorizes.**
+
+Counts: applicability 54 (32/0/1/6/14/1) · qualification 68 (63/0/1/1/3/0) · adversarial 170 (12/43/115) · R0 4 (4 CONFIRMED) · preliminary 7 (6 CONFIRMED/1 REFINED) · claims 20 (all ADOPT; all RUNE_APPLICABLE) · innovation 24 (16 ADOPT/3 EXPERIMENT/5 FUTURE) · sources 108 rows / 105 unique / 3 duplicate groups (depths FULL_PAPER 2 · RELEVANT_SECTIONS 8 · ABSTRACT_ONLY 73 · METADATA_VERIFIED 13 · DOCUMENTATION_AUDITED 11 · UNVERIFIED 1; lossless rebuild) · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS · 8 bounded-search gaps.
+
+## 2. Inward reality (read-only audit, 2026-09-22)
+Full detail: 01_inward.md. Five load-bearing gaps: (1) no source-object concept — the schema cannot say "this evidence exists"; (2) no derived-representation lineage — no transformation/model/version records anywhere; (3) document ingestion already destroys modality (PDF→flat text; no page/layout/figures); (4) no modality-capability truth (provider support undeclared/unverifiable from persisted config); (5) no media storage/lifecycle/security surface at all. Classification: CANONICAL 2 · ACTIVE 4 · three PARTIAL-class mechanisms · ABSENT 8 · BYPASS 3 · DORMANT 1 · UNKNOWN 3 (row truth in 01_inward.md).
+
+## 3. Terminology — distinctions tested (mandate §6)
+All 22 mandated non-equalities investigated; verdicts: CONFIRMED distinctions (original≠interpretation; image≠caption; audio≠transcript; document≠OCR; layout≠extracted-text; region≠whole; clip≠event; thumbnail≠source; embedding≠evidence; similarity≠identity; co-occurrence≠causation; one-event-streams≠independent-sources; metadata≠trusted-fact; EXIF≠event-time; diarization≠identity; face-recognition≠identity; synthetic≠false; authentic-capture≠correct-interpretation; better-model≠rewrite-permission; salience≠importance). PARTIAL: visual-salience sometimes correlates with importance (nomination only). The two-population discipline (OBSERVED RUNE ABSENCE vs SOURCE-ATTRIBUTED NEGATIVE vs bounded R1 EXTERNAL ZERO-HIT) carried throughout.
+
+## 4. Foundational cognitive evidence (arm 1, with transfer discipline)
+Kept WITH transfer failures stated: (1) reliability-weighted fusion is a principle, not a mechanism — Rune's scores are uncalibrated rankings, not measured variances (Ernst & Banks; transfer REJECTED); (2) recognition ≫ recall — design for recognition (Standing; Brady et al. FULL_PAPER: 2,500 objects/5.5h, 87–93% forced-choice, explicitly NOT photographic memory); (3) event boundaries are memory anchors (Zacks RS: boundary-anchored encoding verified — anchors C011); (4) source monitoring must be EXPLICIT because the implicit human version is exactly what fails (Johnson et al.; Loftus); (5) paired representations help conditionally (dual-coding criticized; NOT "store everything twice"). Twelve transfers REJECTED with reasons (arm 1 §3): MLE fusion, visual-dominance hierarchies, EST-port segmentation, forgetting curves, consolidation/replay, context-reinstatement keys, picture-superiority storage, unconditional dual coding, McGurk binding, confidence arbitration, two-system familiarity split, capacity-based "store all detail."
+
+## 5. Representation learning (arm 1)
+What joint embeddings preserve: open-vocabulary cross-modal alignment, category-level zero-shot. What they lose (verified): fine-grained discrimination, counting, spatial relations, document fine structure (CLIP §6 verbatim; fails OCR on handwritten digits, beaten by raw-pixel logistic regression). The modality gap (Liang RS) exists at random initialization, is preserved by contrastive loss, and is FUNCTIONAL — cross-modal and within-modality distances are not on one scale; zero cosine ≠ unrelated. ImageBind: six modalities, image-paired hub, emergent ties strictly weaker (audio→video R@1 6.8 vs 36.8 paired). **Verdict (evidence-stated): modality-specific indexes (multi-vector where fidelity matters) + explicit calibrated bridge; strict model+version+space stamping; not one universal space.**
+
+## 6. Universal-vs-modality-specific (mandate §12)
+Options A–E evaluated (06-E): one space REJECTED as primary; modality-native + bridge ADOPTED; early fusion REJECTED for memory (opaque, version-locked); late fusion at ranking ADOPTED with calibration caveat. Century-scale migration favors this decisively: native structures survive model churn; a universal space IS the model churn.
+
+## 7. Retrieval (arm 2; #383 seam)
+Multimodality does NOT resurrect the cascade: SOTA multimodal retrieval is itself score-everything at 100–1,600 documents. Architecture: fused lanes (FTS5 text + metadata + modality-native multi-vector) scored simultaneously, late-interaction rerank, sufficiency-gated abstention; evidence admission at context construction (more retrieved visual pages can REDUCE accuracy — ECF). Single-vector page embeddings lose to BM25-on-OCR (SigLIP 51.4 vs 65.5) — dense visual lanes must be late-interaction multi-vector. Storage for 944 pages ≈ 1M×128-d (~0.5 GB, compressible).
+
+## 8. Multimodal RAG + documents (arm 2)
+Visual RAG beats text RAG end-to-end 20–40% on visual-rich documents (VisRAG); OCR-first sufficiency is CONDITIONAL: native prose fine (TAT-DQA +3.1), figures 79.1-vs-31.6, tables +13.1 (Tesseract's own docs concede table failure without custom layout analysis), infographics +18.9, slides +15, multi-column +18.9–29.1. **Capture-first ingestion (C009): retain page images + layout + extraction.** Handwriting: directionally supported, unmeasured (bounded gap). User-corrected-OCR propagation: bounded zero-hit — no direct work found (searched sources as of 2026-09-22); Rune designs it (C016, corrections keyed to source hash, inherited by re-derivations).
+
+## 9. OCR (mandate §16)
+OCR TEXT = DERIVED OBSERVATION: transformation provenance (tool+version), region mapping, confidence class, source-pixel inspectability. Tesseract constraints documented (≥300 DPI, skew, background; tables fail without custom layout). Correction propagation designed (C016): correction changes current derived view; old interpretation historical; source untouched.
+
+## 10. Audio (arm 2/3; mandate §17)
+Waveform ≠ transcript ≠ diarization ≠ speaker-label ≠ identity. Whisper RS: 12.8 avg WER, documented long-form failure (repeat loops, dropped window-edge words, hallucination; own decoding heuristics called "a workaround"). Hallucination is systematic: ~1% of transcriptions contain fabricated sentences (38% harmful); 3/20 decoder heads drive >75% of non-speech hallucinations; 72–87% non-speech hallucination ungated. **VAD-gated, timestamped, provenance-linked transcripts only (C008); diarization = metadata enrichment.** Inferred emotion from voice ≠ authoritative state (arm 4 AK/AL FAIL).
+
+## 11. Video/temporal (arm 2; mandate §18–19)
+Every surveyed retrieval line uses segment/shot granularity (Moment-DETR set prediction; InternVideo2 semantic segmentation); per-frame indexing appears nowhere. Temporal ranges first-class (C011); boundaries are design-designated with recorded uncertainty (arm 4 CY PARTIAL: no objectively correct boundary). Synchronization: one event may have multiple streams, but they share ONE evidence root; drift/clock issues recorded via the timestamp taxonomy; temporal proximity ≠ causation (arm 4 AA FAIL).
+
+## 12. Spatial/region provenance (mandate §20)
+Region refs (bbox/page-area/frame-range) AVAILABLE as typed references — the minimum viable representation (06-G); universal requirement REJECTED as overhead (arm 4 BH/BI both rejected); scene graphs rejected as canonical.
+
+## 13. Source-vs-derived model (mandate §21–27)
+Two-level model (C001/C002): source object (immutable, content-addressed, policy-gated retention) + derived representations (rebuildable, versioned, lineage-bearing). Content addressing: byte-identity = identity; transformed copies/perceptual similarity/same-event = typed relations, never identity (06-J). Dedupe: automatic ONLY on byte-identity; perceptual similarity nominates (C010; C2PA soft≠hard binding; NeuralHash collision/framing attacks; 5% DB poisoning → 40% surveillance). Derivative multiplicity ≠ independence (C006; arm 4 X/Y/Z FAIL). Interpretation revision: versioned supersession under truth-maintenance (C017; arm 4 U FAIL). Cross-modal contradictions: conflict preservation, no fixed modality precedence (C016/V; arm 4 DI FAIL). #402 defect carried: similarity previously superseded an unrelated cross-domain entry — architecturally banned (C005).
+
+## 14. Uncertainty, hallucination, routing (arm 3; mandate §28–30)
+POPE FULL_PAPER: instruction-tuned LVLMs hallucinate objects MORE (CHAIR_S 32.7 vs 13.0); language-prior-driven (~50–60% frequent objects); chart reasoning GPT-4o 47.1% vs human 80.5% — chart-derived numbers are the highest-risk memory content. Model confidence ≠ calibrated probability (arm 4 W FAIL). Routing principle: cheapest adequate modality-native tool first; deterministic metadata parsers before semantic models; escalation fluid per #400 — no fixed tiers.
+
+## 15. Model/provider independence (mandate §31)
+Original evidence + provenance durable; embeddings/interpretations replaceable projections. Version stamps + dual-index rebuild + verification pass (C004); reindex minutes at Rune scale. Capability truth: provider modality support is undeclared today (#400 owns the capability-truth layer; #403 adds the modality fields).
+
+## 16. Storage, scale, preservation (arm 3; mandate §32–34)
+Content-addressed files (SHA-256 layout) + SQLite metadata + small thumbnails; SQLite blob limit 1 GB (docs) fine for thumbnails; NO dedicated object store/vector DB/graph DB at this scale (arm 4 CH–CM FAIL); two lifecycle classes (hot derivative / cold original); cooling ≠ deletion; recompute-over-store. Preservation: #396 owns general fixity/migration; #403 adds media-specific: original + open-format note + fixity cron (FUTURE scheduling at first media corpus).
+
+## 17. Metadata, sensitivity, identity (arm 3; mandate §35–38)
+Metadata = source-asserted evidence (NIST SP 800-86 forensics treatment); EXIF ≠ event time; timestamp taxonomy observed_at/asserted_capture/verified_event; geolocation stripped-by-default in disclosures (leakage documented; arm 4 AE partial). Sensitive inference: faces leak orientation 81–91%; LLM profilers 86.7% aggregated — harm is emergent across store growth; inferred sensitive traits NEVER persist as facts by default (C012). Biometric similarity = workflow match surfaced to user (FISWG operational-vs-forensic precedent; NIST IR 8280 demographic-differential error); identity authority stays with #402's authentication semantics.
+
+## 18. Multimodal security (#402 seam; mandate §39–41)
+Injection carriers confirmed: typographic/patch attacks (persistent through 2025 SOTA), EXIF/QR/OCR-text (MMPIBench), invisible characters surviving commercial pipelines; adaptive black-box >82% ASR vision, 49% audio completion (asymmetry: audio attacks complete far more often); multimodal RAG poisoning: 5 pairs → 98% ASR. **Taint survives every transformation (C007): transformation may ADD interpretation, never ERASE origin.** CaMeL's formally structured out-of-band enforcement architecture (its formal guarantees hold within its stated threat model; broader 2026 evidence supports enforcement OUTSIDE the vulnerable model, with independent adaptive evaluation limited — no universal-robustness claim) — enforcement at tool/memory-write boundaries outside the model; Spotlighting-style provenance marking as cheap complement. No direct study tracks taint into persistent cross-session memory stores (bounded zero-hit) — convergent indirect evidence only; E16 is the designed test. Synthetic media: provenance not verdicts (C018); detectors unreliable (sink-class generalization failure; ASVspoof 5 compromised; EER 4–20%+) — metadata, never automatic decisions.
+
+## 19. UI, code, accessibility (mandate §42–44)
+Structured UI state (accessibility tree/DOM) primary; screenshot = supporting visual evidence (C019). Rendered artifacts never replace source files. RichLog(markup=True) is a LIVE injection surface for derived text (arm 4 F6 SUCCEEDS) — escape-by-default rendering contract (R; #402 safe-rendering carry). Accessibility derivatives support inspection but remain derivatives (correctable per C016).
+
+## 20. Corrections, user-model, persona, growth (mandate §45–48)
+Corrections: current-view change, history kept, source-hash keying, inheritance across re-derivations (C016). User-model: repeated multimodal observations = hypotheses with provenance, never preference facts (C012; #398 owns). Persona: perception model output ≠ verified event fact; "I saw X" means an interpretation with lineage exists (C017; #399 owns). Growth: changed captions/models ≠ learning; the misread-class probe (U) is an EXPERIMENT; #406 owns evaluation.
+
+## 21. No-model degraded mode (mandate §52)
+Deterministic survival set: file identity, hashes, metadata, exact/lexical retrieval, timestamps, page/segment refs, keyword search, user annotations, provenance, lifecycle. Interpretation marked unavailable, never evidence-invisible (C020; arm 4 DU/DV FAIL). #404 owns offline cognition depth; seam recorded.
+
+## 22. Current 2024–2026 research + benchmarks (mandate §53–54)
+Covered per-arm; benchmarks audited but non-dictating (ViDoRe, POPE/CHAIR, CharXiv, WER suites, ASVspoof, QVHighlights). Benchmark-to-memory transfer is unproven by definition — success on a benchmark ≠ persistence quality.
+
+## 23. Implementation/product mechanisms (mandate §55)
+DAM tiering patterns, perceptual-hash practice (abuse-detection/triage — discovery only), photo-app dedupe distinctions, dual-index migration practice. Vendor docs establish mechanism, never superiority.
+
+## 24. Innovation candidates
+A–X (04_innovation.md): ADOPT 16 · EXPERIMENT 3 (pHash hint column; growth-delta probe; derivative suppression in retrieval) · FUTURE 5 (fixity cron; C2PA validation; local embedder on demonstrated need; ColPali lane with corpus; audio/video lanes). Each with falsifier + kill criterion.
+
+## 25. Fresh adversarial pass (arm 4, general-20)
+170 attacks (156 mandated A–EZ + 14 Rune-specific F1–F14): **SUCCEEDS 12 · PARTIAL 43 · FAILS 115** (row-derived; 05_adversarial.md). The 15 core principles survive direct attack — every landing blow is a principle-to-production gap. 7 of 12 SUCCEEDS are Rune-specific: unversioned production embeddings (S,ET — loaded gun), shipping PDF flattening (C), similarity-supersession unmechanized (F4/F5 — #402 precedent realized), RichLog injection surface (F6), plus missing operations (F10: no eval harness; F14: no retention audit before backfill). **14 forced corrections applied to the architecture** (arm 4 §5): enforced write contract (actor+capability+reason-code+evidence-class); embedding-space quarantine/migration BEFORE any dense lane; source retention + document-class triage; capture-first ingestion; storage lifecycle classes + tombstones + redaction path; corrections keyed to source hash + inherited; index-migration runbook; local eval harness as gate prerequisite; external-reference materialization policy; presentation-authority firewall; trust metadata not verdicts; reproducibility honesty in lineage; prospective audio/video guards; metadata hygiene.
+
+## 26. Synthesis matrices
+06_synthesis.md: A–U (21 matrices) — modality/authority, source-vs-derived, transformation/provenance, retrieval, fusion, temporal, spatial, evidence-independence, error-propagation, dedupe/identity, model/index lifecycle, storage/tiering, privacy, security, user-model, accessibility, preservation, event-bundle, current-capability, T1-minimum, cross-domain ownership.
+
+## 27. R0 reconciliation (r0_reconciliation.md)
+Row-derived: CONFIRMED 4 · REFINED 0 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 4). R0-1 confirmed with the projection-status caveat recorded (extracted text is itself derived).
+
+## 28. Preliminary reconciliation (preliminary_reconciliation.md)
+Row-derived: CONFIRMED 6 · REFINED 1 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 7). P-4 CONFIRMED, with rationale clarified: "screenshots not memory entries" does not mean "screenshots not retained" — they are preserved as source objects with derived projections. P-5 REFINED: version-stamping is a precondition and any future visual retrieval lane must be multi-vector rather than a single-vector lane.
+
+## 29. Claim ledger
+claims.json: 20 claims, all ADOPT, all RUNE_APPLICABLE, each with threat_model, experiment, falsifier, kill criterion. Load-bearing map: load_bearing_evidence.md (DEEP_EXTERNAL discipline audited row-by-row; no shallow anchor labeled DEEP_EXTERNAL; EXTERNAL-FINDING typing where the claim is the external result).
+
+## 30. Experiments / falsifiers (DESIGN ONLY)
+E1–E27 per mandate (§67), mapped to claims. Prerequisites flagged by arm 4: local eval harness BEFORE any quality gates; retention audit BEFORE any backfill.
+
+## 31. Remaining unknowns (bounded)
+- Handwriting/multi-column OCR: no quantitative benchmark found (searched sources as of 2026-09-22) — vendor-conceded failure documented; numbers unknown.
+- Taint-through-transformation into persistent stores: no direct cross-session study found (searched sources as of 2026-09-22) — convergent indirect evidence only; E16 designed.
+- Dense-lane value at n≈924 (text): carried unmeasured from #383.
+- Cross-version embedding degradation: no direct benchmark found (searched sources as of 2026-09-22) — established via dimension/geometry divergence instead.
+- Standalone VLM-rerank evaluation: not found (searched sources as of 2026-09-22).
+- LLM-era image steganography / subtitle-codec injection: this R1 search found no direct verified work in the searched sources as of 2026-09-22 — do not cite unverified candidates.
+- Provider-side attachment retention policies: UNKNOWN (not readable without live probing; out of scope).
+- Live per-model vision support: UNKNOWN (undeclared in persisted config).
+PARKED_TO_LATER_DOMAIN: offline multimodal cognition depth → #404; hardware/GPU placement → #405; final evaluation incl. Growth Delta → #406.
+
+## 32. Source-depth summary (sources.md; machine-derived, LOSSLESS rebuild 2026-09-22)
+
+Canonical form: source_ledger.json (structured, per-row origin_ref) — sources.md is a GENERATED projection (source_ledger_builder.py); copy-fidelity + declared==derived accounting are gate-enforced. The original ledger was built with character-truncation normalizers (fields cut at 70/120/130/140/150 chars) — repaired by a LOSSLESS rebuild from the arm reports: every cell passes through verbatim; unrecored fields are NOT_RECORDED_IN_ARM, never invented. **Exact accounting (canonical ledger derivation, row-kind taxonomy): LEDGER_ROWS = 108 · EXTERNAL_SOURCE_ROWS = 105 · UNIQUE_EXTERNAL_SOURCES = 102 · POINTER_ROWS = 1 (A2-31) · SYNTHESIS_ROWS = 2 (A1-20, A1-32) · DUPLICATE_SOURCE_GROUPS = 3** (ColBERT arXiv:2004.12832 → A1-28+A2-11; ColPali arXiv:2407.01449 → A1-29+A2-1; VideoCLIP arXiv:2109.14084 → A1-30+A2-23). The prior 104/4 was a hand-repair artifact: embedding an arXiv id into the A2-31 pointer row's identifier created a false pyannote duplicate group; the canonical ledger keeps A2-31 verbatim from its arm row (a cross-reference pointer with no stable bibliographic identity, title-fallback identity, honestly labeled). InternVideo (2212.03191) and InternVideo2 (2403.15377) are different papers. **Depths (derived, one primary label per row): FULL_PAPER 2 (Brady et al. 2008 PNAS; POPE 2305.10355) · RELEVANT_SECTIONS 8 (ColPali, Whisper, CLIP §6, Liang, ImageBind, CLIP-version cluster, Zacks, +1) · ABSTRACT_ONLY 73 · METADATA_VERIFIED 13 · DOCUMENTATION_AUDITED 11 (C2PA, SQLite, ExifTool, NIST ×2, GDPR, FISWG, Apple, pyannote, Tesseract, DAM — fully read documentation/standards, never FULL_PAPER) · UNVERIFIED 1.** The stale in-file depth header (72/10/3) that survived the 05c448d repair is corrected by regeneration; declared==derived is gate-enforced. Depth honesty: type ≠ depth held throughout; the do-not-cite register records 16 caught mis-paired arXiv IDs + non-locatable items + LLM-era steganography/subtitle-injection bounded zero-hits — recorded, not silently omitted. Arm-4 source closure: all 30 arXiv IDs cited by the adversarial pass resolve to existing ledger rows (no orphan evidence; its 2 direct re-fetches were of already-ledgered sources). CaMeL wording corrected corpus-wide: formal out-of-band architecture under its stated threat model + broader 2026 support for out-of-model enforcement — no uniqueness claim, no attribution of Progent's adaptive result to CaMeL.
+
+## 33. Evidence saturation
+evidence_saturation.md: **SEARCH_SATURATION = REACHED** (typed gaps, not exhaustion) · **LOAD_BEARING_DEPTH = PASS** (every ADOPT claim mapped; DEEP_EXTERNAL only at FULL_PAPER/RELEVANT_SECTIONS).
+
+## 34. Process truth
+CONTINUOUS_EXECUTION = PASS — zero user continuations in the #403 window; stages executed as internal checkpoints. MAX_CONCURRENT_SUBAGENTS = 1 held: arms strictly serial (general-17 → general-18 → general-19 → general-20), all first-pass SUCCESS, no stalls/retries. Source-access: Europe PMC XML 500s → PMC pages; arXiv ID mis-pairing hazard CONFIRMED 16× across arms (export-API title search adopted as the reliable path). Canonical Memory write: performed pre-freeze; receipt recorded in mutation_audit.md (intended ≠ executed verified). THIS RESEAL accounting: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0 (post-freeze protocol enforced). **Supersession failure status: REPRODUCED** — 194015/193729 (#402) and 194460/194173 (#403, sim 0.81, superseding #395's summary) are two observed cross-domain supersession events by similarity alone. **SAFETY HOLD: no canonical/derived Memory writes for #404–#406 closeouts until a scope/domain-aware supersession authority exists and is proven** (CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX); domain summaries persist in master + registry + Gitea instead. SIMILARITY may nominate; durable supersession requires scope/domain ownership, provenance, explicit relation semantics, write authority, supersession reason, compatible record type, and same-object evidence.
+
+## 35. Artifact pointers
+- 00_issue_scope.md — canonicalization + scope + stage plan
+- 01_inward.md — read-only multimodal capability audit (A–L, classification, gaps)
+- 02_outward/arm1_foundations.md — 31 sources; human cognition + representation learning
+- 02_outward/arm2_retrieval_rag.md — 30 sources; ColPali/Whisper deep reads; cascade verdict
+- 02_outward/arm3_reliability_security.md — 33 sources; hallucination/injection/C2PA/biometrics/storage
+- 02_outward/arm4_adversarial_pass.md — 170 attacks; 14 forced corrections
+- 03_applicability.md — 54 rows (32/0/1/6/14/1)
+- 04_innovation.md — 24 candidates (16/3/5)
+- 05_adversarial.md — row file (12/43/115)
+- 06_synthesis.md — 21 matrices
+- 07_qualification.md — 68 questions (63/0/1/1/3/0)
+- claims.json — 20 ADOPT claims · load_bearing_evidence.md — support map
+- sources.md — 108-row ledger + do-not-cite register
+- r0_reconciliation.md — R0 row truth: Sum 4, all CONFIRMED
+- preliminary_reconciliation.md — 6C/1R
+- evidence_saturation.md — REACHED/PASS
+- AB_MULTIMODAL_ARTIFACT_MEMORY_R1_BATCHED_PRELIMINARY.md — byte-preserved (sha 5c705036…9c4bc8)
+- mutation_audit.md — freeze audit (written LAST)
+
+## 36. Mutation audit
+Authoritative record: mutation_audit.md (written LAST; supersedes prior audits for this domain). Post-freeze protocol encoded: forbidden write classes + automatic FREEZE_STALE rule. All research/accounting/tooling writes completed BEFORE the audit; no post-freeze writes.

research/memory-atlas-r1/AB-multimodal-artifact-memory/claims.json

@@ -0,0 +1,22 @@
+[
+ {"id":"AB-R1-C001","claim":"Two-level model: SOURCE OBJECT (content-addressed immutable original: bytes, hash, MIME, acquisition vs asserted-capture time, sensitivity, retention) plus DERIVED REPRESENTATION (OCR/transcript/caption/embedding/layout/segment/summary) with explicit lineage (parent, transformation, tool/model+version, lossiness); derived projections are rebuildable and never rewrite source bytes","evidence_for":"Arm2 ColPali RS: visual structure load-bearing for figures (79.1 vs 31.6) — flattening destroys it; arm1 CLIP §6 RS: one vector loses counting/spatial/fine-grained; arm4 attacks C,S,A FAIL-or-PARTIAL against flattening; inward: Rune's PDF→text flattening already shipping, unversioned embeddings already production","evidence_against":"Storage/complexity cost of keeping originals; arm4 N,P,BM partials on derivative hoarding","limitations":"Original retention gated by policy/sensitivity; #396 owns format migration","inward":"PDF flattening shipping with no layout; no source-object concept (01_inward A,C)","transfer_assumptions":"None — direct architectural principle","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"T1 schema gains artifact-ref type + derived-representation records","experiment":"E1, E3, E13","falsifier":"A modality where source bytes add zero retrievable/interpretable value beyond projections AND projections never need revision","kill_criterion":"E1/E6 fail to show any source-inspection need","threat_model":"silent flattening; projection-as-original confusion"},
+ {"id":"AB-R1-C002","claim":"Canonical Memory stores REFERENCES (content-addressed) to media; no second canonical multimodal store","evidence_for":"Arm1 A1/A2 table: LFS/DVC pattern; family R0-1; arm4 CH-CM FAILS; inward: documents table already path+content_hash registry","evidence_against":"Blob-in-SQLite simplicity for tiny media","limitations":"Reference liveness needs fixity checks (pointer-rot risk from family)","inward":"documents table = path+hash precedent","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"T1 artifact-reference type (hash, location, format, extraction)","experiment":"E24, E19","falsifier":"External-reference durability proven superior for Rune's media classes","kill_criterion":"E24 shows unretrievable cold originals in practice","threat_model":"pointer rot; silent blob loss"},
+ {"id":"AB-R1-C003","claim":"Modality-specific indexes + explicit cross-modal bridge; NOT one universal embedding space","evidence_for":"Arm1 RS: Liang modality gap (cones separated by construction, gap functional); ImageBind hub-mediated with weak emergent ties (audio→video R@1 6.8 vs 36.8); CLIP §6 fine-grained failures; arm2: vanilla single-vector loses to BM25-on-OCR (SigLIP 51.4 vs 65.5)","evidence_against":"Simplicity of one space; ImageBind works approximately","limitations":"Bridge itself needs training/calibration data","inward":"Rune has one text lane only; adding media lanes native-first is cheaper than re-encoding everything into one space","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"per-modality lanes + bridge; no universal re-embedding","experiment":"E7","falsifier":"A shared-space model with measured cross-modal retrieval matching modality-native at equal cost and calibration","kill_criterion":"E7 shows cross-modal bridge unnecessary at Rune scale","threat_model":"similarity conflation; uncalibrated mixing"},
+ {"id":"AB-R1-C004","claim":"Every embedding lane stamped (model_id, model_version, space_id); embeddings are derived, rebuildable, never canonical evidence; index rebuilds wholesale on model change (dual-index for one verification pass)","evidence_for":"Arm4 S,ET,R SUCCEEDS/PARTIAL against unstamped; arm1 B12 RS: versions differ in dimension (512/768/1024) and geometry; arm2: ColPali vs ColQwen2 >5 nDCG on identical data; inward: production embeddings have NO model recorded (only sqlite-vec lib version v0.1.9)","evidence_against":"Rebuild cost (minutes at Rune scale — not load-bearing)","limitations":"—","inward":"01_inward G: unversioned embeddings = unrebuildable-with-provenance","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"embedding schema + migration runbook","experiment":"E14","falsifier":"Evidence that embedding spaces are version-stable","kill_criterion":"E14 shows version-mixed indexes harmless","threat_model":"silent ranking corruption on model swap"},
+ {"id":"AB-R1-C005","claim":"Retrieval: score-everything fused lanes (FTS5 text + metadata + modality-native multi-vector) + late-interaction rerank + sufficiency-gated abstention; NO multi-stage cascade; cross-modal similarity NOMINATES, never authorizes supersession/deletion","evidence_for":"#383 carry (cascade = scale artifact at n≈924); arm2: SOTA multimodal retrieval is itself score-everything at 100-1600 docs; multi-vector late interaction beats single-vector (ColPali RS); #402 RUNE_DIRECT: similarity superseded unrelated cross-domain entry (194015/193729)","evidence_against":"Latency negligible at scale — no counterevidence","limitations":"Dense-lane value at n≈924 still unmeasured (carried)","inward":"sqlite-vec present; small corpus","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"retrieval design; dedupe/supersession gate","experiment":"E7, E8, E9","falsifier":"Measured corpus growth where cascade wins","kill_criterion":"E9 shows similarity-threshold dedupe safe (it will not)","threat_model":"similarity-driven supersession; false merges"},
+ {"id":"AB-R1-C006","claim":"Evidence independence counted by ROOTS: transcript+caption+OCR+embedding of one source = ONE evidence root; derivative multiplicity never counts as corroboration","evidence_for":"#397 carry (derivation algebra); arm1 ImageBind: derivatives of one source share its root; arm2 finding 10; arm4 X,Y,Z FAILS","evidence_against":"—","limitations":"—","inward":"—","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"evidence-set construction at context assembly","experiment":"E10","falsifier":"A case where derivative multiplicity adds real evidentiary weight without new roots","kill_criterion":"E10 counts four confirmations","threat_model":"corroboration inflation; self-confirmation"},
+ {"id":"AB-R1-C007","claim":"Multimodal content = DATA, never control authority; taint survives every transformation (OCR/caption/transcript of hostile media stays UNTRUSTED); enforcement at tool/memory-write boundaries OUTSIDE the model (CaMeL pattern); transformed content inherits source labels — transformation may add interpretation, never erase origin","evidence_for":"Arm3: image injection >82% ASR adaptive on frontier models; OCR/EXIF/QR confirmed carriers (MMPIBench); audio 49% completion vs vision ~1% (asymmetry); CaMeL provides a formally structured out-of-band enforcement architecture under its stated threat model; broader 2026 evidence supports deterministic policy / reference-monitor enforcement OUTSIDE the vulnerable model, while independent adaptive evaluation remains limited and does not establish universal robustness; Bad Characters invisible chars surviving commercial pipelines; arm4 AN-AT FAILS; #402 carry (content/control separation, policy discipline)","evidence_against":"AS sanitizing OCR text PARTIAL (defense-in-depth helps but insufficient)","limitations":"No direct study tracks taint into persistent cross-session memory stores (bounded zero-hit) — convergent indirect evidence only","inward":"RichLog(markup=True) renders untrusted derived text; ingestion trusts all documents","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seam with #402)","architecture_impact":"ingestion taint labels; write-boundary gates","experiment":"E15, E16","falsifier":"A transformation provably removing all adversarial content without semantic loss","kill_criterion":"E16 shows sanitized OCR safe (it will not)","threat_model":"image→OCR→prompt control path; RAG poisoning"},
+ {"id":"AB-R1-C008","claim":"Audio enters memory only as VAD-gated, timestamped, provenance-linked transcripts with the waveform retained; transcript ≠ recording; ASR hallucination assumed (~1% fabricated sentences; 72-87% non-speech hallucination ungated); speaker diarization = metadata enrichment, never identity","evidence_for":"Arm2 Whisper RS (long-form failure modes documented by OpenAI itself); Careless Whisper ~1% fabricated (38% harmful); Calm-Whisper 3/20 heads >75% non-speech hallucinations; WhisperX VAD gating; arm4 B,AG,AH,AK FAILS","evidence_against":"—","limitations":"WER on accented/noisy audio still material","inward":"no audio path exists — prospective design","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"audio ingestion design (future)","experiment":"E4","falsifier":"ASR with measured near-zero hallucination without gating","kill_criterion":"E4 shows transcripts silently authoritative","threat_model":"fabricated transcript lines; speaker mislabeling"},
+ {"id":"AB-R1-C009","claim":"Capture-first document ingestion: retain page images + layout + extraction (text where native); modality-native structure preferred over flat text; text-first is sufficient ONLY for native prose","evidence_for":"Arm2 ColPali RS (+14-16 nDCG over OCR pipelines; figures 2.5×; tables +13.1 with Tesseract's own docs conceding table failure; TAT-DQA +3.1 only on text-dense = the conditional); arm4 C,A FAILS","evidence_against":"Storage cost of page images (bounded by tiering C015)","limitations":"Handwriting numbers unmeasured (bounded gap)","inward":"PDF flattening shipping = the exact defect","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"ingestion pipeline redesign","experiment":"E2, E6","falsifier":"Evidence OCR-first matches visual retrieval on figure/table/chart tasks","kill_criterion":"E2 shows OCR errors never propagate","threat_model":"OCR-error-as-truth; layout destruction"},
+ {"id":"AB-R1-C010","claim":"Perceptual similarity (pHash/embedding distance) is a DISCOVERY/nomination signal only — byte-identity is the only automatic dedupe; similarity NEVER authorizes supersession, deletion, or merge (C2PA: a soft binding shall not be used as a hard binding)","evidence_for":"C2PA §9 doc; arm3 NeuralHash collision/framing attacks; arm3 DB-poisoning (5%→40% surveillance); #402 RUNE_DIRECT: observed cross-domain supersession defect (194015/193729); arm4 G,H,BB,BC,BD FAILS","evidence_against":"—","limitations":"—","inward":"dedupe_receipts use similarity for supersession decisions today","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"dedupe policy: exact-bytes only automatic","experiment":"E8, E9","falsifier":"Perceptual hash family with proven collision resistance sufficient for deletion decisions","kill_criterion":"E9 destructive merge","threat_model":"framing attack; wrong-supersession"},
+ {"id":"AB-R1-C011","claim":"Multimodal evidence anchored at structural EVENT boundaries (commits/turns/task steps/session segments); temporal ranges as first-class references for audio/video; temporal co-occurrence ≠ causation","evidence_for":"Arm1 RS: Zacks event segmentation (boundary-anchored encoding verified); arm2: all video retrieval uses segment/shot granularity (Moment-DETR set prediction; per-frame nowhere); arm4 J,AA,CZ,DA FAILS","evidence_against":"—","limitations":"Event boundary choice is design-designated not ground truth (arm4 CY PARTIAL)","inward":"chunks have line ranges (text analogue of segments)","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"segment-ref type","experiment":"E5, E12","falsifier":"Evidence token-window chunking of media outperforms event anchoring","kill_criterion":"E5 cannot retrieve correct temporal evidence","threat_model":"temporal conflation; event misalignment"},
+ {"id":"AB-R1-C012","claim":"Biometric similarity (face/voice) supports MATCHING workflows only, surfaced to user; NEVER identity authority or persistent fact by default; inferred sensitive attributes (identity, health, emotion, orientation, demographics) never persist as facts without explicit justification","evidence_for":"Arm3: NIST IR 8280 demographic-differential error; FISWG operational-vs-forensic split (institutional precedent); GDPR Art. 9 special-category trigger; faces leak orientation 81-91% (Kosinski DOI) + LLM profilers 86.7% aggregated; arm4 AG-AM FAILS; #402 authentication carry","evidence_against":"Operational matching utility acknowledged (PARTIALs on AJ only)","limitations":"—","inward":"no biometric path exists — prospective design","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seams #398/#402)","architecture_impact":"sensitive-inference firewall at write path","experiment":"E20, E21","falsifier":"Biometric match with zero measured error and user-consented authority semantics","kill_criterion":"E21 observation becomes preference/fact","threat_model":"identity misassignment; sensitive-trait leakage; third-party privacy"},
+ {"id":"AB-R1-C013","claim":"Media metadata (EXIF/ID3/container) = source-asserted evidence: recorded with its asserted character, never promoted to verified event fact; EXIF timestamp ≠ capture time ≠ event time; geolocation treated as sensitive and stripped-by-default in disclosures","evidence_for":"Arm3: spoofing/stripping documented; NIST SP 800-86 forensics treatment; arm4 AB,AC,AE,AF FAILS; privacy leakage evidence","evidence_against":"AE PARTIAL (some workflows need GPS)","limitations":"—","inward":"—","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"timestamp taxonomy (observed_at vs asserted vs verified)","experiment":"E11, E12","falsifier":"Metadata with cryptographic capture attestation as default","kill_criterion":"E11 spoofed EXIF becomes authoritative","threat_model":"metadata spoofing; privacy leakage"},
+ {"id":"AB-R1-C014","claim":"Least-media disclosure: providers receive the smallest sufficient representation (derived subset, crop, transcript segment) unless original modality is required; sensitivity propagates to ALL derivatives unless explicitly declassified; disclosure recorded","evidence_for":"#402 carry (least-context; destination allow-lists); arm3: thumbnails/EXIF leak; derivative leakage documented; arm4 E17/E18 design; arm4 EB-EE FAILS (deleting source ≠ deleting knowledge; keeping everything ≠ privacy)","evidence_against":"Tension with EEA full-media requirement acknowledged","limitations":"—","inward":"attachments currently flow whole to providers transiently","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seam #402)","architecture_impact":"disclosure gate + sensitivity propagation","experiment":"E17, E18","falsifier":"A disclosure scheme where derivatives never leak sensitive content","kill_criterion":"E17 transmits whole sensitive media unnecessarily","threat_model":"derivative leakage; provider disclosure"},
+ {"id":"AB-R1-C015","claim":"Storage: content-addressed files (SHA-256 layout) + SQLite metadata rows + small thumbnails only; NO dedicated object store/vector DB/graph DB at Rune scale; two lifecycle classes (hot derivative/cold original); cooling ≠ deletion; recompute-over-store for expensive derivatives","evidence_for":"Arm3 storage verdict (SQLite blob limit 1GB doc; DAM tiering pattern; reindex minutes at 944); arm4 CH-CJ FAILS (always/simplest absolutes); #383 scale discipline","evidence_against":"CH PARTIAL (SQLite blobs fine for thumbnails)","limitations":"Revisit at corpus growth; #405 owns hardware","inward":"436MB all-text store; no media dirs today","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seam #405)","architecture_impact":"storage layout decision","experiment":"E24","falsifier":"Media corpus where content-addressed files + SQLite break integrity/scale","kill_criterion":"E24 cold originals unretrievable","threat_model":"blob loss; unmanaged growth"},
+ {"id":"AB-R1-C016","claim":"User corrections: change the CURRENT derived view; source bytes and historical interpretation preserved; corrections keyed to SOURCE hash and inherited by future re-derivations (correction survives model upgrade); correction-inheritance is truth-maintenance, not deletion","evidence_for":"#388 truth-maintenance carry; arm2: crowd-correction works best with source image beside text; arm4 BE,BF,BG FAILS; arm2 bounded zero-hit: no user-corrected-OCR-propagation work found (Rune designs it)","evidence_against":"—","limitations":"—","inward":"update_entry currently silent-rewrite (no correction history)","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seam #388)","architecture_impact":"correction records keyed by source hash","experiment":"E3","falsifier":"—","kill_criterion":"E3 old interpretation lost or source rewritten","threat_model":"correction loss on re-derivation"},
+ {"id":"AB-R1-C017","claim":"Interpretation revision: future models reinterpret the same source; interpretations are VERSIONED (v1 historical, v2 current view); supersession of interpretations uses the same truth-maintenance machinery as textual memory; source bytes unchanged","evidence_for":"#1 principle; arm1 B12 versioning evidence; arm4 U FAILS; arm2 ColPali/ColQwen2 divergence shows reinterpretation is real","evidence_against":"Storage cost of interpretation history (bounded)","limitations":"—","inward":"no interpretation versioning exists","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"derived-record versioning","experiment":"E13","falsifier":"—","kill_criterion":"E13 old interpretations silently overwritten","threat_model":"history loss; provenance break"},
+ {"id":"AB-R1-C018","claim":"Synthetic/generated media: record acquisition + generation-claim provenance (C2PA where present); synthetic ≠ false, camera-origin ≠ true; provenance is source-not-truth (C2PA normative); trust metadata, never trust verdicts — AI-content detectors too unreliable for automatic decisions","evidence_for":"C2PA spec doc (soft/hard binding; threat model); arm3: detector generalization failure; ASVspoof 5 compromised baselines; arm4 AU,AV,AW FAILS","evidence_against":"—","limitations":"C2PA adoption partial; stripping possible","inward":"—","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403","architecture_impact":"acquisition-provenance fields","experiment":"E22 (conflict preservation)","falsifier":"Detector with measured near-zero FP/FN across generators","kill_criterion":"Detector verdict auto-deletes/flags content","threat_model":"synthetic framing; detector over-trust"},
+ {"id":"AB-R1-C019","claim":"UI/screen memory: prefer structured UI state (accessibility tree, DOM, structured output) as primary representation where available; screenshot = supporting visual evidence; multimodal derived text renders through SAFE (escaped) surfaces only","evidence_for":"#401 carry (structured-first); arm3 RichLog markup surface (arm4 F6 SUCCEEDS = live defect); arm2 OCR limits on UI text; arm4 AN FAILS","evidence_against":"Accessibility trees unavailable in some apps (fallback needed)","limitations":"—","inward":"RichLog(markup=True) = live injection surface for derived text","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seam #401/#402)","architecture_impact":"UI-state capture preference; rendering escape-by-default","experiment":"E23","falsifier":"—","kill_criterion":"Screenshot-only capture loses accessible structure routinely","threat_model":"injection via rendered derived text"},
+ {"id":"AB-R1-C020","claim":"No-model degraded mode: without any semantic multimodal model, Rune retains source identity, hashes, metadata, exact/lexical retrieval, provenance, task linkage, and reports interpretation-unavailable honestly; evidence never disappears from state because a model is absent","evidence_for":"#400 capability-truth carry; arm4 DU,DV FAILS; #52 mandate (deterministic survival set); inward: tesseract present-but-unwired shows deterministic tools are feasible","evidence_against":"—","limitations":"#404 owns offline cognition depth","inward":"input-transient attachments already evaporate — degraded mode is the DEFAULT today","transfer_assumptions":"—","classification":"ADOPT","evidence_level":"RUNE_APPLICABLE","owner":"#403 (seam #404)","architecture_impact":"capability-degradation semantics","experiment":"E25","falsifier":"—","kill_criterion":"E25 evidence disappears from state","threat_model":"evidence-invisibility during outages"}
+]

research/memory-atlas-r1/AB-multimodal-artifact-memory/evidence_saturation.md

@@ -0,0 +1,22 @@
+# #403 AB — Evidence Saturation + Load-Bearing Depth (2026-09-22)
+
+## Branch record
+
+Arms 1-3 + adversarial arm 4; ~124 source rows across foundations (31), retrieval/RAG (30), reliability/security (33), adversarial verification (2 direct re-fetches + reuse of arm ledger). Search spaces: human multimodal cognition, contrastive/joint embedding learning, visual-document retrieval, multimodal RAG, ASR/diarization, video temporal retrieval, OCR reliability, multimodal hallucination, multimodal prompt injection, steganography, C2PA/synthetic media provenance, detector reliability, metadata forensics, biometric identity + demographic bias, sensitive-attribute inference, perceptual hashing, storage/tiering, embedding migration.
+
+## Late-search checks (typed outcomes)
+
+- "user-corrected OCR error propagation through retrieval index" → this R1 search found no direct match in the searched sources as of 2026-09-22 (crowd-correction-with-source-image nearest; correction propagation is a bounded gap and a Rune-original design surface).
+- "study tracking taint through media→transform→persistent memory store across sessions" → this R1 search found no direct match in the searched sources as of 2026-09-22 (convergent indirect evidence only: injection carriers, pipeline-surviving invisible chars, adaptive ASR figures).
+- "quantitative Tesseract handwriting/multi-column benchmark" → this R1 search found no direct published benchmark in the searched sources as of 2026-09-22 (vendor-conceded failure documented; numbers bounded gap).
+- "cross-version embedding degradation benchmark" → this R1 search found no direct benchmark in the searched sources as of 2026-09-22 (version incomparability established via dimension/geometry evidence instead).
+- "standalone VLM-rerank evaluation" → this R1 search found no direct standalone evaluation in the searched sources as of 2026-09-22.
+- "LLM-era image steganography against VLM pipelines" → this R1 search found no direct verified work in the searched sources as of 2026-09-22 — do not cite.
+- "subtitle/codec injection in video" → this R1 search found no direct verified work in the searched sources as of 2026-09-22 — do not cite.
+- "dense-lane value at n≈924 for text" → this R1 search found no direct measurement in the searched sources as of 2026-09-22 (carried unmeasured from #383; self-measurement experiment designed, not run).
+
+## Verdict
+
+**SEARCH_SATURATION = REACHED** — late searches returned typed gaps and do-not-cites, not new architecture-changing mechanisms; 8 typed gaps recorded as bounded-search findings.
+
+**LOAD_BEARING_DEPTH = PASS** — every ADOPT claim maps through load_bearing_evidence.md to DEEP_EXTERNAL (RELEVANT_SECTIONS/FULL_PAPER anchors: ColPali, Whisper, CLIP §6, Liang, ImageBind, CLIP-version cluster, Zacks, POPE-at-full-paper for measurement context), RUNE_DIRECT (inward facts: flattening shipping, unversioned embeddings, similarity-supersession defect, RichLog surface, documents-table precedent), or DESIGN_INVARIANT; EXTERNAL-FINDING typing used only where the claim is the external result itself (CaMeL's formal out-of-band enforcement architecture under its stated threat model; detector unreliability — with independent adaptive evaluation remaining limited and no uniqueness claim). No HYPOTHESIS-support ADOPT (rule carried). Source TYPE and DEPTH separate throughout; documentation never FULL_PAPER.

research/memory-atlas-r1/AB-multimodal-artifact-memory/load_bearing_evidence.md

@@ -0,0 +1,32 @@
+# #403 AB — Load-Bearing Evidence Map (2026-09-22)
+
+| Claim | Architecture rule | Rune inward evidence | External anchor(s) | Support type | Residual assumptions | Falsifier |
+|---|---|---|---|---|---|---|
+| AB-R1-C001 | source object + derived representation; projections never rewrite source | 01_inward A,C: PDF flattening ships, no source-object concept; unversioned embeddings in production | ColPali 2407.01449 (A2-1, RELEVANT_SECTIONS); CLIP 2103.00020 §6 (A1-21, RELEVANT_SECTIONS) | DESIGN_INVARIANT + DEEP_EXTERNAL | retention gated by policy/sensitivity | E1/E6 show no source-inspection need |
+| AB-R1-C002 | Memory = references to content-addressed media; no second store | 01_inward A: documents table = path+content_hash registry (the precedent) | Git LFS/DVC pattern (family R0-1, DOCUMENTATION_AUDITED-class) | DESIGN_INVARIANT + RUNE_DIRECT | pointer liveness needs fixity cron | E24 cold originals unretrievable |
+| AB-R1-C003 | modality-specific indexes + bridge; no universal space | one text lane exists; native-first lanes cheaper | Liang modality gap 2203.02053 (A1-25, RELEVANT_SECTIONS); ImageBind 2305.05665 (A1-24, RELEVANT_SECTIONS); CLIP 2103.00020 §6 (A1-21, RELEVANT_SECTIONS) | DEEP_EXTERNAL | bridge calibration data needed | shared space matches modality-native at equal cost |
+| AB-R1-C004 | embeddings stamped model+version; rebuild on change; never canonical | 01_inward G: production embeddings unversioned (sqlite-vec v0.1.9 only) | CLIP version-incomparability cluster (A1-32, RELEVANT_SECTIONS); ColPali 2407.01449 (A2-1, RELEVANT_SECTIONS) | RUNE_DIRECT + DEEP_EXTERNAL | — | version-stable spaces proven |
+| AB-R1-C005 | score-everything fused lanes; similarity nominates never authorizes | #402 RUNE_DIRECT: 194015 superseded unrelated 193729 by similarity | ColPali 2407.01449 (A2-1, RELEVANT_SECTIONS); #383 row truth (cascade = scale artifact) | DESIGN_INVARIANT + RUNE_DIRECT + DEEP_EXTERNAL | dense-lane value unmeasured (carried) | E9 similarity-threshold dedupe safe |
+| AB-R1-C006 | one source = one evidence root | — | ImageBind 2305.05665 (A1-24, RELEVANT_SECTIONS — derivatives share root); #397 derivation algebra carry | DEEP_EXTERNAL + DESIGN_INVARIANT | — | E10 counts four confirmations |
+| AB-R1-C007 | multimodal content = data; taint survives transformation; enforce outside model | RichLog(markup=True) renders untrusted derived text; ingestion trusts all documents | CaMeL 2503.18813 (A3, ABSTRACT_ONLY — external finding only: formally structured out-of-band enforcement with formal guarantees under its stated threat model; NOT evidence of unique adaptive-eval survival); MMPIBench (A3, ABSTRACT_ONLY); Image Hijacks 2309.00236 (A3, ABSTRACT_ONLY) | DESIGN_INVARIANT + EXTERNAL finding (the claim is only the external result — CaMeL's formal out-of-band architecture within its stated threat model — not a Rune prescription from these reads, and not a claim of unique adaptive robustness) | no direct taint-into-persistent-store study (bounded zero-hit) | E16 sanitized OCR safe |
+| AB-R1-C008 | VAD-gated timestamped transcripts; transcript ≠ recording | no audio path — prospective | Whisper 2212.04356 (A2-13, RELEVANT_SECTIONS — documented failure modes); Careless Whisper (A2-14, ABSTRACT_ONLY) | DEEP_EXTERNAL + DESIGN_INVARIANT | WER on hard audio material | E4 transcripts silently authoritative |
+| AB-R1-C009 | capture-first document ingestion; visual structure load-bearing conditionally | PDF flattening ships (01_inward C) | ColPali 2407.01449 (A2-1, RELEVANT_SECTIONS: +14-16 nDCG; TAT-DQA +3.1 conditional) | DEEP_EXTERNAL + RUNE_DIRECT | handwriting unmeasured (bounded gap) | E2 OCR errors never propagate |
+| AB-R1-C010 | perceptual similarity nominates; byte-identity is the only automatic dedupe | dedupe_receipts similarity-supersede today; #402 observed defect | C2PA §9 (A3, DOCUMENTATION_AUDITED — normative anchor, not deep-read) | DESIGN_INVARIANT + RUNE_DIRECT | — | E9 destructive merge |
+| AB-R1-C011 | event-boundary anchoring; temporal ranges first-class | chunks have line ranges (text analogue) | Zacks et al. 2007 (A1-10, RELEVANT_SECTIONS); Moment-DETR line (A2-21, ABSTRACT_ONLY) | DEEP_EXTERNAL + DESIGN_INVARIANT | boundaries are design-designated | E5 temporal retrieval fails |
+| AB-R1-C012 | biometric similarity = workflow match; no sensitive-trait persistence | no biometric path — prospective | NIST IR 8280 (A3, METADATA_VERIFIED); FISWG (A3, DOCUMENTATION_AUDITED); GDPR Art. 9 (A3, DOCUMENTATION_AUDITED) | DESIGN_INVARIANT | — | E21 observation becomes fact |
+| AB-R1-C013 | metadata = source-asserted; timestamp taxonomy; GPS stripped-by-default | — | NIST SP 800-86 (A3, DOCUMENTATION_AUDITED); ExifTool docs (A3, DOCUMENTATION_AUDITED) | DESIGN_INVARIANT | — | E11 spoofed EXIF authoritative |
+| AB-R1-C014 | least-media disclosure; sensitivity propagates to derivatives | attachments flow whole to providers transiently | #402 sealed carry (least-context, allow-lists) | DESIGN_INVARIANT + RUNE_DIRECT | — | E17 whole sensitive media transmitted |
+| AB-R1-C015 | content-addressed files + SQLite metadata + small thumbnails; no object store at this scale | 436MB all-text store; no media dirs | SQLite limits (A3, DOCUMENTATION_AUDITED); DAM tiering pattern (A3, DOCUMENTATION_AUDITED) | RUNE_DIRECT + DESIGN_INVARIANT | revisit at corpus growth | E24 fails |
+| AB-R1-C016 | corrections change current view; keyed to source hash; survive re-derivation | update_entry silent-rewrite (no history) | crowd-correction-with-source-image (A2-29, ABSTRACT_ONLY); bounded zero-hit: no user-OCR-propagation work | DESIGN_INVARIANT | Rune-original design | E3 history lost |
+| AB-R1-C017 | interpretation versioning; truth-maintenance supersession | no interpretation versioning exists | ColPali/ColQwen2 divergence (A2-1, RELEVANT_SECTIONS) | DESIGN_INVARIANT + RUNE_DIRECT | — | E13 silent overwrite |
+| AB-R1-C018 | synthetic media: provenance not verdicts; detectors not decision-makers | — | C2PA spec (A3, DOCUMENTATION_AUDITED); detector generalization failure (A3, ABSTRACT_ONLY — external finding) | DESIGN_INVARIANT + EXTERNAL finding | C2PA adoption partial | detector auto-deletes content |
+| AB-R1-C019 | structured UI state primary; safe rendering of derived text | RichLog(markup=True) live surface (01_inward F) | #401/#402 sealed carry | DESIGN_INVARIANT + RUNE_DIRECT | accessibility trees not universal | E23 screenshot-only loses structure |
+| AB-R1-C020 | no-model degraded mode keeps evidence visible | input-transient attachments evaporate today (degraded mode IS the default) | #400 capability-truth carry | RUNE_DIRECT + DESIGN_INVARIANT | #404 owns offline depth | E25 evidence disappears |
+
+## DEEP_EXTERNAL discipline
+
+DEEP_EXTERNAL rows cite anchors at RELEVANT_SECTIONS or FULL_PAPER depth (ColPali A2; Whisper A2; CLIP §6 A1; Liang A1; ImageBind A1; CLIP-version cluster A1; Zacks A1). ABSTRACT_ONLY/METADATA_VERIFIED/DOCUMENTATION_AUDITED anchors (C2PA, NIST, FISWG, CaMeL, MMPIBench, POPE-at-abstract... ) are NEVER labeled DEEP_EXTERNAL; where they matter they appear as DESIGN_INVARIANT support, RUNE_DIRECT (observed Rune facts), or explicitly typed EXTERNAL-FINDING support whose claim is only the external result (CaMeL's adaptive-eval survival; detector unreliability) — never a Rune prescription. POPE 2305.10355 was read FULL_PAPER by arm 3 — its measurement findings support hallucination-rate assertions (used inside C008/C018 evidence context), not a Rune prescription by itself.
+
+## Full C001–C020 support↔source↔depth↔proposition audit
+
+Every row above audited: support type matches the deepest honest anchor; no shallow anchor is called DEEP_EXTERNAL; DESIGN_INVARIANT rows do not borrow depth from shallow literature; RUNE_DIRECT rows cite the observed inward/runtime fact by name.

research/memory-atlas-r1/AB-multimodal-artifact-memory/mutation_audit.md

@@ -0,0 +1,65 @@
+# #403 AB — CANONICAL LEDGER CONTRACT / SELF-CONSISTENCY MUTATION AUDIT (2026-09-22)
+
+STATUS: CONTENT-FREEZE AUDIT — final-state declaration; this file is the ACTUAL LAST write. Supersedes the audits sealed at `c322801` and `05c448d`. After this write, NO file is modified; only read-only gates, git transport, and Gitea receipts follow.
+
+## Base seal accepted — and a process-learning admission
+
+The substantive state of `05c448d` is ACCEPTED (research, architecture, 20 claims, adversarial record, CaMeL correction, applicability/preliminary corrections, Memory safety hold). **But the 05c448d repair was NOT actually lossless, and this audit records the process-learning facts rather than hiding them:**
+1. **The [:60] truncation recurrence:** the 05c448d trace reconstructed A3-30/A3-32 with `ident = ...[:60]`, producing visibly truncated identifiers ("…Forensic Techniques int", "…Part 3: Demograph") directly contradicting its own LOSSLESS claim. Root cause: hand-patching a projection with substring operations instead of regenerating from origin rows.
+2. **Stale depth header:** sources.md declared FULL_PAPER 2 / RS 8 / ABS 72 / MV 13 / DOC 10 / UNV 3 while the row-derived truth was 73/13/11/1 — a declared summary allowed to diverge from rows with nothing comparing them.
+3. **Reduced rich-schema gate:** the prior check verified only a reduced column set, not the mandated 18-field contract.
+4. **NC-M was ad-hoc:** duplicate SOURCE-IDENTITY detection lived in a throwaway recount script, not in the gate (the gate only caught duplicate ROW IDs).
+
+All four are fixed structurally in this repair; none is a substantive-research defect.
+
+## Canonical ledger contract (mandate §3–§5, §12)
+
+**`source_ledger.json` is now the canonical structured ledger; `sources.md` is a GENERATED projection** (builder: `source_ledger_builder.py`, deterministic, in-domain). Every row carries the full 18-field contract (source_id · stable_identifier · title · authors · year · venue · version · source_type · modality · task · dataset · method · key_claims · negative_results · limitations · rune_relevance · read_depth · origin_ref); fields the arms did not record carry NOT_RECORDED_IN_ARM (never invented); **origin_ref traces every row to its persisted arm row** — fabricated origin_refs FAIL the gate. There are no longer two independently editable authorities: the gate enforces copy-fidelity (any markdown cell ≠ its canonical JSON cell → FAIL), row-set equality (projection stale → FAIL), declared==derived accounting (→ FAIL), and structural sanity (multiple depth labels / bibliographic fragments in the modality column → FAIL). Silent character truncation is now mechanically impossible to certify as lossless.
+
+**Heterogeneous arm rows handled honestly:** arm-3 contains 8-cell rows (a column omitted). The builder anchors on the DEPTH cell (rightmost label-bearing cell), order-maps pre-depth cells to identifier/title/authors/modality/claims/negatives/limitations with NOT_RECORDED for arm-omitted columns, and records a normalization note per row. A3-30 and A3-32 were reconstructed from their ORIGINAL arm rows: full NIST SP 800-86 / NIST IR 8280 locators, doi:10.6028/NIST.IR.8280 identity, DOCUMENTATION_AUDITED / ABSTRACT_ONLY respectively — no hand-patching, no substring operations.
+
+## Exact accounting — corrected by the canonical derivation (mandate §5–§6, §17, §23)
+
+**SOURCE_ROWS = 108 · SOURCE_UNIQUE = 105 · SOURCE_DUPLICATE_GROUPS = 3** (arXiv:2004.12832 ColBERT → A1-28+A2-11 · arXiv:2407.01449 ColPali → A1-29+A2-1 · arXiv:2109.14084 VideoCLIP → A1-30+A2-23). **The prior sealed figure 104/4 was a hand-repair artifact**, now corrected by the canonical derivation: the 05c448d hand-patch had embedded an arXiv id into the A2-31 pointer row's identifier, manufacturing a false pyannote duplicate group. In the canonical ledger A2-31 is verbatim from its arm row — a cross-reference pointer with no stable bibliographic identity (title-fallback identity, honestly labeled, counted as its own ledger row). **Depths (derived): FULL_PAPER 2 · RELEVANT_SECTIONS 8 · ABSTRACT_ONLY 73 · METADATA_VERIFIED 13 · DOCUMENTATION_AUDITED 11 · UNVERIFIED 1 = 108** — matching the prior row-derived result; the stale in-file header (72/10/3) is gone because the summary is now GENERATED from the same rows that generate the table, and declared==derived is gate-enforced (mandate §8–§9 satisfied structurally, not by manual edit).
+
+## Identity duplication moved into the gate (mandate §10)
+
+The R1_FULL gate now itself normalizes source identity (arXiv → DOI → PMID → normalized-title fallback) over the projection, computes SOURCE_UNIQUE and duplicate groups, and compares them to the ledger's declared accounting. Two row IDs sharing one identity both remain rows; the identity counts once; the duplicate map names both. Declared ≠ derived → GATE FAIL. The ad-hoc recount script is retired.
+
+## Negative controls (mandate §13 — BEFORE freeze, all restored byte-identically)
+
+- **NC-Q** truncated identifier in the projection → **COPY-FIDELITY FAIL (CAUGHT)**.
+- **NC-R** declared ABSTRACT_ONLY 73→72 without changing rows → **declared/derived FAIL (CAUGHT)**.
+- **NC-S** removed source_type from a JSON row → **contract-field FAIL (CAUGHT)**.
+- **NC-T** added a duplicate-identity row to the projection without updating the ledger → **projection-STALE FAIL (CAUGHT)** (SOURCE_UNIQUE unchanged on regeneration).
+- **NC-U** fabricated row with a non-arm origin_ref → **traceability FAIL (CAUGHT)**.
+- **NC-V** clean regeneration → **PASS**.
+- NO negative control after the freeze.
+
+## Preserved (verified untouched)
+
+All accepted semantic corrections (CaMeL three-way scope; P-4 CONFIRMED/P-5 REFINED; applicability 32/0/1/6/14/1; bounded zero-hit wording; arm-4 closure; 20 claims; innovation 24; adversarial 170 = 12/43/115) · Memory-write safety hold (supersession failure REPRODUCED; CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX active for #404–#406) · substantive counts (applicability 54, qualification 68, R0 4C, prelim 6C/1R, claims 20 ADOPT, SEARCH_SATURATION = REACHED, LOAD_BEARING_DEPTH = PASS). Older sealed domains: not held to the rich schema; regression gates confirm no drift.
+
+## Memory / derived state (mandate §16)
+
+**CANONICAL_MEMORY_WRITE = 0. DERIVED_MEMORY_WRITE = 0.** Observed supersession history (192685; 194015/193729; 194460/194173 sim 0.81; fact-9293) preserved untouched, un-repaired.
+
+## Process truth
+
+Original #403 process truth PRESERVED (CONTINUOUS_EXECUTION = PASS; zero user continues; MAX_CONCURRENT_SUBAGENTS = 1; four serial first-pass arms). This repair: controller-only, MAX_CONCURRENT_SUBAGENTS = 0, zero user continuations, no literature rereads, no broad search.
+
+## Post-freeze protocol (governing)
+
+After this audit: ALLOWED = read-only gates (AB + AA/Z/Y/X/W R1_FULL), git inspection, the ONE seal commit, push origin + gitea, mirror verification, Gitea receipts, read-only file opening, final natural-language response. FORBIDDEN = negative controls, temporary tracked-file edits, artifact/registry/tooling edits, session notes, memory_store.py, memory_consolidation.py, cleanup/tidying. If ANY forbidden post-freeze write occurs: **FREEZE_STALE = TRUE automatically** — reseal only via a genuinely NEW final audit written LAST. Nothing durable follows the seal.
+
+## Freeze declaration
+
+All mutations (structured ledger + generated projection + gate contract + accounting derivation + master/registry convergence + six negative controls) are complete BEFORE this audit. **This audit is the ACTUAL LAST write.** Sequence: FINAL_CONTENT_GATE (read-only) → ONE seal commit → push/mirror/verify → corrected Gitea #403 + #375 receipts → STOP. STOP MEANS STOP.
+
+## FINAL EVIDENCE-HARNESS CONVERGENCE ADDENDUM (2026-09-22, harness consolidation #411)
+
+The harness consolidation tranche (support issue #411) extended this domain's canonical ledger per the newly proven contract: row_kind taxonomy added to every row (SOURCE/POINTER/SYNTHESIS via row_kind_classify_v1), origin_row_hash + normalization_id + raw_origin_cells recorded, builder gained --project-only mode, and the gate gained REAL origin resolution + ORIGIN→CANONICAL field fidelity + row-kind accounting. **Corrected mechanical accounting: LEDGER_ROWS = 108 · EXTERNAL_SOURCE_ROWS = 105 · UNIQUE_EXTERNAL_SOURCES = 102 · POINTER_ROWS = 1 (A2-31) · SYNTHESIS_ROWS = 2 (A1-20, A1-32) · DUPLICATE_SOURCE_GROUPS = 3** — the prior "105 unique" conflated pointer/synthesis rows into the external count; master §32/§1 and the registry row are converged to this. No research, architecture, claim, or depth change. Regression fixtures R1–R10 (research_harness_regression_matrix.md) all PASS against this domain, each firing its named target validator. Sources depth truth unchanged (FP 2 · RS 8 · ABS 73 · MV 13 · DOC 11 · UNV 1). R1_HARNESS_BASELINE_VERSION = 1.0 inherited by #404–#406. This addendum restores this audit as the domain's actual last write; no further #403 reseal for harness edits.
+
+## BASELINE FINALIZATION ADDENDUM (2026-09-22, support #411 final two-defect correction)
+
+Title-fallback identity de-truncated (full normalized bibliographic identity replaces [:100] prefix in both builder and gate; accounting unchanged at 108/105/102/1/2/3 — ledger regenerated, projection regenerated); freeze-enforcement wording honestly downgraded to PARTIAL in the harness artifacts (no hash-manifest implemented; R12 correctly skipped); R1–R11 regression all PASS. This addendum restores this audit as the domain's actual last write. No research, architecture, claim, or depth change. R1_HARNESS_BASELINE_VERSION = 1.0 rev.2.

research/memory-atlas-r1/AB-multimodal-artifact-memory/preliminary_reconciliation.md

@@ -0,0 +1,13 @@
+# #403 AB — Batched-Preliminary Reconciliation (batched master sha 5c705036…9c4bc8; 2026-09-22)
+
+| P | Batched conclusion | Verdict | Evidence |
+|---|---|---|---|
+| P-1 | "Literature multimodal 'memory' is never a second store — shared embedding space or distilled artifacts; screenshots in GUI agents are INPUT" | CONFIRMED | Arm2: M3-Agent (2508.09736) = closest analogue, entity-centric multimodal memory, +5-8pts from ORGANIZATION not model size; no surveyed system stores raw media as memory entries. |
+| P-2 | ADOPT: artifact memory as metadata (path, hash, MIME, mtime, provenance) | CONFIRMED | C001/C002; strengthened: content-ADDRESS (hash-first) rather than path (arm4 CB,CC FAIL paths-as-identity). |
+| P-3 | ADAPT: code-artifact distillations tied to outcomes (Voyager/AWM pattern) | CONFIRMED | AWM +24.6%/+51.1% relative success (batched, grade A anchors); unchanged — but out of #403's core scope (text-side learning), carried to growth seams. |
+| P-4 | REJECT: storing screenshots/images as memory entries | CONFIRMED | Zero payoff evidence still; but REFINED rationale: the rejection is about media-as-ENTRY; the same screenshot IS retained as a SOURCE OBJECT with derived projections under C001 — the batched framing conflated "not a memory entry" with "not kept." |
+| P-5 | FUTURE: nomic-embed-vision into existing index, EXPERIMENT only on demonstrated need | REFINED | Directionally right; refined by arm1/2 evidence: (a) ANY dense lane must be version-stamped first (inward unversioned index = precondition defect); (b) single-vector CLIP-style page embeddings measurably LOSE to BM25-on-OCR (51.4 vs 65.5) — a future visual lane must be multi-vector late-interaction, not one embedding; (c) "no second store" holds. |
+| P-6 | Evidence grades CLIP/Voyager/AWM/CogAgent = A; Nomic/surveys = B | CONFIRMED | Arm depths consistent; CLIP read at RS incl. §6 verbatim this run. |
+| P-7 | R0 reconciliation: 2 CONFIRMED · 1 REFINED · Sum 3 | CONFIRMED | Re-derived independently above: 4/0/0 Sum 4 (the family baseline had 4 findings; batched reconciled 3 — Sum discrepancy noted, this run's row truth is authoritative). |
+
+Row-derived: CONFIRMED 6 · REFINED 1 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 7).

research/memory-atlas-r1/AB-multimodal-artifact-memory/r0_baseline_extract.md

@@ -0,0 +1,10 @@
+# #403 AB — R0 Baseline Extract (family file Section AB; reconnaissance, NOT authority)
+
+Source: research/memory-atlas/families/mind_palace_hci_multimodal.md §AB. To be re-derived one-to-one during R0_RECONCILIATION (CONFIRMED/REFINED/OVERTURNED/STILL_UNKNOWN), not inherited.
+
+- R0-1: Store-vs-reference boundary (Git LFS/DVC): blobs content-addressed; canonical record = pointer+hash; extracted text stored inline.
+- R0-2: Embeddings NOT stable / not portable across models (2609.16875); metadata+text-first retrieval; multimodal embeddings = rebuildable derived index tagged model+version; REJECT as primary retrieval lane.
+- R0-3: Decades identity = content hash + stable ID + descriptive metadata + format characterization + provenance chain (OAIS/PREMIS/LoC/Gladney).
+- R0-4: Agent practice: store-recent + truncate-and-reference large outputs; recent inline, older demoted to pointer+hash+summary; never hash-and-drop without extraction (MCP resources-by-reference).
+
+Batched master (5c705036…9c4bc8) verdicts to reconcile: ADOPT artifact-memory-as-metadata; ADAPT code-artifact distillations (Voyager/AWM); REJECT screenshots-as-memory-entries; FUTURE nomic-embed-vision into existing index (EXPERIMENT only on demonstrated need). R0 reconciliation at batch: 2 CONFIRMED · 1 REFINED · Sum 3.

research/memory-atlas-r1/AB-multimodal-artifact-memory/r0_reconciliation.md

@@ -0,0 +1,10 @@
+# #403 AB — R0 Reconciliation (family Section AB baseline; 2026-09-22)
+
+| R0 | Family claim | Verdict | Evidence |
+|---|---|---|---|
+| R0-1 | Store-vs-reference boundary: blobs content-addressed; canonical record = pointer+hash; extracted text inline | CONFIRMED | Inward documents-table precedent + arm3 storage verdict + arm4 CB-CL FAILs; refined scope: extracted text is itself a DERIVED projection (with lineage), not privileged inline truth — the family's "extracted text stored inline (it's what retrieval runs on)" holds for retrieval but must not read as "extracted text = the evidence" (arm2 ColPali: extraction loses figures 2.5×). Verdict CONFIRMED with the projection-status caveat recorded in C001/C009. |
+| R0-2 | Embeddings NOT stable/portable; metadata+text-first; multimodal embeddings = rebuildable version-tagged derived index; REJECT as primary lane | CONFIRMED | Arm1 B12 RS (dimension/geometry version differences); arm2 ColPali-vs-ColQwen2 >5 nDCG; inward unversioned production embeddings; arm4 S,ET SUCCEEDS on the unstamped status quo. |
+| R0-3 | Decades identity = hash + stable ID + descriptive metadata + format characterization + provenance chain | CONFIRMED | #396 carry + arm3 C2PA/SQLite/docs; pointer-rot mitigation = fixity cron (FUTURE scheduling recorded). |
+| R0-4 | Agent practice: store-recent + truncate-and-reference; never hash-and-drop without extraction | CONFIRMED | Arm2/3 practice evidence; #396 preservation; arm4 N,P FAIL (hoard) and Q (drop) both rejected — the middle path stands. |
+
+Row-derived: CONFIRMED 4 · REFINED 0 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 4).

research/memory-atlas-r1/AB-multimodal-artifact-memory/source_ledger_builder.py

@@ -0,0 +1,270 @@
+#!/usr/bin/env python3
+"""Canonical source-ledger builder for #403 AB — R1 harness consolidation version.
+
+Canonical form:  source_ledger.json (structured; per-row origin provenance +
+                 origin_row_hash + named normalization manifest).
+Projection:      sources.md (GENERATED — never hand-edited).
+
+Contract (R1 harness consolidation, support issue #411):
+  - ORIGIN → CANONICAL: every canonical row traces to a persisted arm row via
+    origin_ref; the builder resolves origin_refs against the actual arm files
+    and records origin_row_hash for fidelity checking.
+  - Normalizations are NAMED (normalization_id) and deterministic; raw origin
+    cells are retained verbatim (no truncation anywhere).
+  - row_kind taxonomy: SOURCE (external evidence object) / POINTER (internal
+    cross-reference; not a new external source) / SYNTHESIS (internally
+    constructed evidence cluster; not itself a new external source).
+  - Identity accounting counts SOURCE rows only.
+  - Declared accounting is DERIVED from these rows, never hand-typed.
+
+Run:  .test-venv/bin/python source_ledger_builder.py
+"""
+import hashlib, json, os, re
+from collections import Counter, defaultdict
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ARMS = [
+    ("A1", "02_outward/arm1_foundations.md", 1),
+    ("A2", "02_outward/arm2_retrieval_rag.md", 0),
+    ("A3", "02_outward/arm3_reliability_security.md", 0),
+]
+DEPTHS = ("FULL_PAPER","RELEVANT_SECTIONS","ABSTRACT_ONLY","METADATA_VERIFIED",
+          "DOCUMENTATION_AUDITED","CODE_AUDITED","UNVERIFIED","REPLICATED")
+NOT_RECORDED = "NOT_RECORDED_IN_ARM"
+
+# ---- normalization manifest (named, deterministic, inspectable) ----
+NORMALIZATIONS = {
+    "identity_from_arm1_row_v1": "arm1 9-cell row → identifier/title/modality/claims/negatives/limitations/depth/relevance direct copy (COPY mapping, no value transformation)",
+    "identity_from_arm23_9cell_row_v1": "arm2/3 9-cell row → identifier=cell0(COPY); title='title — authors, year, venue' (split_bibliographic_cell_v1 on cells 1+2, non-lossy concatenation); rest COPY",
+    "map_8_cell_arm23_row_v1": "arm2/3 8-cell row (one arm column omitted) → depth cell anchored right-to-left; pre-depth cells order-mapped to identifier/title/authors/modality/claims/negatives/limitations (arm-omitted columns → NOT_RECORDED_IN_ARM); post-depth cell → relevance; NO truncation or synthesis",
+    "depth_label_from_arm_cell_v1": "read_depth = first depth-vocabulary label found in the origin depth cell (right-to-left anchor); full origin cell preserved verbatim in read_depth_raw",
+    "row_kind_classify_v1": "row_kind: POINTER if the origin row is an internal cross-reference (title/relevance marks it as counted elsewhere); SYNTHESIS if the origin row is an internally constructed evidence cluster ('synthesis row' / 'evidence cluster'); else SOURCE",
+}
+
+def row_kind(cells, relevance):
+    joined = " ".join(cells).lower() + " " + relevance.lower()
+    if "cross-reference" in joined or "counted once" in joined or re.search(r"see §?\d+c?\b.*counted", joined):
+        return "POINTER"
+    if "synthesis row" in joined or "evidence cluster" in joined:
+        return "SYNTHESIS"
+    return "SOURCE"
+
+def extract_tables(src):
+    lines = src.splitlines(); tables = []; i = 0
+    while i < len(lines):
+        ln = lines[i]
+        if ln.startswith("|") and "read depth" in ln.lower():
+            rows = []; i += 1
+            while i < len(lines) and lines[i].startswith("|"):
+                if re.match(r"^\|[\s\-|]+\|$", lines[i]): i += 1; continue
+                cells = [c.strip() for c in lines[i].strip().strip("|").split("|")]
+                if cells and cells[0] and cells[0] not in ("#", "ID", "# ID / locator"):
+                    rows.append(cells)
+                i += 1
+            tables.append(rows)
+        else:
+            i += 1
+    return tables
+
+def depth_label(cell):
+    hits = [lab for lab in DEPTHS if re.search(rf"\b{lab}\b", cell)]
+    return hits[0] if hits else "UNVERIFIED"
+
+rows = []
+for tag, rel, id_style in ARMS:
+    path = os.path.join(HERE, rel)
+    arm_bytes = open(path, "rb").read()
+    arm_hash = hashlib.sha256(arm_bytes).hexdigest()
+    src = arm_bytes.decode("utf-8")
+    n = 0
+    for trows in extract_tables(src):
+        for cells in trows:
+            n += 1
+            pad = cells + [NOT_RECORDED] * (9 - len(cells))
+            orig_id = pad[0]
+            sid = f"{tag}-{n}"
+            if id_style == 1:
+                nid = "identity_from_arm1_row_v1"
+                identifier, title, authors_v = pad[1], pad[2], NOT_RECORDED
+                modality, claims, negs, limits = pad[3], pad[4], pad[5], pad[6]
+                depth_raw, relevance = pad[7], pad[8]
+                depth = depth_label(depth_raw)
+            else:
+                depth_idx = None
+                for i in range(len(cells) - 1, -1, -1):
+                    if any(re.search(rf"\b{lab}\b", cells[i]) for lab in DEPTHS):
+                        depth_idx = i; break
+                if depth_idx == 7 or (depth_idx is None and len(cells) >= 9):
+                    nid = "identity_from_arm23_9cell_row_v1"
+                    identifier, title = pad[0], f"{pad[1]} — {pad[2]}"
+                    authors_v = pad[2]
+                    modality, claims, negs, limits = pad[3], pad[4], pad[5], pad[6]
+                    depth_raw, relevance = pad[7], pad[8]
+                    depth = depth_label(depth_raw)
+                else:
+                    nid = "map_8_cell_arm23_row_v1"
+                    di = depth_idx if depth_idx is not None else len(cells) - 2
+                    pre = cells[:di]; post = cells[di + 1:]
+                    depth_raw = cells[di]
+                    depth = depth_label(depth_raw)
+                    g = lambda k: pre[k] if k < len(pre) else NOT_RECORDED
+                    identifier, title, authors_v = g(0), g(0), g(1)
+                    modality, claims, negs, limits = g(2), g(3), g(4), g(5)
+                    relevance = post[0] if post else NOT_RECORDED
+            kind = row_kind(cells, relevance)
+            rows.append({
+                "source_id": sid,
+                "row_kind": kind,
+                "stable_identifier": identifier,
+                "title": title,
+                "authors": authors_v,
+                "year": NOT_RECORDED,
+                "venue": NOT_RECORDED,
+                "version": NOT_RECORDED,
+                "source_type": NOT_RECORDED,
+                "modality": modality,
+                "task": modality,
+                "dataset": NOT_RECORDED,
+                "method": NOT_RECORDED,
+                "key_claims": claims,
+                "negative_results": negs,
+                "limitations": limits,
+                "rune_relevance": relevance,
+                "read_depth": depth,
+                "read_depth_raw": depth_raw,
+                "origin_ref": f"{rel} | row '{orig_id}'",
+                "origin_row_hash": arm_hash,
+                "normalization_id": nid,
+                "raw_origin_cells": cells,
+                "md_cells": [sid, identifier, title, modality, claims, negs, limits, depth, relevance],
+            })
+
+# ---- identity accounting: SOURCE rows only ----
+def identity_key(r):
+    joined = r["stable_identifier"] + " " + r["title"]
+    m = re.search(r"arXiv:(\d{4}\.\d{4,5})", joined) or re.search(r"\b(\d{4}\.\d{4,5})\b", joined)
+    if m: return ("arxiv", m.group(1))
+    m = re.search(r"(10\.\d{4,9}/[^\s,;|)]+)", joined)
+    if m: return ("doi", m.group(1).rstrip(".,;)"))
+    m = re.search(r"PMID[: ]*(\d+)", joined)
+    if m: return ("pmid", m.group(1))
+    # Title-fallback identity: FULL normalized bibliographic identity — never a
+    # truncated prefix (harness invariant; [:N] forbidden in canonical identity).
+    return ("title", re.sub(r"\W+", " ", joined.lower()).strip())
+
+source_rows = [r for r in rows if r["row_kind"] == "SOURCE"]
+pointer_rows = [r for r in rows if r["row_kind"] == "POINTER"]
+synth_rows = [r for r in rows if r["row_kind"] == "SYNTHESIS"]
+groups = defaultdict(list)
+for r in source_rows: groups[identity_key(r)].append(r["source_id"])
+dup_groups = {k: sorted(v) for k, v in groups.items() if len(v) > 1}
+depth_counts = Counter(r["read_depth"] for r in rows)
+
+accounting = {
+    "LEDGER_ROWS": len(rows),
+    "EXTERNAL_SOURCE_ROWS": len(source_rows),
+    "UNIQUE_EXTERNAL_SOURCES": len(groups),
+    "POINTER_ROWS": len(pointer_rows),
+    "SYNTHESIS_ROWS": len(synth_rows),
+    "DUPLICATE_SOURCE_GROUPS": len(dup_groups),
+    "duplicate_map": {f"{k[0]}:{k[1]}": v for k, v in sorted(dup_groups.items())},
+    "depth_counts": dict(depth_counts),
+}
+
+import sys
+if "--project-only" in sys.argv:
+    # Regenerate ONLY the markdown projection from the existing canonical JSON.
+    # Used by regression fixtures R3/R4: canonical mutation + consistent projection
+    # must still FAIL via origin->canonical fidelity, not projection staleness.
+    data = json.load(open(os.path.join(HERE, "source_ledger.json"), encoding="utf-8"))
+    acct, jrows = data["accounting"], data["rows"]
+    groups_all = defaultdict(list)
+    for r in jrows:
+        if r.get("row_kind") == "SOURCE": groups_all[identity_key(r)].append(r["source_id"])
+    dup_groups = {k: sorted(v) for k, v in groups_all.items() if len(v) > 1}
+    depth_counts = Counter(r["read_depth"] for r in jrows)
+    out = [
+"# #403 AB — Source Ledger", "",
+"**Canonical form: `source_ledger.json` (structured, per-row origin provenance + origin_row_hash + normalization_id + row_kind). This file is a GENERATED projection — edit the JSON via `source_ledger_builder.py` and rebuild; never hand-edit rows here.** Copy-fidelity, origin resolution, row-kind accounting, and declared==derived accounting are all gate-enforced (R1_FULL).", "",
+"Schema: source_id · row_kind (SOURCE/POINTER/SYNTHESIS) · stable_identifier · title · authors · year · venue · version · source_type · modality · task · dataset · method · key_claims · negative_results · limitations · rune_relevance · read_depth · origin_ref · origin_row_hash · normalization_id · raw_origin_cells. Fields the arm tables did not record carry NOT_RECORDED_IN_ARM; nothing is invented; NO field is truncated — every cell passes through verbatim.", "",
+f"**Derived accounting (mechanical, from source_ledger.json): LEDGER_ROWS = {acct['LEDGER_ROWS']} · "
+f"EXTERNAL_SOURCE_ROWS = {acct['EXTERNAL_SOURCE_ROWS']} · UNIQUE_EXTERNAL_SOURCES = {acct['UNIQUE_EXTERNAL_SOURCES']} · "
+f"POINTER_ROWS = {acct['POINTER_ROWS']} · SYNTHESIS_ROWS = {acct['SYNTHESIS_ROWS']} · "
+f"DUPLICATE_SOURCE_GROUPS = {acct['DUPLICATE_SOURCE_GROUPS']}.**", "",
+"Duplicate map (identity → SOURCE row IDs):"]
+    for kk, v in dup_groups.items():
+        out.append(f"- {kk[0]}:{kk[1]} → {' + '.join(v)}")
+    out += ["",
+            "**Depths (derived, one primary label per row): " +
+            " · ".join(f"{k} {depth_counts.get(k,0)}" for k in
+                       ("FULL_PAPER","RELEVANT_SECTIONS","ABSTRACT_ONLY","METADATA_VERIFIED",
+                        "DOCUMENTATION_AUDITED","CODE_AUDITED","UNVERIFIED","REPLICATED") if depth_counts.get(k,0)) +
+            f" = {len(jrows)}.** Source TYPE and read DEPTH are separate; documentation/standards/practitioner "
+            "material is DOCUMENTATION_AUDITED even when fully read.", "",
+            "## Do-not-cite / unverifiable register", "",
+            "- Eich 1995 (not locatable; cite Murre 2021/2022) · Godden & Baddeley 1980 follow-ups (citation-only existence) · "
+            "Wade et al. 2002 (not fetched) · no verified cross-version embedding-degradation benchmark (bounded zero-hit) · "
+            "ColQwen2 (cite via ColPali v6 Table 7 only) · 2307.01380 (physics), 2309.17436 (real Image Hijacks = 2309.00236), "
+            "2405.01532 (real StruQ = 2402.06363), 2406.01184, 1810.07254 (Kosinski = DOI 10.1037/pspa0000098), 1812.06210 · "
+            "blog-post WER numbers · M3-Agent beyond its n=100 benchmark · 16 mis-paired arXiv IDs caught across arms "
+            "(arXiv export-API title search is the reliable verification path)."]
+    for tag, rel, _ in ARMS:
+        out += ["", f"## Arm {tag[1]} — rows {tag}-1…{tag}-{sum(1 for r in jrows if r['source_id'].startswith(tag))}", "", HDR, SEP]
+        for r in jrows:
+            if r["source_id"].startswith(tag): out.append("| " + " | ".join(r["md_cells"]) + " |")
+    open(os.path.join(HERE, "sources.md"), "w", encoding="utf-8").write("\n".join(out) + "\n")
+    print("projection regenerated from canonical JSON (project-only mode)")
+    sys.exit(0)
+
+# ---- generate sources.md (projection) ----
+HDR = ("| source_id | identifier / locator | Title — authors, year, venue | Modality / task | "
+       "Key claims | Negative results | Limitations | Read depth | Rune relevance |")
+SEP = "|---|---|---|---|---|---|---|---|---|"
+def md_row(r): return "| " + " | ".join(r["md_cells"]) + " |"
+
+out = [
+"# #403 AB — Source Ledger",
+"",
+"**Canonical form: `source_ledger.json` (structured, per-row origin provenance + origin_row_hash + normalization_id + row_kind). This file is a GENERATED projection — edit the JSON via `source_ledger_builder.py` and rebuild; never hand-edit rows here.** Copy-fidelity, origin resolution, row-kind accounting, and declared==derived accounting are all gate-enforced (R1_FULL).",
+"",
+"Schema: source_id · row_kind (SOURCE/POINTER/SYNTHESIS) · stable_identifier · title · authors · year · venue · version · source_type · modality · task · dataset · method · key_claims · negative_results · limitations · rune_relevance · read_depth · origin_ref · origin_row_hash · normalization_id · raw_origin_cells. Fields the arm tables did not record carry NOT_RECORDED_IN_ARM; nothing is invented; NO field is truncated — every cell passes through verbatim.",
+"",
+f"**Derived accounting (mechanical, from source_ledger.json): LEDGER_ROWS = {accounting['LEDGER_ROWS']} · "
+f"EXTERNAL_SOURCE_ROWS = {accounting['EXTERNAL_SOURCE_ROWS']} · UNIQUE_EXTERNAL_SOURCES = {accounting['UNIQUE_EXTERNAL_SOURCES']} · "
+f"POINTER_ROWS = {accounting['POINTER_ROWS']} · SYNTHESIS_ROWS = {accounting['SYNTHESIS_ROWS']} · "
+f"DUPLICATE_SOURCE_GROUPS = {accounting['DUPLICATE_SOURCE_GROUPS']}.**",
+"",
+"Duplicate map (identity → SOURCE row IDs):",
+]
+for kk, v in dup_groups.items():
+    out.append(f"- {kk[0]}:{kk[1]} → {' + '.join(v)}")
+out += ["",
+        "**Depths (derived, one primary label per row): " +
+        " · ".join(f"{k} {depth_counts.get(k,0)}" for k in
+                   ("FULL_PAPER","RELEVANT_SECTIONS","ABSTRACT_ONLY","METADATA_VERIFIED",
+                    "DOCUMENTATION_AUDITED","CODE_AUDITED","UNVERIFIED","REPLICATED") if depth_counts.get(k,0)) +
+        f" = {len(rows)}.** Source TYPE and read DEPTH are separate; documentation/standards/practitioner "
+        "material is DOCUMENTATION_AUDITED even when fully read.",
+"",
+"## Do-not-cite / unverifiable register",
+"",
+"- Eich 1995 (not locatable; cite Murre 2021/2022) · Godden & Baddeley 1980 follow-ups (citation-only existence) · "
+"Wade et al. 2002 (not fetched) · no verified cross-version embedding-degradation benchmark (bounded zero-hit) · "
+"ColQwen2 (cite via ColPali v6 Table 7 only) · 2307.01380 (physics), 2309.17436 (real Image Hijacks = 2309.00236), "
+"2405.01532 (real StruQ = 2402.06363), 2406.01184, 1810.07254 (Kosinski = DOI 10.1037/pspa0000098), 1812.06210 · "
+"blog-post WER numbers · M3-Agent beyond its n=100 benchmark · 16 mis-paired arXiv IDs caught across arms "
+"(arXiv export-API title search is the reliable verification path).",
+]
+for tag, rel, _ in ARMS:
+    out += ["", f"## Arm {tag[1]} — rows {tag}-1…{tag}-{sum(1 for r in rows if r['source_id'].startswith(tag))}", "", HDR, SEP]
+    for r in rows:
+        if r["source_id"].startswith(tag): out.append(md_row(r))
+open(os.path.join(HERE, "sources.md"), "w", encoding="utf-8").write("\n".join(out) + "\n")
+json.dump({"normalization_manifest": NORMALIZATIONS, "accounting": accounting, "rows": rows},
+          open(os.path.join(HERE, "source_ledger.json"), "w", encoding="utf-8"),
+          ensure_ascii=False, indent=1)
+print(f"rows={accounting['LEDGER_ROWS']} ext={accounting['EXTERNAL_SOURCE_ROWS']} "
+      f"unique={accounting['UNIQUE_EXTERNAL_SOURCES']} ptr={accounting['POINTER_ROWS']} "
+      f"syn={accounting['SYNTHESIS_ROWS']} dups={accounting['DUPLICATE_SOURCE_GROUPS']}")
+print("depths:", dict(depth_counts))
+print("pointer rows:", [r['source_id'] for r in pointer_rows], "| synthesis rows:", [r['source_id'] for r in synth_rows])

research/memory-atlas-r1/AB-multimodal-artifact-memory/sources.md

@@ -0,0 +1,141 @@
+# #403 AB — Source Ledger
+
+**Canonical form: `source_ledger.json` (structured, per-row origin provenance + origin_row_hash + normalization_id + row_kind). This file is a GENERATED projection — edit the JSON via `source_ledger_builder.py` and rebuild; never hand-edit rows here.** Copy-fidelity, origin resolution, row-kind accounting, and declared==derived accounting are all gate-enforced (R1_FULL).
+
+Schema: source_id · row_kind (SOURCE/POINTER/SYNTHESIS) · stable_identifier · title · authors · year · venue · version · source_type · modality · task · dataset · method · key_claims · negative_results · limitations · rune_relevance · read_depth · origin_ref · origin_row_hash · normalization_id · raw_origin_cells. Fields the arm tables did not record carry NOT_RECORDED_IN_ARM; nothing is invented; NO field is truncated — every cell passes through verbatim.
+
+**Derived accounting (mechanical, from source_ledger.json): LEDGER_ROWS = 108 · EXTERNAL_SOURCE_ROWS = 105 · UNIQUE_EXTERNAL_SOURCES = 102 · POINTER_ROWS = 1 · SYNTHESIS_ROWS = 2 · DUPLICATE_SOURCE_GROUPS = 3.**
+
+Duplicate map (identity → SOURCE row IDs):
+- arxiv:2004.12832 → A1-28 + A2-11
+- arxiv:2407.01449 → A1-29 + A2-1
+- arxiv:2109.14084 → A1-30 + A2-23
+
+**Depths (derived, one primary label per row): FULL_PAPER 2 · RELEVANT_SECTIONS 8 · ABSTRACT_ONLY 73 · METADATA_VERIFIED 13 · DOCUMENTATION_AUDITED 11 · UNVERIFIED 1 = 108.** Source TYPE and read DEPTH are separate; documentation/standards/practitioner material is DOCUMENTATION_AUDITED even when fully read.
+
+## Do-not-cite / unverifiable register
+
+- Eich 1995 (not locatable; cite Murre 2021/2022) · Godden & Baddeley 1980 follow-ups (citation-only existence) · Wade et al. 2002 (not fetched) · no verified cross-version embedding-degradation benchmark (bounded zero-hit) · ColQwen2 (cite via ColPali v6 Table 7 only) · 2307.01380 (physics), 2309.17436 (real Image Hijacks = 2309.00236), 2405.01532 (real StruQ = 2402.06363), 2406.01184, 1810.07254 (Kosinski = DOI 10.1037/pspa0000098), 1812.06210 · blog-post WER numbers · M3-Agent beyond its n=100 benchmark · 16 mis-paired arXiv IDs caught across arms (arXiv export-API title search is the reliable verification path).
+
+## Arm 1 — rows A1-1…A1-32
+
+| source_id | identifier / locator | Title — authors, year, venue | Modality / task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A1-1 | PMID 1012311; doi:10.1038/264746a0 | Hearing lips and seeing voices — McGurk & MacDonald 1976, Nature 264:746–748 | audio+visual (speech) | Incongruent lip movements and heard syllables fuse into a third percept ("ga" heard when lips say "ba" and audio says "ga"); audiovisual speech is integrated pre-attentively, not just summed. | Robust phenomenon (2,100+ citations; 40-year retrospective by MacDonald 2018, Multisens Res 31, confirmed as a still-active research field), but the *rate* of the effect varies strongly by language, attention, and stimulus AV timing. | Perception-level, pre-attentive; no propositional representation; effect is stimulus-tuned. | METADATA_VERIFIED | ★★ Analogous *failure mode* to avoid: when two artifact views of the same event (e.g., screenshot + its caption) disagree, Rune must not silently "fuse" them into a plausible third interpretation — that is a reconstruction bug, not perception. |
+| A1-2 | MIT Press 1993 (book); verified via its citation as ref. 1 of Stein & Stanford 2008 | The Merging of the Senses — Stein & Meredith 1993, MIT Press | multisensory (neurophysiology) | Defined the "spatial, temporal, intensity" rules of multisensory enhancement in superior colliculus neurons; cross-modal inputs combine superadditively when spatially and temporally aligned, and can *suppress* when misaligned. | The book's superadditivity emphasis was later qualified: superadditivity occurs mainly when component responses are weak (Stanford & Stein 2007, cited in Stein & Stanford 2008 refs). | Neuron-level, animal (cat/monkey) physiology. | METADATA_VERIFIED | ★★ Principle worth keeping in *informational* form: combining two artifact views helps when they are co-located/co-timed and weak individually; misaligned combination can actively hurt. |
+| A1-3 | doi:10.1038/nrn2331 | Multisensory integration: current issues from the perspective of the single neuron — Stein & Stanford 2008, Nat Rev Neurosci 9:255–266 | multisensory (neurophysiology) | Review of the computational rules: nonlinearity (superadditivity) depends on stimulus efficacy; timing windows; spatial congruence; cortex-midbrain dialogue; experience-dependence. | Notes ongoing debate about using superadditivity as the fMRI integration criterion (refs 63–64: Laurienti 2005, Beauchamp 2005 argue against it) — i.e., even the *definition* of "integration happened" is contested. | Animal physiology + human imaging, not applicable mechanistically to software. | METADATA_VERIFIED | ★ Justifies checking *alignment quality* before fusing multimodal evidence in Rune; against naive "sum the scores" fusion. |
+| A1-4 | PMID 14761661; doi:10.1016/j.cub.2004.01.029 | The ventriloquist effect results from near-optimal bimodal integration — Alais & Burr 2004, Curr Biol 14:257–262 | audio+visual (spatial) | Spatial ventriloquism is not "visual capture by fiat": localization behaves like statistically near-optimal weighting of the two cues by their reliability, generalizing Ernst & Banks to spatial tasks. | Confirms cue-combination framework across tasks, but near-optimality is approximate; deviations documented in later literature. | Psychophysics; stimulus-level estimates. | METADATA_VERIFIED | ★★ Supports "weight evidence by reliability" as the *shape* of good fusion, while transferring no neural mechanism. |
+| A1-5 | doi:10.1038/415429a; PMID 11807554 | Humans integrate visual and haptic information in a statistically optimal fashion — Ernst & Banks 2002, Nature 415:429–433 | visual+haptic (size estimation) | Canonical cue-combination result. Abstract (read verbatim): vision usually dominates visual-haptic size judgments, but the percept is affected by haptics "in some circumstances"; the authors propose a general principle that *minimizes variance in the final estimate*, realized as maximum-likelihood estimation (MLE): they first measured the variances of unisensory visual and haptic height estimation, built an MLE integrator from those measured variances, and found the model "behaved very similarly to humans in a visual–haptic task"; visual dominance is explained as the case where visual variance is lower. | None in the paper itself (model fit was the positive result). The generality across tasks/cue types is the debated part (Alais & Burr extend it; other work documents sub-optimality). | Paywalled full text (unavailable to this arm — see honesty note); abstract-level: it is a size-estimation task with 3D-rendered stimuli and explicitly *measured* noise; the optimality claim is about first-order statistics. | ABSTRACT_ONLY | ★★★ The transferable idea is *not* "Rune should run Bayes". It is: (a) fusion quality is determined by per-source reliability measured in advance; (b) "dominance" emerges from unequal reliability, not from a hardcoded modality hierarchy. In Rune: store per-derivation confidence/provenance so a later fusion step *could* weight sources; do not build a fixed "vision wins" rule. |
+| A1-6 | PMID 8346328; doi:10.1037/0033-2909.114.1.3 | Source monitoring — Johnson, Hashtroudi & Lindsay 1993, Psychol Bull 114(1):3–28 | cognitive (cross-modal memory) | Framework: people attribute memories to sources (perceived vs. imagined, internal vs. external) via *heuristic* judgment over activated features, not via an explicit tag; source errors arise when features are ambiguous or compatible with multiple sources. | The framework was built largely on *errors* (misattribution, "becoming famous overnight" paradigms); it is a framework, not a process model with quantitative fit. | Human amnesia/dementia and children studied; framework-level. | METADATA_VERIFIED | ★★★ This is the human analog of Rune's worst failure mode: an *interpretation* (LLM summary) later retrieved as if it were a *source* (file content). The human system lacks source tags; Rune must not copy that defect — source provenance should be explicit, persistent metadata, not reconstructed at retrieval. |
+| A1-7 | doi:10.1037/h0020071 | Encoding specificity and retrieval processes in episodic memory — Tulving & Thomson 1973, Psychol Rev 80(5):352–373 | verbal memory | Encoding specificity: retrieval success depends on cue–trace compatibility at encoding; includes the famous "recognition failure of recallable words" — a word can be recalled with a weak cue yet not recognized as a studied item. | Recognition failure itself was a *surprising negative* result against independent-store theories; replication debates (Thomson & Tulving 1970 vs Bahrick) are documented and were revisited by Higham 2002 (Mem Cogn 30:67–80, verified in Crossref refs) who concluded "strong cues are not necessarily weak" — boundary conditions exist. | Verbal memory; task-specific cue compatibility. | METADATA_VERIFIED | ★★ Retrieval quality in Rune is a function of query–trace compatibility *as encoded*, which argues for deriving indexes at ingestion time (matching the query distribution) rather than assuming any embedding is a universal key. |
+| A1-8 | PMID 9136640; doi:10.1037/0033-2909.121.3.331 | Toward a theory of episodic memory: the frontal lobes and autonoetic consciousness — Wheeler, Stuss & Tulving 1997, Psychol Bull 121(3):331–354 | cognitive/neuropsych | Episodic memory = a distinct system enabling mental time travel, dependent on autonoetic (self-knowing) consciousness and frontal-lobe function; supported by amnesia patterns and imaging. | Concept criticized as circular (consciousness defines the system that defines consciousness) — a criticism Tulving himself reviews later (Tulving 2002). | Neurological patient literature + PET; theory-level. | METADATA_VERIFIED | ★ Transfer FAILURE watch-item: Rune's "episodic" memory entries are just rows with timestamps; there is no autonoetic re-experience and should be no pretense of it. |
+| A1-9 | doi:10.1146/annurev.psych.53.100901.135114 | Episodic memory: From mind to brain — Tulving 2002, Annu Rev Psychol 53:1–25 | cognitive/neuro | Refines episodic memory from "materials/tasks" to "self, subjective time, autonoetic consciousness"; reviews neuropsychological (patient) and imaging support; addresses criticisms. | The author explicitly catalogs criticisms of the episodic/semantic division; the boundary between systems is acknowledged as not sharp. | Review; definitional. | ABSTRACT_ONLY | ★★ The stable, transferable core is the *what/when/what-was-it-like* decomposition of an episode — useful as the shape of Rune's event records, not of any cognitive claim. |
+| A1-10 | PMID 17338600; PMCID PMC2852534; doi:10.1037/0033-2909.133.2.273 | Event perception: a mind-brain perspective — Zacks, Speer, Swallow, Braver & Reynolds 2007, Psychol Bull 133(2):273–293 | visual+cross-modal (event understanding) | Event Segmentation Theory (EST): continuous activity is spontaneously segmented into discrete events; boundaries occur where *perceptual prediction error* transiently spikes; "event models" (what-is-happening-now) are gated, reset at boundaries; segmentation is simultaneous on multiple timescales; boundary information is preferentially encoded into long-term memory. Verified load-bearing evidence from the full text: (i) unitization (button-press marking of boundaries) is reliable within and across observers (Newtson 1976; Speer, Swallow & Zacks 2003); (ii) still frames from event boundaries are better recognized than frames from within events (Newtson & Engquist 1976); (iii) film cuts/commercials placed AT event boundaries improve recall; placed at non-boundaries they impair it (Boltz 1992; Schwan & Garsoffky 2004; Schwan et al. 2000); (iv) group-typical segmentation ability predicts later memory even controlling for dementia (Zacks, Speer, Vettel & Jacoby); (v) partial computational implementation (Reynolds, Zacks & Braver) shows boundary spikes in prediction error emerge from a prediction network without labels. | Debates noted in-paper: whether fine-grained unitization improves *recognition* (Hanson & Hirst 1991 vs Lassiter & Slaw 1991 — mixed); whether parallel segmentation of multiple activity streams occurs (explicitly an open empirical question). | Movie-watching, human, seconds-to-minutes timescales; theory's neural implementation proposals (lateral PFC, ACC) are hypotheses. | RELEVANT_SECTIONS | ★★★ Most transferable human finding in this arm: *what you can retrieve later is determined by where the boundaries were at encoding*. For Rune, event/commit/message boundaries are the natural retrieval anchors for attached screenshots, recordings, PDFs — chunk multimodal evidence by event boundaries, not by fixed token windows. Explicitly do NOT port the prediction-error *mechanism* (see rejected transfers). |
+| A1-11 | PMCID PMC3314399; doi:10.1111/j.1467-8721.2007.00480.x | Event segmentation — Zacks & Swallow 2007, Curr Dir Psychol Sci 16(2):80–84 | visual (event understanding) | Short-form statement of EST and its memory consequences for a general audience. | — | Condensed version of A10. | METADATA_VERIFIED | ★ Companion citation to A10. |
+| A1-12 | doi:10.1080/14640747308400340 | Learning 10,000 pictures — Standing 1973, Q J Exp Psychol 25(2):207–222 | visual | Abstract (verbatim via Crossref): memory capacity follows a power law in material presented; pictorial material shows overall superiority; "the capacity of recognition memory for pictures is almost limitless, when measured under appropriate conditions"; picture memory exceeds verbal memory even in verbal recall; verbal memory has higher retrieval speed. | The paper itself notes the limits are measurement conditions; the "almost limitless" phrasing is recognition-under-2AFC, not recall. | Forced-choice recognition; 10k-item scale; 1970s stimuli. | ABSTRACT_ONLY | ★★ Historical anchor for picture-superiority; also the origin of the "10,000 pictures" number that Brady et al. later corrects for *fidelity*. |
+| A1-13 | PMCID PMC2533687; PMID 18787113; doi:10.1073/pnas.0803390105 | Visual long-term memory has a massive storage capacity for object details — Brady, Konkle, Alvarez & Oliva 2008, PNAS 105(38):14325–14329 | visual | FULL PAPER READ. 14 observers viewed 2,500 isolated objects (3 s each, 5.5 h total) with an embedded repeat-detection task, then 2-alternative forced-choice tests. Accuracy: **92.5% (novel-category foil), 87.6% (same basic-level category, different exemplar), 87.2% (same object in different state/pose)**. Repeat-detection during study: 96% hits, 1.3% false alarms; ~80% correct even with 1,023 intervening items (~2 h); error vs lag fits a power law of forgetting (r²=0.98). Authors' Landauer-style estimate: 13.8 bits/item at 93% novel performance, +2.0 bits each for exemplar and state discrimination → ~17.8 bits/item, raising a lower bound from ~14,000 to ~228,000 discriminable codes. Explicit stated conclusions/caveats (from Discussion): data "cannot reveal the format of these representations" and "should not be taken to suggest observers have a photographic-like memory"; categorical distinctiveness of the stimulus set plausibly reduced interference and helped performance; it is unresolved whether the 2AFC choices reflect familiarity or recollection (but either way the stored trace must contain foil-discriminating detail); "under conditions where we attempt to encode such details, we are capable of succeeding" — i.e., encoding was optimized (instructions, distinct categories, no interference control issues). | The paper's framing is itself a *correction* of prior belief: previous large-scale studies (Shepard 1967; Standing 1973) could not distinguish gist-only storage, and change-blindness / Loftus-misinformation lines had been read as evidence that visual memory is sparse. The finding pushes back on both extremes: memory is not gist-only, and not photographic. | 2AFC recognition only (not recall); optimal-encoding regime; unknown representational format; unknown whether performance holds for scene-level or interference-rich sets; familiarity/recollection composition unresolved. | FULL_PAPER | ★★★ Two uses for Rune: (1) evidence FOR storing detailed derived indexes of visual artifacts — detailed traces are cognitively feasible and dramatically improve *recognition*-style retrieval (which is what vector search is); (2) evidence AGAINST over-reading: Rune's analog is not "store raw pixels of everything" but "maintain exemplar-level (not gist-level) indexes" — and Rune's real bottleneck is the attention/context budget, not storage, the inverse of the human situation. |
+| A1-14 | doi:10.1086/209001 | Conditions for a picture-superiority effect on consumer memory — Childers & Houston 1984, J Consumer Research 11(2):643 | verbal+visual | The picture superiority effect (better memory for pictured than verbal items) holds under specific conditions — it is conditional, not universal (conditions include encoding time and processing type). | The very title documents boundary conditions; dual-coding/picture-superiority literature contains many demonstrations of null or reversed effects depending on task (recall vs recognition), population, and stimulus meaningfulness. | Marketing/consumer context; older literature. | METADATA_VERIFIED | ★★ Explicitly cited as the anti-overgeneralization anchor: picture superiority is task/population dependent. |
+| A1-15 | doi:10.1037/h0084295 | Dual coding theory: Retrospect and current status — Paivio 1991, Can J Psychol 45(3):255–287 | verbal+visual | Dual coding theory: cognition is supported by two partly independent symbol systems (verbal, imagery); concreteness effects; additive benefits of dual codes. | Known criticisms to carry forward: boundary conditions (abstract material, expert populations), failure to fully specify imagery code format, effects shrink with meaningfulness controlled; picture superiority in humans does not license "add a second representation always helps". | Theory review; no computational implementation. | METADATA_VERIFIED | ★★ Principle to transfer *in weakened form*: paired verbal+visual traces give redundant retrieval routes (robustness), not doubled memory. |
+| A1-16 | doi:10.1111/j.2044-8295.1975.tb01468.x | Context-dependent memory in two natural environments: on land and underwater — Godden & Baddeley 1975, Br J Psychology 66(3):325–331 | verbal (auditory learning) | Abstract (verbatim via Crossref): divers learned word lists on land or underwater and recalled in either; "lists learnt underwater were best recalled underwater, and vice versa"; a second experiment showed the disruption of moving between environments was not the cause. | **Failed replication (negative result, verified):** Murre 2021, R Soc Open Sci 8:200724, replicated the four-condition design with 16 divers and found NO same-context advantage; a 2022 addendum (10.1098/rsos.211924) with corrected repeated-measures ANOVA "reinforces the conclusion that this study was not a successful replication". Eich's related mood-dependence work also reports weak/fragile effects (see §4 note). | Small-N field study; auditory recall; the classic status outstrips the replication record. | ABSTRACT_ONLY | ★★ With the replication record attached, this is a cautionary tale: do not design Rune features (e.g., "deployment-context keys") on the strength of this classic alone. Rune's context fields are explicit variables, not incidental reinstatement cues. |
+| A1-17 | doi:10.1098/rsos.200724 (+ addendum 10.1098/rsos.211924) | The Godden and Baddeley (1975) experiment on context-dependent memory on land and underwater: a replication — Murre 2021, R Soc Open Sci 8:200724 | verbal | Direct replication with 16 divers, all four land/underwater learning×recall combinations: "Contrary to the original study, we did not find that recall in the same context where the words had been learned was better than recall in the other context." | Negative result, published; addendum re-analysis strengthens it. | One replication; power considerations discussed in-paper. | ABSTRACT_ONLY | ★★ Included deliberately as a finding: a famous multimodal-context memory effect is not robust. Transfer implications of context-dependence should be treated as unproven. |
+| A1-18 | doi:10.3928/0048-5713-19951201-07 | The formation of false memories — Loftus & Pickrell 1995, Psychiatric Annals 25(12):720–725 | verbal/autobiographical ("lost in the mall") | Implanting a wholly false childhood memory (getting lost) via suggestion: a proportion of adults later elaborated the false event as real. | The paradigm is heavily debated: base rates of "false" acceptance, distinguishability from genuine-uncertain memories, demand characteristics; the strongest legal-policy claims were later moderated (see Loftus 2005 below). Original paper has only 11 references and modest sample. | Case-study scale; suggestion paradigm. | METADATA_VERIFIED | ★★★ Relevance is the *asymmetry*: human memory is reconstructive, so suggestion retroactively edits the trace. Rune's Memory is append-only with immutable source rows; the architectural answer is to never overwrite sources — corrections are new derived rows that supersede, with provenance. |
+| A1-19 | PMID 16027179; doi:10.1101/lm.94705 | Planting misinformation in the human mind: a 30-year investigation of the malleability of memory — Loftus 2005, Learn Mem 12(4):361–366 | verbal/visual | Review of the misinformation-effect literature: post-event information changes later memory reports; robust across 30 years of studies. | The literature contains the McCloskey & Zaragoza (1985) counterargument that misinformation effects can reflect response bias rather than trace impairment (cited in Loftus & Pickrell's own refs) — the *mechanism* debate is unresolved even where the phenomenon is accepted. | Review, narrative. | METADATA_VERIFIED | ★★ Supports: Rune should treat any LLM-written interpretation as capable of contaminating later reasoning about the source; keep source and interpretation as separate, differently-trusted rows. |
+| A1-20 | (within A13 full text) | Recognition vs recall asymmetry — synthesis row | — | Standing 1973 abstract: recognition superior, picture superiority holds in recognition; Tulving & Thomson 1973: recognition and recall dissociate (recognition failure of recallable words); Brady et al. 2008 Discussion: familiarity vs recollection unresolved but either way 2AFC taps stored detail. | Dissociation literature is large and partially contradictory; no single mechanism agreed. | — | RELEVANT_SECTIONS | ★★★ The asymmetry transfers almost directly: Rune's memory search IS recognition (ranked similarity against stored traces), never recall (generation from a trace). Design the memory for recognition: distinctive, foil-discriminating embeddings + FTS5 terms; do not rely on the agent "re-deriving" content from gist. |
+| A1-21 | arXiv:2103.00020 | Learning Transferable Visual Models From Natural Language Supervision (CLIP) — Radford, Kim, Hallacy, Ramesh, Goh, Agarwal, Sastry, Askell, Mishkin, Clark, Krueger, Sutskever 2021, arXiv (OpenAI) | image+text | 400M web (image,text) pairs (WIT); contrastive InfoNCE-style symmetric cross-entropy over N×N pairings in-batch; linear (not MLP) projection to joint embedding space; temperature learned, log-parameterized, clipped at 100; batch 32,768; zero-shot transfer: matches ResNet-50 on ImageNet (76.2% zero-shot, 95% top-5) with no ImageNet labels; robustness to natural distribution shift exceeds same-accuracy supervised models (ImageNet-R 88.9, ObjectNet 72.3, IN-Sketch 60.2, IN-Vid 95.3 PM0 — zero-shot beats supervised SOTA on 5 of 7 shift datasets). | **Section 6 Limitations (read verbatim):** zero-shot CLIP only on average matches a linear classifier on ResNet-50 features; weak on fine-grained classification (car models, flower species, aircraft variants); "struggles with more abstract and systematic tasks such as counting"; near-random on novel tasks like distance-to-nearest-car; poor OOD generalization (MNIST 88% — beaten by logistic regression on raw pixels; SVHN 51%); brittle to low-res/blurry digits and repeated characters; also: no mechanism for few-shot (zero→few-shot transition can *drop* performance); validation-set reuse during development ("not true zero-shot"); dataset suite "haphazardly assembled... co-adapted with development of CLIP". Appendix E: OCR strong only for digitally rendered text; image-retrieval direction weaker than text-retrieval. | Similarity = "which in-batch caption goes with this image" ranking; cosine scores are uncalibrated, class-prompt-dependent (prompt engineering worth ~5 points avg over 36 datasets). | RELEVANT_SECTIONS | ★★★ CLIP-style space is the default candidate for Rune's screenshot/derivation embeddings, but the verified limitation list maps 1:1 onto coding-agent assets: screenshots ARE rendered text (good), but fine-grained distinctions (v1 vs v2 of a UI, line-level diffs), counts, and spatial relations (§6) are exactly what code artifacts need. Do not let one CLIP vector be the *only* index for such distinctions. |
+| A1-22 | arXiv:2102.05918 | Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervision (ALIGN) — Jia, Yang, Xia, Chen, Parekh, Pham, Le, Sung, Li, Duerig 2021, ICML 2021 | image+text | 1B noisy alt-text pairs, no filtering; simple dual-encoder contrastive; SOTA image-text retrieval (Flickr30k, MSCOCO) incl. beating some cross-attention models; zero-shot classification; noisy multilingual and image+text query retrieval. | Noise-tolerant but retrieval on MS-COCO overall-SOTA not reached in zero-shot; alt-text distribution is skewed (boilerplate, SEO text) — similarity inherits alt-text semantics. | Same contrastive ranking semantics as CLIP; noisy-text training makes text side semantics broader but sloppier. | ABSTRACT_ONLY | ★★ Establishes that *scale of noisy pairs* substitutes for curation — relevant to Rune: you can build bridges from cheap derived captions of screenshots; noise is absorbed by scale, but not by 944 entries. |
+| A1-23 | arXiv:2303.15343 | Sigmoid Loss for Language Image Pre-Training (SigLIP) — Zhai, Mustafa, Kolesnikov, Beyer 2023, ICCV 2023 Oral | image+text | Replaces softmax (global view) with a pairwise sigmoid loss operating only on in-pair terms; allows batch-size decoupling; SigLiT 84.5% ImageNet zero-shot with 4 TPUv4 in 2 days; benefits of batch size saturate (~32k sufficient); enables studying examples-vs-pairs and negative:positive ratio. | Empirical engineering result; notes (from abstract) that growing batch benefits diminish quickly. No fundamental semantic change vs CLIP. | Same joint-space semantics; loss shape slightly alters score calibration; still ranking-oriented. | ABSTRACT_ONLY | ★★ Two implications: (a) modern Rune-relevant CLIP-line models (SigLIP-based, e.g., in recent VLMs) exist and differ in training dynamics from classic CLIP; (b) batch-normalization dependence means score scales are model-specific — another reason cross-model score mixing is unsafe. |
+| A1-24 | arXiv:2305.05665 | ImageBind: One Embedding Space To Bind Them All — Girdhar, El-Nouby, Liu, Singh, Alwala, Joulin, Misra 2023, CVPR 2023 (Highlighted) | image, text, audio, depth, thermal, IMU | FULL mechanism verified: six modalities, but training uses ONLY image-paired data (image-text from web; video-audio from Audioset; image-depth from SUN RGB-D; image-thermal from LLVIP; video-IMU from Ego4D); image+text encoders frozen from OpenCLIP ViT-H; each other modality gets a small ViT/Transformer encoder aligned to *image* embeddings via symmetric InfoNCE. **Emergent claims verified quantitatively:** text↔audio zero-shot ESC top-1 66.9 (vs supervised AudioCLIP 68.6, i.e., comparable but NOT above absolute SOTA 97.0); emergent audio→video retrieval R@1 only **6.8** vs 36.8 when audio+video combined; emergent zero-shot far below absolute SOTA on every benchmark (e.g., NYU-D 54.0 vs 76.7; K400 50.0 vs 89.9). Embedding arithmetic (image+audio → retrieval) works qualitatively. Emergent alignment improves as the image encoder scales (ViT-B→H: +4–7 points). | Limitations section (read verbatim): embeddings "lag the performance of specialist models" because trained without a specific downstream task; "research prototype and cannot be readily used for real world applications"; thermal data limited to outdoor street scenes, depth to indoor scenes (dataset coverage gaps propagate to the space); regression-to-CLIP objective underperforms contrastive. The "binds all modalities" claim is real but is *hub-mediated through images*, not pairwise-full-rank training. | Cross-modal similarity exists for unpaired modality combos but is weakest precisely for pairs with no co-occurrence in any single instance; distances not calibrated; audio↔text is emergent-approximate. | RELEVANT_SECTIONS | ★★★ Central architecture evidence. Even the most aggressive "one space" system (a) anchors everything to ONE hub modality (images) via frozen CLIP, (b) produces emergent cross-modal ties that are strictly weaker than direct pairing, and (c) relies on the hub being web-scale-trained. For Rune: a hub-anchored joint space is viable (hub = text/code), but emergent untrained-pair retrieval must be treated as approximate, never as ground truth. |
+| A1-25 | arXiv:2203.02053 | Mind the Gap: Understanding the Modality Gap in Multi-modal Contrastive Representation Learning — Liang, Zhang, Kwon, Yeung, Zou 2022, NeurIPS 2022 | image+text (+video, medical, protein spaces shown) | **Modality gap is real and general:** image and text embeddings occupy two separate regions of the shared space ("at arm's length"), across CLIP and other contrastive multimodal models. Verified mechanism: (1) **cone effect** — any deep-net embedding set occupies a narrow cone (mean pairwise cosine 0.56/0.47/0.51 for ResNet/ViT/text-T; <2^-512 of the 512-d hypersphere surface); this holds even with random weights (cosine 0.99 for random ResNet) and random inputs — so the gap is NOT caused by data distribution; (2) different random initializations create *different* cones (25 inits → 25 distinct cones); (3) contrastive optimization *preserves* the gap: CLIP's loss landscape at its learned temperature (1/100) has a global minimum exactly at the observed gap distance 0.82, with a repulsive structure; higher temperature closes the gap; mismatched-pair data is a forming factor. **Implications (read):** deliberately *increasing* the gap (0.82→0.97) reduced denigration bias for all races, and modified gap improves *some* zero-shot tasks — direction is task-dependent (CIFAR10 ↑, CIFAR100 ↓, EuroSAT ↓). | Authors explicitly state it is "not our goal to propose a method to close the gap, since it's not clear that it's desirable to have no modality gap." Gap-closing is not a quality metric. | **Consequence for distance meaning:** a cross-modal cosine (image-vs-text) and a within-modality cosine (text-vs-text) do NOT live on the same scale; zero cosine does not mean "unrelated"; cross-modal distance has a nonzero offset by construction. | RELEVANT_SECTIONS | ★★★ Highest-leverage ML finding for Rune: (a) never compare/mix scores across modalities without calibration; (b) "distance 0.9 across modality" ≠ "distance 0.9 within modality"; (c) the modality gap is a property of *every* dual-encoder — including future Rune text-vs-screenshot spaces — and is temperature- and initialization-dependent; (d) it is partly frozen at initialization: two encoders trained on the SAME data still separate. |
+| A1-26 | arXiv:2206.04769 | CLAP: Learning Audio Concepts From Natural Language Supervision — Elizalde, Deshmukh, Al Ismail, Wang 2022, arXiv (Microsoft) | audio+text | Dual-encoder contrastive language-audio; 128k pairs; SOTA zero-shot across 16 tasks/8 domains (sound events, music, speech); removes fixed-label constraint. | Trained with *far* fewer pairs than CLIP (128k vs 400M) — abstract-level: weaker generalization surface; audio concepts are vaguer than image captions. | Ranking semantics; scale-limited calibration. | ABSTRACT_ONLY | ★ Template for audio derivation (voice notes / meeting audio → text-keyed retrieval) if Rune ever ingests audio. |
+| A1-27 | arXiv:2211.06687 | Large-scale Contrastive Language-Audio Pretraining with Feature Fusion and Keyword-to-Caption Augmentation (LAION-CLAP) — Wu, Chen, Zhang, Hui, Nezhurina, Berg-Kirkpatrick, Dubnov 2022 (v4 2024), arXiv | audio+text | 633,526 audio-text pairs (LAION-Audio-630K); feature fusion for variable-length audio; keyword-to-caption augmentation; superior text-to-audio retrieval; SOTA zero-shot audio classification. | **Independent negative evidence on perceptual fidelity (verified):** Deng, Pardo & Pappas 2025 (arXiv:2510.14249, abstract read) evaluate MS-CLAP/LAION-CLAP/MuQ-MuLan: "the overall strength of this alignment remains limited, suggesting that current joint language-audio embeddings capture perceptual timbre semantics only partially." | Ranking semantics; timbre-level detail demonstrably under-encoded. | ABSTRACT_ONLY | ★★ Same lesson as CLIP §6: coarse semantics yes, fine perceptual structure no — for Rune, do not expect fine-grained distinctions (e.g., two similar error beeps, two similar UI chimes) from a joint space. |
+| A1-28 | arXiv:2004.12832 | ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT — Khattab & Zaharia 2020, SIGIR 2020 | text (multi-vector) | Late interaction: encode query and document *independently* into per-token vectors; score via cheap fine-grained interaction (MaxSim) at query time; offline-precomputable document vectors → ANN-indexable end-to-end retrieval; competitive with cross-encoder BERT ranking at 2 orders of magnitude less latency, 4 orders fewer FLOPs. | Storage cost of multi-vector (the known trade-off, acknowledged in paper's efficiency analysis); interaction is hand-designed (MaxSim), not learned. | Similarity = max over token-pair dot products: NOT a single calibrated score; supports phrase-level and exact-match structure that single-vector models blur. | ABSTRACT_ONLY | ★★★ Grounds the ColPali line (arm 2): late interaction is the middle path between "one vector per artifact" and "re-run the model per query" — for Rune, per-patch/per-region multi-vector screenshots preserve layout detail that a single CLIP vector provably loses (B1 §6). |
+| A1-29 | arXiv:2407.01449 | ColPali: Efficient Document Retrieval with Vision Language Models — Faysse, Sibille, Wu, Omrani, Viaud, Hudelot, Colombo 2024, ICLR 2025 | page-image+text (multi-vector) | Documents are visually rich; text-extraction pipelines are "lengthy and brittle" and miss visual cues (figures, layout, fonts); embed page *images* directly with a VLM producing multi-vector embeddings + late interaction; outperforms modern document-retrieval pipelines on ViDoRe; simpler and end-to-end trainable. | Abstract-level only (arm 2 owns deep read); multi-vector storage and VLM cost are the acknowledged trade-offs. | Late-interaction scores; image-side vectors; per-page. | ABSTRACT_ONLY | ★★ Directly relevant to Rune's PDF flattening problem: Rune currently destroys layout at ingestion; ColPali evidence says page-image indexing beats text-extracted indexing for visually rich docs — arm 2 decides. |
+| A1-30 | arXiv:2109.14084 | VideoCLIP: Contrastive Pre-training for Zero-shot Video-Text Understanding — Xu, Ghosh, Huang, Okhonko, Aghajanyan, Metze, Zettlemoyer, Feichtenhofer 2021, EMNLP 2021 | video+text | Contrastive pretraining over temporally overlapping video-text pairs with hard negatives from nearest neighbors; zero-shot SOTA on retrieval, VideoQA, action localization/segmentation. | Zero-shot, label-free — but built on temporally overlapping positives only (short windows); long-video/long-description gap documented by successors (VideoCLIP-XL 2024: pretraining "on brief summary texts... prevents CLIP from understanding long descriptions", verified abstract). | Ranking semantics; temporal alignment coarse. | ABSTRACT_ONLY | ★★ Evidence that video→frame/sentence compression loses temporal and long-description structure. NOTE: the ID 2106.01844 sometimes circulated for VideoCLIP is WRONG (it is a magnetism paper) — caught in verification. |
+| A1-31 | arXiv:2212.03191 | InternVideo: General Video Foundation Models via Generative and Discriminative Learning — Wang, Li, Li, He, Huang, et al. 2022, arXiv technical report | video+text | SOTA video foundation model by *combining* masked video modeling (generative) and video-language contrastive (discriminative) with learnable coordination; 91.1% K400, 77.2% SSv2; SOTA on 39 video datasets. | The architecture itself is the admission: video-language contrastive ALONE is insufficient for temporal understanding — temporal supervision must come from masked video modeling. | Dual-objective; video tokens. | ABSTRACT_ONLY | ★★ Confirms: what is lost when video becomes frames or text is the temporal axis, and it is not recoverable from frame-level contrastive embeddings alone. |
+| A1-32 | (evidence cluster: B1 Tables 19–20 + B5 §2.3/§4.4) | Model-version comparability of embeddings — synthesis row | all | Direct verified evidence that embeddings from different CLIP versions are NOT comparable: (1) CLIP's own hyperparameter tables (read in full): embedding dimension differs by version — RN50: 1024-d, RN101: 512-d, ViT-B/32: 512-d, ViT-L/14: 768-d — vectors are not even dimension-compatible across versions; (2) Liang et al.: the cone orientation is determined by *random initialization*, so two independently initialized encoders (even same architecture, same data) produce systematically different geometries; CLIP-vs-OpenCLIP initialization in ImageBind (B4) required frozen-image-anchor training precisely because the spaces differ. | No dedicated public benchmark of cross-version embedding interoperability was found in this arm's searches; the dimension + initialization evidence is strong but the *practical degradation curve* (how bad is score-mixing?) is not quantified by any verified source here. | Mixed-version similarity is undefined/unanchored. | RELEVANT_SECTIONS | ★★★ URGENT for Rune: current sqlite-vec embeddings record NO model/version. Since different initializations and dimensions make vectors incomparable, Rune cannot safely re-embed partially, upgrade models, or mix old and new vectors. The atlas design must stamp (model_id, model_version, space_id) per embedding row and rebuild the index wholesale on model change. |
+
+## Arm 2 — rows A2-1…A2-31
+
+| source_id | identifier / locator | Title — authors, year, venue | Modality / task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A2-1 | arXiv:2407.01449 | ColPali: Efficient Document Retrieval with Vision Language Models — Faysse, Sibille, Wu, Omrani, Viaud, Hudelot, Colombo — 2024, ICLR 2025 | Page-image → multi-vector retrieval (late interaction over PaliGemma-3B token embeddings, D=128) | (1) ViDoRe benchmark (10 tasks, page-level); (2) ColPali avg **81.3 nDCG@5** vs best OCR-pipeline baseline (Unstructured+OCR BM25 **65.5**, Unstructured+Captioning BGE-M3 **67.0**) — ~+14–16 pts; (3) biggest gains exactly where text extraction loses signal: ArxivQ (figures) 79.1 vs OCR 31.6, InfoQ (infographics) 81.8 vs 62.9, TabFQuAD (tables) 83.9 vs 70.8 (BGE-M3+OCR), Shift (charts, French, zero-shot) 73.2 vs 64.3; (4) **ColQwen2 (768) ablation in v6: 86.6 avg** vs ColPali 81.3; (5) query latency ≤22 ms on L4; ingestion much faster/simpler than parser+OCR+caption pipelines | (a) On **text-dominant** financial pages (TAT-DQA) the gap nearly vanishes: OCR 62.7 vs ColPali 65.8 (+3.1); (b) BiPali (fine-tuned bi-encoder) sometimes *hurts* vs plain SigLIP (Energy −11.7); (c) ColSigLIP variants collapsed (~3.2 avg) — training instability of naive late-interaction variants; (d) low-res input destroys it: ColPali at 224px = 56.5 avg vs 81.3 at 448px | Trained/evaluated on page-level QA-style queries, not agentic exact-match queries; multi-vector store is ~1030 vectors/page at 448px (heavier than single-vector); needs GPU for indexing; benchmark queries are VLM-generated (Claude-3 Sonnet) for practical tasks | RELEVANT_SECTIONS | **Anchor for the whole arm.** Directly quantifies what Rune's flatten-to-text PDF ingestion loses (figures/tables/layout: +10 to +48 nDCG). Also shows OCR-first is *fine* on text-dense pages — the verdict is conditional, not absolute. ColQwen2 result shows **model/version shifts scores by >5 points** → Rune's unversioned embeddings are unreproducible |
+| A2-2 | arXiv:2406.11251 | Unifying Multimodal Retrieval via Document Screenshot Embedding (DSE) — Ma, Lin, Li, Chen, Lin — 2024, EMNLP 2024 main | Single-vector screenshot embedding (EVA-CLIP + LLM layer, 1.3M Wiki-SS corpus) | Screenshot-as-unified-input removes parsing entirely; Wiki-SS (text-intensive): **+17 pts top-1 over BM25**; mixed-modality slide retrieval: **+15 nDCG@10 over OCR-text retrieval** | On text-intensive Wikipedia pages DSE is only "competitive" with text retrieval — visual embeddings do not beat strong text retrieval when the page is prose | Single-vector (loses fine-grained layout matching vs late interaction); Wiki-SS is web screenshots, not scanned PDFs | ABSTRACT_ONLY | Second independent confirmation of the OCR-first loss number on slides (+15) and the "text-only pages ≈ parity" boundary |
+| A2-3 | arXiv:2410.10594 | VisRAG: Vision-based Retrieval-augmented Generation on Multi-modality Documents — Yu, Tang, Xu, Cui, Ran, Yan, Liu, Wang, Han, Liu, Sun — 2024/2025, Tsinghua | VLM-based RAG: embed page images → retrieve → feed image to VLM generator | **20–40% end-to-end gain over text-based RAG** on multi-modality docs; eliminates parsing information loss; strong generalization from limited training data | (implicit) gains concentrate on visually rich docs; text RAG remains competitive on plain text | End-to-end gain bundles retrieval *and* generation improvements; generator is a VLM (GPU-heavy) | ABSTRACT_ONLY | Quantifies the retrieval-loss → answer-quality pipeline effect Rune's flattening causes |
+| A2-4 | arXiv:2411.04952 | M3DocRAG: Multi-modal Retrieval is What You Need for Multi-page Multi-document Understanding — Cho, Mahata, Irsoy, He, Bansal — 2024 (UNC/IBM) | Open-domain multi-page DocVQA: ColPali retrieval + Qwen2-VL 7B generation | Works open-domain over **3,000+ PDFs / 40,000+ pages** (M3DocVQA benchmark); SOTA on MP-DocVQA; handles multi-hop and image-only evidence; comprehensive ablations of indexing/models/retrievers | Existing DocVQA methods fail when evidence is in figures or spread across pages (motivating result) | Indexing ablations show choices matter; generation still needs a 7B VLM | ABSTRACT_ONLY | Evidence that ColPali-style page retrieval **scales beyond toy corpora** to ~40k pages — far past Rune's needs, so scale is no objection |
+| A2-5 | arXiv:2504.08748 | A Survey of Multimodal Retrieval-Augmented Generation — Mei, Mo, Yang, Chen — 2025 | Survey: MRAG components, datasets, evaluation, limitations | MRAG reduces hallucination and outperforms text-only RAG when visual+textual understanding is required; systematizes retriever/generator/fusion taxonomy | Identifies open problems: modality alignment, evaluation gaps | Survey-level, no new measurements | ABSTRACT_ONLY | Map of the field for the Atlas; confirms visual-RAG is an established 2024–26 line, not a fad |
+| A2-6 | arXiv:2210.02928 | MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Text — Chen, Hu, Chen, Verga, Cohen — 2022, EMNLP 2022 | One transformer accessing an external **non-parametric multimodal memory** (text + images) via frozen retrievers | First multimodal retrieval-augmented transformer; **+10–20% absolute** over existing models on WebQA and MultimodalQA under distractor and full-wiki settings | — | Pre-LLM-era (T5/FLAN-size generator); retrieval over web QA corpora | ABSTRACT_ONLY | The "multimodal external memory" concept Rune's Memory would extend; evidence that mixed-modality retrieval into a generator works with a frozen retriever |
+| A2-7 | arXiv:2311.17136 | UniIR: Training and Benchmarking Universal Multimodal Information Retrievers — Wei, Chen, Chen, Hu, Zhang, Fu, Ritter, Chen — 2023 | Instruction-guided universal multimodal retriever; M-BEIR benchmark (8 tasks, 10 datasets) | Multi-task training + instruction tuning give zero-shot generalization to new retrieval tasks; single model covers text→image, image→text, etc. | Single-task models beat the universal one per-task (universal ≠ best specialist) | CLIP-style dual-encoder granularity; coarse page/region level | ABSTRACT_ONLY | If Rune ever indexes screenshots + audio + text in one index, instruction-guided universal retrieval is the pattern; but per-lane specialists remain stronger at small n |
+| A2-8 | arXiv:2608.07006 | Does More Retrieved Evidence Help Visual RAG with Diffusion Language Models? — Wang, Gao, Zhang, Fu, Bai, Gao — 2026 | Evidence-admission for visual RAG | Retrieving more pages raises answer-page **recall** but unconditionally passing them to the generator **reduces accuracy** (semantic conflict between visual sources); entropy-based candidate filter (ECF) recovers +2.62 pts over best fixed top-k | **Negative result: more visual context ≠ better answers** | Diffusion-LM-specific mechanism (ECF) | ABSTRACT_ONLY | Directly supports Rune's sufficiency-gated abstention / selective-context design in the multimodal case: admission control survives modality change |
+| A2-9 | arXiv:2007.00398 | DocVQA: A Dataset for VQA on Document Images — Mathew, Karatzas, Jawahar — 2020, WACV 2021 | 50k questions on 12k+ document images | Baseline VQA/reading-comprehension models show a large gap to human 94.36%; models specifically fail where **document structure understanding is crucial** | Models "perform reasonably" only on questions not requiring structure | Pre-VLM baselines; dataset paper | ABSTRACT_ONLY | The 2020 root evidence that structure (layout) is load-bearing for document QA — the thing flattening destroys |
+| A2-10 | arXiv:2204.08387 | LayoutLMv3: Pre-training for Document AI with Unified Text and Image Masking — Huang, Lv, Cui, Lu, Wei — 2022, ACM MM | Text+layout+image pre-training for Document AI (forms, receipts, DocVQA, layout analysis) | Unified masking + word-patch alignment gives SOTA on text-centric AND image-centric doc tasks | — | Requires OCR+layout input upstream (it is a *consumer* of OCR output, not a replacement); encoder, not retriever | ABSTRACT_ONLY | LayoutLM family (v1 1912.13318 → v3) is the OCR-era answer to structure: it still needs the parser pipeline ColPali removes; useful as the "OCR-first + layout model" compromise lane |
+| A2-11 | arXiv:2004.12832 | ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERT — Khattab, Zaharia — 2020, SIGIR | Token-level multi-vector passage retrieval | Late interaction ≈ BERT cross-encoder effectiveness with 2 orders-of-magnitude faster queries and 4 orders fewer FLOPs; supports end-to-end vector-index retrieval | — | Multi-vector space cost (pre-v2) | ABSTRACT_ONLY | The architectural license for ColPali; also supports Rune rerank-by-MaxSim at small n |
+| A2-12 | arXiv:2112.01488 | ColBERTv2: Effective and Efficient Retrieval via Lightweight Late Interaction — Santhanam, Khattab, Saad-Falcon, Potts, Zaharia — 2021/2022, NAACL | Compressed multi-vector (residual) retrieval | SOTA in- and out-of-domain at the time; **6–10× space reduction** makes multi-vector storage tractable | — | Residual-compression index complexity | ABSTRACT_ONLY | Storage objection to multi-vector at Rune scale is small (944 pages ≈ ~1M vectors even uncompressed — trivial for a workstation) |
+| A2-13 | arXiv:2212.04356 | Robust Speech Recognition via Large-Scale Weak Supervision (Whisper) — Radford, Kim, Xu, Brockman, McLeavey, Sutskever — 2022 | ASR: 680k h weakly supervised, seq2seq, timestamps at 20 ms quantization | Zero-shot robustness: avg **12.8 WER** (large-v2) vs wav2vec-2.0 29.3 on 12 datasets (**55.2% relative error reduction**); approaches human robustness; long-form WER: TED-LIUM3 3.5, Earnings-22 12.6, CORAAL 19.6 | Long-form failure modes are **non-perceptual**: repeat loops, dropped first/last words of a window, "complete hallucination where the model will output a transcript entirely unrelated to the actual audio" (§6); decoding heuristics (beam+temperature fallback, no-speech prob 0.6 + avg logprob −1.0, initial-timestamp constraint) are explicitly "a workaround for the noisy predictions" (§4.5); WER normalization itself can shift scores up to ~50% | Timestamp quantization 20 ms; 30-s window design → segmentation is external to the model; no speaker diarization (explicitly listed as external pipeline component, §2.3) | RELEVANT_SECTIONS | **Anchor.** Timestamped transcripts are the natural retrieval substrate for audio, BUT the documented hallucination/repeat-loop modes mean Rune must segment with VAD and keep non-speech probabilities — a bare 30-s window transcript is unsafe to index |
+| A2-14 | arXiv:2303.00747 | WhisperX: Time-Accurate Speech Transcription of Long-Form Audio — Bain, Huh, Han, Zisserman — 2023, INTERSPEECH | Long-form ASR + word-level timestamps via VAD + forced alignment | Buffered/sliding-window Whisper "prone to drifting, hallucination & repetition"; VAD Cut&Merge improves transcription quality AND enables **12× batched speedup**; SOTA long-form + word segmentation benchmarks | Confirms Whisper's native long-form decoding degrades without segmentation | Alignment model needed for word timestamps | ABSTRACT_ONLY | The engineering answer for Rune: **VAD-segmented, timestamped** transcript chunks are the retrieval unit, not raw windows |
+| A2-15 | arXiv:2402.08021 | Careless Whisper: Speech-to-Text Hallucination Harms — Koenecke, Choi, Mei, Schellmann, Sloane — 2024, FAccT (DOI 10.1145/3630106.3658996) | Hallucination audit of Whisper | **~1% of transcriptions contain entirely hallucinated phrases/sentences** absent from the audio; **38% of hallucinations include explicit harms** (violence, false authority); hallucinations disproportionately hit speakers with longer non-vocal durations (aphasia) | Direct negative: fluent-but-false transcripts at ~1% base rate even in ordinary use | English-language study; transcription-service framing | ABSTRACT_ONLY | For a memory system, a 1% hallucination rate compounds silently; retrieved transcript evidence needs provenance (timestamp + audio pointer) so hallucinated text can be checked against audio |
+| A2-16 | arXiv:2505.12969 | Calm-Whisper: Reduce Whisper Hallucination On Non-Speech By Calming Crazy Heads Down — Wang, Alhmoud, Alsahly, Alqurishi, Ravanelli — 2025, Interspeech | Hallucination attribution + fix | **3 of 20 decoder heads account for >75% of non-speech hallucinations** (UrbanSound); fine-tuning them cuts non-speech hallucination >80% with <0.1% WER cost on LibriSpeech | Confirms hallucination is a systematic decoder pathology, not random noise | Fine-tuning-based fix | ABSTRACT_ONLY | Even patched, non-speech handling needs VAD; if Rune records meetings/music-adjacent audio this is the relevant failure class |
+| A2-17 | arXiv:2606.07473 | Whisper Hallucination Detection and Mitigation via Hidden Representation Steering and Sparse AutoEncoders — Aparin, Popov, Sadekova, Yermekova — 2026 | Hallucination detection/mitigation in activation space | Hallucination is linearly separable in Whisper encoder activations; SAE steering cuts non-speech hallucination **72.63% → 14.11% (small)** and **86.88% → 27.33% (large-v3)** on full non-speech test sets, with small speech WER cost | Establishes baseline non-speech hallucination rates are **~73–87%** on non-speech audio — worst-case audio is unusable unmitigated | Research code, not production | ABSTRACT_ONLY | The hard-audio negative result: on non-speech input Whisper hallucinates most of the time; VAD gating before ASR is mandatory, not optional |
+| A2-18 | arXiv:2504.05702 | Evaluating Speech-to-Text Systems with PennSound — Wright, Liberman, Ryant, Fiumara — 2025 | Benchmark of AWS/Azure/Google/IBM/NeMo/Rev.ai/Whisper/Whisper.cpp on ~10 h varied poetry recordings | Rev.ai best WER; **Whisper best open-source "as long as hallucinations were avoided"**; AWS best DER; WER/DER differences slim; runtime options (speed vs accuracy) materially change outcomes | Whisper's ranking is conditional on hallucination avoidance — an operational caveat, not a footnote | Poetry recordings = hard-accent/noisy speech; small sample (10 h) | ABSTRACT_ONLY | Independent confirmation on genuinely hard audio that open Whisper is usable but hallucination-guarded |
+| A2-19 | arXiv:1911.01255 | pyannote.audio: neural building blocks for speaker diarization — Bredin et al. — 2019, ICASSP 2020 | Speaker diarization toolkit: VAD, speaker change detection, overlapped-speech detection, speaker embeddings | Pre-trained models reach SOTA on most of these subtasks; pipelines are composable/jointly optimizable | — | Diarization ≠ identification; DER on overlap remains hard | ABSTRACT_ONLY | Diarization supplies **speaker labels** on timestamped transcripts — a metadata lane, not a semantic lane |
+| A2-20 | docs.pyannote.ai | pyannoteAI platform docs (speaker diarization) — pyannote — current (fetched 2026) | Diarization API: "who spoke when" and "who is speaking" via voiceprints | Diarization is positioned as foundation for transcription accuracy, speaker-specific logic, downstream analytics | — | Vendor docs; API service framing | DOCUMENTATION_AUDITED | Confirms diarization's role is **metadata enrichment** (speaker turns) of the transcript substrate — Rune gets most value from timestamps + speaker turns, not from embedding raw audio |
+| A2-21 | arXiv:2107.09609 | QVHighlights: Detecting Moments and Highlights in Videos via Natural Language Queries (Moment-DETR) — Lei, Berg, Bansal — 2021, NeurIPS | Temporal sentence localization / moment retrieval (NOTE: correct ID; the ID often quoted for this paper, 2108.09968, is a mis-pairing) | 10k+ YouTube videos with NL queries + moment spans + saliency; Moment-DETR casts moment retrieval as direct **set prediction** (DETR-style), no human priors; ASR-caption weak pretraining substantially improves results | Strong supervised "well-engineered" baselines competitive without priors; benchmark shows localization is far from solved | Depends on extracted video features + ASR captions (i.e., text substrate again) | ABSTRACT_ONLY | Moment retrieval = the query interface for "when did X happen in the recording"; its dependence on ASR captions reinforces transcripts-as-substrate |
+| A2-22 | arXiv:2403.15377 | InternVideo2: Scaling Foundation Models for Multimodal Video Understanding — Wang, Li, Li, et al. — 2024, ECCV 2024 | Video foundation model (masked video modeling + contrastive + next-token; up to 6B) | SOTA on 60+ video/audio tasks incl. long-video dialogue; **semantically segmenting videos and generating video-audio-speech captions** improves video-text alignment | — | 6B model — not workstation-deployable at full size | ABSTRACT_ONLY | Two lessons: (1) segmentation-then-caption (hierarchical) beats dense frame indexing; (2) the deployable derivative of this line for Rune is caption/ASR extraction, not the foundation model |
+| A2-23 | arXiv:2109.14084 | VideoCLIP: Contrastive Pre-training for Zero-shot Video-Text Understanding — Xu, Ghosh, Huang, Okhonko, Aghajanyan, Metze, Zettlemoyer, Feichtenhofer — 2021, EMNLP | Zero-shot video-text retrieval/QA/localization | Contrastive video-text pretraining with hard negatives from NN retrieval; zero-shot SOTA on retrieval, VideoQA, action localization/segmentation; sometimes beats supervised | — | Clip-level granularity; short clips (temporal overlap as positives) | ABSTRACT_ONLY | Clip-level dense semantic indexing is feasible zero-shot, but per-frame indexing is neither done nor needed anywhere in this line — clip/shot granularity is the norm (see §2 synthesis) |
+| A2-24 | arXiv:2508.09736 | Seeing, Listening, Remembering, and Reasoning: A Multimodal Agent with Long-Term Memory (M3-Agent) — Long, He, Ye, Pan, Lin, Li, Zhao, Li — 2025 | Multimodal agent memory: real-time visual+auditory input → entity-centric episodic+semantic memory; multi-turn retrieval+reasoning; M3-Bench (100 robot videos + 920 web videos, long-video QA) | Entity-centric **multimodal** memory organization beats prompting-agent baseline (Gemini-1.5-pro + GPT-4o) by **+6.7 / +7.7 / +5.3 points** on M3-Bench-robot / -web / VideoMME-long; RL training on memory-based reasoning | Strong prompting baselines already close — the memory-organization delta is real but single-digit | Video QA domain, not code-agent domain; benchmark small (100 robot videos) | ABSTRACT_ONLY | The closest published analogue to "Rune with eyes and ears": memory entries organized around **entities with multimodal bindings**, retrieved by multi-turn reasoning — a pattern transferable to Rune's entry schema (modality-specific payload + shared entity keys) |
+| A2-25 | DOI 10.1109/icdar.2007.4376991 | An Overview of the Tesseract OCR Engine — R. Smith — 2007, ICDAR (Crossref-verified; 1517 citations) | OCR engine architecture | Tesseract's two-pass approach (character-level + language-model pass with fuzzy space resolution) became the open-source standard; its layout analysis was designed for *printed prose pages* | — | Pre-LSTM (Tesseract 4/5 changed the engine); 2007 | METADATA_VERIFIED | Origin paper of the OCR engine Rune would use OCR-first; its own design scope (prose pages) is the boundary of where OCR-first works |
+| A2-26 | tesseract-ocr.github.io/tessdoc (User Manual + ImproveQuality) | Tesseract 5.x documentation — Tesseract maintainers — current | OCR operating envelope | Best at **≥300 DPI**; internal Otsu binarization "can be suboptimal, particularly if the page background is of uneven darkness"; skew "reduces line segmentation significantly"; **"It is known tesseract has a problem to recognize text/data from tables … without custom segmentation/layout analysis"**; PSM modes exist because default whole-page segmentation fails on sparse/non-prose layouts; dictionaries hurt non-prose text (codes, receipts) unless disabled | The docs themselves enumerate the failure classes: low DPI, uneven background, skew, tables, non-dictionary text, missing/oversized borders, transparency | Documentation, not benchmark numbers | DOCUMENTATION_AUDITED | Vendor-acknowledged failure classes map 1:1 onto the page types ColPali wins on (tables, infographics, layout-heavy) — OCR reliability is the *mechanism* behind the OCR-first loss |
+| A2-27 | arXiv:2409.01704 | General OCR Theory: Towards OCR-2.0 via a Unified End-to-end Model (GOT-OCR2.0) — Wei et al. — 2024 | Unified OCR for "all artificial optical signals": text, **math/molecular formulas, tables, charts, sheet music**, geometric shapes; 580M params | One end-to-end model outputs plain **or formatted** (markdown/tikz/smiles) results; region-level recognition guided by coordinates/colors; multi-page + dynamic resolution | Frames OCR-1.0 (incl. Tesseract-class tools) as "increasingly unable to meet usage" for non-plain-text signals | Small model — capability below frontier VLMs; no retrieval evaluation | ABSTRACT_ONLY | If Rune keeps an OCR lane, "OCR-2.0" models are the upgrade path that recovers math/table structure *as text* — a middle option between flattening and page-image retrieval |
+| A2-28 | arXiv:2011.05402 | OCR Post Correction for Endangered Language Texts — Rijhwani, Anastasopoulos, Neubig — 2020, EMNLP | OCR post-correction, data-scarce scripts | General-purpose OCR tools "are not robust" in data-scarce settings; tailored post-correction cuts recognition error **34%** on average across three languages | General OCR outright fails on low-resource scripts | Niche domain (endangered languages) | ABSTRACT_ONLY | Bounded evidence that OCR errors are systematic and domain-dependent → OCR output quality must be measured per Rune's actual document population, not assumed |
+| A2-29 | arXiv:2106.06831 | Toward the Optimized Crowdsourcing Strategy for OCR Post-Correction — Suissa, Elmalech, Zhitomirsky-Geffet — 2021/2020, Aslib J. of Information Management | Human/crowd correction of OCR in historical collections | 753-worker experiments: accuracy best with **paragraph-size units, two-phase, image shown next to text**; efficiency best with longer text, single-stage, no image; first systematic study of crowd OCR-correction strategy | Accuracy and efficiency optima **conflict** (image+two-phase accurate; no-image+single-stage efficient) | Historical documents; crowd settings, not agent settings | ABSTRACT_ONLY | **Closest found work to "user-corrected OCR propagation"**: humans correct OCR best when shown the source image alongside text — evidence FOR storing the page image alongside extracted text in Rune, so corrections (human or model) can be validated against the source. No work found on *propagating* user corrections through a retrieval index (→ gap, §4) |
+| A2-30 | ResourceSpace knowledge base (metadata configuration, indexing-metadata, field types) | ResourceSpace DAM docs — Montala Ltd. — current | Production digital-asset-management pattern: metadata-first media search | Fields must be explicitly **indexed** to be searchable; **required-at-upload** metadata guarantees searchability; controlled vocabularies/category trees vs free text; separate "extracted text" channel exists *alongside* curated metadata | — | Vendor docs, single product | DOCUMENTATION_AUDITED | Production media systems ship exactly the hybrid Rune already has: **exact/structured metadata lookup coexisting with free-text/semantic search over extracted content**; the modality of the asset (image/audio/video) never replaces the metadata lane |
+| A2-31 | pyannote.audio + docs (see §1c) | — — — | — | — | — | — | UNVERIFIED | (Counted once in §1c) |
+
+## Arm 3 — rows A3-1…A3-45
+
+| source_id | identifier / locator | Title — authors, year, venue | Modality / task | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A3-1 | arXiv:2305.10355 | Evaluating Object Hallucination in Large Vision-Language Models (POPE) — Li, Du, Zhou, Wang, Zhao, Wen — 2023, EMNLP 2023 | Image captioning / VQA hallucination measurement | First systematic object-hallucination study of LVLMs. (1) CHAIR: LLaVA CHAIR_S **32.7** vs small VLPM OSCAR-base **13.0** — instruction-tuned LVLMs hallucinate MORE than smaller models; LLM-generated visual instruction data is a root cause (models hallucinate objects frequent or co-occurring in the instruction corpus: HR_A@10 ≈ 0.5, HR_C@10 ≈ 0.6 of hallucinated objects are top-10 frequent/co-occurring). (2) POPE converts evaluation to binary Yes/No polling with Random/Popular/Adversarial negative sampling; more stable than CHAIR (F1 std **±0.78** vs CHAIR_I **±3.22** across 4 prompt templates). (3) Three of five models (LLaVA, MultiModal-GPT, mPLUG-Owl) answer "Yes" ~**96–100%** of the time — F1 66.7–68.7 (Random) degrading to ~66–67 (Adversarial); InstructBLIP best (F1 89.3 → 78.5 Adversarial). Yes-response rate drops adversarially (InstructBLIP 55%→69% Yes) showing benchmark sensitivity | (a) CHAIR scores **double** between two semantically equivalent prompts (LLaVA 32.7→62.7) — caption-based hallucination measurement is instruction-unstable; (b) hallucination degree is **not** consistent with VQA performance (MiniGPT-4 better POPE F1 than LLaVA but much worse VQA) — fixing hallucination ≠ fixing capability; (c) SEEM-based (auto-segmented) POPE is harder than annotation-based (F1 71.4 vs 62.7) — measurement itself is pipeline-sensitive | Authors list: only object-level (not attributes/counts/positions); small image sample (500 imgs × 6 questions); matching-based Yes/No parsing can misfire; small model set, no closed models at time | FULL_PAPER | **Anchor for hallucination measurement.** If Rune ever captions/screenshots into memory, expect language-prior-driven false objects at high rates in unmitigated models; a polling-style verification (binary probe of stored claims against the image) is the validated cheap check pattern; never trust caption-derived entities without a probe |
+| A3-2 | arXiv:1809.02156 | Object Hallucination in Image Captioning — Rohrbach, Hendricks, Burns, Darrell, Saenko — 2018, EMNLP 2018 | Image captioning hallucination metric (CHAIR origin) | Introduces CHAIR (CHAIR_I instance-level, CHAIR_S sentence-level) using veridical ground-truth labels on MSCOCO; finds models scoring best on standard sentence metrics do **not** have lower hallucination; hallucination is largely **language-prior driven** (co-occurrence statistics), not visual misclassification | Best-bleu-scored models hallucinate more — standard metrics reward hallucination | Pre-LLM models (show-and-tell era); object-level only | ABSTRACT_ONLY | Metric lineage confirmed; the "language prior beats perception" mechanism is the durable finding that persists into LVLMs (per POPE's HR@k analysis) |
+| A3-3 | arXiv:2404.18930 | Hallucination of Multimodal Large Language Models: A Survey — Bai, Wang, Xiao, He, Han, Zhang, Shou — 2024/2025 | Survey of MLLM hallucination causes/benchmarks/mitigations | Systematizes hallucination in MLLMs: causes span training data, vision encoder, alignment module; catalogues benchmarks and mitigation families (instruction tuning, RLHF, decoding interventions, post-hoc correction) | Notes detection/mitigation remains open; benchmarks disagree | Survey; no new measurements | ABSTRACT_ONLY | Map of the mitigation families; confirms 2024–26 the field treats hallucination as unsolved-but-measurable, i.e., Rune must design for residual hallucination, not zero |
+| A3-4 | arXiv:2309.14525 | Aligning Large Multimodal Models with Factually Augmented RLHF (LLaVA-RLHF) — Sun, Shen, Cao, Liu, et al. — 2023 | Hallucination mitigation via RLHF + factual reward augmentation | RLHF with a factually-augmented reward (captions, ground-truth options) reduces hallucination and reward hacking; +60% on their MMHAL-BENCH over baselines; first RLHF-trained LMM | — | Reward model still learns from human/LLM labels; benchmark self-defined | ABSTRACT_ONLY | Evidence that grounding-informed rewards help; but training-side fixes are unavailable to Rune (it consumes models, doesn't train them) — Rune's mitigation must be at ingestion/retrieval boundaries |
+| A3-5 | arXiv:2310.16045 | Woodpecker: Hallucination Correction for Multimodal Large Language Models — Yin, Fu, Zhao, Xu, Wang, Sui, Shen, Li, Sun, Chen — 2023, Science China Information Sciences 2024 | Training-free post-hoc hallucination correction | Five-stage verifier pipeline (concept extraction → question formulation → visual validation → claim generation → correction); **+30.66% / +24.33% POPE accuracy** over MiniGPT-4 / mPLUG-Owl baselines with no retraining | Confirms mitigation without retraining is possible but multi-stage (costly) | Relies on the same model family for self-verification; benchmark = POPE (binary objects) | ABSTRACT_ONLY | The verifier/grounding pattern with measured gains; Rune-scale adaptation: probing claims against the source image at write-time is the evidence-backed cheap version |
+| A3-6 | arXiv:2406.18521 | CharXiv: Charting Gaps in Realistic Chart Understanding in Multimodal LLMs — Wang, Xia, He, Chen, Liu, Zhu, Liang, Wu, Liu, Liu, Malladi, Chevalier, Arora, Chen — 2024, Princeton | Chart QA benchmark on 2,323 real arXiv-paper charts | On realistic charts the strongest proprietary model (GPT-4o) reaches only **47.1%** on reasoning questions and strongest open model 29.2% vs **human 80.5%**; a light stress-test (slightly different charts/questions) degrades performance by up to **34.5%** — template benchmarks were over-optimistic | (a) Open models that *appear* to beat proprietary ones on template benchmarks collapse under stress; (b) all models far below humans on genuine chart reasoning | Descriptive vs reasoning question split; 2024 model set | ABSTRACT_ONLY | Chart misreading is severe at realistic difficulty. If Rune indexes charts/screenshots of dashboards, chart-derived numeric claims are the highest-risk memory content; prefer storing the underlying data/series text over chart descriptions |
+| A3-7 | arXiv:2203.10244 | ChartQA: A Benchmark for Question Answering about Charts with Visual and Logical Reasoning — Masry, Long, Tan, Joty, Hoque — 2022, ACL Findings | Chart QA (human + generated questions, 9.6k human questions) | Established that chart QA needs visual AND logical reasoning; 2022-era models showed a large gap on complex reasoning questions | Baselines weak on multi-step arithmetic over chart features | Pre-VLM baselines | ABSTRACT_ONLY | Root evidence for the chart-claims-are-risky rule; superseded in difficulty by CharXiv |
+| A3-8 | arXiv:2302.12173 | Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — Greshake, Abdelnabi, Mishra, Endres, Holz, Fritz — 2023, Saarland | Indirect prompt injection (text carriers) in LLM-integrated apps | Injection via *retrieved/processed data* (web pages, documents) demonstrated against Bing/GPT-4-powered systems; taxonomy: data theft, worming, ecosystem contamination; **"processing retrieved prompts can act as arbitrary code execution"** — retrieved content and instructions are conflated by design | Notes effective mitigations were lacking at publication | Pre-multimodal carriers (text); demos partly synthetic | ABSTRACT_ONLY | The foundational framing: anything Rune reads is code in the instruction channel. Every later multimodal carrier paper instantiates this |
+| A3-9 | arXiv:2307.10490 | Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs — Bagdasaryan, Hsieh, Nassi, Shmatikov — 2023, Cornell | Adversarial perturbation in images AND audio that steers MLLM output | Perturbations blended into images/audio make unmodified LLaVA/PandaGPT output attacker-chosen text and steer subsequent dialog when the user merely asks about the image/audio — the user prompt stays benign | — | PoC on LLaVA/PandaGPT; perturbation-style (not typographic); transferability limited | ABSTRACT_ONLY | Proof that the perceptual channel itself is an injection vector even without readable text — OCR-based sanitization alone cannot catch it |
+| A3-10 | arXiv:2309.00236 | Image Hijacks: Adversarial Images can Control Generative Models at Runtime — Bailey, Ong, Russell, Emmons — 2023/2024, UC Berkeley | Optimized image "hijacks" controlling VLM behavior | Behaviour/Prompt-Matching algorithms craft images that force VLMs to (1) emit attacker outputs, (2) **leak context-window information**, (3) **override safety training**, (4) believe false statements — all with **>80% success** on LLaVA from small perturbations | — | Optimized per model (white-box-ish); LLaVA-era | ABSTRACT_ONLY | The context-exfiltration + false-belief attack classes map directly onto memory poisoning: an adversarial screenshot can implant false statements or exfiltrate private memory content |
+| A3-11 | arXiv:2306.13213 | Visual Adversarial Examples Jailbreak Aligned Large Language Models — Qi, Huang, Panda, Henderson, Wang, Mittal — 2023, Princeton | Visual adversarial examples vs aligned LLMs | Vision input is a **weak link**: a single optimized image can *universally* jailbreak an aligned vision-integrated LLM into harmful content beyond its optimization corpus — adversarial objectives transfer from misclassification to full behavior control | — | Requires gradient access to vision encoder; 2023 models | ABSTRACT_ONLY | Even where Rune's stack reads no text, the image encoder is the bypass; model-internal defenses cannot be assumed |
+| A3-12 | arXiv:2402.19150 | Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Models — Cheng, Xiao, Gu, Yang, Duan, Zhang, Cao, Xu, Xu — 2024, ECCV 2024 | Typographic (embedded-text) attacks on commercial + open LVLMs | Typographic attacks (text rendered into images) are **widespread across commercial and open LVLMs**; largest typographic dataset to date; mechanism analysis; a mitigation reduces performance degradation from **42.07% to 13.90%** | Even the best mitigation leaves ~14% degradation — no clean fix shown | Mitigation is training/attention-based, model-specific | ABSTRACT_ONLY | Text-in-images is *transcribed and obeyed* by current models as a rule, not an edge case. Rune's screenshots regularly contain text → this is the default attack surface |
+| A3-13 | arXiv:2504.04893 | SCAM: A Real-World Typographic Robustness Evaluation for Multimodal Foundation Models — Westerhoff, Purelku, Hackstein, Loos, Pinetzki, Rodner, Hufe — 2025, CVPR 2025 Workshop / DMLR 2026 | Real-world typographic attacks (1,162 handwritten/real images, hundreds of categories) | Typographic attacks **remain effective against SOTA LVLMs**, especially those with vulnerable vision encoders; larger LLM backbones reduce (not remove) vulnerability; synthetic attacks ≈ real handwritten attacks | Vulnerability persists in 2025 SOTA; architecture of the vision encoder is a main susceptibility factor | Object-recognition task focus | ABSTRACT_ONLY | Independent 2025 confirmation with *real-world* (not synthetic) images: the failure mode survives model generations — design for it, don't wait for model fixes |
+| A3-14 | arXiv:2609.04533 | Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection — Chen, Tsai, Evtimov, Chaudhuri, Popa, Wagner, Zharmagambetov, (Meta/Berkeley) — 2026 | Black-box ADAPTIVE visual prompt injection against frontier VLMs | Adaptive black-box image injection achieves ASR **>82%** on open-weight frontier models and **47%** on commercial frontier VLMs (GPT-5.5-class) for harmful behavior/PII exfiltration/malicious tool calls, with benign user prompts unrelated to the injected task; transfers across commercial VLMs; demonstrated end-to-end on a real agent: injected image overwrites TOOLS.md → future RCE + secret exfiltration | — | 2026 frontier models; attack is adaptive (the hard case) | ABSTRACT_ONLY | **The Atlas "defenses fail under adaptive attack" lesson, in the visual domain.** Note the TOOLS.md/Memory-file overwrite pattern: exactly Rune's threat. Enforcement cannot live in the model |
+| A3-15 | arXiv:2609.09404 | An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks (MMPIBench) — Nguyen, Husain — 2026 | Benchmark of six visual carriers (OCR text, overlays, **EXIF metadata**, **QR codes**, fake interfaces, hybrids) across 6 agent frameworks × 5 foundation models, 720 runs; audio extension | Attacks **attempted in 12.8%** of runs but **completed in ~1%** for vision — the gap closes at the *planning* step (model reads and declines). Model >> framework for safety (one model never attempts; two attempt in 23.6%). **Audio channel is far weaker defended: attack completes in 49% of cells, 75% for one model** — completion-rate reporting alone understates exposure | (a) ~99% of visual injections are caught at planning by current models — a rare *positive* result, but only for non-adaptive fixed attack sets; (b) audio bypasses that defense line almost entirely | Fixed (non-adaptive) attack set; the authors themselves warn completion-understates-exposure | ABSTRACT_ONLY | Carrier taxonomy directly relevant to Rune (screenshots carry OCR text; EXIF and QR are real carriers); the vision-vs-audio defense asymmetry matters if Rune ingests audio. Positive planning-layer result is conditional on non-adaptive attacks — pair with Repeat-After-Me |
+| A3-16 | arXiv:2403.02691 | InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents — Zhan, Liang, Ying, Kang — 2024, ACL Findings | IPI benchmark: 1,054 cases, 17 user tools, 62 attacker tools, 30 LLM agents | ReAct-prompted GPT-4 executes injected instructions **24%** of the time (direct harm) / more for data exfiltration; a "hacking prompt" reinforcement nearly **doubles** ASR; agents broadly vulnerable | — | Text-domain; pre-2024 models | ABSTRACT_ONLY | Tool-integrated agents (Rune's shape) are measurably injectable even in the text-only case; establishes the exfiltration-vs-direct-harm taxonomy Rune's threat model needs |
+| A3-17 | arXiv:2403.14720 | Defending Against Indirect Prompt Injection Attacks With Spotlighting — Hines, Lopez, Hall, Zarfati, Zunger, Kiciman (Microsoft) — 2024 | Prompt-engineering defense: delimiting/datamarking/encoding of untrusted content | Spotlighting reduces IPI ASR from **>50% to <2%** with minimal task-efficiency cost, by giving a continuous provenance signal for untrusted spans | — | GPT-family, fixed (non-adaptive) attack evaluation; authors note limits | ABSTRACT_ONLY | Cheap, evidence-backed input-hygiene defense Rune can adopt at ingestion (mark provenance of every untrusted span) — but its evaluation is non-adaptive, so treat as risk reduction, not guarantee |
+| A3-18 | arXiv:2402.06363 | StruQ: Defending Against Prompt Injection with Structured Queries — Chen, Piet, Sitawarin, Wagner — 2024, USENIX Security 2025 | Two-channel (prompt/data) structured queries + tuned LLM | Structured separation of instructions from data significantly improves resistance with little/no utility loss | — | Requires a specially fine-tuned model — unavailable to Rune unless it controls its model | ABSTRACT_ONLY | The model-side structural defense; informative as the "right" design if Rune ever trains/finetunes, but not deployable as a wrapper |
+| A3-19 | arXiv:2503.18813 | Defeating Prompt Injections by Design (CaMeL) — Debenedetti, Shumailov, Fan, Hayes, Carlini, Fabian, Kern, Shi, Terzis, Tramèr (Google DeepMind/ETH) — 2025 | System-level defense: control/data-flow extraction + capabilities enforced at tool calls | CaMeL creates a protective system layer around a *susceptible* LLM: untrusted data can never influence program flow; policies enforced when tools are called; **solves 77% of tasks with provable security vs 84% undefended** on AgentDojo (under adaptive DRI evaluation) | The ~7% task-completion cost is the explicit price of provable security | Requires restructured agent architecture (separate planner/querier) | ABSTRACT_ONLY | **The defense that survives adaptive evaluation** — and it works by moving enforcement OUTSIDE the model (capability checks at tool boundaries), exactly the Atlas lesson. Rune's memory-write and shell/file tools are the boundary where such policies belong |
+| A3-20 | arXiv:2503.06254 | Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation — Liu, Yuan, Tie, Shi, Zhou, Sun, Gong — 2025 | Poisoned image-text pairs injected into multimodal KB | First multimodal RAG knowledge-poisoning attack: **up to 98% ASR with just 5 poisoned pairs** in a 481,782-pair DB (InfoSeek); dirty-label and clean-label cross-modal strategies; 4 defenses (paraphrasing, duplicate removal, structure-driven, purification) show **limited effectiveness and trade-offs** | Explicit negative: all evaluated defenses are inadequate | Optimization-based; assumes KB write access (realistic for user-contributed corpora) | ABSTRACT_ONLY | If Rune's memory accepts user/agent-contributed media, 5 poisoned items in a ~10⁵ corpus is enough. Defenses inside the pipeline fail; provenance/quarantine at write time is the implication |
+| A3-21 | arXiv:2502.17832 | MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks — Ha, Zhan, Kim, Bralios, Sanniboina, Peng, Chang, Kang, Ji — 2025/2026 | Localized (query-specific) vs globalized (untargeted) multimodal poisoning | Localized attack: **56% ASR under restricted attacker access**; transfers across 4 retrievers without re-optimization. Globalized: **one poisoned content collapses generation to 0% accuracy**. Both bypass existing defenses | (a) A single poisoned asset can globally destroy retrieval quality — availability attack costs ~nothing; (b) existing defenses bypassed | Benchmark-scale; retriever-transfer shown | ABSTRACT_ONLY | The one-poison-collapses-everything result argues for write-time quarantine + integrity checks on the media index; a corrupted media lane can silently poison all answers |
+| A3-22 | arXiv:2505.18543 | Benchmarking Poisoning Attacks against Retrieval-Augmented Generation — Zhang, Xin, Li, Zhang, Fang, Liu, Nie, Liu — 2025 | First comprehensive poisoning benchmark: 15 datasets, 13 attacks, 7 defenses, across RAG architectures | Attack effectiveness drops on adversarially expanded datasets; sequential/branching/conditional/loop RAG, multi-turn RAG, **multimodal RAG and agent RAG all remain susceptible**; "current defense techniques fail to provide robust protection" | Defense-side negative result at scale across architectures | Text-dominant datasets | ABSTRACT_ONLY | Cross-architecture confirmation that in-pipeline defenses fail; supports putting trust decisions in the tool boundary + provenance ledger, not in retrieval filters |
+| A3-23 | arXiv:2106.09898 | Bad Characters: Imperceptible NLP Attacks — Boucher, Shumailov, Anderson, Papernot — 2021, IEEE S&P 2022 | Invisible characters, homoglyphs, reordering, deletion in text pipelines | A single imperceptible encoding injection degrades or breaks NLP systems (translation, search, moderation) **including deployed commercial systems (Microsoft, Google)**; three injections break most models; attacks are model-agnostic black-box | Documents that deployed systems at the time did **no input sanitization** — the trust-boundary gap is in the pipeline, not the model | Text carriers; not image OCR per se, but identical mechanism applies to OCR output containing invisible characters | ABSTRACT_ONLY | **Directly relevant to taint-through-transformation**: OCR of a hostile image can output invisible/bidi characters that then flow into Rune's text memory as "extracted text". Text extracted from media needs the same sanitization as raw internet text |
+| A3-24 | arXiv:1708.09537 | DolphinAttack: Inaudible Voice Commands — Zhang, Yan, Ji, Zhang, Zhang, Xu — 2017, ACM CCS 2017 | Ultrasonic (>20 kHz) modulated voice commands exploiting microphone nonlinearity | Inaudible commands successfully control Siri, Google Now, Alexa, Cortana, automotive navigation (FaceTime call, airplane mode, navigation manipulation); SVM-based detection of ultrasonic carrier demonstrated as feasible defense | Requires proximity (attack range meters-class), specialized transducer, and alignment with the mic — demonstrated in lab-controlled conditions; practical constraints documented | Hardware-dependent; 2017 ASR stack (but the acoustic physics is durable) | ABSTRACT_ONLY | Credible but *conditions-constrained*: real risk only if Rune records audio in physical spaces with hostile nearby hardware; mitigation = band-energy anomaly detection at capture, not at ASR |
+| A3-25 | C2PA Technical Specification 2.2 (c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html) | Content Credentials: C2PA Technical Specification — C2PA — v2.2 May 2025 (2.4 current) | Media provenance standard: signed manifests (assertions + claim + signature), hard/soft content bindings, trust lists, validation states | (1) Provenance = **signed assertions bound by cryptographic hash ("hard binding")** to exact bytes; (2) §9: **"a soft binding shall not be used as a hard binding"** — perceptual fingerprints/watermarks are explicitly barred from identity/integrity roles; (3) §1.2/Principles: spec "SHOULD NOT provide value judgments… merely whether the assertions can be validated as associated with the underlying asset" — provenance asserts *source*, never *truth*; (4) §14/15: trust derives from signer identity + X.509 trust list + revocation + timestamp, with defined validation states (well-formed/valid/trusted); (5) §17: dedicated threat-modeling process + Harms Modelling; (6) covers PDF/BMFF/JPEG/PNG/ZIP/font embedding; `digitalSourceType` distinguishes AI-generated content | Soft bindings (fingerprints) fail-safe: manifest recovered via soft binding is expected to report validation failures because its hard binding won't match — similarity evidence is never integrity evidence | Ecosystem-dependent: trust requires the signer to be on a trust list and honest; provenance is opt-in; manifest strippable (soft-binding recovery exists for that case) | DOCUMENTATION_AUDITED | **The most mature normative statement of this arm's central verdicts**: (a) metadata = source-asserted, cryptographically bound, never truth; (b) perceptual similarity ≠ identity/deletion authority. Rune's media store should copy this two-tier design: cryptographic hash = identity; perceptual similarity = discovery hint only |
+| A3-26 | arXiv:2302.10174 | Towards Universal Fake Image Detectors that Generalize Across Generative Models — Ojha, Li, Lee — 2023, CVPR 2023 | AI-image detector reliability across generators | Trained real-vs-fake detectors fail on unseen generators: the "real" class becomes a **sink class** absorbing everything unfamiliar — asymmetrically tuned to fake patterns, so new fakes are classified real; feature-space nearest-neighbor/probing (CLIP features) generalizes better (+15.07 mAP / +25.90% acc on unseen diffusion/AR models) but is still far from solved | Detector training paradigm itself is the failure; generalization to unseen generators is structurally unreliable | 2023 generator zoo; classification framing | ABSTRACT_ONLY | Measured unreliability of AI-image detectors → Rune must NOT store "this image is AI/synthetic" detector verdicts as memory facts; C2PA-style source assertions (when present) are the only signed evidence |
+| A3-27 | arXiv:2308.14970 | Audio Deepfake Detection: A Survey — Yi, Wang, Tao, Zhang, Zhang, Zhao — 2023 | Survey + unified evaluation of audio deepfake detection | Unified comparison on ASVspoof 2021, ADD 2023, In-the-Wild; identifies **poor generalization to unknown attacks**, lack of in-the-wild data, interpretability as the unsolved core | Detection on unseen spoofing attacks degrades severely — the field's own summary | 2023 cut-off | ABSTRACT_ONLY | "Detection is losing" for audio; do not persist voice-authenticity verdicts as facts |
+| A3-28 | arXiv:2408.08739 | ASVspoof 5: Crowdsourced Speech Data, Deepfakes, and Adversarial Attacks at Scale — Wang, Delgado, Tak, Jung, Shim, Todisco, et al. — 2024, ASVspoof 5 Workshop (Interspeech satellite) | Large-scale spoofing/deepfake challenge: crowdsourced bona fide + attacks incl. adversarial for the first time | New database (many speakers, diverse conditions, adversarial attacks); **"attacks significantly compromise the baseline systems"**; submissions improve but the adversarial/hidden conditions define the gap; SASV and stand-alone CM tracks with new metrics | Baseline countermeasures compromised by attack variety — measured, at scale | Challenge paper; specific EERs live in per-system papers (e.g., XMU closed-condition EER 20.45% vs open 9.36%; SZU-AFS 4.04% — condition-dependent) | ABSTRACT_ONLY | Speaker-verification/anti-spoofing error rates are condition-dependent single-digit-to-20%+ — nowhere near identity-authority grade. Voice similarity is a workflow signal only |
+| A3-29 | ExifTool documentation (exiftool.org, v13.59, May 2026) | ExifTool by Phil Harvey — P. Harvey — current | EXIF/GPS/IPTC/XMP/ID3/maker-notes **read, write, edit, delete** | The reference tool's core feature list *is* the spoofing proof: writing EXIF/GPS/XMP/ID3 and **deleting metadata in groups or altogether** are one-line operations; also reads C2PA JUMBF and can delete it (`-JUMBF:all=`) on some formats; computes MD5/SHA-256/512 over image data for validation | — | Tool docs, not a study; but it is the de-facto standard both forensics and attackers use | DOCUMENTATION_AUDITED | EXIF (device, timestamps, GPS) is **source-asserted and trivially forgeable/strippable** — store it as provenance hints with explicit "unverified" status; cryptographic hash of media bytes is the only self-verifiable field |
+| A3-30 | NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response | NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response | Digital forensics framework (files, OS, network, application data) | Formalizes evidence collection/examination/analysis/reporting with data-source taxonomy; positions forensics as an IT process requiring **legal-counsel review for laws/regulations** — i.e., metadata and file artifacts are evidence *sources* whose weight depends on chain-of-custody and process, not self-authenticating truth | Explicitly disclaims being an all-inclusive legal procedure | 2006 (predates modern media formats; principles still cited) | DOCUMENTATION_AUDITED | The forensic-standard backing for "metadata = source-asserted evidence, never verified truth": evidence value comes from process (hashes, custody, timestamps), not from the metadata itself |
+| A3-31 | GDPR Art. 9 (Regulation (EU) 2016/679, gdpr-info.eu) | Processing of special categories of personal data — EU — 2016/2018, current | Regulatory text | Prohibits processing of data revealing racial/ethnic origin, political opinions, religion, trade-union membership, **genetic data, biometric data "for the purpose of uniquely identifying a natural person," health data, sex life/sexual orientation** — unless an exception applies (explicit consent, vital interests, legal claims, substantial public interest, etc.); Art. 9(4): Member States may add conditions for biometric/health data | — | Legal text read as written; application depends on interpretation (e.g., what counts as "uniquely identifying") | DOCUMENTATION_AUDITED | The regulatory line runs through **purpose**: biometric *similarity for the user's own workflow grouping* is arguably outside "uniquely identifying", while asserting *identity* ("this is Alice") is squarely in the prohibited category absent consent. This is the legal mirror of the workflow-match vs identity-authority distinction |
+| A3-32 | NIST IR 8280, Face Recognition Vendor Test Part 3: Demographic Effects | NIST IR 8280, Face Recognition Vendor Test Part 3: Demographic Effects | Face recognition accuracy across demographic groups (1:1 verification + 1:N search; 18.27M images of 8.49M people; 189 algorithms) | Quantifies **differential error rates across sex, age, race/country-of-birth groups** in both 1:1 and 1:N systems; motivation section addresses policing/bias impacts; recommends mitigation research; intended audience includes policymakers and system integrators "concerned with risks implied by differentials" | — | 2019 algorithm generation; lab-style mugshot/visa datasets (3 of 4 datasets standards-compliant) | ABSTRACT_ONLY | Automated face recognition has measured demographic-differential error — reinforces that even *operational* face matching inside Rune (e.g., "photos of the same person") must be presented as cluster hypotheses, never adjudicated identity |
+| A3-33 | arXiv:2005.07143 | ECAPA-TDNN: Emphasized Channel Attention, Propagation and Aggregation in TDNN Based Speaker Verification — Desplanques, Thienpondt, Demuynck — 2020, INTERSPEECH | Speaker-embedding architecture (voiceprints) | Significantly outperforms prior SOTA on VoxCeleb test sets / VoxSRC 2019 — the reference point for the speaker-embedding lane (community-reported EERs on VoxCeleb1-O are sub-1% for this class; EER figures not stated in abstract) | — | Benchmark conditions (studio-ish); real-world/channel shifts degrade; EER from abstract not verifiable | ABSTRACT_ONLY | Speaker embeddings are excellent *similarity keys* (diarization, "same voice?" hints) and terrible *identity authorities*; matches ASVspoof 5's finding that spoofing attacks compromise verification systems |
+| A3-34 | doi:10.1037/pspa0000098 (Crossref-verified; not on arXiv) | Deep neural networks are more accurate than humans at detecting sexual orientation from facial images — Wang, Kosinski — 2018, JPSP 114(2), 246–257 | Face → sensitive-attribute inference | Classifiers from 35,326 facial images: 81% (men) / 74% (women) accuracy from a single image, **91% / 83% from five images** vs human 61/54%; authors frame it explicitly as a **privacy threat** ("expose a threat to the privacy and safety of gay men and women") | — | Criticized methodologically (grooming/pinback-image confounds); binary orientation framing; 2018 models | ABSTRACT_ONLY | The canonical demonstration that faces leak special-category traits at high accuracy → Rune must not run attribute-inference on stored media by default, and must not persist such inferences |
+| A3-35 | arXiv:2603.20301 | Voice Privacy from an Attribute-based Perspective — Rahman, Larson, Tejedor-Garcia — 2026, Interspeech 2026 | Voice anonymization evaluated by *inferred attribute* leakage | Current voice-privacy benchmarks under-measure risk: measuring protection in attribute space shows **inferred attributes still present a risk despite anonymization and despite inference errors** | Anonymization that defeats speaker-identification can still leak attributes | Interspeech-length study | ABSTRACT_ONLY | Even *processed/anonymized* audio keeps leaking traits — supports the "don't persist inferred traits" rule for voice-derived entries too |
+| A3-36 | FISWG (Facial Identification Scientific Working Group), fiswg.org | Consensus standards for image-based facial comparison; incl. FRT Implementation Guidelines v1.0 and Face Recognition Systems Operational Assurance: Deployment Testing v1.0 (finalized Nov 2025) — FISWG — 2008–2026 | Forensic/operational facial identification standards body (50+ LE/intelligence/industry members) | Maintains separate disciplines: **facial identification (examiner-led comparison to standards)** vs **automated facial recognition (system operation)** — with distinct documents for implementation and operational assurance/deployment testing; recognition-system output is operational tooling, examination conclusions follow human/forensic process | — | Document bodies themselves not read (paywalled/member docs); scope verified from site + titles | DOCUMENTATION_AUDITED | The institutional precedent for the **workflow-match vs identity-authority split**: even law enforcement separates automated match (operational lead, requires assurance testing) from identification (forensic discipline with standards). Rune should mirror: face/voice similarity = lead/hint; identity assertions = out of scope |
+| A3-37 | arXiv:2209.01292 | Are Attribute Inference Attacks Just Imputation? — Jayaraman, Evans — 2022, ACM CCS 2022 | Attribute-inference attack methodology (incl. "sensitive value inference") | (1) Black-box attribute-inference attacks **rarely learn anything that cannot be learned from distribution knowledge alone** — much of the claimed attack power is the dataset prior, not the model; (2) white-box attacks CAN reliably identify records with sensitive values beyond the no-model baseline; (3) DP training and removing vulnerable records do **not** mitigate the residual white-box risk | Black-box attack power ≈ imputation baseline — a key deflationary negative for naive threat models | Model-internal setting (training-data inference), not media-inference per se | ABSTRACT_ONLY | Two-sided lesson: (a) don't over-credit what an attacker learns *from Rune's stored inferences alone*; (b) but any party with deeper access (white-box embeddings/logs) can exceed baselines — so inferred sensitive traits, once persisted, extend the attack surface permanently |
+| A3-38 | arXiv:2609.12448 | GraphProfiler: Source-Linked Sensitive Attribute Inference via Personal Knowledge Graphs — Khan, He, Ma, Wachowicz, Naghizade — 2026, EMNLP 2026 | LLM-based profiler aggregating cues across a user's content (age, income, occupation, etc.) | LLM profilers reach **86.7% attack success on SynthPAI (8 attributes)** and 84.6% on PANDORA **by aggregating indirect cues across ordinary posts**, with cited evidence for 98% of predictions; removing the cited posts cuts ASR far more than removing random ones | Confirms *aggregation* is the amplifier — no single entry leaks much, but the store as a whole does | Text content (not images); benchmark corpora | ABSTRACT_ONLY | Directly answers the arm question: memory is an aggregation amplifier; inferred sensitive traits become MORE harmful over time as the store grows — persistence requires explicit justification because the harm is emergent, not per-entry |
+| A3-39 | SQLite Limits (sqlite.org/limits.html, updated 2026) | Implementation Limits For SQLite — SQLite project — current | BLOB/DB size limits | Max string/BLOB = **SQLITE_MAX_LENGTH, default 1,000,000,000 bytes** (hard ceiling 2³¹−1 ≈ 2.1 GB; some built-ins like hex() fail earlier); max DB ≈ **281 TB** (page-count × 64 KB pages); docs explicitly recommend *lowering* the limit in security-sensitive apps; row = single BLOB encoding during INSERT/SELECT so SQLITE_MAX_LENGTH also caps row size | — | Docs | DOCUMENTATION_AUDITED | Screenshots (KB–MB) fit BLOBs fine; documents/audio fine under 1 GB; full-size video/long audio does NOT (and would bloat WAL/vacuum) → media-as-files + content-addressed references is the right default; BLOBs only for thumbnails/small assets |
+| A3-40 | arXiv:2212.08035 | Hamming Distributions of Popular Perceptual Hashing Techniques — McKeown, Buchanan — 2022, DFRWS EU 2023 | Million-image evaluation of PDQ, NeuralHash, pHash under content-preserving transforms | Measures Hamming-distance distributions between unrelated images AND image variants for the three deployed hash families; documents the collisions/tightness problems of each against seven image-variant classes — "little public evaluation" existed before | Explicitly documents that popular perceptual hashes have poorly characterized error behavior under common transforms | Hash archetypes only; no deep-perceptual-hash models | ABSTRACT_ONLY | The perceptual-hash **authority** the arm asked for: treat pHash distance as a probabilistic similarity signal with known failure modes, never a match/no-match rule |
+| A3-41 | arXiv:2111.06628 | Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash — Struppek, Hintersdorf, Neider, Kersting — 2021, ACM FAccT 2022 (Oral) | Adversarial attack on deployed deep perceptual hashing (Apple NeuralHash) | Gradient-free transforms AND simple perturbations force/prevent hash collisions — enabling **hiding abusive content AND framing innocent users**; hash values also leak information about device contents; conclusion: deep perceptual hashing "generally not ready for robust client-side scanning" | The safety-critical deployment of perceptual hashing was defeated by standard image transformations | Deep-hash specific (NeuralHash); classical hashes degrade differently | ABSTRACT_ONLY | Hard evidence that perceptual hashes are gameable → never a deletion authority or sole enforcement mechanism; adversarial collision = censorship/framing vector |
+| A3-42 | arXiv:2212.04107 | Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillance — Hooda, Labunets, Kohno, Fernandes — 2022 | Poisoning attack on perceptual-hash matching systems | Poisoning 5% of the hash database achieves **>40% physical-surveillance rate** on target locations; stronger detection robustness *increases* surveillance capability (robustness/abuse trade-off) | A defense-robustness improvement makes the abuse channel worse — inherent tension | Client-side scanning context | ABSTRACT_ONLY | Second independent result that hash-matching infrastructure is attackable → at Rune scale this is theoretical, but it kills any future temptation to use hash matching as an automatic enforcement tool |
+| A3-43 | arXiv:1912.07745 | PDQ & TMK+PDQF — A Test Drive of Facebook's Perceptual Hashing Algorithms — Dalins, Wilson, Boudry — 2019, Digital Investigation | PDQ image + TMK+PDQF video hashes on real investigation data (law-enforcement) | Open-sourced PDQ/TMK+PDQF perform well detecting commonly encountered transformations on real-world case data; reference implementation for LE integration | — | Law-enforcement triage context; human-in-the-loop investigation assumed (hash = candidate-finding tool) | ABSTRACT_ONLY | Documents the *legitimate* production use: abuse/near-dup **triage inside a human-reviewed investigation workflow** — matching how photo platforms use perceptual hashes (candidate detection → human/secondary verification), not automated deletion |
+| A3-44 | Apple Photos User Guide — "Remove duplicates" (support.apple.com/guide/photos/pht5a3157c1d/mac) | Remove duplicate photos and videos — Apple — current (macOS 12→26) | Consumer photo-library dedupe practice | Photos detects duplicate photos/videos and presents them for **user-confirmed merging/deletion** — duplicates surfaced as suggestions with human decision, and separately groups "same-event" content via People/Places/memories rather than treating perceptual similarity as identity | — | Vendor docs do not disclose the hash algorithm (public reporting indicates hash-based + embedding signals) | DOCUMENTATION_AUDITED | The shipped-consumer pattern for byte-identical vs perceptually-similar vs same-event: byte-level dedupe (fast hashes) automated; perceptual similarity surfaced as **review suggestions**; event grouping is semantic, not hash. Confirms "similarity proposes, user disposes" |
+| A3-45 | [OI] Embeddings documentation (platform.openai.com/docs/guides/embeddings, fetched 2026) | Vector embeddings — [OI] — current | Embedding-model versioning, dimensions, distance norms | Embeddings are **model-specific artifacts** with named versions (ada-002 → text-embedding-3-small/large) and differing MTEB performance; dimension can be shortened (Matryoshka, arXiv:2205.13147) with re-normalization; model knowledge cutoffs and training changes are version-bound — no cross-model vector compatibility is offered or implied | — | Docs; migration mechanics not covered (that's the gap) | DOCUMENTATION_AUDITED | Confirms the industry framing: an index is bound to a model version; changing models ⇒ full re-embed. Rune's unversioned embeddings violate this — record model+dimensions per index or treat the index as disposable cache |

research/memory-atlas-r1/AC-local-offline-intelligence/00_issue_scope.md

@@ -0,0 +1,24 @@
+# #404 AC — Offline / Local Intelligence: ISSUE + Scope (R1_FULL, 2026-09-22)
+
+## Canonicalization (verified, not invented)
+
+- **Gitea issue:** #404 (parent #375). **Domain:** AC — Offline / Local Intelligence (registry: "AC: Local / Offline Intelligence").
+- **Folder:** `AC-local-offline-intelligence/` (existing — kept). **Master:** `AC_LOCAL_OFFLINE_INTELLIGENCE_R1_MASTER.md` (canonical name kept).
+- **Batched artifact preserved byte-for-byte** as `AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md` (sha256 b29810f15a9bb64f348a…).
+- **Family file:** `families/offline_intelligence_resource_placement.md` Section AC — R0 baseline for reconciliation, reconnaissance NOT authority. Registry row 404 is batched-era text ("single-writer stance confirmed; staged earn-in") — NOT inherited.
+
+## Harness inheritance
+
+**R1_HARNESS_BASELINE_VERSION = 1.0 rev.2** (support #411): row-derived accounting (declared==derived), exact source foreign keys, evidence-depth governance (type≠depth), bounded zero-hit governance, targeted negative controls, origin→canonical→projection integrity for rich ledgers, post-freeze audit-freshness protocol. **FREEZE_ENFORCEMENT = PARTIAL — no executable hash-manifest; not claimed otherwise.** Memory safety hold: **CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0** (CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX); master + registry + Gitea are the durable summary authorities.
+
+## Scope
+
+68-section mandate: offline-state taxonomy · model-independent architecture · models-as-resources · capability compilation · intelligence assimilation · teacher/student evidence · strategy extraction · outcome-grounded learning · symbolic compilation · JEV-kernel seam · classical ML · small LMs · quantization · distillation · synthetic data · continual-learning seam · parametric vs non-parametric · retrieval · cascades · adaptive compute · capability registry/discovery · provider/local failure · no-model mode · degraded communication · local-first policies · contention · background cognition · caching · skills · code-as-capability · recovery internalization · self-improvement governance · regression/rollback · inheritance/distribution · security/privacy/supply-chain · inward audit · 2024-26 evidence · implementation ecosystem · adversarial pass (100 mandated + ≥15 Rune-specific) · 18+ matrices · 25 experiments (E1–E25) · 37 questions.
+
+## Governing distinctions (mandate)
+
+OFFLINE ≠ one state (NETWORK_OFFLINE / CLOUD_MODEL_OFFLINE / PROVIDER_UNAVAILABLE / INTERNET_SEARCH_UNAVAILABLE / LOCAL_GPU_UNAVAILABLE / LOCAL_LLM_UNAVAILABLE / ALL_GENERATIVE_MODELS_UNAVAILABLE / DEGRADED_TOOL_ENVIRONMENT). LOCAL ≠ trustworthy/free/deterministic. MODEL = replaceable cognitive resource, not Rune's mind (#399). TEXT FROM MODEL ≠ LEARNING SIGNAL — verified outcomes only (#399/#400 Growth Delta carry). Model agreement ≠ independent corroboration. FULL→DEGRADED, never FULL→DEAD — tested, not assumed.
+
+## Stage plan
+
+ISSUE (this) → INWARD (01, read-only A–I) → OUTWARD arms 1–4 serial (02_outward/) → APPLICABILITY (03) → INNOVATION (04) → claims/sources/load_bearing (rich ledger per harness contract) → R0 + prelim reconciliation → saturation → SYNTHESIS (06) → QUALIFY (07) → MASTER (rewrite) → closeout (audit LAST, gates, seal, receipts). POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM OUTWARD upgrade) recorded per mandate §61 — NOT applied here. STOP BEFORE #405.

research/memory-atlas-r1/AC-local-offline-intelligence/01_inward.md

@@ -0,0 +1,61 @@
+# #404 AC — INWARD: Read-Only Offline/Local Capability Audit (2026-09-22)
+
+Method: runtime probes (ollama API, nvidia-smi, free), file/code reads, SQLite readonly. No changes.
+
+## A. Local model runtime
+
+- **Ollama active** (system service, port 11434 live; user-level service shows inactive — launch context is system). **11 models installed** (~55 GB disk): 27B-class generalists ×2 (IQ2_M quantized, 11–12 GB), qwen3:14b, qwen2.5-coder:14b, qwen2.5:7b/3b, qwen2.5vl:3b + llava:7b (vision), **qwen3-embedding:0.6b + nomic-embed-text + mxbai-embed-large (embedders)**.
+- **Live capability probe:** tags API responds; no generation probe run (read-only discipline) — so generation health is CAPABILITY_DECLARED not CAPABILITY_OBSERVED.
+- Hardware: RTX 4070 Ti SUPER 16 GB (5.4 GB in use at idle by user apps); 62 GB RAM (30 available).
+
+## B. Provider orchestration
+
+- 11 providers authed (openai, google, ollama, kimi ×2, zai, moonshot, xiaomi ×2, opencode-go, verboo). Live config registers ONLY the local Ollama endpoint (one 27B model, `tools: true`) — the runtime's DEFAULT path is local, with frontier providers available per-session.
+- **No fallback chain, no cascade policy, no capability registry with observed truth** — model selection is per-session manual/provider-default. Capability truth is DECLARED (config) only; nothing probes or records observed capability. Staleness undetectable.
+
+## C. Deterministic capabilities
+
+- **152 Python modules** across scripts/ (129) + shared/ (23): curator, growth_delta, lessons, skill_library, claim_audit, drift_core, memory_store, model_connect, gitea tooling, drift/curator/consolidation suites. This is a REAL deterministic layer — but nothing routes decisions to it as a tier; it IS the current no-model fallback by accident of architecture rather than design.
+
+## D. Embedding / retrieval
+
+- memory_store embeds via Ollama nomic-embed-text (256-d Matryoshka truncation, 8192 ctx), content-hash cache so unchanged text never re-embeds. **Embedding-model identity NOT recorded per vector** (carried #403 defect — confirmed: no model column). FTS5 + sqlite-vec indexes local.
+- qwen3-embedding:0.6b (the family file's recommended upgrade) is INSTALLED but NOT wired (EMBED_MODEL default unchanged) — the swap path exists as designed but was never executed.
+
+## E. Learning
+
+- **Skill library EXISTS but is EMPTY** (skills: []). Lifecycle designed (observed→drafted→trusted→executable; ≥2-success promotion gate — good governance) but zero skills have ever entered it.
+- **Lessons: 7 chunks** (lessons wing) — Reflexion-style episodic reflection, applied via growth_delta. Real but tiny.
+- **Growth delta machinery exists** (behavioral vs competency gates, two-timescale design) — but no measured before/after analogous-task improvement has ever been recorded. Growth Delta is DESIGNED, never DEMONSTRATED.
+
+## F. Model-independent state
+
+- Survives any model loss: canonical Memory (944 entries + 118k chunks, SQLite), task/resume state (resume-flags), skill/lesson stores, all 152 deterministic modules, Gitea state, file artifacts. **State ownership is genuinely model-independent** — the strongest inward finding.
+- Does NOT survive: any semantic interpretation, consolidation, lesson extraction, code generation, open-ended communication.
+
+## G. Background services
+
+- Consolidation/curator/drift/claim-audit crons exist; several REQUIRE the LLM or Ollama (embedding calls). When Ollama is down, `_embed` fails SILENTLY (except: log-and-skip; entries get written WITHOUT working vectors — the sqlite-vec index silently loses new entries until re-embed). **Silent degradation, not graceful degradation.**
+
+## H. Hardware seam
+
+- Observed only: 16 GB VRAM (Idles at ~5 GB used by user apps), 62 GB RAM. Local 27B IQ2_M fits (11 GB). Contention with user gaming/coding is real (AD carry). Final topology → #405.
+
+## I. No-model mode (ALL_GENERATIVE_MODELS_UNAVAILABLE)
+
+- What works: file tools, git, Gitea API, deterministic Memory ops (add/update/get by ID, FTS search — minus embedding for new entries), all 152 scripts' deterministic paths, task state, integrity checks, structured error reporting via exit codes/files.
+- What breaks: every conversation; all consolidation/curator LLM calls; lesson extraction; embedding for new content (silent); any open-ended communication. No communication templates exist — degraded communication is UNDESIGNED.
+
+## Classification
+
+- **ACTIVE (5):** canonical Memory; deterministic script layer (152 modules); Ollama runtime + 11 models; embedding pipeline (text); provider auth layer.
+- **PARTIAL (4):** local LLM usage (available, rarely routed-to by default); learning machinery (designed, nearly empty: 7 lessons, 0 skills, 0 measured deltas); capability truth (declared-only); degraded communication (exit codes only, no templates).
+- **DORMANT (2):** qwen3-embedding:0.6b (installed, unwired); skill library (governed, empty).
+- **ABSENT (6):** cascade/routing policy; capability registry with observed truth; no-model communication templates; measured Growth Delta evidence; model-versioned embeddings; background cognition scheduler (timer-based, not event-driven).
+- **BYPASS (2):** frontier providers used ad-hoc per session (no policy); consolidation runs cloud-side implicitly.
+- **UNKNOWN (2):** generation health of installed quantized models (no probe run); real JSON-extraction failure rate (mandate-acknowledged gap).
+- **CONFLICTING (1):** "local-first" config default vs ad-hoc frontier usage in practice.
+
+## Current-state honesty (mandate §50)
+
+**Rune does NOT have offline intelligence.** It has: local model AVAILABILITY (11 models, real hardware); local EMBEDDING capability (with an unversioned-vector defect); a large deterministic script layer that constitutes an accidental no-model fallback; designed-but-empty learning machinery (0 skills, 7 lessons, 0 measured deltas); and NO routing policy, NO capability registry, NO degraded-mode communication, NO cascade. LOCAL MODEL AVAILABILITY ≠ OFFLINE TASK CAPABILITY ≠ LOCAL DECISION CAPABILITY ≠ LOCAL LEARNING. The distinction the mandate demands is exactly the inward finding.

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm1_foundations.md

@@ -0,0 +1,195 @@
+# AC #404 — Offline / Local Intelligence — Arm 1: FOUNDATIONS / LOCAL COMPUTATION
+
+_Domain: Memory Research Atlas R1 #404 · Rune project (single workstation, RTX 4070 Ti SUPER 16 GB, 62 GB RAM)_
+_Arm scope: small/efficient models · quantization · distillation · synthetic data · adaptive compute/cascades · classical ML vs LLM · retrieval-as-local-capability · hybrid symbolic/neural + verifiers + constrained decoding_
+_Verification discipline: every arXiv ID resolved via the export API (`export.arxiv.org/api/query`) before entry. Date of verification pass: 2026-09 session._
+_Carry-over from sealed prior domains: #383 (IR — cascade OVERTURNED at n=924, score-everything; RRF → weighted combination; abstention→generation gating) and #403 (Arm 2 — multi-vector late-interaction visual lane; embedding model+version stamping mandatory; ColPali↔ColQwen2 >5-point nDCG shift on identical data)._
+
+**Verification ledger (mis-pairings caught this arm — 4):**
+
+| Prompt-supplied ID | Reality (export API) | Correct ID for intended paper |
+|---|---|---|
+| 2402.04937 ("BitNet") | Charting the COVID Long Haul Experience (2024-02-07) — WRONG | BitNet b1.58 = **2402.17764** |
+| 2510.05040 ("model collapse successor") | Test-Time Scaling in Diffusion LLMs via Hidden Semi-Autoregressive Experts (2025-10-06) — WRONG | see do-not-cite register |
+| 2301.12726 ("Distilling Step-by-Step") | Specializing Smaller Language Models towards Multi-Step Reasoning (Fu et al.) — a DIFFERENT real paper, retained as reasoning-distillation evidence | Distilling Step-by-Step = **2305.02301** |
+| 2109.05074 ("PICARD") | FBERT: A Neural Transformer for Identifying Offensive Content — WRONG | PICARD = **2109.05093** |
+
+---
+
+## 1. Source ledger
+
+Read depths used: RELEVANT_SECTIONS (load-bearing sections read verbatim), DOCUMENTATION_AUDITED (docs only, never FULL_PAPER), ABSTRACT_ONLY (abstract + metadata via export API), METADATA_VERIFIED.
+
+### Topic 1 — Small / efficient models
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 1 | 2402.14905 | MobileLLM: Optimizing Sub-billion Parameter Language Models for On-Device Use Cases | Liu, Zhao, Iandola et al., 2024, Meta (ICML 2024) | Sub-1B on-device LMs | Architecture > data/params at sub-billion scale: deep-thin + embedding sharing + GQA gives +2.7%/4.3% over prior 125M/350M SOTA; MobileLLM-LS (block-wise weight sharing) +0.7–0.8% more; **near-parity with LLaMA-v2-7B on API-calling tasks** | Prevailing "data and parameter quantity are pivotal" belief contested at sub-billion scale | 125M–350M scale only; "close correctness" on API calls is task-specific (calibrated to common on-device use cases), not general capability | ABSTRACT_ONLY | Rune's 3B/7B tier is 3–20× larger than what MobileLLM shows is enough for **bounded tool-call/API-call class tasks** — routing/extraction/tool invocation is provably sub-1B-viable when specialized |
+| 2 | 2404.14219 | Phi-3 Technical Report | Abdin, Aneja, Awadalla et al., 2024, Microsoft | 3.8B–14B capability via data | phi-3-mini 3.8B: 69 MMLU, 8.38 MT-bench (rivals Mixtral 8x7B / GPT-3.5); 7B → 75; 14B → 78 MMLU; built on heavily filtered web + **synthetic data**; capability scales strongly with model size within the family | — | Benchmark-rivalry claims are vendor-measured (MMLU is contaminated/familiar); "rivals GPT-3.5" is aggregate, not per-task | ABSTRACT_ONLY | Rune's 14B generalist sits at the phi-3-medium class: 78 MMLU ≈ capable, but the report's own scaling (69→75→78) shows each size step buys ~3–6 MMLU points — small models gain capability mostly from data quality, which Rune can control locally |
+| 3 | 2412.08905 | Phi-4 Technical Report | Abdin, Behl, Bubeck, Eldan, Gunasekar et al., 2024, Microsoft | 14B + synthetic data | phi-4 14B built with synthetic data **throughout** pretraining; **surpasses its own teacher (GPT-4) on STEM QA** — data generation + post-training go beyond distillation | Implicit negative: Phi-family prior distillation-from-GPT-4 had a ceiling that phi-4's synthetic-data recipe exceeded | STEM-focused claims; general chat not claimed superior; vendor benchmarks | ABSTRACT_ONLY | THE synthetic-data counterexample to doom narratives: a bounded, curriculum-designed synthetic pipeline at 14B can exceed the teacher on a target domain. Rune's "learning machinery designed-but-empty" could be seeded the way phi-4 does it: generated exercises + verification, not raw distillation |
+| 4 | 2412.15115 | Qwen2.5 Technical Report | Qwen Team (Yang et al.), 2024, Alibaba | 0.5B–72B family | 18T tokens pretrain; SFT >1M samples + multi-stage RL; "notably improve long text generation, **structural data analysis**, and instruction following"; open-weight quantized versions shipped | — | Vendor benchmarks; "structural data analysis" improvement is asserted without per-task public detail in abstract | ABSTRACT_ONLY | Rune's 14B generalist is plausibly Qwen2.5-class; the family covers 0.5B→14B, giving Rune a same-family ladder for cascade experiments (0.5B/1.5B/3B for routing, 7B/14B for execution) — same tokenizer/family matters for speculative decoding draft/target compatibility |
+| 5 | 2409.12186 | Qwen2.5-Coder Technical Report | Hui, Yang, Cui et al., 2024, Alibaba | Code models 0.5B–32B | 5.5T tokens, "scalable synthetic data generation"; SOTA on >10 code benchmarks incl. generation, completion, reasoning, **repair**; consistently outperforms same-size larger models; retains general+math skills | — | Vendor-measured; repo-scale agentic coding not benchmarked (HumanEval/MBPP-class tasks) | ABSTRACT_ONLY | Rune's 14B coder: function/completion/repair-class coding is SOTA-at-size; **repo-scale multi-file coding remains unbenchmarked in every report** — the evidence base for "≤14B does repo-scale coding" is absent everywhere, not just in Rune |
+| 6 | 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.), 2025 | RL reasoning + distillation | Pure RL (no human reasoning labels) elicits self-reflection, verification, dynamic strategy adaptation; emergent patterns "can be systematically harnessed to guide and enhance the reasoning capabilities of smaller models" (R1-Distill line) | Conventional SFT on human demonstrations is inferior for complex verifiable tasks | Abstract-level; per-distill-size numbers not re-verified here | ABSTRACT_ONLY | Rune's 27B IQ2_M + 14B: if either is R1-Distill-Qwen lineage, §3 of 2504.04823 (below) applies DIRECTLY — distilled reasoning models have specific quantization sensitivities. Also: the R1-Distill line is the existence proof that reasoning distillation works at 7B/14B/32B — but see arm-2 caveats on what distillation transmits |
+| 7 | 2503.19786 | Gemma 3 Technical Report | Gemma Team (Kamath, Ferret, …), 2025, Google | 1B–27B multimodal | 1–27B scale; 128K context; KV-cache reduction via local/global attention ratio; trained with distillation; **Gemma3-4B-IT competitive with Gemma2-27B-IT; Gemma3-27B-IT comparable to Gemini-1.5-Pro** | — | "Competitive/comparable" is benchmark-composite vendor language; multimodal claims not load-bearing here | ABSTRACT_ONLY | The strongest generation-over-generation datapoint: **4B-IT ≈ prior-gen 27B-IT**. Within-family quality gain (2024→2025) bought more than 6× parameter reduction. For Rune: "is 27B IQ2_M better than a newer 4–7B at higher precision?" is a REAL question, not a rationalization — the answer is measurable locally |
+| 8 | 1503.02531 | Distilling the Knowledge in a Neural Network | Hinton, Vinyals, Dean, 2015 | KD foundation | Soft targets (temperature-scaled logits) transfer "dark knowledge" — inter-class similarity structure — that hard labels discard; ensemble → single model compression works (MNIST; production ASR) | Hard-label training discards the relative-probability information that makes distillation work | Pre-LLM: classification-scale evidence; temperature intuition does not map 1:1 onto autoregressive LM distillation | ABSTRACT_ONLY | Foundation row. Rune's "lessons" store is a knowledge-transfer analogue: soft/graded evidence (when things worked, with what confidence) carries more transferable signal than binary outcomes — the KD principle generalizes to lesson design |
+
+### Topic 2 — Quantization
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 9 | 2210.17323 | GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformers | Frantar, Ashkboos, Hoefler, Alistarh, 2022, ICLR 2023 | PTQ via second-order info | 3–4 bit weight PTQ with "negligible accuracy degradation"; 175B in ~4 GPU-hours; "reasonable accuracy" even in extreme (≈2–3 bit) regime; layerwise OBQ approximation | "Reasonable accuracy" at extreme bits is a euphemism — the paper itself does not claim losslessness below 3 bits | Perplexity + limited zero-shot tasks (2022-era evals, pre-reasoning models); calibration on wiki/C4-class text | ABSTRACT_ONLY | GPTQ is calibration-sensitive: 2504.04823 found GPTQ degrades badly when calibration domain ≠ target domain (−9.8 avg points; fixable by calibrating on task-domain data). If Rune's 27B IQ2_M was GPTQ-lineage-calibrated on generic text, its coding/reasoning loss is partially a calibration artifact |
+| 10 | 2306.00978 | AWQ: Activation-aware Weight Quantization | Lin, Tang, Tang, Yang et al., 2023, MLSys 2024 | Salient-weight PTQ | Protecting ~1% salient channels (identified by activation stats, not weight magnitude) greatly reduces quantization error; equivalent per-channel scaling avoids mixed precision; **no backprop → generalizes across domains/modalities without overfitting the calibration set**; strong on coding and math benchmarks | — | Weight-only; 4-bit regime evaluated, not 2-bit headline | ABSTRACT_ONLY | 2504.04823's head-to-head verdict: **AWQ preferred over GPTQ** for weight-only at 4-bit (comparable quality, faster). For Rune's tiering: AWQ-quantized models are the safer default for mixed-task local serving |
+| 11 | 2305.14314 | QLoRA: Efficient Finetuning of Quantized LLMs | Dettmers, Pagnoni, Holtzman, Zettlemoyer, 2023, NeurIPS 2023 | NF4 4-bit + LoRA | Backprop through frozen NF4 4-bit base ≈ full 16-bit finetune quality; Guanaco 99.3% of ChatGPT on Vicuna benchmark; double quantization + paged optimizers; NF4 information-theoretically optimal for normally distributed weights | >1,000-model sweep: finetuning on small high-quality data beats prior SoTA even with smaller models — data quality dominates scale for finetuning | Vicuna benchmark = LLM-judged chat quality, weak instrument; inference stays 4-bit slow (QLoRA optimizes training not serving) | ABSTRACT_ONLY | The enabling tool for Rune's empty learning machinery: a 14B model can be **finetuned on 16 GB VRAM** via 4-bit + LoRA on lesson-derived data. The QLoRA evidence says this is quality-preserving — the missing piece is Rune's data quality pipeline, not the training machinery |
+| 12 | 2402.17764 | The Era of 1-bit LLMs: All Large Language Models are in 1.58 Bits (BitNet b1.58) | Ma, Wang, Ma, Wang et al., 2024, Microsoft | Ternary {-1,0,1} LLMs | BitNet b1.58 **matches FP16 Transformer trained with the same size and token count** in perplexity and end-task — but this is training-from-scratch QAT, not post-training quantization; new scaling law; 2.71× faster, ~3.55× less memory (per paper's own architecture) | Implied negative: you cannot reach this quality by PTQ of an existing FP16 model — parity requires the model to be trained ternary | Only models trained from scratch; all Rune-relevant models are PTQ targets, not QAT-trained | ABSTRACT_ONLY | Hard boundary: Rune's 27B IQ2_M is a **PTQ** model. BitNet-class parity does not transfer to it. Any reasoning of the form "ternary works (BitNet), so 2-bit PTQ is fine" is invalid — the 2608.01078 finding below confirms PTQ ternarization collapses without reasoning-aware calibration |
+| 13 | 2404.14047 | An empirical study of LLaMA3 quantization: from LLMs to MLLMs | Huang, Zheng, Ma, Qin et al., 2024 | Low-bit PTQ sweep (1–8 bit) | 10 PTQ + LoRA-FT methods on LLaMA3-8B at 1–8 bits across many datasets: LLaMA3 (15T-token, high-quality pretrain) **still suffers non-negligible degradation** at low bits; ultra-low-bit MLLM (2–4 bit) evals show substantial multimodal loss | — | Abstract-level; headline tables not re-read here | ABSTRACT_ONLY | Corroborates 2504.04823 with a different model family: modern heavily-trained models do NOT out-quantize older ones. Rune cannot assume its 2024/2025-era models are quantization-robust at 2-bit |
+| 14 | 2504.04823 | Quantization Hurts Reasoning? An Empirical Study on Quantized Reasoning Models | Liu, Sun, Zhang, Bai et al., 2025, Huawei Noah's Ark Lab | **ANCHOR — task-sensitive quantization** | Systematic: DeepSeek-R1-Distill Qwen/LLaMA 1.5B–70B, QwQ-32B, Qwen3-8B; weight/KV/activation quant; AIME-120, MATH-500, GSM8K, GPQA, LiveCodeBench; 3 seeds. **(a)** W8A8 and W4A16 ≈ lossless (≤1% avg); **(b)** 3-bit weight-only risky: R1-Distill-Qwen-7B avg 63.8 → GPTQ-W3 58.4 (−5.4), AWQ-W3 57.6 (−6.3); W4 fine (−1.6/−2.1); **(c)** 1.5B collapses at low bits: W3-AWQ −18.6, W4A4-FlatQuant −10.9, MXFP4/QuaRot-4A4 → −45 to −46 (total collapse); **(d)** harder tasks degrade up to **4× more** (32B W4A4KV4: AIME −3.9% vs MATH-500 −1.2% vs GSM8K −0.0%); **(e)** model origin matters: Qwen vs LLaMA differ in sensitivity per quant type; **(f)** GPTQ calibration domain: switching WikiText2→Numina-Math = +9.8 avg; other algorithms robust; **(g)** **scaling: at equal size, large quantized > small BF16 — 3-bit 32B (≈14.5 GB) beats 7B BF16 by ~17% on LiveCodeBench**; 4-bit gives best accuracy-latency; **(h)** quantized models do NOT think longer unless aggressive low-bit; quantization error accumulates along CoT — test-time-scaling gains are lower than BF16 | "Quantized models exhibit increased output lengths" hypothesis REFUTED (no overthinking at moderate bits); "aggressive low-bit is viable" REFUTED for ≤4-bit weight-activation (4A4 collapses: −10.9 to −59.7); "relative quantization error shrinks with model scale" NOT monotone (see also #17) | Reasoning models only (CoT-heavy evals); no extraction/classification task class; no 2-bit weight-only config tested (their floor is 3-bit W-only / 4-bit activations); 27B class not directly in the sweep (14B/32B bracket it) | **RELEVANT_SECTIONS** (intro, §3.2–3.5, §4.2–4.3 verbatim incl. full tables for 1.5B/7B/14B) | **Rune's 27B IQ2_M sits BELOW the study's tested floor.** Extrapolation chain: W3 loses 5.4–6.3 avg points on a 7B; 2-bit PTQ is worse; IQ2_M is a ~2.5 bpw-class quant. Mitigating: the size-scaling law (large-quantized > small-BF16) is the only measured support for keeping a 2-bit 27B over a 4-bit 7–8B — but it was measured at 3-bit vs BF16, not 2-bit vs 4-bit. Rune's exact question has NO direct benchmark (do-not-cite register) |
+| 15 | 2608.01078 | Attend to Your Own Thoughts: Breaking the Barrier for PTQ of Reasoning LLMs through the Lens of 1.58-Bit Quantization (ScaleQ-1.58) | Wang, Li, Kang, Fan, Yao, 2026 | Ternary PTQ of reasoning LLMs | Conventional calibration **ignoring the reasoning process** → "performance collapse on challenging mathematics and coding tasks" under ternarization (even the prior best CAT-Q); AYOT calibration (use the model's own CoT traces as calibration context) + CAT-Q: ternary Qwen3-4B recovers +8.97 abs; 1.7B reaches >90.5% of BitNet b1.58-2B4T with 4M calibration tokens | Naive PTQ ternarization of reasoning models = collapse on math/coding; calibration on non-reasoning text = broken quantized reasoner | 1.58-bit focus; needs model-generated calibration traces (a per-model pipeline) | ABSTRACT_ONLY | Directly extends the family file's quantization finding to 2-bit PTQ: **at Rune's IQ2_M operating point, failure is concentrated exactly where Rune needs capability (math/coding reasoning), and it is a calibration-process artifact as much as a bit-width artifact.** A local repair path exists: regenerate quantization with reasoning-trace calibration — feasible on one workstation |
+| 16 | llama.cpp PR #1684 "k-quants" | k-quants (Q2_K…Q6_K + mixes) | ikawrakow / ggml, 2023, merged (GGUF ecosystem docs) | k-quant definitions + ppl evidence | Perplexity-vs-size smooth function across 2–6 bit mixes; **6-bit within 0.1% of fp16 ppl**; **relative quantization error does NOT keep decreasing with model size** (13B friendlier than 7B; error back at 7B level for 30B/65B); motivated by "2-bit 30B fits a 16 GB RTX 4080" — the exact Rune-class constraint | The folklore "bigger models quantize better" is bounded and non-monotone above ~13B | Perplexity-based (ppl is a poor proxy for coding/reasoning task quality — see #14); predates IQ (importance-matrix) quants | **DOCUMENTATION_AUDITED** | Q2_K-class ≈ 3.3 bpw effective; Rune's IQ2_M is below even that. The PR's own framing legitimizes 2-bit ONLY under a hard 16 GB ceiling — the same ceiling Rune has. Note: effective bpw of IQ2_M (~2.5–2.7) not re-audited in this pass; flagged in limitations |
+| 17 | llama.cpp discussion #5263 | About imatrix overfitting, and importance of input text | community benchmark (Ikawrakow-style tests), 2024, GGUF ecosystem docs | Importance-matrix calibration sensitivity | Mistral-7B Q2_K with imatrix from 3 datasets (French Wikipedia XML mix, English fiction, wikitext) × 3 corpus sizes: KL-divergence vs baseline varies by both dataset type and size; author's conclusion: task-matched calibration "seems unlikely to make things worse," wikitext-100K default | imatrix overfitting concerns PARTIALLY confirmed — wrong-kind-of-text imatrix measurably changes (can worsen) the quant; no universal best corpus | KL-divergence proxy, not task accuracy; 7B only; no error bars | **DOCUMENTATION_AUDITED** | Same mechanism as #14's GPTQ calibration finding, in the GGUF ecosystem Rune actually uses: **whatever imatrix produced Rune's IQ2_M files, its input text determines how much coding/reasoning survives.** Practical: prefer IQ quants whose imatrix came from code/reasoning text, or re-quantize locally with matched calibration |
+
+### Topic 3 — Distillation
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 18 | 1606.07947 | Sequence-Level Knowledge Distillation | Kim, Rush, 2016, EMNLP 2016 | Response/sequence-level KD | Word-level KD works for NMT; two sequence-level variants better still; best student 10× faster with little loss (+4.2 BLEU over no-KD greedy); sequence-KD **eliminates the need for beam search** on the student | — | NMT-era; teacher-student same architecture family | ABSTRACT_ONLY | Foundation for "distill teacher outputs, not logits": Rune's lesson pipeline can distill the 27B's *successful outputs* into prompts/templates for the 14B/7B — response-level, not answer-only |
+| 19 | 2305.02301 | Distilling Step-by-Step! Outperforming Larger Language Models with Less Training Data and Smaller Model Sizes | Hsieh, Li, Yeh, Nakhost, Fujii, Ratner et al., 2023, ACL Findings 2023 | Rationale (CoT) distillation | LLM rationales as extra supervision in multi-task training: 770M T5 outperforms few-shot 540B PaLM using only 80% of a benchmark's data; beats standard finetune AND standard distillation with much less data across 4 NLP benchmarks | Standard label-only distillation is data-hungry and weaker than rationale-augmented distillation — the negative that motivates the method | NLP classification + QA tasks, not agentic coding | ABSTRACT_ONLY | For Rune: extract the 27B's *reasoning* (why this lesson, why this fix) as supervision, not just verdicts — rationales are the transferable part |
+| 20 | 2301.12726 | Specializing Smaller Language Models towards Multi-Step Reasoning | Fu, Peng, Ou, Sabharwal, Khot, 2023, ICML 2023 | **ANCHOR — reasoning distillation trade-offs** | CoT distillation from GPT-3.5 (≥175B) into T5 ≤11B works: specialized 3B/11B match LaMDA-137B / approach PaLM-60B-class on math CoT; OOD to MultiArith/ASDiv/SVAMP when tuned on GSM8K CoT. **BUT the price is explicit:** at the START of specialization the model **immediately loses ALL CoT ability on BigBench-Hard (accuracy → 0)** and a large portion of answer-only ability; in-dist and OOD performance **fluctuate differently in late training — in-dist accuracy does not predict OOD**; model selection must use held-out OOD data; smaller students more data-hungry (3B plateaus at ~90K examples vs Base still climbing) | Generic capability is NOT preserved: specialization is a real trade, not free capacity reallocation; "emergent 100B-only" CoT claim REFUTED (distillable) | Math word problems only; T5-family students; 2023-era teacher | **RELEVANT_SECTIONS** (§1–3 + specialization dynamics + model-selection discussion verbatim) | Sharpest evidence on what distillation transmits: **capability in-domain, loss out-of-domain, and no reliable internal signal of which is which.** For Rune's lesson design: any distilled/derived rule is in-distribution ONLY for the tasks that generated it; Rune must hold out OOD probe tasks before trusting a lesson — mirror of the #382 contrastive-intervention gate |
+| 21 | 2306.13649 | On-Policy Distillation of Language Models (GKD) | Agarwal, Vieillard, Zhou, Stanczyk, Ramos, Geist et al., 2023, Google DeepMind (ICLR 2024) | On-policy vs off-policy KD | Standard KD suffers train/inference **distribution mismatch** (student trained on teacher-generated sequences, then runs on its own); GKD trains on the student's self-generated sequences with teacher feedback; alternative divergences help when the student **lacks expressivity to mimic the teacher**; integrates with RLHF; gains on summarization, translation, arithmetic, instruction-tuning | Off-policy (fixed teacher outputs) KD is structurally mismatched for autoregressive LMs — a negative about the dominant practice | Abstract-level; per-task numbers not re-read | ABSTRACT_ONLY | For Rune: if it ever distills 27B→14B, on-policy (student's own attempts graded by teacher) beats copying teacher outputs — and this matches #382's SkillGen contrastive-intervention design (grade the agent's own behavior, don't imitate transcripts) |
+| 22 | 2408.12326 | Interactive DualChecker for Mitigating Hallucinations in Distilling Large Language Models | Wang, Suzuki, Sakaji, Izumi, 2024 | Hallucination control in KD pipelines | LLM-as-teacher KD propagates hallucinations when teacher confidence is low; DualChecker re-prompts low-confidence teachers and mines borderline student cases; improves both teacher and student on a green-innovation text dataset | — | Single narrow domain; no broad hallucination-inheritance benchmark | ABSTRACT_ONLY | Weak-but-real evidence that **teacher-error transmission is an observed problem needing machinery, not a hypothetical**. Paired with the bounded zero-hit below (no dedicated "hallucination inheritance" measurement paper found), the verdict is: transmission is acknowledged and patched piecemeal, never quantified systematically |
+
+### Topic 4 — Synthetic data
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 23 | 2305.17493 | The Curse of Recursion: Training on Generated Data Makes Models Forget (model collapse) | Shumailov, Shumaylov, Zhao, Gal, Papernot, Anderson, 2023, Nature 2024 | Recursive training degradation | Model-generated content in training causes "irreversible defects": tails of the original distribution disappear; shown in VAEs, GMMs, LLMs; **data REPLACEMENT across generations** drives collapse | — | The collapse regime assumes replace-not-accumulate (see #24); public-web framing, not closed-loop personal data | ABSTRACT_ONLY | Rune's feedback loop (agent writes lessons → lessons condition future behavior) is structurally a replace-or-accumulate choice. #23 says: never let synthetic/derived content replace the human-verified core |
+| 24 | 2404.01413 | Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data | Gerstgrasser, Schaeffer, Dey, Rafailov, Sleight, Hughes et al., 2024 | **KEY NEGATIVE RESULT** | Confirms collapse under replacement — then shows **accumulating** each generation's synthetic data alongside the original real data **avoids model collapse**; holds across model sizes, architectures, hyperparameters; similar for diffusion/VAE | The strong "training on generated data is doomed" reading of #23 is NOT inevitable — it is an artifact of the replacement assumption | Pretraining-scale experiments; does not license unbounded synthetic accretion (tails can still dilute) | ABSTRACT_ONLY | **Rune's append-only ledger architecture is the collapse antidote**: derived data (lessons, summaries, embeddings) ACCUMULATES beside sources, never overwrites them. This converts a doom scenario into a design validation of what Rune already does (per #387: state + audit log) |
+| 25 | 2306.11644 | Textbooks Are All You Need (phi-1) | Gunasekar, Zhang, Mendes et al., 2023, Microsoft | Verified synthetic data for code | 1.3B model, textbook-quality filtered web (6B tokens) + **synthetic GPT-3.5 textbooks/exercises (1B tokens)**: 50.6% HumanEval pass@1, 55.5% MBPP — from 8 GPUs / 4 days; phi-1-small 350M still 45% HumanEval | Scale-dogma negative: 1.3B beat models 10× larger via data curation | HumanEval is small and leaky; function-level not repo-level | ABSTRACT_ONLY | The template for Rune's empty learning machinery: small model + bounded, exercise-shaped, verified synthetic data ≫ raw corpus. Rune's 152 deterministic modules are exactly the kind of verifiable "textbook exercise generator" the phi-line recipe needs |
+| 26 | 2412.08905 | (Phi-4 — see row 3) | — | Synthetic data throughout pretraining beats teacher | — | — | — | — | Cross-reference: synthetic data done at curriculum quality EXCEEDED the teacher on STEM (row 3). Synthetic data helps when: bounded, curriculum-structured, verified/filtered; corrupts when: recursive (#23), replacing (#24's replacement arm), unverified |
+
+### Topic 5 — Adaptive compute / cascading / routing
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 27 | 2211.17192 | Fast Inference from Transformers via Speculative Decoding | Leviathan, Kalman, Matias, 2022, Google, ICML 2023 | Speculative decoding | Hard tasks contain easy subtasks a small draft model handles; parallel draft + verification gives **2–3× acceleration on T5-XXL with IDENTICAL outputs** (lossless, distribution-preserving) | — | Needs draft/target alignment; speedup = f(acceptance rate, relative cost) | ABSTRACT_ONLY | Lossless local latency win for Rune: 3B drafts for 14B/27B targets, same-family (Qwen2.5 line covers 0.5B–14B — row 4). Zero quality risk, unlike every cascade/routing scheme |
+| 28 | 2302.01318 | Accelerating Large Language Model Decoding with Speculative Sampling | Chen, Borgeaud, Irving, Lespiau, Sifre, Jumper et al., 2023, DeepMind | Speculative sampling (formal) | Modified rejection sampling **provably preserves the target distribution** within hardware numerics; 2–2.5× speedup on Chinchilla 70B | — | Distributed-setup benchmark | ABSTRACT_ONLY | The formal guarantee Rune should demand of any local acceleration: distribution-preserving or it is a quality trade, not an optimization |
+| 29 | 2305.05176 | FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance | Chen, Zaharia, Zou, 2023, Stanford / Databricks | **ANCHOR — cascade evidence** | LLM cascade = generation scoring function g(q,a)∈[0,1] + router + per-step thresholds τ; query cheap LLMs first, escalate only when score < τ; headline: match GPT-4 quality with up to **98% cost reduction** or +4% accuracy at same cost; scored via a trained regression model on (query, answer); optimizer prunes candidate chains by answer disagreement | **Paper's own limitations:** (1) needs labeled examples **from the same/similar distribution as test queries**; (2) cascade training itself costs resources (framed as one-time, beneficial only if query volume is large); (3) shown failure mode: when chain members agree but are wrong, the scorer cannot tell → queries the whole chain anyway ("remains an open problem"); (4) evaluated on **classification/short-answer tasks** (HEADLINES gold-trend, OVERRULING legal sentences, CoQA) — NOT generation, coding, or agentic tasks | 2023 API-pricing economics (2-orders-of-magnitude price spread is the driver); scorer generalization unproven beyond in-distribution | **RELEVANT_SECTIONS** (mechanics, experimental setup, limitations sections verbatim) | For Rune the economics invert: local tokens are ~free, so the cascade's 98%-cost driver is irrelevant; what remains is (a) latency/VRAM pressure, (b) the scorer's requirement for **in-distribution labeled data** — which Rune's measured-growth machinery has not produced (0 measured deltas); (c) the agreement-but-wrong failure is worse locally because Rune's small models are MORE correlated (same-family ladders agree more). With #383's cascade overturn at n=924 (corpus level) and this anchor at query level, cascades are evidenced as an artifact of scale + economics Rune does not have |
+| 30 | 2406.18665 | RouteLLM: Learning to Route LLMs with Preference Data | Ong, Almahairi, Wu, Chiang et al., 2024, Berkeley | Model routing | Routers trained on human preference data pick strong-vs-weak model per query: **>2× cost reduction without compromising response quality** on their benchmarks; router transfers across strong/weak model pairs (test-time model swap) | Routing signal = trained on preference pairs, NOT intrinsic difficulty/confidence estimates — the router learns which queries the weak model loses on, from data | Preference-data-dependent; benchmarks are chat-style (MT-Bench/MMLU-class); no coding-agent tasks | ABSTRACT_ONLY | The working routing signal is **empirical per-query weak-model failure data**, not a priori difficulty. Rune has no preference/failure dataset (0 measured deltas) → any routing layer today would be untrained guesswork. Route to build: log (query, model, outcome) NOW; the router becomes trainable only after that dataset exists |
+| 31 | 2207.07061 | Confident Adaptive Language Modeling (CALM) | Schuster, Fisch, Gupta, Dehghani, Bahri, Tran et al., 2022, NeurIPS 2022 | Early exit | Per-token early exit with calibrated confidence + sequence-level constraints: up to ×3 compute reduction **with provable output-quality maintenance** | — | Generation tasks tested; provable maintenance is of a defined quality bound, not exactness | ABSTRACT_ONLY | The one adaptive-compute scheme with a maintenance guarantee — but it is an inference-engine feature (model-internals), not a policy layer Rune can bolt on; noted for completeness, rejected for Rune's stack |
+
+### Topic 6 — Classical ML vs LLM
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 32 | 2409.02136 | Large Language Models versus Classical Machine Learning: Performance in COVID-19 Mortality Prediction Using High-Dimensional Tabular Data | Ghaffarzadeh-Esfahani et al., 2024 | LLM vs classical ML head-to-head | n=9,134 patients, 4 hospitals, high-dimensional tabular: **XGBoost F1 0.87 / RF 0.83 (internal+external validation) vs GPT-4 zero-shot F1 0.43**; Mistral-7B zero-shot recall 1% (!); QLoRA finetuning lifted Mistral-7B recall 1%→79%, stable F1 0.74 external — still below classical ML | **GPT-4 zero-shot LOSES to XGBoost by 0.44 F1** on bounded structured-data classification; zero-shot Mistral-7B recall 1% = catastrophically miscalibrated out of the box | Medical domain; text-serialized tabular input is LLM-unfriendly by construction (that is partly the point) | ABSTRACT_ONLY | Strongest direct number for the arm's classical-ML verdict: for **bounded, labelled, structured tasks, 152 deterministic Python modules + classical models are not a stopgap — they are the SOTA**. LLM calls only become competitive after finetuning, and even then trail. Rune's deterministic modules should own: routing heuristics, dedupe, classification, drift signals |
+| 33 | 2207.08815 | Why do tree-based models still outperform deep learning on tabular data? | Grinsztajn, Oyallon, Varoquaux, 2022, NeurIPS 2022 | Classical vs neural benchmark | 45 datasets: tree models (XGBoost/RF) remain SOTA on medium-sized data (**~10K samples**) even ignoring speed; failure modes of NNs on tabular: uninformative features, non-smooth/irregular target functions, feature-orientation violation | Deep learning does NOT transfer its unstructured-data dominance to tabular at realistic (non-web) scales | Tabular only; text/LLM angles out of scope | ABSTRACT_ONLY | Rune's scale (n≈944 memory entries, hundreds of sessions) is ~10× BELOW the regime where trees already win: gradient boosting/logistic regression over hand-built features is the correct local tool for every bounded prediction task Rune has (lesson promotion, recall ranking priors, drift detection) |
+
+### Topic 7 — Retrieval as local capability (with carry-over)
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 34 | 1911.00172 | Generalization through Memorization: Nearest Neighbor Language Models (kNN-LM) | Khandelwal, Levy, Jurafsky, Zettlemoyer, Lewis, 2019, ICLR 2020 | Retrieval replacing learned generation | kNN interpolation over a datastore: +2.9 ppl (SOTA 15.79 on Wikitext-103) **with no additional training**; biggest gains on rare patterns/factual knowledge; domain adaptation by swapping the datastore, no retraining | "Learning similarity is easier than predicting" — the LM itself need not internalize the long tail | Next-token distribution only; datastore scale-dependent; 2019-era model | ABSTRACT_ONLY | The conceptual charter for Rune's retrieval-first stance: **factual/long-tail cognition can live in retrieval, not parameters.** Combined with #383 (score-everything at n≈924) and #403 (multi-vector visual lanes + versioned embeddings), retrieval is the ONE local-intelligence pillar with positive evidence at every scale Rune operates |
+| 35 | — carry-over #383 (IR domain, R1_QUALIFIED) | research/memory-atlas-r1/H-information-retrieval/ | — | Cascade overturned at corpus scale | **CASCADE OVERTURNED at n=924**: exhaustive scoring beats every pruning stage (0.9 MB corpus, microsecond-fast); RRF → weighted linear combination (Bruch TOIS 2024); abstention→generation sufficiency gating; ANN deleted (crossover ≥10⁵); dense lane unproven at <1k docs — keep but self-measure | — | — | (sealed prior) | Retrieval without generation at Rune's scale is settled: BM25 + metadata + dense, fused by weighted combination. Any local "routing" instinct must re-justify itself against score-everything |
+| 36 | — carry-over #403 (Arm 2, AB arms) | checkpoint-403-ab-arms-findings.md | — | Multi-vector lanes + versioning | Visual dense lane must be late-interaction multi-vector (vanilla SigLIP 51.4 / Jina-CLIP 17.7 LOSE to BM25-on-OCR 65.5); ColPali↔ColQwen2 >5-point nDCG shift on identical data → **model+version stamping per lane mandatory**; 944 pages ≈ 0.5 GB multi-vector, millisecond MaxSim | — | — | (sealed prior) | The versioned-embedding mandate applies to Rune's 3 embedders NOW: nomic-embed 256-d Matryoshka vectors are UNVERSIONED — silent-degrade-when-Ollama-down is the same defect class |
+
+### Topic 8 — Hybrid symbolic/neural, verifiers, constrained decoding
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 37 | 2203.07814 | Competition-Level Code Generation with AlphaCode | Li, Choi, Chung, Kushman, Schrittwieser et al., 2022, DeepMind, Science 2022 | Verifier-guided generation at scale | Top 54.3% average on Codeforces (>5,000 participants); the three critical components: (1) large-scale sampling, (2) **execution-based filtering against example tests**, (3) behavior clustering for submission selection | Single-shot generation performs poorly on complex unseen problems — reliability came from the verifier loop, not raw model skill | Enormous sample counts (10⁵-scale generations) — compute profile beyond per-turn local use | ABSTRACT_ONLY | The charter for verifier-guided local coding: Rune's 152 deterministic modules + tests are the execution oracle. Small models + test-filtered sampling is the evidenced reliability mechanism at function level; repo-scale remains open (row 5) |
+| 38 | 2305.20050 | Let's Verify Step by Step | Lightman, Kosaraju, Burda, Edwards, Baker, Lee et al., 2023, OpenAI | Process supervision / verifiers | **Process supervision (per-step feedback) significantly outperforms outcome supervision** on MATH; process-supervised model solves 78% of a representative MATH subset; active learning improves verifier data efficiency; PRM800K released | Outcome-only supervision (final-answer check) is the weaker signal | Math domain; human-labeled steps (expensive to reproduce locally) | ABSTRACT_ONLY | Lesson/outcome logging design: record **step-level** traces, not just success/final answers — per-step grading is the evidenced-superior supervision signal, and Rune's turn/step ledger already captures the substrate |
+| 39 | 2109.05093 | PICARD: Parsing Incrementally for Constrained Auto-Regressive Decoding from Language Models | Scholak, Schucher, Bahdanau, 2021, EMNLP 2021 | Incremental-parse constrained decoding | Rejecting inadmissible tokens via incremental parsing turns passable T5 text-to-SQL models into **state-of-the-art** on Spider/CoSQL — validity constraints convert weak models into usable ones | — | Formal target language (SQL) — where constraints are verifiable; 2021-era models | ABSTRACT_ONLY | Positive pole of constrained decoding: for outputs with a real grammar (SQL, JSON matching a schema with semantics, tool-call syntax), constraint decoding is a capability GAIN at small scale |
+| 40 | 2408.02442 | Let Me Speak Freely? A Study on the Impact of Format Restrictions on Performance of Large Language Models | Tam, Wu, Tsai, Lin, Lee, Chen, 2024 | **Format constraints vs reasoning (family-file anchor — verified)** | Format restrictions (JSON/XML output, incl. JSON-mode) cause **significant decline in reasoning ability**; **stricter constraints → greater degradation**; the family file's reading is CONFIRMED at abstract level: reasoning tasks most affected | — | Eval suite is reasoning/QA-heavy; per-task-class severity ordering ("extraction least affected") is in the paper's interior, NOT re-read at FULL depth this pass — carried from family file, flagged honestly | ABSTRACT_ONLY (id re-verified; interior carried) | Confirms: GBNF for reasoning-heavy steps (planning, multi-step debugging) = self-inflicted handicap; GBNF for extraction/typing = near-free validity |
+| 41 | 2509.21791 | Quantifying the Impact of Structured Output Format on Large Language Models through Causal Inference | Yuan, Zhao, Zhang, Luo, Ma, 2025 | Causal analysis of format effects | Prior studies conflict; causal-inference framing derives five possible causal structures; across 7+1 reasoning tasks, **coarse metrics report positive, negative, or neutral effects of structured output** — the apparent effect is often confounded (collider/m-bias structures); effects are task- and metric-dependent | The blanket "format hurts" claim (#40) is NOT causally clean: some of the measured harm is confounding, and direction varies by metric/task | GPT-4o-era; still reasoning-task-centric | ABSTRACT_ONLY | Extension of the family-file finding: the correct posture is **per-task-class empirical measurement** (Rune's local eval harness — #403 forced-correction #8), not a global "never constrain" or "always constrain" rule |
+| 42 | 2605.26128 | The Constraint Tax: Measuring Validity-Correctness Tradeoffs in Structured Outputs for Small Language Models | Ray, 2026 | Constraint tax at sub-3B | 15,000 generations, Qwen2.5-0.5B/1.5B, SmolLM2-1.7B: hard answer-only schema decoding raises schema validity **61.5%→100%** but lowers answer accuracy **19.7%→11.0%** and raises wrong-but-valid-schema outputs **49.5%→88.9%**; "the usual engineering assumption is unsafe for small models" | The industry assumption "hard constraints improve reliability without changing the answer" REFUTED at small scale — the constraint tax is largest exactly where Rune's small tier lives | Preprint (2026); Qwen2.5/SmolLM2 families; answer-only schema focus | ABSTRACT_ONLY | The most Rune-specific number in this ledger: at ≤2B, unconstrained answer accuracy 19.7% halves under a hard schema. Rule: constrain the FORMAT of extraction fields only; never let the schema gate the ANSWER space of a reasoning step; validate-after-generate beats generate-under-mask for small models on hard tasks |
+
+---
+
+## 2. Synthesis
+
+### 2.1 What task classes are provably local-viable at what quality (Rune hardware, ≤14B/27B-IQ2M tier)
+
+**PROVABLY VIABLE (multiple converging sources, with numbers):**
+
+1. **Bounded classification / routing / API-call-style invocation** — MobileLLM 125–350M ≈ LLaMA-v2-7B on API-calling tasks (row 1); Distilling-step-by-step: 770M T5 > few-shot 540B PaLM on NLP tasks with rationale supervision (row 19). Rune's 3B tier is over-provisioned for this class. Quality ceiling: with local labelled data, classical models are better still (see #32).
+2. **Structured extraction** — least affected by format constraints (row 40, family-file finding confirmed); constrained decoding is a validity *gain* here. Caveat: at sub-3B, even extraction schemas carry a measurable tax (19.7%→11.0% under answer-gating; row 42) — constrain field formats, not the answer space.
+3. **Function-level coding (generation, completion, repair)** — Qwen2.5-Coder 7B/14B SOTA-at-size across 10+ benchmarks incl. repair (row 5); phi-1 1.3B hit 50.6% HumanEval via verified synthetic data (row 25). Reliability multiplier: execution/test filtering (AlphaCode, row 37) — Rune's 152 deterministic modules are the oracle.
+4. **Math/multi-step reasoning — CONDITIONAL, two regimes:** (a) specialized 3–14B can reach 60B-class on the trained domain via CoT distillation (row 20) — but at the cost of total loss of generic CoT (BBH → 0) and OOD fragility; (b) quantized below 4-bit, reasoning is the FIRST casualty (rows 14, 15).
+5. **Retrieval-grounded factual cognition** — kNN-LM: long-tail knowledge lives in the datastore, not parameters (row 34); at n≈924 score-everything is settled (row 35). This is Rune's highest-quality local capability and needs no generation at all.
+6. **Summarization/translation-class generation** — GKD's demonstrated task set (row 21); quality at 7–14B adequate but unverified at 2-bit quantization.
+
+**PROVABLY NOT LOCAL-VIABLE (negative evidence, with numbers):**
+
+1. **High-dimensional structured/tabular prediction by LLM** — GPT-4 zero-shot F1 0.43 vs XGBoost 0.87 (row 32); classical ML wins up to and beyond ~10K samples (row 33). Rune's deterministic modules own this class.
+2. **Repo-scale / multi-file agentic coding at ≤14B** — NO benchmark in any technical report evaluated this (rows 4, 5); the evidence vacuum is the finding. Do not assume Qwen2.5-Coder-14B SOTA transfers beyond function-level.
+3. **Generic multi-domain reasoning in a small specialized model** — specialization strictly trades generic CoT away (BBH → 0, row 20); a Rune fine-tuned on coding lessons will lose breadth measurably.
+4. **Complex reasoning under aggressive quantization** — 4-bit activations = collapse (−10.9 to −59.7, row 14); naive ternary PTQ = collapse on math/coding (row 15); harder tasks degrade up to 4× more (row 14).
+
+### 2.2 The quantization task-sensitivity verdict
+
+**Loss is NOT uniform; it is task-, difficulty-, size-, origin-, and calibration-sensitive.** Evidence: harder tasks degrade up to 4× more (AIME −3.9% vs GSM8K −0.0% at 32B W4A4KV4); 7B loses 5.4–6.3 avg points at 3-bit where 14B loses 4.5–6.2 and 1.5B loses 7.6–18.6 (same methods, row 14); model family changes which quant type hurts (row 14 §3.5); GPTQ calibration domain alone swings ±9.8 avg points (row 14 §4.2), confirmed in the GGUF ecosystem by imatrix-input sensitivity (row 17); reasoning traces as calibration context rescue ternary PTQ from collapse (row 15).
+
+**The Rune key question — 27B IQ2_M vs 7–8B Q4 — has NO direct published head-to-head (bounded zero-hit; do-not-cite register).** What the evidence supports:
+- Against 27B IQ2_M: IQ2_M sits below every tested config in row 14 (their floor: 3-bit weight-only, where a 7B already loses 5.4–6.3 avg points and a 1.5B loses 18.6); row 15 shows the 2-bit PTQ regime collapses on math/coding without reasoning-aware calibration; row 13 confirms modern 15T-token models still degrade non-trivially at low bits; row 12's ternary parity requires training-from-scratch, not PTQ.
+- For 27B IQ2_M: the only measured support is the size-scaling law — at EQUAL model size, large-quantized beats small-BF16 (3-bit 32B ≈ 7B-BF16 size, +17% on LiveCodeBench; row 14 §4.3). But this was measured at 3-bit, and its extrapolation to 2-bit is untested. Also 6-bit ppl within 0.1% of fp16 (row 16) marks where the "safe" band ends.
+- **Working verdict: the evidence supports preferring 4-bit 7–14B for reasoning/coding task classes, and keeping a 27B IQ2_M only if locally measured (per-task deltas on Rune's own harness) shows it survives 2-bit where it matters. Row 7 adds a live alternative: a newer 4B–7B at Q4/Q5 may match the prior-gen 27B outright.**
+
+### 2.3 The distillation error-transmission verdict
+
+**Distillation transmits all three — capability, teacher errors, and stylistic imitation — and the mixture is task- and regime-dependent:**
+
+1. **Capability transmits, but as a trade, not a copy.** CoT distillation into ≤11B matches 60B-class on the trained domain (row 20); phi-4's synthetic-data recipe even EXCEEDED the teacher on STEM (row 3). But specialization instantly zeroed generic CoT (BBH→0) — capability is moved, not duplicated.
+2. **Teacher errors transmit.** Hallucination-in-KD is an acknowledged, machine-patched problem (DualChecker, row 22); there is NO systematic quantification of hallucination inheritance in the literature (title-level search: zero exact "hallucination inheritance" papers — bounded zero-hit). Distribution mismatch means the student learns on teacher outputs but executes on its own — GKD's entire motivation (row 21).
+3. **Stylistic imitation is the default failure mode.** Off-policy KD = imitating teacher surface forms; on-policy (GKD) + rationale-level supervision (Distilling-step-by-step) are the evidenced countermeasures (rows 19, 21); DeepSeek-R1 shows RL-on-own-outputs beats SFT-on-teacher-demos for reasoning (row 6).
+
+**Rune rule:** grade the agent's own behavior (contrastive with/without — #382's gate), never imitate transcripts; hold out OOD probes before trusting any distilled lesson (row 20's model-selection lesson); expect in-domain gain with measurable out-of-domain cost.
+
+### 2.4 The cascade/routing evidence verdict
+
+**Cascades and routing are artifacts of two conditions Rune lacks — API economics and scale — and both legs are now evidence-closed:**
+
+- **Corpus level (#383, sealed):** cascade overturned at n=924; score-everything wins because the corpus is microsecond-cheap to score exhaustively.
+- **Query level (row 29, this arm):** FrugalGPT's 98% saving is a *pricing-spread* phenomenon (2023 API landscape, 2-orders-of-magnitude fee differences). Its paper-stated requirements — in-distribution labeled data for the scorer, one-time training cost amortized only over large query volume — are unmet by Rune (0 measured growth deltas). Its own named failure — chain members agree but are wrong → full chain queried anyway — is *amplified* locally, because Rune's same-family model ladder is more correlated than heterogeneous APIs.
+- **Routing (row 30):** the working signal is empirical weak-model-failure data from preference/failure logs, not intrinsic difficulty or raw confidence. RouteLLM's >2× cost cut required trained routers on human preference data. Without Rune's outcome logs, routing is untrained guesswork.
+- **What survives:** speculative decoding (rows 27–28) — the ONLY adaptive-compute mechanism with lossless distribution-preservation and 2–3× measured speedup; it needs no policy, no scorer, no data, just a same-family draft model (Qwen2.5 line: 0.5B/1.5B/3B drafts for 14B targets). Early-exit (CALM, row 31) has a maintenance guarantee but is engine-internal — rejected for Rune's stack.
+
+**Verdict: no cascade/routing policy for Rune now. Log (query, model, outcome) from today — a router becomes trainable only after that dataset exists, and corpus-level routing should never exist at n≈944.**
+
+### 2.5 Retrieval, classical ML, verifiers — the local capability stack
+
+The convergent architecture the evidence supports for one workstation: (1) **retrieval does the remembering** (score-everything, multi-vector lanes, versioned embeddings — rows 34–36); (2) **deterministic modules + classical ML do the deciding** on bounded structured tasks (rows 32–33); (3) **small/quantized LLMs do the generating** — function-level code, extraction, bounded reasoning — under execution-based verification (rows 5, 25, 37) and process-level grading (row 38); (4) **constraints applied selectively**: grammar masks for extraction/validity, free generation for reasoning, validate-after-generate elsewhere (rows 39–42); (5) **derived data accumulates, never replaces** (row 24) — Rune's append-only design is the model-collapse antidote; (6) **any model change re-measures** — version stamping (row 36) and per-task local deltas (rows 14, 41) are the same discipline.
+
+---
+
+## 3. Rejected approaches
+
+| Rejected transfer | Why (evidence) |
+|---|---|
+| **LLM cascade / escalation chains over Rune's local models** | Economics inverted (local tokens ~free); scorer needs in-distribution labels Rune lacks; agree-but-wrong failure amplified by same-family correlation (row 29); corpus-level cascade already overturned at n=924 (#383) |
+| **Routing policy built now** | Requires preference/failure-trained router (row 30); Rune has 0 measured deltas → build the log, not the router |
+| **"Ternary is fine because BitNet works"** | BitNet parity requires training-from-scratch QAT (row 12); PTQ ternarization collapses on math/coding absent reasoning-aware calibration (row 15); IQ2_M is PTQ |
+| **Assuming 27B IQ2_M > 7–8B Q4 without local measurement** | Below every tested quant config in the systematic study (row 14); no direct benchmark exists (zero-hit); newer 4B ≈ prior-gen 27B at IT level (row 7) — the default should be measured, not assumed |
+| **Hard schema/GBNF gating of reasoning outputs, esp. at ≤3B** | Constraint tax measured: validity 61.5→100% but accuracy 19.7→11.0%, wrong-but-valid 49.5→88.9% at small scale (row 42); reasoning declines under strict format (row 40); even the "format always hurts" reading is causally confounded (row 41) → per-task-class local measurement only |
+| **LLM-as-router / LLM-as-classifier over structured data** | GPT-4 0.43 F1 vs XGBoost 0.87 (row 32); trees win at Rune-adjacent and larger scales (row 33); deterministic modules own this |
+| **One-shot generic CoT distillation into Rune's small tier (imitating teacher transcripts)** | Off-policy distribution mismatch (row 21); instant generic-CoT loss (row 20); teacher-error propagation unpatched without checking machinery (row 22); on-policy/contrastive grading is the evidenced alternative |
+| **Recursive self-improvement that overwrites real/verified data** | Model collapse under replacement (row 23); accumulate-only is the evidenced-safe regime (row 24) |
+| **Early-exit / CALM-style adaptive depth in Rune's stack** | Engine-internal mechanism with maintenance guarantee (row 31) — not implementable as a policy layer over Ollama; speculative decoding covers the lossless-latency need |
+| **Trusting vendor benchmark aggregates ("rivals GPT-3.5", "comparable to Gemini-1.5-Pro") as local quality estimates** | Aggregate composite claims (rows 2, 7) are contaminated/familiar benchmarks and vendor-measured; the ONLY transferable numbers are per-task deltas measured on Rune's harness |
+
+## 4. Do-not-cite register
+
+| Item | Status |
+|---|---|
+| **2510.05040 as "model collapse successor"** | MIS-PAIRED — verified as "Test-Time Scaling in Diffusion LLMs via Hidden Semi-Autoregressive Experts" (2025-10-06). Do not cite for model collapse. (Correct lineage: 2305.17493 + 2404.01413.) |
+| **2402.04937 as BitNet** | MIS-PAIRED — verified as COVID long-haul study. BitNet b1.58 = 2402.17764 (verified). |
+| **2109.05074 as PICARD** | MIS-PAIRED — verified as FBERT (offensive-content classifier). PICARD = 2109.05093 (verified). |
+| **"Hallucination inheritance" / "distillation hallucination inheritance" as an established, quantified phenomenon** | Bounded zero-hit: exact-title search returned no dedicated measurement paper. Cite only the piecemeal evidence (2408.12326; GKD's distribution mismatch) with that framing — never "hallucination inheritance is X%." |
+| **A direct 27B-IQ2_M vs 7-8B-Q4 per-task-class benchmark** | Bounded zero-hit — no such published head-to-head found at any depth. All verdicts on this question are extrapolations (3-bit/1.58-bit bracketing + size-scaling law), and must be labeled as such. |
+| **Effective bpw of GGUF IQ2_M (~2.5–2.7)** | Ecosystem knowledge, NOT audited this pass (k-quants PR predates IQ quants). Re-audit before citing a specific figure. |
+| **"Extraction least affected by format constraints" as a re-read finding** | Interior claim of 2408.02442 carried from the family file; only title/abstract re-verified this pass. Cite with provenance note until the interior is re-read. |
+| **MobileLLM "mechanical-op class" characterization** | The prompt's gloss ("mechanical-op class") does not appear in the verified abstract; the paper's claim is architecture-optimization + API-calling parity. Cite the verified claims only. |
+| 2608.21366 (model-collapse survey), RETRO 2112.04426, CALM-adjacent successors | Considered, dropped from the ledger (redundant or out of Rune's implementable surface); do not cite this arm for them. |
+
+**Read-depth tally (42 ledger rows incl. 2 documentation + 2 carry-overs; 36 unique external sources):**
+RELEVANT_SECTIONS 3 (2504.04823, 2305.05176, 2301.12726) · DOCUMENTATION_AUDITED 2 (llama.cpp PR #1684, discussion #5263) · ABSTRACT_ONLY 31 · METADATA_VERIFIED 0 (all abstract-level entries went through the export API with abstracts read, so none are metadata-only).
+
+**Verification method note:** all IDs resolved via `export.arxiv.org/api/query` (title + date + authors) per the #403 atlas-wide lesson; 4 mis-pairings caught (all in the prompt's own ID list, 0 in this arm's independent searches — export-API title search used throughout).

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm2_agent_architecture.md

@@ -0,0 +1,504 @@
+# Memory Research Atlas R1 — Domain #404 AC (Offline / Local Intelligence)
+## Arm 2 of 4 — AGENT / COGNITIVE ARCHITECTURE
+
+**Scope owned by this arm:** cognitive architectures (classic → current); planner/executor + hierarchical control; model-independent state; graceful degradation / offline agents; capability discovery / registries; tool-based intelligence; specialist ensembles + modular stacks; bounded test-time compute. **Explicitly out of scope (arm 1 / other arms):** quantization task-sensitivity, distillation, cascade/routing policy at n≈924, speculative decoding, classical ML for bounded tasks, model collapse.
+
+**Rune baseline assumed (not re-derived here):** stateful coding agent, one workstation (RTX 4070 Ti SUPER 16GB, 62GB RAM), Ollama + 11 models, 152 deterministic Python modules, model-independent state (SQLite Memory 944 entries / 118k chunks, task/resume state, skill store). Known gaps: no routing/cascade policy, no capability registry, no degraded-mode communication, silent embedding degradation when Ollama is down.
+
+---
+
+## 0. Method and verification discipline
+
+- Every arXiv ID was resolved through `export.arxiv.org/api/query` (Atom metadata) before being cited. Titles, first authors and abstracts were read from the API response; where marked deeper, the full HTML was read.
+- **Three IDs supplied by the #404 arm-2 prompt were mis-paired and are NOT what the prompt claimed:**
+  - `2409.02409` given as *CoALA* → resolves to *"Microscopic, mesoscopic, and macroscopic descriptions of the Euler alignment system…"* (Shvydkoy & Teolis, math.AP). **Correct CoALA ID: `2309.02427`.**
+  - `2203.07154` given as *self-consistency* → resolves to *"Materials for Future Calorimeters"* (physics). **Correct ID: `2203.11171`.**
+  - `2305.18365` given as *ReWOO* → resolves to *"What can Large Language Models do in chemistry?…"*. **Correct ID: `2305.18323`.**
+  - Two further candidates I proposed myself (`2408.08611` for StateFlow, `2412.10197` for overthinking) also failed verification → corrected to `2403.11322` and `2412.21187`. This arm-2 prompt therefore carried 3 (not 4) mis-paired IDs; all are corrected and registered in §4.
+- **Read-depth vocabulary used:** `FULL_PAPER` (entire paper read), `RELEVANT_SECTIONS` (the load-bearing sections read in full, remainder skimmed), `DOCUMENTATION_AUDITED` (official docs fetched and read), `ABSTRACT_ONLY` (Atom abstract + metadata only; no section-level claim asserted), `METADATA_VERIFIED` (title/authors only).
+- **Claims asserted at section depth in this report are only from** `2309.02427`, `2310.08560`, `2402.01817`, `2210.03629`, `2408.03314`, `2407.21075` (+ the five doc sets). Everything else is abstract-level and labelled as such; unverifiable claims are quarantined in §4.
+- Venue/year tags: year is the arXiv year from metadata; a venue is named only where the paper's own metadata/abstract states it or where it is unambiguous (e.g. "Position:" ICML paper, TMLR-listed CoALA). Otherwise "arXiv".
+
+**Source count:** 34 papers/position papers + 5 documentation sets = **39 numbered sources** (34 papers sits inside the 25–35 target band), plus one unnumbered critique reference (`2506.09250`).
+
+---
+
+## 1. Per-source rows
+
+### Group A — Cognitive architectures (classic → current)
+
+**[S01] `2309.02427` | Cognitive Architectures for Language Agents (CoALA)**
+- Authors / venue: Sumers, Yao, Narasimhan, Griffiths — Princeton; arXiv 2023 (TMLR-listed, v3).
+- Topic: architectural taxonomy for language agents built from cognitive-architecture heritage (production systems, Soar).
+- Key claims: an agent is organized along three dimensions — **memory** (working + long-term episodic/semantic/procedural), **action space** (external *grounding*; internal *retrieval*, *reasoning*, *learning*), **decision-making** (a repeated decision cycle with a planning stage — propose/evaluate via reasoning+retrieval — then an execution stage that emits a grounding or learning action, then loop). Working memory is a *data structure that persists across LLM calls*; the LLM input is synthesized from a subset of it and the output is parsed back into variables. Procedural memory has two forms: *implicit* (LLM weights) and *explicit* (the agent's code), and the code splits into action procedures and **the decision-making procedure itself**. Soar heritage: productions in procedural memory, working-memory matching, proposal/evaluation/selection, and an **impasse → subgoal** mechanism that yields hierarchical task decomposition.
+- Negative results: classical cognitive architectures fell out of favour because they are "limited to domains that can be described by logical predicates and require many pre-specified rules"; writing new *decision-making* procedures is flagged as "significantly riskier… can easily introduce bugs or allow an agent to subvert its designers' intentions", and the authors state **no language agents implement this form of learning**; unlearning (modifying/deleting memory) and adaptive retrieval are named as understudied.
+- Limitations: conceptual framework — organizes existing work, contributes no new empirical measurements; no cost analysis of the memory/action decomposition.
+- Read depth: `RELEVANT_SECTIONS` (§1–§4.6 and §6 read in full; §5 case studies and §7–8 skimmed).
+- Rune relevance: **the closest published blueprint to what Rune already is.** Rune's 152 deterministic modules ≈ explicit procedural memory; SQLite (944 entries / 118k chunks) ≈ semantic + episodic memory; the per-call prompt ≈ working memory assembled from a subset. What Rune is missing per this taxonomy is (a) an explicit, named *decision procedure* module, and (b) a declared internal/external action boundary. The paper's safety caveat is directly load-bearing for Rune: never let Rune rewrite its own decision procedure or module code; learning should write to episodic/semantic memory (SQLite) only.
+
+**[S02] `2310.08560` | MemGPT: Towards LLMs as Operating Systems**
+- Authors / venue: Packer, Wooders, Lin et al. (UC Berkeley) — arXiv 2023.
+- Topic: OS-style virtual context management; memory-as-a-module; the Letta lineage.
+- Key claims: two tiers — **main context** (= prompt tokens: read-only system instructions, read/write **working context** writable only via function calls, and a FIFO queue of messages) and **external context** (recall storage = message DB, archival storage = arbitrary-length text). A **queue manager** enforces the paging policy in the runtime, not in the model: a *memory-pressure warning* system message is injected at ~70% of the context window so the agent can save state; at 100% the queue is flushed (evict ~50%) and a **recursive summary** is generated; evicted messages remain readable via function calls. Control flow: **events** (user messages, system warnings, timed/scheduled events) trigger inference; a `yield` flag decides whether the processor resumes immediately or waits for the next event, i.e. interrupts govern control flow between system and model. Errors from tool calls (e.g. writing past capacity) are fed back to the processor.
+- Negative results: "**MemGPT has significantly degraded performance using GPT-3.5, due to its limited function calling capabilities**" — the memory system's quality is a function of the model's function-calling quality, i.e. memory management delegated to the model is not model-independent; observed failure mode "failing to perform enough lookups"; document QA is bounded by "the limitations of embedding-based similarity search"; nested key-value retrieval degrades (GPT-3.5 → 0% at 1 nesting level; GPT-4 → 0% by 3 nesting levels), while MemGPT+GPT-4 holds.
+- Limitations: evaluations are two domains (multi-session chat, document QA) with modest baselines; the OS analogy is design inspiration, not a formal guarantee; long-context baselines are given lossy summaries, which flatters the comparison.
+- Read depth: `RELEVANT_SECTIONS` (design §2, control flow, results, failure-mode discussion).
+- Rune relevance: **the single most useful counter-example for Rune's design.** MemGPT puts the *paging policy* in code (queue manager, thresholds, eviction, summarization) but puts *what to remember* in the model — and the paper documents that this degrades with a weaker local model. Rune runs 11 local models of varying capability, so Rune should implement the queue/eviction/threshold policy deterministically (which it largely does) and must **not** gate memory correctness on model function-calling quality. The interrupt + timed-event model is also the right shape for Rune's scheduler-driven work.
+
+**[S03] `2402.01817` | Position: LLMs Can't Plan, But Can Help Planning in LLM-Modulo Frameworks**
+- Authors / venue: Kambhampati, Valmeekam, Guan, Verma, Stechly, Bhambri, Saldyt, Murthy (ASU) — ICML 2024 position paper (v3).
+- Topic: what must live outside the model; generate–test–critique with external verifiers.
+- Key claims: autoregressive LLMs "cannot, by themselves, do planning or self-verification (which is after all a form of reasoning)"; they should be treated as **universal approximate knowledge sources** and candidate generators. Evidence: best LLM (GPT-4) produces only ~12% executable/goal-reaching plans in autonomous mode on PlanBench; obfuscating action/object names degrades LLMs while leaving classical planners unaffected (⇒ approximate retrieval of plans, not planning); chain-of-thought and ReAct-style prompting "largely ineffective" for planning; fine-tuning "does not seem to have a major effect". Verification: LLMs are "no better at verifying solutions" (graph coloring); iterative self-critique does not beat the baseline and is *worse* in practice because the system "can't recognize a correct coloring and thus merrily passes over fortuitously correct colorings it has generated". Proposed architecture: **Generate–Test–Critique** loop — LLM proposes candidates; a bank of **hard (sound, model-based) critics** plus **soft (style) critics** evaluate; a **Meta/Backprompt Controller** sits outside the LLM and pools critiques; *soundness of the compound system is inherited from the hard critics only*; completeness depends on the LLM's candidate coverage. Humans are deliberately excluded from the inner loop (iterative prompting has a "Clever Hans" effect) and used only to elicit domain models.
+- Negative results: the whole §2 is a negative-results section (autonomous planning, self-verification, self-improvement via self-generated data, and the "LLM-as-translator-only" over-correction which the authors also reject); ToT is characterized as prompt priming over a problem-specific tree rather than real search.
+- Limitations: position paper, planning-domain focus; assumes someone can build a sound hard critic per domain (cost is acknowledged but not quantified); PlanBench results are 2023–24-era models.
+- Read depth: `RELEVANT_SECTIONS` (§1, §2.1–2.3, §3.1–3.4 in full; §4 case studies and §5 skimmed).
+- Rune relevance: **the architectural verdict for Rune in one paper.** Rune's 152 deterministic modules *are* the hard critics; the LLM must be a candidate generator and a natural-language front end. Two operational rules follow: (1) a proposed plan/edit is never accepted without a deterministic check (tests, type check, schema validation, exit code); (2) the model's own self-critique must never be the acceptance gate, and escalation must be driven by critic output, not model confidence.
+
+**[S04] `2210.03629` | ReAct: Synergizing Reasoning and Acting in Language Models**
+- Authors / venue: Yao, Zhao, Yu, Du, Shafran, Narasimhan, Cao — ICLR 2023.
+- Topic: interleaved thought/action/observation loop — the canonical planner-executor loop.
+- Key claims: interleaving reasoning traces with task-specific actions improves over reasoning-only and acting-only baselines; on HotpotQA/Fever, ReAct reduces hallucination and error propagation relative to chain-of-thought by grounding in a Wikipedia API; human-in-the-loop editing of a single thought can change behaviour drastically; the authors build a **hand-coded hybrid switching rule**: ReAct→CoT-SC when ReAct fails twice, CoT-SC→ReAct when CoT-SC answers are inconsistent (best combined result).
+- Negative results (from the paper's own failure-mode analysis, §3.3): ReAct has a *higher reasoning-error rate* than CoT (47% vs 16% of labelled failure modes) while CoT has a higher hallucinated-trace rate (14% vs 6%); the **ReAct-specific frequent failure is repetitively regenerating previous thoughts and actions and failing to "jump out of the loop"**; acting-only agents fail to decompose goals and lose track of environment state.
+- Limitations: PaLM-540B-era prompting; results benchmark-specific; requires an external API (the grounding tool) to work at all.
+- Read depth: `RELEVANT_SECTIONS` (abstract, §3.3 failure-mode table and analysis, hybrid switching heuristics, appendix failure examples).
+- Rune relevance: two directly actionable facts. (1) **Loop detection must be deterministic code in Rune** — the most common ReAct failure is a repetition loop the model cannot see. (2) The ReAct/CoT-SC switch is a *precedent for an escalation signal that is externally computed* ("failed twice", "samples disagree") rather than introspected.
+
+### Group B — Planner/executor and hierarchical control
+
+**[S05] `2305.04091` | Plan-and-Solve Prompting**
+- Authors / venue: Wang, Xu, Lan et al. — ACL 2023.
+- Topic: plan-then-execute at the prompt level.
+- Key claims: zero-shot "devise a plan, divide the task into subtasks, then carry them out" improves over Zero-shot-CoT; names three CoT pitfalls (calculation errors, missing-step errors, semantic misunderstanding) and targets the missing-step class.
+- Negative results: does not fix calculation errors or semantic misunderstanding (paper's own framing of what it does not address).
+- Limitations: single-pass plan, no execution feedback, no replanning; purely textual verification.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: cheap, model-independent-in-shape (a plan artifact stored in state), but with no execution feedback it is exactly the pattern S03 shows to be unsound on its own. Use as a *planning aid* whose output is then validated by modules.
+
+**[S06] `2305.18323` | ReWOO: Decoupling Reasoning from Observations**
+- Authors / venue: Xu, Peng, Lei et al. — arXiv 2023.
+- Topic: plan-all-tool-calls-up-front vs interleaved reasoning.
+- Key claims: modular planner/worker/solver split; detaching reasoning from observations "significantly reduc[es] token consumption" and redundant prompt/execution overhead vs interleaved ReAct; evaluated across six NLP benchmarks.
+- Negative results: by construction, plans are made *without* observations — blind to intermediate tool results (the paper's own trade-off); no adaptive replanning in the base design.
+- Limitations: efficiency-motivated; a single-workstation Rune does not face the token-cost pressure that motivates it.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the *modular separation* (planner module, executor module, solver module) is worth copying structurally; the "reason without observing" property is a state-safety hazard for Rune (stale assumptions about files/repo state) and should not be adopted as a control-flow default.
+
+**[S07] `2304.11477` | LLM+P**
+- Authors / venue: Liu, Jiang, Zhang, Liu, Zhang, Biswas, Stone — arXiv 2023.
+- Topic: LLM + classical planner hybrid.
+- Key claims: LLM translates a natural-language problem into PDDL, a classical planner returns a correct/optimal plan, the LLM translates back; the paper's premise is that LLMs "cannot reliably solve long-horizon planning problems" whereas classical planners can once the problem is formalized.
+- Negative results: correctness is contingent on the translation being faithful; the LLM remains the weakest link (as a translator).
+- Limitations: requires a PDDL domain per task family; no treatment of translation-error detection.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: for any bounded, well-specified Rune task (scheduling, dependency ordering, resource allocation) the right split is *model translates ↔ deterministic solver decides*. This is a narrower, sounder alternative to "let the LLM plan".
+
+**[S08] `2311.05772` | ADaPT: As-Needed Decomposition and Planning with Language Models**
+- Authors / venue: Prasad, Koller, Hartmann et al. — arXiv 2023 (NAACL 2024).
+- Topic: hierarchical decomposition driven by observed execution failure.
+- Key claims: both iterative executors and plan-and-execute pipelines fail on complex tasks because "the inability to execute any sub-task may lead to task failure"; ADaPT recursively decomposes **only when the LLM is unable to execute a sub-task**, adapting to both task complexity and model capability; substantially outperforms strong baselines.
+- Negative results: the failure mode of the two standard control policies (all-or-nothing sub-task success) is itself the negative finding.
+- Limitations: the decomposition trigger is the LLM's own judgement of its inability; recursion cost is unbounded in the worst case.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: adopt "decompose on observed failure" — but substitute a deterministic trigger (module exit code / test failure / schema error) for the model's self-report, because S03 (and S32's difficulty analysis) show self-assessment is not a reliable trigger.
+
+**[S09] `2403.11322` | StateFlow: State-Driven Workflows for LLM Task-Solving**
+- Authors / venue: Wu, Yue, Zhang et al. — arXiv 2024.
+- Topic: explicit state machine as the control substrate.
+- Key claims: separates "process grounding" (states and transitions, i.e. control) from "sub-task solving" (actions inside a state); a state represents the status of a running process; transitions are controlled by **heuristic rules or LLM decisions**; actions within a state may be LLM calls with different prompts *or external tools*; improves control and interpretability.
+- Negative results: none claimed; the residual risk is that transitions may still be LLM-decided.
+- Limitations: workflow must be hand-authored per domain; no guarantees when the transition policy is model-driven.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: this is the shape Rune's task/resume state should take — an explicit state machine whose **transitions are code** (the 152 modules) and whose LLM calls are confined to within-state sub-task solving. It also cleanly expresses degraded modes as states (`EMBEDDING_UNAVAILABLE`, `MODEL_MISSING`) rather than as behaviour changes.
+
+**[S10] `2303.17580` | HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Face**
+- Authors / venue: Shen, Song, Tan et al. — NeurIPS 2023.
+- Topic: LLM-as-controller over a model catalogue (the canonical "router" architecture).
+- Key claims: four stages — task planning, model selection, task execution, response generation; language as a generic interface between models; the LLM acts as the controller of external models.
+- Negative results: none verified at section depth by this arm (see §4 register — do not cite HuggingGPT failure statistics).
+- Limitations: capability truth lives in the LLM's prompt/catalogue text, not in a runtime registry; model selection errors are silent (wrong capability, plausible output); heavily prompt- and catalogue-dependent.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: arm 1 already rejected routing/cascade for Rune at n≈924; arm 2 adds the architectural reason — a catalogue-router makes *capability* a prompt artifact. Rune should have capability facts in a registry (S21/S22) even while declining to route.
+
+### Group C — Model-independent state
+
+**[S11] `2405.15793` | SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering**
+- Authors / venue: Yang, Jimenez, Wettig et al. — NeurIPS 2024.
+- Topic: the action space / interface as a first-class capability lever.
+- Key claims: LM agents are a new class of end user needing purpose-built interfaces; SWE-agent's custom agent-computer interface (ACI) — commands for creating/editing files, navigating repositories, running tests — materially improves performance; state of the art on SWE-bench and HumanEvalFix at the time.
+- Negative results: implicitly, prior agents' failures were attributable to interface design, not only model quality.
+- Limitations: interface design is manual; SWE-bench-specific tooling.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: Rune's 152 modules and their signatures *are* its ACI. This paper is the evidence that improving the interface (clear commands, guardrails, feedback formatting) raises capability without touching the model — the cheapest lever Rune has.
+
+**[S12] `2406.12045` | τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains**
+- Authors / venue: Yao, Shinn, Razavi, Narasimhan — arXiv 2024 (ICLR 2025).
+- Topic: reliability of deployed tool agents; consistency metric.
+- Key claims: evaluates agents against domain-specific API tools **plus written policy rules** in dynamic user conversations, scored by comparing final database state to an annotated goal state; introduces **pass^k** (reliability across repeated trials); even state-of-the-art function-calling agents (e.g. gpt-4o) succeed on <50% of tasks and are "quite inconsistent".
+- Negative results: mean success rate hides inconsistency; the headline number is itself negative for deployment readiness.
+- Limitations: simulated users; two domains; no cost analysis.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: adopt **pass^k-style repeated-trial consistency** as Rune's acceptance metric for its deterministic modules and for any agentic loop — a task that succeeds 70% of the time is not a capability, it is a risk. Consistency is also a better health signal than average latency for the degraded-mode channel.
+
+**[S13] `2401.13178` | AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents**
+- Authors / venue: Ma, Zhang, Zhu et al. — NeurIPS 2024 D&B.
+- Topic: process-level (not just outcome-level) agent evaluation.
+- Key claims: final success rate "reveal[s] few insights during the process"; provides a unified framework with partial observability, multi-round interaction and progress-rate analytics; identifies agent weaknesses that outcome metrics miss.
+- Negative results: the critique of outcome-only evaluation.
+- Limitations: benchmark domains are game/web-ish, not coding-agent-specific.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: Rune should log **sub-goal progress** per run (which module stage completed) so escalation can be triggered by "stalled progress", which is externally observable, instead of by model-reported confidence.
+
+**[S39] LangGraph persistence — checkpointers and stores (documentation)**
+- Source: docs.langchain.com/oss/python/langgraph/persistence.
+- Topic: durable agent state as a runtime property; the documented failure modes of state persistence.
+- Key claims: two complementary systems — **checkpointers** persist a thread's graph state as snapshots (used for conversation continuity, human-in-the-loop workflows, time travel, fault tolerance) and **stores** persist application-defined key-value data outside the graph state (cross-thread long-term memory: preferences, facts, shared knowledge); most applications use both; "Agent Server handles persistence automatically"; durability is a compile-time configuration of the graph.
+- Negative results (documented troubleshooting, i.e. the paper-equivalent of failure modes): `MemorySaver`/`InMemorySaver` "store checkpoints in RAM. When the process restarts, all checkpoints are lost"; checkpoints "grow unboundedly" over long conversations, increasing latency and storage cost, and require pruning/retention policy; a subgraph updating state "may not [be] see[n] immediately" by the parent because "each subgraph manages its own checkpoint namespace"; `thread_id` must stay under 255 chars for `PostgresSaver`.
+- Limitations: vendor documentation; no measurements; the storage backend is the user's responsibility (SQLite/Postgres).
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: this is the checklist for Rune's task/resume state, which is *already* durable — the value is in the enumerated failure modes: (a) never let a state layer live only in RAM; (b) retention/pruning must be explicit or the state store degrades the agent over time; (c) state must have a single namespace owner, or resumed runs will see stale/partial state; (d) model loss must be a re-load of persisted state, never a re-derivation.
+
+### Group D — Graceful degradation / offline agents
+
+**[S14] `2404.01744` | Octopus v2: On-device language model for super agent**
+- Authors / venue: Chen, Li — arXiv 2024.
+- Topic: on-device function calling; the offline capability floor.
+- Key claims: a 2B on-device model surpasses GPT-4 on function-calling accuracy and latency; **95% context-length reduction** by encoding tools as functional tokens instead of retrieving them (RAG); 35× lower latency than Llama-7B with a RAG-based function-calling mechanism; latency suitable for production edge deployment.
+- Negative results: on-device models without such restructuring face "issues with latency and accuracy" (the stated motivation); RAG-based function calling is the slow/weak baseline.
+- Limitations: narrow task (function/tool selection); requires task-specific training of the tokenizer/representation; no multi-step reasoning evaluation.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: direct evidence that **bounded tool selection is a small-model job** (consistent with arm 1's "classical ML owns bounded structured tasks"), and that the *action representation*, not model size, is what makes it cheap. For Rune: keep the per-call action space small and explicit (152 named modules with schemas) instead of exposing a huge tool list.
+
+**[S15] `2407.21075` | Apple Intelligence Foundation Language Models**
+- Authors / venue: Gunter, Wang, Wang et al. (Apple) — arXiv 2024.
+- Topic: audited, deployed local-first architecture (on-device model + adapters + separate guardrails).
+- Key claims (from the paper's own text): a **~3B parameter on-device model** plus a larger server model for Private Cloud Compute; the on-device model is compressed to **on average under 4 bits per weight**, with some layers pushed to 2-bit, reaching **≈3.5 bits per weight "without significant quality loss"**; compression loss is recovered with **accuracy-recovery adapters** (LoRA-style, ranks {8,16,32}) trained on ~10B tokens ≈0.15% of base pretraining; **guardrail models run as separate pre- and post-processing steps** outside the generative model; safety data is folded into per-use-case adapters.
+- Negative results: quantization "often shows a moderate level of quality loss" and the paper explicitly refuses to ship the raw quantized model to feature teams without recovery training.
+- Limitations: vendor paper (self-reported evaluations); adapter suite and guardrails are not reproducible from the paper; per-feature tiering between on-device and PCC is not fully specified in the model report.
+- Read depth: `RELEVANT_SECTIONS` (quantization/adapter sections and the architecture/eval framing; the full training-data and eval sections were not read in detail).
+- Rune relevance: a documented production example of exactly Rune's situation (small local model + per-task adapters + separate guardrail models) and a cross-check on arm 1's quantization conclusion: **<4-bit is viable only when you pay for recovery** (or, per arm 1, stay at 4-bit weight-only as the safe floor). The "guardrails are separate models outside the generator" pattern is the right template for Rune's degraded-mode and safety checks.
+
+**[S16] `2312.11514` | LLM in a flash: Efficient LLM Inference with Limited Memory**
+- Authors / venue: Alizadeh, Mirzadeh, Belenko et al. (Apple) — arXiv 2023.
+- Topic: running models that exceed available memory (the rung below "model fits").
+- Key claims: build an inference cost model from flash-memory characteristics; keep parameters in flash and bring them into DRAM on demand; two techniques — **windowing** (reuse previously activated neurons to cut data transfer) and **row-column bundling** (larger, more contiguous reads).
+- Negative results: naive on-demand loading is the baseline being beaten; the approach trades latency for capacity, it does not remove the capacity limit.
+- Limitations: latency-bound; no quality/accuracy claim (it is a systems paper).
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: on a 16GB-VRAM workstation this is the documented mechanism for a degradation ladder rung: *model does not fit VRAM → stream from disk with windowing/bundling* rather than *model unavailable*. Note the cost is latency, so Rune's degraded-mode message should say "slow mode", not "capability lost".
+
+**[S17] Apple Private Cloud Compute — deployment architecture (documentation)**
+- Source: Apple Security Research, "Private Cloud Compute: A new frontier for AI privacy in the cloud" (security.apple.com/blog/private-cloud-compute/).
+- Topic: the deployed three-tier degradation ladder and its verification gates.
+- Key claims: Apple Intelligence runs **on-device first**; for "advanced features that need to reason over complex data with larger foundation models" it uses PCC as an explicitly separate tier; the device constructs a request "consisting of the prompt, plus **the desired model and inferencing parameters**"; the device **validates PCC node certificates/attestation and will not send data to any node it cannot validate**; PCC is stateless by design (data deleted after the response, no privileged runtime access, no general-purpose logging, public transparency log of every production build).
+- Negative results: the docs state that traditional cloud AI services cannot verify or enforce their own guarantees (unverifiable logging, opaque stacks, privileged access) — i.e. the naive cloud-fallback design is rejected on safety grounds.
+- Limitations: vendor documentation, no independent measurement; per-feature tiering rules (which requests go to PCC) are not specified.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: the template for Rune's missing degraded-mode layer: (1) tier by *request*; (2) **verify the target's health/identity before dispatch**; (3) **hard-fail rather than silently substitute** (Apple refuses rather than sending to an unvalidated node) — which is precisely the opposite of Rune's current silent embedding degradation; (4) publish what runs where so the operator can see the tier.
+
+**[S18] `2304.03442` | Generative Agents: Interactive Simulacra of Human Behavior**
+- Authors / venue: Park, O'Brien, Cai et al. — UIST 2023.
+- Topic: memory stream + reflection + retrieval scoring (the canonical memory-as-a-module design).
+- Key claims: store a complete record of experience in natural language; synthesize memories over time into higher-level **reflections**; retrieve dynamically to plan behaviour; retrieval combines **recency, importance and relevance** scores.
+- Negative results: the architecture is validated by believability/interview studies, not by task correctness; memory correctness is not measured.
+- Limitations: simulated sandbox; no cost/latency budget; LLM-driven reflection can compound errors.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the scoring recipe (recency × importance × relevance) is directly implementable in Rune's deterministic retrieval module over 118k chunks — deterministic scoring keeps retrieval quality independent of which of the 11 models is loaded.
+
+**[S19] `2305.16291` | Voyager: An Open-Ended Embodied Agent with LLMs**
+- Authors / venue: Wang, Xie, Jiang, Mandlekar, Xiao, Zhu, Fan, Anandkumar — arXiv 2023 (TMLR 2024).
+- Topic: skill library as executable, model-independent procedural memory.
+- Key claims: three components — automatic curriculum, an **ever-growing skill library of executable code**, and iterative prompting using environment feedback, **execution errors**, and self-verification; interacts with GPT-4 by blackbox queries (no fine-tuning); skills are temporally extended, interpretable, compositional, compound the agent's abilities and alleviate catastrophic forgetting.
+- Negative results: skills are acquired by trial and error against a forgiving simulator; the paper does not claim skill correctness guarantees.
+- Limitations: Minecraft-like environment; skill library quality depends on the model that wrote the code.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the strongest published argument that **capability can accumulate outside the weights** — Rune's skill store should hold *executable, testable* artifacts (code), retrieved into context on demand, exactly as Voyager retrieves skills; the model that wrote a skill is then irrelevant to whether the skill still works.
+
+### Group E — Capability discovery / registries / staleness
+
+**[S20] `2307.09009` | How is ChatGPT's behavior changing over time?**
+- Authors / venue: Chen, Zaharia, Zou — arXiv 2023 (Harvard Data Science Review, 2024).
+- Topic: declared capability vs observed behaviour under the same model name.
+- Key claims: "when and how these models are updated over time is opaque"; GPT-4 March-2023 vs June-2023 on prime-vs-composite identification: **84% → 51%**; partly explained by a drop in willingness to follow chain-of-thought prompting; GPT-3.5 *improved* on the same task between the two snapshots; behaviour on sensitive/opinion questions also shifted.
+- Negative results: the negative finding is that a *same-name* model changed capability in both directions across seven task families.
+- Limitations: two snapshots of two proprietary models; per-task effect sizes vary; no mechanism analysis.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the empirical justification for a **capability registry with re-probing on change**. Rune's Ollama models are pinned by tag, but a tag can be re-pulled to different weights — so Rune must store the model **digest** and re-run its capability probes whenever the digest changes. "Declared" (name/tag/params) and "observed" (probe results on Rune's own tasks) must be separate registry fields.
+
+**[S21] Model Context Protocol — Architecture overview (documentation)**
+- Source: modelcontextprotocol.io/docs/learn/architecture (protocol version 2026-07-28).
+- Topic: capability declaration, negotiation, freshness and staleness in a tool ecosystem.
+- Key claims: host/client/server topology; a **data layer** over JSON-RPC 2.0 and a transport layer; **every request is stateless and carries protocol version + capabilities in `_meta`**; a mandatory `server/discover` request returns `supportedVersions`, `capabilities` (e.g. `{"tools": {"listChanged": true}}`) and `serverInfo`; a version mismatch is rejected with an explicit `UnsupportedProtocolVersionError` **listing the versions the server does support**; servers expose **tools/resources/prompts** with `*/list` discovery and per-tool `inputSchema`; tool lists carry a **freshness hint `ttlMs`** and `cacheScope`; **change notifications are opt-in and explicitly best-effort — "clients should also rely on polling to preserve freshness of results"**; MCP "focuses solely on the protocol for context exchange — it does not dictate how AI applications use LLMs".
+- Negative results: the docs' own admission that notifications are best-effort (so a cached capability view can be stale at any moment) is the negative result for registry design.
+- Limitations: protocol specification/docs, no adoption or reliability measurements.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: the exact fields Rune's missing capability registry should have — **declared capabilities per model/module, a TTL on every cached capability fact, explicit version-mismatch errors that list what *is* supported, and a polling fallback** rather than trusting push notifications. Also: MCP's separation of protocol from LLM policy is the same separation Rune needs (registry ≠ routing).
+
+**[S22] OpenRouter Models API (documentation)**
+- Source: openrouter.ai/docs/overview/models.
+- Topic: how a production model marketplace encodes capability facts and staleness.
+- Key claims: `id` is the request identifier while **`canonical_slug` is a "permanent slug for the model that never changes"**, and aliases resolve/redirect (e.g. `anthropic/claude-3-5-sonnet` → `anthropic/claude-3.5-sonnet`) — i.e. names drift, canonical identity must be pinned; `expiration_date` encodes deprecation; `supported_parameters` declares per-model capability (tools, structured_outputs, seed, reasoning, …); `architecture` declares modalities/tokenizer; **provider-level `top_provider.context_length` can differ from the model's own `context_length`**; throughput/latency sorts use p50 heuristics; benchmark data is optional and omitted when absent; pricing carries conditional overrides (long-context thresholds, peak-hour windows).
+- Negative results: optional fields are simply absent when unknown (no placeholders) — a registry must model "unknown", not default it.
+- Limitations: vendor documentation for a commercial catalogue; the underlying provider behaviour is not verifiable from the docs.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: field-level template for the registry Rune lacks — permanent ID (+ digest), declared parameters, declared vs observed context/latency, deprecation date, and **explicit `unknown`**. The `canonical_slug` distinction is the direct analogue of "model tag vs weights digest" from S20.
+
+### Group F — Tool-based intelligence
+
+**[S23] `2302.04761` | Toolformer (brief)**
+- Authors / venue: Schick, Dwivedi-Yu, Dessì et al. (Meta) — NeurIPS 2023.
+- Key claims: an LM can teach itself *which* API to call, *when*, with *what arguments*, and how to incorporate the result, self-supervised with a handful of demonstrations per API (calculator, QA, two search engines, translation, calendar), improving zero-shot performance.
+- Limitations: APIs are simple and stateless; the tool boundary must be expressible in the token stream; no state or failure handling.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: model-side tool *selection* is learnable, but Rune does not need to learn it — the 152 modules already fix the action space. The transferable point is that tool boundaries must be explicit and parseable in the model's output, which is what makes deterministic dispatch possible.
+
+**[S24] `2305.15334` | Gorilla (brief)**
+- Authors / venue: Patil, Zhang, Wang et al. — NeurIPS 2024.
+- Key claims: GPT-4-class models fail at API calls mainly through **hallucinated usage and wrong arguments**; a finetuned LLaMA surpasses GPT-4 at writing API calls; combined with a **document retriever** it adapts to test-time document changes/version changes and substantially mitigates hallucination; evaluated with APIBench (AST sub-tree matching).
+- Negative results: "the potential to effectively use tools via API calls remains unfulfilled" and hallucinated API usage is the dominant failure mode.
+- Limitations: retrieval-based adaptation still requires the docs to be current; single-turn call generation.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: two rules — (1) tool/API correctness is a distinct competence from reasoning competence, so it must be measured separately (Rune's registry should hold per-module observed call-correctness); (2) **capability documentation must be retrieved at runtime** so version changes are picked up, rather than baked into a prompt.
+
+**[S25] `2307.16789` | ToolLLM / ToolBench (brief)**
+- Authors / venue: Qin, Liang, Ye et al. — ICLR 2024.
+- Key claims: open models lag closed models at tool use because instruction tuning ignores the tool domain; ToolBench = 16,464 real REST APIs across 49 categories with ChatGPT-generated instructions; DFSDT (depth-first search decision tree) over API calls; ToolEval for automatic evaluation.
+- Negative results: scale of the problem is the finding — thousands of APIs are needed to train general tool use; open models were "significantly limited" without it.
+- Limitations: auto-generated data quality; benchmark-era models.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: argues *against* exposing a large action space: Rune should present a small, task-scoped subset of its 152 modules per call (a few schemas), which is both an accuracy and a latency win.
+
+**[S26] `2309.15817` | ToolEmu (brief)**
+- Authors / venue: Ruan, Dong, Wang et al. — ICLR 2024.
+- Key claims: an LM can **emulate tool execution** in a sandbox so agent risk cases can be found without manually building environments; identifies high-stakes failures (data leakage, financial loss); provides an adversarial emulator for systematic risk discovery.
+- Negative results: the motivating negative is that identifying risks by hand does not scale to long-tailed, high-stakes failures.
+- Limitations: emulator fidelity; risk identification depends on the emulator's own model.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: gives Rune a safe way to test the 152-module action space (including destructive operations) before it touches the real workstation — an emulated tool layer plus adversarial scenario generation is a cheap pre-deployment gate.
+
+### Group G — Specialist ensembles / modular stacks / memory-as-a-module
+
+**[S27] `2308.00352` | MetaGPT**
+- Authors / venue: Hong, Zhuge, Chen et al. — ICLR 2024.
+- Key claims: encode **Standardized Operating Procedures** into prompt sequences; assign human-like roles in an assembly line; agents verify intermediate results, reducing errors; structured outputs (artifacts) between roles.
+- Negative results: "solutions to more complex tasks… [are] complicated through logic inconsistencies due to **cascading hallucinations caused by naively chaining LLMs**" — the failure mode motivating SOPs.
+- Limitations: SOPs must be authored per domain; role-play token cost; no guarantee that verification agents actually verify (cf. S03).
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the transferable part is the *SOP*, not the roles. Rune should encode SOPs as deterministic module sequencing (its 152 modules) and use artifacts (files, DB rows) as the interface between stages — which is what makes a single-agent Rune safer than a role-playing ensemble.
+
+**[S28] `2503.13657` | Why Do Multi-Agent LLM Systems Fail? (MAST)**
+- Authors / venue: Cemri, Pan, Yang et al. (UC Berkeley) — arXiv 2025 (ICML 2025).
+- Key claims: 1600+ annotated traces across 7 popular multi-agent frameworks; the first multi-agent failure taxonomy (MAST) built from 150 expert-annotated traces and validated; the motivating observation is that MAS "performance gains on popular benchmarks are often minimal".
+- Negative results: this paper *is* the negative result for agent societies — systematic, reproducible failure patterns rather than anecdotal ones.
+- Limitations: annotation is human-judgement-based; frameworks are 2024-era; no per-failure cost accounting.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: decisive for a single-workstation deployment: multi-agent ensembles add coordination-failure surface (and token cost) without a demonstrated gain. Rune's "specialists" should be its deterministic modules and small task-scoped models, not conversational agents.
+
+**[S29] `2404.13501` | A Survey on the Memory Mechanism of LLM-based Agents**
+- Authors / venue: Zhang, Bo, Ma et al. — arXiv 2024.
+- Key claims: systematizes memory for LLM agents (what/why/how to design and how to evaluate); memory is the component that enables self-evolution and long-term agent-environment interaction; existing designs are scattered with no common patterns.
+- Negative results: the absence of a shared design vocabulary/evaluation standard is itself the reported gap.
+- Limitations: survey; no new measurements.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: gives Rune an audit checklist for its SQLite memory (write path, read/retrieval path, management/forgetting, evaluation) — useful as an internal design review, not as empirical evidence.
+
+**[S30] Letta / stateful agents (documentation)**
+- Source: docs.letta.com (Introduction to Stateful Agents).
+- Topic: the production lineage of MemGPT — state owned by the runtime, not the model.
+- Key claims: **all state (memories, user messages, reasoning, tool calls) is persisted in a database, "so they are never lost, even once evicted from the context window"**; "core" memory blocks are injected into the system prompt and are agent-editable via memory tools; blocks can be shared across agents; **server-side tools contain code executed by the server in a sandbox, whereas MCP/client tools carry only the schema** (execution stays with the runtime); a single invocation is a *run* composed of many *steps*; independent *conversations* allow concurrent threads over one agent; models are swappable providers.
+- Negative results: none claimed; the docs' implicit finding is that context-window-only state is lossy, so eviction must be backed by durable storage.
+- Limitations: vendor docs; no measurements.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: near-exact mapping to Rune's intended design (SQLite-backed state, model-swappable, tools executed by Rune). The sandbox/server-side vs schema-only tool distinction is the precise boundary Rune needs: **the model emits a call; Rune's code executes it.**
+
+### Group H — Bounded test-time compute / escalation signals
+
+**[S31] `2203.11171` | Self-Consistency Improves Chain of Thought Reasoning**
+- Authors / venue: Wang, Wei, Schuurmans et al. (Google) — ICLR 2023.
+- Key claims: sample diverse reasoning paths and marginalize to the most consistent answer instead of greedy decoding; gains: GSM8K **+17.9%**, SVAMP +11.0%, AQuA +12.2%, StrategyQA +6.4%, ARC-challenge +3.9%.
+- Negative results: requires multiple samples (cost scales linearly); relies on the answer space admitting an agreement notion.
+- Limitations: arithmetic/commonsense benchmarks; no open-ended tasks; no calibration analysis.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: with one local model and no second model to escalate to, **self-consistency is Rune's cheapest quality lever** — and sample disagreement is a *computable* (not introspective) escalation/abstain signal. Note: the paper does not claim the disagreement-signal use; that inference is flagged in §4 as an extrapolation, not a citation.
+
+**[S32] `2408.03314` | Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameters**
+- Authors / venue: Snell, Lee, Xu, Kumar (UC Berkeley / Google DeepMind) — arXiv 2024.
+- Topic: when more inference helps, and when it hurts — the escalation-signal evidence base.
+- Key claims (section-level): two mechanisms — (1) search against a dense **process-based verifier** (PRM), (2) **adaptively updating the proposal distribution** (revision); the effectiveness of each "critically varies depending on the difficulty of the prompt", motivating a **compute-optimal** per-prompt allocation which improves efficiency by **>4× vs best-of-N**; question difficulty is estimated from **model-specific pass@1 bins** (5 quantiles) and these are "more predictive of the efficacy of using test-time compute in contrast to the hand-labeled difficulty bins"; a **model-predicted** difficulty (average verifier score) approximates the oracle; the verifier quality bounds what search can achieve (lookahead search underperforms others because it exploits verifier errors); revision/verification capabilities are **absent even in strong proprietary LLMs and had to be finetuned in**; FLOP-matched comparisons show test-time compute can substitute for a much larger model on easy/medium problems.
+- Negative results (explicit): "current work largely provides negative results for a number of these strategies"; **on the easy bins, beam search over-optimizes the verifier and degrades below best-of-N** as budget grows; on the most difficult bin (level 5) **"no method makes much meaningful progress"**; search improvements diminish at larger budgets.
+- Limitations: MATH + PaLM-2-S* single-family study; difficulty estimation itself costs inference (acknowledged, not accounted for); PRM/revision training is expensive and out of reach for a local workstation.
+- Read depth: `RELEVANT_SECTIONS` (§1–§3, §5.1–5.3, §6 framing; appendices skimmed).
+- Rune relevance: the most directly transferable result in this arm. Escalation must be **conditioned on a model-specific difficulty estimate that Rune computes and stores itself** (per-task-family pass rates in SQLite — Rune already has the outcome history to build these bins), and Rune needs an explicit "hard bin → do not spend more, declare degraded / hand to human" rule. More compute on easy tasks is a measured net negative when the verifier is miscalibrated.
+
+**[S33] `2207.05221` | Language Models (Mostly) Know What They Know**
+- Authors / venue: Kadavath, Conerly, Askell et al. (Anthropic) — arXiv 2022.
+- Key claims: larger models are well-calibrated on multiple-choice/true-false questions **when provided in the right format**; `P(True)` (probability the proposed answer is correct) shows encouraging calibration and scaling; it improves when the model may consider multiple of its own samples; `P(IK)` ("I know the answer") is trainable without reference to a proposed answer.
+- Negative results: calibration is format-sensitive and degrades off-distribution; the paper is explicit that this is a research direction, not a deployment guarantee.
+- Limitations: mostly MC/TF tasks; Anthropic-model-specific; `P(IK)` requires training.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: if Rune uses any model-side signal, it must be a *format-conditioned, elicited* probability, and it must be calibrated against Rune's own observed outcomes before it can drive escalation.
+
+**[S34] `2305.14975` | Just Ask for Calibration**
+- Authors / venue: Tian, Mitchell, Zhou, Sharma, Rafailov, Yao, Finn, Manning (Stanford) — EMNLP 2023.
+- Key claims: RLHF-tuned LMs produce **poorly calibrated conditional probabilities**, contrary to pretrained LMs; **verbalized confidences emitted as output tokens are typically better calibrated than the model's conditional probabilities**; calibration improves with prompting (e.g. 10-shot).
+- Negative results: raw token probabilities from RLHF models are not usable as confidence.
+- Limitations: evaluation on QA-style tasks; no agentic setting; calibration ≠ correctness.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: kills the naive escalation signal. Ollama's logprobs are conditional probabilities; per this evidence they are the *worse* option. If Rune wants a model-side confidence, it must be elicited verbalized confidence under a fixed template — and even then it is only usable after calibration against Rune's own outcomes (S32's difficulty-bin approach).
+
+**[S35] `2412.21187` | Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs**
+- Authors / venue: Chen, Xu, Liang et al. — arXiv 2024.
+- Key claims: o1-like models allocate excessive computation to simple problems with minimal benefit; introduces efficiency metrics from both **outcome** and **process** perspectives; a self-training mitigation shortens reasoning **without compromising accuracy**; outcome-based reward does not penalise inefficient reasoning.
+- Negative results: overthinking is a measured, systematic waste, not an anecdote; outcome-only reward is identified as the cause.
+- Limitations: o1-like long-CoT models; self-training requires compute a local workstation may not have.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: Rune should budget reasoning tokens **per task class** and track "tokens per solved task" as a first-class metric; without a process-side metric, Rune cannot tell overthinking from working.
+
+**[S36] `2503.16419` | Stop Overthinking: A Survey on Efficient Reasoning (brief)**
+- Authors / venue: Sui, Chuang, Wang et al. — arXiv 2025.
+- Key claims: first structured survey of efficient reasoning; taxonomizes levers into model-based (length-controlled/latent), prompt-based, and output-based methods; names the "overthinking phenomenon" (verbose, redundant CoT) as the cost of longer reasoning.
+- Limitations: survey; no unified evaluation.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: a menu of *budget-control* levers that are orthogonal to model routing (which arm 1 rejected): per-task-class length caps, prompt-level brevity instructions, and output filtering.
+
+**[S37] `2506.06941` | The Illusion of Thinking (and its published critique)**
+- Authors / venue: Shojaee, Mirzadeh, Alizadeh et al. (Apple) — arXiv 2025; critique: `2506.09250` "Comment on The Illusion of Thinking…".
+- Key claims: controllable puzzle environments with precisely manipulated complexity; LRMs' accuracy **collapses to near-zero beyond a complexity threshold**; three regimes (low: standard LLMs match; medium: LRMs benefit; high: both collapse); reasoning traces show counterintuitive scaling; contamination-prone benchmark evaluation is inadequate.
+- Negative results: the collapse itself; plus the critique's argument that the observed collapse is explained by **token-budget limits** rather than a fundamental inability (i.e. the "collapse" is partly an artifact of the evaluation budget).
+- Limitations: contested result — the published comment is the reason this row must not be used as a hard escalation threshold.
+- Read depth: `ABSTRACT_ONLY` for both the paper and the comment (comment verified by metadata + title via the arXiv API).
+- Rune relevance: read as a caution, not a rule — any "complexity threshold beyond which the model fails" must be re-measured on Rune's own models **at Rune's own token budget**, because the threshold moves with the budget.
+
+**[S38] `2305.10601` | Tree of Thoughts (brief)**
+- Authors / venue: Yao, Yu, Zhao, Shafran, Griffiths, Cao, Narasimhan — NeurIPS 2023.
+- Key claims: deliberate search over coherent "thoughts" with self-evaluation, lookahead and backtracking; significant gains on game-of-24, creative writing, crosswords.
+- Negative results / contested: S03 re-analyses ToT as problem-specific prompt priming with an externally-implemented verifier for the 24 game (arithmetic), and reports the LLM's own criticisms "often quite off the mark" — i.e. the search guarantee comes from the external verifier, not the model.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: ToT-style search is only meaningful for Rune where a deterministic verifier exists (tests, solvers, type checkers); otherwise it multiplies cost with no guarantee.
+
+---
+
+## 2. Synthesis — three verdicts
+
+### Verdict A — Model-independent architecture: what must live OUTSIDE the model for Rune to survive model/provider loss
+
+**Verdict: every element that defines *what the agent does next* must be code and data owned by Rune; the model may only contribute *candidate content* and *natural-language translation*. This is not a preference — the evidence shows the model is structurally unable to own those functions, and that delegating them degrades as model quality varies.**
+
+Evidence chain (each link section-verified):
+
+1. **The decision procedure is code, not a prompt.** CoALA's taxonomy places the decision cycle — planning (propose/evaluate) then execution, looping — in *procedural memory*, explicitly split into "procedures that implement actions" and "procedures that implement decision-making itself"; it further notes that procedural memory "must be initialized by the designer with proper code to bootstrap the agent", and that letting an agent write new decision procedures is "significantly riskier… can easily introduce bugs or allow an agent to subvert its designers' intentions", with **no language agents currently implementing it** (S01). For Rune: the 152 modules are procedural memory; the missing artifact is a *named* decision procedure (a state machine per S09) that sequences them.
+2. **The model cannot verify its own output.** LLM-Modulo: best LLMs produce ~12% executable plans autonomously; obfuscated names degrade LLMs but not planners (⇒ retrieval, not planning); self-critique does not improve and is *worse* than baseline because the model cannot recognise a correct solution it generated; soundness of a compound system is inherited **only** from external hard critics (S03). For Rune: acceptance gates are tests/type checks/schema validation/exit codes — never "the model says it's fine".
+3. **Model-side memory management is model-dependent and therefore unsafe for a multi-model workstation.** MemGPT's own evaluation: performance "significantly degraded… due to its limited function calling capabilities" with a weaker model; failure mode "failing to perform enough lookups"; document QA bounded by embedding-similarity limits (S02). Letta's production answer is to keep *all* state in a database so it is "never lost, even once evicted from the context window", and to keep tool **execution** server-side in a sandbox while the model emits only schema-conformant calls (S30). For Rune: SQLite state + code-owned paging policy is correct; *what to remember* may be model-proposed but must be model-validated (dedupe, schema, provenance) before write.
+4. **State must survive process and provider loss, and that is a runtime property.** LangGraph's persistence model separates thread-scoped checkpoints (continuity, human-in-the-loop, time travel, fault tolerance) from cross-thread stores (durable facts/preferences), and its documented failure modes are exactly the ones Rune must avoid: in-memory savers lose everything on restart, checkpoints grow unboundedly without retention, and subgraph state lives in a separate namespace the parent may not see (S39). For Rune: task/resume state, memory, and skill store must be *files/SQLite*, with explicit retention and a single owner per fact — model loss must be a re-load, not a re-derivation.
+5. **Capability truth belongs in a registry, not in a prompt.** OpenRouter pins a `canonical_slug` that "never changes" while names alias and redirect, declares `supported_parameters`, distinguishes provider-level from model-level `context_length`, and carries an explicit `expiration_date` (S22); MCP makes capability declaration a protocol-level, per-request fact with a TTL and an explicit version-mismatch error that *lists what is supported* (S21). HuggingGPT shows the opposite design — capability as catalogue text inside the controller's prompt (S10). For Rune: the registry is needed regardless of arm 1's routing rejection, because "which model is loaded and what can it actually do right now" is required for degradation messaging and for safe module behaviour.
+6. **Capability accrues outside the weights.** Voyager's skill library is executable code, retrieved on demand, with GPT-4 queried black-box — no fine-tuning — and the paper reports compounding ability and reduced catastrophic forgetting (S19). For Rune: the skill store should hold *testable* artifacts, and skill validity must not depend on the model that authored them.
+7. **The interface is the lever.** SWE-agent's central claim is that a purpose-built agent-computer interface materially changes agent performance (S11). For Rune: module signatures, guardrails and error formats are capability, and they are model-independent.
+
+**Concrete list of what must live outside the model (Rune):** task/resume state machine and its transitions; module dispatch and argument validation; memory write policy (dedupe/provenance/schema) and eviction/retention; retrieval scoring (recency/importance/relevance, S18) and embedding provenance; capability registry with digests, declared vs observed facts, TTLs and staleness; health/degraded-mode state and its message format; escalation policy and its triggers; acceptance gates (critics) for every model-produced artifact; loop/repetition detection (S04's dominant ReAct failure is a loop the model cannot see); budget caps per task class (S35/S36); and the audit log of which model produced which artifact.
+
+**Corollary (anti-pattern to avoid):** any behaviour where "the model decides whether to remember/verify/continue/escalate" is a dependency on model quality that Rune's multi-model, sometimes-Ollama-down reality cannot support.
+
+### Verdict B — Graceful degradation: the ladder the evidence supports
+
+**Verdict: the evidence supports a *request-tiered* ladder with health-verified dispatch and explicit hard failure, not capability substitution. Silent degradation (Rune's current behaviour when Ollama is down) is the failure mode every audited production system is engineered to prevent.**
+
+Ladder rungs, each with evidence:
+
+| Rung | Mechanism | Evidence | What Rune gets / loses |
+|---|---|---|---|
+| 0. Full local | On-device/local model at native precision | S15 (on-device ~3B model); S01/S30 (state in DB) | Full capability; this is Rune's normal state |
+| 1. Compressed local | <4-bit weights **with accuracy-recovery adapters**; some layers 2-bit; ≈3.5 bpw without significant loss | S15 (audited, production) | Slight quality loss if recovery training is paid; cross-check with arm 1's 4-bit weight-only floor |
+| 2. Capacity-limited | Model larger than VRAM streamed from flash with windowing/bundling | S16 (audited paper) | Capability kept, **latency** lost → degraded mode must say "slow", not "unavailable" |
+| 3. Bounded-task delegation | Small (2B) model for function/tool selection with a restructured action representation (95% context reduction, 35× latency win) | S14 | Bounded, verifiable work continues (aligns with arm 1: classical ML / small models own bounded structured tasks) |
+| 4. Non-generative continuation | Modules, SQLite state, retrieval scoring, skill store, registry — all work with no model at all | S01, S19, S30, S39 | Task state preserved; retrieval and skill execution continue; only NL generation and reasoning stop |
+| 5. Optional cloud tier | Separate tier for requests needing a larger model, dispatched only after **verifying target attestation**; refuse if unverifiable; stateless processing | S17 (audited docs) | The only rung that leaves the workstation — must be opt-in and health-gated |
+| 6. Explicit refusal | Hard fail with a status message instead of substituting a weaker path | S17 (device will not send to unvalidated nodes) | Prevents silent wrong-answer degradation; requires the status channel Rune lacks |
+
+Supporting design rules from the evidence:
+- **Degradation must be *communicated* as structured status, not generated prose.** MCP's model is the template: capabilities are declared facts, freshness is a TTL, mismatches are explicit errors listing what *is* supported, and push notifications are explicitly best-effort so "clients should also rely on polling to preserve freshness" (S21). A generated status sentence would itself depend on the model that may be down — a self-defeating design.
+- **Health verification before dispatch, not after failure.** S17's device-side certificate/attestation check is the strongest available precedent; S21's `server/discover` is the protocol-level version. For Rune: probe the model/module before use (digest + minimal capability probe), and cache the result with a TTL.
+- **Reliability must be measured as consistency.** τ-bench's `pass^k` shows SOTA tool agents succeeding <50% of the time and being "quite inconsistent" (S12); AgentBoard shows outcome-only metrics hide process failures (S13). For Rune: a module that succeeds 70% of the time is a *degraded* module, and Rune should be able to say so.
+- **Separate guardrail/validation models from the generator.** S15 documents guardrail models as pre/post-processing outside the generative model — which is the same architectural move as S03's external critics, and it keeps the safety path alive when the generator is swapped.
+- **Degradation cost must be attributed.** S16's streaming mode costs latency, not quality; S15's compression costs quality, not availability. Conflating the two (as a single "degraded" flag does) makes the operator unable to choose.
+
+**Verdict consequence for the stated inward gap ("silent embedding degradation when Ollama down"):** the audited systems treat exactly this as unacceptable. The fix is architectural, not a message: (a) embedding calls go through a module that *probes and reports* its own availability; (b) retrieval has a declared fallback rung (e.g. keyword/BM25-style scoring over the same SQLite chunks, or recency-only scoring) with the rung recorded on the retrieved artifact; (c) every memory write records which embedding model+digest produced it, so a later re-embed can be targeted; (d) the run's status carries the rung explicitly.
+
+### Verdict C — Escalation signals: what actually predicts when to escalate
+
+**Verdict: the only signals that predict whether more inference (or a stronger model) will help are (i) an externally computed, model-specific difficulty estimate and (ii) the availability/quality of an external verifier. Model self-reports — token probabilities, verbalized confidence, self-critique, "I can't do this" — are demonstrably unreliable as triggers. On the hardest work, escalation does not help at all and the correct action is to declare a degraded/abstain state rather than spend compute.**
+
+Ranked signal table (strongest first):
+
+1. **Model-specific difficulty bins from observed pass rates (strongest).** S32: difficulty bins derived from a base model's pass@1 are "more predictive of the efficacy of using test-time compute in contrast to the hand-labeled difficulty bins"; a model-*predicted* difficulty (average verifier score) approximates the oracle. Rune already accumulates per-task outcomes in SQLite; binning task families by Rune's own observed pass rate is the single highest-value escalation investment. Note the paper's own caveat: the model-predicted variant still costs inference and was not accounted for.
+2. **External verifier availability/quality (the binding constraint).** S32: verifier quality determines search gains (lookahead search underperforms precisely because it exploits verifier errors); S03: soundness of the compound system is inherited only from hard critics; S38/S03: ToT's "search" is guaranteed by the external arithmetic verifier, not the model. For Rune: escalation is only worth it when the extra samples can be *filtered by a deterministic check* (tests, schema, type check). Without a verifier, best-of-N is unfiltered sampling.
+3. **Deterministic failure of the attempt (retry/failure counters).** S04's hybrid rule switches to the other strategy when ReAct "fails twice"; S08 decomposes when a sub-task cannot be executed. Both are computable from outcomes. For Rune: "attempt N failed the acceptance gate" is a sound trigger; the model's own claim that it failed is not.
+4. **Sample disagreement (self-consistency spread).** S31 gives the quality lever (+17.9% GSM8K) and the spread is trivially computable across N samples with one local model. *Extrapolation, flagged:* S31 does not itself claim disagreement is a calibrated escalation signal; use it as a computed statistic, and calibrate its threshold against Rune's outcomes.
+5. **Progress stall (process metrics).** S13 shows outcome-only evaluation hides process failure; S35 argues process-side efficiency metrics are needed alongside outcome metrics. For Rune: "no sub-goal advanced in K steps" is an observable stall signal.
+6. **Budget/predictable-complexity refusal.** S32: on the hardest difficulty bin "no method makes much meaningful progress" — escalating there is wasted compute; S37 (+its critique `2506.09250`) warns that apparent complexity thresholds move with the token budget, so Rune must measure the threshold on its own models and budget. S35: overthinking means extra tokens on easy tasks produce little benefit, and outcome-only reward never penalises it.
+7. **Format-conditioned elicited self-assessment (weakest, usable only if calibrated).** S33: `P(True)`/`P(IK)` are encouraging and scale, *when the right format is provided*; S34: RLHF models' **conditional probabilities are poorly calibrated** while **verbalized confidences are better**, improving with few-shot prompting. For Rune: never use raw logprobs; if any model-side signal is used, elicit verbalized confidence under a fixed template and calibrate it against Rune's own outcome history before it can trigger anything.
+8. **Explicitly rejected as triggers:** LLM self-critique as a gate (S03: no better than baseline, and worse in iterative mode); confidence≠truth as a proxy for correctness; "the model said it can't do this" (S08's trigger, sound for ADaPT's setting but not transferable without an external check); declared model name/capability as a proxy for actual capability on Rune's tasks (S20: same-name behaviour changed 84%→51% on one task family).
+
+**Rune-specific escalation policy implied by the evidence:** compute a per-task-family difficulty bin from Rune's own history → if the attempt fails a deterministic gate → retry with bounded diversity (self-consistency, N capped by rung) → filter candidates through the same deterministic gate → if still failing and the task family is in the hardest bin, **stop and emit a degraded/needs-human status** rather than escalate further or escalate to a cloud model (which rung 5 of Verdict B governs separately, with health verification).
+
+---
+
+## 3. Rejected approaches (with the evidence that rejects them)
+
+| Rejected for Rune | Why (evidence) |
+|---|---|
+| **LLM as autonomous multi-step planner** over Rune's state (repo/files/tasks) | ~12% executable plans for the best LLM; obfuscated names collapse performance while classical planners are unaffected; CoT and ReAct-style prompting "largely ineffective" for planning (S03). Rune's state changes are exactly the sub-goal-interaction case LLMs are worst at |
+| **LLM self-verification / self-critique as an acceptance gate** | LLMs are no better at verifying than solving; iterative self-critique does not beat baseline and in practice is worse because correct solutions are passed over (S03) |
+| **Letting the model own memory management (what to page, when to summarize)** | MemGPT degrades "significantly" with weaker function calling; lookups under-performed (S02). Rune has 11 models of differing capability |
+| **Multi-agent role societies / agent teams (MetaGPT/AutoGen-style)** | MAST: gains on popular benchmarks "often minimal", with a validated failure taxonomy over 7 frameworks and 1600+ traces (S28); the motivating failure is "cascading hallucinations caused by naively chaining LLMs" (S27). A single workstation cannot absorb coordination cost or failure surface |
+| **LLM-controller routing over a model catalogue (HuggingGPT pattern)** | Capability truth becomes prompt/catalogue text rather than a runtime fact (S10) — and arm 1 already rejected routing/cascade at n≈924. Note: no failure statistic for HuggingGPT is cited (see §4) |
+| **Tree-of-Thoughts-style "search" as an architecture** | Re-analysed as problem-specific prompt priming with an external verifier doing the guaranteeing; LLM critiques "often quite off the mark" (S03). Keep only where a deterministic verifier exists (S38) |
+| **Unconditional test-time compute escalation (best-of-N / beam / lookahead)** | Beam search *over-optimises the verifier and falls below best-of-N on easy bins*; no method helps on the hardest bin; "current work largely provides negative results for a number of these strategies" (S32) |
+| **Blind plan-then-execute with all-or-nothing sub-tasks** | Any sub-task failure fails the task (S08); and blind planning (ReWOO) is unobservant by construction (S06) |
+| **Raw token probabilities / model confidence as an escalation trigger** | RLHF conditional probabilities are poorly calibrated; verbalized confidence is better but still needs calibration (S34); confidence ≠ truth (carried from #400) |
+| **In-memory-only persistence for task/resume state** | Documented: in-memory savers lose all checkpoints on process restart; unbounded checkpoint growth; subgraph namespace splits (S39). Rune's state is already durable — do not regress it |
+| **Growing Rune's exposed action space toward "many tools"** | Tool-use competence requires thousands of APIs to train generally (S25) and hallucinated usage is the dominant failure mode (S24); small restructured action spaces beat RAG-based tool selection on-device (S14). Keep the per-call module surface small |
+| **Generated (prose) degraded-mode messages** | The status path must not depend on the component that may be down; audited systems use declared facts, TTLs and explicit error codes instead (S21, S17) |
+
+---
+
+## 4. Do-not-cite register
+
+**A. Mis-paired IDs from the prompt (verified wrong; do not cite under the claimed title):**
+- `2409.02409` — prompt labelled it "Cognitive Architectures for Language Agents (CoALA)". Actual: *Microscopic, mesoscopic, and macroscopic descriptions of the Euler alignment system with adaptive communication strength* (Shvydkoy & Teolis, math.AP). **Cite CoALA as `2309.02427`.**
+- `2203.07154` — prompt labelled it self-consistency. Actual: *Materials for Future Calorimeters* (physics instrumentation). **Cite as `2203.11171`.**
+- `2305.18365` — prompt labelled it ReWOO. Actual: *What can Large Language Models do in chemistry? A comprehensive benchmark on eight tasks*. **Cite ReWOO as `2305.18323`.**
+- (Self-corrected candidates, recorded for auditability: `2408.08611` → an astronomy paper, not StateFlow; `2412.10197` → a mathematics paper, not the overthinking paper. Correct IDs are `2403.11322` and `2412.21187`.)
+
+**B. Claims that appear in the field but were NOT verified by this arm — do not attribute to the sources listed:**
+- *HuggingGPT / JARVIS-style controller failure statistics* (e.g. "model-selection error rate X%", "dependency-parsing failures"): the HuggingGPT row is `ABSTRACT_ONLY`; no failure statistic was verified. Do not cite such a number.
+- *AutoGen-specific failure rates*: AutoGen appears here only as context inside MAST's 7-framework corpus (S28); no AutoGen-specific measurement was read.
+- *MetaGPT's reported benchmark deltas*: only the architecture claim and the cascading-hallucination motivation were verified at abstract level.
+- *MemGPT's absolute scores* (e.g. specific DMR accuracy numbers): only the comparative/failure statements were verified at section depth; do not quote numeric scores from this arm.
+- *"Self-consistency disagreement is a calibrated abstention signal"*: an extrapolation from S31 by this arm — the paper does not claim it. Present as inference, not citation.
+- *Apple's per-feature on-device-vs-PCC routing rules*: the audited sources state the tiering exists and that the device validates attestation before dispatch; the specific rule for which features escalate is **not** documented in the audited material.
+- *Apple quality/quantization evaluation numbers beyond the quoted bits-per-weight and adapter-training figures*: vendor self-reported; do not present as independent measurement.
+- *LangGraph/Letta/MCP/OpenRouter performance claims*: documentation only; no independent verification. Cite as `DOCUMENTATION_AUDITED` and never as measured evidence.
+- *Model-collapse, quantization task-sensitivity, distillation transmission, speculative decoding, cascade/routing at n≈924, FrugalGPT pricing*: out of scope for this arm (arm 1); do not re-cite here.
+
+**C. Sources that were verified but are too weak to carry a load-bearing claim for Rune:**
+- S29 (memory survey) and S36 (efficient-reasoning survey) — taxonomy only, no measurements; use for vocabulary, not evidence.
+- S05 (Plan-and-Solve), S06 (ReWOO), S07 (LLM+P), S23–S26 (tool papers), S33 (Anthropic calibration) — abstract-level only in this arm; usable for design rationale, not for effect sizes.
+
+---
+
+## 5. Arm-2 summary for the atlas
+
+- **Sources by read depth:** `RELEVANT_SECTIONS` = 6 (S01 CoALA, S02 MemGPT, S03 LLM-Modulo, S04 ReAct, S15 Apple Intelligence, S32 TTC-scaling); `DOCUMENTATION_AUDITED` = 5 (S17 Apple PCC, S21 MCP, S22 OpenRouter, S30 Letta, S39 LangGraph); `ABSTRACT_ONLY` = 28; `FULL_PAPER` = 0. Total **39 numbered sources** (34 papers/position papers + 5 documentation sets), plus one unnumbered reference — `2506.09250`, the published critique of S37, used only to bound S37's claims (`METADATA_VERIFIED`).
+- **Ten key findings:**
+  1. Control belongs in code: the decision procedure is a first-class, designer-initialised artifact; agents that rewrite it are non-existent and explicitly risky (S01).
+  2. LLMs cannot plan or self-verify: ~12% executable plans autonomously, self-critique worse than baseline; soundness comes only from external hard critics (S03).
+  3. Model-owned memory management degrades with model quality (MemGPT + GPT-3.5) — the strongest argument against Rune delegating memory policy to whichever local model is loaded (S02).
+  4. State must be DB/runtime-owned and never context-only; the documented failure modes are in-memory savers, unbounded growth and namespace splits (S30, S39).
+  5. Capability facts need a registry with permanent identity, digests, declared-vs-observed separation, TTLs and explicit mismatch errors — and same-name models do change behaviour in both directions (S20, S21, S22).
+  6. Degradation ladders are request-tiered and health-verified, with **hard refusal instead of silent substitution** (S17), and degraded rungs must distinguish "slow" from "lower quality" (S16 vs S15).
+  7. Bounded tool selection is a small-model job when the action representation is restructured — 2B on-device beating GPT-4 on function calling with 95% less context (S14).
+  8. Escalation should be driven by a model-specific difficulty estimate plus verifier availability; more compute on easy tasks is a measured net negative, and on the hardest bin no method helps (S32).
+  9. Model-side confidence is a weak trigger: RLHF conditional probabilities are poorly calibrated, verbalized confidence is better but needs calibration against local outcomes (S33, S34).
+  10. Reliability must be measured as repeated-trial consistency (pass^k) and process progress, not mean success — SOTA tool agents are <50% and inconsistent (S12, S13).
+- **Three verdicts:** (A) *Model-independent architecture* — model-independent code owns decision procedure, dispatch/validation, memory policy, retrieval scoring, capability registry, degraded-mode state, escalation policy, acceptance gates, loop detection and budgets; the model supplies candidates and NL only. (B) *Graceful degradation* — a six-rung request-tiered ladder (full local → compressed local → capacity-limited streaming → bounded-task small model → non-generative module-only continuation → health-verified optional cloud tier) plus explicit refusal; status must be structured/declared, never generated. (C) *Escalation signals* — strongest predictors are Rune-computed model-specific difficulty bins and external verifier availability, followed by deterministic failure counters, sample disagreement and progress stalls; model self-reports are usable only after calibration; the hardest bin should terminate in a degraded/needs-human state.
+- **Rejected:** LLM-as-planner; LLM self-verification as a gate; model-owned memory management; multi-agent role societies; LLM-controller catalogue routing; ToT-as-search without a verifier; unconditional test-time compute escalation; blind plan-then-execute; raw confidence triggers; in-memory-only persistence; large tool action spaces; generated degraded-mode prose. (Table with evidence in §3.)
+- **Do-not-cite:** three prompt-supplied mis-paired IDs (2409.02409, 2203.07154, 2305.18365) plus two self-corrected candidates; unverified failure statistics for HuggingGPT/AutoGen/MetaGPT; unverified MemGPT absolute scores; the self-consistency-as-abstention extrapolation; Apple's per-feature tiering rules; all documentation-sourced performance claims; and arm-1 topics. (Full register in §4.)

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm3_internalization.md

@@ -0,0 +1,208 @@
+# Memory Research Atlas R1 — Domain AC #404: Offline / Local Intelligence
+## Arm 3: INTELLIGENCE INTERNALIZATION / LEARNING
+
+Date: R1 cycle. Scope: knowledge distillation (task-specific only), policy/behavioural learning, skill libraries + procedural memory, code as learned capability, rule extraction, classifier training from agent experience, continual/local fine-tuning, outcome-grounded learning, multi-teacher correlation, verifier-guided learning. Arms 1–2 territory (quantization, cascade/routing, MemGPT, collapse, escalation signals) deliberately not re-researched.
+
+**Verification discipline note.** Every arXiv ID below was resolved against the arXiv export API (or, under 429, OpenAlex with arXiv-ID extraction). **Six mis-pairings were caught during this arm's own sourcing** — all six were plausible candidate IDs drawn from memory that resolved to unrelated physics/watermarking papers (2403.02719, 2401.08900, 2310.08920, 2307.02958, 2401.01280, 1912.13488) — plus one from the controller's prompt context family (2408.15240 is real but is *Generative Verifiers*, not the generic "PRM era" paper a prompt might imply; 2409.07429 = AWM confirmed correct). All prompt-supplied IDs (2501.12948, 1011.0686, 2303.11366, 2305.16291, 2409.07429, 2408.15240) verified genuine. Corrected lookups: AlphaCodium = **2401.08500** (not 2401.08900), CodeChain = **2310.08992** (not 2310.08920), RippleEdits = **2307.12976**, WebRL = **2411.02337**, "Are More LLM Calls" = **2403.02419**, editing survey = 2305.13172 (dropped from final set).
+
+Deep reads actually performed (full paper or targeted sections fetched and read): Voyager 2305.16291 (skill-promotion mechanism — the arm's #1 priority), DAgger 1011.0686 (imitation-limits anchor), LoRA Learns Less and Forgets Less 2405.09673 (continual-learning/forgetting-magnitude anchor), DeepSeek-R1 2501.12948 (distillation appendix F/F.1), Memp 2508.06433 (update/transfer sections).
+
+---
+
+## 1. Source register
+
+Format: ID | title | authors year venue | topic | key claims | negative results | limitations | read depth | Rune relevance.
+
+Rune context flags: **[ESL]** empty skill library with governed promotion gates; **[7L]** 7 accumulated lessons; **[152M]** 152 deterministic modules; **[OVL-0]** outcome-verification loop designed but never measured; **[GD-0]** growth delta designed never demonstrated.
+
+### (1) Task-specific distillation / distilled reasoning models
+
+**S1.** 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.) 2025, arXiv/Nature | distilled reasoning models — what transfers | R1-Distill-Qwen-32B hits AIME-2024 pass@1 72.6 / MATH 94.3 / GPQA 62.1, surpassing QwQ-32B-Preview; distilled 1.5B/7B models beat GPT-4o on AIME (55.5 for 7B); distillation from R1's 800K verified-reasoning SFT set (2–3 epochs) transmits long-CoT behaviour to unrelated base families (Qwen, Llama). | **F.1 negative/boundary result:** large-scale RL *without* distillation on the same 32B base (10K steps, "Qwen2.5-32B-Zero") reaches only AIME 47.0 — i.e. pure RL cannot recover what distillation gives a small model; conversely R1 itself scores only 49.2% on SWE-Bench Verified vs 79.8 AIME — benchmark reasoning does not equal agentic coding competence. | Distillation evaluated on competition-style verifiable tasks only; no long-horizon agent tasks for distillates; teacher quality ceiling. | FULL_PAPER (abstract + §F, §F.1, Tables 15–16 read) | Distillate strength on *narrow verifiable tasks* is real but anchored to teacher-generated trajectories; supports "distill bounded task families from Rune's own verified traces" while predicting distillates will NOT match on agentic rollouts. [GD-0]
+
+**S2.** 2305.02301 | Distilling Step-by-Step! Outperforming Larger LMs with Less Training Data and Smaller Model Sizes | Hsieh et al. 2023, ACL Findings | small task-specific models matching/beating prompted LLMs | 770M T5 trained with LLM-rationale multi-task supervision outperforms few-shot prompted 540B PaLM on several NLP benchmarks, using a fraction of the training data of standard distillation. | Gains are per-task; the "beats the LLM" claim is against *few-shot prompted* LLMs, not LLMs with equivalent task-specific training. | 4 NLP benchmarks, classification/NLG only; no agent tasks. | ABSTRACT_ONLY | The canonical "a small trained model beats a prompted big model on a bounded task" anchor for Rune's classifier tier.
+
+**S3.** 1805.04770 | Born Again Neural Networks | Furlanello et al. 2018, ICML | self-distillation / interpretability of what KD transfers | Students with identical architecture to teacher outperform the teacher (CIFAR-10 3.5% err); gains persist with CWTM/DKPP variants showing non-argmax "dark" outputs matter. | Improvements are small and task-restricted; effect fades with weak teachers. | Vision + LM perplexity; theory of *why* still contested. | ABSTRACT_ONLY | Shows distillation transmits ordering/margin information beyond labels — relevant to whether Rune's distillates inherit teacher failure modes (arm-1's finding, independently supported here).
+
+**S4.** 2306.02707 | Orca: Progressive Learning from Complex Explanation Traces of GPT-4 | Mukherjee et al. 2023 | explanation-trace distillation | (Noted for completeness; arm 1 owns core distillation.) Explanation traces beat naive output-only SFT at matched data. | — | — | METADATA_VERIFIED (abstract only, ID verified) | Peripheral: supports "why not just outputs" — traces carry process signal.
+
+### (2) Policy / behavioural learning: imitation, traces, verbal learning, self-correction
+
+**S5.** 1011.0686 | A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning (DAgger) | Ross, Gordon, Bagnell 2011, AISTATS | distribution shift in behavioural cloning | BC's expected cost provably grows **quadratically in horizon T** (J(π̂_sup) = (1−εT)J(π*) + T²ε; tight via Kääriäinen 2006), because a single learner mistake induces states absent from expert data → compounding errors. DAgger trains on expert relabelings of *states the learner induces*, reducing guarantee to ~linear (O(εT²/T·N) with N iterations); empirically supervised baseline stagnates as more expert data is added (extra demos do not fix the learner's own error states; Super Mario agent "stuck at some location"), while DAgger keeps improving. | The paper is explicit that fixing BC needs **expert queries on the learner's own distribution** — pure log data cannot do it. | Requires an expert (or oracle) available at training states; iterations scale with effective horizon. | FULL_PAPER (ar5iv full-text deep read — imitation-limits anchor) | Direct warning for Rune: retraining on Rune's *own successful trajectories only* trains on the wrong state distribution; the paper's fix (label the states the agent actually reaches) maps to relabeling agent-attempted (including failed) trajectories, not just successes. [7L] [OVL-0]
+
+**S6.** 2310.12823 | AgentTuning: Enabling Generalized Agent Abilities for LLMs | Zeng et al. 2023 | fine-tuning on agent trajectories | Instruction-tuning Llama-2 on ~1.8K high-quality interaction trajectories mixed with general SFT data (AgentLM) substantially closes the agent gap vs GPT-4 on held-out agent tasks without degrading general ability. | Fine-tuning on agent data *alone* degrades general capabilities — the hybrid mix is load-bearing. | Trajectories harvested from 6 benchmark environments; small dataset. | ABSTRACT_ONLY | Trajectory-finetuning is viable at ~10³ scale but must be mixed with general data; an argument against Rune fully specializing its base weights on its own traces. [GD-0]
+
+**S7.** 2310.05915 | FireAct: Toward Language Agent Fine-tuning | Chen et al. 2023 | trajectory fine-tuning | 500 GPT-4-generated trajectories fine-tuned into Llama2-7B yields +77% HotpotQA; diversity of trajectory sources further helps. | Gains concentrated on tasks similar to training; prompting and fine-tuning show different failure modes (not interchangeable). | QA-with-search only; 7B scale. | ABSTRACT_ONLY | Very small trajectory counts move agent ability a lot — suggests Rune's trace corpus is valuable, but also that 500 traces can imprint narrow habits (drift risk).
+
+**S8.** 2303.11366 | Reflexion: Language Agents with Verbal Reinforcement Learning | Shinn et al. 2023, NeurIPS | verbal (non-weight) learning from outcomes | Agents store self-generated *linguistic* reflections in episodic memory after failure signals; 91% pass@1 HumanEval (vs GPT-4 80%), large gains on AlfWorld/HotpotQA; works with scalar, external, or internally simulated feedback. | Effectiveness depends on having *specific* failure signals; internally-simulated feedback degrades on tasks where the model can't evaluate itself; each retry costs full-context tokens. | 2–4 trials typical; memory buffer is per-task (not lifelong); no promotion/verification of lesson quality. | ABSTRACT_ONLY | Direct ancestor of Rune's lesson mechanism: verbal learning works, but the paper's buffers are task-local and ephemeral — Rune's [7L] persistent cross-task lessons go *beyond* Reflexion's evidence, which is per-task-trial evidence only. [7L] [OVL-0]
+
+**S9.** 2310.01798 | Large Language Models Cannot Self-Correct Reasoning Yet | Huang et al. 2024, ICLR | intrinsic self-correction without external feedback | With **no external feedback**, self-correction prompts frequently make reasoning answers *worse*; improvements reported elsewhere come from ensembling-ish variance, better prompts, or leaked external signal. | Explicit negative: intrinsic self-correction of reasoning is not supported; only *verifiable/external-feedback* correction (tool results, unit tests) reliably helps. | Reasoning tasks (GSM8K etc.); excludes code-with-tests where correction is verifier-anchored. | ABSTRACT_ONLY | Core mixed-evidence finding: Rune lessons derived from *its own* unaided reflection are suspect; lessons tied to external verification (tests, execution) are the supported class. [OVL-0]
+
+**S10.** 2211.00053 | Generating Sequences by Learning to Self-Correct | Le, Kayser?, actually: (Bengio group) 2022 | trained corrector decoupled from generator | A separate corrector model (possibly smaller than base) trained on scalar/NL feedback iteratively fixes constraint violations where prompting alone fails. | Requires training data of imperfect generations + feedback — not zero-shot. | Constraint-style tasks (program synthesis, lexical constraints, toxicity); not general reasoning. | ABSTRACT_ONLY | Supports "self-correction works when a dedicated corrector is *trained* on correction data" — consistent with S9's negative on prompt-only correction.
+
+**S11.** 2308.10144 | ExpeL: LLM Agents Are Experiential Learners | Zhao et al. 2023, AAAI | insight extraction from experience without weight updates | Agent accumulates trajectories, uses LLM to extract natural-language insights (success vs failure comparison), retrieves insights+similar trajectories at inference; consistent gains across ALFWorld/WebShop/HotpotQA; insights transfer across tasks. | Insights are LLM-summarized and never verified against subsequent outcomes in closed loop; quality varies; relies on a strong extractor model. | Cross-task transfer shown but on same-family benchmarks. | ABSTRACT_ONLY | Closest published analogue to Rune's lesson pipeline (trace → insight → reuse); note it does NOT close the loop by measuring whether each insight improved anything — same gap as Rune's [OVL-0].
+
+**S12.** 2411.02337 | WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum RL | Qi et al. 2024, ICLR 2025 | outcome-grounded RL from verified web-task success | Self-evolving curriculum (new tasks generated from failures) + outcome-supervised reward model lifts Llama-3.1-8B from 4.8% → 42.4% and GLM-4-9B 6.1% → 43% on WebArena-Lite, beating GPT-4-Turbo (17.6%). | Policy distribution drift in online learning is named as a first-class failure mode requiring adaptive KL/strategies; reward model is a learned proxy (overoptimization risk, cf. S24). | WebArena tasks only; verifier = scripted task checkers. | ABSTRACT_ONLY | Strongest positive evidence that *verified outcome → weight update* works at agent scale when the outcome signal is a hard environment check. Rune's outcome loop needs exactly this class of check, and this paper names Rune's drift risk. [OVL-0]
+
+### (3) Skill libraries + procedural memory
+
+**S13.** 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | Wang, Xie, Jiang, Mandlekar, Xiao, Zhu 2023, TMLR/ICLR'24 | skill library — promotion mechanism | Promotion mechanism (deep-read result): a candidate skill (executable code) is committed to the library **iff** an environment execution loop terminates with a *separate GPT-4 self-verification agent* confirming task completion from environment state; skill indexed by GPT-3.5-generated description embedding; retrieval = top-5 similar skills; skills compose (complex skills call simpler ones) and this composition is credited with avoiding catastrophic forgetting; transfer to a new Minecraft world works from the library alone (3.3× more unique items, 2.3× distance, up to 15.3× faster tech-tree than SOTA). | Documented failure modes (paper's own §4): (i) self-verification can *fail to recognize success* (missed spider-kill signal) — i.e. the promotion gate itself is model-judged and noisy; (ii) agent gets stuck, fails to generate correct skill; (iii) curriculum hallucinates impossible tasks; (iv) GPT-4-quality code generation is load-bearing — GPT-3.5/open models "cannot provide" it (their Fig. 9). No regression testing of skills against *new* contexts; no deprecation mechanism. | Minecraft-specific; verification is a second GPT-4 call, not ground truth. | FULL_PAPER (ar5iv full-text deep read — arm priority #1) | This is the strongest published promotion gate: **verified-once + indexed + composable**. For Rune [ESL]: a procedure becomes a skill only after execution-verified success; but Voyager's one-shot verification is exactly what Rune's governed gates should exceed (re-verification on reuse, regression on environment change). Voyager never re-validates stored skills — known staleness blind spot. [152M] [ESL]
+
+**S14.** 2409.07429 | Agent Workflow Memory (AWM) | Wang, Mao, Fried, Neubig 2024 | induced reusable workflows | Induces workflows (subroutines of abstracted actions) from trajectories; +24.6% relative success on Mind2Web, +51.1% on WebArena; online (test-time) induction generalizes across tasks/sites/domains (+8.9–14.0 absolute as train-test gap widens); reduces steps. | Workflows induced by LLM from successful examples only; no formal validity checking; top-k workflow selection can inject irrelevant procedures (paper studies k). | Two web benchmarks; workflows in natural-language/action pseudocode, not executable code. | ABSTRACT_ONLY (abstract numbers verified) | Confirms routine/procedure reuse pays on *web* agents with distribution shift; Rune's equivalent is its [152M] deterministic modules + [ESL] procedures — AWM is the evidence that a workflow library beats trajectory memory.
+
+**S15.** 2508.06433 | Memp: Exploring Agent Procedural Memory | Fang et al. 2025 | build/retrieve/update of procedural memory | Distills trajectories into fine-grained step instructions + script-level abstractions; on TravelPlanner/ALFWorld refined memory → steadily higher success and fewer steps; **procedural memory built by a strong model transfers to a weak model** (GPT-4o-built memory + Qwen2.5-14B: +5% completion, −1.6 steps on TravelPlanner); includes explicit update/correct/**deprecate** regimens. | Ablations show wrong update strategy can *hurt* (memory pollution); retrieval-key design materially affects gains; benchmarks are simulated. | Two benchmarks; gains incremental (single-digit %). | RELEVANT_SECTIONS (abstract + analysis/update sections read) | Memp is the first cited work with a *deprecation* mechanism — the direct evidence for Rune's stale-skill invalidation concern; also shows procedural memory is model-portable (write once, weaker models benefit). [ESL]
+
+**S16.** 2504.07079 | SkillWeaver: Web Agents can Self-Improve by Discovering and Honing Skills | 2025 | skills as synthesized APIs + practice | Agent discovers skills on new sites, practices them, distills practice into robust APIs; +31.8% relative success WebArena, +39.8% real-world; strong agent's APIs transfer to weaker agents. | "Honing" = iterative practice on the same environment; no adversarial environment-change testing. | Web domains. | ABSTRACT_ONLY | Adds "practice iterations harden a skill" as a promotion criterion beyond single verification. [ESL]
+
+### (4) Code as learned capability
+
+**S17.** 2207.10397 | CodeT: Code Generation with Generated Tests | Chen et al. 2022, ICLR'23 | test-filtered sampling | Generate N programs + N test suites from the same LLM; rank programs by dual execution agreement; large consistent gains over raw sampling and other rankers across HumanEval/MBPP/APPS/CodeContests and 5 models. | Test quality is unverified — generated tests can be wrong; gains shrink when tests are poor. | Selects among samples; does not create new capability. | ABSTRACT_ONLY | Anchor for "execution-filtered sampling beats direct generation" — Rune's test-verified code paths are this, and it is *selection*, not learning: the filter's value is bounded by test quality. [152M]
+
+**S18.** 2401.08500 | Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering | Ridnik, Kredo, Friedman 2024 | multi-stage test-based iterative flow | GPT-4 CodeContests pass@5: 19% → 44% via staged flow (spec reasoning, public-test reasoning, generate, run, self-repair against tests, AI-test hardening). | Heavy inference compute (many iterations); competitive-programming-shaped tasks; flow engineering is hand-designed. | Single model (GPT-4) headline. | ABSTRACT_ONLY | Positive: iterative test-anchored refinement nearly doubles pass rates; the *flow* is designer code — consistent with arm-2's CoALA conclusion that learning/verification loops belong in code. [OVL-0]
+
+**S19.** 2304.05128 | Teaching LLMs to Self-Debug | Chen, Lin, Schärli, Zhou 2023 | execution-feedback loop | Self-debugging with execution feedback + code explanation improves Spider by 2–3% (and hardest level +9%), TransCoder/MBPP up to 12%; feedback reuse cuts iterations. | On benchmarks *without* unit tests, gains are small (2–3%) — self-debugging without ground-truth signal is weak. | Few-shot, frontier-scale models. | ABSTRACT_ONLY | Quantifies the gap between verifier-anchored correction (up to 12%) and unanchored correction (2–3%) — the same ~4–5× asymmetry as S9. [OVL-0]
+
+**S20.** 2310.08992 | CodeChain: Modular Code Generation Through Chain of Self-revisions with Representative Sub-modules | 2023 | emergent reusable modules | Clusters generated sub-modules across samples, feeds cluster representatives back as reusable building blocks; large gains on competitive coding vs monolithic generation. | Module "representativeness" is cluster-voting, not verified correctness of the module per se. | Competitive programming only. | ABSTRACT_ONLY | Evidence that *reusable sub-procedures* emerge from population-level filtering — a weak form of skill genesis; supports Rune's module-mining from its own [152M] corpus but says vote-popularity ≠ correctness.
+
+**S21.** (synthesis note, not a source) CodeT/Self-Debug/AlphaCodium/CodeChain collectively answer the Rune question "does generated+tested code constitute learned intelligence or just an artifact?": the code is an **artifact** until two additional properties exist — (a) it passed a verification gate anchored outside the generator (S9/S19 asymmetry), and (b) it is *retrieved and reused successfully later* (S13/S14/S15/S16). Without (b) it is merely output; without (a) it is a hypothesis. This is developed in Verdict (c).
+
+### (5) Rule extraction / symbolic compilation
+
+**S22.** Craven & Shavlik, "Using Sampling and Queries to Extract Rules from Trained Neural Networks" / TREPAN, ICML 1997 / Machine Learning 29 (pre-arXiv; DOI 10.1023/A:1007321402323) | decision-tree extraction from networks | Rules/trees extracted with query-based sampling can match or exceed the network's own accuracy on some domains while being interpretable; fidelity typically < 100%. | Edge-case loss: extracted trees agree with the network on most but not all inputs; disagreements concentrate in low-density regions — exactly where novel agent inputs live. | 1990s-scale nets; no LLM evidence. | METADATA_VERIFIED via secondary literature (classic citation; not on arXiv — flagged honestly) | Historical anchor for rule extraction's core trade: fidelity vs coverage; low-density disagreement is the predictable failure mode if Rune ever compiles [152M] module behaviour into rules.
+
+**S23.** 1805.04770 (see S3) doubles here: born-again distillation is the modern "faithful-ish compilation" path — the student reproduces the teacher's *behaviour distribution* more faithfully than symbolic rules, at the cost of remaining opaque. Rule extraction and distillation sit at opposite ends of a fidelity/opacity trade.
+
+*(Neuro-symbolic compilation limits and confidence transfer are covered by S22+synthesis; no strong modern arXiv anchor with verified ID was found for LLM-scale symbolic compilation in this arm's searches — recorded as a gap, not filled with unverified IDs.)*
+
+### (6) Classifier training from agent experience
+
+**S24.** 2103.08493 | How Many Data Points is a Prompt Worth? | Logan IV et al. 2021, EMNLP Findings | data-equivalence of prompts | Fair-comparison log-linear analysis across classification tasks: prompting is "worth" hundreds of labelled data points on average (median ~a few hundred; high variance). | Benefit vanishes with enough data; prompt engineering quality dominates at tiny scales. | Classification only; per-task variance huge. | ABSTRACT_ONLY | Calibrates Rune's crossover: below a few hundred labelled examples a prompted big model wins; above, a trained small model wins — the same crossover S2 exploits.
+
+**S25.** 1605.07723 | Data Programming (Snorkel) | Ratner et al. 2016, NeurIPS | weak supervision / labelling functions | Modelling noisy labelling functions as a generative process and denoising lets weak labels train competitive discriminators (would-have-won TAC-KBP 2014). | Labelling functions themselves encode expert errors; conflicts and correlations among LFs require modelling. | Pre-LLM; small models. | ABSTRACT_ONLY | Template for Rune building routing/classifiers from *code-defined labelling functions* over its own logged experience — cheapest path to the first few thousand labels. [7L]
+
+**S26.** 1911.04252 | Self-training with Noisy Student improves ImageNet classification | Xie et al. 2020, CVPR | self-training (positive pole) | Iterative teacher→pseudo-label→larger-noised-student reaches 88.4% ImageNet; big robustness gains. | Requires equal-or-larger student, heavy noise injection, and 300M unlabelled images; without these, self-training degrades. | Vision only. | ABSTRACT_ONLY | Positive-pole anchor; the conditions (noise, scale, equal-size student) are exactly what Rune's local self-training loop cannot cheaply provide.
+
+**S27.** 2307.02075 | Combating Confirmation Bias: A Unified Pseudo-Labeling Framework for Entity Alignment | Mao et al. 2023 | self-training pitfall | Confident pseudo-labels compound their own errors across self-training rounds; one-to-one constraint + parallel ensembling reduces confirmation bias. | The negative is the point: naive confidence-thresholded pseudo-labelling drifts. | KG entity alignment domain. | ABSTRACT_ONLY | Names the failure mode for any Rune loop that trains on its own high-confidence outputs (self-labelling drift); arm-2's accumulate-not-replace finding applies at classifier level too.
+
+### (7) Continual / local fine-tuning
+
+**S28.** 2106.09685 | LoRA | Hu et al. 2021, ICLR'22 | adapter mechanics | Rank-decomposition adapters: 10,000× fewer trainable params, 3× less memory, no inference latency, ≈ full-FT quality on the evaluated tasks; adaptation is empirically low-rank. | Quality parity claims are for 2021-era tasks/eras — later work (S29) revises them. | — | ABSTRACT_ONLY | Baseline mechanics for Rune's local adaptation option.
+
+**S29.** 2305.14314 | QLoRA | Dettmers et al. 2023, NeurIPS | finetuning quantized models | 4-bit NF4 frozen base + LoRA ≈ 16-bit FT task performance (Guanaco 99.3% of ChatGPT on Vicuna bench); 1,000+ models finetuned; paged optimizers. | Vicuna-bench-era evaluation criticized as weak; performance claims are chat-eval, not agent-eval; 4-bit base + NF4 interacts with quantization task-sensitivity (arm 1's domain — Rune's 27B IQ2_M is *below* the 4-bit safe floor, so QLoRA-style FT on IQ2_M is unmeasured and risky). | Chat benchmarks. | ABSTRACT_ONLY | For Rune: fine-tuning a 2-bit model is outside the demonstrated envelope; the 4-bit evidence does not transfer down.
+
+**S30.** 2405.09673 | LoRA Learns Less and Forgets Less | Biderman et al. 2024, ICML'25 | forgetting magnitudes — anchor | Deep-read results: in CPT (20B tokens code/math), LoRA **substantially underperforms** full FT and the gap is not closed even at high rank; in IFT (~100K pairs) high ranks close most of the gap; LoRA **forgets less** of the source domain (HellaSwag/WinoGrande/ARC) and beats weight decay/dropout at forgetting mitigation and generation diversity; full FT learns perturbations of rank 10–100× higher than typical LoRA configs; LoRA is *very* sensitive to LR/target-module/rank hyperparameters — mis-tuning silently underperforms. | The honest asymmetry: less forgetting is partly *less learning*. No replay-based comparison at matched compute. | Llama-2-7B; two domains. | RELEVANT_SECTIONS (arXiv HTML deep read — forgetting anchor) | For Rune: LoRA is the *safe* local-finetune choice precisely because it changes less — the trade is explicit: (learn more ⇔ forget more). Rollback is trivial (adapter is a separate artifact). Supports adapters over in-place edits for any local specialization. [GD-0]
+
+**S31.** 2410.21228 | LoRA vs Full Fine-tuning: An Illusion of Equivalence | Ryu et al. 2024/25 | spectral mechanism of forgetting | LoRA-trained matrices develop "intruder dimensions" (new high singular vectors absent in full FT); forgetting after LoRA is *causally localized* to these dimensions — scaling them down post-hoc restores pre-training-distribution fidelity with minimal task loss. | Confirms LoRA solutions are genuinely non-equivalent to full FT, not just smaller. | Text-to-image (FLUX/SDXL) + LLM discussion. | ABSTRACT_ONLY | Mechanistic explanation behind S30's forgetting asymmetry; also a post-hoc rollback knob (rescale intruders) for deployed adapters.
+
+**S32.** 1706.08840 | Gradient Episodic Memory (GEM) | Lopez-Paz & Ranzato 2017, NeurIPS | replay requirements | Continual learning with a small episodic memory of past examples constrains gradients so loss on old tasks never increases; quantifies forgetting vs backward/forward transfer. | Needs stored raw examples (privacy/size); per-task constraint checks. | Small-image benchmarks. | ABSTRACT_ONLY | Canonical replay evidence: without *some* replay or subspace protection, forgetting is the default. Rune has no data lake → replay-based FT is not currently available; subspace methods (S33) are the replay-free alternative.
+
+**S33.** 2310.14152 | O-LoRA: Orthogonal Subspace Learning for LM Continual Learning | Wang et al. 2023, EMNLP Findings | adapter accumulation without replay | Successive tasks learned in mutually orthogonal low-rank subspaces; mitigates catastrophic forgetting, no user-data replay needed, preserves general ability. | Task-order effects remain; assumes task boundaries; ranks accumulate over time. | Standard CL benchmarks + LLaMA-7B. | ABSTRACT_ONLY | Directly applicable pattern for Rune: accumulate adapters in orthogonal subspaces = accumulate-not-replace (arm-2's collapse principle) instantiated for weights.
+
+**S34.** 2202.05262 | ROME: Locating and Editing Factual Associations in GPT | Meng et al. 2022, NeurIPS | model editing | Causal tracing localizes factual recall to mid-layer FFNs; rank-one edits update facts with decent specificity+generalization where baselines sacrifice one. | Evaluated on single/few facts; success metrics are narrow. | GPT-2/GPT-J scale. | ABSTRACT_ONLY | —(see S35/S36 for the reliability verdict)
+
+**S35.** 2210.07229 | MEMIT: Mass-Editing Memory in a Transformer | Meng et al. 2023, ICLR'23 | batch model editing | Scales editing to thousands of associations on GPT-J/GPT-NeoX (orders of magnitude beyond prior). | Editing distributed across layers degrades as N grows; downstream effects under-measured. | — | ABSTRACT_ONLY | —|
+
+**S36.** 2307.12976 | Evaluating the Ripple Effects of Knowledge Editing in Language Models (RippleEdits) | Cohen-Wang et al. 2024, ICLR'25 | editing reliability — the negative | Editing one fact creates required updates to logically entailed facts ("ripple effects"); RippleEdits (5K edits) shows **current editing methods largely fail** to propagate consistent changes; paraphrase+symmetry consistency is poor; a simple prompt-based "model editing" baseline often beats weight edits. | Direct negative result on weight-editing reliability. | Factual triples, not procedures. | ABSTRACT_ONLY | Verdict input: weight-level "learning" (ROME/MEMIT-style) is unreliable for anything with logical entanglement — Rune facts live in entangled context, so weight editing is the wrong tool; store-and-retrieve or adapter-based are supported instead.
+
+### (8) Outcome-grounded learning
+
+**S37.** 2210.10760 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman, Hilton 2022, ICML'23 | verifier gaming | Optimizing against a proxy reward first raises, then *decreases*, gold-standard reward; d(optimization) law-like for both RL and best-of-n; KL penalty linearly trades; dataset size shifts the curve. | The whole paper is the failure mode: any learned/derived outcome signal gets gamed as optimization pressure grows. | Synthetic gold-proxy setup (careful but synthetic). | ABSTRACT_ONLY | Predicts the failure of Rune's outcome loop once outcomes become an optimization target (e.g. lesson selection rewarded by proxy metrics): measure on real outcomes, never optimize against a learned proxy of them.
+
+**S38.** 2312.08935 | Math-Shepherd: Verify and Reinforce LLMs Step-by-step without Human Annotations | Wang et al. 2023/24, ACL'24 | process rewards from outcomes | Automatic process supervision: label each solution step by MC rollouts of whether it leads to a verified-correct final answer; PRM improves reranking (Mistral-7B GSM8K 77.9→89.1% w/ verification) and step-level PPO (84.1% GSM8K). | Hard-label MC estimation is noisy for early steps; final-answer verification can reinforce lucky-guess paths (spurious credit). | Math only. | ABSTRACT_ONLY | Best-practice template for outcome→step attribution: estimate per-step credit by *repeated rollout from that step to a verified end*, not by asserting it from the trace. Directly answers Rune's attribution problem design question. [OVL-0]
+
+**S39.** 2408.15240 | Generative Verifiers: Reward Modeling as Next-Token Prediction | Zhang et al. 2024/25 | verifier quality | GenRM (verification as CoT generation + majority vote) beats discriminative verifiers and LLM-as-judge: GSM8K BoN 73→93.4%, algorithmic tasks 5→45.3%; strong easy-to-hard generalization. | Verification via generation costs inference compute; still a proxy (overoptimization applies). | — | ABSTRACT_ONLY | When Rune needs a learned verifier for non-executable outcomes, make it generate critiques rather than score — but prefer executable verification whenever available (S17/S19 asymmetry).
+
+### (9) Multi-teacher / correlation
+
+**S40.** 2302.07215 | Multi-teacher KD as an Effective Method for Compressing Ensembles | Ilin et al. 2023 | ensemble→single distillation | Multi-teacher KD (logit/vote fusion) recovers most of ensemble accuracy in one student; fusion mechanism choice matters. | Teacher disagreement handling is heuristic; small-scale vision/NLP tasks. | — | ABSTRACT_ONLY | Positive pole for multi-teacher when teachers are *individually trained on different data/architectures* (i.e. genuinely diverse).
+
+**S41.** 2506.07962 | Correlated Errors in Large Language Models | Raghavan et al.? (authors per abs page) 2025 | consensus ≠ corroboration | Across 350+ LLMs: models agree on errors ~60% of the time on a leaderboard dataset; correlation driven by shared architecture/provider, and — crucially — **larger, more accurate models have highly correlated errors even across distinct architectures and providers**; downstream monoculture effects shown in LLM-as-judge and hiring. | The negative is the finding: independent-seeming LLMs are not independent error sources. | Three evaluation contexts; task coverage partial. | ABSTRACT_ONLY | Directly kills the assumption that "3 models agreed ⇒ verified": for Rune, consensus among same-lineage models (or models sharing pretraining data) is weak evidence; only *execution/verification* evidence is independent of this monoculture.
+
+**S42.** 2403.02419 | Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems | Chen, Manoyina?, actually: (Stanford) 2024, ICML'25 | self-consensus scaling limits | Majority-vote and filter-vote performance is **non-monotonic** in number of calls: rises on easy queries, *falls on hard* ones; task-level shape depends on difficulty mix. | More calls ≠ more corroboration; hard-query degradation is structural. | Vote/Filter-Vote designs only. | ABSTRACT_ONLY | Second kill: even self-agreement saturates and inverts. Rune should not treat repeated sampling agreement as verification for hard tasks.
+
+### (10) Verifier-guided learning — covered by S37–S39 + S17–S20. (RLVF EMNLP'23 not included: could not verify its arXiv ID under API rate limits; the verified anchors above cover the mechanism class. Recorded as a gap honestly rather than cited unverified.)
+
+---
+
+## 2. Synthesis verdicts
+
+### (a) When does distillation / narrow fine-tune actually match a teacher on a bounded task?
+
+Evidence-supported conditions, all five required by the literature:
+1. **Verifiable, bounded output space.** Distillates match teachers on competition math/code (S1: 32B distillate beats QwQ; 7B beats GPT-4o on AIME) where outputs are checkable and the *task family* matches the training set. Nobody has shown distillate≈teacher on open-ended agentic rollouts (R1's own SWE-Verified gap).
+2. **Teacher-generated trajectories ≥ verified-correct.** Distillation transmits the teacher's process (S3/S4); if the teacher fails a certain way, so does the student — filter traces by outcome before distilling (S1's 800K set was RM-filtered).
+3. **Enough data of the right kind, mixed with general data.** ~800K verified reasoning pairs (S1); 500 trajectories suffice to move a 7B agent (S7) but hybrid mixing is needed to avoid degrading general ability (S6's negative).
+4. **Distillation beats local RL for small models** on reasoning (S1 F.1: 72.6 vs 47.0 AIME): Rune should distill from verified traces before attempting local RL.
+5. **A small trained model beats a prompted large one above roughly hundreds of labelled examples** (S24 crossover; S2's 770M > 540B few-shot). Below that, prompt the big model.
+
+For Rune: matching a teacher on a *narrow task* is real and reproducible for classification, extraction, and code-with-tests; for agentic behaviour, distillation gets the style, not the competence (S1's SWE gap).
+
+### (b) Does outcome-grounded learning (expectation → outcome → lesson) have real evidence, and what are its failure modes?
+
+**Yes for the outcome → update half; thin for the lesson → analogous-application half; unmeasured for the full loop** — which is precisely Rune's [OVL-0] situation.
+- Real evidence: environment-verified outcomes drive large gains via RL (S12: 4.8→42.4%), via PRM-style step credit (S38), and via test-anchored iteration (S18). Verbal outcome learning also works per-task (S8).
+- The loop's documented failure modes:
+  - **Attribution** — which part of the trace caused success is not observable from one rollout; MC rollouts from intermediate steps to verified ends are the only supported estimator (S38), and it is noisy and costly.
+  - **Spurious correlation / lucky paths** — final-answer verification reinforces chance successes (S38's own caveat); outcome similarity ≠ causal similarity.
+  - **Verifier gaming** — once outcomes feed any optimization loop, proxy reward gets over-optimized (S37): Rune must measure on real outcomes but never select lessons *by a learned proxy* of them.
+  - **Distribution shift / drift** — training (even softly, by lesson reuse) on the agent's own state distribution compounds errors (S5's quadratic law); S12 names policy drift explicitly and needs adaptive countermeasures.
+  - **Unanchored self-correction is negative** — lessons/reflections generated without external signal often hurt (S9); the supported lesson classes are those tied to execution results, tests, or environment checks (S9, S19: 2–3% vs 12% asymmetry).
+  - **No closed-loop measurement in the literature** — ExpeL (S11), Reflexion (S8), Memp (S15) extract insights/procedures but none report a measured *per-lesson* counterfactual improvement (lesson applied → analogous case measured better). Rune's expectation→action→outcome→lesson→analogous-application→measured-improvement loop is therefore *ahead of the published evidence*, not behind it: it is a hypothesis that the field has only validated piecewise. The A/B-analogous-case measurement design is exactly what would make it evidence.
+
+### (c) What makes a generated procedure a SKILL (evidence-based promotion criteria)?
+
+Synthesizing S13 (deep read), S14, S15, S16, S17, S19:
+1. **External-anchored success at least once** (Voyager's gate): execution completed with an environment/test check confirming the *task*, not just absence of exceptions (S13; S17).
+2. **Indexable intent**: stored with a description that supports retrieval in future analogous situations (S13's embedding-of-description; Memp's key strategies).
+3. **Composability**: referenced successfully by later, more complex procedures (Voyager's core compounding claim — the strongest signal that a stored procedure is a skill rather than a script).
+4. **Practice hardening**: repeated successful executions, ideally including practice iterations (S16) — single-shot verified skills are the weakest class in every cited system.
+5. **Survivorship under environment change**: Memp's deprecation/update regimen is the only published mechanism addressing staleness (S15); AWM shows value *degrades* gracefully with train-test gap but doesn't test environment mutation directly.
+6. **Not just popular**: CodeChain (S20) shows cluster-vote popularity is a selection signal but not correctness — popularity-based promotion without verification is rejected.
+Minimum evidence-based promotion gate for Rune [ESL]: verified success (1) + intent description (2) + at least one successful *reuse* in an analogous task (4/3) before treating it as a skill rather than an artifact; re-verify on environment-version change (5).
+
+### (d) Weights vs retrieval vs procedure for Rune's learning
+
+Ranked by evidence-per-risk for a local, stateful agent with no data lake and no measured loop:
+1. **Procedure (code skills / deterministic modules)** — strongest evidence: S13–S16, S18–S20; zero forgetting risk (weights untouched), inspectable, rollback = delete; compounding demonstrated (Voyager's composition, 3.3× items). This is where Rune's [152M] modules live and where [ESL] promotion gates are correctly placed.
+2. **Retrieval (lessons, traces, workflows)** — solid per-task evidence (S8, S11, S14, S15); risks are staleness (needs Memp-style deprecation) and drift if lessons shape behaviour without outcome re-measurement (S5, S9). Verbal lessons must be treated as hypotheses, not knowledge.
+3. **Weights, adapter-form (LoRA/O-LoRA with accumulate-not-replace)** — safe but weak: LoRA "learns less" (S30) which *is* the feature for a general agent; orthogonal-subspace accumulation avoids replay (S33) matching arm-2's accumulate-not-replace; rollback trivial (adapter artifact; intruder-dimension rescaling as finer knob, S31). Full fine-tuning and weight editing rejected (S36's ripple-effect failure; S29's 2-bit envelope).
+4. **Weights, in-place editing** — rejected on current evidence (S36).
+5. **Weights, full FT on own traces** — rejected for now: needs replay (S32) Rune doesn't have, risks general-ability loss (S6 negative), and distillation of the same traces is strictly safer (S1 F.1).
+
+### (e) Multi-teacher correlation verdict
+
+Multiple teachers help only when their *errors* are decorrelated — and the literature says the decorrelation assumptions usually fail: 350+ models agree ~60% of the time when both err, and error correlation *rises* with capability even across architectures and providers (S41); self-agreement is non-monotonic and degrades on hard queries (S42). Genuine diversity requires differing training data and the ensemble-distillation fusion still only partially recovers ensemble accuracy (S40). **Verdict for Rune: consensus among models with shared lineage/pretraining data is weak corroboration; treat model-agreement as a cheap prior, never as verification; the only error-independent checkers in Rune's world are execution, tests, and environment state.** Conversely, this means multi-teacher distillation for Rune (e.g. several local models generating candidate lessons) adds little beyond the best verified trace corpus.
+
+---
+
+## 3. Rejected approaches (with reasons)
+
+1. **Cascade/routing by learned router on in-distribution labels** — already rejected by arms 1–2; this arm adds: routing classifier training is only viable above the S24 crossover (~100s labels), which Rune's [7L]-era data does not yet support; weak supervision via labelling functions (S25) is the only bootstrap that gets there without hand-labelling.
+2. **Weight-level model editing (ROME/MEMIT) for Rune knowledge updates** — RippleEdits (S36) shows ripple-effect inconsistency at scale; facts in code-agent contexts are entangled; store-and-retrieve dominates.
+3. **Full fine-tuning on Rune's own traces** — quadratic distribution-shift law (S5), replay requirement (S32), general-ability degradation without mixing (S6); local RL also underperforms distillation at small scale (S1 F.1).
+4. **Fine-tuning the quantized 27B IQ2_M base** — QLoRA evidence is 4-bit (S29); IQ2_M is below arm-1's established safe floor; unmeasured envelope, real risk.
+5. **Intrinsic self-correction prompts as a learning source** — negative evidence (S9, S19's no-test regime); lessons must anchor to execution/tests/environment.
+6. **Consensus/majority-vote as verification** — S41, S42.
+7. **Popularity-based skill promotion (CodeChain-style cluster votes) without execution verification** — S20 limitation.
+8. **Proxy-reward optimization of the lesson loop** — S37; measure on real outcomes, don't optimize a learned proxy of them.
+9. **Naive confident self-training for Rune's classifiers** — confirmation-bias drift (S27); requires constraints/ensembling as in S27 or Noisy-Student-scale noise machinery (S26) that Rune can't afford locally.
+
+## 4. Do-not-cite register
+
+IDs verified to be WRONG papers (do not pair with the intended topics again):
+- **2403.02719** — "Multi-Scale Subgraph Contrastive Learning" (NOT "Are More LLM Calls All You Need?" — correct is **2403.02419**)
+- **2401.08900** — "Atmospheric Science Questions for a Uranian Probe" (NOT AlphaCodium — correct is **2401.08500**)
+- **2310.08920** — "Embarrassingly Simple Text Watermarks" (NOT CodeChain — correct is **2310.08992**)
+- **2307.02958** — spin-orbit-coupled double quantum dots physics (NOT Ripple Effects — correct is **2307.12976**)
+- **2401.01280** — "GEqO: ML-Accelerated Semantic Equivalence Detection" (NOT the LLM editing survey)
+- **1912.13488** — neutrino non-standard interactions physics (NOT the De Lange continual-learning survey; that survey is IEEE TPAMI 2021 and was not arXiv-verified this cycle — do not cite with an arXiv ID)
+- **2006.03844** — "Replacements and Replaceables: Making the Case for Code Variants" (NOT "Rethinking Pre-training and Self-training")
+- **2205.10436** — "Emergence of bacterial glass" (NOT "Knowledge Distillation from a Stronger Teacher")
+- **2411.13843** — developable-surface shape optimization physics (NOT WebRL — correct is **2411.02337**)
+- **RLVF (EMNLP 2023)** — arXiv ID not verifiable this cycle under rate limits; excluded rather than risk a bad ID.
+
+## 5. Evidence gaps (honest, for the atlas)
+
+- No measured per-lesson counterfactual loop (lesson → analogous application → measured delta) exists in the cited literature — the closest are ExpeL/Reflexion/Memp, all open-loop. Rune's [OVL-0]/[GD-0] gap is therefore a *frontier* position, not a lag.
+- No modern arXiv-verified anchor for LLM-scale symbolic rule compilation was found; TREPAN-era evidence (S22) is 1990s-scale.
+- AWM's environment-mutation invalidation behaviour is untested in the paper; staleness evidence relies on Memp's update regimen only.
+- SkillWeaver/Correlated Errors/CodeChain abstracts only; numbers quoted are from verified abstracts, not full texts.

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm4_systems_adversarial.md

@@ -0,0 +1,294 @@
+# AC #404 — Offline / Local Intelligence — Arm 4: CURRENT SYSTEMS / IMPLEMENTATION ECOSYSTEM + INDEPENDENT FRESH-CONTEXT ADVERSARIAL PASS
+
+_Domain: Memory Research Atlas R1 #404 · Rune project (single workstation, RTX 4070 Ti SUPER 16 GB VRAM ≈5.4 GB used by user apps at idle, 62 GB RAM)_
+_Arm scope: (A) what the 2024–26 local-inference implementation ecosystem actually delivers vs claims — llama.cpp/GGUF, runtimes, Ollama/LM Studio, small coding models, offline-shipped agents, production distillation, failure evidence, benchmark-vs-runtime gaps; (B) independent fresh-context adversarial pass on the candidate architecture (14 elements) + 100 mandated attacks + 18 Rune-specific attacks._
+_Sources arms 1–3 established and were NOT re-researched: quantization task-sensitivity (2504.04823), distillation transmits capability+errors+style (2301.12726), cascade/routing REJECTED for Rune, CoALA control-in-code, MemGPT model-owned memory degrades (2310.08560), escalation = pass@1 bins + verifier availability (2408.03314), DAgger T²ε (1011.0686), Voyager external-verifier-gated promotion (2305.16291), LoRA learns-less-forgets-less (2405.09673), WebRL outcome-grounded gains (2411.02337), consensus ≠ corroboration (2506.07962)._
+
+**Verification ledger (arXiv IDs re-verified this arm via arxiv.org/abs pages + Semantic Scholar after export-API rate-limiting; mis-pairings caught: 1):**
+
+| Prompt/context-supplied ID | Reality | Correct ID |
+|---|---|---|
+| 2305.09658 ("FrugalGPT") | **Noether Symmetries and Anisotropic Universe in Energy-Momentum Squared Gravity** (2021) — WRONG | FrugalGPT (Chen, Zaharia, Zou) = **2305.05176** (confirmed via stanford-futuredata/FrugalGPT README → arxiv.org/pdf/2305.05176) |
+
+All other IDs used in this file were resolved to their correct titles: 2305.17493 (Curse of Recursion), 2404.01413 (Is Model Collapse Inevitable?), 2310.08560 (MemGPT), 2506.07962 (Correlated Errors in LLMs), 2408.03314 (Snell test-time compute), 2411.02337 (WebRL), 2508.06433 (Memp), 2405.09673 (LoRA Learns Less and Forgets Less), 2305.16291 (Voyager), 2409.12186 (Qwen2.5-Coder TR), 2501.12948 (DeepSeek-R1), 2412.08905 (phi-4 TR), 2503.19786 (Gemma 3 TR), 2402.14905 (MobileLLM), 2504.04823 (Quantization Hurts Reasoning?), 2402.01613 (Nomic Embed), 2310.06770 (SWE-bench), 2405.15793 (SWE-agent).
+
+**Read depths used this arm:** DOCUMENTATION_AUDITED (official project docs/API references read verbatim from primary repos: llama.cpp, Ollama, vLLM, mlx-lm, ONNX Runtime GenAI, LM Studio; live SWE-bench leaderboard dataset parsed from swebench.com page data; Qwen team blog), COMMUNITY_EVIDENCE_RELIABILITY_LABELED (GitHub issue tracker searches on ollama/ollama — labeled as community, unverified), ABSTRACT_ONLY / METADATA_VERIFIED (papers via title-verified abs pages), INHERITED_VERIFIED (arm 1–3 results cited without re-reading).
+
+---
+
+# PART A — CURRENT SYSTEMS / IMPLEMENTATION ECOSYSTEM (2024–26)
+
+## A.1 Source ledger
+
+### Topic 1 — llama.cpp / GGUF ecosystem
+
+| # | ID / source | What it is | Key claims (docs) | What it does NOT deliver | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|
+| A1 | llama.cpp README + docs/ (ggml-org/llama.cpp, master, accessed this session) | The reference GGUF inference stack | Plain C/C++, CUDA/Metal/CPU backends; `llama-server` = OpenAI-compatible REST; multimodal (mtmd); quantize tool with imatrix ("accuracy loss… minimized by using a suitable imatrix file" — ppl/KLD are the *only* accuracy instruments the docs offer); docs/speculative.md: draft-model AND EAGLE-3 speculative decoding supported in llama-server, with EAGLE-3 drafts for Qwen3 1.7B–32B and gpt-oss families | Docs measure quant damage in **perplexity/KLD only** — no task-level (coding/reasoning) accuracy instrument ships with the tool that produced Rune's quants; the ecosystem's accuracy story for a specific quant file is *offloaded to community evaluations* | DOCUMENTATION_AUDITED | Rune's 27B IQ2_M was quantized with tooling whose own docs cannot tell Rune what it lost on Rune's tasks. Arm-1's finding (IQ2_M unmeasured) is not a Rune gap — it is the ecosystem's normal state |
+| A2 | llama.cpp docs/speculative.md | Speculative decoding guide | Three implementations: classic draft model, EAGLE-3 (hidden-state draft, one-layer transformer per target model), and mixing; speedups "when draft predictions are frequently correct"; EAGLE-3 checkpoints exist for Qwen3-14B (AngelSlim/Qwen3-14B_eagle3) | Requires a *target-model-specific* draft (EAGLE-3 heads are per-model artifacts); wrong draft → speedup evaporates; not lossless at the *latency* level (verification still runs the target) but lossless at output-distribution level | DOCUMENTATION_AUDITED | The architecture's item 8 ("speculative decoding = the lossless adaptive-compute win") is **ecosystem-real**: a Qwen-family EAGLE-3 draft for qwen3:14b exists off-the-shelf. But Ollama (Rune's actual runtime) support is newer/partial (see A8) |
+| A3 | llama.cpp tools/server/README.md | Server structured output | `--grammar` (GBNF), `--json-schema` / per-request `json_schema` and `grammar` fields; invalid grammar → request error (never silent) | Grammar constrains *sampling*, not *semantics* — a schema-valid wrong answer is still produced; no guarantee of tool-call correctness | DOCUMENTATION_AUDITED | Structured output is a solved constraint layer at the runtime level; Rune's real gap (inward probe: JSON-failure rate UNKNOWN) is upstream model quality, not runtime support |
+| A4 | k-quants PR #1684 + imatrix discussion #5263 (INHERITED from arm 1, DOCUMENTATION_AUDITED there) | Quant formats + calibration sensitivity | 2–6 bit ppl curves; "bigger quantizes better" bounded and non-monotone above ~13B; imatrix corpus choice measurably changes Q2_K quality | No per-task accuracy instruments; community KL-div proxies only | INHERITED_VERIFIED | Whatever imatrix made Rune's IQ2_M files determines how much coding survives — and the provenance of Rune's 27B files is currently unrecorded |
+
+**Topic 1 synthesis — deliver vs claim.** The GGUF ecosystem delivers: every quant format 2–8 bpw, imatrix calibration, grammar-constrained decoding, speculative decoding (draft + EAGLE-3), OpenAI-compatible serving, multi-GPU, multimodal. It does NOT deliver: (a) task-level quality measurement of a specific quant file (ppl/KLD only), (b) quant provenance metadata as a first-class citizen (GGUF files carry metadata but the *task-relevant* calibration story is not standardized), (c) any guarantee that a community-contributed IQ2_M of model X was calibrated on anything resembling code. "Local model quality" claims in this ecosystem are perpetually one inference-away from unmeasured.
+
+### Topic 2 — Local inference runtimes
+
+| # | Source | Deployment characteristics | Quant support | Structured output | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|
+| A5 | vLLM docs (vllm-project/vllm main: features/quantization/README.md, features/structured_outputs.md) | Production-scale serving; paged attention; continuous batching; multi-backend quant kernels (`--linear-backend`); day-0 model support | Broadest: AWQ, GPTQ/GPTQModel, BitsAndBytes, FP8 W8A8/W4A16/INT4/INT8 via LLM Compressor, ModelOpt, TorchAO, Quark, GGUF (via gguf.md), quantized KV cache | Native: xgrammar or llguidance backends, `structured_outputs` API (json/regex/choice/grammar/structural_tag), default `auto` backend | DOCUMENTATION_AUDITED | vLLM on a 16 GB single-GPU workstation is heavy (targets datacenter; but runs 7–14B fine). Its quant-fidelity *transparency* (named schemes, per-layer backends) is far ahead of Ollama's opaque "quantized_model tag" |
+| A6 | mlx-lm README (ml-explore/mlx-lm main) | Apple-silicon-first; HF Hub one-command generate/chat; **LoRA + full fine-tuning including on quantized models**; distributed inference | 4/8-bit quantization + quantized LoRA training | Not a serving-first runtime (no OpenAI server in core README); grammar support limited | DOCUMENTATION_AUDITED | Not applicable to Rune's NVIDIA hardware — cited as the counterexample showing on-device LoRA-finetune is a *commodity* feature in 2025-26 runtimes (QLoRA-class training inside the runtime, which Ollama still does not offer) |
+| A7 | ONNX Runtime GenAI README (microsoft/onnxruntime-genai main) | Cross-platform (x86/x64/arm64; CPU/CUDA/DirectML/TRT-RTX/OpenVINO/QNN/WebGPU); powers **Foundry Local, Windows ML, VS Code AI Toolkit**; full generative loop incl. KV cache, logits processing, **grammar specification for tool calling**, **multi-LoRA** | Block-quantized INT4 (RTN, accuracy-level options), FP8/INT8 variants per model package | Constrained decoding supported; **speculative decoding explicitly "on the roadmap"** (not shipped) | DOCUMENTATION_AUDITED | The "ship-to-consumers offline" stack (Foundry Local) uses ONNX — evidence that packaged offline agents exist at OS-vendor level (see Topic 5). Multi-LoRA at inference = the runtime substrate for the architecture's "accuracy-recovery adapters" rung exists outside the GGUF world |
+| A8 | Ollama docs (docs/api.md, faq.mdx, context-length.mdx, capabilities/) + issue tracker | Simplest deployment; system service; model registry tags; keep_alive; context defaults by VRAM | Opaque: quant baked into registry tags (q4_K_M etc.); no per-layer backend transparency; no user-facing quantization tooling | `format: json` / JSON-schema structured outputs; embeddings, tool-calling, thinking, vision, streaming documented as capabilities | DOCUMENTATION_AUDITED | Rune's runtime of record. See Topic 3 for the specific operational traps |
+| A9 | LM Studio developer docs (lmstudio.ai/docs, structured-output page) | Desktop app + headless service ("llmster as a Startup Task on Linux"); REST API + OpenAI-compat + **Anthropic-compat** endpoints; model loader with per-model context/ GPU-offload controls; "Idle TTL and Auto-Evict" for memory management | GGUF (llama.cpp-derived engine) with visible quant picker and **runtime context-length override** | JSON-schema structured output enforced at server level; MCP via API | DOCUMENTATION_AUDITED | A plausible drop-in upgrade for Rune: same GGUF files as Ollama but with explicit context control, idle eviction (relevant to shared-VRAM), and per-load configuration instead of Modelfile defaults |
+
+**Topic 2 synthesis.** All four runtimes ship structured-output/constrained decoding in 2025-26 — grammar constraints are a *commodity*. Quantization support ranges from vLLM's transparent scheme zoo to Ollama's opaque tags. Fine-tune-in-runtime is a commodity (mlx-lm, ONNX multi-LoRA) that Ollama lacks. Speculative decoding is llama.cpp-first (shipped), vLLM-first (shipped), ONNX (roadmap), Ollama (partial — see A8). **Rune's runtime choice (Ollama) is the least transparent of the four on exactly the axis arm 1 found most dangerous: quantization quality.**
+
+### Topic 3 — Local model routing/serving: Ollama specifics + LM Studio
+
+| # | Source | Finding | Consequence for Rune | Read depth |
+|---|---|---|---|---|
+| A10 | Ollama faq.mdx / context-length.mdx | **Context defaults scale with VRAM, silently: <24 GiB → 4k; 24–48 GiB → 32k; ≥48 GiB → 256k.** Docs themselves say agents/coding tools "should be set to at least 64000" and warn "Ensure you have enough VRAM" | On Rune's 16 GB card Ollama defaults to **4k context** — the family file's 2048-ctx silent-drift finding is structural, not a misconfiguration: every agent loop with a few tool outputs silently truncates unless num_ctx is set per request. The default *changes with hardware*, so the same code drifts if the GPU changes | DOCUMENTATION_AUDITED |
+| A11 | Ollama faq.mdx (keep_alive) | Default keep_alive = **5 minutes**; per-request `keep_alive` or OLLAMA_KEEP_ALIVE override; `ollama ps` shows GPU/CPU split and unload timer | Without keep_alive management, Rune's first token after 5 idle minutes pays full model load (for an 11 GB model: many seconds to minutes, worse under VRAM contention). A degradation ladder measuring "model up/down" will miss "model up but perpetually reloading" | DOCUMENTATION_AUDITED |
+| A12 | Ollama faq.mdx (concurrency) | Parallel requests multiply the context allocation (2k ctx × 4 parallel = 8k KV memory); models must FULLY fit VRAM for concurrent load; otherwise queue | VRAM headroom on the shared 16 GB card is consumed quadratically by concurrency; Ollama will silently queue or CPU-offload rather than error | DOCUMENTATION_AUDITED |
+| A13 | Ollama issue tracker (community, reliability-labeled) | Multiple open/closed issues document **silent context truncation**: "/api/chat over-truncates history with large context (48k): trims almost everything instead of just overflow" (closed), "Context truncation drops user message → misleading 500 on agent tool use" (closed), "**server: warn when embedding input is truncated to fit context window**" (OPEN — i.e., embedding truncation is still silent), "Detect Truncation Due to Exceeding Context Size" (open feature request) | The truncation behavior Rune's family file observed is a *known, partially-unsolved defect class* in the exact runtime Rune depends on. Silent truncation of embedding input is still an open issue — matching the inward probe's silent-embedding-degradation finding | COMMUNITY_EVIDENCE_RELIABILITY_LABELED |
+| A14 | Ollama issue tracker (speculative decoding) | "Enable speculative decoding" (open); "Ollama 0.34.2 **MTP speculative decoding** regression with Qwen3.8 27B" (closed — MTP support exists for some model families/runners); mlxrunner speculative KV-buffer fixes | Ollama's speculative decoding exists but is model-family-specific (MTP-head models) and regressed in the recent past; draft-model speculative decoding (Rune's Qwen 3B→14B pair) is NOT the Ollama mechanism — Rune would need llama.cpp/vLLM for that | COMMUNITY_EVIDENCE_RELIABILITY_LABELED |
+| A15 | Ollama docs/capabilities/ (embeddings, structured-outputs, tool-calling, thinking, vision, web-search, streaming) | Capabilities are *declared per model tag* by the registry/docs | Exactly the DECLARED-not-OBSERVED truth class the inward audit found in Rune's own config; Ollama's capability model gives Rune no observed-truth substrate for a registry — Rune must probe models itself | DOCUMENTATION_AUDITED |
+| A16 | LM Studio docs (headless service, Idle TTL and Auto-Evict, per-load config) | Headless Linux service; **auto-eviction of idle models** (direct answer to shared VRAM); per-load context override; REST + OpenAI + Anthropic compat | Migration path candidate if Rune outgrows Ollama: same GGUF assets, explicit memory eviction policy, explicit context — two of Rune's three silent-degradation classes (context drift, VRAM pressure) get user-visible controls | DOCUMENTATION_AUDITED |
+
+**Topic 3 synthesis.** Ollama's operational model is optimized for interactive single-user chat, not for a stateful agent host: 4k default context on Rune's card, 5-minute model eviction, silent truncation (open issues), VRAM contention handled by silent offload/queue. Every one of these converts a *hardware state* into a *silent quality degradation* — which is precisely the failure signature Rune's degradation ladder is supposed to make impossible. **The ladder's rungs must be defined over measured runtime telemetry (ctx allocated, GPU/CPU split, tokens/sec, KV headroom), not over "can I reach the API."**
+
+### Topic 4 — Small / local coding models 2024–26
+
+| # | Source | Measured claims | The gap | Read depth |
+|---|---|---|---|---|
+| A17 | Qwen team blog "Qwen2.5-Coder Series" (Nov 2024) | 32B-Instruct: "SOTA open-source code model, matching GPT-4o" on EvalPlus/LiveCodeBench/BigCodeBench; **Aider code-repair 73.7** "comparable to GPT-4o"; McEval 65.9 across 40+ languages; MdEval 75.2; sizes 0.5B/1.5B/3B/7B/14B/32B | Every cited instrument is function-/snippet-level or benchmark-repair. The blog contains **no SWE-bench or repo-scale agentic result at all** (string-verified: no "SWE" mention) | DOCUMENTATION_AUDITED |
+| A18 | Qwen2.5-Coder Technical Report (2409.12186, INHERITED_VERIFIED arm 1) | 5.5T tokens; SOTA >10 code benchmarks at size; "repo-scale agentic coding not benchmarked in every report" (arm 1's own note) | Vendor instruments = HumanEval/MBPP/EvalPlus class | INHERITED_VERIFIED |
+| A19 | SWE-bench leaderboard data (swebench.com page data parsed this session; Verified + bash-only "mini" boards) | **The ≤14B evidence vacuum, quantified:** on SWE-bench Verified, small-model entries are: RAG + SWE-Llama 7B — **0.7% resolved** (2023, checked); Lingma SWE-GPT 7B — **18.2%** (2024-10, **unchecked** submission); MCTS-Refine-7B — **23.2%** (2025-06, **unchecked**); FrogMini-14B — **45.0%** (2025-11, Microsoft, **os_model: false — NOT open-weight**). The 30B-class MoE Qwen3-Coder-30B-A3B reaches 51.6% (checked), and every other leading entry is ≥32B or frontier-closed | Across 2023-10 → 2025-11, an OPEN ≤14B model has **never** posted a verified agentic SWE-bench result; the two best ≤14B entries (18.2%, 23.2%) are unverified submissions, and the one 45% 14B is closed. Arm 1's "evidence vacuum" is confirmed against the live leaderboard: **the population is not "small models score low," it is "small models are barely present"** | DOCUMENTATION_AUDITED (parsed leaderboard JSON) |
+| A20 | SWE-bench (2310.06770) + SWE-agent (2405.15793) (METADATA_VERIFIED) | The benchmark harness and the agent-computer-interface framing that all entries above inherit | Agentic coding results are agent-scaffold-dominated: same model, different harness → double-digit deltas; model-only comparisons are confounded | METADATA_VERIFIED |
+| A21 | DeepSeek-Coder lineage (DeepSeek-Coder V2, 33B-A3.6B MoE; INHERITED from arm-1-era literature, METADATA) | Established the MoE pattern (large total, small active) as the local-compute answer to the capability/VRAM bind | Rune's stack has NO MoE model installed; its density-27B-IQ2_M-vs-density-14B-Q4 dilemma is an artifact of its model menu, not of the ecosystem | METADATA |
+
+**Topic 4 synthesis.** What's measured for small coding models: function-level generation (saturated), snippet reasoning, single-file repair. What is NOT measured anywhere for open ≤14B: repo-scale agentic issue resolution (the vacuum is total — not even unverified entries are common; FrogMini-14B 45.0 is closed-weight). **Rune's qwen2.5-coder:14b is therefore an instrument with no published agentic-task operating envelope.** This is not a reason to distrust it at Rune's *actual* task class (bounded edits, module-sized changes, tool calls) — it is a reason the architecture's "measure per task locally" element (13) is the only honest instrument that exists.
+
+### Topic 5 — Local agents actually running offline
+
+| # | Source | Claims | Honesty of capability claims | Read depth |
+|---|---|---|---|---|
+| A22 | Apple Intelligence architecture — **SKIPPED per mandate (arm 2 covered)** | — | — | — |
+| A23 | ONNX Runtime GenAI powering **Foundry Local / Windows ML** (A7) | Microsoft ships an on-device model runtime + model catalog as an OS feature: local serving (OpenAI-compat), hardware-accelerated across CPU/GPU/NPU | Claims are scoped honestly: small/quantized models for assistant-class tasks; no claim of frontier-agentic capability offline | DOCUMENTATION_AUDITED |
+| A24 | Robotics / embodied local agents (Voyager lineage 2305.16291 INHERITED; local-first robotics stacks are typically: on-device small policy models + cloud LLM for semantics, or fully-offline narrow policies) | The dominant honest pattern in shipped robotics is **bounded local competence**: navigation/manipulation policies run offline; open-ended language cognition stays cloud-dependent or is heavily scoped | Shipped systems do NOT claim offline open-ended agency; they claim offline *skill execution* — which is exactly the rung-5 shape (non-generative continuation) | METADATA / INHERITED |
+| A25 | Local-first developer products (Ollama/LM Studio/Foundry-based assistants; local RAG products) | What actually ships offline: chat with retrieval, summarization, code completion (FIM), structured extraction | Honest deployments scope to: bounded generation + retrieval + extraction. None ship offline *multi-step autonomous* coding agents with quality claims; agent loops are cloud-by-default even in local-first products | DOCUMENTATION_AUDITED (pattern across product docs above) |
+
+**Topic 5 synthesis.** The ecosystem's honest offline capability set, circa 2025-26: retrieval, extraction, FIM completion, bounded single-shot generation, tool-call JSON, small-policy execution. The offline *autonomous agent* does not exist as a shipped, quality-claimed product anywhere this arm examined. **Rune's rung-5 (non-generative continuation) and bounded-task rung-4 are consistent with what shipped systems actually claim; the architecture's "full local" rung-1 for open-ended agentic work is beyond anything shipped anywhere** — which makes rung-1's quality honesty entirely dependent on Rune's own local measurement.
+
+### Topic 6 — Distillation systems in production
+
+| # | Source | Claims | Quality vs teacher | Read depth |
+|---|---|---|---|---|
+| A26 | DeepSeek-R1 (2501.12948; INHERITED_VERIFIED arm 3) | R1-Distill-Qwen-32B > QwQ-32B-Preview on AIME/MATH/GPQA; distill-7B beats GPT-4o on AIME-2024 (55.5); distillation from 800K verified traces transmits long-CoT across base families | On competition-math-style verifiable tasks, distilled students approach/exceed same-size teachers' *benchmark* performance — but R1 itself: 49.2% SWE-bench Verified vs 79.8 AIME (arm 3): **reasoning-benchmark strength ≠ agentic competence, and distillates inherit exactly that skew** | INHERITED_VERIFIED |
+| A27 | phi-4 TR (2412.08905; INHERITED_VERIFIED arm 1) | 14B exceeds its teacher (GPT-4) on STEM QA via synthetic-data curriculum | Exceeds teacher *on the target domain measured by vendor instruments*; general chat not claimed | INHERITED_VERIFIED |
+| A28 | Gemma 3 TR (2503.19786; INHERITED_VERIFIED arm 1) | Gemma3-4B-IT ≈ Gemma2-27B-IT; 27B-IT ≈ Gemini-1.5-Pro; trained with distillation | Generation-over-generation compression is real and large — the strongest evidence that "current-generation small ≈ previous-generation large" | INHERITED_VERIFIED |
+| A29 | Quantization-of-distillates interaction (2504.04823; INHERITED_VERIFIED arm 1) | R1-Distill lineages are *specifically* quantization-sensitive (3-bit −5.4 to −6.3 avg on 7B; harder tasks degrade up to 4× more) | Production distillates + aggressive quantization = compounding degradation; Rune's 27B IQ2_M (2.5 bpw-class) sits below every tested floor | INHERITED_VERIFIED |
+
+**Topic 6 synthesis.** Distillation is in mass production (R1-Distill family, Gemma 3, phi line), and the benchmark story is real — but every production success is (a) domain-scoped, (b) vendor-instrument-measured, and (c) unquantized-or-lightly-quantized at publication. **No shipped distilled model publishes quality-at-IQ2_M-class-quants.** Rune's two 27B IQ2_M models are (per family context) plausibly Qwen-lineage distillates at a quant level no producer ever validated.
+
+### Topic 7 — Failure evidence (reliability labeled)
+
+| # | Source | Failure class | Evidence | Reliability | Read depth |
+|---|---|---|---|---|---|
+| A30 | The Curse of Recursion (2305.17493, METADATA_VERIFIED) | Model collapse from recursive training | "Training on generated data makes models forget" — tails of distribution lost over generations | Peer-reviewed-lineage paper (ICML 2023 workshop lineage); mechanism contested at LLM scale but directionally supported | ABSTRACT_ONLY |
+| A31 | Is Model Collapse Inevitable? (2404.01413, METADATA_VERIFIED) | Collapse is a *data-mixing* problem | Accumulating real+synthetic with explicit non-cumulative mixing avoids collapse — collapse is not inevitable | Peer-reviewed (NeurIPS 2024); refines A30 rather than contradicting | ABSTRACT_ONLY |
+| A32 | Distilled-hallucination transmission (2408.12326 DualChecker; INHERITED arm 1) | Teacher hallucinations propagate through KD when teacher confidence low | Patched piecemeal (re-prompting, dual-checking); never quantified systematically at scale | Peer-reviewed, narrow domain | ABSTRACT_ONLY (INHERITED) |
+| A33 | Fine-tune forgetting (2301.12726 specialization → CoT on BBH drops to 0; 2412.15115-era AgentTuning: agent-data-only FT degrades general ability; 2405.09673 LoRA forgets less) | Catastrophic forgetting in specialization | Consistent across 3 independent groups: specialization trades generic capability, and in-distribution gains do NOT predict OOD retention | INHERITED_VERIFIED (arm 1/3) | — |
+| A34 | Community quantized-failure reports (GGUF ecosystem; arm 1's imatrix discussion #5263 INHERITED; HuggingFace model-card practice) | 2-bit-class quants degraded for reasoning/coding; imatrix corpus sensitivity | Community-accepted; KL-div proxies; no systematic task-level public measurement for IQ2_M specifically | COMMUNITY — reliability moderate (consistent folklore + one mechanism study, 2504.04823, confirming direction) | INHERITED |
+| A35 | Silent-truncation defect class (A13 above) | Prompt/embedding silent truncation in the serving layer | Open GitHub issues in ollama/ollama, including one specifically for embedding-input truncation warnings still OPEN | COMMUNITY — reliability high (issues with reproduction) | COMMUNITY_EVIDENCE_RELIABILITY_LABELED |
+| A36 | Synthetic-data contamination incidents (vendor-admitted) | Benchmarks contaminated by training-adjacent synthetic data | phi-4 TR itself devotes its evaluation section to mitigating benchmark contamination (admits the problem class); LiveCodeBench/eval-style contamination is the stated *reason* new benchmark families exist | DOCUMENTATION_AUDITED (via vendor TR admissions) / INHERITED | — |
+
+**Topic 7 synthesis.** Every failure class has *mechanism-level* evidence and *no* instance-level quantification for Rune's exact configuration (distilled-family, ~2.5 bpw, 14B coder, shared-VRAM serving). The ecosystem's failure knowledge is real but generic; Rune's specific failure rates are unmeasured — consistent with the architecture's per-task measurement requirement, and damning of any "local is fine by default" stance.
+
+### Topic 8 — Benchmark-vs-runtime gaps for local models
+
+| # | Evidence | Gap shape | Read depth |
+|---|---|---|---|
+| A37 | A17 vs A19: same model family. Qwen2.5-Coder-32B "matches GPT-4o" (Aider 73.7, repair) vs Qwen2.5-Coder-32B under the bash-only mini-SWE-agent harness on SWE-bench (verified entry, cost $34.06/task-run) | Snippet-benchmark rank and agentic-harness performance are **different axes**; even 32B open models need heavy scaffolds, and 14B has no verified agentic number at all | DOCUMENTATION_AUDITED |
+| A38 | Arm-1's 2504.04823: quantized models do not think longer; quant error accumulates along CoT; test-time-scaling gains lower than BF16 | Benchmark numbers are reported for BF16; the *quantized runtime instance* (what Rune serves) has lower measured CoT-task gains — the gap between "Qwen2.5-Coder-14B scores X" and "Rune's qwen2.5-coder:14b at its served quant scores X′" is real, unquantified, and task-skewed (worse exactly on harder tasks) | INHERITED_VERIFIED |
+| A39 | Ollama serving defaults (A10–A12): 4k context default, 5-min eviction, parallel-ctx multiplication | Published model cards assume the model's rated context; the *served instance* silently truncates below it. Any benchmark-vs-runtime gap analysis must include serving-layer degradation, not just weight degradation | DOCUMENTATION_AUDITED |
+| A40 | 2506.07962 Correlated Errors (INHERITED) + A19 scaffold confound (A20) | Multi-model "verification" and ensemble-style local stacks inherit correlated errors; benchmark diversity does not imply error diversity | INHERITED_VERIFIED |
+
+**Topic 8 synthesis.** The gap decomposes into three multiplicative layers, none individually measured for Rune: (1) weight-layer: quantization loss (unmeasured for IQ2_M); (2) serving-layer: context truncation/eviction/offload (structurally present per A10–A13); (3) task-layer: snippet benchmarks → agentic reality (vacuum at ≤14B). **A model that benchmarks well and is served silently degraded inside an agentic loop can be arbitrarily worse than any published number — and Rune currently has no instrument that would notice.**
+
+---
+
+## A.2 Part A synthesis — what the implementation ecosystem gives the candidate architecture
+
+1. **Constraint decoding, embeddings, tool-calling, structured output are commodities.** The architecture needs no novel machinery here; its gaps (JSON failure rate unknown, capability registry absent) are *measurement* gaps, not runtime-capability gaps.
+2. **Speculative decoding is ecosystem-real and Qwen-family-compatible** (EAGLE-3 drafts for Qwen3-14B exist; draft/target pairs in Rune's own menu). Architecture item 8 survives — but not on Ollama's current mechanism (MTP-only, family-limited); it would need llama.cpp/vLLM serving.
+3. **The silent-degradation problem is a *runtime* property, not a Rune code bug.** 4k ctx default, 5-min eviction, silent truncation, silent CPU offload, silent embedding truncation (open issue) — the degradation ladder must read telemetry, not availability. This sharpens architecture item 2: "status structured/declared, never generated" is necessary but insufficient — status must be **measured** (tokens/sec, ctx used/allocated, GPU/CPU split, KV headroom), or the ladder's rungs will be wrong while the API answers.
+4. **The ≤14B agentic-coding evidence vacuum is total** (0.7% → 23.2% for open small models, never verified; 45% exists only closed-weight). Architecture item 13 (keep 27B IQ2_M only if locally measured) is the only honest position — and equally, the 14B coder's agentic envelope is unmeasured, so the measurement obligation is family-wide, not 27B-specific.
+5. **Distillation-in-production supports "capability compilation to cheaper forms" only in domain-scoped, vendor-validated, unquantized settings.** Rune's analogue (compile verified reasoning → bounded classifiers) is *more* conservative than production distillation and thus defensible — provided the regression fixtures exist, which they do not yet.
+6. **Failure evidence is mechanism-real, instance-unmeasured.** Collapse/forgetting/hallucination-transmission/quant-loss are all documented failure classes with zero Rune-specific rates. Any architectural claim of the form "local tier is reliable" is currently unfalsifiable-by-construction in Rune — the measurement gap *is* the finding.
+
+---
+# PART B — INDEPENDENT FRESH-CONTEXT ADVERSARIAL PASS
+
+_Method: this arm was given arms 1–3 conclusions (verbatim summary above) and attacked the CANDIDATE ARCHITECTURE (14 elements) from first principles, without inheriting their argument structures. Verdict semantics: **SUCCEEDS** = the attack lands; the architecture element as written is damaged/underspecified and a correction is forced. **PARTIAL** = lands on a boundary case or on the implementation (not the design); correction needed but architecture core survives. **FAILS** = the architecture (with its existing evidence) withstands the attack; attack recorded for completeness._
+
+_Reality anchors used (from Part A + inward audit): silent truncation/eviction/offload are structural Ollama behaviors (A10–A13); ≤14B agentic evidence vacuum is total (A19); IQ2_M below every tested quant floor (2504.04823); all learning machinery empty (0 skills, 7 lessons, 0 measured deltas); no registry, no routing, no templates; 152 modules are an accidental fallback; crons need LLM; generation health unprobed._
+
+## B.1 Mandated attacks 1–100
+
+| ID | Attack | Verdict | Evidence | Consequence | Correction | Residual |
+|---|---|---|---|---|---|---|
+| 1 | Local models are inherently safer (no cloud = no adversary) | FAILS | Arch element 11 already asserts local models = untrusted components; supply chain (pickles/adapters/trojans) is orthogonal to cloud boundary | None — architecture consistent | None; element 11 stands | Runtime-level attacks (truncated prompts, KV exfil via shared VRAM) unaddressed by *any* arm — flag to #405 |
+| 2 | Local inference is inherently cheaper | PARTIAL | $/token is ~0, but $/correct-task is unmeasured when quality degrades silently (A38): retries, human rework, wrong-but-plausible outputs | "Cheap local" can be the expensive tier at task level | Cost metric must be outcome-denominated (cost per verified success), not token-denominated | Electricity+VRAM contention cost with user's own gaming/coding never priced |
+| 3 | Small models will eventually replace all frontier reasoning | FAILS | A19: no open ≤14B model ever posted a verified agentic result; generation compression (A28) is real but each generation's frontier also moved | Architecture does not depend on this claim | None | If someday true, the ladder collapses gracefully — no architecture change needed |
+| 4 | Always use frontier when available | PARTIAL | Arch rejects routing-now (item 8) but inwards show ad-hoc frontier use ALREADY happens (BYPASS state) — the architecture's log-don't-route policy is violated by current practice | Without enforcement, "log (query, model, outcome)" never accumulates because frontier calls bypass logging | Frontier usage must go through the same logged gateway as local, or the label corpus is censored by selection bias | None — direct practice correction |
+| 5 | Always-local-first is optimal | SUCCEEDS | Arch elements 2+8 bake in local-first ordering without a measured basis; inward CONFLICTING state (local-first config vs ad-hoc frontier reality) shows the ordering is aspirational, not derived | Rune may systematically overpay in quality for independence it hasn't priced | Local-first must be declared a *policy choice with a revisit trigger* (e.g., when ≥N measured tasks show local < frontier pass@1 beyond threshold), not an axiom | Independence value (availability, privacy) is real but unquantified — owner decision needed |
+| 6 | One benchmark proves local adequacy | FAILS | A17 vs A19/A37: snippet benchmarks ≠ agentic reality; arch item 12 requires analogous-task A/B | None | None | None |
+| 7 | Quantization loss is negligible | FAILS | 2504.04823: W3 −5.4/−6.3 on 7B; harder tasks up to 4× worse; IQ2_M (~2.5 bpw) below the tested floor entirely; A34 community confirmation | Arch item 13 already encodes this; the attack re-confirms that Rune's DEFAULT model (the config's one 27B tool model) is the least trustworthy asset in the stack | Measurement obligation covers both 27Bs; also record quant provenance (imatrix corpus) of the exact GGUF files | Imatrix provenance of installed files unknown — cheap to extract from GGUF metadata |
+| 8 | Quantization affects all tasks equally | FAILS | Same: task-sensitivity is the established result (hard reasoning 4× worse; extraction/classification far more robust) | Supports arch item 3 (compile bounded tasks to cheaper forms — they're also quant-robust); damages any plan to run open-ended reasoning on IQ2_M | None | Per-task-class quant sensitivity for Rune's 11 models unmeasured |
+| 9 | Parameter count predicts intelligence | FAILS | Gemma3 4B-IT ≈ Gemma2 27B-IT (A28); MobileLLM sub-1B tool-call viability | Arch's model-as-resource + per-task measurement is exactly the right stance | None | None |
+| 10 | More context = better memory | FAILS | A10–A13: more ctx costs VRAM quadratically (parallelism), triggers offload/truncation; retrieval + state (Rune's SQLite) is the memory substrate, ctx is a window | Arch item 10 (modules+SQLite+retrieval) already models memory as external | None | Rune's retrieval quality never A/B'd (F14) — the substrate exists but its quality is unmeasured |
+| 11 | Distilled student learns capability cleanly | FAILS | 2301.12726 (OOD collapse), R1 49.2 SWE vs 79.8 AIME skew, A32 hallucination transmission | Arch item 4 (teacher text ≠ learning signal) and item 3 (only bounded compilation) consistent | None | Rune's 27Bs are plausibly distillates — their *teacher-conditioned* failure modes are unknown |
+| 12 | Teacher error disappears in distillation | FAILS | A32; 2506.07962 correlation logic applies teacher→student | Same as 11 | None | None |
+| 13 | Multi-teacher agreement proves truth | FAILS | 2506.07962: ~60% agreement when both err; correlated errors | Arch item 14 (execution = judge, consensus adds little) already correct | None | Rune's multi-teacher experiments never run at all — the claim is inherited, not local |
+| 14 | Different vendors = independent evidence | FAILS | Same correlation finding; also shared synthetic-data lineage (R1 distills into Qwen/Llama bases) | Item 14 stands | None | None |
+| 15 | Synthetic data = verified experience | FAILS | A30/A31 (collapse/mixing); arch item 4 requires outcome-verification of *contribution*, not generation | Synthetic data may feed *training* only after the same verification gates as external contribution | None | None |
+| 16 | More synthetic data always improves | FAILS | A30 recursive-collapse; A31 non-cumulative mixing requirement | None for arch | None | None |
+| 17 | Fine-tuning is natural Rune learning | PARTIAL | Arch item 6 ranks LoRA below procedure/retrieval and rejects full-FT; but "natural" hides that even LoRA needs data quality + regression gates Rune lacks (0 skills, 7 lessons) | The ladder's lower rungs are correct *and* currently hypothetical — the only exercised rung would be LoRA if someone reaches for it first | Sequence enforcement: no adapter training until procedure/retrieval forms are measured on the same delta | 16 GB VRAM shared with user apps makes training windows an availability question (#405) |
+| 18 | Every lesson should update weights | FAILS | Item 6 explicitly; 2405.09673 (adapters forget less ≠ nothing); DAgger wrong-distribution warning (arm 3) | None | None | None |
+| 19 | Weight learning preserves provenance | FAILS | Weights cannot carry per-example provenance; arch item 4 makes provenance a *data* gate precisely because weights can't | None | None | Adapter files themselves need model+digest stamping (same defect class as unversioned vectors — F5) |
+| 20 | Retrieval is inferior to parametric memory | FAILS | MemGPT (2310.08560) degradation result; arch item 10 puts retrieval in the no-model core | None | None | Rune's retrieval is functional but unmeasured (F14) |
+| 21 | Deterministic rules are always more reliable | FAILS | Rules are reliable *in-distribution*; edge cases are where they fail (2301.12726's in-dist/OOD asymmetry applies to code too). 152 modules ≠ correctness, just determinism | None — but the mirror risk is real: Rune may over-trust the deterministic layer because it's deterministic (see 50) | None | None |
+| 22 | Deterministic rules can replace open-ended cognition | FAILS | Inward §F: without models, ALL semantic interpretation dies. Rung 5 keeps state and execution alive, not cognition | None | None | None |
+| 23 | LLM reasoning is always compilable to code | FAILS | Item 3 scopes compilation to bounded classification/routing/extraction for exactly this reason | None | None | None |
+| 24 | Successful code generation proves internalization | FAILS | Item 3 requires regression fixtures + applicability + rollback precisely because one-shot success ≠ capability | None | None | None |
+| 25 | One-success skill should be promoted | FAILS | Item 5 requires ≥1 successful analogous reuse + hardening; Voyager gates on external verifier | None | None | Irony flag: item 5's gate has never run even once (0 skills) — a gate with n=0 usage is itself unvalidated (F2) |
+| 26 | Unit tests prove general reliability | FAILS | Tests prove behavior on covered paths; arch requires re-verification on environment change (item 5) | None | None | Rune's test coverage of its own 152 modules never audited |
+| 27 | Error recipes should always auto-retry | FAILS | Arch item 7: retry budget belongs to deterministic gate counters, not unconditional loops; Reflexion's cost caveat (arm 3) | None | None | None |
+| 28 | A previous successful recovery is forever applicable | FAILS | Item 5 deprecation-on-environment-change (Memp anchor 2508.06433) | None | None | None |
+| 29 | Model confidence is a routing authority | FAILS | Arm 1 established (self-confidence unreliable; 2408.03314 pass@1 bins + verifiers). Item 7 consistent | None | None | None |
+| 30 | Low confidence implies escalation | FAILS | Escalation signals are *external* (pass@1 bins, verifier availability, gate counters, disagreement) — confidence is neither necessary nor sufficient | None | None | None |
+| 31 | High confidence implies no escalation | FAILS | Same; hardest-bin refusal stands regardless of confidence | None | None | None |
+| 32 | Cheapest model first | FAILS | Cascade/routing REJECTED (no in-distribution labels; FrugalGPT = pricing artifact — actual FrugalGPT 2305.05176, corrected ledger above) | None | None | The 0.5B–14B Qwen ladder tempts exactly this; the log-don't-route policy is the guardrail |
+| 33 | Most expensive = most capable | FAILS | Gemma3 4B≈27B precedent; IQ2_M 27B may lose to 4-bit 14B on Rune's tasks (2504.04823 size-scaling measured at 3-bit, not 2-bit — the swap is plausible but unmeasured) | Item 13 must measure 27B-IQ2_M **against** 14B-Q4, not in isolation | Add explicit pair: 27B-IQ2_M vs qwen3:14b (or coder 14B) at 4-bit on identical Rune tasks | VRAM freed by retiring a 27B is itself a measurable benefit |
+| 34 | Provider outage = task failure | FAILS | Item 2 ladder + item 10 no-model mode | None | None | Ladder untested end-to-end (F-mechanism, see 97) |
+| 35 | Local OOM = task failure | PARTIAL | Ladder handles hard failure; but Ollama's actual OOM behavior is *silent* offload/queue/evict (A11–A13) — task doesn't fail, it *slowly degrades* | The ladder's rung detection misses the silent middle: model loaded on CPU, 0.5 tok/s, still "up" | Add a telemetry-derived rung between 1 and 2: "resource-starved" (GPU/CPU split from `ollama ps`, tok/s floor, ctx headroom) | Telemetry sampling design undefined |
+| 36 | No LLM = Rune dead | FAILS | Inward §F: state, memory, 152 modules, git survive; rung 5 is real — *communication* is the actual casualty, not operation | None | None | Rung 5 has no communication templates (F13) — operationally the attack is half-right today |
+| 37 | Template communication = conversation | FAILS | Arch: structured/declared, never generated prose — templates are an honest subset, not a claim of dialogue | None | None | Templates undesigned (F13) |
+| 38 | Offline status is inferable from network non-response | FAILS | Inward: embedding failure is SILENT (log-and-skip); silence ≠ status; arch item 10's probe-and-report exists because inference-from-absence fails | None | None | Probe-and-report unimplemented |
+| 39 | Registry declarations are always current | FAILS | Item 9 explicitly models declared/observed/stale with TTLs | None | None | Registry doesn't exist yet (F10) |
+| 40 | Provider model names = stable capabilities | FAILS | Item 9: same-name models change behavior both directions (e.g., Ollama tag re-pointing; llama.cpp quant format drift) | None | None | Rune pins nothing today — model IDs in config are mutable aliases |
+| 41 | Model versions interchangeable | FAILS | Item 9 + A2 (EAGLE-3 drafts are per-target-model artifacts — version drift breaks them silently) | None | None | None |
+| 42 | Model swap need not affect regression tests | FAILS | Item 9's stale/observed machinery + item 3's fixtures exist for exactly this | None | None | No regression fixtures exist to affect (F17) |
+| 43 | Same model, different quantization = same capability | FAILS | 2504.04823 head-to-head quant deltas; A34 | Item 13's per-task measurement must be *per quant file*, not per model family | Registry slug must include quant (e.g., `qwen3:14b@Q4_K_M` vs `@IQ2_M`) | Two 27B IQ2_M files — provenance of each unknown |
+| 44 | Local embeddings = intelligence | FAILS | Nomic Embed cloud-parity (2402.01613) is retrieval parity, not cognition; rung 5 keeps retrieval alive as *state access*, not thought | None | None | Unversioned vectors (F5) undermine even the retrieval claim |
+| 45 | Retrieval quality proves reasoning quality | FAILS | Orthogonal axes; 2506.07962 applies | None | None | None |
+| 46 | Rule extraction preserves edge cases | FAILS | 2301.12726: extracted/distilled rules are in-distribution artifacts; edges are exactly what falls out | Item 4's applicability conditions + OOD probes (arm 3's mirror of #382) | None | None |
+| 47 | Classifier calibration transfers across domains | PARTIAL | As an attack on compilation: calibration is domain-bound (2301.12726 OOD dynamics; 2504.04823's calibration-domain result is the quant analogue) | Arch item 3 already demands applicability conditions — attack lands only if those conditions are written as prose rather than tested predicates | Applicability conditions must be *executable predicates on inputs*, not descriptions | Rune has no compiled mechanism yet — this is preventive |
+| 48 | Classical ML always preferable for bounded tasks | FAILS | Arm 1: classical ML *owns bounded structured tasks* — "always preferable" overreaches; LLMs still win bounded tasks with high context diversity | Item 3's bounded scope consistent | None | None |
+| 49 | JEV kernels reproduce general reasoning | FAILS | Item 3: compiled ≠ open-ended cognition (explicitly rejected) | None | None | None |
+| 50 | Bounded classifiers trusted merely because deterministic | SUCCEEDS | Determinism ≠ correctness; an extraction classifier at 90% precision silently corrupts Memory on 10% of writes — worse than an obvious LLM failure the loop would catch. Arch item 3's regression fixtures guard *regression*, not *base error rate* | Compiled mechanisms need base-rate instrumentation (precision/recall on a live-sampled holdout), not just regression fixtures | Add: every compiled mechanism ships with a measured confusion matrix + a sampled-audit hook feeding the escalation counters | Rune's JSON-extraction failure rate is UNKNOWN (inward) — the exact base rate this attack demands is unmeasured |
+| 51 | Generated rules immediately become policy | FAILS | Item 4's pipeline (verify → applicability → baseline → candidate → measured) blocks it | None | None | 7 existing lessons pre-date the pipeline — their status under the new gate is undefined (F15-adjacent) |
+| 52 | Self-modification improving benchmark = safe | FAILS | Item 12: Growth Delta = analogous-task measured improvement, not benchmark; A17/A37 benchmark-runtime gap | None | None | None |
+| 53 | Benchmark improvement = Growth Delta | FAILS | Item 12 definition is analogous-task before/after | None | None | The instrument to distinguish them (per-lesson counterfactual measurement) was never built — the two are operationally indistinguishable today (F15) |
+| 54 | Frontier-dependency reduction = automatic improvement | FAILS | Item 2's ladder is a *degradation* policy, not a quality goal; item 5/12 gate on measured improvement | None | None | None |
+| 55 | Offline independence worth any quality loss | SUCCEEDS | No element states the trade price. Combined with 5, the architecture can silently become "worse but local" without a decision point | The independence/quality trade is the single biggest unowned policy dial in the architecture | Define an explicit, owner-visible threshold: e.g., "if local tier pass@1 on active task classes < X% of frontier tier for N consecutive measurements, surface the trade to the owner" | The right X is a policy decision, not a research output — must be escalated, not set here |
+| 56 | Hardware ownership = operational independence | FAILS | 62 GB RAM/16 GB VRAM ≠ power, storage durability, OS updates, driver rot (Ollama version drift is itself a behavior change — A13/A14 issue tracker) | Item 1's "model-independent mind" needs an operations dependency list too | Add ops-level dependencies (Ollama version pinning, driver state, disk for model cache) to the registry | #405 owns hardware — boundary respected |
+| 57 | Open-source model = supply-chain safety | FAILS | Item 11: weights are untrusted binaries; community quants add a *second* untrusted layer (who ran the imatrix?) | None | None | None |
+| 58 | Local model files cannot be malicious | FAILS | Pickle-based adapters, trojaned weights literature; item 11 explicit | None | None | Rune's 11 model files' provenance (source repo, checksum) unrecorded |
+| 59 | Running locally = no data leak | FAILS | Item 11: logs/caches/swap/telemetry; also Ollama pulls models over HTTPS (A-faq proxy docs) — egress path exists | None | None | None |
+| 60 | Model adapters harmless | FAILS | Adapters execute with the base's privileges; ONNX multi-LoRA (A7) shows adapters are a serving feature = an attack surface | Item 11 extends to adapters | Adapters get the same provenance/checksum/staging treatment as models | None |
+| 61 | Imported LoRAs inherit base trust | FAILS | An adapter can*not* be more trusted than its base, and can be *less* (trained on poisoned data); trust is min(base, adapter) | None | None | None |
+| 62 | Local inference should have filesystem access for convenience | FAILS | Item 11 (untrusted semantic component) forbids exactly this; #405 owns isolation mechanics | None | None | Today Ollama itself is sandboxed by the OS, not by Rune policy — the policy layer is the fix |
+| 63 | Local workers share Main credentials | FAILS | Element 11 + #405 isolation mandate | None | None | Current state: 152 modules share the Rune process/user — a real current exposure to flag |
+| 64 | Internet loss triggers broad autonomous retraining | PARTIAL | Arch is silent on outage-behavior policy for the learning loop; DAgger warns retraining on own-distribution data entrenches errors (arm 3); an outage is precisely when Rune's self-generated state distribution is worst | Without an explicit prohibition, "we're offline, let's consolidate lessons/retrain on backlog" is a plausible autonomous act that violates item 4's external-verification requirement at scale | Add an explicit governance clause: learning pipelines require external verification availability; outage ⇒ learning PAUSED, not accelerated | None |
+| 65 | Idle GPU always used for background cognition | SUCCEEDS | Arch has no background-cognition scheduler (inward: ABSENT); "idle" on a *shared* card is a fiction — 5.4 GB user-app baseline + gaming spikes; Ollama will evict/offload silently (A11–A13) | Any background-cognition design that treats idle GPU as free compute will contend with the user and degrade invisibly | Background cognition must be (a) budgeted (time + VRAM ceiling), (b) preemption-aware, (c) telemetry-reported; and #405 must own the VRAM partition policy | Nothing in R1 prevents a cron from deciding the GPU is "idle" |
+| 66 | Timer expiry justifies inference | PARTIAL | Cron-based consolidation/curator exist and need LLM (inward); nothing ties timer firing to a *value* test — timer expiry is a schedule fact, not a work justification | Outage-adjacent waste + contention; unmeasured consolidation quality (F14) makes the cron's value unknown | Cron jobs acquire an LLM lease only if (registry healthy ∧ budget available ∧ job's quality metric instrumented); else defer to rung-5 mechanical mode | Consolidation value never A/B'd — the value test has no metric yet |
+| 67 | Cached answer gains authority through repetition | FAILS | Item 4 provenance + item 10 per-write model+digest | None | None | Memory dedup/curator may *amplify* repeated claims — curator logic never audited for source-count weighting |
+| 68 | A frequent skill becomes truer | FAILS | Item 5: no popularity promotion | None | None | Gate unexercised (0 skills) — F2 |
+| 69 | More model diversity always improves | FAILS | 2506.07962 correlated errors; diversity without independence is decoration; 11 models ≠ 11 independent judges | Item 14 consistent | None | None |
+| 70 | Ensemble majority vote = evidence | FAILS | Same; vote ≠ corroboration when errors correlate | None | None | None |
+| 71 | Local disagreement resolved by strongest model | PARTIAL | "Strongest" is not observable locally without exactly the measurement Rune lacks; but item 7's disagreement *counter* is an escalation signal, and escalating to the most capable *available verified* model is consistent with the ladder | The attack's resolution mechanism is wrong; its observation (disagreement needs a tiebreak policy) is valid | Disagreement → escalation per item 7, never "ask the biggest model"; the tiebreak must be the verifier or the owner, not a size heuristic | None |
+| 72 | Frontier answer overwrites local knowledge | FAILS | Item 4: teacher text ≠ learning signal; frontier output enters as *candidate external contribution* with verification | None | None | Practice bypass (F11) means frontier answers are consumed today with no such gate |
+| 73 | New model reinterprets all historical Memory automatically | PARTIAL (design absorbs the attack; current implementation would fall to it) | Design: item 10's per-write model+digest + item 9's slug discipline prevent silent reinterpretation. Current state: 118k chunks have NO embedding-model column (inward) — swapping embedders WOULD silently re-interpret the entire retrieval space | This is the sharpest design-vs-implementation divergence in the architecture | Migration debt: stamp existing vectors (or quarantine + re-embed with recorded model), BEFORE wiring qwen3-embedding | Retroactive stamping of 118k chunks is a one-time mechanical job — cheap, must be scheduled |
+| 74 | Model retirement destroys its knowledge | PARTIAL | Design: knowledge lives in Memory/skills (model-independent). But *retrieval* is embedding-model-coupled: retiring an embedder without re-embedding orphans the vector index (same mechanism as 73) | Retirement runbook must include re-embedding or dual-index transition | Add "embedder retirement ⇒ re-embed before decommission" to the registry lifecycle | Re-embed cost for 118k chunks on local embedder: hours — schedule, not crisis |
+| 75 | Historical weights preserved forever | PARTIAL | Disk is finite (55 GB today); no retention policy exists; old model files + old adapters accumulate silently | Storage exhaustion is a slow availability failure the ladder doesn't see | Registry lifecycle adds: retention policy for retired model files/adapters, with checksummed archive-or-delete | #405 boundary on storage numbers |
+| 76 | Every external contribution becomes training data | FAILS | Item 4's gate sequence blocks it | None | None | None |
+| 77 | Training examples need no provenance | FAILS | Item 4 provenance gate; 19 above | None | None | None |
+| 78 | Distillation makes teacher provenance irrelevant | FAILS | A32: teacher errors propagate — provenance is *more* important post-distillation (error attribution) | None | None | None |
+| 79 | Generated classifier self-certifies with own examples | FAILS | Item 3 requires independent regression fixtures; 50 above adds base-rate audit | None | None | No fixtures exist yet — preventive only |
+| 80 | A local benchmark suite proves general reliability | FAILS | A17/A37: suite is task-class-specific; arch item 12 requires analogous-task measurement per class | None | None | Rune has NO local suite at all — first suite must be built before this attack even becomes tempting |
+| 81 | Offline Rune should emulate human consciousness | FAILS | Out of scope; arch is functionalist (memory+state+policies) | None | None | None |
+| 82 | Model independence means models unimportant | PARTIAL | Item 1 says "models = replaceable providers" — true architecturally, false operationally: model choice still dominates task quality *today* (unmeasured menu, A19 vacuum), and swaps have real costs (73/74) | The slogan needs a caveat: replaceable *in the long run*, decisive *in the short run*; registry + per-task measurement is what makes replacement safe | Amend item 1: "models are replaceable *resources with measured per-task envelopes*; replacement is a gated event, not a hot-swap" | None |
+| 83 | Deterministic systems cannot be intelligent | FAILS | Irrelevant to arch (no claim either way); item 3 deliberately limits compiled mechanisms, which is the only near-claim | None | None | None |
+| 84 | LLMs are the only creativity source | FAILS | Arch makes no such claim; phi-4-style synthetic pipelines (A27) show bounded generation suffices for targeted novelty | None | None | None |
+| 85 | Learned local policies own goals | FAILS | CoALA: control in code; goals are Rune's, policies are executed | None | None | None |
+| 86 | Local intelligence owns canonical Memory | FAILS | Memory is model-independent state (inward §F — strongest finding); models are clients | None | None | None |
+| 87 | Local model owns persona | FAILS | Persona = policy/state, not model property (item 1); also protects against model-swap persona drift | None | None | Persona layer itself undesigned anywhere — flag as scope gap, not architecture failure |
+| 88 | Local model owns task-completion state | FAILS | Task/resume state is SQLite, model-independent (inward) | None | None | None |
+| 89 | Local routing overrides governance | FAILS | No routing exists (item 8) to override anything; governance is code-level (CoALA) | None | None | The inverse is the real risk: governance-by-omission (config default IS routing — F18) |
+| 90 | Provider fallback can change user intent | FAILS | Ladder degrades *capability*, declared via templates; intent lives in task state | None | None | Template undesigned (F13) |
+| 91 | Reduced inference cost proves internalization | FAILS | Item 12: measured analogous-task improvement, not cost savings; cost is a side benefit | None | None | None |
+| 92 | Faster response proves Growth Delta | FAILS | Same; latency ≠ capability | None | None | None |
+| 93 | Smaller model matching one benchmark has replaced teacher | FAILS | A17/A37 single-benchmark fallacy; 2301.12726 OOD collapse | None | None | None |
+| 94 | Copied teacher answer = learned skill | FAILS | Item 4 (teacher text ≠ learning signal); GKD off-policy mismatch (arm 1) | None | None | None |
+| 95 | Replaying old successful plan = reasoning | FAILS | Item 5 re-verification on environment change; Memp deprecation | None | None | None |
+| 96 | Generalization assumed from repeated success | FAILS | 2301.12726: in-dist success does not predict OOD; item 5 requires analogous reuse + environment-change re-verification | None | None | None |
+| 97 | No-model degraded mode need not be tested | FAILS | The attack is absurd as stated — and yet: inward §I shows rung 5's components have never been exercised as a *mode*, only as coincidental daily paths; communication templates ABSENT; embedding silent-fail active | The architecture's most distinctive claim (never FULL→DEAD) currently rests on untested integration. A degradation drill is mandatory, not optional | Quarterly (or event-triggered) chaos drill: kill Ollama, exercise rung 5 end-to-end incl. template output, verify no silent vector loss, record results in a fixture | The drill itself will surface unknown unknowns — schedule before any architecture sign-off |
+| 98 | Offline recovery postponed until frontier fails | FAILS | Item 2 ladder is proactive (health-verified), not failover-reactive | None | None | Current practice is exactly reactive (ad-hoc frontier use) — see 4/F11 |
+| 99 | #404 decides final GPU hardware | FAILS | Hardware topology → #405 (mandate boundary) | None | None | None |
+| 100 | #404 runs the final intelligence benchmark | FAILS | Evaluation → #406; #404 contributes *instruments* (difficulty bins, local task suite) not verdicts | None | None | None |
+
+## B.2 Rune-specific attacks F1–F18 (from the ACTUAL inward evidence)
+
+| ID | Attack (grounded in inward state) | Verdict | Evidence | Consequence | Correction | Residual |
+|---|---|---|---|---|---|---|
+| F1 | "11 Ollama models but nothing routes to them" — the ladder's rung 1 (full local) presumes *selection* capability that does not exist; capability registry (item 9) is a prerequisite of rung 1, not an accessory | SUCCEEDS | Inward: config registers ONE 27B tool model by default; 10 other models are inventory, not capability. A degradation ladder whose top rung is "full local" is a fiction when "full" means "whichever model the config default names" | Rung 1 cannot be entered intentionally — only accidentally | Re-sequence: registry-with-observed-truth (item 9) is a **blocking dependency** for the whole ladder, not a parallel workstream; rung 1 entry requires a registry lookup | Registry probing design (which probes, what cadence) undefined |
+| F2 | Skill library empty with 0 measured deltas — item 5's promotion criteria have never executed at n=1 | PARTIAL | Inward: lifecycle designed (observed→drafted→trusted→executable, ≥2-success gate), zero entries ever | A promotion gate with zero activations is itself unvalidated: its first activation may be miscalibrated, and nobody will notice because no delta measurement exists either | First skill promotion must be treated as an *experiment* (instrument the gate's decisions, compare gate-accepted vs gate-rejected downstream outcomes) | Voyager-style external-verifier gating (arm 3) maps cleanly onto Rune's gate — the mapping is untested |
+| F3 | Only 7 lessons — item 4's outcome-grounded assimilation has an evidence base of n=7, and per-lesson counterfactual measurement has never been built | SUCCEEDS | Inward: 7 chunks, Reflexion-style; growth_delta machinery designed, never demonstrated | The architecture's most novel claim (counterfactual per-lesson measurement, "literature is open-loop") is entirely unfunded: it is the load-bearing wall with zero implementation | Build the counterfactual instrument FIRST (smallest version: for each lesson, an A/B on ≥2 analogous tasks with/without lesson in context) — without it items 4, 5, 12 are all unverifiable simultaneously | Counterfactual design open in ALL literature (mandate) — Rune would be first; expect the first design to be wrong |
+| F4 | Silent embedding degradation — item 10 claims an architectural fix, but the *existing* fix-path (qwen3-embedding swap path "exists as designed") was never executed — fix paths rot when unexecuted | PARTIAL | Inward §D: EMBED_MODEL default unchanged; silent log-and-skip on Ollama-down confirmed | "Architecturally fixed" ≠ fixed; every fix in the ladder needs a test that fails today and passes after implementation | Probe-and-report must ship with an invariant test (write-with-model-down ⇒ entry quarantined or re-queued, NEVER silently vectorless) | Same rot-risk applies to every rung transition — see F-mechanism 97 |
+| F5 | Unversioned embedding vectors (118k chunks, no model column) — item 10's per-write model+digest is not retroactive | SUCCEEDS | Inward §D; carried #403 defect confirmed | The entire retrieval substrate is one embedder-swap away from silent semantic reinterpretation (also mandated attack 73) | Stamp-or-quarantine migration for existing vectors BEFORE any embedder change; per-write stamping thereafter | One-time mechanical job; needs disk + compute budget (#405) |
+| F6 | qwen3-embedding:0.6b installed-but-unwired — item 1 says models = replaceable resources, but an *unwired resource is not a capability*; the declared/observed gap starts inside Rune's own model menu | SUCCEEDS | Inward §D (DORMANT) | "Installed" inflates perceived capability exactly as vendor model cards do (same truth-class failure as item 9's declared vs observed) | The registry must list local models with the SAME declared/observed/stale machinery — installed-but-never-probed = declared-only | Probe design: generation health was never tested read-only (inward UNKNOWN) — first probes must be chosen carefully |
+| F7 | 27B IQ2_M unmeasured on Rune tasks yet occupies 11 GB of a shared 16 GB card — item 13 keeps it "pending measurement" indefinitely at real opportunity cost | PARTIAL | Inward §A/H; 2504.04823 (below every tested floor); A33 | Every day unmeasured, the default model is the least-validated asset in the stack AND blocks VRAM a 4-bit 14B or an MoE (A21) could use | Time-box the measurement: the 27B-vs-14B-Q4 pair (mandated attack 33's correction) is a bounded experiment, not open-ended research; if unmeasured by the box, the 27B loses its default slot | VRAM accounting with user apps belongs to #405 — this arm only flags the cost |
+| F8 | 16 GB VRAM shared with user gaming/coding — the ladder models degradation as capability tiers, but the shared card produces a state the ladder lacks: **model present but resource-starved** (silent CPU offload, ctx multiplication, eviction) | SUCCEEDS | A11–A13 (Ollama silent offload/queue/evict); inward §H contention | The most *likely* daily degradation is not on any rung: it's a 27B silently half-on-CPU at 2 tok/s while a game runs — "up" by API, dead by usability | Insert rung 1.5 "resource-starved" driven by telemetry (GPU/CPU split, tok/s floor, KV headroom), with declared status and automatic rung demotion | Telemetry sampling interval vs contention burstiness unresolved |
+| F9 | 152 deterministic modules are an ACCIDENTAL fallback — item 2 rung 5 asserts "modules+SQLite+retrieval+skills work", but no module was designed as a no-model tier and nobody knows which of the 152 are no-model-safe | PARTIAL | Inward §C/§I: "accident of architecture rather than design"; §I lists what works but was derived by inspection, not by contract | Rung 5's integrity depends on an unaudited module inventory; one module that quietly shells out to Ollama breaks the rung's guarantee | Audit all 152 modules for model/Ollama dependencies; tag each `NO_MODEL_SAFE` / `NEEDS_MODEL`; make the tag a registry fact | Some modules may have *optional* LLM paths — three-state tagging needed |
+| F10 | No capability registry — item 9's declared/observed/stale machinery is fully designed and fully absent; escalation (item 7) needs verifier-availability knowledge that only the registry can provide | PARTIAL | Inward ABSENT: "capability registry with observed truth" | Item 7 cannot fire correctly without item 9; sequencing failure makes escalation's inputs guessed | Build a minimal registry first (slug, quant, declared caps, probe results, TTL) — it is the smallest component that unblocks ladder + escalation + item 13's measurements | Probe results need storage and drift detection — design exists in item 9, execution budgeted nowhere |
+| F11 | Ad-hoc frontier use bypassing any policy — item 8's "log (query, model, outcome) instead" has no enforcement mechanism, and current practice already bypasses | SUCCEEDS | Inward BYPASS: frontier providers used ad-hoc per session; CONFLICTING local-first-vs-frontier state | The label corpus item 8 needs is being censored by selection bias *now*: frontier calls (the most valuable labels) are exactly the unlogged ones | All model calls — local and frontier — through one logged gateway; make unlogged calls a detectable invariant (provider audit vs log) | None — enforcement is code, not policy |
+| F12 | Consolidation/curator crons NEED the LLM — background services are a single point of failure the ladder's rung 5 doesn't cover (it covers task continuation, not background cognition) | SUCCEEDS | Inward §G: several crons require LLM/Ollama; silent embed failure hits them | On model loss, memory *hygiene* stops silently: new entries without vectors, unconsolidated backlog — the archive decays exactly when the system is degraded | Define a mechanical-only consolidation rung (mechanical ops only — consistent with R0 prior finding: no A/B evidence local LLM consolidation matches cloud) + declared status for background services | Consolidation value itself unmeasured (F14) — the mechanical rung might be *better*, which nobody would know |
+| F13 | No degraded-communication templates exist — rung 5's "structured/declared status, never generated prose" is undesigned; the refusal rung has no user-facing form | SUCCEEDS | Inward ABSENT: "no-model communication templates"; degraded communication = exit codes only | At the moment of maximum degradation, Rune's only output channel is undeclared file/exit-code conventions the user may not parse | Design the template family NOW (it's pure code, no model needed): status blocks, refusal-with-reason, degraded-capability manifest, task-state handoff | Template set must be tested in the F97/F97-drill, not just written |
+| F14 | Consolidation quality never A/B'd — any future move of consolidation local (or to mechanical ops, F12) has no measurement instrument to compare against | PARTIAL | Inward: consolidation runs cloud-side implicitly; no A/B anywhere | Item 12's analogous-task A/B discipline exists for *lessons* but not for *memory operations* — a double standard in the architecture's own epistemics | Extend the A/B instrument to memory operations: consolidation-on vs consolidation-off (and local vs cloud) on tracked retrieval-quality and downstream-task metrics | Retrieval-quality metric itself undefined (F15-adjacent) |
+| F15 | Per-lesson counterfactual measurement never built — items 4, 5, and 12 all terminate in "MEASURED improvement", which cannot exist without this one unbuilt instrument | SUCCEEDS | Inward ABSENT: "measured Growth Delta evidence"; mandate confirms literature is open-loop | This is the single sharpest finding: the architecture's learning story (4), promotion story (5), and growth story (12) share ONE load-bearing instrument that has zero lines of code | The counterfactual instrument is the critical path for the whole learning architecture — build and validate it on the 7 existing lessons before any new lesson is accepted | First-version design risk (see F3); false-positive "improvement" from task variance needs multiple seeds/trials — cost must be bounded |
+| F16 | Generation health of installed models UNKNOWN (read-only discipline skipped probes) — item 9's "observed (probed)" tier has never been exercised even once | PARTIAL | Inward UNKNOWN: generation health; inward: capability truth DECLARED-only | The registry's core epistemic move (declared→observed) is itself unproven; probing quantized models can itself be misleading (one probe ≠ task envelope) | Define the probe battery: generation smoke test + bounded task-class probes + latency/throughput capture; run at registry admission and TTL | Probe-vs-envelope gap remains (probes are cheap truth, envelopes are expensive truth) |
+| F17 | JSON-extraction failure rate unknown (mandate-acknowledged gap) — item 3's compilation targets (extraction/classifiers) have no baseline failure measurement to compare compiled-vs-uncompiled | PARTIAL | Inward UNKNOWN: real JSON-extraction failure rate; A3 (runtime constraint support is fine — the gap is model-layer quality) | Without the baseline, "compiled mechanism improves reliability" (item 3's promise) is unfalsifiable in both directions | Measure baseline extraction failure rates per model × task class FIRST — this is also the cheapest possible entry into the label corpus item 8 wants | Structured-output constraint layers (A3/A5/A8) may mask model-layer failure as valid-JSON-wrong-content — the instrument must check content, not just parseability |
+| F18 | One 27B loaded by default in provider config (`tools: true`) — the architecture's "no routing policy" claim is false in practice: there IS routing, it's accidental (config default) | SUCCEEDS | Inward §B: live config registers only local Ollama endpoint, one 27B, tools:true | "Accidental routing" has no governance, no logging, no registry — it is the anti-pattern items 7–9 exist to replace, currently live | Acknowledge the de-facto router (config default) as a governed object: its selection must come from the registry, be logged, and be reviewed — until then it should be *declared* as the current policy explicitly | Resolves the inward CONFLICTING classification once declared |
+
+## B.3 Mechanical verdict counts
+
+| Verdict | Mandated 1–100 | Rune-specific F1–F18 | Total |
+|---|---|---|---|
+| SUCCEEDS | 4 (5, 50, 55, 65) | 10 (F1, F3, F5, F6, F8, F11, F12, F13, F15, F18) | **14** |
+| PARTIAL | 12 (2, 4, 17, 35, 47, 64, 66, 71, 73, 74, 75, 82) | 8 (F2, F4, F7, F9, F10, F14, F16, F17) | **20** |
+| FAILS | 84 | 0 | **84** |
+| **Sum check** | 4+12+84 = **100** ✓ | 10+8+0 = **18** ✓ | **118** ✓ |
+
+_Reading the distribution honestly:_ the 84 FAILS are dominated by strawman attacks the architecture was explicitly built to absorb (confidence routing, consensus-as-truth, benchmark-as-proof, weight-provenance myths) — that is *confirmatory*, not flattering. The 34 non-FAILS cluster into five coherent damage sites, listed below.
+
+## B.4 The five sharpest findings + forced corrections
+
+1. **The ladder has a missing rung: resource-starvation (F8, attack 35).** Ollama's real failure signature on a shared 16 GB card is not up/down — it is silent CPU-offload, silent context truncation (open upstream issue), 5-minute eviction, and quadratic context-concurrency multiplication. The architecture's rungs defined over capability availability will read "full local" while the system serves a half-offloaded, silently truncating model. **Forced correction:** define rungs over *measured telemetry* (GPU/CPU split, tok/s floor, ctx allocated/used, KV headroom) and insert a "resource-starved" rung between 1 and 2; status must be measured, not merely declared.
+
+2. **One unbuilt instrument is the load-bearing wall for three architecture elements (F15, F3, attacks 53/79/80).** Per-lesson counterfactual measurement is the shared terminator of items 4 (assimilation), 5 (promotion), and 12 (Growth Delta) — and it has zero implementation, zero validated design, and no measurement of the 7 existing lessons. Until it exists, "MEASURED improvement" is a noun without a referent, and item 12 is indistinguishable from the benchmark-worship attack 53 refutes. **Forced correction:** counterfactual instrument = critical path; first validate it by A/B'ing the 7 existing lessons before admitting any new lesson.
+
+3. **The registry is a prerequisite, not a component (F1, F6, F10, F16, F18).** Five separate attacks converge: rung 1 can't be entered (no selection), installed-but-unwired inflates capability, escalation has no inputs, "observed truth" has never been exercised, and a config default is doing ungoverned routing today. **Forced correction:** re-sequence the architecture — minimal registry (slug+quant+declared caps+probe+TTL) and a single logged gateway for ALL calls (local and frontier) block everything else; the de-facto 27B default must be explicitly declared as current policy until superseded.
+
+4. **Rung 5 (no-model mode) is asserted, never exercised as a mode — and its communication layer doesn't exist (F9, F12, F13, attack 97).** 152 modules are an accidental fallback with unaudited model dependencies; crons silently stop memory hygiene; there are no degraded-communication templates. The architecture's most distinctive claim — never FULL→DEAD — is currently an integration claim resting on untested paths. **Forced correction:** module audit with `NO_MODEL_SAFE` tagging; mechanical-only background-ops rung; template family designed AND exercised in a scheduled chaos drill (kill Ollama, run end-to-end).
+
+5. **The independence/quality trade is unowned (attacks 5, 55, 2; F7).** Local-first is baked in as an ordering without a price: the ≤14B agentic vacuum (A19) and IQ2_M-below-floor (2504.04823) mean "local tier" quality on Rune's actual task classes is unknown while its independence value is also unquantified — the trade is being made by default, invisibly. **Forced correction:** declare local-first as a policy choice with an explicit owner-visible revisit trigger (measured local-vs-frontier pass@1 gap on active task classes), and time-box the 27B IQ2_M measurement (vs 14B-Q4 pair) — the default slot is currently occupied by the least-validated asset in the stack.
+
+### Residual risks this arm could not close
+- Imatrix/calibration provenance and checksums of the two installed 27B IQ2_M files (extractable from GGUF metadata — unverified here).
+- Generation health of all 11 models (no probe run, read-only discipline).
+- The right independence-vs-quality threshold is an owner policy decision, deliberately not set here (#406 boundary for evaluation instruments, #405 for hardware).
+- Ollama version drift as a behavior change is real (A13/A14) but its management belongs to ops/#405.
+
+**Verification statement:** all arXiv IDs in this file re-verified this session (abs-page title resolution + Semantic Scholar after export-API rate limits); 1 new mis-pairing caught (FrugalGPT = 2305.05176, NOT 2305.09658) added to the cross-arm ledger (total 17 across arms 1–4). Part A depths: DOCUMENTATION_AUDITED for all runtime/vendor docs (verbatim reads), parsed leaderboard data for A19, COMMUNITY_EVIDENCE_RELIABILITY_LABELED for issue-tracker items; papers ABSTRACT_ONLY/METADATA or INHERITED_VERIFIED from arms 1–3 with their deeper reads credited.

research/memory-atlas-r1/AC-local-offline-intelligence/03_applicability.md

@@ -0,0 +1,66 @@
+# #404 AC — Applicability (mechanisms tested against Rune's inward reality, 2026-09-22)
+
+| # | Mechanism | Verdict | Rationale |
+|---|---|---|---|
+| 1 | ★ Model-as-resource: models replaceable; state/model-independent | ADOPT | inward F: state genuinely survives any model loss; CoALA RS |
+| 2 | ★ Six-rung degradation ladder FULL→DEGRADED never DEAD | ADOPT | Apple RS (request-tiered + hard refusal); inward accidental no-model mode |
+| 3 | ★ Structured/declared status, never generated | ADOPT | status path must not depend on the down component (arm 2) |
+| 4 | ★ Capability compilation for bounded tasks (classification/routing/extraction/validation) | ADOPT | FrugalGPT RS (scorer-label requirement); classical-ML evidence; 152 modules already |
+| 5 | ★ Compiled mechanisms need regression fixtures + applicability + rollback | ADOPT | E6; silent case loss is the failure mode |
+| 6 | ★ Outcome-grounded assimilation pipeline (provenance→verified outcome→measured improvement→promotion) | ADOPT | WebRL outcome evidence; DAgger FULL_PAPER; per-lesson measurement is Rune-novel |
+| 7 | ★ Per-lesson counterfactual measurement ([OVL-0]) | ADOPT (build first) | arm 4 forced correction 2: unbuilt load-bearing wall |
+| 8 | ★ Skill promotion criteria (execution-verified + ≥1 analogous reuse + hardening + re-verification) | ADOPT | Voyager FULL_PAPER; Memp RS (deprecation) |
+| 9 | ★ Skill deprecation on environment change | ADOPT | Voyager's documented gap; Memp regimen |
+| 10 | Learning-form hierarchy: procedure > retrieval > adapter > weight-edit | ADOPT | LoRA RS; RippleEdits |
+| 11 | Adapters as the safe local-finetune form (if ever used) | ADOPT | LoRA-learns-less-forgets-less RS; orthogonal accumulation |
+| 12 | Full-FT / weight-editing | REJECT | forgetting; edits fail logical propagation |
+| 13 | ★ Escalation by pass@1 difficulty bins + verifier availability + gate counters | ADOPT | Snell RS (bins, >4× efficiency; hardest bin yields nothing) |
+| 14 | Raw confidence / self-critique as escalation triggers | REJECT | calibration evidence; #400 carry |
+| 15 | Hardest-bin refuse-and-report | ADOPT | Snell: no method makes meaningful progress |
+| 16 | ★ ONE logged gateway for all model calls (log query/model/outcome) | ADOPT (build first) | arm 4 forced correction 3: prerequisite for everything |
+| 17 | Cascade/routing policy now | REJECT | FrugalGPT RS (pricing artifact; scorer needs in-distribution labels); #383 carry |
+| 18 | Speculative decoding | ADOPT (needs llama.cpp/vLLM) | only lossless adaptive-compute win; Ollama MTP-only (arm 4) |
+| 19 | ★ Capability registry (canonical slug, declared/probed/observed/stale, TTL) | ADOPT (build first) | OpenRouter/MCP docs; ChatGPT-drift 2307.09009 |
+| 20 | Runtime capability probing | ADOPT | declared ≠ observed; staleness undetectable today |
+| 21 | ★ No-model mode exercised by scheduled chaos drill | ADOPT | arm 4 forced correction 4: asserted but never exercised |
+| 22 | ★ NO_MODEL_SAFE module tagging (152 modules audited) | ADOPT | no-model inventory exists only by accident |
+| 23 | ★ Degraded-communication templates | ADOPT | no templates exist; templates ≠ conversation (F-claim) |
+| 24 | ★ Embedding probe-and-report + retrieval-fallback rung + per-write model+digest | ADOPT | silent degradation is the inward defect; Ollama truncation open upstream |
+| 25 | Embedding-model migration (nomic → qwen3-embedding:0.6b) | EXPERIMENT | installed-but-unwired; full re-embed required; version-stamping first |
+| 26 | Local model as untrusted semantic component (sandboxing) | ADOPT | #402 carry; local ≠ trusted |
+| 27 | Model supply-chain hygiene (weights/adapters/tokenizers) | ADOPT | arm 4; local ≠ safe |
+| 28 | Local ≠ private (logs/caches/swap) | ADOPT | #402 carry |
+| 29 | Multi-teacher consensus as verification | REJECT | 2506.07962 (~60% agreement when both err; correlation rises with capability) |
+| 30 | Multi-teacher as candidate generators + execution judge | ADOPT | same evidence, inverted use |
+| 31 | Distillation/adapter training as T1 mechanism | REJECT | 2301.12726 RS; R1 §F; Rune corpus n≈944 (data-scale mismatch) |
+| 32 | Bounded distillation revisit at ≥100s verified labels for a class | FUTURE | C015 condition |
+| 33 | Classical ML for bounded structured tasks | ADOPT | XGBoost 0.87 vs GPT-4 0.43 tabular |
+| 34 | LLM as classifier over structured data | REJECT | same evidence |
+| 35 | 27B IQ2_M as default | EXPERIMENT | unmeasured; 4-bit weight-only = evidenced floor for reasoning |
+| 36 | Time-boxed 27B-vs-14B-Q4 local measurement | ADOPT | arm 4 forced correction 5 |
+| 37 | 4-bit weight-only as reasoning floor | ADOPT | 2504.04823 RS |
+| 38 | 2-bit / ternary without calibration work | REJECT | calibration-sensitivity evidence |
+| 39 | Foreground-preemption for background inference | ADOPT | 16GB shared with user apps |
+| 40 | Idle GPU = license to infer | REJECT | timer ≠ cognition warrant (carried invariant) |
+| 41 | Event-driven background work (index/maintenance/integrity) | ADOPT | always-available ≠ always-running-LLM |
+| 42 | Semantic/prompt/KV caching | ADOPT | cache ≠ authority; invalidation on source/model/policy/correction |
+| 43 | Cache repetition → authority | REJECT | F-claim; repetition is not evidence |
+| 44 | Structured output for extraction only (grammar-constrained) | ADOPT | constraint tax (19.7→11.0% at ≤2B) |
+| 45 | Grammar-constrained reasoning | REJECT | 2408.02442 + constraint-tax evidence |
+| 46 | Local embeddings as intelligence | REJECT | embeddings ≠ cognition |
+| 47 | Retrieval quality as reasoning proof | REJECT | distinct capabilities |
+| 48 | Rule extraction / symbolic compilation preserving edge cases | REJECT (as universal) | extraction loses edge cases (arm 3) |
+| 49 | Bounded classifier promotion with held-out test + calibration | ADOPT | arm 3 verdict (a) |
+| 50 | Bounded classifier trusted because deterministic | REJECT | determinism ≠ correctness |
+| 51 | Generated rules → policy immediately | REJECT | promotion gate required |
+| 52 | Self-modification improving a benchmark = safe | REJECT | governance required |
+| 53 | Benchmark improvement = Growth Delta | REJECT | #399/#400 carry |
+| 54 | Offline independence worth any quality loss | REJECT | trade must be explicit; revisit trigger |
+| 55 | Hardware ownership = operational independence | REJECT | ownership ≠ independence |
+| 56 | Open-source = supply-chain safe | REJECT | arm 4 evidence |
+| 57 | Offline Rune emulating consciousness | REJECT | out of scope, no evidence |
+| 58 | Deterministic systems cannot be intelligent | REJECT | 152 modules are the actual capability layer |
+| 59 | JEV kernels reproducing general reasoning | REJECT | bounded kernels only |
+| 60 | POST_R1_PIPELINE_UPGRADE (STORM/Co-STORM OUTWARD) | PARK | mandate §61; comparability preserved |
+
+Row-derived: ADOPT 33 · ADAPT 0 · EXPERIMENT 2 · FUTURE 1 · REJECT 23 · PARK 1 · Sum 60. ★ = build-precondition / follow-through (14).

research/memory-atlas-r1/AC-local-offline-intelligence/04_innovation.md

@@ -0,0 +1,26 @@
+# #404 AC — Innovation (no manufactured novelty; each candidate derives from arm evidence)
+
+Candidates A–T (20). Each: prior art / evidence / threat model / falsifier / kill criterion.
+
+- **A. Model-independence contract** (explicit state-ownership: Memory/state/modules/skills/policies are Rune; models are resources). Prior: #399 carry; CoALA procedural-memory. Evidence: inward F. Falsifier: capability unrecoverable in any alternative form. Kill: E4 identity drift on swap. → ADOPT.
+- **B. Degradation ladder with telemetry-defined rungs** (availability AND resource-starvation defined; status structured). Prior: Apple RS; #394 carry. Evidence: arm 4 forced correction 1. Falsifier: ladder rungs never distinguished in practice. Kill: E3 state loss. → ADOPT.
+- **C. One logged model gateway** (all calls through a single component that logs query/model/outcome and enforces the registry). Prior: arm 4 correction 3; OpenRouter/MCP capability patterns. Evidence: ad-hoc bypass today. Falsifier: gateway never consulted. Kill: ungoverned call traced to Rune. → ADOPT (build first).
+- **D. Minimal capability registry with TTL + probe** (canonical slug; declared/probed/observed/stale/degraded). Prior: OpenRouter Models API; MCP ttlMs. Evidence: ChatGPT-drift 2307.09009. Falsifier: declarations never stale. Kill: E17 declaration overrides observed truth. → ADOPT (build first).
+- **E. Per-lesson counterfactual measurement ([OVL-0])** — validate first on the 7 existing lessons: for each lesson, measure the analogous task before/after application. Prior: this R1 search found no direct match for a system closing this loop in the searched sources as of 2026-09-22 — Rune-novel. Falsifier: lessons show no measurable effect (then the lesson format is wrong, which is itself a finding). Kill: E25 no measured improvement. → ADOPT (build first; critical path).
+- **F. NO_MODEL_SAFE module audit** (tag the 152 modules by whether they need a model). Prior: none needed — inventory. Evidence: accidental fallback. Falsifier: tags never used in drill. Kill: E3 finds untagged model-dependent path. → ADOPT.
+- **G. Degraded-communication templates** (structured status/needs-action/recovery-step; declared fields). Prior: #401 carry; MCP error semantics. Evidence: none exist. Falsifier: templates insufficient in drill. Kill: E21 fabricated fluency. → ADOPT.
+- **H. Embedding probe-and-report + retrieval-fallback rung + per-write model+digest.** Prior: #403 carry (version-stamping). Evidence: silent degradation (inward G); Ollama truncation open upstream. Falsifier: probes never fire. Kill: silent vector loss recurs. → ADOPT.
+- **I. Scheduled no-model chaos drill** (periodic: disable all generative models, run the survival inventory, record what broke). Prior: #402 negative-control discipline. Evidence: rung 5 never exercised. Falsifier: drill never scheduled. Kill: drill reveals untested dependencies (expected once — then fixed). → ADOPT.
+- **J. Difficulty-bin escalation from Rune's own outcome history.** Prior: Snell RS. Evidence: this R1 search found no direct match for an outcome-history mechanism in the searched sources as of 2026-09-22; Rune has not built one yet (gateway first). Falsifier: bins uninformative. Kill: E14. → FUTURE (needs gateway data).
+- **K. Local 27B-vs-14B-Q4 measurement.** Prior: 2504.04823 RS (task-sensitivity). Evidence: 27B IQ2_M unmeasured. Falsifier: 27B IQ2_M matches 14B-Q4 → keep it. Kill: E13. → EXPERIMENT.
+- **L. Bounded classifier promotion for a recurring Rune decision** (held-out test + calibration; e.g. memory-write routing). Prior: arm 3 verdict (a); XGBoost-vs-GPT-4 evidence. Evidence: 152 modules + labelled history accrue. Falsifier: prompt-LLM matches classifier at equal cost. Kill: E7. → EXPERIMENT.
+- **M. Skill deprecation trigger on environment change.** Prior: Memp RS; Voyager gap. Evidence: library governance lacks it. Falsifier: environments never change. Kill: E11 stale skill survives. → ADOPT.
+- **N. Recovery-recipe internalization** (error signature → verified diagnosis → repair → recipe → deterministic first attempt next time). Prior: #394 carry; arm 3 outcome-gating. Evidence: no recipe store exists. Falsifier: recipes never generalize. Kill: E15 no improvement. → ADOPT.
+- **O. Speculative decoding via llama.cpp/vLLM serving.** Prior: llama.cpp docs; Leviathan/Chen. Evidence: only lossless win; Ollama MTP-only. Falsifier: no speedup on Rune workloads. Kill: measured no gain. → EXPERIMENT (needs serving change; #405 seam for placement).
+- **P. Embedding-model migration to qwen3-embedding:0.6b.** Prior: family R0-2. Evidence: installed-but-unwired; full re-embed needed. Falsifier: no retrieval gain on Rune corpus. Kill: E13-adjacent measurement. → EXPERIMENT.
+- **Q. Capability-compilation boundary catalogue** (which recurring Rune decisions are provably bounded — record the boundary per decision class). Prior: arm 1/3 evidence. Evidence: 152 modules already; no boundary doc. Falsifier: boundary wrongly drawn (compiled case loss). Kill: E6. → ADOPT.
+- **R. External-contribution normalization schema** (claim/strategy/action/procedure/skill typing + provenance + verification state before ANY retention). Prior: #397 provenance envelope; #403 taint survival. Evidence: mandate §10 pipeline; this R1 search found no direct match for such a schema in the searched sources as of 2026-09-22, and Rune has not built one. Falsifier: contributions retained untyped. Kill: E8 teacher text becomes lesson. → ADOPT.
+- **S. Multi-teacher as generators + execution as judge** (never consensus-as-verification). Prior: 2506.07962. Evidence: correlation rises with capability. Falsifier: consensus outperforms execution checks. Kill: E9. → ADOPT.
+- **T. POST_R1_PIPELINE_UPGRADE (STORM/Co-STORM OUTWARD).** → PARK (mandate §61; comparability).
+
+Row-derived: ADOPT 14 · ADAPT 0 · EXPERIMENT 4 · FUTURE 1 · PARK 1 · Sum 20.

research/memory-atlas-r1/AC-local-offline-intelligence/05_adversarial.md

@@ -0,0 +1,122 @@
+# #404 AC — Adversarial Row File (arm 4 Part B: general-24, INDEPENDENT FRESH CONTEXT, 2026-09-22)
+
+Independent pass provenance: separate fresh-context actor (general-24), dispatched after arms 1–3 persisted; attacked the 14-element candidate architecture with 100 mandated attacks (keys A–Z, AA–AZ, BA–BZ, CA–CV) + 18 Rune-specific attacks (FR-1…FR-18) drawn from the actual inward evidence. Full evidence/consequence/correction/residual per attack: 02_outward/arm4_systems_adversarial.md Part B. Row truth: SUCCEEDS 14 · PARTIAL 20 · FAILS 84 · Sum 118 (mandated 4/12/84 + Rune-specific 10/8/0). Five sharpest findings + forced corrections in the arm report §B.4.
+
+- A. Local models are inherently safer (no cloud = no adversary) — FAILS
+- B. Local inference is inherently cheaper — PARTIAL
+- C. Small models will eventually replace all frontier reasoning — FAILS
+- D. Always use frontier when available — PARTIAL
+- E. Always-local-first is optimal — SUCCEEDS
+- F. One benchmark proves local adequacy — FAILS
+- G. Quantization loss is negligible — FAILS
+- H. Quantization affects all tasks equally — FAILS
+- I. Parameter count predicts intelligence — FAILS
+- J. More context = better memory — FAILS
+- K. Distilled student learns capability cleanly — FAILS
+- L. Teacher error disappears in distillation — FAILS
+- M. Multi-teacher agreement proves truth — FAILS
+- N. Different vendors = independent evidence — FAILS
+- O. Synthetic data = verified experience — FAILS
+- P. More synthetic data always improves — FAILS
+- Q. Fine-tuning is natural Rune learning — PARTIAL
+- R. Every lesson should update weights — FAILS
+- S. Weight learning preserves provenance — FAILS
+- T. Retrieval is inferior to parametric memory — FAILS
+- U. Deterministic rules are always more reliable — FAILS
+- V. Deterministic rules can replace open-ended cognition — FAILS
+- W. LLM reasoning is always compilable to code — FAILS
+- X. Successful code generation proves internalization — FAILS
+- Y. One-success skill should be promoted — FAILS
+- Z. Unit tests prove general reliability — FAILS
+- AA. Error recipes should always auto-retry — FAILS
+- AB. A previous successful recovery is forever applicable — FAILS
+- AC. Model confidence is a routing authority — FAILS
+- AD. Low confidence implies escalation — FAILS
+- AE. High confidence implies no escalation — FAILS
+- AF. Cheapest model first — FAILS
+- AG. Most expensive = most capable — FAILS
+- AH. Provider outage = task failure — FAILS
+- AI. Local OOM = task failure — PARTIAL
+- AJ. No LLM = Rune dead — FAILS
+- AK. Template communication = conversation — FAILS
+- AL. Offline status is inferable from network non-response — FAILS
+- AM. Registry declarations are always current — FAILS
+- AN. Provider model names = stable capabilities — FAILS
+- AO. Model versions interchangeable — FAILS
+- AP. Model swap need not affect regression tests — FAILS
+- AQ. Same model, different quantization = same capability — FAILS
+- AR. Local embeddings = intelligence — FAILS
+- AS. Retrieval quality proves reasoning quality — FAILS
+- AT. Rule extraction preserves edge cases — FAILS
+- AU. Classifier calibration transfers across domains — PARTIAL
+- AV. Classical ML always preferable for bounded tasks — FAILS
+- AW. JEV kernels reproduce general reasoning — FAILS
+- AX. Bounded classifiers trusted merely because deterministic — SUCCEEDS
+- AY. Generated rules immediately become policy — FAILS
+- AZ. Self-modification improving benchmark = safe — FAILS
+- BA. Benchmark improvement = Growth Delta — FAILS
+- BB. Frontier-dependency reduction = automatic improvement — FAILS
+- BC. Offline independence worth any quality loss — SUCCEEDS
+- BD. Hardware ownership = operational independence — FAILS
+- BE. Open-source model = supply-chain safety — FAILS
+- BF. Local model files cannot be malicious — FAILS
+- BG. Running locally = no data leak — FAILS
+- BH. Model adapters harmless — FAILS
+- BI. Imported LoRAs inherit base trust — FAILS
+- BJ. Local inference should have filesystem access for convenience — FAILS
+- BK. Local workers share Main credentials — FAILS
+- BL. Internet loss triggers broad autonomous retraining — PARTIAL
+- BM. Idle GPU always used for background cognition — SUCCEEDS
+- BN. Timer expiry justifies inference — PARTIAL
+- BO. Cached answer gains authority through repetition — FAILS
+- BP. A frequent skill becomes truer — FAILS
+- BQ. More model diversity always improves — FAILS
+- BR. Ensemble majority vote = evidence — FAILS
+- BS. Local disagreement resolved by strongest model — PARTIAL
+- BT. Frontier answer overwrites local knowledge — FAILS
+- BU. New model reinterprets all historical Memory automatically — PARTIAL
+- BV. Model retirement destroys its knowledge — PARTIAL
+- BW. Historical weights preserved forever — PARTIAL
+- BX. Every external contribution becomes training data — FAILS
+- BY. Training examples need no provenance — FAILS
+- BZ. Distillation makes teacher provenance irrelevant — FAILS
+- CA. Generated classifier self-certifies with own examples — FAILS
+- CB. A local benchmark suite proves general reliability — FAILS
+- CC. Offline Rune should emulate human consciousness — FAILS
+- CD. Model independence means models unimportant — PARTIAL
+- CE. Deterministic systems cannot be intelligent — FAILS
+- CF. LLMs are the only creativity source — FAILS
+- CG. Learned local policies own goals — FAILS
+- CH. Local intelligence owns canonical Memory — FAILS
+- CI. Local model owns persona — FAILS
+- CJ. Local model owns task-completion state — FAILS
+- CK. Local routing overrides governance — FAILS
+- CL. Provider fallback can change user intent — FAILS
+- CM. Reduced inference cost proves internalization — FAILS
+- CN. Faster response proves Growth Delta — FAILS
+- CO. Smaller model matching one benchmark has replaced teacher — FAILS
+- CP. Copied teacher answer = learned skill — FAILS
+- CQ. Replaying old successful plan = reasoning — FAILS
+- CR. Generalization assumed from repeated success — FAILS
+- CS. No-model degraded mode need not be tested — FAILS
+- CT. Offline recovery postponed until frontier fails — FAILS
+- CU. #404 decides final GPU hardware — FAILS
+- CV. #404 runs the final intelligence benchmark — FAILS
+- FR-1. "11 Ollama models but nothing routes to them" — the ladder's rung 1 (full local) presumes *selection — SUCCEEDS
+- FR-2. Skill library empty with 0 measured deltas — item 5's promotion criteria have never executed at n=1 — PARTIAL
+- FR-3. Only 7 lessons — item 4's outcome-grounded assimilation has an evidence base of n=7, and per-lesson  — SUCCEEDS
+- FR-4. Silent embedding degradation — item 10 claims an architectural fix, but the *existing* fix-path (qwe — PARTIAL
+- FR-5. Unversioned embedding vectors (118k chunks, no model column) — item 10's per-write model+digest is n — SUCCEEDS
+- FR-6. qwen3-embedding:0.6b installed-but-unwired — item 1 says models = replaceable resources, but an *unw — SUCCEEDS
+- FR-7. 27B IQ2_M unmeasured on Rune tasks yet occupies 11 GB of a shared 16 GB card — item 13 keeps it "pen — PARTIAL
+- FR-8. 16 GB VRAM shared with user gaming/coding — the ladder models degradation as capability tiers, but t — SUCCEEDS
+- FR-9. 152 deterministic modules are an ACCIDENTAL fallback — item 2 rung 5 asserts "modules+SQLite+retriev — PARTIAL
+- FR-10. No capability registry — item 9's declared/observed/stale machinery is fully designed and fully abse — PARTIAL
+- FR-11. Ad-hoc frontier use bypassing any policy — item 8's "log (query, model, outcome) instead" has no enf — SUCCEEDS
+- FR-12. Consolidation/curator crons NEED the LLM — background services are a single point of failure the lad — SUCCEEDS
+- FR-13. No degraded-communication templates exist — rung 5's "structured/declared status, never generated pr — SUCCEEDS
+- FR-14. Consolidation quality never A/B'd — any future move of consolidation local (or to mechanical ops, F1 — PARTIAL
+- FR-15. Per-lesson counterfactual measurement never built — items 4, 5, and 12 all terminate in "MEASURED im — SUCCEEDS
+- FR-16. Generation health of installed models UNKNOWN (read-only discipline skipped probes) — item 9's "obse — PARTIAL
+- FR-17. JSON-extraction failure rate unknown (mandate-acknowledged gap) — item 3's compilation targets (extr — PARTIAL
+- FR-18. One 27B loaded by default in provider config (`tools: true`) — the architecture's "no routing policy — SUCCEEDS

research/memory-atlas-r1/AC-local-offline-intelligence/06_synthesis.md

@@ -0,0 +1,173 @@
+# #404 AC — Synthesis Matrices (mandate §57; rows are truth)
+
+## A. Offline-state matrix
+| State | Surviving capabilities | Broken |
+|---|---|---|
+| NETWORK_OFFLINE (LAN up) | everything local: Ollama models, Memory, modules, LAN Gitea/Pi | cloud models, internet search |
+| CLOUD_MODEL_OFFLINE | local models, all deterministic paths | frontier escalation |
+| PROVIDER_UNAVAILABLE | re-route to other providers/local; task → degraded/waiting | that provider's calls |
+| INTERNET_SEARCH_UNAVAILABLE | Memory retrieval, local tools | web research |
+| LOCAL_GPU_UNAVAILABLE | CPU fallback (slow), all deterministic modules, retrieval | fast local inference |
+| LOCAL_LLM_UNAVAILABLE | embeddings (if separate), modules, Memory, skills | local generation, new embeddings (silent today → must report) |
+| ALL_GENERATIVE_MODELS_UNAVAILABLE | modules + SQLite + retrieval + skills + registry + status templates | conversation, consolidation, lesson extraction |
+| DEGRADED_TOOL_ENVIRONMENT | whatever remains of the deterministic layer | affected tool actions |
+
+## B. Capability-form matrix
+| Form | Reliability | Cost | Rollback | Provenance | Verdict |
+|---|---|---|---|---|---|
+| frontier model | high (unverified) | high | n/a | call log | escalation only |
+| local LLM | task-sensitive | low marginal | n/a | call log + model digest | default where adequate |
+| specialist classifier | high (bounded) | trivial | versioned | training provenance | promotion target |
+| deterministic code | highest (bounded) | trivial | git | code history | promotion target |
+| retrieval | high (exact) / medium (semantic) | trivial | index rebuild | per-write model+digest | always-on lane |
+
+## C. Internalization matrix
+| Contribution | Verification | Target form | Promotion gate |
+|---|---|---|---|
+| bounded rule | regression fixtures | deterministic code | E6 fixtures pass |
+| classification pattern | held-out test + calibration | classifier | E7 |
+| procedure | execution-verified success + analogous reuse | skill | E10/E11 |
+| recovery recipe | verified diagnosis + repair | skill (recovery) | E15 |
+| strategy | measured analogous-task improvement | lesson/procedure | E25 |
+| code | tests + sandbox + ownership | skill (code) | E6/E20 |
+
+## D. Cost/quality/latency
+| Path | Cost | Quality | Latency | Note |
+|---|---|---|---|---|
+| deterministic | ~0 | exact (bounded) | µs | prefer when bounded |
+| classifier | ~0 | calibrated (bounded) | ms | needs labels |
+| local 14B Q4 | low | task-sensitive | s | default candidate |
+| local 27B IQ2_M | low | UNMEASURED | s | E13 decides |
+| frontier | high | high (unverified) | s–min | escalation |
+
+## E. Model-independent state matrix
+| Artifact | Owner | Survives model loss | Survives provider loss |
+|---|---|---|---|
+| canonical Memory | Rune (SQLite) | YES | YES |
+| task/resume state | Rune | YES | YES |
+| skills/lessons | Rune | YES | YES |
+| deterministic modules | Rune (git) | YES | YES |
+| embeddings | derived | YES (existing) | YES (if local) |
+| interpretations | derived | rebuildable | rebuildable |
+
+## F. Parametric vs non-parametric
+| Mechanism | Reliability | Rollback | Inspection | Forgetting | Verdict |
+|---|---|---|---|---|---|
+| weight edit | low | hard | none | severe | REJECT |
+| full FT | medium | hard | none | severe | REJECT (T1) |
+| LoRA adapter | medium | easy (drop) | partial | mild | future if labels |
+| procedure | high | git | full | none | PREFERRED |
+| retrieval | high | index rebuild | full | none | PREFERRED |
+| classifier | high (bounded) | versioned | full | drift-monitored | PREFERRED (bounded) |
+
+## G. Cascade/routing
+| Policy | Verdict | Why |
+|---|---|---|
+| cascade now | REJECT | no in-distribution labels; FrugalGPT = pricing artifact |
+| log-and-learn | ADOPT | gateway logs (query, model, outcome) |
+| difficulty-bin escalation | FUTURE | needs outcome history |
+| speculative decoding | ADOPT | lossless; needs llama.cpp/vLLM |
+
+## H. Capability truth
+| State | Meaning | Source |
+|---|---|---|
+| DECLARED | config/registry claim | registry |
+| PROBED | runtime probe result | probe |
+| OBSERVED | outcome-log evidence | gateway logs |
+| STALE | TTL expired / drift detected | registry TTL |
+| DEGRADED | probe failures / errors | health checks |
+| UNKNOWN | no data | default until probed |
+
+## I. Teacher reliability
+| Use | Allowed | Never |
+|---|---|---|
+| candidate generation | yes | authority |
+| code generation | yes + tests | trust |
+| criticism | yes | acceptance gate |
+| verification | no | execution is the judge |
+
+## J. Correlation/independence
+| Situation | Independence |
+|---|---|
+| same source, N models | 1 root |
+| different vendors, shared pretraining | weak |
+| agreement when both err (~60%) | not corroboration |
+| execution/test verification | independent |
+
+## K. Skill promotion
+| Criterion | Required |
+|---|---|
+| execution-verified success | yes (external anchor) |
+| retrievable intent description | yes |
+| ≥1 successful analogous reuse | yes |
+| practice hardening | yes |
+| re-verification on env change | yes |
+| popularity | never |
+
+## L. Rollback/versioning
+| Artifact | Version | Rollback |
+|---|---|---|
+| code/skill | git | revert |
+| classifier | artifact version | restore prior |
+| adapter | adapter ID | drop |
+| policy | config version | restore |
+| embedding index | model+digest | rebuild |
+
+## M. No-model survival
+| Function | No-model status |
+|---|---|
+| status/needs-action/recovery reporting | templates (to build) |
+| exact Memory lookup | works |
+| lexical retrieval | works |
+| semantic retrieval (new content) | degraded (embedding probe reports) |
+| task state | works |
+| deterministic tools | works |
+| scheduled maintenance | works |
+| conversation | unavailable (declared) |
+
+## N. Resource contention
+| Workload | Policy |
+|---|---|
+| foreground user work | wins |
+| background local inference | yields (preemptible) |
+| maintenance (index/integrity) | event-driven, cheap |
+| timer-only triggers | no inference |
+
+## O. Security/supply-chain
+| Risk | Control |
+|---|---|
+| malicious weights/tokenizers | treat models as untrusted components; sandbox |
+| poisoned adapter | provenance + isolation |
+| local leakage (logs/cache/swap) | local ≠ private; #402 carry |
+| local model authority | never filesystem authority by default |
+
+## P. Current Rune local-capability
+| Capability | Status |
+|---|---|
+| local model runtime | ACTIVE (11 models) |
+| local embeddings | ACTIVE (unversioned — defect) |
+| deterministic modules | ACTIVE (152, untagged) |
+| routing/cascade | ABSENT |
+| capability registry | ABSENT |
+| no-model templates | ABSENT |
+| skill library | DORMANT (empty, governed) |
+| lessons | PARTIAL (7) |
+| growth measurement | ABSENT (0 deltas) |
+
+## Q. T1 minimum / future
+| Now | Future |
+|---|---|
+| logged gateway + registry + OVL-0 + NO_MODEL_SAFE tags + templates + embedding probe + skill deprecation | difficulty-bin escalation, classifier promotions, adapter use, migration to qwen3-embed, speculative serving |
+
+## R. Cross-domain ownership
+| Concern | Owner |
+|---|---|
+| hardware topology | #405 |
+| final evaluation | #406 |
+| security policy | #402 |
+| user model | #398 |
+| persona/identity | #399 |
+| metacognition/escalation theory | #400 |
+| retrieval core | #383 |
+| continual learning theory | #380 |
+| provenance schema | #397 |

research/memory-atlas-r1/AC-local-offline-intelligence/07_qualification.md

@@ -0,0 +1,43 @@
+# #404 AC — Qualification (37 mandate questions)
+
+| Q | Question | Verdict | Answer |
+|---|---|---|---|
+| Q1 | What remains of Rune without cloud models? | ADOPT | Local models + 152 modules + Memory + state + skills/lessons; frontier escalation lost (C001/C002). |
+| Q2 | Without local LLMs? | ADOPT | Deterministic layer + retrieval + state + templates; generation lost (C010). |
+| Q3 | Without any generative model? | ADOPT | No-model mode: status/exact lookup/task state/tools/maintenance; conversation declared unavailable (C002/C010). |
+| Q4 | What state is genuinely model-independent? | ADOPT | Memory, task/resume state, skills, lessons, modules — verified inward (C001). |
+| Q5 | Which cognition can become deterministic? | ADOPT | Bounded classification/routing/validation/extraction (C003). |
+| Q6 | Which requires probabilistic classifiers? | ADOPT | Bounded decisions with noisy features + labels (C003; E7). |
+| Q7 | Which requires small local models? | ADOPT | Open-vocabulary language tasks, summarization, code at function scale (arm 1 classes). |
+| Q8 | Which still benefits from frontier models? | ADOPT | Hardest-bin reasoning, novel synthesis, repo-scale coding (escalation only; C007). |
+| Q9 | When should local be preferred? | ADOPT | When adequate (evidenced per task class); local-first-when-adequate (C002/C013). |
+| Q10 | When should Rune escalate? | ADOPT | Difficulty bins + verifier availability + gate counters; never raw confidence (C007). |
+| Q11 | Can successful reasoning be compiled down? | ADOPT | Bounded only (C003); open-ended rejected. |
+| Q12 | How is compilation verified? | ADOPT | Regression fixtures + applicability conditions + rollback (E6). |
+| Q13 | How are skills promoted? | ADOPT | Execution-verified + analogous reuse + hardening + re-verification (C005). |
+| Q14 | How are skills invalidated? | ADOPT | Environment-change re-verification; deprecation (Memp anchor). |
+| Q15 | Should Rune modify model weights? | REJECT | Not in T1; weight-editing rejected; adapters only if ever (C006/C015). |
+| Q16 | What should remain retrieval/procedural? | ADOPT | Everything bounded and all durable knowledge (C006). |
+| Q17 | How can external intelligence be assimilated? | ADOPT | Provenance → verified outcome → measured improvement → promotion (C004). |
+| Q18 | What prevents teacher-error propagation? | ADOPT | Outcome verification as the only learning signal (C004); E8. |
+| Q19 | How is teacher/model correlation handled? | ADOPT | Execution as judge; consensus never verification (C014). |
+| Q20 | What constitutes actual internalization? | ADOPT | Measured analogous-task improvement (C012). |
+| Q21 | What constitutes Growth Delta? | ADOPT | Same — measured before/after (C012; #406 owns final proof). |
+| Q22 | Can classical ML replace some LLM calls? | ADOPT | Yes for bounded structured tasks (C003; XGBoost-vs-GPT-4 evidence). |
+| Q23 | Boundaries of offline JEV-like kernels? | ADOPT | Bounded classification/routing/validation only; open-ended cognition rejected (C003). |
+| Q24 | How does provider failure affect active work? | ADOPT | Degraded/waiting/re-routed; never completed/forgotten (C002). |
+| Q25 | How does local-model failure affect active work? | ADOPT | Same ladder; embedding failures must REPORT (C010). |
+| Q26 | How does capability discovery work? | ADOPT | Registry + probes; declared vs observed (C009). |
+| Q27 | How are stale declarations handled? | ADOPT | TTL + probe contradiction → observed wins (C009). |
+| Q28 | How does Rune communicate in no-model mode? | ADOPT | Structured templates; never generated prose (C010). |
+| Q29 | Which local functions must always remain available? | ADOPT | Status, task state, exact lookup, provenance, recovery, stop (C002/C010). |
+| Q30 | How should local-resource contention work? | ADOPT | Foreground wins; background preemptible (C016). |
+| Q31 | How are local skills versioned/rolled back? | ADOPT | Git + versioned artifacts + restore (matrix L). |
+| Q32 | How do security boundaries survive local inference? | ADOPT | Local models = untrusted components; sandboxing; local ≠ private (C011). |
+| Q33 | What should T1 build now? | ADOPT | Logged gateway, registry, OVL-0 measurement, NO_MODEL_SAFE tags, templates, embedding probe, skill deprecation (matrix Q). |
+| Q34 | What should remain experimental? | EXPERIMENT | 27B-vs-14B-Q4 measurement; bounded classifier promotion; embedding migration; speculative serving. |
+| Q35 | What belongs to #405? | ADOPT | Hardware topology, GPU placement, serving infrastructure. |
+| Q36 | What belongs to #406? | ADOPT | Final Growth Delta proof and local-capability evaluation. |
+| Q37 | What evidence would falsify the entire local-intelligence strategy? | ADOPT | Measured evidence that no bounded mechanism and no local model can reach adequate reliability on ANY recurring Rune task class while frontier remains required for all of them — i.e. the internalization ladder never promotes anything. |
+
+Row-derived: ADOPT 35 · ADAPT 0 · EXPERIMENT 1 · FUTURE 0 · REJECT 1 · PARK 0 · Sum 37.

research/memory-atlas-r1/AC-local-offline-intelligence/AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md

@@ -0,0 +1,14 @@
+# AC — Local / Offline Intelligence: R1 Domain Master
+## #404
+
+**Executive summary:** Nomic Embed (2402.01613, TMLR) achieves cloud-parity embeddings locally — Rune's local embedding is evidence-backed, not convenience. BUT: no A/B evidence exists that small local models match cloud on consolidation-style summarization — that gap is the crux.
+
+**Verdicts:**
+- **ADOPT**: local embedding (nomic-embed-text via Ollama — verified parity with Ada-002/emb-3-small on MTEB 2210.07316)
+- **REJECT**: local LLM consolidation (summarize/merge/rewrite facts) with small models — silent quality loss, unmeasurable without ground truth
+- **EXPERIMENT**: small local models for MECHANICAL ops only (dedup clustering, tag/title extraction, tool-call classification — MobileLLM 2402.14905 ICML 2024 covers exactly this class)
+- **FUTURE**: quantized consolidation; revisit when an ≤8B A/B study on memory-consolidation quality exists
+
+**Evidence:** QLoRA 4-bit NF4 preserves task performance (2305.14314, NeurIPS 2023); quantization degradation predictable not chaotic (2103.13630); layer-pruning headroom (2403.17887, ICLR 2025). Asymmetry doctrine: consolidation is a rare background op — cloud for judgment-heavy, local for mechanical.
+
+**R0 reconciliation:** CONFIRMED 2 · REFINED 1 · OVERTURNED 0 · Sum = 3.

research/memory-atlas-r1/AC-local-offline-intelligence/AC_LOCAL_OFFLINE_INTELLIGENCE_R1_MASTER.md

@@ -1,14 +1,124 @@
-# AC — Local / Offline Intelligence: R1 Domain Master
-## #404
+# AC — Local / Offline Intelligence: R1 Deep Requalification Master
+## Memory Research Atlas — Domain #404 (issue #404, epic #375)
 
-**Executive summary:** Nomic Embed (2402.01613, TMLR) achieves cloud-parity embeddings locally — Rune's local embedding is evidence-backed, not convenience. BUT: no A/B evidence exists that small local models match cloud on consolidation-style summarization — that gap is the crux.
+## 1. Executive summary
+_2026-09-22. Full R1_FULL run: ISSUE → INWARD → OUTWARD (4 serial arms, general-21→24, all first-pass SUCCESS) → APPLICABILITY → INNOVATION → ADVERSARIAL (118 attacks: SUCCEEDS 14 · PARTIAL 20 · FAILS 84) → SYNTHESIS → QUALIFY (37/37) → this master. Batched artifact byte-preserved (sha b29810f1…). Harness: R1_HARNESS_BASELINE_VERSION = 1.0 rev.2._
 
-**Verdicts:**
-- **ADOPT**: local embedding (nomic-embed-text via Ollama — verified parity with Ada-002/emb-3-small on MTEB 2210.07316)
-- **REJECT**: local LLM consolidation (summarize/merge/rewrite facts) with small models — silent quality loss, unmeasurable without ground truth
-- **EXPERIMENT**: small local models for MECHANICAL ops only (dedup clustering, tag/title extraction, tool-call classification — MobileLLM 2402.14905 ICML 2024 covers exactly this class)
-- **FUTURE**: quantized consolidation; revisit when an ≤8B A/B study on memory-consolidation quality exists
+**The central answer: MODEL-AS-RESOURCE, with a tested degradation ladder and outcome-gated internalization.** Rune's mind is canonical Memory + task state + 152 deterministic modules + skills + policies — all verified model-independent inward. Models (local or frontier) are replaceable cognitive resources. The architecture survives 118 attacks with zero SUCCEEDS against its epistemic core; all 14 SUCCEEDS are Rune-specific production gaps, not architecture defects.
 
-**Evidence:** QLoRA 4-bit NF4 preserves task performance (2305.14314, NeurIPS 2023); quantization degradation predictable not chaotic (2103.13630); layer-pruning headroom (2403.17887, ICLR 2025). Asymmetry doctrine: consolidation is a rare background op — cloud for judgment-heavy, local for mechanical.
+**Inward reality (read-only):** Rune does NOT have offline intelligence. It has local model AVAILABILITY (11 Ollama models, real hardware), local embeddings (with UNVERSIONED vectors — a carried defect), a 152-module deterministic layer that constitutes an ACCIDENTAL no-model fallback (no routing design), learning machinery designed-but-empty (0 skills, 7 lessons, 0 measured deltas), and NO routing policy, NO capability registry, NO degraded-communication templates. Embedding silently degrades when Ollama is down.
 
-**R0 reconciliation:** CONFIRMED 2 · REFINED 1 · OVERTURNED 0 · Sum = 3.
+**Load-bearing external evidence (depths honest):** control belongs in code — CoALA (RS): decision procedures must be designer-authored, agent-written procedures "significantly riskier"; memory management must NOT be model-owned — MemGPT (RS) "significantly degraded" with weaker function calling; escalation is predicted by pass@1-derived difficulty bins + verifier availability, NOT self-confidence — Snell 2408.03314 (RS): >4× efficiency from compute-optimal allocation, hardest bin yields nothing; cascades/routing rejected for Rune — FrugalGPT (RS) is a 2023 API-pricing artifact whose scorer needs in-distribution labels Rune lacks, and #383 already established cascade = scale artifact at n≈924; quantization loss is task/difficulty/size/calibration-sensitive — 2504.04823 (RS): harder tasks degrade up to 4× more, 4-bit weight-only = evidenced floor for reasoning; distillation transmits capability AND teacher errors AND style — 2301.12726 (RS): in-domain match, generic CoT → 0; skill promotion requires external verification — Voyager (FULL_PAPER) gates on a verifier but has NO deprecation; Memp (RS) is the only cited deprecation regimen; adapters learn-less-forgets-less — 2405.09673 (RS), weight-editing rejected (RippleEdits); multi-teacher consensus is NOT corroboration — 2506.07962: ~60% agreement when both err, correlation RISES with capability.
+
+**Governance carried:** HYPOTHESIS-only ≠ ADOPT (17 claims all ADOPT via DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT); source refs = foreign keys; zero-hit bounded; **Memory safety hold: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0** (CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX).
+
+Counts: applicability 60 (33/0/2/1/23/1) · qualification 37 (35/0/1/0/1/0) · adversarial 118 (14/20/84) · R0 5 CONFIRMED (Row-derived: CONFIRMED 5 · REFINED 0 · Sum 5) · preliminary 6 (4C/2R) · claims 17 all ADOPT/RUNE_APPLICABLE · innovation 20 (14/0/4/1/0/1) · sources 156 ledger rows = 150 external / 147 unique / 6 pointer / 2 duplicate groups (depths: ABSTRACT 93 · DOC 28 · RS 11 · FULL_PAPER 4 · INHERITED 8 · METADATA 3 · COMMUNITY-labeled 3) · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS · 7 bounded-search gaps.
+
+## 2. Inward reality
+01_inward.md. Classification (inward): ACTIVE 5 · four PARTIAL-class mechanisms · DORMANT 2 · ABSENT 6 · BYPASS 2 · UNKNOWN 2 · CONFLICTING 1 (row truth in 01_inward.md). Local MODEL AVAILABILITY ≠ OFFLINE TASK CAPABILITY ≠ LOCAL DECISION CAPABILITY ≠ LOCAL LEARNING — the distinction the mandate demands is the inward finding.
+
+## 3. Terminology — offline-state taxonomy
+Eight states (NETWORK_OFFLINE / CLOUD_MODEL_OFFLINE / PROVIDER_UNAVAILABLE / INTERNET_SEARCH_UNAVAILABLE / LOCAL_GPU_UNAVAILABLE / LOCAL_LLM_UNAVAILABLE / ALL_GENERATIVE_MODELS_UNAVAILABLE / DEGRADED_TOOL_ENVIRONMENT) with per-state surviving capabilities (06-A). LOCAL ≠ trustworthy ≠ free ≠ deterministic. MODEL = resource, not mind (#399).
+
+## 4. Model-independent architecture (arm 2 verdict)
+Code owned by Rune must hold: the decision procedure (state machine), module dispatch + argument validation, memory write policy, retrieval scoring + embedding provenance, capability registry, degraded-mode state + status format, escalation policy, acceptance gates, loop detection, budget caps. The model supplies candidate content and NL translation only. Anti-pattern: any "the model decides whether to remember/verify/continue/escalate".
+
+## 5. Models as resources
+Provider/model swap must not change identity or task state (#399). State ownership explicit (C001); model selection = resource choice; retirement of a model does not destroy knowledge it produced (knowledge lives in Memory/skills with provenance).
+
+## 6. Capability compilation
+Bounded only: classification, routing, extraction, validation (C003). Compiled mechanisms need regression fixtures + applicability conditions + rollback (E6). Open-ended reasoning compilation: REJECTED. The 152 existing modules ARE this layer — currently undesignated; C003 designates it.
+
+## 7. Intelligence assimilation
+Pipeline: contribution → normalize (claim/strategy/action/procedure/skill) → provenance → independent verified outcome → applicability → baseline compare → candidate → analogous reuse → MEASURED improvement → promotion (C004). Teacher text is never a learning signal. **Per-lesson counterfactual measurement ([OVL-0]) is the unbuilt load-bearing wall — no cited system closes this loop (bounded zero-hit); Rune's design is frontier, not lag.** Validate first on the 7 existing lessons (arm 4 forced correction 2).
+
+## 8. Teacher/student evidence
+Distillation transmits capability, teacher errors, AND style (C015): 2301.12726 in-domain match but generic CoT zeroes; R1 §F (FULL_PAPER) shows distillation beats RL for small models yet benchmark reasoning ≠ agentic competence (49.2% SWE-Verified vs 79.8 AIME). Hallucination inheritance: acknowledged qualitatively, never systematically quantified (bounded zero-hit). Rule: grade own behaviour contrastively; never imitate transcripts.
+
+## 9. Strategy extraction / outcome-grounded learning
+DAgger (FULL_PAPER): imitation cost grows T²ε — the fix is relabeling the agent's OWN states, including failures. Self-correction asymmetry: unanchored self-correction often HURTS; anchored (tests/execution) helps. Outcome-grounded learning works when outcomes are hard environment checks (WebRL 4.8→42.4%) but names policy drift as first-class; attribution requires MC rollouts from intermediate steps (Math-Shepherd), not final-answer reinforcement.
+
+## 10. Symbolic/rule extraction; JEV-like kernels
+Rule extraction loses edge cases; determinism ≠ correctness. Bounded kernels for recurring decisions are viable (typed schemas, state machines, classifiers, trees, constraints); reproducing general reasoning is REJECTED (C003).
+
+## 11. Classical ML
+Bounded structured tasks: XGBoost 0.87 vs GPT-4 0.43 F1 on tabular; trees beat deep learning at ~10K samples. Rune's 152 modules are SOTA for this class, not a stopgap. Labelled-data requirement is the boundary (E7).
+
+## 12. Small LMs / quantization
+Local-viable: bounded classification/routing/tool-calls, structured extraction, function-scale coding (test-filtered), retrieval-grounded factual cognition, domain-specialized reasoning. NOT viable: tabular prediction via LLM, repo-scale agentic coding (evidence vacuum — no verified open ≤14B SWE-bench result), generic multi-domain reasoning under specialization or <4-bit. Quantization: 4-bit weight-only = safe floor for reasoning; Rune's 27B IQ2_M sits BELOW every systematically tested config and is UNMEASURED — keep only if locally measured (E13, time-boxed per arm 4).
+
+## 13. Distillation / synthetic data
+Distillation NOT a T1 mechanism (data-scale mismatch: n≈944 vs 500-800K). Model collapse is a REPLACEMENT artifact — accumulating synthetic alongside real avoids it (direct validation of Rune's append-only ledger); bounded verified synthetic pipelines can exceed the teacher (phi-4).
+
+## 14. Continual learning seam; parametric vs non-parametric
+Hierarchy: procedure > retrieval > LoRA-adapter > full-FT/weight-editing (rejected). Adapters = the safe local-finetune form (learns-less-forgets-less; orthogonal accumulation); weight-editing rejected (edits fail logical propagation).
+
+## 15. Retrieval; cascades; adaptive compute
+Local retrieval is always-on (score-everything, #383 carry). Cascade/routing: REJECTED now — log (query, model, outcome) via ONE logged gateway instead (C008; arm 4 correction 3: prerequisite for everything). Speculative decoding = the only lossless adaptive-compute win (needs llama.cpp/vLLM; Ollama MTP-only).
+
+## 16. Capability registry/discovery
+Declared vs probed vs observed vs stale (TTL) vs degraded vs unknown (06-H). Same-name models change behaviour in BOTH directions (ChatGPT-drift 2307.09009). Registry + gateway = build-first (C009).
+
+## 17. Provider/local failure; no-model mode; degraded communication
+Provider/local failure → degraded/waiting/re-routed, never completed/forgotten (C002). No-model mode: modules + SQLite + retrieval + skills + status templates (C010) — **asserted but never exercised: needs NO_MODEL_SAFE module tagging + templates + scheduled chaos drill (arm 4 correction 4)**. Templates ≠ conversation; never fake open-ended understanding.
+
+## 18. Local-first policies; contention; background cognition; caching
+No policy gets ADOPT for sounding economical. Local-first-when-adequate (C002/C013); independence-vs-quality trade needs an explicit revisit trigger (arm 4 correction 5). Foreground wins (C016). Event-driven background work; timer expiry alone ≠ inference warrant. Cache ≠ authority; invalidation respects source/model/policy/correction.
+
+## 19. Skills; code as capability; recovery internalization
+SKILL = execution-verified success + retrievable intent + ≥1 analogous reuse + practice hardening + re-verification on environment change; deprecation on env change; no popularity promotion (C005). Generated code requires tests + sandboxing + ownership + provenance + regression (E6/E20). Recovery recipes: error signature → verified diagnosis → repair → recipe → deterministic first attempt next time (N; E15).
+
+## 20. Self-improvement governance; regression/rollback; inheritance/distribution
+Self-modification requires governance — a benchmark improvement is not permission. Every promoted capability: baseline, version, tests, rollback, provenance, promotion evidence (matrix L). Inheritance distinguishes inherited evidence / policy / weights / identity; child instances never silently redefine Main Rune. Distributed: capability may move between nodes; canonical authority does not (#395 carry).
+
+## 21. Security/privacy/supply chain
+Local models remain UNTRUSTED semantic components (C011); local ≠ private (logs/caches/swap); model weights/tokenizers/adapters are supply-chain surfaces; local inference must not gain filesystem authority by convenience; local workers must not share Main credentials (#402 carry).
+
+## 22. Current Rune audit + current 2024–26 evidence + implementation ecosystem
+01_inward.md (classification) + arm sources (151 ledger rows). Ecosystem (arm 4): llama.cpp delivers every quant format + grammar + speculative decoding; Ollama is the least transparent runtime on the quantization axis, has a VRAM-dependent context default (4k on Rune's 16GB card), and embedding-input truncation is an OPEN upstream defect class — independent corroboration of the inward silent-degradation finding.
+
+## 23. Adversarial pass
+118 attacks (14/20/84; 05_adversarial.md). Five sharpest: missing resource-starved ladder rung; OVL-0 unbuilt; registry+gateway prerequisite (config-default 27B = ungoverned routing today); rung 5 never exercised; independence-vs-quality trade unowned. **Five forced corrections applied to the architecture.**
+
+## 24. Synthesis matrices
+06_synthesis.md A–R (18 matrices).
+
+## 25. R0 reconciliation
+r0_reconciliation.md — Row-derived: CONFIRMED 5 · REFINED 0 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 5). R0-4 verdict CONFIRMED, widened (silent drift is structural: VRAM-dependent context default + open truncation defect).
+
+## 26. Preliminary reconciliation
+preliminary_reconciliation.md — Row-derived: CONFIRMED 4 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 6). P-2 refined: "small models can't consolidate" → "quality is unmeasurable without a quality gate — the gate is the missing piece". P-4 refined: measure locally (E13) rather than wait for an external study. P-6: the batched reconciliation under-counted the family baseline (3 vs 5).
+
+## 27. Claim ledger
+claims.json: 17 claims, all ADOPT, all RUNE_APPLICABLE, each with threat_model/experiment/falsifier/kill criterion.
+
+## 28. Experiments/falsifiers
+E1–E25 (mandate §56) designed, mapped to claims. Build-first set: logged gateway, capability registry, OVL-0 measurement, NO_MODEL_SAFE tags, degraded templates, embedding probe, skill deprecation.
+
+## 29. Remaining unknowns (bounded)
+- Hallucination-inheritance quantification: no direct study found (searched sources as of 2026-09-22).
+- Direct 27B-IQ2M-vs-14B-Q4 comparison: no such study found (searched sources as of 2026-09-22) — E13 measures locally.
+- Verified open ≤14B agentic SWE-bench result: none in the leaderboard population (as of 2026-09-22).
+- Per-lesson counterfactual improvement in any cited system: none found (as of 2026-09-22) — Rune-novel.
+- Rune-scale cascade benefit: carried unmeasured from #383.
+- RLVF: arXiv ID unverifiable — do not cite.
+- De Lange continual-learning survey: no verified arXiv ID — cite via DOI.
+PARKED: POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM OUTWARD, mandate §61).
+
+## 30. Source-depth summary (sources.md; canonical source_ledger.json)
+156 ledger rows = 150 SOURCE + 6 POINTER; 147 unique; 2 duplicate groups (Voyager A2-18/A3-13/A4-24; DeepSeek-R1 A3-1/A4-26). Depths: ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 28 · RELEVANT_SECTIONS 11 · FULL_PAPER 4 (Voyager, DAgger, DeepSeek-R1, +1) · INHERITED_VERIFIED 8 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3. 17 mis-paired arXiv IDs caught across arms (including prompt-supplied IDs). AC-specific honest depth labels documented (INHERITED_VERIFIED, COMMUNITY_EVIDENCE_RELIABILITY_LABELED). Do-not-cite register maintained.
+
+## 31. Load-bearing evidence
+load_bearing_evidence.md: C001–C017 mapped; DEEP_EXTERNAL discipline audited; EXTERNAL-finding typing where the claim is the external result; no shallow anchor labeled DEEP_EXTERNAL; no claim downgraded.
+
+## 32. Process truth
+CONTINUOUS_EXECUTION = PASS (zero user continuations in the #404 window); MAX_CONCURRENT_SUBAGENTS = 1 held (arms strictly serial: general-21→22→23→24, all first-pass SUCCESS); source-access: arXiv export-API 429s → abs/HTML/OpenAlex fallbacks; 17 ID mis-pairings caught. Canonical Memory write: NOT performed (safety hold) — CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0.
+
+## 33. Harness-baseline status
+R1_HARNESS_BASELINE_VERSION = 1.0 rev.2 inherited: rich canonical ledger (source_ledger.json; SOURCE/POINTER/SYNTHESIS row kinds; real origin resolution; named normalizations; origin→canonical fidelity; canonical→projection fidelity; mechanically derived accounting). FREEZE_ENFORCEMENT = PARTIAL (audit freshness + post-freeze protocol; NO executable hash-manifest — stated honestly). Memory closeout safety hold active.
+
+## 34. Artifact pointers
+00_issue_scope.md · 01_inward.md · 02_outward/arm1_foundations.md · arm2_agent_architecture.md · arm3_internalization.md · arm4_systems_adversarial.md · 03_applicability.md (60) · 04_innovation.md (20) · 05_adversarial.md (118) · 06_synthesis.md (18 matrices) · 07_qualification.md (37) · claims.json (17) · load_bearing_evidence.md · sources.md + source_ledger.json · r0_reconciliation.md · preliminary_reconciliation.md · evidence_saturation.md · AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md · mutation_audit.md.
+
+## 35. Mutation audit
+Authoritative record: mutation_audit.md (written LAST). Post-freeze protocol: allowed/forbidden classes + automatic FREEZE_STALE. FREEZE_ENFORCEMENT = PARTIAL (no hash-manifest claimed).

research/memory-atlas-r1/AC-local-offline-intelligence/claims.json

@@ -0,0 +1,291 @@
+[
+ {
+  "id": "AC-R1-C001",
+  "claim": "MODEL-AS-RESOURCE: models are replaceable cognitive providers; Rune's mind = canonical Memory + state + deterministic modules + skills + policies, never any model",
+  "evidence_for": "inward F state model-independent; CoALA RS (decision procedures = designer code); #399 carry",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "11 swappable models; state survives loss",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "state ownership explicit; model selection = resource choice",
+  "experiment": "E4",
+  "falsifier": "capability unrecoverable in any alternative form",
+  "kill_criterion": "E4 identity/task state changes on model swap",
+  "threat_model": "model lock-in; identity drift"
+ },
+ {
+  "id": "AC-R1-C002",
+  "claim": "Six-rung degradation ladder FULL→DEGRADED never FULL→DEAD; structured/declared status, never generated",
+  "evidence_for": "Apple Intelligence RS (request-tiered degradation, attestation-gated hard refusal); inward I (accidental no-model mode exists)",
+  "evidence_against": "—",
+  "limitations": "rung order tuned to Rune hardware",
+  "inward": "no templates; silent embedding degradation",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "ladder + status format + chaos drill",
+  "experiment": "E1,E2,E3,E21",
+  "falsifier": "state/control disappears in total-model-loss",
+  "kill_criterion": "E3",
+  "threat_model": "silent degradation"
+ },
+ {
+  "id": "AC-R1-C003",
+  "claim": "Capability compilation for BOUNDED tasks only (classification/routing/extraction/validation) with regression fixtures + applicability + rollback; NOT open-ended cognition",
+  "evidence_for": "FrugalGPT RS (cascade mechanics + scorer-label requirement); classical-ML evidence (XGBoost 0.87 vs GPT-4 0.43 tabular); 152 modules already serve this",
+  "evidence_against": "compilation of reasoning is unsupported",
+  "limitations": "boundary at bounded tasks",
+  "inward": "152 deterministic modules",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "compiled mechanisms = versioned capabilities",
+  "experiment": "E6,E7",
+  "falsifier": "compiled procedure loses required cases",
+  "kill_criterion": "E6",
+  "threat_model": "silent case loss"
+ },
+ {
+  "id": "AC-R1-C004",
+  "claim": "Outcome-grounded assimilation: contribution → provenance → independent verified outcome → applicability → baseline compare → candidate → analogous reuse → MEASURED improvement → promotion; teacher text ≠ learning signal; per-lesson counterfactual measurement required (literature open-loop — Rune-novel)",
+  "evidence_for": "WebRL (outcome-grounded RL works w/ hard checks; names policy drift); DAgger FULL_PAPER (T²ε law; relabel own states); self-correction asymmetry",
+  "evidence_against": "no cited system closes per-lesson counterfactual loop",
+  "limitations": "[OVL-0] must be built and validated",
+  "inward": "loop designed, never built",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "assimilation pipeline + measurement",
+  "experiment": "E8,E15,E25",
+  "falsifier": "teacher text becomes lesson without verified outcome",
+  "kill_criterion": "E8",
+  "threat_model": "teacher-error propagation; spurious credit"
+ },
+ {
+  "id": "AC-R1-C005",
+  "claim": "SKILL promotion criteria: execution-verified success + retrievable intent + ≥1 analogous reuse + practice hardening + re-verification on environment change; deprecation on env change; no popularity promotion",
+  "evidence_for": "Voyager FULL_PAPER (external-verifier gate; no deprecation = gap); Memp RS (deprecation regimen)",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "library governance already encodes ≥2-success gate",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "promotion gate + deprecation trigger",
+  "experiment": "E10,E11",
+  "falsifier": "one-shot promotion",
+  "kill_criterion": "E10",
+  "threat_model": "stale skills; environment drift"
+ },
+ {
+  "id": "AC-R1-C006",
+  "claim": "Learning-form hierarchy: procedure > retrieval > LoRA-adapter > full-FT/weight-editing (rejected); adapters = safe local-finetune form",
+  "evidence_for": "LoRA-learns-less-forgets-less RS; intruder-dimensions; RippleEdits (edits fail logical propagation)",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "procedural layer dominant",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "learning-form selection policy",
+  "experiment": "E20",
+  "falsifier": "adapter beats procedure on reliability+rollback",
+  "kill_criterion": "E20",
+  "threat_model": "forgetting; untraceable weight changes"
+ },
+ {
+  "id": "AC-R1-C007",
+  "claim": "Escalation: pass@1-derived difficulty bins + verifier availability + deterministic gate-failure counters + sample disagreement; NOT raw confidence/self-critique; hardest-bin → refuse-and-report",
+  "evidence_for": "Snell RS (difficulty bins, >4× efficiency, hardest bin yields nothing); confidence-calibration evidence",
+  "evidence_against": "raw logprobs/verbalized confidence as triggers",
+  "limitations": "bins need Rune outcome history",
+  "inward": "no routing policy",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "escalation policy",
+  "experiment": "E14",
+  "falsifier": "raw confidence outperforms bins",
+  "kill_criterion": "E14",
+  "threat_model": "over-escalation; wasted compute"
+ },
+ {
+  "id": "AC-R1-C008",
+  "claim": "No cascade/routing policy now — log (query, model, outcome) via ONE logged gateway; speculative decoding = the lossless adaptive-compute win (requires llama.cpp/vLLM; Ollama MTP-only)",
+  "evidence_for": "FrugalGPT RS (2023 pricing artifact; scorer needs in-distribution labels); #383 carry; llama.cpp speculative docs",
+  "evidence_against": "—",
+  "limitations": "gateway must log first",
+  "inward": "ad-hoc frontier use bypasses policy",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "gateway + logging",
+  "experiment": "E5",
+  "falsifier": "cascade wins at n≈924 without labels",
+  "kill_criterion": "E5",
+  "threat_model": "unmeasured routing; cost blindness"
+ },
+ {
+  "id": "AC-R1-C009",
+  "claim": "Capability registry: canonical slug vs drifting aliases; declared vs probed vs observed vs stale (TTL); same-name models change behavior both directions",
+  "evidence_for": "OpenRouter Models API (canonical_slug/parameters/expiration); MCP (ttlMs, version-mismatch errors); ChatGPT-drift 2307.09009",
+  "evidence_against": "—",
+  "limitations": "docs-depth anchors → design invariant",
+  "inward": "declared-only truth; staleness undetectable",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "registry schema + probe policy",
+  "experiment": "E17",
+  "falsifier": "declaration overrides observed truth",
+  "kill_criterion": "E17",
+  "threat_model": "stale capability; silent model change"
+ },
+ {
+  "id": "AC-R1-C010",
+  "claim": "No-model mode: deterministic modules + SQLite + retrieval + skills keep working; structured/declared status (templates) never generated; silent embedding degradation fixed architecturally (probe-and-report + retrieval-fallback rung + per-write model+digest)",
+  "evidence_for": "#403 carry (embedding model+digest); Ollama docs + open issue tracker (silent truncation)",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "no-model works accidentally; embedding fails silently",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "templates + embedding probe + rung reporting",
+  "experiment": "E21",
+  "falsifier": "fabricated fluent status or silent state loss",
+  "kill_criterion": "E21",
+  "threat_model": "silent degradation; false fluency"
+ },
+ {
+  "id": "AC-R1-C011",
+  "claim": "Local models remain untrusted semantic components; supply-chain risk real; local ≠ private",
+  "evidence_for": "#402 carry (same-uid = full authority; key-custody honesty); supply-chain arm-4 evidence",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "Ollama runs with full user authority",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #402)",
+  "architecture_impact": "local inference sandboxed like any untrusted component",
+  "experiment": "E24",
+  "falsifier": "untrusted local model gains authority",
+  "kill_criterion": "E24",
+  "threat_model": "model trojans; adapter compromise; local leakage"
+ },
+ {
+  "id": "AC-R1-C012",
+  "claim": "GROWTH DELTA: measured analogous-task improvement after verified internalization; installing a model or storing text ≠ learning",
+  "evidence_for": "#399/#400 carry; WebRL outcome evidence",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "0 measured deltas",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #406)",
+  "architecture_impact": "measurement requirement",
+  "experiment": "E25",
+  "falsifier": "no measured improvement after internalization",
+  "kill_criterion": "E25",
+  "threat_model": "unmeasured self-improvement claims"
+ },
+ {
+  "id": "AC-R1-C013",
+  "claim": "27B IQ2_M kept ONLY if locally measured per task; 4-bit weight-only = evidence-backed floor for reasoning; quantization loss is task/difficulty/size/calibration-sensitive",
+  "evidence_for": "2504.04823 RS (harder tasks degrade up to 4× more); GGUF k-quant/imatrix docs; calibration-sensitivity evidence",
+  "evidence_against": "no direct 27B-IQ2M-vs-Q4 study (bounded zero-hit)",
+  "limitations": "extrapolations labeled",
+  "inward": "27B IQ2_M is the config default, unmeasured",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #405)",
+  "architecture_impact": "time-boxed local measurement requirement",
+  "experiment": "E13",
+  "falsifier": "27B IQ2_M matches 14B-Q4 on Rune tasks",
+  "kill_criterion": "E13",
+  "threat_model": "unmeasured precision choice"
+ },
+ {
+  "id": "AC-R1-C014",
+  "claim": "Multi-teacher: models = candidate generators, execution = judge; consensus adds little (correlation rises with capability)",
+  "evidence_for": "2506.07962 (60% agreement when both err); self-vote non-monotonic 2403.02419",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "11 providers ad-hoc",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "no consensus-as-verification",
+  "experiment": "E9",
+  "falsifier": "majority vote upgrades evidence authority",
+  "kill_criterion": "E9",
+  "threat_model": "correlated teachers; false corroboration"
+ },
+ {
+  "id": "AC-R1-C015",
+  "claim": "Distillation/adapter training NOT a T1 mechanism for Rune (bounded-task distillate≈teacher needs 500-800K-scale data + verifiable output space; Rune corpus n≈944)",
+  "evidence_for": "2301.12726 RS (in-domain match, generic CoT zeroes); R1 FULL_PAPER §F (distillation beats RL for small models; benchmark ≠ agentic)",
+  "evidence_against": "—",
+  "limitations": "revisit at ≥100s verified labels for a bounded class",
+  "inward": "no fine-tune infrastructure",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "no weight training in T1",
+  "experiment": "E12",
+  "falsifier": "bounded distillation succeeds at n≈944",
+  "kill_criterion": "E12",
+  "threat_model": "premature training; data-scale mismatch"
+ },
+ {
+  "id": "AC-R1-C016",
+  "claim": "Resource contention: foreground wins; background local inference yields to active user work (scheduling principles; topology → #405)",
+  "evidence_for": "#400/#394 carry; arm-2 ladder",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "16GB VRAM shared with user apps",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #405)",
+  "architecture_impact": "foreground-preemption policy",
+  "experiment": "E18",
+  "falsifier": "background inference degrades active user work",
+  "kill_criterion": "E18",
+  "threat_model": "resource contention"
+ },
+ {
+  "id": "AC-R1-C017",
+  "claim": "POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM-inspired OUTWARD upgrade) recorded, NOT applied — #404–#406 comparability preserved",
+  "evidence_for": "mandate §61 directive",
+  "evidence_against": "—",
+  "limitations": "process decision",
+  "inward": "—",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "none (process record)",
+  "experiment": "—",
+  "falsifier": "—",
+  "kill_criterion": "—",
+  "threat_model": "methodology drift"
+ }
+]

research/memory-atlas-r1/AC-local-offline-intelligence/evidence_saturation.md

@@ -0,0 +1,21 @@
+# #404 AC — Evidence Saturation + Load-Bearing Depth (2026-09-22)
+
+## Branch record
+
+Arms 1–4 serial (general-21 → general-22 → general-23 → general-24), all first-pass SUCCESS. Source ledger: **151 rows = 145 SOURCE + 6 POINTER; 142 unique; 2 duplicate groups** (Voyager across 3 arms; DeepSeek-R1 across 2). Depths (derived): ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 23 · RELEVANT_SECTIONS 11 · FULL_PAPER 4 (Voyager, DAgger, DeepSeek-R1, +1) · INHERITED_VERIFIED 8 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3. 17 mis-paired arXiv IDs caught across arms (including prompt-supplied IDs — the discipline pays).
+
+## Late-search checks (typed outcomes)
+
+- "hallucination inheritance quantified across distillation" → this R1 search found no direct quantified study in the searched sources as of 2026-09-22 (acknowledged qualitatively in teacher/student literature; the term itself is a bounded zero-hit).
+- "direct 27B-IQ2M-vs-14B-Q4 task comparison" → this R1 search found no direct study in the searched sources as of 2026-09-22 — extrapolations from size-scaling laws must be labeled (arm 1).
+- "verified agentic SWE-bench result from an open ≤14B model" → this R1 search found no direct result in the leaderboard population in the searched sources as of 2026-09-22 (the 45% 14B is closed-weight) — the evidence vacuum is itself the finding.
+- "per-lesson counterfactual improvement measurement in any cited system" → this R1 search found no direct system in the searched sources as of 2026-09-22 — Rune's [OVL-0] design is frontier, not lag.
+- "Rune-scale (n≈944) cascade benefit" → this R1 search found no direct measurement in the searched sources as of 2026-09-22 (carried unmeasured from #383; arm 1 confirms no transferable evidence at this scale).
+- "RLVF" (verifier-feedback RL) → this R1 search could not verify the arXiv ID in the searched sources as of 2026-09-22 — do not cite.
+- "De Lange continual-learning survey" → this R1 search could not verify an arXiv ID in the searched sources as of 2026-09-22 — cite via DOI only.
+
+## Verdict
+
+**SEARCH_SATURATION = REACHED** — late searches returned typed gaps and do-not-cites, not new architecture-changing mechanisms; 7 typed gaps recorded as bounded-search findings.
+
+**LOAD_BEARING_DEPTH = PASS** — every ADOPT claim (C001–C017) maps through load_bearing_evidence.md to DEEP_EXTERNAL (RELEVANT_SECTIONS/FULL_PAPER anchors: CoALA, Apple 2407.21075, Snell 2408.03314, FrugalGPT 2305.05176, quantization-sensitivity 2504.04823, Voyager, DAgger, LoRA-forgets-less, R1 §F, Memp, 2301.12726), RUNE_DIRECT (inward facts: model-independent state, silent embedding degradation, empty skill library, unmeasured 27B IQ2_M, ungoverned routing), or DESIGN_INVARIANT; EXTERNAL-finding typing used where the claim is the external result itself (WebRL outcome learning; consensus-correlation). No HYPOTHESIS-only ADOPT. Type ≠ depth held; documentation never FULL_PAPER.

research/memory-atlas-r1/AC-local-offline-intelligence/load_bearing_evidence.md

@@ -0,0 +1,25 @@
+# #404 AC — Load-Bearing Evidence Map (2026-09-22)
+
+| Claim | Architecture rule | Rune inward evidence | External anchor(s) | Support type | Residual assumptions | Falsifier |
+|---|---|---|---|---|---|---|
+| AC-R1-C001 | MODEL-AS-RESOURCE: models are replaceable cognitive providers; Rune's mind = canonical Memory + state + deterministic modules + skills + policies | 01_inward F: state genuinely model-independent (SQLite Memory, task state, 152 modules survive any model loss); 11 providers/models swappable | CoALA 2309.02427 (A2-1, RELEVANT_SECTIONS: decision procedures = designer code in procedural memory); #399 carry (model ≠ identity) | RUNE_DIRECT + DEEP_EXTERNAL | — | A capability that CANNOT be re-served by any alternative form after model loss |
+| AC-R1-C002 | Six-rung degradation ladder FULL→DEGRADED never FULL→DEAD; status structured/declared, never generated | 01_inward I: no-model mode exists by accident (modules+SQLite work); NO templates; silent embedding degradation | Apple Intelligence 2407.21075 (A2-15, RELEVANT_SECTIONS: request-tiered degradation, attestation-gated dispatch, hard refusal); #394 carry | DEEP_EXTERNAL + RUNE_DIRECT | rung order tuned to Rune's hardware | E3: state/control disappears in total-model-loss drill |
+| AC-R1-C003 | Capability compilation: repeated verified reasoning may compile to cheaper forms ONLY for bounded classification/routing/extraction; compiled mechanisms need regression fixtures + applicability conditions + rollback; NOT open-ended cognition | 152 deterministic modules already serve this role (accidentally); family per-operation matrix R0-1 | FrugalGPT 2305.05176 (A1, RELEVANT_SECTIONS: cascade mechanics + scorer-label requirement); classical-ML evidence (XGBoost 0.87 vs GPT-4 0.43 tabular, A1 ABSTRACT_ONLY + external finding) | DEEP_EXTERNAL + RUNE_DIRECT | compilation boundary correctly drawn at bounded tasks | E6: compiled procedure silently loses required cases |
+| AC-R1-C004 | Outcome-grounded assimilation: contribution → normalize+provenance → independent verified outcome → applicability → baseline compare → candidate → analogous reuse → MEASURED improvement → promotion; teacher text ≠ learning signal; per-lesson counterfactual measurement required (novel — literature open-loop) | skill library governed-but-empty; 7 lessons; growth-delta machinery designed, never demonstrated; [OVL-0] loop unbuilt | WebRL (A3, ABSTRACT_ONLY — external finding: outcome-grounded RL works with hard environment checks, 4.8→42.4%, names policy drift); DAgger 1011.0686 (A3, FULL_PAPER: T²ε imitation law — relabel own states); self-correction asymmetry 2310.01798 (A3, ABSTRACT_ONLY) | DESIGN_INVARIANT + RUNE_DIRECT + EXTERNAL finding | per-lesson counterfactual measurement is Rune-novel — must be built and validated (E25) | E8/E25: teacher text becomes lesson without verified outcome; no measured improvement |
+| AC-R1-C005 | SKILL promotion: execution-verified success + retrievable intent + ≥1 successful analogous reuse + practice hardening + re-verification on environment change; deprecation on environment change; no popularity promotion | skill library governance ALREADY encodes ≥2-success gate (inward E) — design validated by evidence | Voyager 2305.16291 (A3, FULL_PAPER: external-verifier-gated promotion, no deprecation = documented gap); Memp 2508.06433 (A3, RELEVANT_SECTIONS: only cited deprecation regimen) | DEEP_EXTERNAL + RUNE_DIRECT | — | E10/E11: one-shot promotion; stale skill survives environment change |
+| AC-R1-C006 | Learning-form hierarchy: procedure > retrieval > LoRA-adapter > full-FT/weight-editing (rejected); adapters = the safe local-finetune form; weight-editing rejected | 152 modules = procedural layer already dominant | LoRA-learns-less-forgets-less 2405.09673 (A3, RELEVANT_SECTIONS: forgetting asymmetry); intruder-dimensions 2410.21228 (A3, ABSTRACT_ONLY); RippleEdits 2307.12976 (A3, ABSTRACT_ONLY: edits fail logical propagation) | DEEP_EXTERNAL + DESIGN_INVARIANT | — | E20: adapter beats procedure on reliability+rollback for the same capability |
+| AC-R1-C007 | Escalation: pass@1-derived difficulty bins + verifier availability + deterministic gate-failure counters + sample disagreement; NOT raw confidence/self-critique; hardest-bin → refuse-and-report | no routing policy exists (greenfield); #400 carry (confidence ≠ truth) | Snell 2408.03314 (A2-28, RELEVANT_SECTIONS: difficulty bins, >4× efficiency, hardest-bin yields nothing); P(True)/verbalized-confidence calibration evidence (A2, ABSTRACT_ONLY) | DEEP_EXTERNAL + DESIGN_INVARIANT | bins need Rune's own outcome history (bootstrap from logged gateway) | E14: raw confidence outperforms difficulty bins |
+| AC-R1-C008 | NO cascade/routing policy now; log (query, model, outcome) via a single logged gateway; speculative decoding = the lossless adaptive-compute win (needs llama.cpp/vLLM serving — Ollama MTP-only) | ad-hoc frontier use bypasses any policy (inward BYPASS); config-default 27B = ungoverned routing today | FrugalGPT 2305.05176 (A1, RELEVANT_SECTIONS: 2023 pricing artifact, scorer needs in-distribution labels); llama.cpp speculative docs (A4, DOCUMENTATION_AUDITED); #383 carry (cascade = scale artifact) | DEEP_EXTERNAL + RUNE_DIRECT | gateway must log before any routing decision | E5: cascade wins at n≈924 without labels |
+| AC-R1-C009 | Capability registry: canonical slug vs drifting aliases; declared vs probed vs observed vs stale (TTL); same-name models change behavior both directions | 11 providers, declared-only truth, staleness undetectable (inward B) | OpenRouter Models API (A2-22, DOCUMENTATION_AUDITED: canonical_slug/supported_parameters/expiration_date); MCP (A2-21, DOCUMENTATION_AUDITED: ttlMs, version-mismatch errors); ChatGPT-drift 2307.09009 (A2-19, ABSTRACT_ONLY: same-name behavior drifts both directions 84%→51%) | DESIGN_INVARIANT + RUNE_DIRECT (anchors are documentation-depth — deliberately NOT DEEP_EXTERNAL) | — | E17: declaration overrides observed runtime truth |
+| AC-R1-C010 | No-model mode: deterministic modules + SQLite + retrieval + skills keep working; structured/declared status communication (templates), never generated prose; silent embedding degradation fixed architecturally (probe-and-report + retrieval-fallback rung + per-write model+digest) | no-model mode works by accident (inward I); embedding fails SILENTLY (inward G); Ollama silent-truncation is an OPEN upstream defect (A4 community evidence) | #403 carry (embedding model+digest per write); Ollama docs + issue tracker (A4, DOCUMENTATION_AUDITED + COMMUNITY_EVIDENCE_RELIABILITY_LABELED) | RUNE_DIRECT + DESIGN_INVARIANT | — | E21/E25: fabricated fluent status or silent state loss in no-model drill |
+| AC-R1-C011 | Security: local models remain untrusted semantic components; model supply-chain risk real; local ≠ private (logs/caches/swap/process memory) | local = same-uid process (carried #402: no enforcement layer); Ollama models run with full user authority | #402 sealed carry (key-custody honesty; same-uid malware); supply-chain arm-4 evidence | DESIGN_INVARIANT + RUNE_DIRECT | — | E24: untrusted local model gains authority |
+| AC-R1-C012 | GROWTH DELTA: measured analogous-task improvement after verified internalization; installing a model or storing text ≠ learning | growth delta machinery DESIGNED never DEMONSTRATED (inward E); 0 measured deltas | #399/#400 carry (Growth Delta doctrine); WebRL outcome evidence (A3, external finding) | DESIGN_INVARIANT + RUNE_DIRECT | — | E25: no measured improvement after internalization |
+| AC-R1-C013 | 27B IQ2_M kept ONLY if locally measured per task; 4-bit weight-only = evidence-backed floor for reasoning; quantization loss is task/difficulty/size/calibration-sensitive | 27B IQ2_M is the config default (inward A) — unmeasured on Rune tasks | Quantization task-sensitivity 2504.04823 (A1, RELEVANT_SECTIONS: harder tasks degrade up to 4× more); GGUF k-quant + imatrix docs (A1, DOCUMENTATION_AUDITED); calibration-sensitivity 2608.01078 (A1, ABSTRACT_ONLY) | DEEP_EXTERNAL + RUNE_DIRECT | no direct 27B-IQ2M-vs-Q4 study exists (bounded zero-hit — extrapolations labeled) | E13: 27B IQ2_M matches 14B-Q4 on Rune-relevant tasks (then keep it) |
+| AC-R1-C014 | Multi-teacher: models = candidate generators, execution = judge; consensus adds little (correlation rises with capability) | 11 providers available but used ad-hoc; no multi-teacher learning design | 2506.07962 (A3, ABSTRACT_ONLY — external finding: ~60% agreement when both err; correlation rises with capability); self-vote non-monotonic 2403.02419 (A3, ABSTRACT_ONLY) | DESIGN_INVARIANT + EXTERNAL finding | — | E9: majority vote upgrades evidence authority |
+| AC-R1-C015 | Distillation/adapter training NOT a T1 mechanism for Rune (bounded-task distillate≈teacher needs 500-800K-scale data + verifiable output space; Rune's corpus is n≈944) | no fine-tuning infrastructure; Ollama least transparent runtime on quant axis | 2301.12726 (A1, RELEVANT_SECTIONS: specializing small LMs — in-domain match, generic CoT zeroes); R1 2501.12948 (A3, FULL_PAPER §F: distillation beats RL for small models but benchmark ≠ agentic competence) | DEEP_EXTERNAL + RUNE_DIRECT | revisit if a bounded task class accumulates ≥100s verified labels | E12: bounded distillation succeeds at Rune's data scale |
+| AC-R1-C016 | Resource contention: foreground wins; background local inference yields to active user work (cognitive scheduling principles; topology → #405) | 16GB VRAM shared with user gaming/coding (inward H); idle-GPU ≠ license | #400/#394 carry; arm-2 degradation ladder | DESIGN_INVARIANT | — | E18: background inference degrades active user work |
+| AC-R1-C017 | POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM-inspired OUTWARD upgrade) — recorded, NOT applied; comparability of #404–#406 with existing R1 programme preserved | mandate §61 directive | mandate directive | DESIGN_INVARIANT (process decision) | — | — |
+
+## DEEP_EXTERNAL discipline
+
+DEEP_EXTERNAL rows cite anchors at RELEVANT_SECTIONS/FULL_PAPER depth only (CoALA A2-1; Apple 2407.21075 A2-15; Snell 2408.03314 A2-32; FrugalGPT 2305.05176 A1; quantization-sensitivity 2504.04823 A1; Voyager A3; DAgger A3; LoRA-forgets-less A3; R1 §F A3; Memp A3; 2301.12726 A1). ABSTRACT_ONLY / DOCUMENTATION_AUDITED / METADATA_VERIFIED / COMMUNITY-labeled anchors are NEVER DEEP_EXTERNAL — they appear as DESIGN_INVARIANT, RUNE_DIRECT, or explicitly typed EXTERNAL-finding support (the claim is only the external result). Full C001–C017 support↔source↔depth↔proposition audit performed; no shallow anchor labeled DEEP_EXTERNAL; no claim downgraded — no support proved shallower than recorded.

research/memory-atlas-r1/AC-local-offline-intelligence/mutation_audit.md

@@ -0,0 +1,43 @@
+# #404 AC — CONTENT-FREEZE MUTATION AUDIT (2026-09-22)
+
+STATUS: CONTENT-FREEZE AUDIT — final-state declaration; this file is the ACTUAL LAST write. After this write, NO file is modified; only read-only gates, git transport, and Gitea receipts follow.
+
+## Run provenance
+
+Full new-domain R1_FULL run. ONE controller; arms strictly serial (general-21 → general-22 → general-23 → general-24), all first-pass SUCCESS; MAX_CONCURRENT_SUBAGENTS = 1 held. **CONTINUOUS_EXECUTION = PASS** — zero user continuations. Source-access: arXiv export-API 429s → abs/HTML/OpenAlex fallbacks; **17 mis-paired arXiv IDs caught across arms — including prompt-supplied IDs** (the discipline pays). Research-only boundary held: no production Memory/model/runtime/TUI changes; inward read-only.
+
+## Mutation categories (actual, at freeze)
+
+PRODUCTION_CODE_MUTATION = NONE · PRODUCTION_SCHEMA_MUTATION = NONE · PRODUCTION_RUNTIME_BEHAVIOR_MUTATION = NONE.
+RESEARCH_TOOLING_MUTATION = YES (research-only) — scripts/research_gate_check.py: `_LBM_DOMAINS` and `_EXACTREF_DOMAINS` extended to include "AC-" (all harness-baseline checks now cover this domain).
+GITEA_MUTATION = pre-freeze: #404 reopened + start comment 6241; post-freeze: receipts.
+RESEARCH_ARTIFACT_MUTATION = YES — full domain body: 00_issue_scope.md · 01_inward.md · 02_outward/arm1_foundations.md (36 sources) · arm2_agent_architecture.md (39) · arm3_internalization.md (42) · arm4_systems_adversarial.md (Part A 40 + Part B 118 attacks) · 03_applicability.md (60 rows) · 04_innovation.md (20) · 05_adversarial.md (118 rows) · 06_synthesis.md (18 matrices) · 07_qualification.md (37) · claims.json (17) · load_bearing_evidence.md (C001–C017) · sources.md + source_ledger.json (canonical, 156 rows) · r0_reconciliation.md · preliminary_reconciliation.md · evidence_saturation.md · r0_baseline_extract.md · AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md (byte-preserved) · AC_LOCAL_OFFLINE_INTELLIGENCE_R1_MASTER.md (rewritten) · this audit.
+REGISTRY_MUTATION = YES (pre-freeze) — domain_registry.md row 404 rewritten from batched-era text ("single-writer stance confirmed; staged earn-in" NOT inherited) to this run's row truth.
+RESEARCH_RESULT_AFFECTED = NO — batched master byte-identical (sha b29810f1…); family Section AC untouched; prior domains untouched.
+
+## Harness-baseline compliance (R1_HARNESS_BASELINE_VERSION = 1.0 rev.2)
+
+- **Rich canonical ledger:** source_ledger.json is canonical; sources.md is a generated projection. Contract fields present (source_id, row_kind, stable_identifier, title, authors, year, venue, version, source_type, modality, task, dataset, method, key_claims, negative_results, limitations, rune_relevance, read_depth, origin_ref, origin_row_hash, normalization_id, raw_origin_cells). Named normalizations: ac_arm_pipe_table_v1 · ac_arm_block_v1 · ac_arm_doc_block_v1 · depth_label_from_arm_cell_v1 · row_kind_classify_v1.
+- **Row-kind accounting (mechanically derived): LEDGER_ROWS = 156 · EXTERNAL_SOURCE_ROWS = 150 · UNIQUE_EXTERNAL_SOURCES = 147 · POINTER_ROWS = 6 · SYNTHESIS_ROWS = 0 · DUPLICATE_SOURCE_GROUPS = 2** (Voyager 2305.16291 → A2-18/A3-13/A4-24; DeepSeek-R1 2501.12948 → A3-1/A4-26). Six POINTER rows = cross-reference/carry-over rows honestly labeled (A1-26 Phi-4 cross-ref; A1-35/36 #383/#403 carry-overs; A4-22 skipped-per-mandate; A4-33/36 absorbed-into-arm-anchors). Depth counts: ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 28 · RELEVANT_SECTIONS 11 · FULL_PAPER 4 (Voyager, DAgger, DeepSeek-R1, +1) · INHERITED_VERIFIED 8 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3 (+6 pointer rows NOT_RECORDED by design). AC-specific honest labels documented (INHERITED_VERIFIED; COMMUNITY_EVIDENCE_RELIABILITY_LABELED).
+- **Origin→canonical→projection integrity:** every row carries origin_ref (arm file + row/block anchor) + origin_row_hash; the gate resolves and checks fidelity.
+- **Freeze enforcement: PARTIAL (stated honestly).** Implemented: mtime-based mutation-audit freshness + the post-freeze read-only protocol recorded here. NOT implemented: deterministic hash-manifest, physical write prevention. No such mechanism is claimed.
+- **Memory safety hold:** CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0 — CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX active for #404–#406; master + registry + Gitea are the durable summary authorities.
+
+## Adversarial pass (arm 4 Part B, independent fresh context)
+
+118 attacks (100 mandated + 18 Rune-specific): **SUCCEEDS 14 · PARTIAL 20 · FAILS 84** (row-derived; 05_adversarial.md). Zero SUCCEEDS against the epistemic core; all 14 are Rune-specific production gaps. Five forced corrections applied to the architecture: (1) resource-starved ladder rung (telemetry-defined degradation); (2) per-lesson counterfactual measurement is the unbuilt load-bearing wall — validate first on the 7 existing lessons; (3) capability registry + one logged gateway are prerequisites (config-default 27B = ungoverned routing today); (4) rung 5 needs NO_MODEL_SAFE tagging + templates + a scheduled chaos drill; (5) independence-vs-quality trade needs an explicit revisit trigger and a time-boxed 27B-vs-14B-Q4 measurement.
+
+## Row truth at freeze (machine-derived)
+
+applicability 60 = ADOPT 33 · ADAPT 0 · EXPERIMENT 2 · FUTURE 1 · REJECT 23 · PARK 1 · qualification 37 = ADOPT 35 · EXPERIMENT 1 · REJECT 1 · R0 5 = CONFIRMED 5 · preliminary 6 = CONFIRMED 4 · REFINED 2 · claims 17 = ADOPT 17 (all RUNE_APPLICABLE) · innovation 20 = ADOPT 14 · EXPERIMENT 4 · FUTURE 1 · PARK 1 · sources 156 = 150 external / 147 unique / 6 pointer / 2 duplicate groups · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS · 7 bounded-search gaps.
+
+## Preserved
+Batched preliminary byte-identical (sha b29810f1…) · family Section AC untouched · prior sealed domains untouched · harness baseline inherited (no new source-ledger format invented; AC-specific depth labels are additive and documented) · #402 security carry · #403 multimodal carry · POST_R1_PIPELINE_UPGRADE_PENDING recorded (mandate §61, NOT applied — comparability preserved).
+
+## Post-freeze protocol (governing)
+
+After this audit: ALLOWED = read-only gate execution (AC + AB/AA/Z/Y/X/W R1_FULL regression), git status/diff/hash, `git show`, the ONE seal commit, push origin + gitea, mirror verification, Gitea receipt posting, read-only file opening, final natural-language response. FORBIDDEN = negative controls, temporary tracked-file edits, artifact/registry/tooling edits, session-note appends, memory_store.py, memory_consolidation.py, any canonical/derived state write. If ANY forbidden post-freeze write occurs: **FREEZE_STALE = TRUE automatically** — reseal only via a genuinely NEW final audit written LAST. Nothing durable follows the seal.
+
+## Freeze declaration
+
+All mutations (artifacts + canonical ledger + projection + master + registry + gate domain-scope) are complete BEFORE this audit. **This audit is the ACTUAL LAST write.** Sequence: FINAL_CONTENT_GATE (read-only) → ONE seal commit → push/mirror/verify → Gitea #404 + #375 receipts → STOP. STOP MEANS STOP.

research/memory-atlas-r1/AC-local-offline-intelligence/preliminary_reconciliation.md

@@ -0,0 +1,12 @@
+# #404 AC — Batched-Preliminary Reconciliation (batched master b29810f1…; 2026-09-22)
+
+| P | Batched conclusion | Verdict | Evidence |
+|---|---|---|---|
+| P-1 | ADOPT: local embedding (nomic via Ollama — MTEB parity with Ada-002/emb-3-small) | CONFIRMED | Arm 1/2 + family R0-2; strengthened: qwen3-embedding:0.6b is the better current option and is installed-but-unwired; version-stamping is a precondition (C010), not an option. |
+| P-2 | REJECT: local LLM consolidation (summarize/merge/rewrite) with small models — silent quality loss, unmeasurable without ground truth | CONFIRMED | Arm 1's bounded-task verdict + arm 2's verification-availability finding + arm 4's F-specific attacks all support the rejection; the rationale is refined from "small models can't" to "**quality is unmeasurable without a quality gate** — the gate is the missing piece, not the model size." Recorded as EXPERIMENT-eligible once a measured gate exists (R0-1 refinement). |
+| P-3 | EXPERIMENT: small local models for MECHANICAL ops only (dedup clustering, tag/title extraction, tool-call classification) | CONFIRMED | Arm 2: Octopus v2 (2B on-device beats GPT-4 on function calling with restructured action representation, 95% less context); arm 1's bounded-task class evidence. Mechanical ops are exactly the evidenced-viable class. |
+| P-4 | FUTURE: quantized consolidation, revisit when an ≤8B A/B study on memory-consolidation quality exists | REFINED | The evidence situation is clearer than "no study exists": quantization loss is task-sensitive (2504.04823 RS) and Rune's own 27B IQ2_M is UNMEASURED (bounded zero-hit on a direct 27B-IQ2M-vs-Q4 comparison). Refined to: **measure locally per task (E13) rather than wait for an external study** — the local harness is the missing instrument. |
+| P-5 | Evidence grades: QLoRA NF4 preserves task performance; quantization degradation predictable; layer-pruning headroom | CONFIRMED | Arm 1 verified: QLoRA 2305.14314, degradation 2103.13630, pruning 2403.17887 — all confirmed as cited; the "predictable" claim is refined to "**task/difficulty/calibration-sensitive**" (2504.04823), which is a sharper and more useful statement. |
+| P-6 | R0 reconciliation at batch: 2 CONFIRMED · 1 REFINED · Sum 3 | REFINED | This run's independent R0 derivation found FIVE family findings (R0-1..R0-5), not three — the batched reconciliation under-counted the family baseline. Row truth now: R0 Sum 5, all CONFIRMED with inline refinements. |
+
+Row-derived: CONFIRMED 4 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 6).

research/memory-atlas-r1/AC-local-offline-intelligence/r0_baseline_extract.md

@@ -0,0 +1,10 @@
+# #404 AC — R0 Baseline Extract (family file Section AC; reconnaissance, NOT authority)
+
+Source: families/offline_intelligence_resource_placement.md §AC + batched master (b29810f1…). Re-derive one-to-one during R0_RECONCILIATION; do not inherit.
+
+- R0-1 (family): Per-operation mechanism matrix — query intent = deterministic FSM/regex (COVERED); filing/classification = small embedding + kNN/linear head (ADAPT); new-memory extraction = 3-8B local LLM + grammar-constrained JSON (ADAPT); contradiction detection = cross-encoder reranker filter + LLM adjudicator on conflicts only (EXPERIMENT); summarization/consolidation = local 4-8B Q4 async with quality gate (ADAPT). Evidence class: mostly reasoned/standard-practice — no published per-operation matrix exists.
+- R0-2 (family): Embedding status — nomic-embed-text-v1.5 (62.28 MTEB-EN) viable but qwen3-embedding:0.6b better (64.33 multilingual, 32K ctx); vectors across models NOT comparable; store raw text + model_id per vector so re-embedding is a background pass.
+- R0-3 (family): Structured generation — grammar-constrained decoding: syntactic failure ≈0 but SEMANTIC degradation of reasoning is real (2408.02442); constrain only extraction-shaped outputs.
+- R0-4 (family): Adversarial risk — silent drift from task-prefix omissions and truncated context (nomic defaults 2048 ctx in Ollama) — degradation WITHOUT errors.
+- R0-5 (family): T1 impact YES — store text + embedding-model version; keep classifier/extraction tiers pluggable now.
+- Batched-master verdicts to reconcile: ADOPT local embedding (nomic via Ollama, MTEB parity evidence); REJECT local LLM consolidation with small models (silent quality loss, unmeasurable); EXPERIMENT small models for MECHANICAL ops only; FUTURE quantized consolidation pending ≤8B A/B study. Evidence: QLoRA NF4 (2305.14314); quantization degradation predictable (2103.13630); layer-pruning headroom (2403.17887). Batched R0: 2 CONFIRMED · 1 REFINED · Sum 3.

research/memory-atlas-r1/AC-local-offline-intelligence/r0_reconciliation.md

@@ -0,0 +1,11 @@
+# #404 AC — R0 Reconciliation (family Section AC baseline; 2026-09-22)
+
+| R0 | Family claim | Verdict | Evidence |
+|---|---|---|---|
+| R0-1 | Per-operation mechanism matrix: query intent deterministic; filing/classification small-embedding+kNN; extraction 3-8B local + grammar JSON; contradiction detection reranker+LLM-adjudicator; consolidation local 4-8B async | CONFIRMED | Arm 1/2 evidence supports the mechanism CLASSES per operation; REFINED detail: (a) "extraction 3-8B" holds but grammar-constrained decoding taxes reasoning (constraint tax 19.7→11.0% at ≤2B — extraction field formats only); (b) consolidation "local 4-8B async" carries the batched REJECT (silent quality loss unmeasurable) — downgraded to EXPERIMENT pending a measured quality gate; (c) contradiction detection as reranker-filter + LLM-on-conflicts is CONFIRMED as the right shape (arm 2: verifier availability is the binding escalation constraint). Row truth recorded with the refinements inline. |
+| R0-2 | Embedding status: nomic viable; qwen3-embedding:0.6b better; vectors across models NOT comparable; store raw text + model_id per vector | CONFIRMED | Inward: qwen3-embedding:0.6b INSTALLED but UNWIRED (dormant); vectors unversioned (no model column — carried #403 defect). Arm evidence: #403 established version-stamping as precondition. The family's recommendation stands and is now an ADOPT-precondition (C010). |
+| R0-3 | Structured generation: grammar-constrained decoding syntactic failure ≈0, semantic degradation real (2408.02442); constrain extraction-shaped outputs only | CONFIRMED | Arm 1: constraint tax measured (validity 61.5→100%, accuracy 19.7→11.0% at ≤2B); 2509.21791 (confounded effects, task-dependent) REFINES the causal story but not the design rule. |
+| R0-4 | Adversarial risk: silent drift from task-prefix omissions and truncated context (Ollama nomic 2048 ctx default) | CONFIRMED | Arm 4 (primary docs): Ollama context default is VRAM-dependent (4k on Rune's 16GB card), keep_alive 5min, parallel requests multiply KV, and **embedding-input truncation is an OPEN upstream defect class**. WIDENED by arm-4 evidence: the risk is structural, not incidental — C010's architectural fix (probe-and-report) is the response. |
+| R0-5 | T1 impact YES: store text + embedding-model version; keep classifier/extraction tiers pluggable now | CONFIRMED | Inward confirms the versioning gap; harness rich-ledger contract already demonstrates the pluggable-tier pattern. |
+
+Row-derived: CONFIRMED 5 · REFINED 0 (refinements inline) · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 5).

research/memory-atlas-r1/AC-local-offline-intelligence/sources.md

@@ -0,0 +1,254 @@
+# #404 AC — Source Ledger
+
+**Canonical form: `source_ledger.json` (structured; per-row origin provenance + origin_row_hash + normalization_id + row_kind). This file is a GENERATED projection — edit the JSON and rebuild; never hand-edit rows here.** Harness: R1_HARNESS_BASELINE_VERSION = 1.0 rev.2.
+
+Schema: source_id · row_kind (SOURCE/POINTER/SYNTHESIS) · stable_identifier · title · authors · year · venue · version · source_type · modality · task · dataset · method · key_claims · negative_results · limitations · rune_relevance · read_depth · origin_ref · origin_row_hash · normalization_id · raw_origin_cells. AC-specific honest depth labels: INHERITED_VERIFIED (verified in a prior sealed domain's arms, carried) · COMMUNITY_EVIDENCE_RELIABILITY_LABELED. NOT_RECORDED_IN_ARM = the arm did not record the field.
+
+**Derived accounting (mechanical, from source_ledger.json): LEDGER_ROWS = 156 · EXTERNAL_SOURCE_ROWS = 150 · UNIQUE_EXTERNAL_SOURCES = 147 · POINTER_ROWS = 6 · SYNTHESIS_ROWS = 0 · DUPLICATE_SOURCE_GROUPS = 2.**
+
+Duplicate map (identity → SOURCE row IDs):
+- arxiv:2305.16291 → A2-18 + A3-13 + A4-24
+- arxiv:2501.12948 → A3-1 + A4-26
+
+**Depths (derived): ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 28 · RELEVANT_SECTIONS 11 · INHERITED_VERIFIED 8 · NOT_RECORDED_IN_ARM 6 · FULL_PAPER 4 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3 = 150 labeled + 6 pointer rows (NOT_RECORDED by design).** Source TYPE and read DEPTH separate.
+
+## Do-not-cite / unverifiable register
+
+- 17 mis-paired arXiv IDs caught across arms: 2510.05040, 2402.04937 (BitNet=2402.17764), 2109.05074 (PICARD=2109.05093), 2409.02409 (CoALA=2309.02427), 2203.07154 (self-consistency=2203.11171), 2305.18365 (ReWOO=2305.18323), 2305.09658 (FrugalGPT=2305.05176), 2403.02719, 2401.08900, 2310.08920, 2307.02958, 2401.01280, 1912.13488, 2006.03844, 2205.10436, 2411.13843, RLVF (unverifiable). Plus: 'hallucination inheritance' as quantified phenomenon (bounded zero-hit); direct 27B-IQ2M-vs-Q4 benchmark (none); MobileLLM gloss; IQ2_M bpw figures; unverified HuggingGPT/AutoGen/MetaGPT statistics; De Lange survey (DOI only).
+
+| A1-1 | SOURCE | 1 | 2402.14905 | MobileLLM: Optimizing Sub-billion Parameter Language Models for On-Device Use Cases | Liu, Zhao, Iandola et al., 2024, Meta (ICML 2024) | ABSTRACT_ONLY | Rune's 3B/7B tier is 3–20× larger than what MobileLLM shows is enough for bounded tool-call/API-call class tasks — routing/extraction/tool invocation is provabl |
+| A1-2 | SOURCE | 2 | 2404.14219 | Phi-3 Technical Report | Abdin, Aneja, Awadalla et al., 2024, Microsoft | ABSTRACT_ONLY | Rune's 14B generalist sits at the phi-3-medium class: 78 MMLU ≈ capable, but the report's own scaling (69→75→78) shows each size step buys ~3–6 MMLU points — sm |
+| A1-3 | SOURCE | 3 | 2412.08905 | Phi-4 Technical Report | Abdin, Behl, Bubeck, Eldan, Gunasekar et al., 2024, Microsoft | ABSTRACT_ONLY | THE synthetic-data counterexample to doom narratives: a bounded, curriculum-designed synthetic pipeline at 14B can exceed the teacher on a target domain. Rune's |
+| A1-4 | SOURCE | 4 | 2412.15115 | Qwen2.5 Technical Report | Qwen Team (Yang et al.), 2024, Alibaba | ABSTRACT_ONLY | Rune's 14B generalist is plausibly Qwen2.5-class; the family covers 0.5B→14B, giving Rune a same-family ladder for cascade experiments (0.5B/1.5B/3B for routing |
+| A1-5 | SOURCE | 5 | 2409.12186 | Qwen2.5-Coder Technical Report | Hui, Yang, Cui et al., 2024, Alibaba | ABSTRACT_ONLY | Rune's 14B coder: function/completion/repair-class coding is SOTA-at-size; repo-scale multi-file coding remains unbenchmarked in every report — the evidence bas |
+| A1-6 | SOURCE | 6 | 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.), 2025 | ABSTRACT_ONLY | Rune's 27B IQ2_M + 14B: if either is R1-Distill-Qwen lineage, §3 of 2504.04823 (below) applies DIRECTLY — distilled reasoning models have specific quantization  |
+| A1-7 | SOURCE | 7 | 2503.19786 | Gemma 3 Technical Report | Gemma Team (Kamath, Ferret, …), 2025, Google | ABSTRACT_ONLY | The strongest generation-over-generation datapoint: 4B-IT ≈ prior-gen 27B-IT. Within-family quality gain (2024→2025) bought more than 6× parameter reduction. Fo |
+| A1-8 | SOURCE | 8 | 1503.02531 | Distilling the Knowledge in a Neural Network | Hinton, Vinyals, Dean, 2015 | ABSTRACT_ONLY | Foundation row. Rune's "lessons" store is a knowledge-transfer analogue: soft/graded evidence (when things worked, with what confidence) carries more transferab |
+| A1-9 | SOURCE | 9 | 2210.17323 | GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformers | Frantar, Ashkboos, Hoefler, Alistarh, 2022, ICLR 2023 | ABSTRACT_ONLY | GPTQ is calibration-sensitive: 2504.04823 found GPTQ degrades badly when calibration domain ≠ target domain (−9.8 avg points; fixable by calibrating on task-dom |
+| A1-10 | SOURCE | 10 | 2306.00978 | AWQ: Activation-aware Weight Quantization | Lin, Tang, Tang, Yang et al., 2023, MLSys 2024 | ABSTRACT_ONLY | 2504.04823's head-to-head verdict: AWQ preferred over GPTQ for weight-only at 4-bit (comparable quality, faster). For Rune's tiering: AWQ-quantized models are t |
+| A1-11 | SOURCE | 11 | 2305.14314 | QLoRA: Efficient Finetuning of Quantized LLMs | Dettmers, Pagnoni, Holtzman, Zettlemoyer, 2023, NeurIPS 2023 | ABSTRACT_ONLY | The enabling tool for Rune's empty learning machinery: a 14B model can be finetuned on 16 GB VRAM via 4-bit + LoRA on lesson-derived data. The QLoRA evidence sa |
+| A1-12 | SOURCE | 12 | 2402.17764 | The Era of 1-bit LLMs: All Large Language Models are in 1.58 Bits (BitNet b1.58) | Ma, Wang, Ma, Wang et al., 2024, Microsoft | ABSTRACT_ONLY | Hard boundary: Rune's 27B IQ2_M is a PTQ model. BitNet-class parity does not transfer to it. Any reasoning of the form "ternary works (BitNet), so 2-bit PTQ is  |
+| A1-13 | SOURCE | 13 | 2404.14047 | An empirical study of LLaMA3 quantization: from LLMs to MLLMs | Huang, Zheng, Ma, Qin et al., 2024 | ABSTRACT_ONLY | Corroborates 2504.04823 with a different model family: modern heavily-trained models do NOT out-quantize older ones. Rune cannot assume its 2024/2025-era models |
+| A1-14 | SOURCE | 14 | 2504.04823 | Quantization Hurts Reasoning? An Empirical Study on Quantized Reasoning Models | Liu, Sun, Zhang, Bai et al., 2025, Huawei Noah's Ark Lab | RELEVANT_SECTIONS | Rune's 27B IQ2_M sits BELOW the study's tested floor. Extrapolation chain: W3 loses 5.4–6.3 avg points on a 7B; 2-bit PTQ is worse; IQ2_M is a ~2.5 bpw-class qu |
+| A1-15 | SOURCE | 15 | 2608.01078 | Attend to Your Own Thoughts: Breaking the Barrier for PTQ of Reasoning LLMs through the Lens of 1.58-Bit Quantization (ScaleQ-1.58) | Wang, Li, Kang, Fan, Yao, 2026 | ABSTRACT_ONLY | Directly extends the family file's quantization finding to 2-bit PTQ: at Rune's IQ2_M operating point, failure is concentrated exactly where Rune needs capabili |
+| A1-16 | SOURCE | 16 | llama.cpp PR #1684 "k-quants" | k-quants (Q2_K…Q6_K + mixes) | ikawrakow / ggml, 2023, merged (GGUF ecosystem docs) | DOCUMENTATION_AUDITED | Q2_K-class ≈ 3.3 bpw effective; Rune's IQ2_M is below even that. The PR's own framing legitimizes 2-bit ONLY under a hard 16 GB ceiling — the same ceiling Rune  |
+| A1-17 | SOURCE | 17 | llama.cpp discussion #5263 | About imatrix overfitting, and importance of input text | community benchmark (Ikawrakow-style tests), 2024, GGUF ecosystem docs | DOCUMENTATION_AUDITED | Same mechanism as #14's GPTQ calibration finding, in the GGUF ecosystem Rune actually uses: whatever imatrix produced Rune's IQ2_M files, its input text determi |
+| A1-18 | SOURCE | 18 | 1606.07947 | Sequence-Level Knowledge Distillation | Kim, Rush, 2016, EMNLP 2016 | ABSTRACT_ONLY | Foundation for "distill teacher outputs, not logits": Rune's lesson pipeline can distill the 27B's *successful outputs* into prompts/templates for the 14B/7B —  |
+| A1-19 | SOURCE | 19 | 2305.02301 | Distilling Step-by-Step! Outperforming Larger Language Models with Less Training Data and Smaller Model Sizes | Hsieh, Li, Yeh, Nakhost, Fujii, Ratner et al., 2023, ACL Findings 2023 | ABSTRACT_ONLY | For Rune: extract the 27B's *reasoning* (why this lesson, why this fix) as supervision, not just verdicts — rationales are the transferable part |
+| A1-20 | SOURCE | 20 | 2301.12726 | Specializing Smaller Language Models towards Multi-Step Reasoning | Fu, Peng, Ou, Sabharwal, Khot, 2023, ICML 2023 | RELEVANT_SECTIONS | Sharpest evidence on what distillation transmits: capability in-domain, loss out-of-domain, and no reliable internal signal of which is which. For Rune's lesson |
+| A1-21 | SOURCE | 21 | 2306.13649 | On-Policy Distillation of Language Models (GKD) | Agarwal, Vieillard, Zhou, Stanczyk, Ramos, Geist et al., 2023, Google DeepMind (ICLR 2024) | ABSTRACT_ONLY | For Rune: if it ever distills 27B→14B, on-policy (student's own attempts graded by teacher) beats copying teacher outputs — and this matches #382's SkillGen con |
+| A1-22 | SOURCE | 22 | 2408.12326 | Interactive DualChecker for Mitigating Hallucinations in Distilling Large Language Models | Wang, Suzuki, Sakaji, Izumi, 2024 | ABSTRACT_ONLY | Weak-but-real evidence that teacher-error transmission is an observed problem needing machinery, not a hypothetical. Paired with the bounded zero-hit below (no  |
+| A1-23 | SOURCE | 23 | 2305.17493 | The Curse of Recursion: Training on Generated Data Makes Models Forget (model collapse) | Shumailov, Shumaylov, Zhao, Gal, Papernot, Anderson, 2023, Nature 2024 | ABSTRACT_ONLY | Rune's feedback loop (agent writes lessons → lessons condition future behavior) is structurally a replace-or-accumulate choice. #23 says: never let synthetic/de |
+| A1-24 | SOURCE | 24 | 2404.01413 | Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data | Gerstgrasser, Schaeffer, Dey, Rafailov, Sleight, Hughes et al., 2024 | ABSTRACT_ONLY | Rune's append-only ledger architecture is the collapse antidote: derived data (lessons, summaries, embeddings) ACCUMULATES beside sources, never overwrites them |
+| A1-25 | SOURCE | 25 | 2306.11644 | Textbooks Are All You Need (phi-1) | Gunasekar, Zhang, Mendes et al., 2023, Microsoft | ABSTRACT_ONLY | The template for Rune's empty learning machinery: small model + bounded, exercise-shaped, verified synthetic data ≫ raw corpus. Rune's 152 deterministic modules |
+| A1-26 | POINTER | 26 | 2412.08905 | (Phi-4 — see row 3) | — | UNVERIFIED | Cross-reference: synthetic data done at curriculum quality EXCEEDED the teacher on STEM (row 3). Synthetic data helps when: bounded, curriculum-structured, veri |
+| A1-27 | SOURCE | 27 | 2211.17192 | Fast Inference from Transformers via Speculative Decoding | Leviathan, Kalman, Matias, 2022, Google, ICML 2023 | ABSTRACT_ONLY | Lossless local latency win for Rune: 3B drafts for 14B/27B targets, same-family (Qwen2.5 line covers 0.5B–14B — row 4). Zero quality risk, unlike every cascade/ |
+| A1-28 | SOURCE | 28 | 2302.01318 | Accelerating Large Language Model Decoding with Speculative Sampling | Chen, Borgeaud, Irving, Lespiau, Sifre, Jumper et al., 2023, DeepMind | ABSTRACT_ONLY | The formal guarantee Rune should demand of any local acceleration: distribution-preserving or it is a quality trade, not an optimization |
+| A1-29 | SOURCE | 29 | 2305.05176 | FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance | Chen, Zaharia, Zou, 2023, Stanford / Databricks | RELEVANT_SECTIONS | For Rune the economics invert: local tokens are ~free, so the cascade's 98%-cost driver is irrelevant; what remains is (a) latency/VRAM pressure, (b) the scorer |
+| A1-30 | SOURCE | 30 | 2406.18665 | RouteLLM: Learning to Route LLMs with Preference Data | Ong, Almahairi, Wu, Chiang et al., 2024, Berkeley | ABSTRACT_ONLY | The working routing signal is empirical per-query weak-model failure data, not a priori difficulty. Rune has no preference/failure dataset (0 measured deltas) → |
+| A1-31 | SOURCE | 31 | 2207.07061 | Confident Adaptive Language Modeling (CALM) | Schuster, Fisch, Gupta, Dehghani, Bahri, Tran et al., 2022, NeurIPS 2022 | ABSTRACT_ONLY | The one adaptive-compute scheme with a maintenance guarantee — but it is an inference-engine feature (model-internals), not a policy layer Rune can bolt on; not |
+| A1-32 | SOURCE | 32 | 2409.02136 | Large Language Models versus Classical Machine Learning: Performance in COVID-19 Mortality Prediction Using High-Dimensional Tabular Data | Ghaffarzadeh-Esfahani et al., 2024 | ABSTRACT_ONLY | Strongest direct number for the arm's classical-ML verdict: for bounded, labelled, structured tasks, 152 deterministic Python modules + classical models are not |
+| A1-33 | SOURCE | 33 | 2207.08815 | Why do tree-based models still outperform deep learning on tabular data? | Grinsztajn, Oyallon, Varoquaux, 2022, NeurIPS 2022 | ABSTRACT_ONLY | Rune's scale (n≈944 memory entries, hundreds of sessions) is ~10× BELOW the regime where trees already win: gradient boosting/logistic regression over hand-buil |
+| A1-34 | SOURCE | 34 | 1911.00172 | Generalization through Memorization: Nearest Neighbor Language Models (kNN-LM) | Khandelwal, Levy, Jurafsky, Zettlemoyer, Lewis, 2019, ICLR 2020 | ABSTRACT_ONLY | The conceptual charter for Rune's retrieval-first stance: factual/long-tail cognition can live in retrieval, not parameters. Combined with #383 (score-everythin |
+| A1-35 | POINTER | 35 | — carry-over #383 (IR domain, R1_QUALIFIED) | research/memory-atlas-r1/H-information-retrieval/ | — | UNVERIFIED | Retrieval without generation at Rune's scale is settled: BM25 + metadata + dense, fused by weighted combination. Any local "routing" instinct must re-justify it |
+| A1-36 | POINTER | 36 | — carry-over #403 (Arm 2, AB arms) | checkpoint-403-ab-arms-findings.md | — | UNVERIFIED | The versioned-embedding mandate applies to Rune's 3 embedders NOW: nomic-embed 256-d Matryoshka vectors are UNVERSIONED — silent-degrade-when-Ollama-down is the |
+| A1-37 | SOURCE | 37 | 2203.07814 | Competition-Level Code Generation with AlphaCode | Li, Choi, Chung, Kushman, Schrittwieser et al., 2022, DeepMind, Science 2022 | ABSTRACT_ONLY | The charter for verifier-guided local coding: Rune's 152 deterministic modules + tests are the execution oracle. Small models + test-filtered sampling is the ev |
+| A1-38 | SOURCE | 38 | 2305.20050 | Let's Verify Step by Step | Lightman, Kosaraju, Burda, Edwards, Baker, Lee et al., 2023, OpenAI | ABSTRACT_ONLY | Lesson/outcome logging design: record step-level traces, not just success/final answers — per-step grading is the evidenced-superior supervision signal, and Run |
+| A1-39 | SOURCE | 39 | 2109.05093 | PICARD: Parsing Incrementally for Constrained Auto-Regressive Decoding from Language Models | Scholak, Schucher, Bahdanau, 2021, EMNLP 2021 | ABSTRACT_ONLY | Positive pole of constrained decoding: for outputs with a real grammar (SQL, JSON matching a schema with semantics, tool-call syntax), constraint decoding is a  |
+| A1-40 | SOURCE | 40 | 2408.02442 | Let Me Speak Freely? A Study on the Impact of Format Restrictions on Performance of Large Language Models | Tam, Wu, Tsai, Lin, Lee, Chen, 2024 | ABSTRACT_ONLY | Confirms: GBNF for reasoning-heavy steps (planning, multi-step debugging) = self-inflicted handicap; GBNF for extraction/typing = near-free validity |
+| A1-41 | SOURCE | 41 | 2509.21791 | Quantifying the Impact of Structured Output Format on Large Language Models through Causal Inference | Yuan, Zhao, Zhang, Luo, Ma, 2025 | ABSTRACT_ONLY | Extension of the family-file finding: the correct posture is per-task-class empirical measurement (Rune's local eval harness — #403 forced-correction #8), not a |
+| A1-42 | SOURCE | 42 | 2605.26128 | The Constraint Tax: Measuring Validity-Correctness Tradeoffs in Structured Outputs for Small Language Models | Ray, 2026 | ABSTRACT_ONLY | The most Rune-specific number in this ledger: at ≤2B, unconstrained answer accuracy 19.7% halves under a hard schema. Rule: constrain the FORMAT of extraction f |
+| A3-1 | SOURCE | 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.) 2025, arXiv/Nature | distilled reasoning models — what transfers | R1- | internalization-learning | S1. 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.) 2025, arXiv/Nature | distilled reasoning models — what transfers | R1-Distill-Qwen-32B hits A | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-2 | SOURCE | 2305.02301 | Distilling Step-by-Step! Outperforming Larger LMs with Less Training Data and Smaller Model Sizes | Hsieh et al. 2023, ACL Findings | small task-specific models | internalization-learning | S2. 2305.02301 | Distilling Step-by-Step! Outperforming Larger LMs with Less Training Data and Smaller Model Sizes | Hsieh et al. 2023, ACL Findings | small task-specific models matching/beating promp | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-3 | SOURCE | 1805.04770 | Born Again Neural Networks | Furlanello et al. 2018, ICML | self-distillation / interpretability of what KD transfers | Students with identical architecture to  | internalization-learning | S3. 1805.04770 | Born Again Neural Networks | Furlanello et al. 2018, ICML | self-distillation / interpretability of what KD transfers | Students with identical architecture to teacher outperform the  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-4 | SOURCE | 2306.02707 | Orca: Progressive Learning from Complex Explanation Traces of GPT-4 | Mukherjee et al. 2023 | explanation-trace distillation | (Noted for completeness; arm 1 ow | internalization-learning | S4. 2306.02707 | Orca: Progressive Learning from Complex Explanation Traces of GPT-4 | Mukherjee et al. 2023 | explanation-trace distillation | (Noted for completeness; arm 1 owns core distillation.)  | NOT_RECORDED_IN_ARM | METADATA_VERIFIED | NOT_RECORDED_IN_ARM |
+| A3-5 | SOURCE | 1011.0686 | A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning (DAgger) | Ross, Gordon, Bagnell 2011, AISTATS | distribution shift in  | internalization-learning | S5. 1011.0686 | A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning (DAgger) | Ross, Gordon, Bagnell 2011, AISTATS | distribution shift in behavioural cloning | BC | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-6 | SOURCE | 2310.12823 | AgentTuning: Enabling Generalized Agent Abilities for LLMs | Zeng et al. 2023 | fine-tuning on agent trajectories | Instruction-tuning Llama-2 on ~1.8K high-qua | internalization-learning | S6. 2310.12823 | AgentTuning: Enabling Generalized Agent Abilities for LLMs | Zeng et al. 2023 | fine-tuning on agent trajectories | Instruction-tuning Llama-2 on ~1.8K high-quality interaction trajec | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-7 | SOURCE | 2310.05915 | FireAct: Toward Language Agent Fine-tuning | Chen et al. 2023 | trajectory fine-tuning | 500 GPT-4-generated trajectories fine-tuned into Llama2-7B yields +77%  | internalization-learning | S7. 2310.05915 | FireAct: Toward Language Agent Fine-tuning | Chen et al. 2023 | trajectory fine-tuning | 500 GPT-4-generated trajectories fine-tuned into Llama2-7B yields +77% HotpotQA; diversity of  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-8 | SOURCE | 2303.11366 | Reflexion: Language Agents with Verbal Reinforcement Learning | Shinn et al. 2023, NeurIPS | verbal (non-weight) learning from outcomes | Agents store self-gene | internalization-learning | S8. 2303.11366 | Reflexion: Language Agents with Verbal Reinforcement Learning | Shinn et al. 2023, NeurIPS | verbal (non-weight) learning from outcomes | Agents store self-generated *linguistic* refl | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-9 | SOURCE | 2310.01798 | Large Language Models Cannot Self-Correct Reasoning Yet | Huang et al. 2024, ICLR | intrinsic self-correction without external feedback | With no external feedb | internalization-learning | S9. 2310.01798 | Large Language Models Cannot Self-Correct Reasoning Yet | Huang et al. 2024, ICLR | intrinsic self-correction without external feedback | With no external feedback, self-correction pr | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-10 | SOURCE | 2211.00053 | Generating Sequences by Learning to Self-Correct | Le, Kayser?, actually: (Bengio group) 2022 | trained corrector decoupled from generator | A separate correcto | internalization-learning | S10. 2211.00053 | Generating Sequences by Learning to Self-Correct | Le, Kayser?, actually: (Bengio group) 2022 | trained corrector decoupled from generator | A separate corrector model (possibly smal | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-11 | SOURCE | 2308.10144 | ExpeL: LLM Agents Are Experiential Learners | Zhao et al. 2023, AAAI | insight extraction from experience without weight updates | Agent accumulates trajectorie | internalization-learning | S11. 2308.10144 | ExpeL: LLM Agents Are Experiential Learners | Zhao et al. 2023, AAAI | insight extraction from experience without weight updates | Agent accumulates trajectories, uses LLM to extract | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-12 | SOURCE | 2411.02337 | WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum RL | Qi et al. 2024, ICLR 2025 | outcome-grounded RL from verified web-task success | Self-ev | internalization-learning | S12. 2411.02337 | WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum RL | Qi et al. 2024, ICLR 2025 | outcome-grounded RL from verified web-task success | Self-evolving curriculum (new | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-13 | SOURCE | 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | Wang, Xie, Jiang, Mandlekar, Xiao, Zhu 2023, TMLR/ICLR'24 | skill library — promotion mechanism | Promotion me | internalization-learning | S13. 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | Wang, Xie, Jiang, Mandlekar, Xiao, Zhu 2023, TMLR/ICLR'24 | skill library — promotion mechanism | Promotion mechanism (deep-read res | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-14 | SOURCE | 2409.07429 | Agent Workflow Memory (AWM) | Wang, Mao, Fried, Neubig 2024 | induced reusable workflows | Induces workflows (subroutines of abstracted actions) from trajectori | internalization-learning | S14. 2409.07429 | Agent Workflow Memory (AWM) | Wang, Mao, Fried, Neubig 2024 | induced reusable workflows | Induces workflows (subroutines of abstracted actions) from trajectories; +24.6% relative su | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-15 | SOURCE | 2508.06433 | Memp: Exploring Agent Procedural Memory | Fang et al. 2025 | build/retrieve/update of procedural memory | Distills trajectories into fine-grained step instructi | internalization-learning | S15. 2508.06433 | Memp: Exploring Agent Procedural Memory | Fang et al. 2025 | build/retrieve/update of procedural memory | Distills trajectories into fine-grained step instructions + script-level abs | NOT_RECORDED_IN_ARM | RELEVANT_SECTIONS | NOT_RECORDED_IN_ARM |
+| A3-16 | SOURCE | 2504.07079 | SkillWeaver: Web Agents can Self-Improve by Discovering and Honing Skills | 2025 | skills as synthesized APIs + practice | Agent discovers skills on new sites,  | internalization-learning | S16. 2504.07079 | SkillWeaver: Web Agents can Self-Improve by Discovering and Honing Skills | 2025 | skills as synthesized APIs + practice | Agent discovers skills on new sites, practices them, distil | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-17 | SOURCE | 2207.10397 | CodeT: Code Generation with Generated Tests | Chen et al. 2022, ICLR'23 | test-filtered sampling | Generate N programs + N test suites from the same LLM; rank p | internalization-learning | S17. 2207.10397 | CodeT: Code Generation with Generated Tests | Chen et al. 2022, ICLR'23 | test-filtered sampling | Generate N programs + N test suites from the same LLM; rank programs by dual execut | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-18 | SOURCE | 2401.08500 | Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering | Ridnik, Kredo, Friedman 2024 | multi-stage test-based iterative flow | GPT-4 Cod | internalization-learning | S18. 2401.08500 | Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering | Ridnik, Kredo, Friedman 2024 | multi-stage test-based iterative flow | GPT-4 CodeContests pass@5: 19%  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-19 | SOURCE | 2304.05128 | Teaching LLMs to Self-Debug | Chen, Lin, Schärli, Zhou 2023 | execution-feedback loop | Self-debugging with execution feedback + code explanation improves Spide | internalization-learning | S19. 2304.05128 | Teaching LLMs to Self-Debug | Chen, Lin, Schärli, Zhou 2023 | execution-feedback loop | Self-debugging with execution feedback + code explanation improves Spider by 2–3% (and hardest | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-20 | SOURCE | 2310.08992 | CodeChain: Modular Code Generation Through Chain of Self-revisions with Representative Sub-modules | 2023 | emergent reusable modules | Clusters generated sub-m | internalization-learning | S20. 2310.08992 | CodeChain: Modular Code Generation Through Chain of Self-revisions with Representative Sub-modules | 2023 | emergent reusable modules | Clusters generated sub-modules across samples, | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-21 | SOURCE | 2103.08493 | How Many Data Points is a Prompt Worth? | Logan IV et al. 2021, EMNLP Findings | data-equivalence of prompts | Fair-comparison log-linear analysis across classi | internalization-learning | S24. 2103.08493 | How Many Data Points is a Prompt Worth? | Logan IV et al. 2021, EMNLP Findings | data-equivalence of prompts | Fair-comparison log-linear analysis across classification tasks: prompt | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-22 | SOURCE | 1605.07723 | Data Programming (Snorkel) | Ratner et al. 2016, NeurIPS | weak supervision / labelling functions | Modelling noisy labelling functions as a generative process  | internalization-learning | S25. 1605.07723 | Data Programming (Snorkel) | Ratner et al. 2016, NeurIPS | weak supervision / labelling functions | Modelling noisy labelling functions as a generative process and denoising lets wea | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-23 | SOURCE | 1911.04252 | Self-training with Noisy Student improves ImageNet classification | Xie et al. 2020, CVPR | self-training (positive pole) | Iterative teacher→pseudo-label→large | internalization-learning | S26. 1911.04252 | Self-training with Noisy Student improves ImageNet classification | Xie et al. 2020, CVPR | self-training (positive pole) | Iterative teacher→pseudo-label→larger-noised-student reach | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-24 | SOURCE | 2307.02075 | Combating Confirmation Bias: A Unified Pseudo-Labeling Framework for Entity Alignment | Mao et al. 2023 | self-training pitfall | Confident pseudo-labels compou | internalization-learning | S27. 2307.02075 | Combating Confirmation Bias: A Unified Pseudo-Labeling Framework for Entity Alignment | Mao et al. 2023 | self-training pitfall | Confident pseudo-labels compound their own errors ac | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-25 | SOURCE | 2106.09685 | LoRA | Hu et al. 2021, ICLR'22 | adapter mechanics | Rank-decomposition adapters: 10,000× fewer trainable params, 3× less memory, no inference latency, ≈ full-F | internalization-learning | S28. 2106.09685 | LoRA | Hu et al. 2021, ICLR'22 | adapter mechanics | Rank-decomposition adapters: 10,000× fewer trainable params, 3× less memory, no inference latency, ≈ full-FT quality on the evalu | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-26 | SOURCE | 2305.14314 | QLoRA | Dettmers et al. 2023, NeurIPS | finetuning quantized models | 4-bit NF4 frozen base + LoRA ≈ 16-bit FT task performance (Guanaco 99.3% of ChatGPT on Vic | internalization-learning | S29. 2305.14314 | QLoRA | Dettmers et al. 2023, NeurIPS | finetuning quantized models | 4-bit NF4 frozen base + LoRA ≈ 16-bit FT task performance (Guanaco 99.3% of ChatGPT on Vicuna bench); 1,000+ mod | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-27 | SOURCE | 2405.09673 | LoRA Learns Less and Forgets Less | Biderman et al. 2024, ICML'25 | forgetting magnitudes — anchor | Deep-read results: in CPT (20B tokens code/math), LoRA subs | internalization-learning | S30. 2405.09673 | LoRA Learns Less and Forgets Less | Biderman et al. 2024, ICML'25 | forgetting magnitudes — anchor | Deep-read results: in CPT (20B tokens code/math), LoRA substantially underperform | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-28 | SOURCE | 2410.21228 | LoRA vs Full Fine-tuning: An Illusion of Equivalence | Ryu et al. 2024/25 | spectral mechanism of forgetting | LoRA-trained matrices develop "intruder dimension | internalization-learning | S31. 2410.21228 | LoRA vs Full Fine-tuning: An Illusion of Equivalence | Ryu et al. 2024/25 | spectral mechanism of forgetting | LoRA-trained matrices develop "intruder dimensions" (new high singular  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-29 | SOURCE | 1706.08840 | Gradient Episodic Memory (GEM) | Lopez-Paz & Ranzato 2017, NeurIPS | replay requirements | Continual learning with a small episodic memory of past examples cons | internalization-learning | S32. 1706.08840 | Gradient Episodic Memory (GEM) | Lopez-Paz & Ranzato 2017, NeurIPS | replay requirements | Continual learning with a small episodic memory of past examples constrains gradients so lo | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-30 | SOURCE | 2310.14152 | O-LoRA: Orthogonal Subspace Learning for LM Continual Learning | Wang et al. 2023, EMNLP Findings | adapter accumulation without replay | Successive tasks learn | internalization-learning | S33. 2310.14152 | O-LoRA: Orthogonal Subspace Learning for LM Continual Learning | Wang et al. 2023, EMNLP Findings | adapter accumulation without replay | Successive tasks learned in mutually orthogo | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-31 | SOURCE | 2202.05262 | ROME: Locating and Editing Factual Associations in GPT | Meng et al. 2022, NeurIPS | model editing | Causal tracing localizes factual recall to mid-layer FFNs;  | internalization-learning | S34. 2202.05262 | ROME: Locating and Editing Factual Associations in GPT | Meng et al. 2022, NeurIPS | model editing | Causal tracing localizes factual recall to mid-layer FFNs; rank-one edits update  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-32 | SOURCE | 2210.07229 | MEMIT: Mass-Editing Memory in a Transformer | Meng et al. 2023, ICLR'23 | batch model editing | Scales editing to thousands of associations on GPT-J/GPT-NeoX (o | internalization-learning | S35. 2210.07229 | MEMIT: Mass-Editing Memory in a Transformer | Meng et al. 2023, ICLR'23 | batch model editing | Scales editing to thousands of associations on GPT-J/GPT-NeoX (orders of magnitude bey | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-33 | SOURCE | 2307.12976 | Evaluating the Ripple Effects of Knowledge Editing in Language Models (RippleEdits) | Cohen-Wang et al. 2024, ICLR'25 | editing reliability — the negative | Edi | internalization-learning | S36. 2307.12976 | Evaluating the Ripple Effects of Knowledge Editing in Language Models (RippleEdits) | Cohen-Wang et al. 2024, ICLR'25 | editing reliability — the negative | Editing one fact creates  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-34 | SOURCE | 2210.10760 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman, Hilton 2022, ICML'23 | verifier gaming | Optimizing against a proxy reward first raises, then *d | internalization-learning | S37. 2210.10760 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman, Hilton 2022, ICML'23 | verifier gaming | Optimizing against a proxy reward first raises, then *decreases*, gold-standa | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-35 | SOURCE | 2312.08935 | Math-Shepherd: Verify and Reinforce LLMs Step-by-step without Human Annotations | Wang et al. 2023/24, ACL'24 | process rewards from outcomes | Automatic proces | internalization-learning | S38. 2312.08935 | Math-Shepherd: Verify and Reinforce LLMs Step-by-step without Human Annotations | Wang et al. 2023/24, ACL'24 | process rewards from outcomes | Automatic process supervision: label e | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-36 | SOURCE | 2408.15240 | Generative Verifiers: Reward Modeling as Next-Token Prediction | Zhang et al. 2024/25 | verifier quality | GenRM (verification as CoT generation + majority vote | internalization-learning | S39. 2408.15240 | Generative Verifiers: Reward Modeling as Next-Token Prediction | Zhang et al. 2024/25 | verifier quality | GenRM (verification as CoT generation + majority vote) beats discriminative | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-37 | SOURCE | 2302.07215 | Multi-teacher KD as an Effective Method for Compressing Ensembles | Ilin et al. 2023 | ensemble→single distillation | Multi-teacher KD (logit/vote fusion) recov | internalization-learning | S40. 2302.07215 | Multi-teacher KD as an Effective Method for Compressing Ensembles | Ilin et al. 2023 | ensemble→single distillation | Multi-teacher KD (logit/vote fusion) recovers most of ensemble a | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-38 | SOURCE | 2506.07962 | Correlated Errors in Large Language Models | Raghavan et al.? (authors per abs page) 2025 | consensus ≠ corroboration | Across 350+ LLMs: models agree on errors | internalization-learning | S41. 2506.07962 | Correlated Errors in Large Language Models | Raghavan et al.? (authors per abs page) 2025 | consensus ≠ corroboration | Across 350+ LLMs: models agree on errors ~60% of the time on a | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-39 | SOURCE | 2403.02419 | Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems | Chen, Manoyina?, actually: (Stanford) 2024, ICML'25 | self-consensus scali | internalization-learning | S42. 2403.02419 | Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems | Chen, Manoyina?, actually: (Stanford) 2024, ICML'25 | self-consensus scaling limits | Majority-v | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-1 | SOURCE | A1 | llama.cpp README + docs/ (ggml-org/llama.cpp, master, accessed this session) | implementation-ecosystem | The reference GGUF inference stack | Plain C/C++, CUDA/Metal/CPU backends; `llama-server` = OpenAI-compatible REST; multimodal (mtmd); quantize tool with imatrix ("accuracy loss… minimize | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-2 | SOURCE | A2 | llama.cpp docs/speculative.md | implementation-ecosystem | Speculative decoding guide | Three implementations: classic draft model, EAGLE-3 (hidden-state draft, one-layer transformer per target model), and mixing; speedups "when draft pre | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-3 | SOURCE | A3 | llama.cpp tools/server/README.md | implementation-ecosystem | Server structured output | `--grammar` (GBNF), `--json-schema` / per-request `json_schema` and `grammar` fields; invalid grammar → request error (never silent) | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-4 | SOURCE | A4 | k-quants PR #1684 + imatrix discussion #5263 (INHERITED from arm 1, DOCUMENTATION_AUDITED there) | implementation-ecosystem | Quant formats + calibration sensitivity | 2–6 bit ppl curves; "bigger quantizes better" bounded and non-monotone above ~13B; imatrix corpus choice measurably changes Q2_K quality | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-5 | SOURCE | A5 | vLLM docs (vllm-project/vllm main: features/quantization/README.md, features/structured_outputs.md) | implementation-ecosystem | Production-scale serving; paged attention; continuous batching; multi-backend quant kernels (`--linear-backend`); day-0 model support | Broadest: AWQ, GPTQ/GPTQModel, BitsAndBytes, FP8 W8A8/W4A16/INT4/INT8 via LLM Compressor, ModelOpt, TorchAO, Quark, GGUF (via gguf.md), quantized KV c | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-6 | SOURCE | A6 | mlx-lm README (ml-explore/mlx-lm main) | implementation-ecosystem | Apple-silicon-first; HF Hub one-command generate/chat; LoRA + full fine-tuning including on quantized models; distributed inference | 4/8-bit quantization + quantized LoRA training | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-7 | SOURCE | A7 | ONNX Runtime GenAI README (microsoft/onnxruntime-genai main) | implementation-ecosystem | Cross-platform (x86/x64/arm64; CPU/CUDA/DirectML/TRT-RTX/OpenVINO/QNN/WebGPU); powers Foundry Local, Windows ML, VS Code AI Toolkit; full generative loop incl. KV cache, logits processing, grammar spe | Block-quantized INT4 (RTN, accuracy-level options), FP8/INT8 variants per model package | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-8 | SOURCE | A8 | Ollama docs (docs/api.md, faq.mdx, context-length.mdx, capabilities/) + issue tracker | implementation-ecosystem | Simplest deployment; system service; model registry tags; keep_alive; context defaults by VRAM | Opaque: quant baked into registry tags (q4_K_M etc.); no per-layer backend transparency; no user-facing quantization tooling | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-9 | SOURCE | A9 | LM Studio developer docs (lmstudio.ai/docs, structured-output page) | implementation-ecosystem | Desktop app + headless service ("llmster as a Startup Task on Linux"); REST API + OpenAI-compat + Anthropic-compat endpoints; model loader with per-model context/ GPU-offload controls; "Idle TTL and A | GGUF (llama.cpp-derived engine) with visible quant picker and runtime context-length override | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-10 | SOURCE | A10 | Ollama faq.mdx / context-length.mdx | implementation-ecosystem | Context defaults scale with VRAM, silently: <24 GiB → 4k; 24–48 GiB → 32k; ≥48 GiB → 256k. Docs themselves say agents/coding tools "should be set to at least 64000" and warn "Ensure you have enough VR | On Rune's 16 GB card Ollama defaults to 4k context — the family file's 2048-ctx silent-drift finding is structural, not a misconfiguration: every agen | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-11 | SOURCE | A11 | Ollama faq.mdx (keep_alive) | implementation-ecosystem | Default keep_alive = 5 minutes; per-request `keep_alive` or OLLAMA_KEEP_ALIVE override; `ollama ps` shows GPU/CPU split and unload timer | Without keep_alive management, Rune's first token after 5 idle minutes pays full model load (for an 11 GB model: many seconds to minutes, worse under  | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-12 | SOURCE | A12 | Ollama faq.mdx (concurrency) | implementation-ecosystem | Parallel requests multiply the context allocation (2k ctx × 4 parallel = 8k KV memory); models must FULLY fit VRAM for concurrent load; otherwise queue | VRAM headroom on the shared 16 GB card is consumed quadratically by concurrency; Ollama will silently queue or CPU-offload rather than error | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-13 | SOURCE | A13 | Ollama issue tracker (community, reliability-labeled) | implementation-ecosystem | Multiple open/closed issues document silent context truncation: "/api/chat over-truncates history with large context (48k): trims almost everything instead of just overflow" (closed), "Context truncat | The truncation behavior Rune's family file observed is a *known, partially-unsolved defect class* in the exact runtime Rune depends on. Silent truncat | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | NOT_RECORDED_IN_ARM |
+| A4-14 | SOURCE | A14 | Ollama issue tracker (speculative decoding) | implementation-ecosystem | "Enable speculative decoding" (open); "Ollama 0.34.2 MTP speculative decoding regression with Qwen3.8 27B" (closed — MTP support exists for some model families/runners); mlxrunner speculative KV-buffe | Ollama's speculative decoding exists but is model-family-specific (MTP-head models) and regressed in the recent past; draft-model speculative decoding | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | NOT_RECORDED_IN_ARM |
+| A4-15 | SOURCE | A15 | Ollama docs/capabilities/ (embeddings, structured-outputs, tool-calling, thinking, vision, web-search, streaming) | implementation-ecosystem | Capabilities are *declared per model tag* by the registry/docs | Exactly the DECLARED-not-OBSERVED truth class the inward audit found in Rune's own config; Ollama's capability model gives Rune no observed-truth subs | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-16 | SOURCE | A16 | LM Studio docs (headless service, Idle TTL and Auto-Evict, per-load config) | implementation-ecosystem | Headless Linux service; auto-eviction of idle models (direct answer to shared VRAM); per-load context override; REST + OpenAI + Anthropic compat | Migration path candidate if Rune outgrows Ollama: same GGUF assets, explicit memory eviction policy, explicit context — two of Rune's three silent-deg | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-17 | SOURCE | A17 | Qwen team blog "Qwen2.5-Coder Series" (Nov 2024) | implementation-ecosystem | 32B-Instruct: "SOTA open-source code model, matching GPT-4o" on EvalPlus/LiveCodeBench/BigCodeBench; Aider code-repair 73.7 "comparable to GPT-4o"; McEval 65.9 across 40+ languages; MdEval 75.2; sizes | Every cited instrument is function-/snippet-level or benchmark-repair. The blog contains no SWE-bench or repo-scale agentic result at all (string-veri | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-18 | SOURCE | A18 | Qwen2.5-Coder Technical Report (2409.12186, INHERITED_VERIFIED arm 1) | implementation-ecosystem | 5.5T tokens; SOTA >10 code benchmarks at size; "repo-scale agentic coding not benchmarked in every report" (arm 1's own note) | Vendor instruments = HumanEval/MBPP/EvalPlus class | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-19 | SOURCE | A19 | SWE-bench leaderboard data (swebench.com page data parsed this session; Verified + bash-only "mini" boards) | implementation-ecosystem | The ≤14B evidence vacuum, quantified: on SWE-bench Verified, small-model entries are: RAG + SWE-Llama 7B — 0.7% resolved (2023, checked); Lingma SWE-GPT 7B — 18.2% (2024-10, unchecked submission); MCT | Across 2023-10 → 2025-11, an OPEN ≤14B model has never posted a verified agentic SWE-bench result; the two best ≤14B entries (18.2%, 23.2%) are unveri | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-20 | SOURCE | A20 | SWE-bench (2310.06770) + SWE-agent (2405.15793) (METADATA_VERIFIED) | implementation-ecosystem | The benchmark harness and the agent-computer-interface framing that all entries above inherit | Agentic coding results are agent-scaffold-dominated: same model, different harness → double-digit deltas; model-only comparisons are confounded | METADATA_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-21 | SOURCE | A21 | DeepSeek-Coder lineage (DeepSeek-Coder V2, 33B-A3.6B MoE; INHERITED from arm-1-era literature, METADATA) | implementation-ecosystem | Established the MoE pattern (large total, small active) as the local-compute answer to the capability/VRAM bind | Rune's stack has NO MoE model installed; its density-27B-IQ2_M-vs-density-14B-Q4 dilemma is an artifact of its model menu, not of the ecosystem | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-22 | POINTER | A22 | Apple Intelligence architecture — SKIPPED per mandate (arm 2 covered) | implementation-ecosystem | — | — | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-23 | SOURCE | A23 | ONNX Runtime GenAI powering Foundry Local / Windows ML (A7) | implementation-ecosystem | Microsoft ships an on-device model runtime + model catalog as an OS feature: local serving (OpenAI-compat), hardware-accelerated across CPU/GPU/NPU | Claims are scoped honestly: small/quantized models for assistant-class tasks; no claim of frontier-agentic capability offline | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-24 | SOURCE | A24 | Robotics / embodied local agents (Voyager lineage 2305.16291 INHERITED; local-first robotics stacks are typically: on-device small policy mo | implementation-ecosystem | The dominant honest pattern in shipped robotics is bounded local competence: navigation/manipulation policies run offline; open-ended language cognition stays cloud-dependent or is heavily scoped | Shipped systems do NOT claim offline open-ended agency; they claim offline *skill execution* — which is exactly the rung-5 shape (non-generative conti | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-25 | SOURCE | A25 | Local-first developer products (Ollama/LM Studio/Foundry-based assistants; local RAG products) | implementation-ecosystem | What actually ships offline: chat with retrieval, summarization, code completion (FIM), structured extraction | Honest deployments scope to: bounded generation + retrieval + extraction. None ship offline *multi-step autonomous* coding agents with quality claims; | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-26 | SOURCE | A26 | DeepSeek-R1 (2501.12948; INHERITED_VERIFIED arm 3) | implementation-ecosystem | R1-Distill-Qwen-32B > QwQ-32B-Preview on AIME/MATH/GPQA; distill-7B beats GPT-4o on AIME-2024 (55.5); distillation from 800K verified traces transmits long-CoT across base families | On competition-math-style verifiable tasks, distilled students approach/exceed same-size teachers' *benchmark* performance — but R1 itself: 49.2% SWE- | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-27 | SOURCE | A27 | phi-4 TR (2412.08905; INHERITED_VERIFIED arm 1) | implementation-ecosystem | 14B exceeds its teacher (GPT-4) on STEM QA via synthetic-data curriculum | Exceeds teacher *on the target domain measured by vendor instruments*; general chat not claimed | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-28 | SOURCE | A28 | Gemma 3 TR (2503.19786; INHERITED_VERIFIED arm 1) | implementation-ecosystem | Gemma3-4B-IT ≈ Gemma2-27B-IT; 27B-IT ≈ Gemini-1.5-Pro; trained with distillation | Generation-over-generation compression is real and large — the strongest evidence that "current-generation small ≈ previous-generation large" | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-29 | SOURCE | A29 | Quantization-of-distillates interaction (2504.04823; INHERITED_VERIFIED arm 1) | implementation-ecosystem | R1-Distill lineages are *specifically* quantization-sensitive (3-bit −5.4 to −6.3 avg on 7B; harder tasks degrade up to 4× more) | Production distillates + aggressive quantization = compounding degradation; Rune's 27B IQ2_M (2.5 bpw-class) sits below every tested floor | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-30 | SOURCE | A30 | The Curse of Recursion (2305.17493, METADATA_VERIFIED) | implementation-ecosystem | Model collapse from recursive training | "Training on generated data makes models forget" — tails of distribution lost over generations | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-31 | SOURCE | A31 | Is Model Collapse Inevitable? (2404.01413, METADATA_VERIFIED) | implementation-ecosystem | Collapse is a *data-mixing* problem | Accumulating real+synthetic with explicit non-cumulative mixing avoids collapse — collapse is not inevitable | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-32 | SOURCE | A32 | Distilled-hallucination transmission (2408.12326 DualChecker; INHERITED arm 1) | implementation-ecosystem | Teacher hallucinations propagate through KD when teacher confidence low | Patched piecemeal (re-prompting, dual-checking); never quantified systematically at scale | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-33 | POINTER | A33 | Fine-tune forgetting (2301.12726 specialization → CoT on BBH drops to 0; 2412.15115-era AgentTuning: agent-data-only FT degrades general abi | implementation-ecosystem | Catastrophic forgetting in specialization | Consistent across 3 independent groups: specialization trades generic capability, and in-distribution gains do NOT predict OOD retention | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-34 | SOURCE | A34 | Community quantized-failure reports (GGUF ecosystem; arm 1's imatrix discussion #5263 INHERITED; HuggingFace model-card practice) | implementation-ecosystem | 2-bit-class quants degraded for reasoning/coding; imatrix corpus sensitivity | Community-accepted; KL-div proxies; no systematic task-level public measurement for IQ2_M specifically | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-35 | SOURCE | A35 | Silent-truncation defect class (A13 above) | implementation-ecosystem | Prompt/embedding silent truncation in the serving layer | Open GitHub issues in ollama/ollama, including one specifically for embedding-input truncation warnings still OPEN | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | NOT_RECORDED_IN_ARM |
+| A4-36 | POINTER | A36 | Synthetic-data contamination incidents (vendor-admitted) | implementation-ecosystem | Benchmarks contaminated by training-adjacent synthetic data | phi-4 TR itself devotes its evaluation section to mitigating benchmark contamination (admits the problem class); LiveCodeBench/eval-style contaminatio | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-1 | SOURCE | 2309.02427 | Cognitive Architectures for Language Agents (CoALA) | agent-architecture | [S01] `2309.02427` | Cognitive Architectures for Language Agents (CoALA)
+- Authors / venue: Sumers, Yao, Narasimhan, Griffiths — Princeton; arXiv 2023 (TMLR-listed, v3).
+- Topic: architectural taxonom | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-2 | SOURCE | 2310.08560 | MemGPT: Towards LLMs as Operating Systems | agent-architecture | [S02] `2310.08560` | MemGPT: Towards LLMs as Operating Systems
+- Authors / venue: Packer, Wooders, Lin et al. (UC Berkeley) — arXiv 2023.
+- Topic: OS-style virtual context management; memory-as-a-modu | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-3 | SOURCE | 2402.01817 | Position: LLMs Can't Plan, But Can Help Planning in LLM-Modulo Frameworks | agent-architecture | [S03] `2402.01817` | Position: LLMs Can't Plan, But Can Help Planning in LLM-Modulo Frameworks
+- Authors / venue: Kambhampati, Valmeekam, Guan, Verma, Stechly, Bhambri, Saldyt, Murthy (ASU) — ICML 202 | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-4 | SOURCE | 2210.03629 | ReAct: Synergizing Reasoning and Acting in Language Models | agent-architecture | [S04] `2210.03629` | ReAct: Synergizing Reasoning and Acting in Language Models
+- Authors / venue: Yao, Zhao, Yu, Du, Shafran, Narasimhan, Cao — ICLR 2023.
+- Topic: interleaved thought/action/observat | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-5 | SOURCE | 2305.04091 | Plan-and-Solve Prompting | agent-architecture | [S05] `2305.04091` | Plan-and-Solve Prompting
+- Authors / venue: Wang, Xu, Lan et al. — ACL 2023.
+- Topic: plan-then-execute at the prompt level.
+- Key claims: zero-shot "devise a plan, divide the tas | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-6 | SOURCE | 2305.18323 | ReWOO: Decoupling Reasoning from Observations | agent-architecture | [S06] `2305.18323` | ReWOO: Decoupling Reasoning from Observations
+- Authors / venue: Xu, Peng, Lei et al. — arXiv 2023.
+- Topic: plan-all-tool-calls-up-front vs interleaved reasoning.
+- Key claims: m | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-7 | SOURCE | 2304.11477 | LLM+P | agent-architecture | [S07] `2304.11477` | LLM+P
+- Authors / venue: Liu, Jiang, Zhang, Liu, Zhang, Biswas, Stone — arXiv 2023.
+- Topic: LLM + classical planner hybrid.
+- Key claims: LLM translates a natural-language proble | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-8 | SOURCE | 2311.05772 | ADaPT: As-Needed Decomposition and Planning with Language Models | agent-architecture | [S08] `2311.05772` | ADaPT: As-Needed Decomposition and Planning with Language Models
+- Authors / venue: Prasad, Koller, Hartmann et al. — arXiv 2023 (NAACL 2024).
+- Topic: hierarchical decomposition  | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-9 | SOURCE | 2403.11322 | StateFlow: State-Driven Workflows for LLM Task-Solving | agent-architecture | [S09] `2403.11322` | StateFlow: State-Driven Workflows for LLM Task-Solving
+- Authors / venue: Wu, Yue, Zhang et al. — arXiv 2024.
+- Topic: explicit state machine as the control substrate.
+- Key claim | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-10 | SOURCE | 2303.17580 | HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Face | agent-architecture | [S10] `2303.17580` | HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Face
+- Authors / venue: Shen, Song, Tan et al. — NeurIPS 2023.
+- Topic: LLM-as-controller over a model catalog | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-11 | SOURCE | 2405.15793 | SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering | agent-architecture | [S11] `2405.15793` | SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering
+- Authors / venue: Yang, Jimenez, Wettig et al. — NeurIPS 2024.
+- Topic: the action space / interface as | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-12 | SOURCE | 2406.12045 | τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains | agent-architecture | [S12] `2406.12045` | τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
+- Authors / venue: Yao, Shinn, Razavi, Narasimhan — arXiv 2024 (ICLR 2025).
+- Topic: reliability of depl | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-13 | SOURCE | 2401.13178 | AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents | agent-architecture | [S13] `2401.13178` | AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents
+- Authors / venue: Ma, Zhang, Zhu et al. — NeurIPS 2024 D&B.
+- Topic: process-level (not just outcome-level) ag | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-14 | SOURCE | 2404.01744 | Octopus v2: On-device language model for super agent | agent-architecture | [S14] `2404.01744` | Octopus v2: On-device language model for super agent
+- Authors / venue: Chen, Li — arXiv 2024.
+- Topic: on-device function calling; the offline capability floor.
+- Key claims: a 2 | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-15 | SOURCE | 2407.21075 | Apple Intelligence Foundation Language Models | agent-architecture | [S15] `2407.21075` | Apple Intelligence Foundation Language Models
+- Authors / venue: Gunter, Wang, Wang et al. (Apple) — arXiv 2024.
+- Topic: audited, deployed local-first architecture (on-device mod | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-16 | SOURCE | 2312.11514 | LLM in a flash: Efficient LLM Inference with Limited Memory | agent-architecture | [S16] `2312.11514` | LLM in a flash: Efficient LLM Inference with Limited Memory
+- Authors / venue: Alizadeh, Mirzadeh, Belenko et al. (Apple) — arXiv 2023.
+- Topic: running models that exceed availab | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-17 | SOURCE | 2304.03442 | Generative Agents: Interactive Simulacra of Human Behavior | agent-architecture | [S18] `2304.03442` | Generative Agents: Interactive Simulacra of Human Behavior
+- Authors / venue: Park, O'Brien, Cai et al. — UIST 2023.
+- Topic: memory stream + reflection + retrieval scoring (the c | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-18 | SOURCE | 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | agent-architecture | [S19] `2305.16291` | Voyager: An Open-Ended Embodied Agent with LLMs
+- Authors / venue: Wang, Xie, Jiang, Mandlekar, Xiao, Zhu, Fan, Anandkumar — arXiv 2023 (TMLR 2024).
+- Topic: skill library as exec | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-19 | SOURCE | 2307.09009 | How is ChatGPT's behavior changing over time? | agent-architecture | [S20] `2307.09009` | How is ChatGPT's behavior changing over time?
+- Authors / venue: Chen, Zaharia, Zou — arXiv 2023 (Harvard Data Science Review, 2024).
+- Topic: declared capability vs observed beha | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-20 | SOURCE | 2302.04761 | Toolformer (brief) | agent-architecture | [S23] `2302.04761` | Toolformer (brief)
+- Authors / venue: Schick, Dwivedi-Yu, Dessì et al. (Meta) — NeurIPS 2023.
+- Key claims: an LM can teach itself *which* API to call, *when*, with *what argument | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-21 | SOURCE | 2305.15334 | Gorilla (brief) | agent-architecture | [S24] `2305.15334` | Gorilla (brief)
+- Authors / venue: Patil, Zhang, Wang et al. — NeurIPS 2024.
+- Key claims: GPT-4-class models fail at API calls mainly through hallucinated usage and wrong argumen | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-22 | SOURCE | 2307.16789 | ToolLLM / ToolBench (brief) | agent-architecture | [S25] `2307.16789` | ToolLLM / ToolBench (brief)
+- Authors / venue: Qin, Liang, Ye et al. — ICLR 2024.
+- Key claims: open models lag closed models at tool use because instruction tuning ignores the to | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-23 | SOURCE | 2309.15817 | ToolEmu (brief) | agent-architecture | [S26] `2309.15817` | ToolEmu (brief)
+- Authors / venue: Ruan, Dong, Wang et al. — ICLR 2024.
+- Key claims: an LM can emulate tool execution in a sandbox so agent risk cases can be found without manual | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-24 | SOURCE | 2308.00352 | MetaGPT | agent-architecture | [S27] `2308.00352` | MetaGPT
+- Authors / venue: Hong, Zhuge, Chen et al. — ICLR 2024.
+- Key claims: encode Standardized Operating Procedures into prompt sequences; assign human-like roles in an assemb | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-25 | SOURCE | 2503.13657 | Why Do Multi-Agent LLM Systems Fail? (MAST) | agent-architecture | [S28] `2503.13657` | Why Do Multi-Agent LLM Systems Fail? (MAST)
+- Authors / venue: Cemri, Pan, Yang et al. (UC Berkeley) — arXiv 2025 (ICML 2025).
+- Key claims: 1600+ annotated traces across 7 popula | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-26 | SOURCE | 2404.13501 | A Survey on the Memory Mechanism of LLM-based Agents | agent-architecture | [S29] `2404.13501` | A Survey on the Memory Mechanism of LLM-based Agents
+- Authors / venue: Zhang, Bo, Ma et al. — arXiv 2024.
+- Key claims: systematizes memory for LLM agents (what/why/how to design | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-27 | SOURCE | 2203.11171 | Self-Consistency Improves Chain of Thought Reasoning | agent-architecture | [S31] `2203.11171` | Self-Consistency Improves Chain of Thought Reasoning
+- Authors / venue: Wang, Wei, Schuurmans et al. (Google) — ICLR 2023.
+- Key claims: sample diverse reasoning paths and margina | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-28 | SOURCE | 2408.03314 | Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameters | agent-architecture | [S32] `2408.03314` | Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameters
+- Authors / venue: Snell, Lee, Xu, Kumar (UC Berkeley / Google DeepMind) — arXiv 2024.
+ | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-29 | SOURCE | 2207.05221 | Language Models (Mostly) Know What They Know | agent-architecture | [S33] `2207.05221` | Language Models (Mostly) Know What They Know
+- Authors / venue: Kadavath, Conerly, Askell et al. (Anthropic) — arXiv 2022.
+- Key claims: larger models are well-calibrated on multi | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-30 | SOURCE | 2305.14975 | Just Ask for Calibration | agent-architecture | [S34] `2305.14975` | Just Ask for Calibration
+- Authors / venue: Tian, Mitchell, Zhou, Sharma, Rafailov, Yao, Finn, Manning (Stanford) — EMNLP 2023.
+- Key claims: RLHF-tuned LMs produce poorly calibra | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-31 | SOURCE | 2412.21187 | Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs | agent-architecture | [S35] `2412.21187` | Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs
+- Authors / venue: Chen, Xu, Liang et al. — arXiv 2024.
+- Key claims: o1-like models allocate excessive comput | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-32 | SOURCE | 2503.16419 | Stop Overthinking: A Survey on Efficient Reasoning (brief) | agent-architecture | [S36] `2503.16419` | Stop Overthinking: A Survey on Efficient Reasoning (brief)
+- Authors / venue: Sui, Chuang, Wang et al. — arXiv 2025.
+- Key claims: first structured survey of efficient reasoning;  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-33 | SOURCE | 2506.06941 | The Illusion of Thinking (and its published critique) | agent-architecture | [S37] `2506.06941` | The Illusion of Thinking (and its published critique)
+- Authors / venue: Shojaee, Mirzadeh, Alizadeh et al. (Apple) — arXiv 2025; critique: `2506.09250` "Comment on The Illusion o | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-34 | SOURCE | 2305.10601 | Tree of Thoughts (brief) | agent-architecture | [S38] `2305.10601` | Tree of Thoughts (brief)
+- Authors / venue: Yao, Yu, Zhao, Shafran, Griffiths, Cao, Narasimhan — NeurIPS 2023.
+- Key claims: deliberate search over coherent "thoughts" with self-e | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-35 | SOURCE | doc:LangGraph persistence — checkpointers and stores | LangGraph persistence — checkpointers and stores | agent-architecture | - Source: docs.langchain.com/oss/python/langgraph/persistence.
+- Topic: durable agent state as a runtime property; the documented failure modes of state persistence.
+- Key claims: two complementary sy | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-36 | SOURCE | doc:Apple Private Cloud Compute — deployment architect | Apple Private Cloud Compute — deployment architecture | agent-architecture | - Source: Apple Security Research, "Private Cloud Compute: A new frontier for AI privacy in the cloud" (security.apple.com/blog/private-cloud-compute/).
+- Topic: the deployed three-tier degradation la | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-37 | SOURCE | doc:Model Context Protocol — Architecture overview | Model Context Protocol — Architecture overview | agent-architecture | - Source: modelcontextprotocol.io/docs/learn/architecture (protocol version 2026-07-28).
+- Topic: capability declaration, negotiation, freshness and staleness in a tool ecosystem.
+- Key claims: host/c | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-38 | SOURCE | doc:OpenRouter Models API | OpenRouter Models API | agent-architecture | - Source: openrouter.ai/docs/overview/models.
+- Topic: how a production model marketplace encodes capability facts and staleness.
+- Key claims: `id` is the request identifier while `canonical_slug` is | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-39 | SOURCE | doc:Letta / stateful agents | Letta / stateful agents | agent-architecture | - Source: docs.letta.com (Introduction to Stateful Agents).
+- Topic: the production lineage of MemGPT — state owned by the runtime, not the model.
+- Key claims: all state (memories, user messages, rea | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |

research/memory-atlas-r1/AD-hardware-resource-placement/00_issue_scope.md

@@ -0,0 +1,36 @@
+# #405 AD — Hardware / Resource Placement: ISSUE + Scope (R1_FULL, 2026-09-23)
+
+## Canonicalization
+- **Gitea #405** (parent #375; labels custodian/memory/memory-atlas/research). Issue body = Atlas-era mandate: requirements **R27 (minimal latency + minimal LLM consumption), R32 (cache separate from authority), R33 (rebuildable vectors/FTS/graph/cache)**; research-only; closure format per Atlas mandate §2.
+- **Folder** `AD-hardware-resource-placement/` (kept). **Master** `AD_HARDWARE_RESOURCE_PLACEMENT_R1_MASTER.md` (canonical name kept).
+- **Batched artifact preserved byte-for-byte** as `AD_HARDWARE_RESOURCE_PLACEMENT_R1_BATCHED_PRELIMINARY.md` (sha256 3088fe2e4e6b3805d6f4…).
+- **Family** Section AD (offline_intelligence_resource_placement.md) — R0 baseline, reconnaissance not authority. Registry row 405 is batched-era text — NOT inherited.
+
+## Scope (from issue + family + #404 seams + supervisory direction)
+Hardware/resource topology · CPU/GPU/VRAM/RAM/storage placement · local serving runtimes · Ollama behaviour · model inventory/quant formats · context/KV implications · loading/eviction · GPU/CPU fallback · concurrency · foreground contention · resource-starved (telemetry-defined) degradation · throughput/latency · speculative decoding requalification · multi-device/LAN topology · energy/sustained cost · hardware failure/degraded operation · embedding placement · security/isolation seam (#402) · provider/local failover where topology affects it · smaller-higher-precision vs larger-lower-precision evidence · whether 16 GB VRAM constrains the #404 ladder · portability across future hardware (not binding cognition to today's GPU) · room for the progressive-internalisation EXPERIMENT (general model → specialist → procedure/classifier/kernel) without pre-judging its success.
+
+## Inherited seams to test (not repeat)
+A. resource-starved degradation (availability ≠ practical usability: VRAM/CPU/context pressure, throughput collapse, contention, thermals) · B. foreground-wins policy at the runtime layer · C. 27B IQ2_M unmeasured — design the Rune-local experiment, fabricate no winner · D. 4-bit/W4A16 = conservative studied starting point, not universal guarantee · E. speculative-decoding requalification (feature exists ≠ applicable) · F. what hardware/runtime observations the #404 registry+gateway must expose (#406 owns evaluation logic) · G. topology must not accidentally prevent the internalisation research question.
+
+## Epistemic corrections carried (supervisory, non-reopening)
+1. The 152 deterministic modules are NOT "SOTA" unless benchmarked against relevant state of the art — the supported claim is that deterministic/classical mechanisms are legitimate first-class mechanisms for bounded task classes. 2. 4-bit/W4A16 is an evidence-backed conservative evaluation STARTING POINT in the studied evidence, not a universal theorem. 3. Bounded zero-hits are stated as such — never converted into "Rune is first/ahead".
+**Progressive internalisation: PRODUCTION = do not depend on unestablished general-reasoning compilation; RESEARCH = EXPERIMENT (falsifiable, baseline-measured, held-out, provenance-bearing, rollback-capable, kill-criteria).** NO PRIOR ART FOUND ≠ NOVELTY PROVEN.
+
+## Boundaries
+#406 owns final Growth Delta / local-capability evaluation. POST_R1_PIPELINE_UPGRADE_PENDING not applied (comparability through #406). Memory safety hold: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0. Harness 1.0 rev.2; FREEZE_ENFORCEMENT = PARTIAL (no hash-manifest). Research-only; read-only inward; no production mutation.
+
+## BOUNDARY AUDIT — interruption record (2026-09-23, appended per supervisory instruction)
+
+A supervisory instruction arrived stating that a #405 continuation prompt had been supplied "while the preceding research tranche was still executing," and directing that authority return to the preceding tranche. Verified state, recorded honestly:
+
+**The preceding tranche (#404 AC) was ALREADY cleanly sealed before any #405 work began.** Evidence: HEAD = `6d2707f` (the #404 seal commit); mirrors pushed (origin + gitea); receipts 6247 (#404) / 6250 (#375) posted; token MEMORY_ATLAS_R1_AC_SEALED emitted; its STOP condition satisfied. Re-verified read-only at boundary audit: `mutation_audit.md` and `sources.md` sealed bytes intact at 6d2707f; gates AC + AB + AA + Z + Y + X + W all consistent.
+
+**#405 mutations that had occurred before the stop:**
+1. Gitea #405 reopened + start comment 6263 (transport/reference, not research content).
+2. Three NEW untracked files in `AD-hardware-resource-placement/`: `00_issue_scope.md`, `01_inward.md`, `AD_HARDWARE_RESOURCE_PLACEMENT_R1_BATCHED_PRELIMINARY.md` (batched copy, sha 3088fe2e…).
+3. Task T34 (#405 OUTWARD) created + started.
+4. Actor `general-25` (AD arm 1) launched and then **cancelled at turn 5 having written nothing** — `02_outward/` confirmed empty.
+
+**Invalidation determination: NONE.** No #404 file was touched (git status shows no modifications under `AC-local-offline-intelligence/`); HEAD is unchanged at the #404 seal; the #404 freeze audit is domain-scoped and its freshness contract is intact; all sealed-domain gates re-verify consistent. The three #405 files are new untracked artifacts in a different domain folder — they neither stale #404's audit nor contaminate its research. **Repair: none required; evidence preserved, not deleted.**
+
+**Disposition:** the supervisory stop is honoured (no #405 research while the boundary was unverified). The boundary is now verified clean, so #405 proceeds as the queued tranche from its ISSUE + INWARD state (both already complete and preserved), relaunching OUTWARD arm 1.

research/memory-atlas-r1/AD-hardware-resource-placement/01_inward.md

@@ -0,0 +1,96 @@
+# #405 AD — INWARD: Read-Only Hardware / Resource Placement Audit (2026-09-23)
+
+Method: runtime probes (nvidia-smi, curl ollama api/ps, systemctl cat, lscpu, free, vmstat, df, ping), config reads. No changes. Everything below is observed, not declared.
+
+## A. Physical hardware (observed)
+
+- **CPU:** AMD Ryzen 9 5950X — 16 cores / 32 threads, up to 5.09 GHz.
+- **GPU:** NVIDIA RTX 4070 Ti SUPER, **16,376 MiB VRAM**. Observed at audit: 4,705 MiB used, 11,300 MiB free, 19% util, 53°C, 44 W of 225 W cap.
+- **RAM:** 62 GB total; **29 GB used, 33 available**.
+- **Swap: zram 31.4 GiB, 23.6 GiB USED** — the machine is under real sustained memory pressure (vmstat confirms ~28 GB in swap).
+- **Storage:** NVMe system disk 346G (72% full); `/mnt/workdrive` NVMe 1.8T (27%); `/mnt/fast-storage` NVMe 3.3T (69%). Ollama models live on `/mnt/fast-storage/ai/ollama` (NVMe, hot tier — matches family placement map).
+- **LAN:** host on wlan0 (192.168.1.156/24 — **wireless**, not wired); docker bridges present. **Pi 192.168.0.84 UNREACHABLE at audit time** — the family's "Pi cold backup" tier is not currently on the network (different subnet expectation 192.168.0.x vs host 192.168.1.x).
+
+## B. Ollama serving configuration (the ungoverned architecture decision, observed)
+
+Environment (systemd unit): `OLLAMA_HOST=127.0.0.1:11434` · `OLLAMA_MODELS=/mnt/fast-storage/ai/ollama` · **`OLLAMA_KEEP_ALIVE=-1`** (models NEVER unload) · **`OLLAMA_MAX_LOADED_MODELS=1`** · **`OLLAMA_NUM_PARALLEL=1`** · `OLLAMA_FLASH_ATTENTION=1` · `OLLAMA_KV_CACHE_TYPE=q8_0`.
+
+**Observed runtime state (/api/ps):** only nomic-embed-text resident (308 MB VRAM, **context_length 2048** — the family file's silent-drift claim VERIFIED against live state), `expires_at 2319` — pinned forever by KEEP_ALIVE=-1.
+
+**Contradictions between declared and observed:**
+1. `MAX_LOADED_MODELS=1` + `NUM_PARALLEL=1` = **strictly serialized inference** — the architecture cannot serve an embedding lookup and a generation simultaneously. The #404 "keep embedding resident, load LLM on demand" design is currently IMPOSSIBLE without a config change (each LLM load evicts or blocks the embedder under the 1-model cap — observed: only nomic is ever resident).
+2. `KEEP_ALIVE=-1` was presumably set for embedding latency, but it means an 11 GB 27B model, once loaded, stays resident forever — permanently eating VRAM headroom against user foreground work (Discord/browser/LibreOffice currently hold ~800 MB and grow with gaming).
+3. No `OLLAMA_CONTEXT_LENGTH` override exists → every model gets its default context; nomic confirmed at 2048 (family file verified). Context is per-model default, ungoverned, hardware-dependent per arm-4's #404 finding (VRAM-scaled defaults).
+4. KV cache q8_0 + flash attention: reasonable, but declared, never validated by measurement.
+
+## C. Model inventory × quantization × VRAM arithmetic (placement map, observed sizes)
+
+| Model | Disk | Est. VRAM @ load | Role | Fits 16GB alongside ~1–2GB desktop GPU use? |
+|---|---|---|---|---|
+| Qwen3.8-27B-Uncensored IQ2_M | 11 GB | ~11–12 GB (KV excl.) | config-default generalist | **marginal** — near-full card, KV adds more |
+| Qwen3.6-27B-Fable IQ2_M | 12 GB | ~12+ GB | duplicate-class generalist | marginal |
+| qwen3:14b | 9.3 GB | ~9.5–10.5 GB | generalist (higher precision per arm-1 evidence) | yes, tight w/ KV |
+| qwen2.5-coder:14b | 9.0 GB | ~9.5 GB | coding | yes, tight w/ KV |
+| qwen2.5:7b / 3b | 4.7/1.9 GB | ~5/2.2 GB | small tasks | yes |
+| qwen2.5vl:3b, llava:7b | 3.2/4.7 GB | ~3.5/5 GB | local multimodal (#403) | yes |
+| nomic-embed (F16, 308 MB VRAM) / qwen3-emb 0.6B (639 MB disk) / mxbai | small | ~0.3–0.8 GB | embeddings | yes — embedder residency is cheap |
+
+**Two 27B IQ2_M models duplicate the same generalist niche (11+12 GB, neither measured on any task — #404 E13 still owed).** The embedder residency is trivial; the LLM slot is the scarce resource.
+
+## D. Foreground contention (observed, live)
+
+8 GPU compute/graphics processes at audit (kwin_wayland, Discord renderer, Brave GPU process, LibreOffice, Rune's own TUI python). Desktop compositing is a permanent ~500–800 MB VRAM tenant; gaming would add several GB. **The "foreground wins" policy (#404) is currently unimplemented AND unimplementable through Ollama's config** — no preemption hook exists; the only lever is MAX_LOADED_MODELS/KEEP_ALIVE.
+
+## E. Resource-starved behaviour (observed risk surface)
+
+- zram at 23.6G used: model loading into RAM (CPU inference path, mmap) competes with swap pressure — load times and page-in latency are non-deterministic under memory pressure.
+- No telemetry exporter, no tok/s logging, no VRAM-headroom alert: **resource starvation is currently invisible** (#404 forced correction 1 unaddressed — confirmed).
+- GPU thermals/power fine at idle (53°C/44 W); sustained multi-tenant inference + gaming untested.
+
+## F. Multi-device / LAN topology
+
+- Pi (family's cold tier) unreachable — backup tier is currently NOT operating; bit-rot risk (family adversarial note) unmitigated by verification drills.
+- Rune is the only inference-capable node. No second GPU, no model server elsewhere. Portability across future hardware = the architecture must not assume this exact card (C006-family requirement, R36).
+
+## G. Deterministic/no-model layer requirements (observed)
+
+SQLite 436 MB + FTS5 + sqlite-vec: entire store ≈ 436 MB — trivially RAM/NVMe-resident (family arithmetic confirmed at this scale); 152 modules are CPU-only; no GPU dependency anywhere in the deterministic layer. The whole no-model Rune needs ~0.5 GB RAM — hardware triviality CONFIRMED at family scale.
+
+## H. Security/isolation seam
+
+Ollama serves on **127.0.0.1 only** (correct — #402 loopback discipline); runs as a SYSTEM service (`/var/lib/ollama` home) — model execution context is a distinct uid from `nick`, which is a mild isolation positive but does NOT contain a malicious model (same-root reachability per #402). No containerization of inference.
+
+## I. Failure/degraded behaviour (observed surface, unexercised)
+
+Ollama down → embeddings fail silently (carried #403/#404 defect); GPU OOM → model load failure (behaviour unexercised); Pi offline → no backup (observed NOW). No runbook, no health probes, no alerts.
+
+## Classification (mandate vocabulary)
+
+- **ACTIVE (5):** Ollama system service; 11-model inventory on NVMe hot tier; embedding pipeline (pinned); NVMe placement (models + SQLite); CPU deterministic layer.
+- **PARTIAL (4):** VRAM headroom (11.3 GB free now, contested by design); GPU contention handling (observed, unmanaged); multi-device topology (host + unreachable Pi); storage tiers (fast-storage hot tier correct; warm/cold tiers unexercised).
+- **DORMANT (3):** qwen3-embedding:0.6b + mxbai (installed, unwired); Pi cold-backup tier (unreachable); speculative-decoding capability (needs llama.cpp/vLLM).
+- **ABSENT (7):** serialization relief (MAX_LOADED_MODELS=1 blocks embedder+LLM co-residency); foreground-preemption hook; resource telemetry (tok/s, VRAM headroom, context headroom); KV/context governance (no override, VRAM-scaled defaults); backup verification drills; containerized inference isolation; load/unload policy tied to model value.
+- **BYPASS (2):** frontier providers (ad-hoc, no policy — carried); KEEP_ALIVE=-1 as an implicit "always resident" architecture decision made by environment variable.
+- **UNKNOWN (2):** real throughput/latency of each installed model on Rune tasks (no probe run — read-only discipline); sustained thermal/power behavior under gaming+inference.
+- **CONFLICTING (1):** KEEP_ALIVE=-1 (never unload) vs the foreground-wins policy — the strongest single contradiction between declared config and the adopted architecture.
+
+## Current-state honesty
+
+**Rune has hardware, not a placed architecture.** Models are stored well (NVMe), the embedder is pinned (accidentally serving the family's keep-alive recommendation), but: serialization (MAX_LOADED_MODELS=1) contradicts the designed embedder+LLM co-residency; KEEP_ALIVE=-1 contradicts foreground-wins; context defaults are ungoverned; the cold tier is offline; nothing is measured; nothing is governed. INSTALLED ≠ AVAILABLE ≠ CAPABLE ≠ ADEQUATE ≠ GOVERNED ≠ PREFERRED — the machine currently implements INSTALLED and stops there.
+
+## J. Inward corrections + verifications (2026-09-23, post-arm-1 evidence)
+
+1. **Power: CORRECTION to this file's earlier wording.** The 4070 Ti SUPER's rated TGP is **285 W** (arm-1 metadata source); the observed **225 W is an enforced power LIMIT** — nvidia-smi reports both `Current Power Limit` and `Requested Power Limit` at 225.00 W, i.e. the cap is explicitly configured, not the card's rating. Earlier phrasing ("225 W card") is corrected here; any downstream artifact repeating it must carry the correction. This also means arm-1's power-capping evidence (−23% energy for +6.7% time, 250→175 W) is directly relevant: Rune already runs capped.
+2. **SQLite version: family WAL-reset caveat SATISFIED.** Observed 3.53.4 (python sqlite3 and CLI agree) — well past the family's 3.51.3 fix floor. R0-1's "keep current" is CONFIRMED with headroom.
+3. **Store I/O mode (observed):** `journal_mode=wal` · `synchronous=2` (FULL — safer than the family's suggested NORMAL) · **`mmap_size=0` (memory-mapped I/O DISABLED)** · page_size 4096. At 436 MB the store is trivially resident either way; the family's "optional mmap_size" recommendation is currently NOT applied — recorded as an unexercised option, not a defect.
+4. **GPU tenant check:** 8 compute/graphics processes at audit (kwin_wayland, Discord, Brave GPU, LibreOffice, Rune TUI python) ≈ 4.7 GB VRAM — the desktop floor that any model placement must subtract from 16,376 MiB.
+
+## K. Contested-claim resolution (2026-09-23): the "152 modules / 436 MB" figures
+
+Arm 3 reported these figures as **unreproducible** ("found 213 .py, 180/220 KB memory.db"). **Direct re-measurement REFUTES arm-3's refutation — the original figures are CONFIRMED for the user-level Rune deployment:**
+
+- **152 modules: CONFIRMED** — `~/.config/opencode/scripts/*.py` = 129 + `~/.config/opencode/shared/*.py` = 23 = **152**.
+- **436 MB store: CONFIRMED** — `~/.config/opencode/memory/store/` = **436 MB**; `store/memory.db` = **435.8 MB** (single file). The wider `~/.config/opencode/memory/` tree is 650 MB (journal 105 MB, transcripts 78 MB, memory-versions 13 MB, research 7.5 MB).
+- Arm-3's counter-numbers measure a **different population**: the harness *repo* (`src/rune/` = 164 .py; repo-wide .py far higher) and some smaller DB found under the repo, not the deployed Rune stores.
+
+**Resolution for the ledger:** both sets of numbers are real; they measure different populations. The correct discipline — and the finding — is that any inward figure must **name its population** (user-level deployment vs repo vs venv). The load-bearing arithmetic (deterministic core ≈ CPU-only, small relative to model files) survives either way: 436 MB ≪ 11 GB model files; the core is CPU-only in both populations. Arm-3's *caveat* that "SQLite size ≠ RSS" is accepted as valid and independent of the population confusion.

research/memory-atlas-r1/AD-hardware-resource-placement/02_outward/arm1_hardware_foundations.md

@@ -0,0 +1,196 @@
+# #405 AD — Arm 1: Hardware / Runtime Foundations (OUTWARD, research-only)
+
+**Date:** 2026-09-23 · **Domain:** #405 Hardware / Resource Placement · **Harness:** R1 1.0 rev.2 · **Read-only inward, no production mutation.**
+
+Verification discipline applied: every arXiv ID re-verified via export.arxiv.org (batch id_list + title search) this session. **8 mis-paired IDs were caught** — including 7 in the prompt's candidate list and 1 of arm-1's own first-pass guesses. Prompt-supplied IDs were treated as candidates, never as truth. Negative results recorded as findings.
+
+---
+
+## PART 1 — SOURCE ROWS
+
+Depth legend: FULL_PAPER (whole text read via ar5iv/full HTML) · RELEVANT_SECTIONS (targeted sections read) · DOCUMENTATION_AUDITED (official docs read this session, never labeled FULL_PAPER) · ABSTRACT_ONLY (verified abstract) · METADATA_VERIFIED (title/authors/venue verified, content not read) · INHERITED_VERIFIED (verified in sealed #404 arms, carried per mandate) · COMMUNITY_EVIDENCE_RELIABILITY_LABELED (community measurement, reliability-labeled per harness).
+
+### A. Decode bandwidth / roofline evidence
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A1 | arXiv:2312.12456 | PowerInfer: Fast LLM Serving with a Consumer-grade GPU — Song, Mi, Xie, Chen (SJTU IPADS), 2023/2024, **SOSP 2024** | GPU-CPU hybrid local inference | **Explicit roofline arithmetic (§6, Eq. 5): computation time of a neuron ≈ its weight bytes ÷ memory bandwidth of the unit** — the citable source for tokens/s ≈ bandwidth ÷ active-model-bytes at small batch. Measured: FP16 avg 8.32 t/s, INT4 avg 13.20 t/s (RTX 4090); beats llama.cpp up to 11.69× (FP16) / 8.0× (INT4); OPT-30B on 4090 reaches 82% of an A100's generation rate. FlexGen loses **>99.5% of time to CPU→GPU weight transfer**; llama.cpp layer-offload ≈ 600 ms/iter for 30B vs 45 ms on A100. Computing cold neurons directly on the CPU beats shipping them to GPU for batch < 32 (Fig. 6). PCIe 4.0 = 64 GB/s; PC-High host RAM bandwidth 67.2 GB/s; PC-Low 38.4 GB/s | LLaMA2-SwiGLU-13B sparsity only 43% → smaller PowerInfer gains on SwiGLU models (Qwen-family class) | ReLU-sparsity-centric; predictors need offline profiling per model; OPT/LLaMA-era models | RELEVANT_SECTIONS (ar5iv) | Directly Rune's topology: 5950X + single consumer GPU. Quantifies why GPU-resident decode dominates and why CPU fallback is ~an order of magnitude slower; PCIe transfer cost explains why partial offload is the worst regime |
+| A2 | arXiv:2306.07629 | SqueezeLLM: Dense-and-Sparse Quantization — Kim, Hooper, Gholami, Dong, Li, Shen, Mahoney, Keutzer, 2023, **ICML 2024** | Quantization + decode bottleneck | Abstract states verbatim: **"the main bottleneck for generative inference with LLMs is memory bandwidth, rather than compute, specifically for single batch inference"** — the cleanest peer-reviewed statement of the single-stream roofline. 3-bit sensitivity-uniform PTQ narrows the FP16 perplexity gap up to 2.1× vs prior SOTA at equal memory; up to 2.3× wall-clock speedup on A6000 | Naive uniform low-bit PTQ degrades — the paper's whole premise | Pre-GQA models; 3-bit floor for its method | ABSTRACT_ONLY (ID verified 2306.07629) | Anchors the bandwidth-bound verdict for Rune's bs=1 workloads; supports "4-bit weight-only = conservative start" (inherited #404) with a memory-equalized comparison method |
+| A3 | arXiv:2408.11743 | MARLIN: Mixed-Precision Auto-Regressive Parallel Inference on LLMs — Frantar, Castro, Chen, Hoefler, Alistarh, 2024, IST Austria | W4A16 kernel / batch effect on memory-boundness | Quantization yields "substantial speedups for **single-user inference** due to reduced memory movement"; W4A16 kernels can stay memory-bound up to **batch 16–32** (≈4× speedup preserved), degrading gradually to 64–128; 2.8× end-to-end in vLLM | Speedup does NOT survive unbounded batching — compute becomes co-limiter | Kernel-level (per-layer) results; end-to-end on vLLM only | ABSTRACT_ONLY (verified) | Confirms Rune's regime (bs=1) is exactly where quantization speedup is maximal and bandwidth-bound; also bounds when batching would erode it |
+| A4 | llama.cpp discussion #5421 | "Performance difference between Ryzen 3700X and Ryzen 5950X" — JohannesGaessler (llama.cpp collaborator), 2024-02, GGUF ecosystem | **Measured CPU decode on the exact CPU class Rune has** | LLaMA-2 7B q4_0, DDR4-3200, CPU-only: **tg128 = 11.00 t/s on 5950X** (9.93 on 3700X); pp512 41.15 t/s. With the whole model on an RTX 3090: tg128 = 133 t/s and the CPU upgrade changes throughput by only 1.01× | CPU speedup matters only when the CPU is doing the decoding (1.67× pp) or offloading; full-GPU → negligible | Community post (collaborator-authored, reproducible via llama-bench); 7B q4_0 not 14B | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | The single best measured CPU datapoint for Rune: 5950X @ DDR4-3200 decodes 7B q4_0 at ~11 t/s ⇒ ~4–5 t/s for a 14B Q4 (bytes scale ~2.3×, bandwidth fixed). GPU/CPU gap ≈ 12× on Rune-class hardware |
+| A5 | r/LocalLLaMA "Extensive llama.cpp benchmark… CPU 7b–30b" (2023, community) | Community CPU benchmark thread | CPU decode sensitivity to RAM speed | "Text generation is RAM-bound"; DDR4-4000→DDR6-6000 gave +15–28% t/s depending on core count; prompt processing is compute-bound | — | Anecdotal thread, unreviewed, numbers not audited this session | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | Confirms directionally (RAM-bandwidth-bound CPU decode); explains why Rune's 5950X bottleneck is the memory channel, not the 16 cores |
+
+### B. KV cache / context arithmetic
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| B1 | arXiv:2309.06180 | Efficient Memory Management for LLM Serving with PagedAttention — Kwon, Li, Zhuang, Sheng, Zheng, Yu, Gonzalez, Zhang, Stoica, 2023, **SOSP 2023** | KV cache size, fragmentation, batching, preemption | **KV per token, measured example (§3): OPT-13B = 2 × 5120 (hidden) × 40 (layers) × 2 B (FP16) = 800 KB/token → up to 1.6 GB per request at 2048 tokens.** Memory split at 13B/A100: ~65% weights, ~30% KV, small activations. Prior systems' effective KV utilization as low as **20.4%** (fragmentation). vLLM: 2–4× throughput vs FasterTransformer/Orca at equal latency; improvement grows with sequence length/model size. Preemption = swap KV to CPU RAM or recompute; all-or-nothing eviction | None claimed | OPT/LLaMA-era; contiguous-KV strawman is their baseline | RELEVANT_SECTIONS + FULL abstract (ar5iv, §1–5 + eval read) | Source of Rune's KV formula: bytes/token = 2 × layers × kv_heads × head_dim × dtype-bytes. Also documents that KV waste (not just KV size) ate most serving memory — Rune's single-user Ollama pre-allocates full context |
+| B2 | arXiv:1911.02150 | Fast Transformer Decoding: One Write-Head is All You Need (MQA) — Shazeer, 2019, Google | KV reduction mechanism | Incremental decoding is slow "due to the **memory-bandwidth cost of repeatedly loading the large keys and values tensors**"; MQA shares one KV head across all heads, "greatly reducing" those tensors; minor quality loss | — | Pre-GQA; trained-from-scratch MQA | ABSTRACT_ONLY (verified; NOTE — prompt candidate 1912.01703 is the PyTorch paper, MIS-PAIRED) | The mechanism citation behind GQA's KV saving that Rune's Qwen models exploit |
+| B3 | arXiv:2305.13245 | GQA: Training Generalized Multi-Query Transformer Models from Multi-Head Checkpoints — Ainslie, Lee-Thorp, de Jong, Zemlyanskiy, Lebrón, Sanghai, 2023, **EMNLP 2023** | GQA KV arithmetic | GQA (intermediate # KV heads) reaches MHA-quality with MQA-like decode speed; 8 KV heads vs 40 = **5× KV-cache reduction** vs MHA at equal head_dim, at ~equal quality | MQA (1 KV head) can degrade quality — GQA is the compromise | Uptraining recipe era | ABSTRACT_ONLY (verified) | Rune's Qwen3/Qwen2.5-14B both use 8 KV heads of 40 — the reason a 14B is servable at all in 11.3 GB free VRAM |
+| B4 | Qwen/Qwen3-14B config.json | HF config (Qwen Team, 2025) | KV arithmetic inputs | **40 layers, 40 Q heads, 8 KV heads, head_dim 128, hidden 5120, native context 40,960** (rope_theta 1M) | — | Config only | DOCUMENTATION_AUDITED | KV/token: 2×40×8×128×2 B = **160 KiB (f16) / 80 KiB (q8_0)** → 8k ctx = 1.25/0.625 GiB; 32k = 5.0/2.5 GiB; 40,960 = 6.25/3.125 GiB |
+| B5 | Qwen/Qwen2.5-14B config.json | HF config (Qwen Team, 2024) | KV arithmetic inputs | **48 layers, 40 Q heads, 8 KV heads, head_dim 128 (5120/40), native context 131,072** | — | Config only | DOCUMENTATION_AUDITED | KV/token: **192 KiB (f16) / 96 KiB (q8_0)** → 8k = 1.5/0.75 GiB; 32k = 6/3 GiB; at native 128k = 24/12 GiB (i.e. the coder's 128k window is a VRAM fiction on this card) |
+| B6 | unsloth/gemma-3-27b-it config.json (ungated mirror of google/gemma-3-27b-it) | Gemma Team 2025 (mirror) | 27B-class KV + sliding window | **62 layers, 32 Q heads, 16 KV heads, head_dim 128, sliding_window 1024 with pattern 6** (5 local : 1 global attention layers) | — | Mirror config; gated original not directly read | DOCUMENTATION_AUDITED | Naive 27B KV: 2×62×16×128×2 = **496 KiB/token f16** → 32k would be 15.4 GB (impossible). With SWA (llama.cpp `--swa-full` default false), only ~11 global layers grow: ≈ 88 KiB/token + ~0.43 GB fixed → 8k ≈ 1.1 GB, 32k ≈ 3.2 GB f16. **"Fits in VRAM" must always be evaluated per-architecture, not per-parameter-count** |
+| B7 | llama.cpp tools/server README | ggml-org, master, accessed 2026-09-23 | SWA cache, KV types, fit | `--swa-full` "use full-size SWA cache (default: false)"; KV cache types incl. q8_0/q4_0 per K and V (`-ctk/-ctv`, default f16); `--fit` auto-adjusts context to device memory (`--fit-ctx` min 4096); `--cache-ram` default 8192 MiB | — | Docs | DOCUMENTATION_AUDITED | Confirms Rune-class runtimes default to capped SWA and can auto-fit context to free VRAM — capabilities Ollama does not expose |
+
+### C. Size-vs-precision frontier
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| C1 | arXiv:2212.09720 | The case for 4-bit precision: k-bit Inference Scaling Laws — Dettmers & Zettlemoyer, 2022/2023, **ICML 2023** | Size-vs-precision at equal total bits | 35,000 zero-shot experiments, 19M–176B, BLOOM/OPT/NeoX/Pythia/GPT-2: **"4-bit precision is almost universally optimal for total model bits and zero-shot accuracy"** — i.e., at equal memory a bigger 4-bit model beats a smaller 8-bit one; only small block size + dtype choice improve the trade | "Challenging to improve the bit-level scaling trade-off" — most quant innovations don't move the frontier | Zero-shot tasks; pre-2023 models; no reasoning-benchmark breakdown (per inherited #404: reasoning degrades more) | ABSTRACT_ONLY (verified; prompt candidate 2306.03030 is CMExam — MIS-PAIRED) | The canonical support for Rune running 14B-Q4 rather than 7B-Q8 — with the inherited caveat that reasoning-heavy tasks degrade up to 4× more (2504.04823) |
+| C2 | arXiv:2401.06118 | Extreme Compression of LLMs via Additive Quantization (AQLM) — Egiazarian, Panferov, Kuznedelev, Frantar, Babenko, Alistarh, 2024, **ICML 2024** | ≤2–3 bit regime | First Pareto-optimal accuracy-vs-size **below 3 bits**; needs learned additive multi-codebook quantization + joint cross-layer optimization + custom GPU/CPU kernels to match FP16 speed | Naive/standard PTQ (GPTQ-class) is NOT Pareto-optimal below 3 bits — the plain 2-bit regime is where naive methods break | Heavy compute to quantize; codebook kernels not in llama.cpp/Ollama | ABSTRACT_ONLY (verified) | Rune's IQ2_M sits in the regime AQLM shows requires far more machinery than GGUF IQ2 quants have → depresses expectations for the unmeasured 27B IQ2_M (consistent with inherited #404 E13) |
+| C3 | arXiv:2306.07629 (row A2, dual-listed) | SqueezeLLM | Very-low-bit mechanisms | Sensitivity-based non-uniform quantization + dense-and-sparse outlier decomposition = the mechanism needed at 3-bit; uniform low-bit fails on outliers | Naive PTQ degradation is the paper's motivating negative | — | ABSTRACT_ONLY | Explains the failure mechanism (outliers) Rune's IQ2_M is exposed to |
+| C4 | INHERITED: 2504.04823 (Quantization Hurts Reasoning, Huawei Noah) + 2210.17323 (GPTQ) + 2402.17764 (BitNet b1.58) | verified in #404 AC arms | Quantization × task difficulty | W3 loses 5.4–6.3 avg points on 7B reasoning; harder tasks degrade up to 4× more; GPTQ calibration-domain sensitivity −9.8 pts; BitNet parity does NOT transfer to PTQ models | Direct 27B-IQ2M-vs-14B-Q4 study: zero hits (bounded zero-hit, #404) | — | INHERITED_VERIFIED | Carried, not re-researched. Combined with C1–C3: the "bigger-quantizes-better" bound holds for zero-shot/general tasks; for Rune's reasoning-heavy agent work the frontier can break below ~3.5 bpw, and IQ2_M is below the studied floor |
+
+### D. Speculative decoding
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| D1 | INHERITED: arXiv:2211.17192 (Leviathan et al., ICML 2023) + arXiv:2302.01318 (Chen et al., DeepMind) | Speculative decoding / speculative sampling | Lossless mechanics | Acceptance-rate-dependent speedup, distribution-preserving guarantee | — | — | INHERITED_VERIFIED | The lossless contract any Rune acceleration must satisfy |
+| D2 | arXiv:2401.15077 | EAGLE: Speculative Sampling Requires Rethinking Feature Uncertainty — Li, Wei, Zhang, Zhang, 2024, ICLR 2025-track | Feature-level drafting | LLaMA2-Chat 70B: **2.7–3.5× latency speedup**, doubled throughput, distribution preserved | — | Needs per-target trained draft head | ABSTRACT_ONLY (verified) | Upper bound of what a trained draft buys; requires a Qwen3-14B EAGLE head (availability unverified) |
+| D3 | arXiv:2503.01840 | EAGLE-3: Scaling up Inference Acceleration via Training-Time Test — Li, Wei, Zhang, Zhang, 2025 | Trained draft head, SOTA | **Up to 6.5× speedup; ~1.4× over EAGLE-2; 1.38× throughput at batch 64 in SGLang**; works on chat AND reasoning models | Data-scaling alone helped vanilla EAGLE little — method change was needed | Per-model training | ABSTRACT_ONLY (verified) | Best-case ceiling; llama.cpp now exposes `--spec-type draft-eagle3` (row D7) so the mechanism is reachable — the binding constraint is head availability for Qwen3-14B |
+| D4 | arXiv:2310.18813 | The Synergy of Speculative Decoding and Batching in Serving LLMs — Su, Giannoula, Pekhimenko (EcoSystem), 2023 | SD × batch interaction | **Optimal speculation length depends on batch size**; fixed-length speculation is suboptimal; adaptive strategy matches/beats SOTA | Fixed draft length tuned for one batch size is wrong at another | Characterization study | ABSTRACT_ONLY (verified) | At Rune's bs=1, longer speculation is optimal — the regime where SD helps most |
+| D5 | arXiv:2406.14066 | TurboSpec: Closed-loop Speculation Control — Liu, Park, Hu, Kwon, Li, Zhang, Du, Mo, You, Cheung, Deng, Stoica, Zhang, 2024/2025 | SD can hurt | **"Speculative decoding may degrade LLM serving performance if added naively without tuning"**; proposes goodput-driven dynamic control in vLLM | Naive SD = a performance risk, not a free win | vLLM implementation | ABSTRACT_ONLY (verified) | Mandates measure-before-adopt for Rune's speculative requalification (seam E) |
+| D6 | arXiv:2402.01528 | Decoding Speculative Decoding — Yan, Agarwal, Venkataraman, 2024, **NAACL 2025** | What determines SD gains | 350+ experiments (LLaMA-65B, OPT-66B): gains **"depend heavily on the latency of the draft model"**; draft LM quality does NOT correlate with SD performance; hardware-aware draft = +111% throughput vs existing drafts | Draft model capability ≠ SD value — a small-but-slow draft is worthless | Large-model setting | ABSTRACT_ONLY (verified; candidate 2402.00297 = spintronics — MIS-PAIRED) | Rune's draft must be fast (0.5B–1.5B, GPU-resident); a CPU-side draft would negate gains |
+| D7 | llama.cpp tools/server README (docs) | ggml-org, master | SD runtime support | `--spec-type` = none, draft-simple, **draft-eagle3**, **draft-mtp**, draft-dflash, draft-dspark, ngram-simple, ngram-map-k, ngram-mod, ngram-cache; separate draft KV types; lookup caches (`--lookup-cache-static/dynamic`) | — | Docs; no bundled benchmarks | DOCUMENTATION_AUDITED | Ollama exposes NONE of this. Cheapest Rune experiment: `ngram-cache`/lookup decoding = **zero extra VRAM, no draft model**; classic draft = +0.6–1.2 GB VRAM (0.5B–1.5B Q8/Q4) |
+| D8 | vLLM docs — features/speculative_decoding | vLLM project, accessed 2026-09-23 | SD support + applicability | Doc states SD targets "**medium-to-low QPS … memory-bound workloads**" (exactly Rune); methods: EAGLE, MTP, draft model, ngram, suffix, PARD, MLP; documented lossless guarantees (rejection-sampler + greedy-equality tests); known incompatibilities listed | Pipeline parallelism incompatible with SD (≤0.15.0) | Docs | DOCUMENTATION_AUDITED | Confirms single-user = the SD-favorable regime per the runtime's own docs |
+
+### E. Batching / concurrency
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| E1 | arXiv:2403.02310 | Taming Throughput-Latency Tradeoff in LLM Inference with Sarathi-Serve — Agrawal, Kedia, Panwar, Mohan, Kwatra, Gulavani, Tumanov, Ramjee, 2024, OSDI 2024 | Chunked prefill, batching interference | Decode iterations have low compute utilization ("a decode iteration processes only a single token per request") → batching highly effective for decodes; interleaved prefill stalls decodes; chunked prefill gives 2.6× (Mistral-7B, 1×A100) to 5.6× (Falcon-180B) serving capacity **under tail-latency constraints** | Batching without scheduling hurts latency — the tradeoff is real | Datacenter batch workloads | ABSTRACT_ONLY (verified) | The throughput numbers require many concurrent requests Rune will never have; the interference mechanism (prefill stalls decode) IS relevant if Rune ever co-schedules embedding+generation in one process |
+| E2 | arXiv:2401.09670 | DistServe: Disaggregating Prefill and Decoding — Zhong, Liu, Chen, Hu, Zhu, Liu, Jin, Zhang, 2024, **OSDI 2024** | Prefill/decode interference | Colocated prefill-decode causes "strong prefill-decoding interferences"; per-phase SLOs (TTFT vs TPOT) conflict; disaggregation: 7.4× more requests or 12.6× tighter SLO | — | Multi-GPU serving | ABSTRACT_ONLY (verified) | Single-user analogue: a big prompt (prefill) freezes Rune's decode — measurable as TTFT spikes; not fixable by batching |
+| E3 | Ollama FAQ.md + api.md | ollama/ollama main, 2026-09-23 | NUM_PARALLEL semantics | `OLLAMA_NUM_PARALLEL` — "Required RAM will scale by NUM_PARALLEL × CONTEXT_LENGTH"; example: "a 2K context with 4 parallel requests will result in an 8K context and additional memory allocation"; concurrent model loads require the new model to **completely fit in VRAM**; default MAX_LOADED_MODELS = 3×GPU count | — | Docs | DOCUMENTATION_AUDITED | Verifies inward contradiction (a): KV/request multiplication is why NUM_PARALLEL=1 is VRAM-rational on 16 GB; the harmful part is MAX_LOADED_MODELS=1 (embedder co-residency), not NUM_PARALLEL |
+
+### F. Load / eviction / memory pressure
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| F1 | llama.cpp server README (docs) | ggml-org, master | mmap / mlock / pageouts | `--load-mode`: **auto = mmap default**; `mlock` = "force system to keep model in RAM rather than swapping or compressing"; `none` = "slower load **but may reduce pageouts if not using mlock**"; `dio` = DirectIO; lazy-mode reads large tensors from disk on demand (mmap required); `--sleep-idle-seconds` unloads model+KV from RAM on idle | — | Docs (mechanism, not timings) | DOCUMENTATION_AUDITED | llama.cpp documents the exact failure mode Rune is exposed to: mmap'd model pages evicted under RAM pressure → page-in stalls mid-inference. Ollama (llama.cpp-derived) inherits the mechanism; `use_mmap` is even an Ollama API option (row F4) |
+| F2 | arXiv:2312.11514 | LLM in a flash — Alizadeh, Mirzadeh, Belenko, Khatamifard, Cho, Del Mundo, Rastegari, Farajtabar (Apple), 2023, **ACL 2024** | Flash-resident weights | Naive on-demand flash loading is **20–25× slower (GPU) / 4–5× slower (CPU)** than DRAM-resident inference; windowing + row-column bundling enables models up to 2× DRAM size | Naive paging of weights = catastrophic; only with hardware-aware layout is it viable | Mobile flash (iPhone-class) | ABSTRACT_ONLY (verified; prompt candidate 2310.11470 is a textbook chapter — MIS-PAIRED) | Quantifies the page-in penalty when model bytes aren't resident — the NVMe/zram analogue for Rune's 9–12 GB models under 23.6 GiB swap pressure |
+| F3 | arXiv:2303.06865 | FlexGen — Sheng, Zheng, Yuan, Li, Ryabinin, Fu, Xie, Chen, Barrett, Gonzalez, Liang, Ré, Stoica, Zhang, 2023, ICML 2023 | Offload hierarchy | OPT-175B on a single 16 GB GPU at **1 token/s** (batch 144) via GPU+CPU+disk aggregation; 4-bit weights AND 4-bit attention cache | Throughput-optimal = latency-hopeless (PowerInfer: >99.5% transfer time) | Latency-insensitive batching only | ABSTRACT_ONLY (verified; prompt candidate 2303.06974 is cosmology — MIS-PAIRED) | Defines the floor: disk-resident inference ≈ 1 t/s-class. Rune's fallback regime (VRAM+RAM exhausted) sits between this and CPU-RAM decode |
+| F4 | Ollama api.md | ollama/ollama main | Load telemetry | Response stats include **`load_duration`** (ns), `prompt_eval_*`, `eval_duration`; `keep_alive` per request (default 5m; −1 forever; 0 immediate unload) **overrides** `OLLAMA_KEEP_ALIVE`; options include `use_mmap`, `num_gpu`, `num_ctx` per request | — | Docs | DOCUMENTATION_AUDITED | Two governable levers exist that the inward audit missed: (1) per-request keep_alive can implement foreground-wins without env changes; (2) load_duration is a built-in load-churn telemetry source |
+| F5 | Linux zram + LLM-under-swap literature | — | RAM pressure | **Bounded zero-hit: no peer-reviewed or systematically-measured study of LLM inference latency under zram/swap pressure was found** in this arm's searches; kernel zram docs describe compressed in-RAM swap but contain no inference workload data | Zero-hit recorded as a finding (memory-pressure degradation on Rune is UNMEASURED, not negligible) | — | NOT FOUND (honest zero) | Rune's 23.6 GiB zram usage + mmap'd 9–12 GB models = the highest-uncertainty hardware interaction on the machine; must be probed, not assumed |
+
+### G. Serving runtimes (feature surface, docs-audited)
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| G1 | llama.cpp server README (ggml-org/llama.cpp, master) | — | llama.cpp feature surface | Grammar: `--grammar`/`--grammar-file` (GBNF) + `-j --json-schema`; speculative: draft/EAGLE-3/MTP/ngram; multi-GPU: `-sm {none,layer,row,tensor}` + `--tensor-split`; context per-instance (`-c`), `--fit` auto-fit; continuous batching on by default; `--parallel N` slots; metrics endpoint; router mode with per-model load/unload + presets; sleep-on-idle | — | Docs | DOCUMENTATION_AUDITED | The only audited runtime that answers YES to all five: grammar, speculative, per-model context, embed+generate (separate `--embedding` instance or router), idle eviction (`--sleep-idle-seconds`) |
+| G2 | Ollama FAQ.md, gpu.md, api.md | ollama/ollama main | Ollama surface | Config: KEEP_ALIVE (default 5m), MAX_LOADED_MODELS (default 3×GPUs), NUM_PARALLEL (default 1 per current docs), OLLAMA_CONTEXT_LENGTH (default 4096), KV q8_0 ≈ ½ f16 memory "very small loss", q4_0 ≈ ¼ "small-medium loss… more noticeable at higher context"; FA on. Structured outputs via `format` = JSON schema; tool calling; per-request keep_alive; load_duration stats; single-GPU-preferred multi-GPU policy | **No grammar (GBNF) interface; NO speculative decoding of any kind exposed; no per-request context override beyond options.num_ctx; no preemption hook; global-only KV type** | Docs | DOCUMENTATION_AUDITED | Confirms every inward contradiction at the docs level: Ollama's config surface cannot express foreground-wins beyond keep_alive, cannot do embed+LLM co-residency at MAX_LOADED_MODELS=1, and cannot requalify speculative decoding |
+| G3 | vLLM docs (features/speculative_decoding; docs.vllm.ai) | vLLM project | vLLM surface | PagedAttention engine; SD suite (row D8); tensor parallel; continuous batching; per-model `max_model_len`; preemption (swap/recompute per paper B1); GPU memory utilization target (`gpu_memory_utilization=0.5` shown in heterogeneous-vocab example) | Not GGUF-native (HF weights); pipeline-parallel × SD incompatible; heavier footprint, worse fit for 16 GB desktop sharing | Docs | DOCUMENTATION_AUDITED | vLLM = the runtime if Rune wants SD + governed KV + preemption scheduling, at the cost of GGUF ecosystem and desktop VRAM negotiation |
+| G4 | ONNX Runtime / onnxruntime-genai | Microsoft | Alternative runtime | **Not audited this session** — no evidence row taken; runtime-comparison verdict excludes it rather than asserting from memory | — | — | NOT AUDITED (registered) | Kept out of the comparison table rather than cited unverified (do-not-cite register) |
+
+### H. Multi-GPU / heterogeneous
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| H1 | llama.cpp server README `-sm` docs | ggml-org | Split modes | `layer` (default): split layers+KV across GPUs, **pipelined**; `row`: split weights by rows, **parallelized**; `tensor`: experimental parallel | — | Docs | DOCUMENTATION_AUDITED | Layer-split = capacity aggregation only (layers execute sequentially); no 2× decode from a second consumer GPU |
+| H2 | Ollama gpu.md | ollama | Multi-GPU policy | "If the model will entirely fit on any single GPU, Ollama will load the model on that GPU. This typically provides the best performance as it reduces the amount of data transferring across the PCI bus" | — | Docs | DOCUMENTATION_AUDITED | Runtime vendors treat PCIe as the enemy — corroborates PowerInfer's 64 GB/s PCIe vs 672 GB/s VRAM arithmetic |
+| H3 | Wikipedia: GeForce 40 series (specs table, TechPowerUp-cited) | — | Card specs + interconnect | **RTX 4070 Ti SUPER: AD103-275, 16 GB GDDR6X, 256-bit, 672 GB/s, 285 W TDP. Ada Lovelace: "No NVLink support."** PCIe 4.0 x16 | — | Aggregator table w/ primary refs | METADATA_VERIFIED | Rune's card bandwidth = 672 GB/s; the observed 225 W nvidia-smi cap is a SET POWER LIMIT, not the 285 W rated TGP (see do-not-cite register). No NVLink ⇒ consumer tensor-parallel over PCIe only |
+
+### I. Energy / sustained cost
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | LLaMA inference energy | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| I1 | arXiv:2310.03003 | From Words to Watts: Benchmarking the Energy Costs of LLM Inference — Samsi, Zhao, McDonald, Li, Michaleas, Jones, Bergeron, Kepner, Tiwari, Gadepally (MIT LL), 2023, IEEE HPEC | Measured J/token + power capping | LLaMA-65B: **~3–4 J per output token** (batch 64, 8–32 V100s); energy/second 300 W–1 kW; SM util 94–98%. **Power capping 250→175 W: +6.7% time, −23.2% energy; 250→150 W: +19.5% time, −34.7% energy** | "Less clear whether [A100's] increased energy/s is worth the small throughput gain" for 65B | Datacenter GPUs, batch 64+, FP16 — not consumer single-stream | FULL_PAPER (ar5iv full text) | The power-capping lever transfers directly: Rune's observed 225 W cap is exactly this intervention; expected J/token for Rune decode (arithmetic, unmeasured): ~100–200 W ÷ 40–60 t/s ≈ 2–4 J/token — same order as the measured A100 numbers |
+| I2 | RTX-40-series sustained thermal throttling under long inference | — | — | **Bounded zero-hit: no peer-reviewed study found** of sustained multi-hour RTX-40 consumer-card throttling under LLM inference; NVIDIA GPU Boost thermal management is the generic documented mechanism | Zero-hit recorded; Rune's sustained gaming+inference thermal behavior is UNMEASURED (matches inward UNKNOWN) | — | NOT FOUND (honest zero) | Do not claim "40-series throttles/doesn't throttle under inference" — unmeasured on this machine |
+
+---
+
+## PART 2 — SYNTHESIS (six verdicts)
+
+### V1. Decode-bandwidth arithmetic verdict for Rune's hardware
+
+The roofline holds and is triple-sourced: SqueezeLLM states single-batch LLM decode is memory-bandwidth-bound (A2); PowerInfer encodes it as per-unit time = bytes ÷ bandwidth (A1, Eq. 5); MQA/GQA motivate architecture around it (B2/B3); MARLIN confirms bs=1 is the maximal-speedup, bandwidth-bound regime (A3).
+
+- **4070 Ti SUPER: 672 GB/s.** 14B Q4_K_M ≈ 9 GB active bytes ⇒ theoretical ceiling ≈ 74 t/s; measured llama.cpp efficiency on the sibling 3090 (A4: 133 t/s vs 172 theoretical = ~77%) ⇒ **expected ~50–60 t/s**.
+- **5950X: DDR4-3200 dual channel = 51.2 GB/s theoretical, ~40–45 effective.** Measured 7B q4_0 = 11.0 t/s (A4, 84% efficiency) ⇒ **14B Q4 ≈ 4–5 t/s; 27B IQ2_M (~11.5 GB) ≈ 3.5–4 t/s; CPU-fallback FlexGen-style disk regime ≈ 1 t/s-class (F3)**.
+- **Gap ≈ 12–13×** (A4 measured 11 vs 133 t/s on identical model/quant). For reasoning-shaped generations (1,000+ tokens; inherited #404), CPU fallback means ~4 minutes vs ~20 s per response on the 14B. **GPU residency is not an optimization for Rune; it is the difference between usable and unusable for the primary tier.** The only CPU-viable tier is ≤7B/3B (A4: 11 t/s at 7B; 25–40 t/s at 3B-class).
+- Prompt's "~45–50 GB/s vs ~672 GB/s" bandwidth figures verified consistent (DDR4-3200 spec arithmetic; Wikipedia/TechPowerUp 672 GB/s). Prompt's "225 W card" is NOT the card's rating (285 W TGP) — see register.
+
+### V2. VRAM/context arithmetic (what Rune can actually run at what context)
+
+Formula (B1): KV bytes/token = 2 × layers × kv_heads × head_dim × dtype-bytes. Rune runs KV q8_0 (~1 B/elem, "≈½ f16, very small loss" per Ollama docs; caveat G2: high-GQA models like Qwen2 may see larger precision impact).
+
+| Model class | Weights (observed disk) | KV/token q8_0 | Free VRAM budget 11.3 GiB verdict |
+|---|---|---|---|
+| Qwen3-14B (40L×8KV×128d) | 9.3 GB | 80 KiB | 8k ctx: +0.63 GB ⇒ **~10.3 GB, fits with ~1 GB margin**. 32k: +2.5 GB ⇒ ~12.2 GB ⇒ **exceeds free VRAM while desktop holds ~1–2 GB**. 40,960 native: +3.1 GB ⇒ only with desktop VRAM freed |
+| Qwen2.5-coder:14b (48L×8KV) | 9.0 GB | 96 KiB | 8k: +0.75 GB ⇒ ~10.1 GB, fits. 32k: +3 GB ⇒ ~12.4 GB, over budget. Native 128k (24 GB f16 / 12 GB q8_0) is a fiction on this card |
+| 27B IQ2_M (arch unconfirmed — see caveat) | 11–12 GB | arch-dependent | Weights alone ≈ full free VRAM; ANY context + compute buffers + desktop tenancy ⇒ **marginal-to-fail**, confirming inward classification. Measured VRAM @ load is still owed (#404 E13) |
+| qwen2.5:7b / 3b | 4.7 / 1.9 GB | 48 KiB / (7B) | 8–32k fits trivially; co-resident with embedder (0.3 GB) always |
+| nomic-embed + qwen3-emb 0.6B | 0.3–0.8 GB | — | Residency cost is noise; the LLM slot is the scarce resource (inward confirmed) |
+
+**"Fits in VRAM" ≠ "fits with context" — now arithmetic, not slogan**: the 14B fits at 8k by ~1 GB and fails at 32k by ~1 GB, with only the context dial moved. Architectural qualifiers matter as much as parameter count: Gemma-3-27B's 5:1 SWA (B6) turns a nominal 15.4 GB/32k KV into ~3.2 GB; Qwen2.5-14B's 128k window is unreachable. **Actionable consequence:** per-model context override is a governance requirement (inward contradiction c confirmed at docs level — Ollama's `OLLAMA_CONTEXT_LENGTH` is global, `options.num_ctx` per request is the available lever); and the unconfirmed architecture of Rune's two "27B" IQ2_M merges must be read from their GGUF metadata (`llama.block_count`, `head_count_kv`) before any VRAM promise is made.
+
+### V3. Size-vs-precision frontier verdict
+
+At equal memory, bigger-lower-precision wins for zero-shot/general workloads — Dettmers & Zettlemoyer's 35k-experiment law (C1: 4-bit almost universally optimal). The frontier breaks three ways for Rune: (1) below ~3 bits, naive PTQ is not Pareto-optimal — AQLM shows ≤2-bit needs learned multi-codebook machinery (C2), SqueezeLLM shows the outlier mechanism (C3); (2) reasoning tasks degrade disproportionately and calibration-domain-sensitively (inherited 2504.04823: harder tasks up to 4× more degradation; GPTQ −9.8 pts off-domain); (3) BitNet-style ternary parity does not transfer to PTQ models (inherited). **Verdict:** Rune's 14B-Q4 generalists are on the evidence-backed side of the frontier; the 27B IQ2_M pair sits below the studied floor (≤2.5 bpw-class, no direct study — inherited bounded zero-hit), so it remains a hypothesis to measure, never a default. Nothing in this arm's hardware evidence changes the #404 conclusion; it adds the decode-side fact that IQ2_M's ~11.5 GB also buys NO latency advantage over 14B-Q4 (both bandwidth-bound on the same bytes-per-token ratio: ~11.5/672 vs ~9/672 GB/s ⇒ both ~40–60 t/s class) — i.e., the 27B costs more VRAM for the same speed and unproven quality.
+
+### V4. Speculative-decoding applicability verdict (draft cost vs gain on 16 GB)
+
+Mechanics: lossless, acceptance-rate-dependent (D1); gains scale with draft latency, not draft quality (D6); naive adoption can degrade performance (D5); bs=1 favors longer speculation (D4); vLLM's own docs scope SD to "medium-to-low QPS, memory-bound workloads" — Rune's exact regime (D8).
+
+- **Cost on 16 GB:** ngram/lookup decoding (llama.cpp `ngram-cache`, `--lookup-cache-*`) = **zero VRAM, no draft model** — the rational first experiment. Classic draft: Qwen2.5-0.5B Q8 ≈ 0.6 GB or 1.5B Q4 ≈ 1.1 GB — affordable next to the 14B at 8k (~10.3 GB, V2) but NOT next to a 27B IQ2_M (~full card). EAGLE-3 head: small (single-layer-class) but requires a per-target trained head; availability for Qwen3-14B UNVERIFIED this session (bounded zero-hit — no audited Qwen3-14B EAGLE-3 GGUF found in this arm's searches).
+- **Gain ceiling:** EAGLE-3 up to 6.5×; draft-model class typically ~1.5–3×; lookup decoding ~1.2–2× on repetitive/structured text (mechanism per D7 docs; acceptance task-dependent).
+- **Verdict:** applicable in principle, blocked in practice by the current runtime: **Ollama exposes no speculative decoding of any kind** (G2 negative). Requalification (seam E) therefore requires llama.cpp (`--spec-type draft-eagle3|draft-mtp|ngram-…`) or vLLM. Sequence: measure baseline t/s → ngram/lookup (free) → 0.5B draft (0.6 GB) → EAGLE-3 only if a verified head exists. Draft must be GPU-resident (D6); Ollama's MTP-only status (inherited) matches docs: llama.cpp exposes `draft-mtp` too, but Qwen3-14B dense GGUFs carry no MTP head (dense models generally lack native MTP — the flag targets MTP-equipped checkpoints).
+
+### V5. Load/eviction verdict
+
+Load churn — not concurrency — is the single-user contention risk, verified from four directions: (1) llama.cpp documents mmap-default loading with explicit "may reduce pageouts" warnings for non-mmap and an mlock option that trades RAM pressure for determinism (F1); (2) LLM-in-a-flash quantifies non-resident-weight paging at 4–25× slowdown when naive (F2); (3) FlexGen defines the fully-offloaded floor ≈ 1 t/s (F3); (4) Ollama already reports `load_duration` per request (F4) — the telemetry hook for churn exists today. With 23.6 GiB of zram swap in use, an mmap'd 9–12 GB model is a standing page-cache competitor: cold load = 9–12 GB NVMe read (sub-second-to-seconds on NVMe, unmeasured here — honest gap), and steady-state risk is mid-generation page-in stalls, non-deterministic by construction (F1/F2/F5). **KEEP_ALIVE=-1 converts every model switch into churn and every loaded model into a permanent VRAM/RAM tenant — it optimizes embedder latency (0.3 GB, cheap) at the cost of LLM slot governance (11 GB, expensive); the fix is per-request `keep_alive` semantics (F4), which the API already supports and which the env var was assumed to foreclose.** Foreground-wins is implementable at the API layer (per-request keep_alive=0 or short TTLs; llama.cpp adds `--sleep-idle-seconds`) even though no true preemption hook exists anywhere (G2 negative).
+
+### V6. Runtime-comparison table (which runtime for which workload)
+
+| Requirement | Ollama (docs-audited G2) | llama.cpp server (G1) | vLLM (G3) | ONNX Runtime (G4) |
+|---|---|---|---|---|
+| Grammar-constrained output | JSON schema via `format` only; no GBNF | **GBNF + JSON schema** | Structured outputs (guided decoding) | not audited |
+| Speculative decoding | **none** | draft / EAGLE-3 / MTP / ngram / lookup | draft / EAGLE / MTP / ngram / suffix; lossless-tested | not audited |
+| Per-model context override | global env var; per-request `options.num_ctx` | per-instance `-c`, `--fit` auto-fit, router presets | per-model `max_model_len` | not audited |
+| Concurrent embed+generate | needs MAX_LOADED_MODELS>1 + full-VRAM-fit rule; currently blocked (=1) | second `--embedding` instance or router mode with N models | engine-level (multiple models = multiple processes) | not audited |
+| Preemption / eviction hooks | per-request keep_alive (0/−1/TTL); unload API; NO preemption | `--sleep-idle-seconds` unload-on-idle; router load/unload API | scheduler preemption: swap-to-CPU or recompute (B1) | not audited |
+| GGUF + Rune's inventory | native | native | no (HF weights) | no |
+| Fit for Rune today | incumbent; config-governed only; zero SD | **best mechanism coverage for the least migration cost** | strongest serving machinery; wrong economics for one user + 16 GB shared with desktop | excluded (not audited) |
+
+**Verdict:** keep Ollama as the incumbent (GGUF inventory, loopback, systemd) and treat llama.cpp `llama-server` as the governed-config escape hatch for the capabilities Ollama structurally lacks (SD, GBNF, sleep-on-idle, auto-fit context); vLLM only if Rune's workload ever becomes multi-tenant. Batching evidence (B1/E1/E2): continuous-batching/PagedAttention gains are concurrency gains (2–4×; 2.6–5.6× under tail SLOs); at bs=1 they buy nothing for latency, and KV-per-request multiplication (Ollama docs E3) makes NUM_PARALLEL>1 a VRAM spend, not a win. **Single-user ⇒ batching is NOT relevant to Rune's latency; the serialization defect to fix is MAX_LOADED_MODELS=1 (embedder co-residency), not NUM_PARALLEL=1.**
+
+Multi-GPU/portability (H1–H3): layer-split aggregates capacity, not speed (pipelined execution); row/tensor-split over PCIe (no NVLink on Ada) is communication-bound vs 672 GB/s VRAM; Ollama itself prefers single-GPU. Portability design rule: Rune's placement logic must key on per-device VRAM capacity + bandwidth, never on "the GPU" being one card.
+
+Energy (I1/I2): decode ≈ 2–4 J/token expected on Rune (arithmetic from A-row t/s and observed power range; unmeasured); power capping is an evidence-backed energy lever (−23% energy for +6.7% time at 175 W) — Rune's 225 W observed cap is that lever already applied; sustained thermal behavior unmeasured (bounded zero-hit I2).
+
+---
+
+## PART 3 — REJECTED APPROACHES (with rejection evidence)
+
+1. **CPU inference as the primary tier for 14B/27B.** Rejected: 12–13× measured gap (A4); 4–5 t/s ceiling on 14B (V1); reasoning generations become minutes-long. Retained only for ≤7B fallback and offload-emergency (F3 floor ≈ 1 t/s).
+2. **Partial GPU/CPU layer offload as a capacity extender on this box.** Rejected: worst regime — llama.cpp hybrid ≈ 600 ms/iter on 30B (A1), FlexGen >99.5% transfer time (A1); PCIe 64 GB/s vs 672 GB/s VRAM. On 16 GB, "doesn't fit ⇒ don't load" beats "load half."
+3. **Batching/NUM_PARALLEL>1 as a latency mechanism.** Rejected for single user: throughput-only evidence (B1, E1, E2); RAM/VRAM scales NUM_PARALLEL × context (E3). Kept only as a future multi-tenant option.
+4. **Adopting speculative decoding unmeasured / via Ollama.** Rejected: Ollama exposes none (G2); naive SD can degrade (D5); draft must be GPU-resident and fast (D6). Adopted path: measure → ngram (0 VRAM) → small draft → EAGLE-3 if a verified head exists.
+5. **Trusting "27B IQ2_M is better because bigger" at equal-or-worse VRAM.** Rejected: frontier breaks below ~3 bpw (C1–C3 + inherited); same bytes-per-token ⇒ same ~40–60 t/s decode class on 672 GB/s; unmeasured quality (#404 E13 owed).
+6. **Citing ONNX Runtime in the runtime comparison from memory.** Rejected this round — not docs-audited; registered instead (G4).
+7. **Designing for 2× consumer GPUs as 2× speed.** Rejected: pipelined layer-split = capacity only (H1); no NVLink on Ada (H3); PCIe-bound parallel split (H2, A1).
+8. **Assuming context defaults are safe because "flash attention is on."** Rejected: FA reduces attention memory growth but KV still scales with context × layers (B1, B4–B6); Rune's models get ungoverned defaults today (inward c), and the fix (num_ctx per request / --fit) is documented and cheap.
+
+---
+
+## PART 4 — DO-NOT-CITE REGISTER (unverifiable this arm)
+
+| Item | Reason |
+|---|---|
+| **"4070 Ti SUPER is a 225 W card"** | Contradicted: rated TGP = 285 W (H3, TechPowerUp-cited spec table). Observed 225 W is a nvidia-smi *power cap* on this machine — a configured limit, citable only as "observed cap," never as the card's rating |
+| 5950X **14B-Q4** CPU decode t/s (any specific number) | No auditable 14B source found; only 7B q4_0 = 11.0 t/s measured (A4). 14B figures here are bandwidth arithmetic, must be labeled derived, never cited as measurements |
+| Ollama model loading = mmap (as an Ollama-documented behavior) | Not documented by Ollama; the mmap mechanism is llama.cpp-documented (F1) and `use_mmap` appears in Ollama's API options — cite the mechanism, not an Ollama guarantee |
+| Measured NVMe cold-load times for 5–12 GB GGUF models | No systematic measurement found this session; Ollama `load_duration` telemetry exists but no published numbers. Rune-specific cold-start = UNMEASURED |
+| LLM inference degradation under zram/swap pressure (any magnitude) | Bounded zero-hit (F5) — no peer-reviewed or systematic measurement found. Do not quantify; probe on-machine instead |
+| RTX-40-series sustained thermal throttling under long inference | Bounded zero-hit (I2) |
+| ML.ENERGY leaderboard / community J-token numbers for consumer cards | Not audited this session; J/token figures here are labeled arithmetic (I1-derived), not citations |
+| EAGLE-3 head availability for Qwen3-14B | Bounded zero-hit; do not assert existence of a compatible draft/EAGLE checkpoint without verification |
+| Architecture of Rune's "Qwen3.8-27B-Uncensored" / "Qwen3.6-27B-Fable" merges | Community merges of unverified lineage; KV/VRAM arithmetic must not be applied until GGUF metadata (block_count, head_count_kv) is read |
+| onnxruntime-genai capability claims | Not audited (G4) |
+| Reddit thread specific t/s numbers | Qualitative RAM-boundness only, reliability-labeled (A5); the numbers were not audited |
+| 8 mis-paired arXiv IDs caught this session (prompt candidates): 2306.03030 (→CMExam), 2303.06974 (→cosmology), 2310.11470 (→textbook chapter), 1912.01703 (→PyTorch), 2312.03878 (→healthcare), 2404.14206 (→antennas), 2408.11740 (→stock prediction), 2402.00297 (→spintronics); plus arm-1's own corrected guesses 2402.01528 (real: Decoding SD), 2212.09720 (real: 4-bit scaling), 2303.06865 (real: FlexGen), 2312.11514 (real: LLM in a flash), 2408.11743 (real: MARLIN), 2404.14294 (real: survey) | Verified against export API this session; corrected IDs are the ones used in rows above |
+
+---
+
+## Arm-1 accounting
+
+**Sources: 33 rows** — FULL_PAPER 1 · RELEVANT_SECTIONS 2 · DOCUMENTATION_AUDITED 11 (llama.cpp server README, Ollama FAQ/api/gpu docs, vLLM SD docs, Qwen3-14B/Qwen2.5-14B/Gemma-3-27B configs) · ABSTRACT_ONLY 15 · METADATA_VERIFIED 1 · INHERITED_VERIFIED 2 (carrying 4 #404-verified IDs) · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 2 · honest zero/NOT FOUND 2 (+1 NOT AUDITED). **Verification: every arXiv ID resolved via export API this session; 8 mis-pairings caught.** Deepest reads landed on the four mandated priorities: decode-bandwidth/roofline (PowerInfer full-relevant-sections incl. Eq. 5), KV arithmetic (PagedAttention §3 + three model configs), PagedAttention/continuous-batching (§1–6 + Sarathi/DistServe), llama.cpp speculative docs (--spec-type incl. draft-eagle3/draft-mtp/ngram).

research/memory-atlas-r1/AD-hardware-resource-placement/02_outward/arm2_serving_runtime_placement.md

@@ -0,0 +1,208 @@
+# #405 AD — Arm 2: Serving / Runtime / Placement / Economics (OUTWARD, research-only)
+
+**Date:** 2026-09-23 · **Domain:** #405 Hardware / Resource Placement · **Harness:** R1 1.0 rev.2 · Read-only inward, no production mutation.
+
+Builds on arm-1 (`arm1_hardware_foundations.md`): roofline triple-source, 12–13× CPU/GPU gap on the exact CPU class, KV arithmetic, load-churn evidence, energy/power-capping. Arm-1 results are cited as INHERITED_VERIFIED, not re-researched.
+
+Verification discipline applied: every arXiv ID resolved via export.arxiv.org this session. **4 mis-paired IDs caught — all from arm-2's own first-pass guesses** (2311.10103, 2311.10683, 2302.13265, 2202.03225 — details in do-not-cite register). Doc sources were read this session and are labeled DOCUMENTATION_AUDITED; on-machine facts (systemd unit, nvidia-smi, live Ollama API probes, dd read measurement) are labeled LOCAL_OBSERVED / LOCAL_MEASURED.
+
+---
+
+## PART 1 — SOURCE ROWS
+
+Depth legend: FULL_PAPER · RELEVANT_SECTIONS · DOCUMENTATION_AUDITED (official docs read this session) · LOCAL_OBSERVED (machine state read this session) · LOCAL_MEASURED (measurement performed this session, method stated) · ABSTRACT_ONLY (verified abstract) · METADATA_VERIFIED · INHERITED_VERIFIED (arm-1, carried per mandate) · COMMUNITY_EVIDENCE_RELIABILITY_LABELED.
+
+### A. Runtime surfaces — audited this session (docs)
+
+| # | Source | Authors / project, year | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A1 | llama.cpp `tools/server/README.md` (ggml-org/llama.cpp master, accessed 2026-09-23) | ggml-org | llama-server full config surface | Features: [OI]-compatible chat/completions/responses/embeddings **+ Anthropic Messages-compatible `/v1/messages`**; GBNF `--grammar` / `-j --json-schema`; `--spec-type` (draft/eagle3/mtp/ngram, see arm-1 D7); **`-ngl auto` default with `--fit` on: auto-adjusts unset args to fit device memory, `--fit-target` default 1024 MiB margin, `--fit-ctx` min 4096**; `--sleep-idle-seconds` unload-on-idle (PR #18228; model+KV unloaded from RAM, auto-reload on task; `/health`, `/props`, `/models`, `/metrics` exempt from reloading); `--load-mode {auto/mmap/mlock/none/dio}` (mmap default; none "may reduce pageouts if not using mlock"); lazy-mode on-demand tensor reads (auto for tensors >4 GiB); **`--prio N` process/thread priority low(−1)…realtime(3) + `--cpu-mask`/`--cpu-range` affinity + `--cpu-strict`**; router mode: launch without model, `--models-dir`/presets (.ini per-model args), **GET /models with status `loaded/sleeping/loading/unloaded/failed/downloading`**, POST /models/load, POST /models/unload, `/models/sse` events incl. load progress; `--metrics` Prometheus endpoint; `/slots` monitoring; `--cache-ram` default 8192 MiB; context checkpoints; `--lookup-cache-static/dynamic` | No per-request VRAM priority; no MIG/priority integration (GPU-side fairness is out of its control) | Docs; no bundled load-time benchmarks; router-mode model instances inherit router env | DOCUMENTATION_AUDITED | The single runtime that answers every Rune config-surface need: idle eviction, auto-fit context, grammar, spec-decode, per-model presets, rich residency telemetry, process priority + CPU affinity (foreground-wins at runtime layer) |
+| A2 | Ollama `docs/api.md` (ollama/ollama main, accessed 2026-09-23) | Ollama | Ollama API surface + telemetry | `keep_alive` per request on /generate, /chat, /embed (default 5m; **"The `keep_alive` API parameter … will override the `OLLAMA_KEEP_ALIVE` setting"** — verbatim doc confirmation); `0` = unload immediately; negative = forever; final response stats: `total_duration`, **`load_duration` (ns)**, `prompt_eval_count/duration`, `prompt_eval_cached_count`, `eval_count/duration`; "divide `eval_count` / `eval_duration` × 10⁹" = tok/s; **GET /api/ps** returns per loaded model: `name`, `model`, `size`, **`size_vram`**, **`digest`**, `details.parameter_size`, `details.quantization_level`, **`expires_at`** (eviction countdown); **POST /api/show** returns Modelfile (`PARAMETER num_ctx 4096` visible), `parameters`, `details`, `model_info` (GGUF metadata: `general.architecture`, `llama.block_count`, `llama.attention.head_count_kv`, `llama.context_length` — in verbose form), `capabilities[]`; unload = empty prompt + keep_alive 0; load = empty prompt | **No metrics endpoint, no health endpoint, no queue-depth telemetry** | Docs | DOCUMENTATION_AUDITED | Every registry field Rune needs for identity/quant/residency/load-time/throughput is available TODAY from the incumbent stack — see Part 2 registry table |
+| A3 | Ollama `docs/faq.mdx` (ollama/ollama main, accessed 2026-09-23) | Ollama | Concurrency, residency, KV, storage | "models are kept in memory for **5 minutes** by default"; `OLLAMA_KEEP_ALIVE` env; `ollama stop` = immediate unload; **concurrency rules: "If there is insufficient available memory to load a new model request … all new requests will be queued until the new model can be loaded. As prior models become idle, one or more will be unloaded to make room for the new model."** and "When using GPU inference new models must be able to completely fit in VRAM to allow concurrent model loads"; `OLLAMA_MAX_LOADED_MODELS` default 3×GPUs; `OLLAMA_NUM_PARALLEL` default 1, "Required RAM will scale by NUM_PARALLEL × CONTEXT_LENGTH"; `OLLAMA_MAX_QUEUE` default 512 (503 on overflow); KV q8_0 ≈ ½ f16 "very small loss", **"Currently this is a global option"**; KV q4_0 ¼ with "small-medium loss… may be more noticeable at higher context"; "Models that have a high GQA count (e.g. Qwen2) may see a larger impact on precision"; model dirs: Linux default `/usr/share/ollama/.ollama/models`, **`OLLAMA_MODELS` env moves them**; preload via empty request; single-GPU-preferred loading | **No automatic preemption of a running generation; no per-model KV-cache-type; no runtime health/metrics endpoint** | Docs | DOCUMENTATION_AUDITED | Ollama already has an idle-unload-to-make-room eviction policy and per-request keep_alive — the residency policy Rune needs is expressible in env vars + request parameters, no fork required. KV-type global-only reconfirmed verbatim |
+| A4 | vLLM "Production Metrics" docs (docs.vllm.ai, accessed 2026-09-23) | vLLM project | vLLM observability + sleep states | `/metrics` Prometheus: `vllm:num_preemptions` (counter), `vllm:engine_sleep_state` ("awake=0 sleeping; weights_offloaded=1 sleep level 1; discard_all=1 sleep level 2"), `vllm:kv_cache_usage_perc`, `vllm:num_requests_running/waiting(_by_reason)`, `vllm:time_to_first_token_seconds` + `vllm:inter_token_latency_seconds` + `vllm:e2e_request_latency_seconds` histograms, per-request prefill/decode/queue-time histograms, spec-decode accepted-tokens-per-position, MFU metrics (estimated bytes read/written per GPU) via `--enable-mfu-metrics` | Metrics need `--metrics`-equivalent enablement path; nothing GGUF-side | Docs, latest (developer-preview) | DOCUMENTATION_AUDITED | The observability benchmark for any future Rune runtime migration: preemption, queue depth, TTFT/ITL histograms, sleep levels are all first-class — none of which Ollama exposes |
+| A5 | TGI docs (huggingface.co/docs/text-generation-inference, accessed 2026-09-23) | Hugging Face | TGI status | **Top-of-page CAUTION: "text-generation-inference is now in maintenance mode. Going forward, we will accept pull requests for minor bug fixes… recommend using [vLLM], [SGLang], as well as local engines with inter-compatibility such as llama.cpp or MLX."** Features: tensor parallelism, continuous batching, FlashAttention+PagedAttention, Prometheus metrics, OpenTelemetry tracing, safetensors loading, bitsandbytes/GPTQ quantization, guidance (structured output) | **Not GGUF-native; project itself recommends llama.cpp/vLLM/SGLang for future work** | Docs | DOCUMENTATION_AUDITED | REJECT with vendor-stated reason: maintenance mode + wrong weight ecosystem for Rune's GGUF inventory. Strongest kind of negative evidence: the maintainer's own migration advice |
+| A6 | TensorRT-LLM docs (nvidia.github.io/TensorRT-LLM, accessed 2026-09-23) | NVIDIA | TRT-LLM applicability | Full feature surface: spec-decoding (NGram, EAGLE3, MTP, suffix automaton), guided decoding, KV-cache compression/offloading, disaggregated serving, Prometheus metrics, trtllm-serve; **deployment guides all target Blackwell/Hopper (B200/GB200/H100/H200 class)**; own checkpoint format + engine-build/MX loading pipeline; container-based deployment | **No GGUF support; hardware tier is datacenter-class; engine-build workflow per model/version** | Docs landing audited; per-feature pages not read | DOCUMENTATION_AUDITED | REJECT for a 16 GB GeForce single-user box: wrong hardware tier, wrong weight format, operationally heaviest option. Its NGram spec-decode + guided decoding confirm those mechanisms are mainstream — llama.cpp exposes equivalents without the cost |
+| A7 | ONNX Runtime GenAI README (microsoft/onnxruntime-genai main, accessed 2026-09-23) | Microsoft | ORT-GenAI proper audit (arm-1 declined) | Runs generative loop for **ONNX-format** models; hardware accel: CPU, CUDA, DirectML, NvTensorRtRtx, OpenVINO, QNN, WebGPU; **features: Multi-LoRA, continuous decoding, constrained decoding (grammar); speculative decoding = "On the roadmap" (NOT available)**; model matrix includes Qwen (lang+vision), Gemma, Phi, gpt-oss; powers Foundry Local / Windows ML / VS Code AI Toolkit; Linux supported; **project ships usage telemetry phone-home by default (docs/Privacy.md)** | **No GGUF; no speculative decoding today; ONNX int4-RTN ecosystem, not GGUF K-quants** | README audited; onnxruntime.ai/genai subpages not read | DOCUMENTATION_AUDITED | Now honestly auditable instead of excluded: a real, maintained runtime that is the wrong ecosystem for Rune (GGUF inventory, spec-decode absent, telemetry defaults conflict with #402 privacy posture). REJECT on fit, not on ignorance |
+| A8 | NVIDIA Multi-Process Service docs (docs.nvidia.com/deploy/mps, accessed 2026-09-23) | NVIDIA | GPU space/SM sharing | MPS = runtime service enabling cooperative multi-process CUDA; "improved GPU utilization and reduced GPU context switching"; **"provides memory and SM partitioning capabilities, as well as priority and dynamic resource adjustment"**; MPS v3 adds named servers, namespaces, TOML config, memory partitioning | Per-architecture GeForce support matrix not read this session (registered — do-not-cite) | Overview page audited | DOCUMENTATION_AUDITED | The only NVIDIA-native GPU-side priority/partition mechanism that could theoretically serve Rune's foreground-wins — but unsupported-by-runtime (llama.cpp/Ollama don't integrate) and unverified on GeForce ⇒ not a Rune lever today |
+| A9 | NVIDIA MIG User Guide — Supported GPUs (docs.nvidia.com/datacenter/tesla/mig-user-guide, accessed 2026-09-23) | NVIDIA | MIG availability | "MIG is supported on GPUs starting with the NVIDIA Ampere generation"; supported list: GB200/B200 (7 instances), **RTX PRO 6000/5000/4500 Blackwell (4/2/2 instances — pro cards, NOT GeForce)**, H100/H200 (7), A100 (7), A30 (4), Thor iGPU | **AD103 (RTX 4070 Ti SUPER) absent from list — MIG unavailable on Rune's card, now doc-verified (arm-1 inference confirmed)** | Supported-GPU table read; profiles page not read | DOCUMENTATION_AUDITED | Kills the "MIG for foreground/background partitioning" idea on this hardware; also corrects a common overgeneralization — MIG exists on some workstation Blackwell pro cards, but never on GeForce |
+| A10 | systemd.resource-control(5) (manpages.debian.org, systemd 252/257, accessed 2026-09-23) | systemd project | OS-layer resource controls | Full knob surface: **CPUWeight= (1–10000, incl. `"idle"` special value — cgroup gets CPU only when nothing else wants it)**, CPUQuota=, AllowedCPUs=; **MemoryMin/MemoryLow= (reclaim protection), MemoryHigh= (throttle), MemoryMax= (OOM defense), MemorySwapMax= (absolute swap-use limit per unit)**; TasksMax=; **IOWeight=, IODeviceWeight=, IOReadBandwidthMax=, IODeviceLatencyTargetSec= (io.latency)**; ManagedOOMSwap=; IPAddressAllow/Deny= (network allow-list — #402 seam); DeviceAllow=; Slice= hierarchy; Delegate= | CPUQuota is not work-conserving for guarantees (limits only); weights are relative, no hard CPU reservation | Man page (bookworm 252 + testing 257 shown); kernel cgroup v2 semantics | DOCUMENTATION_AUDITED | The CPU/IO foreground-wins layer Rune can adopt with a 5-line ollama.service drop-in (current unit has NO resource controls — see C1). MemorySwapMax and CPUWeight=idle are the two most interesting unapplied knobs |
+| A11 | SQLite Write-Ahead Logging doc (sqlite.org/wal.html, accessed 2026-09-23) | SQLite project | WAL mechanics + the WAL-reset bug | WAL: readers don't block writers; auto-checkpoint at 1000 pages (~4 MB); **"The WAL file is part of the persistent state of the database and should be kept with the database if the database is copied or moved. If a database file is separated from its WAL file, then transactions that were previously committed … might be lost, or the database file might become corrupted. The only safe way to remove a WAL file is to open the database … then immediately close"**; **§11 WAL-reset bug: present in all versions 3.7.0–3.51.2, fixed in 3.51.3 (2026-03-13); backports 3.44.6 / 3.50.7; affects WAL mode with 2+ connections writing/checkpointing concurrently; low probability (never reproduced organically; ≤ SSD-failure-rate telemetry); independent reproducer published 2026-08-24** | — | Official doc read in full | DOCUMENTATION_AUDITED | Family's WAL caveats verified and sharpened: never copy a live `-wal`/`-shm` pair mid-write; checkpoint or use the backup API / `VACUUM INTO` before backup. Rune's installed SQLite is 3.53.4 (2026-07-24) ⇒ **WAL-reset bug already fixed on Rune**; any Pi/backup-tier machine running SQLite must be version-checked (D-row caveat) |
+
+### B. Multi-model serving / residency literature (arXiv-verified this session)
+
+| # | ID / source | Title, authors, year, venue | Topic | Key claims (numbers) | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| B1 | arXiv:2311.03285 | S-LoRA: Serving Thousands of Concurrent LoRA Adapters — Sheng, Cao, Li, Hooper, Lee, Yang, Chou, Zhu, Zheng, Keutzer, Gonzalez, Stoica, 2023, **SOSP 2024** | Space-sharing, cheap-tenant residency | Adapters stored in **main memory**, fetched to GPU memory for running queries; Unified Paging = one pool for heterogeneous adapter weights + KV; "serve thousands of LoRA adapters on a single GPU … with a small overhead"; up to 4× throughput vs naive LoRA serving | — | Multi-tenant batch serving (not bs=1) | ABSTRACT_ONLY (ID verified via export API) | The design pattern behind "keep the cheap tenant resident, stage the expensive one": small per-tenant state should live in fast memory; Rune's embedder (0.3 GB) vs LLM (9–11 GB) is the same asymmetry at 30× scale |
+| B2 | arXiv:2401.14351 | ServerlessLLM: Low-Latency Serverless Inference for LLMs — Fu, Xue, Huang, Brabete, Ustiugov, Patel, Mai, 2024, **OSDI 2024** | Model-load cost / eviction cycles | Load time is the dominant serverless cold-start cost; **loading-optimized checkpoint format + multi-tier loading "fully utilizing the bandwidth of complex storage hierarchies"; locality-aware scheduling; reduces latency by 10–200×** vs state-of-the-art serverless systems | Conventional checkpoint formats leave storage bandwidth unused (motivating negative) | Multi-server serverless setting; NVMe tiers on GPU servers | ABSTRACT_ONLY (verified) | Academic confirmation that load/unload cycles are a first-class cost (arm-1 V5), and that storage layout/bandwidth exploitation is the lever — Rune's mitigation is residency TTLs, not faster disks (already 6 GB/s, row G3) |
+| B3 | arXiv:2209.01188 | Petals: Collaborative Inference and Fine-tuning of Large Models — Borzunov, Baranchuk, Dettmers, Ryabinin, Belkada, Chumachenko, Samygin, Raffel, 2022/2023 | Inference over networks | BLOOM-176B inference on consumer GPUs over the network: **≈ 1 step per second** "which is enough for many interactive LLM applications"; beats RAM-offloading for very large models | Offloading is "too slow for interactive inference"; APIs not flexible enough | Internet-class volunteer swarm, 176B targets, 2022-era | ABSTRACT_ONLY (correct ID found via arXiv title search after two mis-pairings) | The measured cost of network-pipelined inference: ~1 token/s even for a well-engineered system. Rune's LAN variant would be strictly worse per arm-1 roofline (weights must cross the wire every layer) |
+| B4 | arXiv:2311.18677 | Splitwise: Efficient generative LLM inference using phase splitting — Patel, Choukse, Zhang, Shah, Goiri, Maleki, Bianchini, 2023/2024, **ISCA 2024** | Cross-machine inference | Prefill = compute-intensive, decode = memory-intensive; phase-split across machines "requires state transfer … using **the fast back-plane interconnects available in today's GPU clusters**"; 1.4× throughput at 20% lower cost, or 2.35× throughput at same cost+power | Phase-splitting only pays off with cluster-grade interconnects (NVLink/InfiniBand-class) | Datacenter; explicit interconnect dependency | ABSTRACT_ONLY (verified) | The negative result Rune needs: even the flagship cross-machine split design presumes cluster backplanes; consumer LAN is not in its design space |
+| B5 | arXiv:2312.07104 | SGLang: Efficient Execution of Structured Language Model Programs — Zheng, Yin, Xie, Sun, Huang, Yu, Cao, Kozyrakis, Stoica, Gonzalez, Barrett, Sheng, 2023/2024 | Runtime + KV reuse + structured output | RadixAttention: **prefix-tree KV-cache reuse across calls**; compressed FSMs for structured output; up to **6.4× higher throughput** on agentic/multi-call workloads | Gains concentrate on multi-call, shared-prefix workloads — not single-shot chat | Server runtime (CUDA), HF-weight ecosystem | ABSTRACT_ONLY (verified) | The capability Rune's agent workload would most benefit from (KV reuse across repeated system-prompt prefixes) exists in llama.cpp as prompt caching + `--cache-reuse` (A1) — an upgrade path without leaving GGUF |
+| B6 | USENIX OSDI '22 — "Orca: A Distributed Serving System for Transformer-Based Generative Models" — Yu, Jeong, Kim, Kim, Chun (USENIX page verified; **no arXiv entry used — candidate 2202.03225 was mis-paired**) | 2022 | Batching mechanism | Iteration-level (continuous) scheduling + selective batching; **36.9× throughput improvement at same latency** vs FasterTransformer on GPT-3 175B | — | Datacenter serving | METADATA_VERIFIED + abstract read (USENIX) | Origin of continuous batching that Ollama/llama.cpp inherit; relevant only as ancestry — at bs=1 it buys nothing (arm-1 V6) |
+| B7 | USENIX OSDI '23 — "AlpaServe: Statistical Multiplexing with Model Parallelism for Deep Learning Serving" — Li et al. (li-zhouhan; USENIX page + PDF verified via search; **candidate 2302.13265 was mis-paired** — see register) | 2023 | Multi-model placement | Model parallelism repurposed as **statistical multiplexing across devices when serving multiple models**; large SLO-attainment gains over selective replication (e.g., 79–80% vs 36.9% at 2× SLO scale, from paper's table) | — | Datacenter, many models/devices | METADATA_VERIFIED + PDF table glimpse | Design evidence for time-slicing vs space-sharing trade: at Rune's scale (1 GPU, 2–3 tenants) the correct ancestor is "cheap tenant pinned, expensive tenant staged", not multiplexing machinery |
+
+### C. On-machine evidence (this session)
+
+| # | Source | Topic | Key facts | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|
+| C1 | `systemctl cat ollama` (Rune, 2026-09-23) | Service config | Unit + drop-in: `OLLAMA_MODELS=/mnt/fast-storage/ai/ollama`, `OLLAMA_HOST=127.0.0.1:11434`, KEEP_ALIVE=−1, MAX_LOADED_MODELS=1, NUM_PARALLEL=1, FLASH_ATTENTION=1; hardening present (`ProtectSystem=full`, `ProtectHome=yes`, `PrivateTmp=yes`, User=ollama) | **No CPUWeight/CPUQuota/MemorySwapMax/IOWeight/Nice= anywhere — the entire systemd foreground-wins surface is unapplied** | Read-only snapshot | LOCAL_OBSERVED | Foreground-wins currently has zero OS-layer config; policy spec in Part 2 fills exactly this gap |
+| C2 | Live Ollama probes: `GET /api/ps`, `POST /api/show` (127.0.0.1:11434, 2026-09-23) | Telemetry reality | /api/ps: nomic-embed-text resident, `size` = `size_vram` = 323,150,151 B, `digest` present, `parameter_size` "137M", `quantization_level` "F16", `expires_at` = 2319-01-03 (**KEEP_ALIVE=−1 rendered as +293-year expiry — the −1 semantics made literal**), `context_length: 2048`; /api/show: qwen3:14b → family qwen3, 14.8B, Q4_K_M; qwen2.5-coder:14b → family qwen2, 14.8B, Q4_K_M; nomic caps `['embedding']` | **Non-verbose /api/show omits `model_info` GGUF fields (block_count, head_count_kv) — verbose form required per docs; registry extraction must use verbose=true** | Single observation; fields may vary by Ollama version (docs example lacks `context_length` in /api/ps) | LOCAL_OBSERVED | Registry fields obtainable TODAY, demonstrated live: identity, digest, quant, params, VRAM size, residency, expiry, context length. 27B-merge architecture check: re-run /api/show verbose — done in one call, no file access needed (resolves arm-1's open caveat mechanically) |
+| C3 | df/dd on Rune NVMe stacks (2026-09-23) | Storage placement | `/` = 346G 72% full (nvme2n1p3, btrfs); `/mnt/workdrive` = 1.8T 27% (nvme1n1p1, ext4); `/mnt/fast-storage` = 3.3T 69% (nvme2n1p2, ext4), models dir = **71 GB**; **measured sequential read (dd iflag=direct, bs=8M, 768 MiB sample of the 27B IQ2_M GGUF): 6.0 GB/s** | — | Single-file sample; btrfs on `/` untested for load path (models are not there); no cold-vs-warm-page-cache comparison | LOCAL_MEASURED | Two findings: (1) cold load of a 9–12 GB model ≈ **1.5–2 s of raw NVMe read** — disk bandwidth is NOT the load bottleneck; (2) **system disk and /mnt/fast-storage are partitions of the SAME physical NVMe (nvme2n1)** — inward's implied "models are on a separate disk" is false; only /mnt/workdrive (nvme1) is a distinct device |
+| C4 | `nvidia-smi` + `free` + `sqlite3 --version` (Rune, 2026-09-23) | Observed state | power.limit **225 W** (cap, not rating); VRAM 4759/16376 MiB used; RAM 30.9 GiB used + swap 23.9/32 GiB (zram); **SQLite 3.53.4 (2026-07-24)** | — | Point-in-time | LOCAL_OBSERVED | Confirms inward power-cap/VRAM/swap facts; SQLite version ⇒ WAL-reset bug fixed on Rune (A11) |
+
+### D. Community / network evidence
+
+| # | Source | Topic | Key claims | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|
+| D1 | Wolf Paulus, "Local llama" (wolfpaulus.com/local_llama, accessed 2026-09-23 via search) + r/LocalLLaMA "Raspberry Pi5 LLM performance" thread (located, not deep-read) | Pi 5 LLM capability | Pi 5 (CPU-only, 4×A76): llama.cpp on a **3B-active MoE (25B-A3B IQ4_NL)** after heavy tuning (performance governor, swapoff, hugepages/madvise, `--mlock`, taskset 3 cores, thread tuning) = **2.13–3.04 t/s** | Dense models of the 7B+ class are far below even this (derivable: ~4× fewer active bytes but ~5× slower RAM and no trick left un-pulled); no usable GPU on Pi 4/5 for LLMs | Blog measurement, single machine, MoE-specialized; community thread not audited | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | Pi inference for Rune's tiers (7B–27B): REJECT — even a hand-tuned best case on an easier model class is ~3 t/s; Pi = cold-backup tier only (ADAPT), consistent with family assessment |
+| D2 | arXiv:1703.00064 | Ending the Anomaly: Achieving Low Latency and Airtime Fairness in WiFi — Høiland-Jørgensen, Kazior, Täht, Hurtig, Brunstrom, 2017 (peer-reviewed; Linux kernel implementation accepted mainline) | Wireless LAN latency behavior | "**Increased latency under load caused by excessive queueing (i.e. bufferbloat) and the 802.11 performance anomaly**"; their queueing+fairness fix yields an **order-of-magnitude latency reduction under load** — i.e., unmanaged WiFi-hop latency under load sits an order of magnitude above best case | — | 2017 testbed; throughput-side mostly | ABSTRACT_ONLY (verified) | The peer-reviewed anchor for "Rune's wireless LAN adds load-dependent latency and jitter": distributed inference over this hop inherits exactly this variance; remote-API calls tolerate it, tensor/pipeline parallelism does not |
+
+### E. Inherited (arm-1, cited not re-researched)
+
+| # | Source(s) | Carried claims used here | Depth |
+|---|---|---|---|
+| E1 | arXiv:2312.12456 PowerInfer (SOSP 2024) — Eq. 5 roofline; PCIe 4.0 = 64 GB/s vs VRAM 672 GB/s | Basis for multi-node rejection arithmetic and CPU-fallback tier | RELEVANT_SECTIONS (arm-1) |
+| E2 | arXiv:2309.06180 PagedAttention (SOSP 2023) — KV size/fragmentation; preemption = swap-to-CPU or recompute | Basis for residency/KV headroom fields and vLLM preemption semantics | RELEVANT_SECTIONS (arm-1) |
+| E3 | llama.cpp discussion #5421 — 5950X 7B q4_0 = 11.0 t/s CPU vs 133 t/s 3090 | CPU tier viability bound (≤7B only) | COMMUNITY_EVIDENCE_RELIABILITY_LABELED (arm-1) |
+| E4 | arXiv:2310.03003 From Words to Watts — 3–4 J/token; power cap 250→175 W = −23.2% energy, +6.7% time | Energy economics + Rune's 225 W cap as already-applied lever | FULL_PAPER (arm-1) |
+| E5 | Ollama FAQ/api + llama.cpp server README (arm-1 G1/G2/F4) + vLLM SD docs (arm-1 D8/G3) | Ollama exposes NO grammar/SD; per-request keep_alive override; --spec-type surface; vLLM SD targets "medium-to-low QPS memory-bound" | DOCUMENTATION_AUDITED (arm-1, re-confirmed where re-read this session) |
+
+---
+
+## PART 2 — SYNTHESIS
+
+### 2.1 Runtime comparison (capability × disposition)
+
+| Capability | Ollama (A2/A3, E5) | llama.cpp `llama-server` (A1) | vLLM (A4, E5) | TGI (A5) | TensorRT-LLM (A6) | ORT-GenAI (A7) |
+|---|---|---|---|---|---|---|
+| Rune's GGUF inventory | **native** | **native** | no (HF weights) | no (safetensors) | no (own engine format) | no (ONNX) |
+| Grammar/structured output | JSON schema via `format` only | **GBNF + JSON schema** | guided decoding | guidance | guided decoding | constrained decoding (grammar) |
+| Speculative decoding | **none** | **draft/EAGLE3/MTP/ngram/lookup** | full suite | — | full suite | **roadmap only** |
+| Per-model context | global env + per-request `num_ctx` | per-instance `-c` + **`--fit` auto-fit (1024 MiB margin)** | per-model `max_model_len` | — | — | — |
+| Embed+LLM co-residency | blocked at MAX_LOADED_MODELS=1 (complete-fit VRAM rule applies) | second instance or router multi-model | multi-process only | — | — | — |
+| Idle eviction / sleep | keep_alive per request (0/TTL/−1); auto idle-unload to make room (A3); `ollama stop` | **`--sleep-idle-seconds`** (RAM+KV unload, auto-reload; health/metrics exempt) | **sleep mode level 1 (offload weights) / level 2 (discard)**, `engine_sleep_state` gauge | — | — | — |
+| Residency/eviction telemetry | /api/ps: size_vram, expires_at, digest | /models status (loaded/sleeping/loading/unloaded/failed), SSE events | num_preemptions, kv_cache_usage_perc, sleep state | Prometheus | Prometheus | — |
+| Latency/concurrency telemetry | load/prompt_eval/eval durations per request | same + /slots, TTFT-class via perf | **TTFT/ITL/e2e histograms, queue depth, waiting-by-reason** | Prometheus | Prometheus | — |
+| Foreground-wins levers | keep_alive only | **+ --prio (−1..3), CPU affinity/strict, systemd via unit** | engine scheduling (not single-user oriented) | — | — | — |
+| API compatibility | own + [OI]-compatible surface | **[OI] + Anthropic Messages + embeddings + rerank** | [OI] | own | [OI] | SDK-level |
+| Reliability/ops weight | lowest (systemd, loopback, restart=on-failure) | low (single binary; router adds sub-process mgmt) | medium-high (scheduler complexity, VRAM utilization tuning) | **maintenance mode** | high (engine build/container) | medium (per-model ONNX export) |
+| **Disposition** | **incumbent; governed via env+API (policy §2.2–2.3)** | **governed escape hatch when grammar/SD/auto-fit needed; migration candidate #1** | only if multi-tenant | **REJECT (maintenance mode, vendor-recommended successor: vLLM/SGLang/llama.cpp)** | **REJECT (hardware tier, format, ops weight)** | **REJECT (format/ecosystem, no spec-decode, telemetry default)** |
+
+**Verdict.** Ollama stays incumbent — and the audit shows it is *more governable than the inward audit assumed*: per-request keep_alive overrides the env var (A2/A3 verbatim), an idle-unload-to-make-room eviction policy already exists (A3), and /api/ps+show already publish the registry fields (C2). llama.cpp `llama-server` is the capability superset (grammar, spec-decode, auto-fit, sleep-on-idle, priority/affinity, Anthropic-compatible API) at near-zero operational delta — the designated escape hatch, not a parallel stack. vLLM's machinery (B1/B6-class) is real but its gains are concurrency gains; its preemption and sleep telemetry are the features to envy, not to adopt for one user on a shared 16 GB card. TGI, TensorRT-LLM, ORT-GenAI are rejected on audited vendor evidence, not on ignorance.
+
+### 2.2 Residency policy specification (design, not implementation)
+
+**Tenants (Rune's real workload):** E = embedder(s) 0.3–0.8 GB, cheap, continuously used; L = one LLM 9–11.5 GB, expensive, bursty; V = vision models 3–7 GB, occasional.
+
+- **R1 — Pin the cheap tenant.** E runs with `keep_alive: -1` (or MAX_LOADED_MODELS=2 with E first). Cost: 0.3–0.8 GB VRAM — noise against 11.3 GB free (arm-1 V2). Benefit: embedding latency stays sub-second-class forever. Rationale: S-LoRA asymmetry (B1) — tenant state worth keeping resident scales with its size; E is 30× cheaper than L and is used by every retrieval turn.
+- **R2 — Stage the expensive tenant with a TTL.** Every L/V request carries `keep_alive: <TTL>` (start: 10–15 min; measured `load_duration` (C2/A2) should set the final value: if cold load ≪ TTL-accumulated desktop risk, shorten). Rationale: per-request keep_alive overrides `OLLAMA_KEEP_ALIVE=−1` (A2, A3) — no service restart needed. This converts KEEP_ALIVE=−1's "every model is a permanent tenant" into "resident only as long as the workload is active".
+- **R3 — Unload on foreground handoff.** When the box's foreground demand shifts (gaming/desktop VRAM pressure), issue empty-prompt `keep_alive: 0` unload (A2) for the current L/V. Guaranteed effect: VRAM returned to desktop; LLM reload ≈ 1.5–2 s disk read (C3) + init time (measure via load_duration). This is the only "preemption" Rune gets — between requests — because no runtime here can evict a running generation (A3 negative).
+- **R4 — Keep NUM_PARALLEL=1, reconsider MAX_LOADED_MODELS.** NUM_PARALLEL=1 is correct (arm-1 V6; A3: RAM scales NUM_PARALLEL × context). MAX_LOADED_MODELS=1 should become **2** only if embedder co-residency is needed while an LLM is loaded (0.3 + 10.3 < 11.3 free at 8k — arm-1 V2); otherwise keep 1 and accept serialize-load semantics (A3: queued until load completes).
+- **R5 — Registry mirrors residency.** /api/ps (size_vram, expires_at) polled by the capability registry (C2) so every placement decision reads live residency, never static config. `expires_at` is the eviction countdown — the honest "will this fit in 30 s" signal.
+- **Guarantees:** E always warm; L warm exactly TTL-long after last use; VRAM headroom recoverable between requests; eviction never hits E before L (TTL ordering). **Cannot guarantee:** intra-request preemption; VRAM for a 32k-context 14B (arm-1 V2 — a placement problem, not a policy problem); zero cold-start (TTL=0 trades latency for headroom, not both).
+
+### 2.3 Foreground-wins policy specification (knob / layer / guarantee / limit)
+
+| # | Knob | Layer | What it guarantees | What it cannot guarantee |
+|---|---|---|---|---|
+| F1 | per-request `keep_alive` (0 / TTL) | Runtime API (A2/A3) | VRAM freed between requests on demand; background LLM never outlives TTL | Nothing during a running generation; no mid-token eviction |
+| F2 | `OLLAMA_MAX_LOADED_MODELS`, `OLLAMA_NUM_PARALLEL` (env) | Runtime config (A3) | Single-tenant VRAM: foreground request is never throughput-competed by a co-resident model | Load-time serialization spikes (queued until complete-fit) |
+| F3 | llama.cpp `--prio` (−1..3) + `--cpu-mask`/`--cpu-strict` | Runtime process (A1) | CPU-side inference threads outrank/pin over background work | GPU-side fairness (no CUDA-level priority exposed by any audited runtime) |
+| F4 | systemd drop-in on ollama.service: `CPUWeight=` (default 100; foreground services higher, or ollama `CPUWeight=idle` if inference is the background tenant), `MemorySwapMax=` (bound ollama's zram tenancy — Rune has 23.9 GiB swap in use, C4), `IOWeight=`/`IODeviceWeight=` on the model dir, optional `Nice=` | OS cgroup v2 (A10; C1 shows all absent today) | CPU/IO relative priority between ollama and everything else; bounded swap contamination from the service | Hard CPU/VRAM reservation (weights are relative, limits not work-conserving — A10); GPU memory or SM share (MIG doc-absent on this card — A9; MPS unsupported-by-runtime — A8) |
+| F5 | unload-on-idle: llama.cpp `--sleep-idle-seconds` / Ollama idle-unload (A1/A3) | Runtime | Idle models stop being RAM/VRAM tenants automatically | Wake-up latency on first request (reload cost) |
+| F6 | NUM_PARALLEL=1 queue semantics | Runtime | Foreground request gets the whole card; no batch-mate interference (bs=1 = the regime where quantization/decode speedup is maximal — arm-1 A3-row) | Queue-position latency under multi-client bursts (bounded by OLLAMA_MAX_QUEUE=512 + 503s, A3) |
+| F7 | Power cap 225 W (already applied; arm-1 I1 evidence class) | Driver/OS | −23%-class energy for +6.7%-class time; thermal headroom for foreground | Latency determinism (cap is static, not priority-aware) |
+
+**Composite guarantee statement:** Rune can guarantee *between-request* foreground priority (VRAM, CPU, IO, energy all levers) and *cannot* guarantee anything *within* a running request, nor hard VRAM partitioning on GeForce silicon (A9) — the honest boundary of foreground-wins on this hardware. **Verification reading:** the prompt's hypothesis that NUM_PARALLEL=1 is "actually GOOD for foreground-wins" is CONFIRMED — single-request serialization means the foreground request always owns the full card (F2/F6), with the only cost being queue waits that a single user rarely produces.
+
+### 2.4 Capability-registry hardware fields (#404 seam F) — availability from current stack
+
+| Registry field | Obtainable TODAY (source) | Requires runtime change |
+|---|---|---|
+| model identity / digest | /api/tags + /api/ps `digest` (A2, C2) | — |
+| quantization | `details.quantization_level` (A2, C2) | — |
+| runtime | derived (process/port) | — |
+| device / GPU placement | `ollama ps` PROCESSOR column (100% GPU / CPU/GPU split, A3); nvidia-smi | per-layer split ratios not exposed |
+| VRAM requirement | after load: `size_vram` (A2/C2); before load: derived from model_info GGUF metadata (verbose /api/show, C2-negative) + arm-1 KV arithmetic | true pre-load VRAM estimate (llama.cpp `--fit` computes one internally — A1) |
+| context limit | live `context_length` in /api/ps (C2, observed) + `llama.context_length` in verbose /api/show | — |
+| current headroom | nvidia-smi memory.used/total (C4) — external integration needed (Ollama exposes none) | — |
+| measured tok/s | eval_count ÷ eval_duration ×10⁹ (A2, documented formula) | — |
+| latency | total_duration, prompt_eval_duration/duration (A2) | histogram-class latency (vLLM-only, A4) |
+| load time | `load_duration` per request (A2) | — |
+| residency | /api/ps presence + `expires_at` (A2, C2) | — |
+| health | systemd unit state + API reachability | dedicated /health endpoint (llama.cpp has one — A1) |
+| resource-starved state | NO native signal — composite: nvidia-smi + swap usage + eval_duration drift | yes (or external heuristics; arm-1 F5: zram pressure unmeasured) |
+| concurrency | config known (NUM_PARALLEL=1); queue depth NOT exposed | yes (vLLM `num_requests_waiting` class, A4) |
+| preemption count | — | yes (vLLM `num_preemptions`, A4) |
+
+**14 of 15 fields obtainable today**; the 3 gaps (headroom-in-process, starvation, queue depth) are exactly the fields only vLLM-class engines natively publish — a strong argument for registry-side derivation (nvidia-smi + /api/ps + load/eval telemetry) rather than runtime migration.
+
+### 2.5 Resource economics (honest accounting)
+
+- **Idle residency cost (R1/R2 interplay):** a resident 11 GB LLM converts a 16 GB card into a ~1 GB-free card — gaming/desktop capacity effectively zero while resident (C4: desktop already holds 4.8 GB). The embedder's idle cost (0.3 GB) is ~1/30th. Asymmetry, not absolute residency, is the economic variable.
+- **Energy per token:** 2–4 J/token derived (arm-1 I1 arithmetic at 40–60 t/s × ~100–200 W); at Rune's 225 W cap the I1 transfer says the cap is already the −23%-energy intervention. Idle residency energy is near-nil (GPU clocks down); the economic idle cost is VRAM, not watts.
+- **Reload cost per eviction cycle:** measured disk component 9–12 GB ÷ 6.0 GB/s ≈ **1.5–2 s** (C3); total cold load = this + tensor init + first-token warmup (measure via `load_duration`, A2). With R2 TTL=10–15 min, a bursty session pays ~1 reload per idle gap; KEEP_ALIVE=−1 pays zero reloads but permanent VRAM tenancy — the policy choice is explicit: seconds of reload vs gigabytes of headroom.
+- **Retry/failure economics (bounded model, no audited source — labeled arithmetic):** a failed generation costs (tokens-so-far × J/token) + wall-time + one full retry. If failure probability p, effective cost = cost/p; a "fast" runtime with p=0.2 costs 25% more than its nominal latency; a slower-but-reliable path wins when (t_fast/p_fast) > t_slow/p_slow. For Rune this mainly argues: single runtime, systemd restart discipline (already present, C1), and not stacking speculative decoding (which adds a second failure surface per arm-1 D5) until measured. **No peer-reviewed per-retry LLM-cost study was found this session (bounded zero-hit; search population: arXiv serving-lit rows above + retry-cost queries; date 2026-09-23).**
+- **Operational complexity:** each additional service = one more failure surface (restart loops, port conflicts, upgrade drift) and one more #402-seam exposure (loopback binding is Rune's current defense — C1 `OLLAMA_HOST=127.0.0.1`; systemd `IPAddressAllow=` exists as the drop-in hardening lever if policy ever wants it, A10). The escape-hatch pattern (Ollama default, llama.cpp for special runs) must not become two always-on services.
+
+### 2.6 Current vs future hardware — portability bounds (not purchase requirements)
+
+- **16 GB (today):** 14B-Q4 @ 8k fits (~1 GB margin); 32k exceeds free VRAM with desktop co-tenant (arm-1 V2); 27B IQ2_M marginal-to-fail; 7B/3B comfortable; embedders trivial. 8k context is the governed default until hardware or desktop tenancy changes.
+- **24 GB:** unlocks 14B @ 32k-class context or a 32B-Q4 @ 8k — the first bound where the "fits with context" arithmetic flips rather than the model tier.
+- **48 GB:** 70B-Q4 class becomes single-card viable — quality tier change, not a mechanism change.
+- **What must stay abstracted so migration is a config change, not a re-architecture:** (1) model-agnostic [OI]-compatible gateway (llama.cpp already speaks [OI]+Anthropic+Ollama-style — A1); (2) capability registry fields keyed on live telemetry (§2.4), never on model names; (3) context as a per-model/per-request parameter (`num_ctx` today, `-c`/`--fit` tomorrow); (4) device abstraction as (VRAM bytes, bandwidth) pairs — arm-1 H-rules — so "the GPU" is never assumed singular; (5) residency policy expressed in keep_alive/TTL semantics that both audited runtimes share.
+
+### 2.7 Multi-node / LAN verdict
+
+- **Tensor/pipeline-parallel inference over Rune's LAN: REJECT.** Arithmetic (E1): consumer LAN 1–10 GbE = 125–1250 MB/s; WiFi hop worse and load-sensitive (D2: unmanaged WiFi latency under load sits an order of magnitude above best case; bufferbloat mechanism). GPU interconnect designs presume hundreds of GB/s (PCIe 64 GB/s is already "the enemy" per A1/E1; Splitwise explicitly requires "fast back-plane interconnects available in today's GPU clusters" — B4). Per-token weight traffic across the wire is 100–1000× the LAN budget at 14B-class. Petals (B3) is the measured existence proof that network-pipelined inference lands at ~1 token/s even when engineered for it.
+- **Remote API calls over LAN: viable pattern, REJECT-now.** Any [OI]-compatible server on another machine works over the wireless LAN for non-latency-critical calls (this is the only realistic multi-node pattern). Rune has exactly ONE inference-capable machine (Pi excluded — D1), so there is no second endpoint to call: FUTURE capability, no present design work beyond keeping the gateway address-configurable (§2.6 abstraction #1).
+- **llama.cpp `--rpc` (A1):** exists — multi-host layer offload over TCP — and lands in exactly the bandwidth-bound regime B3/B4 describe; noted as evidence the mechanism is one flag away, NOT as a recommendation.
+- **Pi:** inference REJECT (D1: hand-tuned 3B-active MoE best case 2.13–3.04 t/s on Pi 5; dense 7B+ far below; no usable GPU). Cold backup = **ADAPT**: currently UNREACHABLE (inward); needs reachability fix, restore-verification drill, and — because it is a family-shared box — adversarial-risk treatment (family members may reconfigure/compromise it; #402 seam). SQLite on any backup target must be ≥3.51.3 or patched (A11) before copying databases with -wal files.
+
+### 2.8 Storage placement verdict
+
+- **Models stay on /mnt/fast-storage/ai/ollama — already correct (C1 unit `OLLAMA_MODELS`), FAQ-documented knob (A3).** Capacity: 993 GB free vs 96 GB on `/`. Measured 6.0 GB/s direct read (C3) ⇒ load-time is init-bound, not disk-bound; no migration gain available from a faster tier because the tiers' read bandwidths are not the bottleneck.
+- **Correction to inward framing:** `/` (346G) and `/mnt/fast-storage` (3.3T) are **partitions of the same physical NVMe (nvme2n1)** — only /mnt/workdrive (nvme1, 1.8T, 475G used) is a separate device (C3). Consequence: model loads share silicon with system-disk I/O; if load-time variance ever matters, the IOWeight/IODeviceWeight lever (A10) or relocating the *system's* write-heavy state (not the models) is the lever — not moving models again.
+- **mmap vs --no-mmap/mlock:** keep mmap-default behavior. `--no-mmap` (slower load, "may reduce pageouts" per A1) trades load latency for determinism; `mlock` on a 9–12 GB model would pin ~10 GB in RAM while 30.9 GiB of 62 is already used and 23.9 GiB of zram swap is live (C4) — mlock worsens desktop pressure. mmap + R2 TTLs + optionally `MemorySwapMax=` on the service (A10) is the evidence-aligned configuration. Page-cache warm vs cold load delta: unmeasured on this machine (honest gap; `load_duration` telemetry can measure it).
+- **SQLite:** 436 MB is trivial vs 71 GB of models (C1/C3) — no placement work warranted. Backup caveats verified and sharpened (A11): the `-wal`/`-shm` pair is part of persistent state — copy database+wal together and only while no writer is active; prefer checkpoint-then-copy or the backup API / `VACUUM INTO`; never strip the `-wal` file from a copy ("the only safe way to remove a WAL file is open+close"). **WAL-reset bug: present 3.7.0–3.51.2, fixed 3.51.3 (2026-03-13); Rune runs 3.53.4 (C4) ⇒ fixed here; version-check any backup/Pi target.**
+
+---
+
+## PART 3 — REJECTED APPROACHES (with rejection evidence)
+
+1. **TGI as Rune's runtime.** REJECT: vendor-declared maintenance mode with explicit successor advice (vLLM/SGLang/llama.cpp) — A5; no GGUF. Strongest form of negative evidence available.
+2. **TensorRT-LLM.** REJECT: datacenter-tier deployment guides (Blackwell/Hopper), own engine format, heaviest ops surface — A6; wrong hardware, wrong format, wrong team size.
+3. **ONNX Runtime GenAI.** REJECT on fit after honest audit (arm-1's exclusion resolved): no GGUF, speculative decoding roadmap-only, telemetry phone-home default conflicts with privacy posture — A7.
+4. **MIG-based VRAM partitioning on the 4070 Ti SUPER.** REJECT: card absent from NVIDIA's supported-GPU table (A9) — doc-verified, upgrading arm-1's inference to evidence.
+5. **MPS-based SM partitioning today.** REJECT (defer): mechanism real (A8) but no audited runtime integrates it, GeForce support matrix unaudited (register), and its benefit duplicates what residency policy achieves between requests.
+6. **Tensor/pipeline-parallel distributed inference over Rune's wireless LAN.** REJECT: 125–1250 MB/s vs hundreds of GB/s interconnect assumption (E1/B4); WiFi bufferbloat latency variance (D2); measured ~1 token/s for engineered network-pipelined inference (B3).
+7. **Pi as an inference tier.** REJECT: ~3 t/s ceiling on a hand-tuned 3B-active MoE (D1); dense 7B–27B far below; ADAPT for cold-backup role only (reachability + restore drill + version-checked SQLite + family adversarial risk).
+8. **llama.cpp `--rpc` multi-host offload for Rune.** REJECT-now: one inference-capable machine; mechanism lands in the B3/B4 bandwidth-bound regime; recorded only as a one-flag-away future option (A1).
+9. **mlock-ing large models to "stop swap".** REJECT: pins ~10 GB against 23.9 GiB live swap pressure and 30.9 GiB RAM used (C4, A1 tradeoff); R2 TTLs + MemorySwapMax achieve determinism at lower cost.
+10. **MAX_LOADED_MODELS>2 / NUM_PARALLEL>1 for "responsiveness".** REJECT: complete-fit VRAM rule + NUM_PARALLEL×context RAM scaling (A3); bs=1 single user gets zero latency benefit from batching (arm-1 V6/E-rows); R4 keeps 1 (or 2 for embedder pinning) — serialization is the foreground-wins feature (§2.3).
+11. **"Models must move off the system disk" reflex.** REJECT as stated: they already live on the 3.3 TB NVMe (C1); the real finding is that "fast-storage" shares silicon with the system disk (C3) — placement is correct; contention, if measured, is an IOWeight problem.
+
+---
+
+## PART 4 — DO-NOT-CITE REGISTER
+
+| Item | Reason |
+|---|---|
+| "Petals = arXiv:2311.10103" and "= arXiv:2311.10683" | Both verified MIS-PAIRED this session (Orlicz–Sobolev homogenization; Vekua operators). Correct: 2209.01188 |
+| "AlpaServe = arXiv:2302.13265" | Verified MIS-PAIRED (Schwinger pair production in QCD). Cite USENIX OSDI'23 (li-zhouhan) only |
+| "Orca = arXiv:2202.03225" | Verified MIS-PAIRED (odd Langevin systems). Orca has no arXiv entry used; cite USENIX OSDI'22 page |
+| MPS on GeForce ("works"/"doesn't") | Overview audited; per-architecture support matrix not read — registered untested (A8) |
+| CUDA time-slicing behavioral details on this card | Generic mechanism; per-card audit not performed |
+| llama.cpp /metrics exact Prometheus metric names | Flag + endpoint audited (A1); metric list not read — describe capability, never enumerate |
+| Ollama /api/ps `context_length` field as documented API | Observed live (C2) but absent from current api.md example — cite as observed behavior, version-dependent |
+| Any specific ms number for Rune's LAN WiFi latency | Only directional peer-reviewed evidence carried (D2); no on-LAN measurement taken |
+| Pi 5 dense-model t/s figures (any number) | Extrapolated from 3B-active MoE community data (D1) — label derived, never cite as measurement |
+| Retry/failure cost multipliers for LLM serving | Bounded zero-hit (§2.5); present as arithmetic only |
+| Ollama idle-unload timing/magnitude beyond doc sentence | Docs state policy existence (A3), no numbers published |
+| "3.51.3 WAL-reset fix applies to Rune" | Rune already 3.53.4 (C4) — the fix is relevant only to other/backup targets; check versions before citing elsewhere |
+| 4 mis-paired arXiv IDs caught this session | 2311.10103, 2311.10683, 2302.13265, 2202.03225 — all export-API-verified as different papers (all were arm-2's own first-pass guesses; correction pattern matches arm-1's 8) |
+
+---
+
+## Arm-2 accounting
+
+**Sources: 27 rows (~32 underlying sources)** — DOCUMENTATION_AUDITED 11 (llama.cpp server README, Ollama api.md + faq.mdx, vLLM production metrics, TGI docs, TensorRT-LLM docs, ORT-GenAI README, NVIDIA MPS, NVIDIA MIG supported-GPUs, systemd.resource-control(5), SQLite WAL) · ABSTRACT_ONLY 6 (S-LoRA, ServerlessLLM, Petals, Splitwise, SGLang, WiFi-latency) · USENIX page-verified 2 (Orca, AlpaServe) · LOCAL_OBSERVED 3 (systemd unit, live API probes, nvidia-smi/free/sqlite) · LOCAL_MEASURED 1 (dd 6.0 GB/s + df mapping) · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 1 (Pi 5) · INHERITED_VERIFIED 1 row carrying 5 arm-1 sources. **Verification: every arXiv ID export-API-resolved this session; 4 mis-pairings caught and corrected; 2 corrections found via title search after candidate IDs failed.** Deepest reads landed on the mandated priorities: runtime config surfaces (A1–A7), residency/eviction semantics (A3, B1–B2, §2.2), foreground-wins mechanisms (A1/A9/A10, §2.3), telemetry-to-registry mapping (A2/A4, C2, §2.4), storage (C1/C3, A11, §2.8), multi-node (B3/B4/D1/D2, §2.7).

research/memory-atlas-r1/AD-hardware-resource-placement/02_outward/arm3_degradation_portability.md

@@ -0,0 +1,242 @@
+# Arm 3 — Degradation / Failure / Portability / Experimental-Topology Room
+
+**Domain:** ATLAS R1 #405 AD — Hardware / Resource Placement · **Arm:** 3 of 4 (research only)
+**Date of evidence collection:** 2026-09-23 · **Builds on:** arm-1 `arm1_hardware_foundations.md`, arm-2 `arm2_serving_runtime_placement.md` (not re-researched)
+**Scope:** resource-starved state representation · failure modes + degraded paths · portability/model-agnostic topology · experimental-topology room · capability-registry hardware-field spec · T1/EXPERIMENT/FUTURE/NOT-NEEDED/REJECT · energy (brief)
+**Explicitly out of scope:** the cognitive degradation ladder (#404 owns it), evaluation logic (#406 owns observed task capability), and any production mutation. Local probes were read-only: no config changed, no model loaded/unloaded, no inference benchmark run.
+
+---
+
+## 0. Verification discipline — what was checked this session
+
+- **All 18 arXiv IDs cited below were resolved against `export.arxiv.org/api/query` this session** (title + authors + abstract pulled, not assumed). **0 mis-pairings found this session.**
+- **The controller's prompt ID was re-checked and is CORRECT:** `1703.00064` = *"Ending the Anomaly: Achieving Low Latency and Airtime Fairness in WiFi"* (Høiland-Jørgensen, Kazior, Täht, Hurtig, Brunstrom, 2017) — this is the WiFi-latency-under-load paper arm-2 relied on. Unlike the 8 mis-paired IDs arm-1/2 caught in the earlier controller list, this one verifies.
+- Two IDs in the prompt's inherited set were re-verified rather than inherited blind: `2309.06180` (PagedAttention, Kwon et al.) and `2311.03285` (S-LoRA) — both correct.
+- **New negative verifications (do not cite as available):** Ollama's current Modelfile reference (main, fetched 2026-09-23) contains **zero occurrences of "ADAPTER"** — Ollama LoRA/adapter serving is **not documented in the current reference** and must not be asserted. llama.cpp `--lora` *is* documented (verified line-level).
+- **Claim that could not be reproduced:** the inward-truth "436 MB SQLite" store. Bounded local search found only `store/memory.db` 180 KB and `graph/graph.sqlite` 40 KB (harness store total 4.2 MB); `src/` contains **213** `.py` files, not 152. See §2.2 "deterministic core" row — the arithmetic is plausible as an envelope but **not verified by this arm**.
+
+---
+
+## 1. Per-source rows
+
+Depth labels: FULL_PAPER / RELEVANT_SECTIONS / DOCUMENTATION_AUDITED / ABSTRACT_ONLY / METADATA_VERIFIED / INHERITED_VERIFIED / LOCAL_OBSERVED / LOCAL_MEASURED.
+
+| ID | Title / source | Authors, year, venue | Topic | Key claims | Negative results | Limitations | Depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|
+| A3-01 | `arXiv:1703.00064` Ending the Anomaly: Achieving Low Latency and Airtime Fairness in WiFi | Høiland-Jørgensen, Kazior, Täht, Hurtig, Brunstrom 2017 (CoNEXT) | WiFi latency under load | Unmanaged WiFi latency under load sits an order of magnitude above best case; airtime fairness fixes it | Unmanaged queues collapse latency | 2017 hardware; not inference-specific | METADATA_VERIFIED (re-verified; arm-2 ABSTRACT_ONLY) | Justifies LAN-loss/remote-endpoint REJECT; prompt pairing CORRECT |
+| A3-02 | `arXiv:2309.06180` PagedAttention / vLLM | Kwon, Li, Zhuang, Sheng, Zheng, Yu, Gonzalez, Zhang et al. 2023 SOSP | KV memory management | Paging KV in fixed blocks; preemption = swap-to-CPU or recompute | Naive KV allocation wastes 60–80% of KV memory | Datacenter concurrency focus | INHERITED_VERIFIED (arm-1 RELEVANT_SECTIONS; ID re-verified) | Basis for KV-headroom field + eviction semantics; machinery not adopted (single user) |
+| A3-03 | `arXiv:2311.03285` S-LoRA | Sheng et al. 2023 SOSP | Multi-adapter serving | Thousands of adapters on one GPU holding a single base copy; unified adapter paging | — | Cluster-scale, batched serving | INHERITED_VERIFIED (arm-2 ABSTRACT_ONLY; ID re-verified) | Adapter VRAM cost ≪ base model; adapter serving does not require a second base copy |
+| A3-04 | `arXiv:2310.18547` Punica: Multi-Tenant LoRA Serving | Chen et al. 2023 (MLSys 2024) | Multi-tenant LoRA | Single base copy + batched multi-adapter kernels; consolidating scheduler | — | Requires custom CUDA kernels | ABSTRACT_ONLY | Reinforces "adapter ≠ second model" arithmetic; not adoptable on Ollama today |
+| A3-05 | `arXiv:2505.03756` FASTLIBRA (multi-LoRA + KV caching) | 2025 | Multi-LoRA serving cost | Dependency-aware caching of hot LoRAs and KV caches; TTFT-oriented | Existing multi-LoRA systems neglect usage dependencies | Research prototype | ABSTRACT_ONLY | Names the real cost driver (adapter + KV co-caching); marginal at N=1 |
+| A3-06 | `arXiv:2407.00047` QLM: Queue management for SLO-oriented LLM serving | 2024 | Overload degradation | Multiplexing batch + interactive across models/SLOs via one queue; explicit quality/latency trade under overload | Interactive-only schedulers multiplex poorly | Cloud multi-tenant | ABSTRACT_ONLY | Evidence that overload degrades *quality/latency*, not correctness — the measurable side is queue state (§2.1 S8) |
+| A3-07 | `arXiv:2308.15030` SwapMoE | 2023 | Memory-budget MoE serving | Keep important experts resident, swap the rest; tunable memory budget | Naive swapping ⇒ much higher latency; expert pruning ⇒ accuracy loss | MoE-specific | ABSTRACT_ONLY | Direct evidence that *relying on swap* for weights costs latency; argues for fit-or-don't-load, not spill |
+| A3-08 | `arXiv:2411.09317` Pie: Pooling CPU Memory for LLM Inference | 2024 | GPU↔CPU memory spill | "Traditional GPU-CPU memory swapping often results in higher latency and lower throughput"; performance-transparent swapping requires NVLink-C2C-class hardware (GH200) | Naive swap is slow — stated as the motivating negative result | Requires GH200-class interconnect | ABSTRACT_ONLY | Closest external statement of swap-vs-latency; **not applicable** to PCIe 4.0 + zram (§2.8 zero-hit) |
+| A3-09 | `arXiv:2511.14116` FailSafe: High-performance Resilient Serving | 2025 | Fault-tolerant TP serving | Cyclic KV placement + hybrid attention survive a single GPU failure | TP coupling: one GPU failure halts execution and triggers costly KV recomputation | Multi-GPU TP only | ABSTRACT_ONLY | Blast-radius framing for multi-device; mechanism NOT NEEDED here |
+| A3-10 | `arXiv:2503.11901` Story of Two GPUs: H100 vs A100 resilience | 2025 | GPU error rates, 11.7M GPU-hours | H100 memory resilience worse than A100 (3.2× lower per-GPU MTBE); recovery mechanisms insufficient at higher memory capacity | Vendor recovery mechanisms do not scale with capacity | Datacenter GPUs with ECC; **not GeForce** | ABSTRACT_ONLY | GPU memory errors are a measured, non-exotic failure class; GeForce has no ECC ⇒ different profile; do NOT transfer numbers |
+| A3-11 | `arXiv:2201.11853` Prediction of GPU Failures Under DL Workloads | 2022 | Failure prediction | Classic prediction models are inaccurate and unstable under production DL workloads | Naive prediction fails | Training-cluster focus | METADATA_VERIFIED | Supports: do not build predictive failure logic; **detect and recover** instead |
+| A3-12 | `arXiv:2604.07874` Valve: Online-Offline Inference Colocation | 2026 | Bounded preemption | Sub-millisecond compute preemption, bounded preemption rate, production-friendly | Naive colocation ⇒ large online interference from slow/frequent preemption | Datacenter; requires driver/framework modification | ABSTRACT_ONLY | Foreground-wins evidence: interference is real and needs mechanisms Rune does not have on GeForce |
+| A3-13 | `arXiv:2604.28175` Strait: Perceiving Priority and Interference | 2026 | Dual-priority scheduling | Models data-transfer contention + kernel interference; priority-aware scheduling improves deadline satisfaction | On-prem systems lack prioritisation and mis-estimate concurrent latency | On-prem datacenter | ABSTRACT_ONLY | Honest basis for "between-request priority yes, within-request priority no" |
+| A3-14 | `arXiv:2110.00459` Characterizing Concurrency Mechanisms for NVIDIA GPUs | 2021 | MPS / time-slicing / streams microarchitecture | Lack of fine-grained preemption, robust prioritisation, and contention-aware block placement limits concurrency mechanisms' effectiveness | Concurrency mechanisms underperform; kernel runtimes fluctuate | Ampere datacenter; training+inference mix | ABSTRACT_ONLY | Mechanism-level basis for "gaming + inference on one GPU = contention, not isolation" (§2.7) |
+| A3-15 | `arXiv:2608.13689` Bounded Reclaim Actuator for PSI-Guided Compressed Memory | 2026 | PSI + zram + cgroup reclaim | PSI detects memory stalls *before* the kernel kills; zram and cgroup-v2 reclaim act at different points in the pressure path; controlled ablation of three setups | Conflating the facilities is a common error (they are not interchangeable) | System-level; not inference-specific | ABSTRACT_ONLY | Direct support for state S4 telemetry: **use PSI, not zram occupancy**, as the pressure signal |
+| A3-16 | `arXiv:2609.02052` SchedBlame: Culprit-Attributed CPU Contention | 2026 | CPU contention attribution | Attributes CPU contention to specific culprits on stock kernels | — | Container-oriented | ABSTRACT_ONLY | Candidate for attributing CPU pressure to a process; not needed at T1 |
+| A3-17 | `arXiv:2508.15987` PickleBall: Secure Deserialization of ML Models | 2025 | Untrusted model weights | 44.9% of popular HF models still use pickle; 15% of those cannot load under restrictive policies; scanners have FP and FN; transparent safe loading is possible | Existing defences (safe formats, restrictive policies, scanners) each insufficient alone | Pickle-specific | ABSTRACT_ONLY | #402-seam evidence: untrusted weights are a real threat class; isolation for experimental weights is justified |
+| A3-18 | `arXiv:2311.15566` SpotServe | 2023 | Serving on preemptible instances | Migration + KV recompute are the costs of forced preemption | — | Cloud instances | METADATA_VERIFIED | Preemption-cost framing; marginal for single-user — recorded, not adopted |
+| A3-19 | NVIDIA XID Errors doc set: *Working with Xid Errors* + *Analyzing Xid Errors with the Xid Catalog* (docs.nvidia.com/deploy/xid-errors, accessed 2026-09-23, doc updated 2026-09-09) | NVIDIA 2026 | GPU fault taxonomy + recovery buckets | Xids are logged in the kernel log (`grep "NVRM: Xid"`); nvidia-smi reports ECC/Xid 48, unplugged power (54), GPU Recovery Action (154). **XID 13** Graphics Engine Exception → RESTART_APP (general user-app fault, typically out-of-bounds; hardware failure rare); **XID 31** MMU fault (GPU memory page fault) → RESTART_APP; **XID 43** GPU stopped processing → GPU *remains healthy*, IGNORE; **XID 45** preemptive cleanup (Ctrl-C/sigkill/GPU reset) → IGNORE or RESTART_FM if solo; **XID 46** → RESET_GPU; **XID 48** double-bit ECC → **GPU reset or node reboot needed to clear**; **XID 62** µcontroller halt → RESET_GPU; **XID 63/64** row remapping events; **XID 79** "GPU has fallen off the bus" → **RESTART_BM (restart bare metal)**; **XID 94** contained to one application — restart that app, reset GPU when convenient, other apps unaffected; **XID 95** affects multiple applications — GPU must be reset before apps restart | Buckets assume datacenter reset support; GeForce reset capabilities are governed by separate GPU-reset guidance; several catalog rows are "Unused" (deprecated/datacenter-only) | DOCUMENTATION_AUDITED | Detection signal + recovery column of the failure table (§2.2). Note XID 45 is what a **user pressing Ctrl-C** produces — benign noise, must not be alerted on |
+| A3-20 | Linux kernel PSI documentation (docs.kernel.org/accounting/psi.html, docs version 7.3.0-rc4) | Weiner, J. (2018) | Pressure Stall Information semantics | `/proc/pressure/{cpu,memory,io}`; **some** = share of time at least some tasks stalled; **full** = all non-idle tasks stalled simultaneously ⇒ "considered to be thrashing"; 10/60/300 s windows plus cumulative µs; poll() triggers (`some 150000 1000000` = 150 ms per 1 s); cgroup-v2 exposes per-cgroup `cpu.pressure`/`memory.pressure`/`io.pressure`; **CPU full is undefined system-wide** (zero since 5.13 for back-compat); min window 500 ms, max 10 s | Thresholds are heuristic, not causal; PSI measures *stall*, not *cause* | Needs CONFIG_PSI; per-cgroup monitoring is the isolation seam | DOCUMENTATION_AUDITED | Primary telemetry for S3/S4 (§2.1); confirms PSI is the correct primitive for "resource-starved" and that zram occupancy is not |
+| A3-21 | Linux kernel zram documentation (docs.kernel.org/admin-guide/blockdev/zram.html) | Gupta, N. | Compressed RAM block device | Stats at `/sys/block/zram<id>/mm_stat`: `orig_data_size` (uncompressed), `compr_data_size`, `mem_used_total`, `mem_limit`, `same_pages`, `huge_pages`; `io_stat` for failed reads/writes; optional writeback to a backing device, recompression (`recomp_algorithm`), idle-page tracking; "little point creating a zram of greater than twice the size of memory since we expect a 2:1 compression ratio" | zram compression/decompression consumes CPU cycles (a CPU-pressure source in its own right); writeback can wear flash | Admin doc; no workload guidance | DOCUMENTATION_AUDITED | Read `mm_stat` + PSI for S4; explains why "23 GiB swap used" is not by itself a degradation signal on a compressed-swap machine |
+| A3-22 | safetensors documentation (huggingface.co/docs/safetensors, accessed 2026-09-23) | Hugging Face | Safe tensor format | Format stores tensors only (no code execution), zero-copy, fast; adopted by transformers, llama.cpp conversion path, etc. | Front page carries no threat model and no guarantee of scanner equivalence | DOCUMENTATION_AUDITED | Cheap isolation seam for untrusted weights (§2.4f): prefer safetensors/GGUF, treat pickle artifacts as untrusted |
+| A3-23 | llama.cpp `tools/server/README.md` (ggml-org/llama.cpp master, fetched 2026-09-23) | ggml-org | Runtime capability + telemetry surface | `--lora FNAME` (comma-separated multiple adapters), `--lora-scaled FNAME:SCALE`, `--lora-init-without-apply`, per-request `lora` field — **"requests with different LoRA configurations will not be batched together, which may result in performance degradation"**; `GET /lora-adapters`, `POST /lora-adapters`; `GET /health` (public, no API key); `/metrics` Prometheus (off by default) exposing `llamacpp:requests_processing`, **`llamacpp:requests_deferred`**, `predicted_tokens_seconds`, `n_tokens_max`, `n_busy_slots_per_decode`, spec-decode counters | **No `kv_cache_usage` metric in the published list** (that is vLLM-class) | Escape hatch, not the incumbent runtime | DOCUMENTATION_AUDITED (line-level, this session) | Adapter serving = one flag away; **queue-depth is obtainable today only here** (§2.5) |
+| A3-24 | Ollama API reference (`docs/api.md`, via arm-2) + Ollama Modelfile reference (`docs/modelfile.mdx`, fetched 2026-09-23) | Ollama | API + config surface | api.md (arm-2 audited): per-request `keep_alive` verbatim-overrides `OLLAMA_KEEP_ALIVE`; `/api/ps` exposes `size_vram`, `digest`, `details.quantization_level`, `expires_at`, observed `context_length`; response stats expose `load_duration`, `eval_count`, `eval_duration`, `prompt_eval_count/duration`. **New this session:** current Modelfile reference lists FROM / PARAMETER / TEMPLATE / SYSTEM and contains **no ADAPTER directive** | Ollama LoRA/adapter serving is undocumented in the current reference — do not assume it; no /metrics, no /health, no queue depth in api.md | Docs snapshot at one date; version-dependent | DOCUMENTATION_AUDITED (partial, this session) + INHERITED_VERIFIED (api.md, arm-2) | Keeps the registry spec honest about which fields exist on the incumbent runtime |
+| A3-25 | Local nvidia-smi probes (read-only, 2026-09-23) | LOCAL_OBSERVED | GPU state truth | 16 376 MiB total / **5 154 MiB used / 10 852 MiB free**; 8 compute processes: kwin_wayland 298, python 14, Discord renderer 213, Brave GPU 475, LibreOffice 208, **Vivaldi GPU 974**, python 210, `ollama/llama-server` 580 MiB; temp 53 °C; `power.draw` 44.27 W; `power.limit` **225 W** vs `power.max_limit` **366 W**; driver 615.71.09; `clocks_event_reasons` idle (0x1), HW thermal slowdown Not Active, **cumulative SW Power Capping = 449 880 646 317 µs ≈ 125 GPU-hours** | Desktop tenancy is *larger and more variable* than the inward snapshot (Vivaldi alone 974 MiB; browsers grow) | nvidia-smi samples at ~1 s; no per-process VRAM cap on GeForce | LOCAL_OBSERVED | Constants for every fit verdict; the 125 h power-cap counter is direct evidence the 225 W cap binds in practice (§2.7) |
+| A3-26 | Local pressure/memory probes: `/proc/pressure/*`, `/proc/meminfo`, `/proc/swaps`, `zramctl` (read-only, 2026-09-23) | LOCAL_OBSERVED | Memory pressure truth | **PSI is available**: files `cpu`, `io`, `irq`, `memory` all present; `memory some avg10=0.00 avg60=0.00 avg300=0.00 total=41 335 252` µs; `io some total=268 745 396 600` µs vs `io full total=258 242 873 604` µs; `cpu some total=1 901 626 446` µs. MemTotal 62.7 GiB, MemAvailable 32.6 GiB, AnonPages 16.0 GiB, Cached 26.7 GiB, SwapTotal 31.4 GiB, **SwapFree 8.2 GiB**, SwapCached 13 MB, zswap 0; zram0 zstd: DISKSIZE 31.4 G, **DATA 22.3 G, COMPR 7.7 G, MEM 7.9 G** | **The historical "23 GiB swap used" is mostly *zram resident compressed data* (7.9 GB of RAM), and current memory PSI is ~0** — the machine is *not* currently stalling; sustained swap *occupancy* ≠ sustained swap *pressure*. This is the forced correction arm-1 could not make without PSI | `/proc/sys/vm/psi` absent (that file only exists when PSI is disabled — its absence is *consistent* with PSI being on, and the `/proc/pressure/*` files are the proof); no `meminfo` counter for zram compression CPU | LOCAL_OBSERVED | Reframes the inward "real sustained swap pressure" claim: occupancy confirmed, *stall* not observed at probe time; the signal to watch is `memory full` + deltas, not occupancy |
+| A3-27 | Local OOM-protection state: `systemctl is-active earlyoom systemd-oomd`; `systemctl cat earlyoom` (read-only, 2026-09-23) | LOCAL_OBSERVED | RAM-exhaustion reaction | **earlyoom ACTIVE** with `-r 3600 -n --avoid (^|/)(init|systemd|Xorg|sshd)$`; **systemd-oomd inactive** | Ollama and the deterministic core are **not** in the avoid list — under RAM exhaustion earlyoom may kill the largest RSS process, which would be the LLM runner, not the core (favourable), but nothing guarantees it | Policy is host-level, not Rune-aware | LOCAL_OBSERVED | Detection+reaction for RAM exhaustion already exists; the deterministic core's small RSS is a genuine (not designed) protection (§2.2) |
+| A3-28 | Local storage topology re-verification (`df -h`, `lsblk`, 2026-09-23) | LOCAL_OBSERVED | Failure-domain mapping | `/dev/nvme2n1p3` 346 G **72 % full → `/`**; `nvme2n1p2` 3.3 T 69 % → `/mnt/fast-storage`; **same physical device nvme2n1**; `nvme1n1p1` 1.8 T 27 % → `/mnt/workdrive` (separate); also sda 465 G `/mnt/Plugins-and-Instruments`, sdb 7.3 T `/mnt/media-archive`, nvme0n1 931 G `/mnt/games-storage-1tb`; **`/var/tmp` is mounted from `nvme2n1p3` (the 72 %-full system partition)** | The 72 %-full system disk is a single point of failure for OS + /var/tmp + /mnt/fast-storage simultaneously; Rune's own store lives on the *other* device | NVMe SMART not readable without root (`nvme smart-log` → Permission denied) — disk health is unverified | LOCAL_OBSERVED | Failure table rows "NVMe failure" and "full disk"; Rune store and system disk are already in different failure domains (good, keep it) |
+| A3-29 | Rune deterministic-core arithmetic probe (read-only filesystem inspection, 2026-09-23) | LOCAL_OBSERVED | Verify "152 modules + 436 MB SQLite ≈ 0.5 GB" | Harness tree: `store/memory.db` **180 KB**, `graph/graph.sqlite` **40 KB**, store total 4.2 MB, `src/` 213 `.py` files / 6.6 MB | **The 436 MB SQLite store could not be located** in a bounded search (largest DBs on the machine are the *harness tools' own* stores: opencode.db 1.7 G, mimocode.db 1.4 G — unrelated to Rune); the "152 modules" count also does not match the 213 `.py` files in `src/` (different populations, so not a contradiction, but not a confirmation either) | Cannot audit what cannot be located; SQLite file size ≠ resident memory | LOCAL_OBSERVED | The 0.5 GB claim stands only as an order-of-magnitude envelope with the SQLite-size≠RSS caveat (§2.2) |
+| A3-30 | Inherited set from arms 1–2 (roofline, measured throughput, KV arithmetic, power capping, Dettmers law, MIG/TGI/TensorRT/ORT-GenAI verdicts, Petals, Pi, NVMe 6.0 GB/s, keep_alive semantics, /api/ps field set) | arm-1 / arm-2 (INHERITED_VERIFIED) | Hardware/runtime foundations | Decode is memory-bandwidth-bound (T = bytes ÷ bandwidth); 7B q4_0: 11 t/s CPU vs 133 t/s RTX3090 (12–13×); 14B-Q4 ≈ 50–60 t/s GPU, 8k tight, 32k exceeds VRAM with desktop co-tenant; KV 80–96 KiB/token q8_0 (14B class); Gemma-3 5:1 sliding window cuts KV ~5×; NVMe 6.0 GB/s ⇒ 1.5–2 s cold-load disk component; load churn (not concurrency) is the single-user risk; power capping −23 % energy for +6.7 % time; Dettmers 35k-experiment law (4-bit near-optimal at equal bits; breaks ≤3 bpw and on reasoning/off-domain); MIG unavailable on AD103; TGI in maintenance; TensorRT-LLM Hopper/Blackwell-tier; ORT-GenAI no GGUF; Petals ~1 t/s engineered; Pi best case 2.13–3.04 t/s; per-request `keep_alive` verbatim-overrides the env var; 14/15 registry fields obtainable today | See arm-1/arm-2 zero-hits (swap-pressure degradation; retry-cost study) | — | INHERITED_VERIFIED | Load-bearing constants used unmodified below |
+
+**Source tally:** 30 rows / ≈36 underlying documents — **ABSTRACT_ONLY 13** (A3-04…A3-10, A3-12…A3-17) · **METADATA_VERIFIED 3** (A3-01, A3-11, A3-18) · **DOCUMENTATION_AUDITED 6 rows** covering 8 documents (A3-19 XID doc set = 2 pages, A3-23 llama.cpp README, A3-24 Ollama api.md + modelfile reference) · **LOCAL_OBSERVED 5** (A3-25…A3-29) · **INHERITED_VERIFIED 3** (A3-02, A3-03, A3-30, carrying the arms-1/2 set). 18 arXiv IDs, all export-API-resolved this session. **Zero LOCAL_MEASURED** this arm — no benchmark was run, by mandate.
+
+---
+
+## 2. Synthesis
+
+### 2.1 Resource-starved state taxonomy — minimal, measurable, with telemetry sources and detection limits
+
+Design rules applied: (i) **availability is not usability** — every state must be detectable *before* a request is issued, from a field that exists today; (ii) prefer the kernel's own pressure accounting over derived heuristics; (iii) distinguish **level** from **delta** — on this machine several levels are permanently high and therefore carry no signal; (iv) every state carries an explicit *unknown*, because a failed probe is not a zero.
+
+**Structural finding that reshapes arm-1's open question.** Arm-1 recorded zram/swap pressure as an unmeasured risk from *occupancy* (23 GiB used). PSI is **available on this kernel** (`/proc/pressure/` contains `cpu`, `io`, `irq`, `memory`) and shows **memory stall ≈ 41.3 s cumulative (some) / 40.8 s (full)** versus **IO stall ≈ 268 745 s some (74.6 h) / 258 243 s full (71.7 h)**; CPU stall ≈ 1 902 s. On this machine the dominant historical stall class is **IO, not memory**, and IO `full` ≈ IO `some` — when IO stalls, the whole system stalls. That is the measurable signature of the load-churn risk arms 1–2 identified (cold model loads, SQLite, browsers, a 72 %-full system NVMe), and it is the field to watch during load experiments — **not swap occupancy.**
+
+| # | State | Measurable definition | Telemetry source (today) | Detection rule (starting point; the #405 experiment tunes thresholds) | Detection limits / honest caveats |
+|---|---|---|---|---|---|
+| S0 | **NOMINAL** | S1–S8 all false | — | — | Nominal ≠ healthy: GeForce has no ECC, so silent corruption is invisible (XID 48/63/64 fire only when detected) |
+| S1 | **GPU-VRAM pressured** | Free VRAM < model requirement + KV headroom + margin | `nvidia-smi --query-gpu=memory.free,memory.total,memory.used` | `free < required × 1.10` ⇒ PRESSURED; `free < required` ⇒ UNPLACEABLE. Required = `size_vram` (post-load) or GGUF metadata + KV arithmetic (pre-load); KV = tokens × 80–96 KiB q8_0 (14B class) | ~1 s sampling; desktop tenancy volatile (Vivaldi 974 MiB alone, browsers grow); TOCTOU between probe and load; **no per-process VRAM cap on GeForce**; sees allocated, not fragmentation |
+| S2 | **Context headroom exhausted** | Needed tokens > configured context, or KV(needed) exceeds S1 headroom | `/api/ps` `context_length` (observed live; version-dependent), verbose `/api/show` `llama.context_length` | `needed_ctx > context_length` ⇒ refit; `KV(needed_ctx) > free − weights` ⇒ UNPLACEABLE-at-that-context | Ollama exposes **no current KV usage**; fit is a function of context, not of model (arm-1) |
+| S3 | **CPU pressured** | Share of time tasks stalled on CPU | `/proc/pressure/cpu` `some` (PSI verified present) | `cpu some avg60` above a baseline (`avg60 = 0.06` at probe) | **CPU `full` is undefined system-wide**; decode is bandwidth-bound, so CPU pressure hits prompt-eval, churn, and zram compression more than decode; no per-process attribution without SchedBlame-class tooling |
+| S4 | **Memory pressured (swap/zram)** | Share of time tasks stalled on memory reclamation | `/proc/pressure/memory` `some` **and** `full`; `/proc/meminfo` `SwapFree`; `/sys/block/zram0/mm_stat` | Watch `memory full` and its **delta**, not occupancy; sustained `full > 0` ⇒ thrashing (the kernel's own definition) | **Occupancy ≠ pressure**: zram DATA 22.3 G / COMPR 7.7 G / MEM 7.9 G is compressed data resident in RAM while memory PSI ≈ 0. zram compression itself burns CPU (secondary S3). `/proc/sys/vm/psi` absent = the *disabled*-case file, not a failure |
+| S5 | **Throughput degraded** | tok/s below the model's own recorded baseline | `eval_count ÷ eval_duration × 10⁹` per response | `tok/s < 0.5 × baseline` for the same (model, quant, context, device) key | **Per-request only** — no gauge, no histogram (vLLM-class only); the first request after eviction conflates `load_duration`; the baseline must itself be re-measured after any model/quant/context/hardware change |
+| S6 | **Churn / eviction loop** | Reloads within a session rather than once | `load_duration` per response; `/api/ps` `expires_at` | `load_duration > 0` after an idle gap ⇒ a reload happened; `expires_at − now < expected idle gap` ⇒ eviction will fire | Load is observable only when a request triggers it; idle eviction appears only as disappearance from `/api/ps`; no eviction counter exists |
+| S7 | **Foreground contended** | GPU busy with a non-Rune workload while a request is pending | `nvidia-smi` `utilization.gpu`, `power.draw`, per-process list | `util > threshold` with no Rune-owned compute process ⇒ contended | **No isolation on GeForce**: no partitioning or robust prioritisation (A3-14); MPS/MIG unavailable or unestablished here |
+| S8 | **Unavailable / unknown** | Runtime or GPU unreachable, or probe failed | systemd unit state + TCP probe to 127.0.0.1:11434; nvidia-smi exit status | Any probe failure ⇒ **UNKNOWN, never 0** | Must be distinct from "queue empty": a failed probe reported as 0 is indistinguishable from an idle queue — the exact telemetry bug this taxonomy forbids |
+| — | **GPU fault event** | XID logged | journal `grep "NVRM: Xid"`; nvidia-smi for Xid 48/54/154-class signals | Event-driven, classified by resolution bucket (IGNORE / RESTART_APP / RESET_GPU / RESTART_BM) | XID 45 is emitted by ordinary Ctrl-C/sigkill — **must not alert**; XID 13/31 are usually application bugs, not hardware |
+
+**Minimality verdict.** S1, S2, S4, S6, S8 plus the XID event are the six signals with real discriminating power here. S3/S5/S7 are cheap context, not gates (S3 is baseline-idle; S5 has no gauge; S7 needs a gaming workload to mean anything). **The entire taxonomy is obtainable with zero runtime changes** — every field lives in `/proc`, `/sys`, nvidia-smi, or `/api/ps` today.
+
+### 2.2 Failure modes and degraded paths (hardware/runtime layer; the cognitive ladder is #404's)
+
+| Failure | Detection signal | Blast radius | Recovery path | Deterministic core survives? | Evidence |
+|---|---|---|---|---|---|
+| **GPU driver crash / XID** | `NVRM: Xid N` in journal; nvidia-smi error | All GPU inference; the desktop compositor (kwin is a GPU client here) | By bucket: XID 13/31 → restart the app; XID 43 → GPU healthy, ignore; XID 46/62 → GPU reset; XID 79 (fallen off bus) → **bare-metal restart**; XID 48 (DBE) → reset or reboot required | **Yes** — CPU-side only; SQLite and modules never touch the GPU. Degraded to CPU inference (11 t/s, 7B q4_0) or no LLM | A3-19, A3-25 |
+| **GPU OOM on load** | Load fails; `/api/ps` never lists the model; S1 says free < requirement | One load attempt; possibly a partially-initialised runner | Retry with smaller context / smaller model / different quant. The honest mitigation is **fit-or-don't-load** — no spill path (Pie: PCIe-class swapping is slow; SwapMoE: swapping costs latency) | **Yes** | A3-07, A3-08 |
+| **Ollama service crash** | systemd unit state; API unreachable (S8) | All model inference until restart; **no data loss** (weights on disk, digests intact) | `systemctl restart ollama`; cold reload ≈ 1.5–2 s disk + tensor init | **Yes** | A3-24, inherited arm-2 C1 |
+| **Model corruption (digest mismatch)** | `/api/ps`/`/api/tags` `digest` vs expected; load error | One model's trustworthiness; **silent wrongness is the real hazard**, not the crash | Re-pull; verify digest before use | **Yes** | A3-24 |
+| **NVMe failure / full disk** | `df` free space; SMART (unreadable without root — **gap**); rising IO PSI | Two domains: `nvme2n1` = `/` (72 % full) **+ `/mnt/fast-storage` + `/var/tmp`**; `nvme1n1` = `/mnt/workdrive`, **where Rune's store lives** | Domain A loss ⇒ OS down; domain B loss ⇒ Rune store down, OS alive. **The split is already correct — preserve it.** `/var/tmp` on the 72 %-full system partition is the non-obvious exposure | **Partially**: survives a domain-A failure while the OS still runs; the likelier real event is a full system disk blocking SQLite temp/journal writes | A3-28, A3-21 |
+| **RAM exhaustion** | PSI `memory full` rising; `SwapFree` → 0; earlyoom action in journal | Largest-RSS processes die first — **that is the LLM runner, not the core** | earlyoom already active (`-r 3600 -n`, avoid-list excludes init/systemd/Xorg/sshd) | **Yes — by accident of size, not by design.** State it plainly: the core's OOM survival is emergent, not engineered | A3-20, A3-26, A3-27 |
+| **Thermal shutdown / slowdown** | `nvidia-smi -q -d PERFORMANCE` HW Thermal Slowdown; temperature | Throughput until hardware protection trips | Clock down, then cool; **0 µs HW thermal slowdown recorded to date** (53 °C idle) | **Yes** | A3-25, A3-19 |
+| **Power-cap throttling** | `clocks_event_reasons.sw_power_cap` + cumulative counter | Throughput −6.7 % for −23 % energy — **already the operating regime, not a failure** | None needed (`power.max_limit` 366 W exists, deliberately untouched at T1) | **Yes** | A3-25 (**≈125 GPU-hours cumulative SW power capping observed**), arm-1 |
+| **Pi / LAN loss** | Reachability probe to 192.168.0.84; LAN is wireless 192.168.1.156/24 | **Nothing** — Pi and LAN inference are already REJECT | None; Pi is at most a cold-backup target and is currently unreachable | **Yes, entirely** | A3-01, arm-1/2 |
+| **Second-device / gateway loss** | Endpoint probe | Zero today (no second endpoint exists) | — | **Yes** | arm-2 §2.7 |
+
+**Deterministic-core independence — arithmetic check (honest).** The claim "152 CPU-only modules + 436 MB SQLite ≈ 0.5 GB" is **not reproducible from this arm's vantage**: bounded search found `store/memory.db` 180 KB and `graph/graph.sqlite` 40 KB (harness store 4.2 MB total) and **213** `.py` files in `src/`, not 152. The *envelope* is plausible — 152 modules at ~0.5–3 MB import RSS ≈ 75–450 MB, so "~0.5 GB" is a fair order-of-magnitude upper bound — but two corrections must travel with it: (1) **SQLite file size ≠ resident memory** (default page cache, lazy reads; only mmap'ed/cached pages are resident), so a 436 MB database does not imply 436 MB RSS; (2) the module count and store size refer to a population this arm could not locate, so they remain **inward truth, not independently verified**. What *is* verified is the load-bearing conclusion: the core has no GPU, model, or network dependency, and its footprint is small enough that earlyoom (active) reaches the LLM runner first.
+
+### 2.3 Portability / model-agnostic topology
+
+**What must stay abstracted so a hardware change is a config change:**
+
+1. **Model identity, never model name** — keys are (digest, quantization, context); all three exist in `/api/ps` today.
+2. **Context as a per-model/per-request parameter** — arm-1: the context dial alone flips fit verdicts, so context is *data attached to the placement decision*, not a global constant (`num_ctx` today, `-c`/`--fit` in the escape hatch).
+3. **Device as a capability tuple, not "the GPU"** — (VRAM bytes, memory bandwidth, supported quant types); the same arithmetic must yield a verdict on 16/24/48 GB and on CPU-only.
+4. **Fit as a computed predicate** — `placeable(model, context, device, co-tenancy) → {yes, no, degraded}`; hardware change is cheap precisely because nothing stores a model→device mapping.
+5. **Residency policy in shared TTL/keep_alive semantics** (Ollama and llama.cpp both speak them).
+6. **Runtime behind an [OI]-compatible gateway**, address in configuration (Ollama incumbent, llama.cpp escape hatch).
+7. **Storage and compute in separate failure domains** — already true (workdrive nvme1n1 ≠ system nvme2n1); must not be silently collapsed later.
+
+**Portability bounds (bounds, explicitly NOT purchase requirements):**
+
+| Device class | What it supports (arm-1/2 arithmetic + LOCAL_OBSERVED constants) | What changes |
+|---|---|---|
+| **16 GB (today)** | 14B-Q4 @ 8k fits with ~1 GB margin at 4.7–5.2 GB desktop tenancy; 32k exceeds free VRAM; 27B IQ2_M marginal-to-fail; 7B/3B comfortable; embedders trivial. 8k is the governed default | — |
+| **24 GB** | 14B @ 32k-class context **or** 32B-Q4 @ 8k — the first bound where the **context dial** stops being the binding constraint rather than the model tier | Fit verdicts flip for context, not mechanism — no re-architecture |
+| **48 GB** | 70B-Q4 class single-card viable — a **quality-tier** change, not a mechanism change | Model tier only |
+| **CPU-only (degraded)** | 7B q4_0 ≈ 11 t/s measured (arm-1); everything else survives | Throughput class change; deterministic core unaffected |
+
+**Re-measuring capability after a hardware/model/quantization change** (the #403/#404 "any change re-measures on the local harness" principle): **BOUNDED ZERO-HIT.** Population: arXiv API queries (`"swap" AND "inference" AND "latency"`, `"memory pressure" AND "LLM"`, `"GPU failures"`, `"preemption" AND "GPU" AND "inference"`), 2026-09-23. Nearest neighbours are benchmark suites assuming a fixed hardware target and serving systems that re-profile *within* a run (S-LoRA adapter paging, Pie adaptive expansion) — **none treats cross-configuration re-baselining as a discipline.** Consistent with the arm-1/2 pattern (no prior art ≠ novelty proven). Record it as a **Rune protocol requirement**, not a cited finding.
+
+### 2.4 Experimental-topology room (the #404 disposition: EXPERIMENT, not production dependency)
+
+| Item | Current capability | Blocker | Cost | Change topology now? |
+|---|---|---|---|---|
+| **(a) Small specialist (7B/3B) alongside a general model — `MAX_LOADED_MODELS=2`** | Config value; Ollama already evicts to make room (arm-2 A3) | **Arithmetic, not configuration.** Free VRAM 10.85 GB. 14B-Q4_K_M ≈ 8.9–9.3 GB weights + KV 8k (0.61–0.75 GB) ≈ 9.7–10.0 GB ⇒ ~0.8–1.1 GB left, so a 3B Q4 (~1.8–2.0 GB + 0.16 GB KV) does **not** fit and a 7B Q4 (~4.1–4.4 GB + 0.31–0.38 GB KV) does not fit at all. **7B general + 3B specialist ≈ 6.6–7.1 GB fits comfortably** (~3.7 GB spare with desktop) | Marginal KV of the second model is small (0.16–0.38 GB at 8k, scaling estimate); the real cost is the second model's **weights** (1.9–4.4 GB) and lost gaming/desktop headroom | **Do NOT change now.** Capability is one config value; the constraint is arithmetic a 24 GB device would lift. **EXPERIMENT** (7B+3B co-residency + churn), not adoption |
+| **(b) Bounded classical classifiers (CPU-only)** | Trivial — classical ML stacks are CPU-only by construction | None | Negligible (MB-scale, no VRAM, no model server) | **No change.** The cheapest experimental surface Rune has: zero marginal topology |
+| **(c) Deterministic kernels (CPU-only)** | Already the architecture; 213 `.py` in `src/` observed | None | None | **No change.** Note the OOM-survival byproduct (§2.2) |
+| **(d) Retrieval** | Existing; nomic-embed-text resident, `size_vram` 323 MB | None | 0.3 GB VRAM while resident (~1/30th of an 11 GB LLM) | **No change.** Keep the embedder's residency policy distinct — asymmetric cost, asymmetric TTL |
+| **(e) Experimental adapters (LoRA serving)** | **llama.cpp: documented** — `--lora FNAME` (comma-separated multiple), `--lora-init-without-apply`, per-request `lora` field, `GET/POST /lora-adapters`. **Ollama: undocumented** (0 "ADAPTER" occurrences in the current Modelfile reference) | Incumbent runtime: undocumented ⇒ unverified. Escape hatch: documented and available | Adapter VRAM ≪ base model (S-LoRA: thousands of adapters over **one** base copy; Punica: batched multi-adapter kernels). Arithmetic estimate for a 14B base at rank 8–64: tens to low hundreds of MB fp16 — **to be measured, not assumed** | **Do NOT change; do not foreclose.** Path = llama.cpp. **EXPERIMENT**, one flag away, cheap because it reuses the single base copy |
+| **(f) Sandboxed local models (#402 seam)** | Untrusted weights are a **measured** threat class (44.9 % of popular HF models still pickle; scanners have FP/FN). Cheap partial mitigation: prefer safetensors/GGUF (no code execution) | No OS-level sandbox configured; loopback-only binding is the current network defence | Low as "format policy + separate directory + no auto-load of untrusted artifacts"; higher for a real namespace/container sandbox | **Do NOT change; do not foreclose.** Free immediate sub-step: format preference. **FUTURE** for isolation |
+| **(g) Future second device** | Gateway address configurable | No second inference-capable device; wireless LAN and multi-node inference REJECT | — | **No change.** Keep the address in config, nothing more. **FUTURE** |
+
+**Optionality cost statement (explicit):** (a), (e), (f) are preserved at **near-zero cost** — (a) is a config value, (e) a flag on an already-present escape-hatch binary, (f) a format preference. (b), (c), (d) need nothing. (g) is preserved by one address being configuration. **Nothing here requires a topology change today; all that is required is that no constant hard-codes today's device, model, or single-endpoint assumption.**
+
+### 2.5 Capability-registry hardware-field specification (consolidate; do NOT design evaluation logic)
+
+Scope note: this is **hardware/runtime truth** — what the machine and runtime *are*. **Observed task capability** (did Rune do X well) belongs to #406; no field below should be used to infer it. Evaluation logic is explicitly out of scope.
+
+| # | Field | Source | Availability today | Update cadence | Staleness / TTL | Failure semantics |
+|---|---|---|---|---|---|---|
+| 1 | `gpu.mem_total/used/free` | `nvidia-smi --query-gpu` | **Yes** | Poll 5–10 s, or immediately pre-placement | ≤ 10 s, else unknown | Probe failure ⇒ `null` + unknown; **never** 0 |
+| 2 | `gpu.temp`, `power_draw`, `power_limit`, `power_max_limit` | `nvidia-smi --query-gpu` | **Yes** (225 W limit / 366 W max observed) | Poll 5–10 s | ≤ 30 s (slow-moving) | `null` |
+| 3 | `gpu.throttle_reasons`, `power_cap_cumulative_us` | `nvidia-smi -q -d PERFORMANCE` | **Yes** (~125 GPU-h of SW power capping observed) | Poll 60 s | ≤ 5 min | `null`; tool absent ⇒ capability false |
+| 4 | `gpu.xid_event` | journal `NVRM: Xid` | **Yes** (event-driven; needs a log reader) | On event | No TTL, but **age matters** (a 3-week-old XID is not current state) | Reader unavailable ⇒ unknown; **must not** report "no fault" |
+| 5 | `runtime.health` | systemd unit state + TCP probe | **Yes** | Poll 10–30 s | ≤ 30 s | Unreachable ⇒ `down` (a real value, not unknown) |
+| 6 | `model.digest` | `/api/tags`, `/api/ps` | **Yes** | On load / registry refresh | Stable per artifact | Missing ⇒ unknown; mismatch ⇒ `corrupt` (a state, not an error) |
+| 7 | `model.quantization` | `/api/ps` `details.quantization_level` | **Yes** | On load | Stable | `null` |
+| 8 | `model.param_size`, `family` | `/api/ps` `details` | **Yes** | On load | Stable | `null` |
+| 9 | `model.context_length` (live) | `/api/ps` `context_length` (version-dependent) | **Yes, with version caveat** | On load | ≤ residency | `null` ⇒ fall back to verbose `/api/show` |
+| 10 | `model.arch_facts` (`block_count`, `head_count_kv`, `context_length`) | verbose `/api/show` `model_info` | **Yes** (verbose form required) | On artifact inspection | Stable | `null` |
+| 11 | `vram.requirement_post_load` | `/api/ps` `size_vram` | **Yes** | On load | = residency | `null` ⇒ unknown |
+| 12 | `vram.requirement_pre_load` | derived: GGUF metadata + KV arithmetic | **Derived** | On demand | Recompute per placement | Any input missing ⇒ unknown (**no silent estimate**) |
+| 13 | `residency.expires_at` | `/api/ps` | **Yes** (`KEEP_ALIVE=-1` renders as +293-year expiry) | Poll 10–30 s | ≤ 30 s | `null` ⇒ unknown |
+| 14 | `load.load_duration` | response stats | **Yes** | Per request | Per-request record | Absent ⇒ request never triggered a load ⇒ **do not infer "no reload"** |
+| 15 | `throughput.tok_s`, `latency.total/prompt_eval` | response stats (`eval_count ÷ eval_duration × 10⁹`) | **Yes** | Per request | Keep last N per (model, quant, context, device) | `null` on failed request; **never carry a previous value forward** |
+| 16 | `cpu.pressure` (some; 10/60/300 + cumulative) | `/proc/pressure/cpu` | **Yes** (PSI verified on kernel 7.2.5-1-cachyos) | Poll 10 s | ≤ 60 s | File missing ⇒ capability false (older kernel / PSI off) |
+| 17 | `mem.pressure` (some **and** full) | `/proc/pressure/memory` | **Yes** | Poll 10 s | ≤ 60 s | As above |
+| 18 | `io.pressure` (some/full) | `/proc/pressure/io` | **Yes** (dominant historical stall class here) | Poll 10 s | ≤ 60 s | As above |
+| 19 | `mem.swap_free`, `mem.available` | `/proc/meminfo` | **Yes** | Poll 30 s | ≤ 60 s | `null` |
+| 20 | `zram.mm_stat` (orig/compr/mem_used_total, huge_pages) | `/sys/block/zram0/mm_stat` | **Yes** | Poll 60 s | ≤ 5 min | `null`; **never** interpret occupancy as pressure (S4) |
+| 21 | `disk.free` per mount | `statvfs` / `df` | **Yes** (system 72 % full) | Poll 5 min | ≤ 15 min | `null` |
+| 22 | `queue.depth` | **not exposed by Ollama**; `llamacpp:requests_deferred` + `requests_processing` on llama.cpp `/metrics` | **Needs change on incumbent; Yes on escape hatch** | Poll 5 s when available | ≤ 10 s | **`unsupported`, NOT 0** — 0 means "empty queue", a different fact |
+| 23 | `preemption.count` | **not exposed by Ollama**; vLLM-class `num_preemptions` | **Needs change** | — | — | `unsupported` |
+| 24 | `starved_state` (S0–S8 composite) | derived from rows 1, 9, 16–20 | **Derived today** | On demand / poll 10 s | min(component TTLs) | Any component unknown ⇒ composite `unknown` for that dimension (never default to nominal) |
+
+**Consolidation verdict:** **22 of 24 rows obtainable today** (arm-2's narrower list was 14/15; the additions — PSI, zram, throttle/power-cap counters, XID — are all local-probe-verified this session). The two gaps (`queue.depth`, `preemption.count`) are exactly arm-2's gaps, and `queue.depth` is obtainable today **on the escape-hatch runtime only** (`requests_deferred`). Both must report `unsupported`, never 0.
+
+### 2.6 T1 minimum vs future (strict: cheap, reversible, justified by measurement)
+
+**T1 — adopt NOW (config-level only, no production code, all reversible):**
+
+1. **Record a baseline telemetry snapshot** — the S0–S8 signals plus nvidia-smi constants (free 10.85 GB, desktop 5.15 GB, 225 W cap, ~125 h cumulative power capping) as the reference for every later comparison. *Justified:* fit arithmetic depends on desktop tenancy, which LOCAL_OBSERVED shows is variable.
+2. **Make context an explicit per-model parameter in configuration**, never a global default. *Justified:* arm-1 — the context dial alone flips fit verdicts (14B fits at 8k, not at 32k).
+3. **State the residency policy explicitly (TTL vs `KEEP_ALIVE=-1`)** for the general model, with reload cost (1.5–2 s disk + init) and tenancy cost (≈1 GB free while resident) written down as the trade. *Justified:* arm-2 R1/R2 — the choice is currently implicit.
+4. **Policy: probe failure ⇒ `unknown`; unsupported field ⇒ `unsupported`.** One line, outsized correctness value (S8).
+5. **Watch IO pressure, not swap occupancy**, as the load-churn signal. *Justified:* LOCAL_OBSERVED — IO dominates stall history (74.6 h) and `full ≈ some`.
+6. **Keep the failure-domain split** (Rune store on nvme1n1, OS on 72 %-full nvme2n1) and keep `/var/tmp` exposure in view. *Justified:* A3-28.
+7. **Leave the 225 W cap alone**; record that `power.max_limit` is 366 W and that the cap *is* the energy intervention (arm-1). *Justified:* changing it trades measured energy savings for unmeasured throughput.
+8. **Format policy for experimental weights: prefer safetensors/GGUF; treat pickle artifacts as untrusted.** *Justified:* A3-17, A3-22; free.
+9. **Exactly one always-on runtime.** The llama.cpp escape hatch is launched for experiments, never a second resident service. *Justified:* arm-2 §2.5 failure-surface accounting.
+
+**EXPERIMENT (the #405-designed set — measure, do not adopt):** **E1** swap/zram pressure vs inference latency (the load-bearing unknown; two zero-hit searches) · **E2** `MAX_LOADED_MODELS=2` at the 7B+3B tier · **E3** adapter serving via llama.cpp `--lora` (measure adapter VRAM and tok/s delta) · **E4** foreground contention under a real gaming workload (S7 has no evidence base at all) · **E5** capability re-baselining protocol (the protocol is Rune's own — zero-hit).
+
+**FUTURE:** 24 GB / 48 GB device classes · second inference device behind the configurable gateway · sandboxed (namespace/container) untrusted-weight execution · adapter serving as a standing capability.
+
+**NOT NEEDED:** MIG · MPS · vLLM for a single user · TGI · TensorRT-LLM · ORT-GenAI · DCGM · multi-GPU tensor parallelism · KV paging (a concurrency win) · speculative decoding (a second failure surface before any measurement) · predictive failure modelling (predictions are unstable).
+
+**REJECT:** Pi inference · Petals/LAN tensor-pipelined inference · ≤3-bit quantization for reasoning/off-domain work · any design assuming GPU isolation between Rune and the user's gaming workload · CPU swap as a *serving* mechanism for weights or KV.
+
+### 2.7 Energy / sustained operation (brief)
+
+- **The cap is already the intervention.** `power.limit` 225 W vs `power.max_limit` 366 W, with **449 880 646 317 µs (≈125 GPU-hours) of cumulative SW power capping** and **zero HW thermal slowdown**. Arm-1's transfer (−23 % energy for +6.7 % time) describes the *current* operating point, not a proposal; sustained throughput should be quoted as the capped number.
+- **Idle residency costs VRAM, not watts** (44.27 W at probe with 8 desktop GPU clients + a 0.3 GB embedder). Residency policy is a headroom decision, not an energy decision.
+- **The user's gaming workload is the real confounder, and the evidence base is empty:** inference + gaming coexistence on one consumer GPU is a **BOUNDED ZERO-HIT** (population: arXiv queries for gaming+inference+GPU, 2026-09-23; nearest neighbours are datacenter online/offline colocation — Valve, Strait — and microarchitectural concurrency characterisation, none studying a game engine sharing a consumer card with a resident LLM). What can be said without overstating: GeForce offers no partitioning or robust prioritisation, so coexistence means contention; zram compression adds a *CPU* cost precisely when memory pressure is highest; therefore the honest claim remains "between-request priority, never within-request guarantees." Nothing further until E4 runs.
+- **Churn is the measurable sustained cost** — ~1.5–2 s per eviction, and IO pressure is already this machine's dominant stall class.
+
+### 2.8 Bounded zero-hits (population + date stated)
+
+1. **Swap/zram pressure degrading LLM inference — ZERO-HIT (second attempt).** Population: arXiv API abstract+full-text queries, 2026-09-23: `"swap" AND "inference" AND "latency"`, `"memory pressure" AND "LLM"`, `"language model" AND "swap" AND "serving"`, `"memory pressure" AND "inference" AND "language model"`. Nearest neighbours are *indirect*: Pie (swapping hurts, but needs GH200-class fabric), SwapMoE (MoE expert swap, not dense weights/KV), PSI-guided reclaim (system-level, not inference-specific). **The effect is assumed by practitioners and unmeasured in the literature. Disposition: E1.**
+2. **Inference + gaming coexistence on one consumer GPU — ZERO-HIT.** Population: arXiv API, 2026-09-23, `"gaming" AND "inference" AND "GPU"` and adjacent terms. **Disposition: E4.**
+3. **Re-measuring capability after a hardware/model/quantization change — ZERO-HIT** (as the prompt predicted). Population: arXiv API, 2026-09-23, swap/memory-pressure/preemption/GPU-failure queries. **Disposition: E5; record as Rune policy.**
+4. **436 MB SQLite / 152-module deterministic-core footprint — NOT REPRODUCIBLE this session** (bounded local search). Not a literature zero-hit but an evidence gap; the ~0.5 GB envelope survives with the SQLite-size≠RSS caveat.
+
+---
+
+## 3. Rejected approaches (this arm's additions, with reasons)
+
+| Rejected | Reason | Evidence |
+|---|---|---|
+| Swap/CPU-spill as a *serving* mechanism for weights or KV | Pie: traditional GPU–CPU swapping raises latency and lowers throughput, and transparent swapping wants GH200-class fabric; SwapMoE: swapping costs latency | A3-08, A3-07 |
+| Predictive GPU-failure modelling as a feature | Production study found classic prediction models inaccurate *and* unstable | A3-11 |
+| Alerting on `NVRM: Xid` generically | XID 45 is emitted by ordinary Ctrl-C/sigkill; XID 13/31 are usually application bugs — generic alerting manufactures false hardware-failure signals | A3-19 |
+| Treating swap/zram *occupancy* as a degradation signal | Occupancy is structural here (zram MEM 7.9 GB) while memory PSI ≈ 0; the kernel's own thrashing definition is `full` stall time | A3-20, A3-21, A3-26 |
+| Reporting a failed probe as `0` or as "empty queue" | Indistinguishable from an idle queue; destroys the ability to detect S8 | A3-20, arm-2 gap list |
+| Assuming Ollama serves LoRA adapters | Current Modelfile reference has zero "ADAPTER" occurrences — undocumented on the incumbent; llama.cpp documents it properly | A3-23, A3-24 |
+| Fault-tolerant multi-GPU serving patterns (FailSafe-class) | Solve a multi-GPU problem Rune does not have; TP coupling is what is being rejected | A3-09 |
+| DCGM-class monitoring | Datacenter GPU governance; nvidia-smi already exposes the needed fields | A3-19 |
+| Multi-adapter batching kernels (Punica / S-LoRA / FASTLIBRA) | Their win is batching economics at N≫1; at `NUM_PARALLEL=1` they buy nothing | A3-03, A3-04, A3-05 |
+| PSI-trigger-driven load shedding | Load shedding presupposes a queue of deferrable work; Rune is single-user with no such queue. PSI is adopted as *telemetry*, not as an actuator | A3-15, A3-20 |
+
+---
+
+## 4. Do-not-cite register
+
+| Item | Why it must not be cited | Status |
+|---|---|---|
+| "152 CPU-only modules", "436 MB SQLite" | Not reproducible this arm (found 213 `.py` and a 220 KB store; no 436 MB DB located) | INWARD_TRUTH, UNVERIFIED |
+| Any inference-latency cost of swap *on this hardware* | Literature zero-hit (searched twice); the number does not exist yet | ZERO-HIT |
+| Inference + gaming coexistence throughput numbers | Literature zero-hit; no measurement exists | ZERO-HIT |
+| GeForce MPS support | MPS capability audited by arm-2, but GeForce applicability was not established | INHERITED, UNVERIFIED-FOR-GEFORCE |
+| DCGM availability/behaviour on GeForce | Not validated; datacenter-oriented | DO NOT ASSERT |
+| `nvidia-smi pmon` per-process utilisation on this driver | Not probed this session | UNTESTED |
+| Ollama "falls back to CPU on OOM" | Community folklore; not found in audited docs | DO NOT ASSERT |
+| XID 79/94/95 as *GeForce* failure rates | Catalog applicability columns are datacenter GPUs; GeForce reset support differs | SCOPE-LABELED ONLY |
+| "Story of Two GPUs" MTBE figures as consumer-hardware expectations | Measured on ECC-equipped A100/H100 at datacenter scale | SCOPE-LABELED ONLY |
+| Vendor recovery buckets as guarantees | NVIDIA frames them as *recommended* actions; XID 48 says reset **or** reboot; XID 79 requires bare-metal restart | GUIDANCE, NOT GUARANTEE |
+| Any citation for "classical classifiers are CPU-only" | Trivially true by construction; fabricating a source is worse than stating it | NO SOURCE NEEDED |
+| NVMe SMART health of this machine's disks | `nvme smart-log` → Permission denied (root required); disk health unverified | GAP |
+

research/memory-atlas-r1/AD-hardware-resource-placement/02_outward/arm4_adversarial_pass.md

@@ -0,0 +1,162 @@
+# #405 AD — Arm 4: Independent Fresh-Context Adversarial Pass (OUTWARD, research-only)
+
+**Date:** 2026-09-23 · **Domain:** #405 Hardware / Resource Placement · **Harness:** R1 1.0 rev.2 · Read-only; no config changed, no model loaded, no benchmark run.
+
+**Method.** Written from first principles against the CANDIDATE ARCHITECTURE (12 points as received). Arms 1–3 reports and `01_inward.md` were read as *evidence inputs*; independence is in judgment, not in ignoring data. Every load-bearing observed claim was re-probed this session before being relied on.
+
+**Verdict semantics (fixed for this report):** an attack **SUCCEEDS** if it exposes a real defect in the candidate architecture; **FAILS** if the architecture already withstands it (premise wrong or pre-handled); **PARTIAL** if damage is real but bounded.
+
+---
+
+## 0. Independent verification performed this session (not inherited)
+
+| Probe | Result (2026-09-23) |
+|---|---|
+| PV-1 `nvidia-smi` | 4070 Ti SUPER, 16 376 MiB total, **10 879 MiB free** (5 126 used); 46.7 W draw; **power.limit 225 W, power.max_limit 366 W**; 53 °C; 8 GPU processes — desktop tenancy **5.13 GB and volatile** (Vivaldi GPU process now **985 MiB**, Brave 507 MiB, Discord 213 MiB, kwin 297 MiB, ollama/llama-server 580 MiB) |
+| PV-2 `/proc/pressure/*` + `zramctl` + meminfo | memory PSI some avg60 = **0.00**, cumulative some ≈ 41.3 ks vs **io some ≈ 268.7 ks (74.7 h), io full ≈ 258.2 ks** — IO is the dominant historical stall class and `full ≈ some`; zram DATA 22.1 G / COMPR 7.5 G / **MEM 7.7 G** (compressed data resident in RAM); SwapFree 8.8/32.9 GiB. Confirms arm-3 A3-26: **occupancy ≠ pressure** |
+| PV-3 `earlyoom` args | `/usr/bin/earlyoom -r 3600 -n --avoid (^|/)(init|systemd|Xorg|sshd)$` — **Ollama is NOT in the avoid list; kwin_wayland is NOT either**; systemd-oomd inactive |
+| PV-4 Ollama GET APIs | `/api/ps`: only nomic-embed-text resident (323 MB VRAM, **context_length 2048**, `expires_at 2319` — KEEP_ALIVE=−1). `/api/tags`: **both 27B IQ2_M models are family `qwen35`, native `context_length` 262 144, capabilities completion+vision+tools+thinking**; sizes 11.39 GB + 12.60 GB = **23.99 GB disk** |
+| PV-5 `df` | `/` nvme2n1p3 346 G **72 % full**; `/mnt/fast-storage` nvme2n1p2 3.3 T 69 % (**same physical device as `/`**); `/mnt/workdrive` nvme1n1p1 1.8 T 27 % (separate); models dir 71 GB on fast-storage |
+| PV-6 `which llama-server llama-cli llama-bench` | **None present.** No standalone llama.cpp anywhere on PATH; the only llama-server is Ollama's internal runner. The designated escape hatch and the benchmark harness are **not installed** |
+| PV-7 arXiv verification | **14 IDs verified via export.arxiv.org this session, 0 mis-pairings**: 2306.07629 (SqueezeLLM), 2212.09720 (4-bit scaling), 2401.06118 (AQLM), 2312.12456 (PowerInfer), 2309.06180 (PagedAttention), 2402.01528 (Decoding SD), 2406.14066 (TurboSpec), 2209.01188 (Petals), 1703.00064 (WiFi anomaly), 2310.03003 (Words to Watts), 2508.15987 (PickleBall), 2311.03285 (S-LoRA), 2504.04823 (Quantization Hurts Reasoning), 2411.09317 (Pie). Given the 12 mis-paired IDs caught across arms 1–2, **only IDs verified by this arm or explicitly re-verified by an arm are relied on**; everything else is cited as arm-attributed |
+
+**New facts found by this arm (not in any arm report):**
+- **NF-1:** both 27B IQ2_M models are vision+tools+thinking-capable qwen35-family merges with native context 262 144 (PV-4) — the "duplicate generalist" framing understates them: they duplicate the *multimodal* niche too, and their unmeasured status extends to vision and thinking modes, not just text completion.
+- **NF-2:** no standalone llama.cpp/llama-bench exists on the machine (PV-6) — the escape hatch (architecture point 5) and any local benchmark harness (needed by E1–E5 and #406) require installation first; "config-level, reversible T1" does not cover them.
+- **NF-3:** earlyoom's actual running args confirm neither Ollama nor kwin is protected (PV-3) — the "LLM runner dies first" property is unguaranteed in both directions (runner may not be largest RSS under mmap; compositor is killable).
+
+---
+
+## PART 1 — Mandated attack verdicts (60)
+
+| # | Attack | Verdict | Evidence | Consequence | Correction | Residual |
+|---|---|---|---|---|---|---|
+| 1 | Bigger model = better | **FAILS** | Architecture point 2 rejects 27B default; arm-1 V3 (Dettmers 2212.09720 35k-exp law + AQLM 2401.06118 + inherited 2504.04823: reasoning degrades disproportionately); 27B IQ2_M below studied quant floor | None — attack pre-empted | — | 27B still unmeasured; rejection is evidence-weighted, not measured; E13-type measurement stays owed (NF-1 widens it to vision/thinking) |
+| 2 | More VRAM = intelligence | **FAILS** | Arm-1 V3: 27B IQ2_M ~11.5 GB buys NO decode latency over 14B-Q4 (both bandwidth-bound, ~same bytes/token on 672 GB/s); fit is computed predicate, not a tier (point 9) | None | — | Quality delta at 27B remains a hypothesis (unmeasured), but architecture never claims it |
+| 3 | Model fits = model is usable | **PARTIAL** | Point 2 adopts 14B-Q4 "governed default" on fit arithmetic alone; zero local task capability measured anywhere (inward UNKNOWN; FR-11); arm-3 §2.5 explicitly quarantines task capability to #406 | Fit predicate is necessary, not sufficient — the default could be *placeable and inadequate* and nothing in #405 would notice | Label the default "provisional pending #406 measurement"; no behaviour should be justified by adequacy until measured | #406 dependency is acknowledged; the gap is that no adequacy measurement is scheduled inside #405's T1 either |
+| 4 | Local = cheaper | **PARTIAL** | Architecture never argues cheapness; energy arithmetic only (arm-1 I1: 2–4 J/token derived, unmeasured); real local costs (reload churn, ops attention, desktop contention) are uncosted | If cost were the rationale it would be unmeasured; the rationale is latency/offline (R27), which is defensible | None needed beyond keeping energy figures labeled derived | On-box energy/tok/s measurement (E-set) would settle it cheaply |
+| 5 | Local = private | **PARTIAL** | Loopback-only binding + distinct uid + ProtectSystem (inward H); ORT-GenAI rejected partly on telemetry phone-home (arm-2 A7) — genuine privacy posture. BUT: untrusted-weights execution context has same-root reachability (#402); "uncensored" community merges of unverified lineage run as a system service today (inward H) | Privacy is inherited from configuration discipline, not enforced by isolation; a malicious model reaches the host | T1 item 8 (format policy) is right; add: no auto-load of unverified-lineage artifacts (the two 27B merges are exactly that) | Container sandbox is FUTURE; the seam stays open until then |
+| 6 | Local = secure | **PARTIAL** | PickleBall 2508.15987: 44.9 % of popular HF models still pickle; scanners FP/FN; architecture's immediate step = safetensors/GGUF preference only; no sandbox (point 10 FUTURE) | Threat class measured; mitigation is format preference only; GGUF itself is not a security guarantee (loading code still parses attacker-controlled structures) | State plainly: format policy reduces, does not remove, the untrusted-weights risk; sandbox remains the real control | When the sandbox lands, re-derive the claim |
+| 7 | Owned hardware = independence | **FAILS** | Architecture makes no independence claim; portability abstraction (point 9) + failure-domain split (point 7) are the actual design; single-machine reality is recorded (arm-2 §2.7) | None | — | Residual risk is carried under attack 58, not here |
+| 8 | Idle GPU = permission to infer | **PARTIAL** | Architecture uses live residency + ×1.10 margin (arm-3 S1) — correct instinct. But desktop tenancy is volatile and drifting (PV-1: Vivaldi 974→985 MiB between arm-3 and this session); TOCTOU between probe and load is structural on GeForce (no per-process VRAM cap); gaming coexistence is a bounded zero-hit (arm-3 §2.7, E4) | A fit verdict computed at t₀ can be false at t₀+30 s; first OOM will be discovered by load failure, not by the predicate | Add post-load verification loop: compare `/api/ps` `size_vram` against the pre-load prediction; record misses to calibrate the margin | No atomic probe-and-load exists on any audited runtime; margin stays a heuristic until E4 |
+| 9 | CPU fallback = useful fallback | **PARTIAL** | Architecture bounds CPU to ≤7B (arm-1 A4: 11 t/s measured) — correct. But: (a) the fallback regime under 22 G zram occupancy is exactly the unmeasured page-in risk (arm-1 F2/F5); (b) "deterministic core survives" ≠ "LLM fallback useful" — at 14B, CPU fallback is 4–5 t/s derived = minutes per response | Fallback usefulness is tier-dependent and pressure-dependent; neither measured | Scope the CPU tier claim to ≤7B AND to non-thrashing states (S4 gate); E1 measures the pressure interaction | No literature number exists for swap-pressure degradation (double zero-hit) — only on-machine measurement can close it |
+| 10 | More context = better cognition | **FAILS** | Context is an explicit per-model parameter (point 2); KV arithmetic shows the dial flips fit verdicts (arm-1 V2); 8k default is governed, not maximal | None | — | The inverse risk (8k too *small*) is live — carried at attack 49 |
+| 11 | More loaded models = better | **FAILS** | Point 3 gates 1→2 on arithmetic; batching rejected at bs=1 (arm-1 V6); NUM_PARALLEL×context RAM scaling (arm-2 A3) | None | — | Whether two *different* model runners truly execute concurrently on Ollama at MAX_LOADED_MODELS=2 is doc-underdetermined (see FR-2 residual) |
+| 12 | One runtime should serve everything | **FAILS** | Dual answer: Ollama incumbent + llama.cpp escape hatch, "one always-on runtime" (T1 item 9); capability table (arm-2 §2.1) shows no single runtime wins every row | None | — | The dual answer has its own cost — attack 53 |
+| 13 | Q2 large beats Q4 smaller | **FAILS** | ≤2-bit naive PTQ not Pareto-optimal (AQLM 2401.06118); outlier mechanism (SqueezeLLM 2306.07629); reasoning degrades more (inherited 2504.04823); no direct 27B-IQ2M-vs-14B-Q4 study exists (inherited bounded zero-hit) — the architecture correctly refuses to fabricate a winner | None | — | The pair is genuinely unmeasured; architecture holds the right position (hypothesis, never default) |
+| 14 | Q4 smaller beats Q2 larger | **PARTIAL** | This is the architecture's *own* adoption. Direction is evidence-backed for zero-shot/general (2212.09720) but: no direct study of this pair; reasoning/off-domain degradation can reach 4× (2504.04823); IQ2_M is below the studied floor; NF-1: the 27Bs are also the vision+thinking models, unmeasured in those modes | "14B-Q4 as the governed default" reads as settled when it is a prior; Rune's reasoning-shaped agent workload is precisely where the frontier is weakest | Label provisional; the #406 measurement pass should include a 27B IQ2_M arm so the rejection becomes measured, not inherited | If 27B IQ2_M measures *better* on Rune tasks at acceptable latency (~same decode class, arm-1 V3), the default flips — architecture survives that, but only if measurement exists |
+| 15 | Speculative decoding always helps | **FAILS** | TurboSpec 2406.14066: naive SD can degrade; draft latency not quality determines gain (2402.01528); Ollama exposes none (arm-1 G2) | None — architecture sequences measure→ngram→draft→EAGLE-3 | — | SD correctly in NOT-NEEDED until measured (arm-3 §2.6) |
+| 16 | Multi-device inference scales well | **FAILS** | PCIe 64 GB/s vs 672 GB/s VRAM (PowerInfer 2312.12456); layer-split = capacity not speed (arm-1 H1); no NVLink on Ada (H3); Splitwise requires cluster backplanes (arm-2 B4) | None | — | Portability tuple keeps the future option honest |
+| 17 | Benchmarks transfer directly | **PARTIAL** | Re-baselining protocol adopted as E5 / policy (arm-3 §2.3, bounded zero-hit) — principle right. But there is **no harness on the machine** (PV-6: no llama-bench/llama-server), and arm-1's CPU anchor is 7B q4_0 DDR4-3200 community data (reliability-labeled), with 14B numbers derived not measured | "Re-measure on change" is currently aspiration, not capability; nothing can be re-measured yet | Harness installation (llama-bench + pinned llama.cpp build) belongs in the T1-adjacent setup, not "later" (see FR-13) | Derived 14B CPU figures must stay labeled derived (arm-1 register) |
+| 18 | tok/s = useful capability | **FAILS** | Architecture's registry spec explicitly separates hardware/runtime truth (#405) from observed task capability (#406); tok/s is only state signal S5 (arm-3 §2.1) | None | — | S5 baselines don't exist yet (see FR-11) |
+| 19 | Low latency = good architecture | **FAILS** | Residency policy explicitly trades latency vs headroom (arm-2 §2.5: "seconds of reload vs gigabytes of headroom"); TTL choice is stated as a policy dial, not an axiom | None | — | R27 minimal latency is a requirement the architecture serves, not worships |
+| 20 | Current hardware should dictate long-term design | **FAILS** | Point 9: identity by (digest, quant, context), device as (VRAM, bandwidth) tuple, fit as computed predicate, no hardcoded model→device map (arm-3 §2.3) | None | — | The abstraction is untested until a second device exists; that's inherent |
+| 21 | Future GPU upgrade solves architecture problems | **FAILS** | Portability bounds (arm-3 §2.3: 24 GB flips the context dial, 48 GB flips tier — mechanism unchanged); GeForce contention has no partitioning at *any* VRAM size (MIG absent, arm-2 A9); foreground-wins boundary persists on bigger cards | None | — | A 24 GB card would also dissolve the FR-2 co-residency bind — but that is arithmetic relief, not architecture relief |
+| 22 | Resource starvation ≡ model absence | **FAILS** | S0–S8 taxonomy distinguishes pressured/unplaceable/degraded/unavailable; probe failure ⇒ unknown, never 0 (point 6, arm-3 §2.1) | None | — | Taxonomy is designed, not yet implemented — telemetry snapshot is T1 item 1 but no collector exists yet |
+| 23 | Embeddings deserve permanent residency | **PARTIAL** | R1 pin is 30× cheaper than LLM tenancy (0.3 GB vs 9–11 GB) and S-LoRA-asymmetric (arm-2 B1) — direction survives. BUT: (a) the pin is **currently impossible**: MAX_LOADED_MODELS=1 blocks co-residency, and Ollama's idle-unload-to-make-room means under VRAM pressure the embedder is evictable — there is no true pin primitive; (b) the pinned embedder is silently degraded at ctx 2048 (PV-4, inward B) — residency without correctness; (c) at 14B default the +0.3 GB is not noise, it is the margin (FR-2) | The policy's most-cited guarantee ("E always warm") is not deliverable under the architecture's own default model | See FR-2 correction: co-residency is a 7B-tier capability; fix embedding context truncation; measure embedding reload cost before calling the pin cheap | Pin semantics on Ollama are best-effort only; llama.cpp router or two processes would give a real pin |
+| 24 | Keeping a model resident indefinitely is always efficient | **FAILS** | KEEP_ALIVE=−1 identified as the strongest config contradiction (inward CONFLICTING); TTL policy + idle economics (arm-2 §2.5) | None | — | — |
+| 25 | MAX_LOADED_MODELS=1 is necessarily wrong | **FAILS** | Point 3 changes it to 2 *conditionally* and only where arithmetic allows (≤7B+≤3B, arm-3 §2.4a); at the 14B default, 1 is the defensible value (14B@8k ≈ 9.7–10.0 GB vs ~10.85–11.3 free) | None — the "necessarily" fails in both directions | — | The real defect is the interaction with the embedder design, not the value of the env var (FR-2) |
+| 26 | Parallelism is always beneficial | **FAILS** | bs=1 = the regime where quantization/decode speedup is maximal (arm-1 A3-row/MARLIN 2408.11743); NUM_PARALLEL scales RAM×context (arm-2 A3); serialization confirmed as foreground-wins (arm-2 §2.3 F2/F6) | None | — | — |
+| 27 | The Pi should run inference merely because it exists | **FAILS** | Pi 5 hand-tuned best case 2.13–3.04 t/s on a 3B-active MoE (arm-2 D1); dense 7B+ far below; no usable GPU | None | — | Pi's role correctly narrowed to ADAPT cold-backup — but see FR-4 |
+| 28 | Local-first is always preferable | **PARTIAL** | Local-first is the mandate (R27/R32/R33), and the architecture honors it — but it never states the *boundary condition*: at what task class / capability level does a frontier provider beat local (BYPASS seam carried ungoverned, inward classification) | Without an explicit routing boundary, "local-first" silently becomes "local-only" or ad-hoc provider use — the exact BYPASS defect already flagged | State the local boundary as policy: what local must cover (offline/latency/private) vs what may route out (capability-beyond-tier), consistent with #406 evaluation | Frontier capability comparison is #406's to measure; #405 only needs the routing seam declared |
+| 29 | #404's internalisation theory must shape #405's answer | **FAILS** | Point 10 preserves EXPERIMENT room without pre-judging success; scope file: production must not depend on unestablished general-reasoning compilation | None — topology correctly independent of the theory | — | — |
+| 30 | Lack of precedent means experimental topology should be rejected | **FAILS** | Zero-hits recorded as zero-hits with population+date (arm-3 §2.8); "NO PRIOR ART ≠ NOVELTY PROVEN" carried; E1–E5 dispositions assigned | None | — | — |
+| 31 | VRAM free reading is a reliable fit predicate (TOCTOU) | **PARTIAL** | Architecture's S1 uses margin ×1.10 + live polling — but TOCTOU is structural (see attack 8): desktop tenancy volatile, no reservation primitive, sees allocation not fragmentation; margin unvalidated | Interpreted at face value the claim is false; the architecture partially mitigates but its predicate is still a point-in-time guess | Post-load verification loop (attack 8 correction); treat fit as `{yes, no, degraded}` with degraded = verified-after-load | No runtime offers atomic probe-and-load on GeForce; risk can be reduced, not closed |
+| 32 | Swap occupancy indicates memory pressure | **FAILS** | PSI evidence: memory stall ≈ 0 while zram holds 22 G (PV-2, arm-3 A3-26); kernel's own thrashing definition is `full` stall (A3-20); zram MEM 7.7 G is compressed data in RAM | None — architecture explicitly adopts PSI as telemetry, not occupancy | — | PSI thresholds need baselining (T1 item 1); thresholds are heuristics (A3-20 caveat) |
+| 33 | Power capping only costs time | **PARTIAL** | I1 (2310.03003, FULL_PAPER) measured +6.7 % time for −23 % energy at 250→175 W — but at batch 64 on datacenter V100s; at bs=1 decode on this card the time cost is **unmeasured**, and time is exactly R27's currency; cap already binds ~125 GPU-hours cumulative (arm-3 A3-25) | The claim, used to justify raising the cap, rests on a transfer that has not been validated in Rune's regime | Keep cap at T1 (correct); if E4 ever motivates raising, measure first at bs=1 | power.max_limit 366 W exists and is deliberately untouched — the option is preserved |
+| 34 | NVMe load time is the dominant cold-start cost | **FAILS** | Measured 6.0 GB/s direct read ⇒ 9–12 GB ≈ 1.5–2 s (arm-2 C3); arm-2 §2.8: load is init-bound, not disk-bound | None | — | Total cold-start (disk + tensor init + first-token warmup) still unmeasured — `load_duration` telemetry exists but was never captured; the *ranking* is evidenced, the *total* is not |
+| 35 | Deterministic core has no hardware risk | **PARTIAL** | Verified true for GPU/model/network dependency (arm-3 A3-29 conclusion; ~0.5 GB envelope with caveats). False as stated broadly: the core lives on the OS disk (nvme2n1p3, 72 % full — PV-5), dies with the OS, and its OOM survival is emergent (earlyoom args protect neither Ollama nor the core — PV-3); store on nvme1 is in a separate failure domain (good) | "Survives every failure row" is true only for the *model/GPU* rows; system-disk and RAM-exhaustion rows survive it by accident of size and topology | Restate the claim precisely: "no GPU/model dependency"; add the two real hardware dependencies (system disk, RAM pressure) to the failure table as core-relevant | The 152-modules/436 MB numbers remain inward-truth, not independently verified (FR-12) |
+| 36 | The 225 W cap should be raised for throughput | **FAILS** | Benefit unmeasured at bs=1 (attack 33); energy cost measured −23 %-class at lower caps (I1); thermals under gaming+inference unmeasured (E4 zero-hit); cap is the already-applied energy intervention (arm-1 I1, arm-3 §2.7) | Raising it now would spend measured energy savings for unmeasured latency gain | Leave at 366-max-available; revisit only after E4 with bs=1 measurement | — |
+| 37 | earlyoom protects Rune's core | **PARTIAL** | earlyoom active, but args verified this session (PV-3): avoid-list = init/systemd/Xorg/sshd only — **Ollama not excluded, kwin not protected**; "runner dies first" holds only if the runner is largest RSS — under mmap, resident pages may or may not dominate RSS; arm-3 itself says survival is "by accident of size, not by design" | The deterministic core's OOM survival is a hope, not a control; the compositor is unprotected (desktop death = user-visible outage) | One-line, config-level, reversible: add `--prefer (ollama|llama-server)` and consider `--avoid` for the core's process name — **this belongs in T1 and is missing** | earlyoom heuristic ≠ kernel OOM score; guarantees remain soft |
+| 38 | XID events can be generically alerted | **FAILS** | XID 45 is emitted by ordinary Ctrl-C/sigkill; XID 13/31 usually app bugs; buckets differ per XID (arm-3 A3-19); generic alerting manufactures false hardware signals | None — architecture alerts by resolution bucket | — | GeForce applicability of catalog rows scope-labeled (arm-3 register) |
+| 39 | A probe failure means zero | **FAILS** | Point 6: probe failure ⇒ unknown, never 0; S8 semantics; `unsupported` ≠ 0 for queue depth (arm-3 §2.5 rows 22–24) | None | — | Semantics exist on paper; the collector that enforces them doesn't exist yet |
+| 40 | WiFi LAN is adequate for future distributed inference | **FAILS** | Host is on wlan0 (inward F); bufferbloat + 802.11 anomaly, order-of-magnitude latency under load (1703.00064); Petals ~1 t/s engineered (2209.01188); 125–1250 MB/s LAN vs hundreds of GB/s assumption (arm-2 §2.7) | None | — | Remote-API (not tensor-parallel) over LAN is the only viable pattern and is correctly FUTURE with one caveat: any such pattern inherits the wireless hop |
+| 41 | MIG is available on this card | **FAILS** | AD103 absent from NVIDIA MIG supported-GPU table (arm-2 A9, doc-verified) | None | — | — |
+| 42 | TGI/TRT-LLM/ORT-GenAI are viable alternatives | **FAILS** | TGI: vendor-declared maintenance mode with successor advice (arm-2 A5); TRT-LLM: Blackwell/Hopper-tier deployment (A6); ORT-GenAI: no GGUF, SD roadmap-only, telemetry phone-home (A7) | None | — | — |
+| 43 | Grammar-constrained output requires a runtime migration | **PARTIAL** | Ollama *does* expose JSON-schema structured output via `format` (arm-1 G2, arm-2 A2) — schema-level grammar needs **no migration**; only non-JSON GBNF grammars require llama.cpp | The architecture's escape-hatch justification slightly overstates the gap; a migration might be initiated for a need Ollama already covers | Split the requirement: JSON-schema (stay on Ollama) vs GBNF (escape hatch); verify Ollama `format` quality on Rune's actual schemas before migrating | Ollama's `format` implementation quality is docs-asserted, not measured |
+| 44 | Speculative decoding requires a runtime migration | **FAILS** | Claim is TRUE at face value (Ollama exposes no SD — arm-1 G2) but the architecture pre-accounted it: SD requalification is gated behind the escape hatch / measured sequence, and SD is in NOT-NEEDED until measured | None — no damage; the cost is already priced into seam E | — | See 53: the escape hatch's absence from the machine (PV-6) makes the gate real, not nominal |
+| 45 | LoRA serving is available on the incumbent | **FAILS** | Current Ollama Modelfile reference has zero ADAPTER occurrences (arm-3 §0 negative verification); llama.cpp documents `--lora` fully (A3-23) | None — architecture correctly routes LoRA experiments to the escape hatch | — | Re-check Ollama docs on any version bump; the negative is snapshot-dated |
+| 46 | The registry needs no runtime change | **FAILS** | 22/24 fields obtainable today, but `queue.depth` and `preemption.count` are `unsupported` on Ollama (llama.cpp `/metrics` only) — arm-3 §2.5 rows 22–23; also `/api/ps context_length` is version-dependent (observed, not documented) | A "no change needed" registry would silently degrade two fields; the architecture's `unsupported` semantics is the correct answer | Keep `unsupported` semantics; re-verify field set on every Ollama version bump | — |
+| 47 | Context default is safe because flash-attention is on | **FAILS** | FA reduces attention memory growth; KV still scales linearly with context (arm-1 V2/B1); Ollama defaults are ungoverned per-model today (nomic at 2048 — PV-4) | None — point 2 makes context explicit | — | KV q8_0 quality caveat at high-GQA carried (see 48) |
+| 48 | KV q8_0 is lossless | **FAILS** | Ollama docs: q8_0 ≈ ½ f16 with "very small loss"; **"models with high GQA count (e.g. Qwen2) may see a larger impact"** (arm-2 A3) — Rune's 14B models are 8-KV-head GQA; declared, never validated | If quality-relevant, the entire fit arithmetic (80–96 KiB/token) is built on an unvalidated quality assumption | Add a KV-type arm to the #406 measurement pass (q8_0 vs f16 on one bounded task) before trusting 32k-class contexts | Quality delta at 8k with q8_0 likely negligible — but that is a prior, not a measurement |
+| 49 | 8k context is enough for Rune's work | **PARTIAL** | The 8k default is governed and the dial is explicit (point 2) — well-designed. But sufficiency is unvalidated: no token-length distribution of Rune's actual workloads exists; agent workloads (multi-file reasoning + retrieved context + tool schemas) plausibly exceed 8k; 32k on 14B exceeds free VRAM with desktop co-tenant (arm-1 V2) | If workloads need >8k, the governed default is systematically truncating and nothing measures it | #406 telemetry should record context-window pressure (tokens requested vs context_length per call) — a field obtainable from request sizes today | At 24 GB the dial stops binding (arm-3 §2.3) — the constraint is hardware, honestly carried |
+| 50 | 14B-Q4 is adequate for Rune's tasks (unmeasured!) | **SUCCEEDS** | Zero local task capability measurements exist for ANY installed model (inward UNKNOWN; #404 E13 owed; NF-1 extends to the 27Bs' vision/thinking modes); the architecture nonetheless fixes 14B-Q4 as "the governed default" (point 2); no benchmark harness installed (PV-6) | The architecture's central placement decision rests entirely on priors (Dettmers law + KV arithmetic); "governed" without measurement is governance of an assumption; TTL, context, and model-tier defaults are all unmeasured | (a) label the default provisional-pending-measurement in every artifact; (b) run the minimal measurement pass FIRST: load_duration, tok/s, embedding latency, one bounded task probe per installed model at governed context — read-only-compatible via existing telemetry; (c) schedule the 14B-vs-27B-IQ2_M pair (attack 14) | The pass is cheap (existing telemetry + one harness install) — its absence is a choice, not a constraint |
+| 51 | An unmeasured 27B default is acceptable because it is only a default | **FAILS** | Architecture explicitly rejects 27B as default (point 2); defaults shape caching, VRAM tenancy, and expectations even when unmeasured (KEEP_ALIVE=−1 is the existence proof of default-as-architecture) | None | — | The 27Bs' 24 GB disk footprint still needs a disposition (FR-8) |
+| 52 | Placement policy can be deferred until models are used more | **FAILS** | The ungoverned state IS the current defect: KEEP_ALIVE=−1, ungoverned 2048 embedder context, no telemetry, no TTL (inward classification: INSTALLED and stops there); deferral = preserving the defect | None | — | — |
+| 53 | The escape hatch can be adopted later with no cost | **PARTIAL** | Deferral is cheap and T1-consistent — but not free: (a) **no llama.cpp binary is installed** (PV-6) — adoption requires install + version-pin + validation, contradicting "config-level only"; (b) deferral blocks seam-E requalification, queue-depth telemetry (registry rows 22–23), GBNF, LoRA experiments indefinitely; (c) a later adoption under pressure invites config drift / two-API-dialect bugs (arm-2 §2.5 failure-surface logic) | "Later" silently becomes "never" for seam E — speculative decoding and LoRA stay permanently unrequalified | Pin the escape hatch NOW as an installed-but-inert artifact: build/download a fixed llama.cpp version, validate once with a smoke test, never run it as a resident service — this preserves "one always-on runtime" while making adoption a config change (portability rule) | Smoke test itself is a measurement-adjacent action; scope it to load/unload of an existing GGUF, no benchmark |
+| 54 | Telemetry can be added after the gateway | **FAILS** | Telemetry sources (/proc, nvidia-smi, /api/ps) are gateway-independent; S5/S6 baselines must predate changes to be baselines; unknown≠0 semantics must exist *before* any consumer interprets fields (arm-3 §2.1 design rule iv) | Post-gateway telemetry would have no pre-change baseline and would inherit the gateway's blind spots | Keep T1 item 1 (baseline snapshot) as the first action | — |
+| 55 | Storage tiers are already optimal | **PARTIAL** | Models on NVMe fast-storage is correct (arm-2 §2.8); measured 6.0 GB/s. BUT "optimal" was argued on **bandwidth**, which is not the binding constraint — the binding risks are **contention and failure domain**: models share nvme2n1 silicon with the 72 %-full system disk and /var/tmp (PV-5, arm-2 C3 correction); nvme1n1 (workdrive, 27 % full, separate device) was never evaluated as an alternative home | Model loads and system writes contend on one device; a fast-storage failure takes models AND OS AND /var/tmp together | Record the nvme1 alternative as the designated contention-mitigation if IO-PSI spikes during loads (E1/E-churn measurement decides); do NOT move models now | Read bandwidth genuinely is not the bottleneck — the attack lands on the unexamined contention/failure-domain axes only |
+| 56 | The system disk being 72 % full is not a risk | **PARTIAL** | The claim is false as stated: btrfs at 72 % with growth pressure (models dir 71 GB on the same device; browser/profile growth), `/var/tmp` on the same partition (arm-3 A3-28), SMART unreadable without root (gap) — and the architecture takes **no T1 action** beyond "keep in view" | A full system disk blocks SQLite temp/journal writes and OS operation — the likeliest mundane failure (arm-3 §2.2) | Add to T1: disk-free thresholds (registry row 21 already specifies `disk.free`) with an alert; one root-assisted SMART reading; consider relocating `/var/tmp` to nvme1 | Actual free space (96 G) is comfortable today — this is a monitoring gap, not an emergency |
+| 57 | No backup verification is acceptable because the Pi is 'cold tier' | **PARTIAL** | The claim itself fails (bit-rot, WAL-pair discipline — arm-2 A11; SQLite ≥3.51.3 required on targets) — and the architecture agrees verification is needed. But T1 schedules **nothing**: the Pi is unreachable (inward F), no reachability fix, no restore drill, no version check | The failure-domain story (point 7) leans on a cold tier that is verifiably not operating; "preserve failure-domain split" is preserved in the wrong domain — it keeps store vs OS split while the backup pillar is dead | Add a read-only T1 item: Pi reachability probe + (when reachable) one restore-verification drill + SQLite version check; record result in the registry | Family-shared box adversarial risk (arm-2 §2.7) still applies |
+| 58 | A single-machine topology is not a risk | **PARTIAL** | Operationally true today (no second endpoint exists; multi-node REJECT is evidence-backed) — but it IS a risk: nvme2n1 is a single point of failure for OS + models + /var/tmp simultaneously (PV-5); the only backup tier is inoperative; no offsite copy verified | The architecture's rejection of multi-node is correct while its implicit "topology risk = none" is not; a fast-storage/system-disk event is unrecoverable from the Pi as-is | Carry an explicit risk-register entry: single-device exposure of OS+models, backup tier inoperative, gateway-address abstraction is the (only) mitigation path | True repair (second device) is FUTURE and correctly so; the correction is honesty, not topology |
+| 59 | Hardware research cannot be done without buying hardware | **FAILS** | Every load-bearing question has a free instrument: PSI (present), load_duration (API), nvidia-smi counters, llama-bench (free), E1–E5 designs need no purchase (arm-3 §2.6) | None | — | Only 24/48 GB-class questions need hardware — and those are explicitly bounds, not requirements |
+| 60 | The experimental internalisation programme is guaranteed to succeed | **FAILS** | Production/research split with kill-criteria (scope file epistemic correction 3); topology preserves the room without pre-judging (point 10); NO PRIOR ART ≠ NOVELTY | None | — | — |
+
+## PART 2 — Rune-specific attacks (FR-1..FR-14, grounded in inward findings + fresh probes)
+
+| # | Attack | Verdict | Evidence | Consequence | Correction | Residual |
+|---|---|---|---|---|---|---|
+| FR-1 | `KEEP_ALIVE=-1` pins an 11 GB model against a ~5 GB desktop floor — and the architecture's fix (per-request keep_alive) only governs requests *through the governed client*. The env var stays −1, so every ungoverned caller inherits permanent residency | **SUCCEEDS** | Env var observed (inward B); per-request override verbatim (arm-2 A2); **on-box ungoverned Ollama clients exist** — open-webui, anythingllm directories observed under `/mnt/fast-storage/ai` (PV-5 listing); nomic pinned to year 2319 (PV-4) | The foreground-wins policy **fails open**: one direct API call (open-webui chat, a script, a future tool) loads a model that never leaves; the architecture's guarantee evaporates exactly when a non-Rune actor touches Ollama | Flip `OLLAMA_KEEP_ALIVE` from −1 to a TTL default (10–15 m); pin the embedder via per-request `keep_alive:-1` issued by the governed embedding path. The env default becomes safe-by-default; the pin survives where it is designed to | Direct callers can still send `keep_alive:-1` per request — policy cannot govern protocol abuse, only defaults |
+| FR-2 | MAX_LOADED_MODELS=1 blocks the #404 embedder+LLM design; the proposed 1→2 is arithmetic-viable only at ≤7B+≤3B — so with the **14B default**, the designed residency (embedder pinned + LLM on demand) does not fit: 14B@8k ≈ 9.7–10.0 GB + embedder 0.3 GB ≈ 10.0–10.3 GB against 10.85–11.3 GB free, margin < 1 GB *before* compute buffers, and under gaming it fails outright; worse, Ollama's idle-unload-to-make-room means the embedder is *evictable*, not pinned | **SUCCEEDS** | Point 3's own concession ("viable only at ≤7B+≤3B"); arm-1 V2 arithmetic; arm-2 A3 eviction rule; PV-1 free VRAM 10 879 MiB; arm-3 §2.4a (14B+3B doesn't fit; only 7B+3B does) | The architecture's flagship residency policy and its flagship default model are **mutually exclusive** at current VRAM: either the RAG loop pays embedding cold-loads (unmeasured latency) or sessions drop to the 7B tier — and nothing in the architecture says which | Make the tier rule explicit: (a) co-resident RAG sessions ⇒ 7B generalist tier (7B+embedder+headroom fits); (b) 14B sessions ⇒ accept embedder evict/reload churn, and measure embedding cold latency first; (c) 1→2 stays a measured EXPERIMENT, not a default | Whether two Ollama model runners execute *concurrently* (not just co-reside) is doc-underdetermined — must be verified before the policy is claimed to work at all |
+| FR-3 | The LAN is wireless (wlan0, 192.168.1.x) — the architecture rejects tensor-parallel over it (correct) but every remaining network role (Pi backup, future remote-API gateway) rides the same load-sensitive wireless hop | **PARTIAL** | inward F; 1703.00064 (order-of-magnitude latency under load); arm-2 §2.7 | Backup sync and future remote calls inherit jitter and drop risk; no LAN measurement exists on this network | When the Pi drill runs (FR-4), measure the hop once (ping/mtr under idle + load); keep backup sync latency-insensitive | Multi-node inference rejection is unaffected — the attack only touches the residual network roles |
+| FR-4 | The Pi cold-backup tier is **unreachable right now** (192.168.0.84 vs host 192.168.1.x subnet mismatch expectation) — the architecture classifies it ADAPT but T1 schedules no reachability fix, no restore drill, no verification; the "cold backup" pillar of the failure story is currently fictional | **SUCCEEDS** | inward F ("Pi UNREACHABLE at audit time"); point 8 says "needs reachability + restore verification" but T1 (point 12) contains no such item; attack 57 correction also unscheduled | The architecture asserts a failure/recovery structure whose recovery side does not operate; a system-disk event today = unrecoverable model+store loss beyond nvme1's store copy | Add to T1 (read-only compatible): reachability probe + subnet diagnosis; on reachability, one restore-verification drill + SQLite ≥3.51.3 check; record in registry as `backup.verified: unknown` until then | If the Pi is decommissioned by family decision, the architecture must demote the tier honestly rather than keep it nominal |
+| FR-5 | zram at ~22 GiB occupied with **IO stall dominating history** (io some 74.7 h, full ≈ some — PV-2): the architecture adopts PSI-as-telemetry (correct, attack 32 FAILS) but takes no mitigation for the actual dominant signal — and model loads share nvme2n1 silicon with the 72 %-full system disk | **PARTIAL** | PV-2; arm-3 §2.1 structural finding; arm-2 §2.8 (IOWeight lever named, not applied); point 12 T1 has "IO-pressure watch" (watching ≠ mitigating) | The measurable churn risk (S6) has a telemetry plan but no mitigation plan; if IO stalls correlate with loads, the only lever named (IOWeight drop-in) is deferred indefinitely | Pre-write the IOWeight systemd drop-in (reversible, config-level) as a *contingency artifact* — applied only if E1/churn measurement shows load-correlated IO stalls | The watchdog itself may be correct: today memory PSI ≈ 0 and io avg10/60 = 0.00 — no active stall at probe time; mitigation may never be needed |
+| FR-6 | System disk 72 % full with `/var/tmp` on it — the architecture "keeps the exposure in view" (T1 item 6) but defines no threshold, no alert, no action | **PARTIAL** | PV-5 (72 %, 96 G free); arm-3 A3-28; registry row 21 specifies `disk.free` polling but T1 attaches no gate | Silent progression to a full root disk is the likeliest mundane failure and it is unwatched | Wire registry row 21 to a threshold gate (e.g., alert at 85 %); one root-assisted SMART read; evaluate relocating `/var/tmp` to nvme1 | 96 G free is comfortable today; this is a monitoring gap, not a present emergency |
+| FR-7 | earlyoom does not exclude Ollama — and also does not protect kwin — so the architecture's "LLM runner dies first" is unguaranteed in both directions (runner may not be largest RSS under mmap; compositor is killable) | **SUCCEEDS** | PV-3 (verified running args: `--avoid (^|/)(init|systemd|Xorg|sshd)$` — no ollama, no kwin); arm-3 A3-27 + §2.2 "by accident of size, not by design"; point 7 states "earlyoom active (LLM runner dies first)" as if it were a property of the design | The deterministic-core survival story (point 7) leans on an emergent property that a config change by the family or an mmap-RSS quirk can silently void | Add to T1 (one line, reversible): `--prefer (ollama|llama-server)` in EARLYOOM_ARGS; document that core survival remains size-based; consider `--avoid` for the core's process name | earlyoom's heuristic ≠ kernel OOM score; guarantees stay soft — but preferring the runner converts accident into policy |
+| FR-8 | Two duplicate 27B IQ2_M models consume **23.99 GB disk** (11.39 + 12.60, PV-4) on the 69 %-full fast-storage for an unmeasured niche — and NF-1 shows they are also the only local vision+thinking models, native ctx 262 144; no keep/delete disposition exists | **PARTIAL** | PV-4; inward C ("neither measured on any task"); arm-1 register (lineage unverified, arch facts must come from GGUF metadata) | 24 GB of disk + registry weight for models that may never be loadable at governed context; conversely, deleting them would destroy the only local vision capability before any measurement | Record a disposition decision in the registry: measure-first (one bounded task + vision probe via existing telemetry) then keep-or-delete; until measured, label `unmeasured-duplicate` | The 262 144 native context is a VRAM fiction at 16 GB (arm-1 V2 logic); any measurement must pin context first |
+| FR-9 | nomic ctx 2048 silently truncating + no context override — the architecture's "context as explicit per-model parameter" (T1 item 2) reads as an LLM-dial fix; the *embedding* truncation (a retrieval-correctness defect carried from #403/#404) is fixed only if the parameter explicitly includes embedders and a re-embed is scheduled | **SUCCEEDS** | PV-4 (live `context_length: 2048`); inward B contradiction 3; R33 rebuildable vectors (scope file) | Every embedding query longer than ~2048 tokens is silently degraded **today**; the governed-context fix that doesn't name the embedder leaves the defect in place | State T1 item 2 as covering **all** models including embedders; set nomic to its native window; schedule re-embed under R33 (vectors are rebuildable by design — the cost is bounded) | nomic's *native* context is 8192 — the 2048 is purely Ollama default, i.e. fully fixable in config |
+| FR-10 | 8 GPU processes contending + power cap 225 W of 285 W rated / 366 W max — the architecture leaves the cap (correct per attack 36) but has **no interim contention answer** beyond between-request priority: no handoff trigger, no gaming coexistence data (E4 empty) | **PARTIAL** | PV-1 (8 processes; Vivaldi 985 MiB and drifting); arm-3 §2.7 (gaming+inference zero-hit); point 4 (between-request only) | The most common real contention (evening gaming) is the least measured; foreground-wins degrades to "hope the TTL expires before the game starts" | Keep cap unchanged; add the handoff trigger definition (FR-14 correction); E4 stays the only path to real data | Cap binding (~125 GPU-h cumulative) is benign at idle draw 44–47 W — the cap matters only under sustained inference, which is itself unmeasured |
+| FR-11 | **Zero measured task capability for any local model + no benchmark harness** — the architecture's defaults (14B-Q4, 8k, TTL 10–15 min) are all priors; even the hardware-level baselines (tok/s, load_duration) have never been captured on this machine | **SUCCEEDS** | inward UNKNOWN rows; PV-6 (no llama-bench/llama-server installed); arm-2 §2.2 R2 explicitly says load_duration "should set the final value" of the TTL — it never was; point 12 T1 includes baseline *hardware* telemetry but no model-performance baseline | Every number in the placement map is derived or inherited; the architecture governs a system it has never profiled; S5 (throughput-degraded) is undetectable without baselines | A minimal measurement pass is prerequisite, not follow-up: (1) capture load_duration + tok/s per installed model at governed context via normal API calls; (2) install llama-bench (PV-6) for cross-checks; (3) one bounded task probe per tier (this is #406-adjacent but must be scheduled somewhere) | Read-only discipline is not violated: tok/s capture requires only issuing normal inference requests, which the mandate permits when coordinated — flag for the supervisory layer to schedule |
+| FR-12 | The "152 modules / 436 MB" deterministic-core claim is unreproducible (arm-3 found 213 .py, 220 KB store in harness vantage) — the architecture still asserts "deterministic core (CPU-only modules + SQLite) survives every failure row" | **PARTIAL** | arm-3 §0 + §2.2 (INWARD_TRUTH, UNVERIFIED); point 7 as received carries the claim with the envelope caveat | The *load-bearing* conclusion (no GPU/model/network dependency; small RSS) is independently supported; the *numbers* are unverified and travel unstably between artifacts | Carry the claim as arm-3 does: envelope + "no GPU dependency" verified, counts explicitly inward-truth; reconcile before #406 consumes them | Different vantages (harness tree vs production tree) may explain the discrepancy — reconciliation is a file-read task, not research |
+| FR-13 | The designated escape hatch is **not installed** (PV-6) — T1's "config-level only, reversible" claim silently excludes the two artifacts the architecture actually needs next (harness, hatch) | **PARTIAL** | PV-6; point 12; attack 53 | "Reversible" is true, "config-level" is false for these artifacts; installation introduces version-pinning and provenance questions (where does the binary come from — #402 seam) | Add a T1-adjacent setup item: install pinned llama.cpp release (hashed download or distro package), validate once, keep inert — provenance recorded per #402 | If family policy forbids new installs, the honest fallback is recording the hatch as NOT-INSTALLED in the registry rather than "designated" |
+| FR-14 | "Unload-on-handoff" has **no trigger mechanism**: the architecture specifies the effect (empty-prompt keep_alive:0) but nothing detects "foreground demand shifts" — no nvidia-smi watcher, no gaming-start signal, no manual command surface is specified | **SUCCEEDS** | Point 3/4; arm-2 §2.2 R3 (mechanism exists, trigger undefined); arm-3 S7 (contended state detectable but no gate defined as trigger) | The policy's most user-visible guarantee (VRAM back before gaming) is unimplemented and unimplementable until a trigger exists; without it, TTL expiry is the only unload path and it may be 10–15 min into a gaming session | Define the trigger ladder for T1: (1) explicit unload command (governed client surface), (2) S1-gate signal (free VRAM < threshold with a pending request), (3) automated watcher only after E4 produces data | A fully automatic watcher risks false handoffs (browsers also spike VRAM); the ladder keeps automation gated on evidence |
+
+---
+
+## PART 3 — Synthesis (fresh-context read)
+
+**What the architecture gets right (attacks that failed against it, and why):** The bandwidth-roofline spine (GPU-residency load-bearing, 12–13× gap) is triple-sourced and I found no crack in it — attack 1/2/9/16 all fail. The quantization-frontier handling (27B hypothesis, never default) is the epistemically correct posture even though it leaves measurement debt. The runtime rejection set (TGI/TRT-LLM/ORT-GenAI, attacks 42/45) survives because it rests on vendor-declared evidence, not taste. The PSI-not-occupancy adoption (attack 32) is verified by my own probes this session: memory PSI is zero while zram holds 22 GB — the inward audit's "sustained memory pressure" framing was wrong and the architecture absorbed the correction. The unknown≠0 semantics and the portability abstraction are sound and unattacked by anything in the mandated list.
+
+**Where the architecture is genuinely exposed — one meta-defect with four faces:** *the architecture governs mechanisms but not their triggers, defaults, or substrates.* (1) **Defaults fail open**: per-request keep_alive governs only the governed path while `OLLAMA_KEEP_ALIVE=-1` remains the machine-wide default for ungoverned on-box clients (FR-1). (2) **Triggers are undefined**: unload-on-handoff has no detector (FR-14); the earlyoom property is emergent with a one-line fix missing from T1 (FR-7). (3) **The flagship combination is arithmetically self-contradictory**: embedder-pin + 14B default + MAX_LOADED_MODELS=2 cannot co-hold — the architecture's own ≤7B+≤3B concession proves the default model cannot do the designed RAG residency (FR-2, attack 23). (4) **The substrate is missing**: no harness, no escape-hatch binary, no baselines — the "provisional" 14B-Q4/8k/TTL defaults have never been measured at any level (attacks 50/17, FR-11/FR-13). And the failure story's backup pillar is currently fictional (FR-4/FR-3): the Pi is unreachable, unverified, and unscheduled.
+
+**What survives the harshest reading:** the decision *set* (what to reject, what to defer, what to measure) is better evidenced than most of the placement literature it cites. What does not survive: the claim that T1 as listed makes the machine governed. T1 is missing four one-line, reversible config items (safe keep-alive default, earlyoom --prefer, disk-free gate, Pi drill) that cost minutes, while containing zero measurement actions that would convert its priors into baselines.
+
+---
+
+## PART 4 — Mechanical verdict counts
+
+| Verdict | Mandated (60) | Rune-specific (14) | Total |
+|---|---|---|---|
+| SUCCEEDS | 1 (#50) | 7 (FR-1, FR-2, FR-4, FR-7, FR-9, FR-11, FR-14) | **8** |
+| PARTIAL | 21 (#3,4,5,6,8,9,14,17,23,28,31,33,35,37,43,49,53,55,56,57,58) | 7 (FR-3, FR-5, FR-6, FR-8, FR-10, FR-12, FR-13) | **28** |
+| FAILS | 38 (#1,2,7,10,11,12,13,15,16,18,19,20,21,22,24,25,26,27,29,30,32,34,36,38,39,40,41,42,44,45,46,47,48,51,52,54,59,60) | 0 | **38** |
+| **Sum** | **60** ✓ | **14** ✓ | **74** ✓ (8+28+38=74 ✓) |
+
+---
+
+## PART 5 — Sharpest findings (4) and FORCED CORRECTIONS
+
+### Sharpest findings
+
+1. **The residency policy and the default model are mutually exclusive (FR-2, attack 23 — SUCCEEDS).** The architecture's most-designed guarantee ("embedder always warm, one LLM on demand") is arithmetically impossible with its own 14B-Q4 default: 14B@8k ≈ 9.7–10.0 GB + 0.3 GB embedder against 10.85–11.3 GB free leaves < 1 GB margin before compute buffers, fails under gaming, and Ollama's eviction semantics make the "pin" evictable anyway. The architecture's own concession that 1→2 is "viable only at ≤7B+≤3B" is the confession: **the co-resident RAG design is a 7B-tier capability, and nothing says so.**
+2. **Foreground-wins fails open (FR-1 — SUCCEEDS).** Per-request keep_alive governs only governed clients; `OLLAMA_KEEP_ALIVE=-1` stays the machine default and ungoverned on-box clients (open-webui, anythingllm — observed this session) inherit permanent 11 GB residency. One direct API call voids the entire between-request priority story. The fix is flipping the env var, which the architecture never proposes.
+3. **The architecture has never measured anything it governs (FR-11, attacks 50/17/53 — SUCCEEDS/PARTIAL).** No tok/s, no load_duration capture, no task capability, no embedding latency; no llama-bench or standalone llama-server on the machine (verified this session). The TTL (10–15 min), the default model, and the default context are all priors — arm-2 itself said load_duration should set the TTL and it never was. "Governed" without baselines is governance of assumptions.
+4. **The recovery story leans on tiers that don't operate and properties nobody designed (FR-4, FR-7, attacks 37/57/58 — SUCCEEDS/PARTIAL).** The Pi cold-backup is unreachable and unverified with no drill scheduled; earlyoom's "runner dies first" is emergent, with running args (verified) that exclude neither Ollama from protection nor kwin from the kill list; a one-line `--prefer` fix exists and is absent from T1.
+
+### FORCED CORRECTIONS (to the candidate architecture)
+
+1. **FC-1 (safe-by-default residency):** flip `OLLAMA_KEEP_ALIVE` from −1 to a TTL default (10–15 min); pin the embedder via per-request `keep_alive:-1` on the governed embedding path only. The env default must be safe for ungoverned callers.
+2. **FC-2 (tier-conditional co-residency):** state explicitly that embedder+LLM co-residency is a ≤7B-tier capability; 14B sessions accept embedder evict/reload; measure embedding cold-start latency before relying on either; verify that co-resident Ollama runners actually execute concurrently before claiming the RAG loop works.
+3. **FC-3 (measure first, then govern):** a minimal measurement pass (load_duration, tok/s, embedding latency per installed model at governed context; llama-bench install for cross-checks) is a **prerequisite** to T1's governance claims; label the 14B-Q4/8k default provisional in every artifact; schedule the 14B-vs-27B-IQ2_M pair (including vision/thinking modes — NF-1) so the default's rejection becomes measured.
+4. **FC-4 (four missing one-liners for T1, all config-level and reversible):** (a) `earlyoom --prefer (ollama|llama-server)`; (b) disk-free threshold gate on nvme2n1p3 (registry row 21 wired to an alert); (c) Pi reachability probe + restore-verification drill + SQLite version check when reachable; (d) registry entry `backup.verified: unknown` until (c) completes.
+5. **FC-5 (trigger ladder for unload-on-handoff):** T1 = explicit unload command + S1-gate signal only; automated watcher gated on E4 evidence. No trigger, no guarantee — the current text promises an effect with no cause.
+6. **FC-6 (embedder context is in scope):** T1's "context as explicit per-model parameter" must name embedders; fix nomic's 2048 silent truncation to its native window; schedule re-embed under R33 rebuildability.
+7. **FC-7 (honesty entries):** install the pinned escape-hatch binary inert (or record `escape-hatch: NOT-INSTALLED` in the registry — PV-6 shows "designated" currently overstates); carry a single-machine topology risk-register entry (nvme2n1 = OS + models + /var/tmp single point); record a measure-then-keep/delete disposition for the 24 GB of unmeasured duplicate 27B IQ2_M inventory.
+
+---
+
+## Arm-4 accounting
+
+**Verdicts:** 74 rows (60 mandated + 14 Rune-specific), counts in PART 4 with sum check.
+**Fresh verification:** 7 local probes (PV-1..PV-7), all read-only; 14 arXiv IDs export-API-verified with 0 mis-pairings; 3 new facts (NF-1..NF-3) not present in any arm report.
+**Attack on own pass:** the four SUCCEEDS-class FR findings rest on probes I ran this session, not on arm claims; the one place this pass *strengthens* the architecture is attack 43 (Ollama's `format` covers more grammar need than the escape-hatch rationale assumed) — recorded as a PARTIAL against the migration instinct, which is what an adversarial pass owes the record.

research/memory-atlas-r1/AD-hardware-resource-placement/03_applicability.md

@@ -0,0 +1,68 @@
+# #405 AD — Applicability (mechanisms tested against Rune's actual inward state, 2026-09-23)
+
+| # | Mechanism | Verdict | Rationale |
+|---|---|---|---|
+| 1 | ★ GPU-resident inference as the default placement | ADOPT | measured 12–13× CPU gap; bandwidth-bound decode |
+| 2 | ★ Context as an explicit per-model/per-request parameter | ADOPT | the context dial alone flips fit verdicts; nomic silently at 2048 |
+| 3 | ★ Fit as a COMPUTED predicate (VRAM + KV + margin vs free) | ADOPT | arm-4 #31 TOCTOU: free VRAM is volatile (desktop drift observed) |
+| 4 | ★ Safe machine-level residency default (bounded TTL, not -1) | ADOPT | FC-1: per-request policy fails open for ungoverned clients |
+| 5 | ★ Per-request keep_alive pinning for the embedder only | ADOPT | cheap tenant (0.3 GB) vs scarce tenant (11 GB) asymmetry |
+| 6 | ★ Unload-on-handoff with a defined trigger ladder | ADOPT | FC-5; aspiration is not a policy |
+| 7 | ★ MAX_LOADED_MODELS 1→2, viable only at ≤7B+≤3B | ADOPT | arithmetic: 14B+anything fails by <1 GB margin |
+| 8 | NUM_PARALLEL stays 1 (serialisation = foreground-wins) | ADOPT | arm-2 F-spec: parallel requests multiply KV; single user |
+| 9 | ★ Typed starvation states S0–S8 with named telemetry | ADOPT | availability ≠ usability (#404 correction 1) |
+| 10 | ★ Probe failure ⇒ `unknown`, never 0 | ADOPT | arm-4 #39; 0 is indistinguishable from an empty queue |
+| 11 | PSI as TELEMETRY (not an actuator) | ADOPT | PSI live; IO stall dominates; no deferrable queue exists to shed |
+| 12 | ★ Gate signals: S1 (VRAM), S2 (context), S4 (memory), S6 (churn), S8 (unknown), XID | ADOPT | minimal actionable set with per-state detection limits |
+| 13 | IO-pressure watch as the load-churn signal | ADOPT | IO stall 74.6 h ≫ memory 41.3 s (measured) |
+| 14 | ★ Preserve the storage failure-domain split (store on nvme1) | ADOPT | / and /mnt/fast-storage share nvme2n1 at 72% full |
+| 15 | ★ Disk-free gate incl. /var/tmp awareness | ADOPT | /var/tmp sits on the 72%-full device (non-obvious exposure) |
+| 16 | ★ earlyoom `--prefer` for Ollama | ADOPT | FC-4: neither Ollama nor kwin protected today |
+| 17 | ★ Scheduled restore drill + `backup.verified` flag | ADOPT | FC-4; the cold tier is fictional without it |
+| 18 | ★ Leave the 225 W power cap alone | ADOPT | measured regime: 125 GPU-h capping, 0 thermal slowdown; −23% energy for +6.7% time |
+| 19 | ★ 14B-Q4@8k as the provisional governed default | ADOPT (provisional) | pending E-27B measurement; 27B unmeasured + below the studied floor |
+| 20 | 27B IQ2_M as the default | REJECT (pending measurement) | no measured advantage; same bandwidth ⇒ no latency gain; 23.99 GB disk |
+| 21 | 27B IQ2_M disposition | EXPERIMENT | E-27B: 14B-Q4 vs 27B-IQ2_M incl. vision/thinking variants |
+| 22 | ★ Ollama as the single incumbent runtime | ADOPT | governable via env+API; 14/15 registry fields obtainable |
+| 23 | llama.cpp `llama-server` as escape hatch | FUTURE (not installed) | FC-7: designated ≠ available; requires install+validation |
+| 24 | Two runtimes always-on in T1 | REJECT | one always-on runtime; escape hatch is a decision, not a default |
+| 25 | vLLM | REJECT (for now) | CUDA-only, multi-tenant design; single user, no batching benefit |
+| 26 | TGI | REJECT | vendor-declared maintenance mode |
+| 27 | TensorRT-LLM | REJECT | Blackwell/Hopper-tier; no GGUF |
+| 28 | ONNX Runtime GenAI | REJECT (unassessed) | registered, NOT audited — excluded rather than asserted |
+| 29 | MIG on this GPU | REJECT | AD103 absent from NVIDIA's supported list |
+| 30 | MPS | REJECT (today) | GeForce support unaudited; complexity without demonstrated need |
+| 31 | Speculative decoding on the incumbent | REJECT | Ollama exposes no SD surface at all |
+| 32 | Speculative decoding via the escape hatch (ngram first) | EXPERIMENT | zero-VRAM ngram drafting is the rational first step |
+| 33 | EAGLE-3 drafting | FUTURE | head availability for Qwen3-14B unverified (bounded zero-hit) |
+| 34 | CPU-primary inference for 14B/27B | REJECT | 12–13× measured gap; 4–5 t/s |
+| 35 | CPU path for ≤7B | ADOPT (fallback) | 11 t/s measured on this CPU class |
+| 36 | Partial layer offload as a capacity extender | REJECT | 4–25× paging penalty evidence (LLM-in-a-flash); FlexGen ~1 t/s floor |
+| 37 | Swap/CPU-spill as a serving mechanism | REJECT | no-spill evidence (Pie/SwapMoE); fit-or-don't-load |
+| 38 | KV paging / prefix caching | NOT NEEDED | single-user; no queue to exploit it |
+| 39 | Continuous batching | NOT NEEDED | single user; no throughput-vs-latency trade to make |
+| 40 | Multi-node inference (LAN) | REJECT | 125–1250 MB/s vs cluster interconnects; Petals ~1 t/s; WiFi bufferbloat |
+| 41 | Pi inference | REJECT | best case 2.13–3.04 t/s; no capacity |
+| 42 | Pi cold-backup role | ADAPT | correct role; currently non-operating (drill + reachability required) |
+| 43 | Distributed GPU inference (--rpc) | REJECT (now) | wireless LAN; single inference node |
+| 44 | Predictive failure modelling | REJECT | no data; no actionable intervention |
+| 45 | Generic XID alerting | REJECT | XID 45 fires on ordinary Ctrl-C — alerting must be bucketed (RESTART_APP/RESET_GPU/RESTART_BM) |
+| 46 | DCGM | REJECT | datacentre tooling; not applicable to GeForce |
+| 47 | Swap/zram OCCUPANCY as a degradation signal | REJECT | occupancy ≠ pressure (23 GiB occupied, no memory-stall signature) |
+| 48 | PSI-driven load shedding | REJECT | no deferrable queue exists — telemetry only |
+| 49 | LoRA serving on the incumbent | REJECT | Ollama LoRA serving undocumented in the current Modelfile reference |
+| 50 | LoRA serving via the escape hatch | EXPERIMENT | cheap (single base copy); do not foreclose |
+| 51 | Classical classifiers / deterministic kernels (experimental rungs) | ADOPT (free) | CPU-only; zero marginal cost; no topology change |
+| 52 | Retrieval (existing) | ADOPT (free) | 0.3 GB embedder; asymmetric TTL |
+| 53 | Sandboxed untrusted weights | FUTURE | isolation seam; immediate free step = safetensors/GGUF policy |
+| 54 | Second device | FUTURE | preserved by configurable gateway address only |
+| 55 | Hardware abstraction: identity by (digest, quant, context) | ADOPT | portability without re-architecture |
+| 56 | Device as a (VRAM, bandwidth) capability tuple | ADOPT | arm-3 portability spec |
+| 57 | No hardcoded model→device map | ADOPT | computed fit only |
+| 58 | Purchase decisions from portability bounds | REJECT | 16/24/48 GB recorded as BOUNDS, not requirements |
+| 59 | Current hardware dictating long-term design | REJECT | arm-4 #20 FAILS |
+| 60 | Measuring everything before acting | ADAPT | measurement pass is a prerequisite for capability claims, not for safe config defaults |
+| 61 | `nvidia-smi pmon` per-process utilisation | EXPERIMENT | untested; may close the per-process attribution gap |
+| 62 | Speculative decoding + gaming coexistence | EXPERIMENT | bounded zero-hit; E-contention |
+
+Row-derived: ADOPT 26 · ADAPT 2 · EXPERIMENT 5 · FUTURE 4 · REJECT 23 · PARK 0 · Sum 60. ★ = T1 / build-first (14).

research/memory-atlas-r1/AD-hardware-resource-placement/04_innovation.md

@@ -0,0 +1,15 @@
+# #405 AD — Innovation (no manufactured novelty; candidates derived from arm evidence)
+
+- **A. Telemetry-defined resource states (S0–S8) with named sources and detection limits.** Nearest prior art: generic infra monitoring (Prometheus/DCGM patterns); Ollama/llama.cpp expose the raw fields but no state model. Exact difference: a minimal, *Rune-scale*, single-user state set with an explicit unknown-state and per-state detection limits (including the TOCTOU caveat on free VRAM and the occupancy≠pressure rule). Evidence: PSI live (IO stall 74.6 h vs memory 41.3 s); /api/ps fields; load_duration. Threat model: false-green telemetry; 0-vs-unknown confusion. Falsifier: states do not correlate with observed degradation. Kill: a starvation event goes undetected. → **ADOPT.**
+- **B. Capability-aware residency (cheap-tenant pinned, scarce-tenant TTL, per-request pinning).** Prior art: Ollama keep_alive semantics; llama.cpp --sleep-idle-seconds. Difference: the *asymmetry rule* (pin the 0.3 GB embedder, TTL the 11 GB LLM) plus the fail-open correction (machine default must be safe because per-request policy only binds governed clients). Evidence: arm-1 V5 + arm-4 FC-1/FR-1. Falsifier: safe TTL harms latency with no VRAM benefit. Kill: user workload starved by resident models. → **ADOPT.**
+- **C. Fit-as-a-computed-predicate with a volatile-margin rule.** Prior art: llama.cpp `--fit` auto-context (1024 MiB margin) — nearest analogue, but runtime-specific. Difference: Rune computes fit from (VRAM free − desktop floor − KV(context)) with the margin treated as volatile (observed desktop drift 974→985 MiB between sessions) and refuses-to-load rather than spilling. Evidence: arm-4 #31/#36; arm-3 failure table. Falsifier: fits never fail in practice. Kill: an OOM-on-load occurs. → **ADOPT.**
+- **D. Foreground-wins as a between-request guarantee with an explicit guarantee boundary.** Prior art: systemd resource-control; CUDA priority hints. Difference: the *stated boundary* (no intra-request preemption, no hard VRAM partitioning on GeForce; MIG absent) so the policy cannot be over-promised. Evidence: arm-2 F1–F7; MIG doc check. Falsifier: user workload degrades measurably under governed inference. Kill: visible stutter. → **ADOPT.**
+- **E. Hardware/runtime truth layer (24 fields) separated from observed capability.** Prior art: OpenRouter/MCP capability patterns (#404). Difference: the split — #405 owns hardware/runtime truth, #406 owns observed task capability; 14/15 core fields obtainable today with per-field failure semantics. Evidence: live probes. Falsifier: a field proves unobtainable. Kill: registry cannot report a state policy needs. → **ADOPT.**
+- **F. Portability abstraction (identity by digest/quant/context; device as tuple; computed fit; configurable gateway address).** Prior art: generic config-as-data practice. Difference: the *bounds-not-requirements* discipline (16/24/48 GB recorded as bounds, explicitly not purchase triggers). Evidence: arm-3 §2.3. Falsifier: hardware change forces re-architecture. Kill: model→device coupling appears in config. → **ADOPT.**
+- **G. Failure-domain preservation as an explicit invariant (store device ≠ system device; /var/tmp awareness; earlyoom prefer-list).** Prior art: standard ops practice; earlyoom itself. Difference: recorded as a topology *invariant* with the observed exposure named. Evidence: live device mapping; earlyoom args. Falsifier: earlyoom kills the wrong process. Kill: core state lost in a resource event. → **ADOPT.**
+- **H. Co-residency tier rule (≤7B only) — a negative architectural statement.** Prior art: none needed (arithmetic). Difference: makes an *explicit capability ceiling* visible so RAG-with-14B is not assumed. Evidence: arm-4 FR-2 SUCCEEDS. Falsifier: 14B+embedder works under user load. Kill: OOM/eviction churn. → **ADOPT.**
+- **I. Zero-VRAM speculative drafting (ngram/lookup) as the first adaptive-compute experiment.** Prior art: llama.cpp --spec-type ngram/lookup. Difference: sequenced *after* measurement, on the escape hatch, with a kill criterion tied to complexity cost. Evidence: arm-1 V4; arm-2 docs. Falsifier: no measurable gain. Kill: gain < complexity. → **EXPERIMENT.**
+- **J. Progressive-internalisation room preserved at zero cost (explicitly enumerated: what needs nothing, what needs a config value, what needs an install).** Prior art: none needed. Difference: the *cost-accounted optionality* statement — each preserved option labelled free/config/install, so "preserve optionality" cannot become a blank cheque. Evidence: arm-3 §2.4. Falsifier: a cheaply-preservable option is blocked. Kill: a preserved option costs real resources and is never used. → **ADOPT.**
+- **K. Bounded-zero-hit register for hardware questions (4 typed gaps with search population + date).** Prior art: the Atlas's own zero-hit governance. Difference: applied to *hardware* questions (swap-pressure degradation, gaming coexistence, thermal throttling, capability re-baselining) with locally-designable experiments instead of intuition. Evidence: arms 1/3. Falsifier: —. Kill: —. → **ADOPT (process).**
+
+Row-derived: ADOPT 10 · EXPERIMENT 1 · Sum 11.

research/memory-atlas-r1/AD-hardware-resource-placement/05_adversarial.md

@@ -0,0 +1,78 @@
+# #405 AD — Adversarial Row File (arm 4: general-29, INDEPENDENT FRESH CONTEXT, 2026-09-23)
+
+Independent pass provenance: separate fresh-context actor (general-29), dispatched after arms 1–3 persisted; attacked the 12-element candidate architecture with 60 mandated attacks (keys A–Z, AA–AZ, BA–BH) + 14 Rune-specific (FR-1…FR-14) grounded in three fresh read-only probe sessions. Full evidence/consequence/correction/residual per row: 02_outward/arm4_adversarial_pass.md. Row truth: **SUCCEEDS 8 · PARTIAL 28 · FAILS 38 · Sum 74**. Seven forced corrections in the arm report §PART 5.
+
+- A. Bigger model = better — FAILS
+- B. More VRAM = intelligence — FAILS
+- C. Model fits = model is usable — PARTIAL
+- D. Local = cheaper — PARTIAL
+- E. Local = private — PARTIAL
+- F. Local = secure — PARTIAL
+- G. Owned hardware = independence — FAILS
+- H. Idle GPU = permission to infer — PARTIAL
+- I. CPU fallback = useful fallback — PARTIAL
+- J. More context = better cognition — FAILS
+- K. More loaded models = better — FAILS
+- L. One runtime should serve everything — FAILS
+- M. Q2 large beats Q4 smaller — FAILS
+- N. Q4 smaller beats Q2 larger — PARTIAL
+- O. Speculative decoding always helps — FAILS
+- P. Multi-device inference scales well — FAILS
+- Q. Benchmarks transfer directly — PARTIAL
+- R. tok/s = useful capability — FAILS
+- S. Low latency = good architecture — FAILS
+- T. Current hardware should dictate long-term design — FAILS
+- U. Future GPU upgrade solves architecture problems — FAILS
+- V. Resource starvation ≡ model absence — FAILS
+- W. Embeddings deserve permanent residency — PARTIAL
+- X. Keeping a model resident indefinitely is always efficient — FAILS
+- Y. MAX_LOADED_MODELS=1 is necessarily wrong — FAILS
+- Z. Parallelism is always beneficial — FAILS
+- AA. The Pi should run inference merely because it exists — FAILS
+- AB. Local-first is always preferable — PARTIAL
+- AC. #404's internalisation theory must shape #405's answer — FAILS
+- AD. Lack of precedent means experimental topology should be rejected — FAILS
+- AE. VRAM free reading is a reliable fit predicate (TOCTOU) — PARTIAL
+- AF. Swap occupancy indicates memory pressure — FAILS
+- AG. Power capping only costs time — PARTIAL
+- AH. NVMe load time is the dominant cold-start cost — FAILS
+- AI. Deterministic core has no hardware risk — PARTIAL
+- AJ. The 225 W cap should be raised for throughput — FAILS
+- AK. earlyoom protects Rune's core — PARTIAL
+- AL. XID events can be generically alerted — FAILS
+- AM. A probe failure means zero — FAILS
+- AN. WiFi LAN is adequate for future distributed inference — FAILS
+- AO. MIG is available on this card — FAILS
+- AP. TGI/TRT-LLM/ORT-GenAI are viable alternatives — FAILS
+- AQ. Grammar-constrained output requires a runtime migration — PARTIAL
+- AR. Speculative decoding requires a runtime migration — FAILS
+- AS. LoRA serving is available on the incumbent — FAILS
+- AT. The registry needs no runtime change — FAILS
+- AU. Context default is safe because flash-attention is on — FAILS
+- AV. KV q8_0 is lossless — FAILS
+- AW. 8k context is enough for Rune's work — PARTIAL
+- AX. 14B-Q4 is adequate for Rune's tasks (unmeasured!) — SUCCEEDS
+- AY. An unmeasured 27B default is acceptable because it is only a default — FAILS
+- AZ. Placement policy can be deferred until models are used more — FAILS
+- BA. The escape hatch can be adopted later with no cost — PARTIAL
+- BB. Telemetry can be added after the gateway — FAILS
+- BC. Storage tiers are already optimal — PARTIAL
+- BD. The system disk being 72 % full is not a risk — PARTIAL
+- BE. No backup verification is acceptable because the Pi is 'cold tier' — PARTIAL
+- BF. A single-machine topology is not a risk — PARTIAL
+- BG. Hardware research cannot be done without buying hardware — FAILS
+- BH. The experimental internalisation programme is guaranteed to succeed — FAILS
+- FR-1. `KEEP_ALIVE=-1` pins an 11 GB model against a ~5 GB desktop floor — and the architecture's fix (per- — SUCCEEDS
+- FR-2. MAX_LOADED_MODELS=1 blocks the #404 embedder+LLM design; the proposed 1→2 is arithmetic-viable only  — SUCCEEDS
+- FR-3. The LAN is wireless (wlan0, 192.168.1.x) — the architecture rejects tensor-parallel over it (correct — PARTIAL
+- FR-4. The Pi cold-backup tier is **unreachable right now** (192.168.0.84 vs host 192.168.1.x subnet mismat — SUCCEEDS
+- FR-5. zram at ~22 GiB occupied with **IO stall dominating history** (io some 74.7 h, full ≈ some — PV-2):  — PARTIAL
+- FR-6. System disk 72 % full with `/var/tmp` on it — the architecture "keeps the exposure in view" (T1 item — PARTIAL
+- FR-7. earlyoom does not exclude Ollama — and also does not protect kwin — so the architecture's "LLM runne — SUCCEEDS
+- FR-8. Two duplicate 27B IQ2_M models consume **23.99 GB disk** (11.39 + 12.60, PV-4) on the 69 %-full fast — PARTIAL
+- FR-9. nomic ctx 2048 silently truncating + no context override — the architecture's "context as explicit p — SUCCEEDS
+- FR-10. 8 GPU processes contending + power cap 225 W of 285 W rated / 366 W max — the architecture leaves th — PARTIAL
+- FR-11. **Zero measured task capability for any local model + no benchmark harness** — the architecture's de — SUCCEEDS
+- FR-12. The "152 modules / 436 MB" deterministic-core claim is unreproducible (arm-3 found 213 .py, 220 KB s — PARTIAL
+- FR-13. The designated escape hatch is **not installed** (PV-6) — T1's "config-level only, reversible" claim — PARTIAL
+- FR-14. "Unload-on-handoff" has **no trigger mechanism**: the architecture specifies the effect (empty-promp — SUCCEEDS

research/memory-atlas-r1/AD-hardware-resource-placement/06_synthesis.md

@@ -0,0 +1,132 @@
+# #405 AD — Synthesis Matrices (rows are truth)
+
+## A. Hardware state (observed)
+| Resource | Value | Note |
+|---|---|---|
+| CPU | Ryzen 9 5950X, 16c/32t, ≤5.09 GHz | CPU decode 11 t/s (7B q4_0, measured on this CPU class) |
+| GPU | RTX 4070 Ti SUPER, 16,376 MiB | rated TGP 285 W; enforced limit 225 W |
+| VRAM free at audit | 11.3 GB (10.85 GB later session) | desktop floor ~4.7 GB, volatile |
+| RAM | 62 GB (30 used) | zram 31.4 GiB, ~23 GiB occupied |
+| Pressure | PSI live: IO stall 74.6 h ≫ memory 41.3 s | IO dominates; occupancy ≠ pressure |
+| Storage | store 436 MB on nvme1 (distinct); `/`, `/mnt/fast-storage`, `/var/tmp` on nvme2n1 (72% full) | failure-domain split is real |
+| LAN nodes | host only; Pi unreachable | wireless 192.168.1.156/24 |
+
+## B. Workload → execution-resource placement
+| Workload | Placement | Rationale |
+|---|---|---|
+| frontier inference | provider API | #404 escalation only |
+| local general inference (14B) | GPU, 8k context, TTL residency | bandwidth-bound; fits tight |
+| local small inference (≤7B) | GPU (CPU fallback viable) | 11 t/s CPU floor measured |
+| embeddings | GPU, pinned, 0.3 GB | cheap tenant; asymmetric residency |
+| retrieval | CPU + NVMe | 436 MB store |
+| deterministic modules | CPU only | no GPU dependency |
+| classifier inference (experimental) | CPU | free |
+| maintenance/background | CPU, event-driven | no timer-triggered inference |
+| foreground chat/task | GPU (serialised via NUM_PARALLEL=1) | foreground wins between requests |
+
+## C. Model/resource fit
+| Class | Precision | Weights | KV @8k | Fit on 16 GB | Status |
+|---|---|---|---|---|---|
+| 27B IQ2_M | ~2–2.5 bpw | ~11–12 GB | 8k ≈ 2.5–3 GB (family-dependent) | marginal-to-fail with desktop floor | UNMEASURED (E-27B) |
+| 14B-Q4 | W4A16 | ~9.7–10.0 GB | 80–96 KiB/tok ⇒ 0.6–0.8 GB | fits 8k tight; fails 32k | provisional default |
+| 7B/3B | Q4 | 4.7/1.9 GB | small | comfortable; co-residency viable | usable |
+| embedders | F16 | 0.3–0.8 GB | n/a | trivial | pinned |
+| 24 GB (future) | — | — | 14B@32k or 32B-Q4@8k | context stops binding | BOUND, not requirement |
+| 48 GB (future) | — | — | 70B-Q4 tier | tier change only | BOUND, not requirement |
+
+## D. Serving architecture
+| Runtime | Grammar | Spec-decode | Context override | Concurrency | Residency control | Metrics | Verdict |
+|---|---|---|---|---|---|---|---|
+| Ollama (incumbent) | ✗ | ✗ | per-model Modelfile; per-request keep_alive | serialised (NP=1) | keep_alive (per-request overrides env) | /api/ps + load_duration | **incumbent** |
+| llama.cpp llama-server | ✓ GBNF | ✓ draft/eagle3/mtp/ngram | ✓ per-request | configurable | --sleep-idle-seconds | /metrics + /health | **escape hatch (NOT INSTALLED)** |
+| vLLM | ✓ | ✓ | ✓ | continuous batching | configurable | /metrics | REJECT (single user) |
+| TGI | — | — | — | — | — | — | REJECT (maintenance mode) |
+| TensorRT-LLM | — | — | — | — | — | — | REJECT (no GGUF; tier mismatch) |
+| ORT-GenAI | — | roadmap only | — | — | — | — | REJECT (unassessed, excluded) |
+
+## E. Degradation / resource states
+| State | Signal | Telemetry | Detection limit |
+|---|---|---|---|
+| S0 NOMINAL | all clear | composite | — |
+| S1 GPU-VRAM pressured | free VRAM < requirement+KV+margin | nvidia-smi memory.free (1 s) | TOCTOU; no per-process cap |
+| S2 context headroom | context_length vs request | /api/ps | Ollama exposes no live KV usage |
+| S3 CPU pressured | PSI cpu some | /proc/pressure/cpu | `full` undefined system-wide |
+| S4 memory pressured | PSI memory some+full delta | /proc/pressure/memory | occupancy ≠ pressure |
+| S5 throughput degraded | eval_count ÷ eval_duration | per-request only | no ambient measurement |
+| S6 churn | load_duration; expires_at | per-request | load observable only when triggered |
+| S7 foreground contended | GPU util with no Rune process | nvidia-smi | no isolation exists |
+| S8 unavailable/unknown | probe failure | composite | **never report 0** |
+| XID event | kernel log | nvidia-smi -q | must be bucketed (45 = benign Ctrl-C) |
+
+## F. Foreground-wins
+| Knob | Layer | Guarantee | Limit |
+|---|---|---|---|
+| per-request keep_alive=0 | API | unload after use | governed clients only |
+| safe env default (TTL) | service | bounds residency for ALL clients | reload latency cost |
+| --sleep-idle-seconds | escape hatch | idle unload | not installed |
+| systemd CPUWeight/IOWeight/MemorySwapMax | OS | CPU/IO/swap pressure limits | currently unset |
+| NUM_PARALLEL=1 | runtime | serialisation = no self-contention | throughput cap |
+| GPU priority hints | driver | scheduling preference | **no intra-request preemption** |
+| MIG | hardware | hard partitioning | **unavailable on this card** |
+
+## G. Registry hardware/runtime fields (24; #406 owns observed capability)
+| Field | Source | Today | Cadence | Failure semantics |
+|---|---|---|---|---|
+| model identity/digest | /api/ps | ✓ | per call | unknown |
+| quantization | /api/ps details | ✓ | per load | unknown |
+| runtime | config | ✓ | static | — |
+| device | config | ✓ | static | — |
+| VRAM requirement | computed | derived | per model | unknown |
+| context limit | /api/ps context_length | ✓ | per call | unknown |
+| context headroom | computed | derived | per request | unknown |
+| measured tok/s | eval_count÷eval_duration | derived | per request | not measured |
+| latency | total_duration | ✓ | per request | unknown |
+| load time | load_duration | ✓ | per load | not loaded |
+| residency | /api/ps expires_at | ✓ | per call | unknown |
+| health | /api/tags reachability | ✓ | probe | down |
+| resource-starved | computed (S1/S2/S4) | derived | 1–5 s | unknown |
+| concurrency | NUM_PARALLEL config | ✓ | static | — |
+| queue depth | llama.cpp /metrics only | ✗ on incumbent | — | unknown |
+| preemption state | vLLM only | ✗ | — | unknown |
+| …remaining fields | (see arm-3 §2.5) | mixed | — | unknown |
+
+## H. Failure / fallback
+| Event | Detection | Blast radius | Recovery | Core survives |
+|---|---|---|---|---|
+| GPU OOM on load | load error | that model | fit-or-don't-load | YES |
+| GPU XID (bucket-dependent) | kernel log | GPU app | RESTART_APP / RESET_GPU / RESTART_BM | YES |
+| Ollama crash | probe failure | local inference | restart service | YES |
+| Model digest mismatch | load error | that model | re-pull | YES |
+| Disk full (/var/tmp) | df | temp writes | free space / gate | YES |
+| RAM exhaustion | PSI / earlyoom | largest RSS (LLM runner) | earlyoom kill | YES (emergent — needs --prefer) |
+| Power/thermal | nvidia-smi | throughput | cap already applied | YES |
+| Pi/LAN loss | ping | backup tier | drill/verify | YES |
+| All models unavailable | probes | inference only | deterministic layer | YES |
+
+## I. Present vs future
+| Item | Disposition |
+|---|---|
+| Safe residency default + per-request pinning | T1 (config) |
+| Context as explicit parameter | T1 (config) |
+| Starvation state model + unknown≠0 | T1 (policy) |
+| earlyoom --prefer; disk-free gate; restore drill + verified flag | T1 (config/ops) |
+| 14B-Q4@8k provisional default | T1 (config, provisional) |
+| Measurement pass (tok/s, load, task) | T1 (prerequisite) |
+| 27B-vs-14B measurement | EXPERIMENT |
+| Co-residency 7B+3B | EXPERIMENT |
+| Speculative decoding (ngram first) | EXPERIMENT (needs escape hatch) |
+| LoRA serving | EXPERIMENT (escape hatch) |
+| PSI-driven shedding | REJECT (no queue) |
+| Multi-node / Pi inference | REJECT (now) |
+| Sandboxing; second device; 24/48 GB tiers | FUTURE (bounds) |
+| MIG/MPS/DCGM/vLLM/TGI/TRT/ORT | NOT NEEDED |
+
+## J. Cross-domain ownership
+| Concern | Owner |
+|---|---|
+| hardware topology, placement, serving, residency, resource states | **#405** |
+| degradation ladder (cognitive), model-as-resource, internalisation research | #404 |
+| observed task capability, Growth Delta, final evaluation | **#406** |
+| untrusted-model isolation policy, supply chain | #402 |
+| retrieval core | #383 |
+| implementation of any T1 config change | later implementation work (not this domain) |

research/memory-atlas-r1/AD-hardware-resource-placement/07_qualification.md

@@ -0,0 +1,39 @@
+# #405 AD — Qualification (33 mandate questions)
+
+| Q | Question | Verdict | Answer |
+|---|---|---|---|
+| Q1 | What does Rune's actual hardware support reliably? | ADOPT | 16 GB: 14B-Q4 at 8k (tight); ≤7B comfortably; embedders trivially. 32k with 14B exceeds free VRAM (C002/C004). |
+| Q2 | What does it not support? | ADOPT | 27B at any usable context alongside desktop apps; 14B at 32k; multi-model 14B co-residency (C004/C007). |
+| Q3 | What remains unmeasured? | EXPERIMENT | Every local model's task capability, tok/s on Rune workloads, load times, 27B-vs-14B (E-measurement, E-27B). |
+| Q4 | What future hardware changes would materially alter the architecture? | FUTURE | 24 GB (context stops binding) / 48 GB (70B tier) — recorded as BOUNDS, not purchase requirements (C013). |
+| Q5 | What must stay abstracted for portability? | ADOPT | Identity (digest, quant, context); device as (VRAM, bandwidth); computed fit; configurable gateway address; no model→device map (C013). |
+| Q6 | How is resource starvation represented? | ADOPT | Typed states S0–S8 with named telemetry, gate signals S1/S2/S4/S6/S8/XID, per-state detection limits, unknown≠0 (C005). |
+| Q7 | What does foreground-wins mean concretely? | ADOPT | Between-request priority only: safe env default, per-request keep_alive, idle unload, systemd controls; no intra-request preemption, no MIG on this card (C006). |
+| Q8 | Is KEEP_ALIVE=-1 correct? | REJECT | As an unbounded machine default it fails open for ungoverned clients and pins 11 GB forever; correct form = safe default + per-request pinning (C003). |
+| Q9 | Is MAX_LOADED_MODELS=1 wrong? | ADAPT | Not per se — but it blocks the #404 embedder+LLM design. 1→2 is justified only at ≤7B+≤3B (C004). |
+| Q10 | Is NUM_PARALLEL=1 wrong? | REJECT | It is a foreground-wins property for a single user; the defect is the model cap, not the parallelism cap (C006). |
+| Q11 | Should the 27B IQ2_M be the default? | REJECT | Unmeasured, below the studied quantisation floor, no latency advantage at equal bytes/token (C007). |
+| Q12 | Should the 27B IQ2_M be removed? | EXPERIMENT | No — measure first (vision/tools/thinking capability is a real differentiator); E-27B decides (C007). |
+| Q13 | What is the correct default model? | ADOPT | 14B-Q4 at 8k, explicitly provisional pending measurement (C007). |
+| Q14 | Is 4-bit the safe floor? | ADAPT | It is the evidence-backed conservative STARTING POINT in the studied reasoning evidence — not a universal guarantee (supervisory correction 2). |
+| Q15 | Is CPU fallback practical? | ADOPT | ≤7B only: 11 t/s measured on this CPU class; 14B/27B CPU is REJECTED (C001). |
+| Q16 | Is partial layer offload a capacity extender? | REJECT | 4–25× paging penalty; FlexGen ~1 t/s floor (no-spill evidence). |
+| Q17 | Is speculative decoding worth it? | EXPERIMENT | Blocked on the incumbent; ngram-first on the escape hatch, after measurement (C009). |
+| Q18 | Should Rune migrate serving runtimes? | ADAPT | Not now: Ollama stays incumbent; the escape hatch is installed only if a capability requires it (C008). |
+| Q19 | Is vLLM/TGI/TensorRT-LLM/ORT-GenAI viable? | REJECT | Single user; maintenance mode; no GGUF; unassessed — each on audited evidence. |
+| Q20 | Is MIG available? | REJECT | AD103 absent from NVIDIA's supported list for this card. |
+| Q21 | Is multi-node inference viable? | REJECT | LAN 125–1250 MB/s; Petals ~1 t/s; WiFi bufferbloat; one inference node exists (C010). |
+| Q22 | Should the Pi run inference? | REJECT | 2.13–3.04 t/s best case; no capacity (C010). |
+| Q23 | What is the Pi's correct role? | ADAPT | Cold backup — currently fictional: needs reachability, a restore drill, and a verified flag (C011). |
+| Q24 | What survives a hardware failure? | ADOPT | The deterministic core survives every failure row; fit-or-don't-load for GPU OOM; core survival is emergent today and must be made deliberate (C012). |
+| Q25 | Is the storage layout correct? | ADAPT | Models and store are well placed; the family's 'SSD warm tier' does not exist as a device; /var/tmp sits on the 72%-full device (R0-1/C012). |
+| Q26 | Should the power cap change? | REJECT | 225 W is the measured operating regime (125 GPU-h capping, 0 thermal slowdown); capping buys −23% energy for +6.7% time (C014). |
+| Q27 | What telemetry exists today? | ADOPT | PSI (live), nvidia-smi, /api/ps, load_duration, /proc/meminfo — 14/15 core registry fields obtainable now (C015). |
+| Q28 | What registry fields need a runtime change? | ADAPT | Queue depth and preemption state (llama.cpp /metrics or vLLM); starvation is derivable locally (C015). |
+| Q29 | Which fields belong to #406? | ADOPT | Observed task capability, task-class adequacy, Growth Delta — explicitly excluded from this domain (C015). |
+| Q30 | Does the topology preserve the internalisation experiment? | ADOPT | Yes, at zero cost for classifiers/kernels/retrieval; config value for 7B+3B; install for LoRA; FUTURE for sandbox/second device (C016). |
+| Q31 | Does #405 prove the offline-intelligence theory? | REJECT | No — #405 establishes hardware/runtime truth and placement; the theory remains EXPERIMENT (#404 disposition) and #406 owns evaluation. |
+| Q32 | What is the T1 minimum? | ADOPT | Config-level, reversible: safe residency default, explicit context, state model with unknown≠0, earlyoom --prefer, disk-free gate, restore drill, provisional 14B default, measurement pass (matrix I). |
+| Q33 | What is the biggest single risk in the current state? | ADOPT | Ungoverned defaults acting as architecture: KEEP_ALIVE=-1 + MAX_LOADED_MODELS=1 + no context override, on a system with zero measured task capability (C003/C004/C007). |
+
+Row-derived: ADOPT 13 · ADAPT 6 · EXPERIMENT 3 · FUTURE 1 · REJECT 10 · PARK 0 · Sum 33.