mini-loop

A compact, inspectable coding-agent harness. The existing FastAPI implementation lives in python/; an independent Go implementation lives in go/. See the port plan and parity matrix.

mini-loop starts with the s01 agent loop from learn-claude-code and adds the runtime boundaries a real multi-session service needs: workspace-scoped tools, session isolation, permissions, context management, event streaming, observability, and optional durability. The default path stays narrow; production protections and experimental orchestration remain explicit choices.

Read this in layers

If you want to…	Start here
See what the project is	30-second overview
Run it locally	Quick start
Run the independent Deep Agents server	Deep Agents server module
Run the opt-in Temporal Task HTTP server	Task server
Inspect the optional Temporal experiment	Temporal fault prototype
Understand one request	How one turn works
Decide what to enable	Runtime posture
Integrate over HTTP or Python	Use the runtime
Build a domain-specific agent	Extend the harness
Review the full system	Architecture
Find detailed design evidence	Documentation map

30-second overview

Caller
  └─ SessionManager
       └─ isolated AgentSession (workspace + history + lock)
            ├─ async model ↔ tool loop
            ├─ guarded tool execution
            └─ SSE events + trajectories + optional durable state

• One session, one isolated agent. History, todos, workspace, runtime state, and the run lock are never module-global.
• Many sessions, one concurrent service. Sessions make progress in parallel; a single conversation remains serial and ordered.
• One small default, many injectable seams. Tools, hooks, prompts, compaction, model providers, storage, sandboxing, secrets, skills, and event sinks are construction-time choices.
• Evidence is part of the runtime. REST/SSE status, trajectories, action records, audit posture, and optional SQLite state make behavior inspectable.
• An independent Deep Agents server is opt-in. deepagents-server/ serves a Deep Agents graph through the standard LangGraph Agent Server in its own environment; the Python and Go runtime defaults remain separate.
• Capability does not imply enablement. Default-on, default-off, process-local, library-only, and durable paths are labeled separately below.

Quick start

The deterministic fake model exercises the server without an API key or network call:

python -m venv .venv
source .venv/bin/activate
pip install -r python/requirements.txt
MINILOOP_FAKE_LLM=1 MINILOOP_FAKE_DELAY=0.3 PYTHONPATH=python python -m mini_loop

Open http://127.0.0.1:8000 in two tabs to watch isolated agents run in parallel. The browser console shows live events and recorded trajectories; the generated OpenAPI reference is at http://127.0.0.1:8000/docs.

The conversation workspace is at http://127.0.0.1:8000/ui: a searchable session sidebar, a command palette, configurable shortcuts, visited-session navigation, light/dark themes, expandable tool records, and a session-tools panel for tasks, team, trajectories, transcript, cron, skills, memory, improvements, and the fake benchmark. It uses the same REST/SSE and approval boundaries as the classic console. See Web UI design and verification.

For a real Anthropic-compatible provider:

cp python/.env.example .env # set ANTHROPIC_API_KEY, MODEL_ID, and optional base URL
PYTHONPATH=python python -m mini_loop

How one turn works

1. A Python caller or HTTP principal (anonymous on the default loopback server) creates or restores a session.
2. SessionManager binds the workspace, owner, runtime policy, model client, and optional resources before constructing the Agent.
3. AgentSession serializes that conversation and stamps the request with an immutable RunContext.
4. Agent._loop builds a bounded model request from the pinned tool catalogue, skills, memory, compaction state, and runtime facts.
5. Tool calls pass through hooks, monotonic guards, permission/approval, the action journal, execution, masking, and result observers before returning to the model.
6. The session emits correlated lifecycle events and records the transcript, trajectory, and configured durable state.

Concurrency is bounded at two levels. MINILOOP_MAX_CONCURRENT_LLM limits model calls across sessions (default 8), while MINILOOP_MAX_CONCURRENT_TOOLS limits parallel_safe tools (default 8). Parallel tool results return in the model's original call order. Shell and mutation tools remain ordering barriers.

Runtime posture

The table is the fastest way to distinguish “implemented” from “active here.”

Capability	Default posture	How it changes
Async agent loop, workspace tools, session isolation, REST/SSE console	On	Core runtime
Prompt caching and stuck detection	On	Replace or disable through injected policies
Local trajectory recording	On	MINILOOP_TRAJECTORIES=0 disables it
Comprehensive s09–s20 feature bundle	Off	MINILOOP_FEATURES=all or enable_features=True
HTTP authentication	Off on loopback	Configure MINILOOP_API_TOKEN or MINILOOP_API_TOKENS; non-loopback startup without tokens is refused
Sandbox, secret registry, SQLite state	Null boundaries	Inject/configure the protection needed by the deployment
Owner-scoped skills, memory, and personal-skill publication	Off	Configure MINILOOP_USER_RESOURCES_ROOT and authenticated owners
Token-efficiency pipeline and semantic code tools	Off	Explicit shadow/enforce and pinned ast-outline settings
Guardian approval reviewer	Off	MINILOOP_GUARDIAN=1; it may approve, deny, or defer, never widen authority
Typed decisions: choice, score, and noul	Off, including the full feature bundle	MINILOOP_DECISIONS=llm|jev or explicit install_decisions(); judgments return data through the existing tool boundary
Declarative workflow MVP	Off, process-local	Trusted Python construction with enable_workflows=True
Verified execute → verify → fold loop	Library-only	Call VerifiedLoopService explicitly; no HTTP/tool surface
Independent Deep Agents server	Opt-in, separate module	deepagents-server/: bearer-authenticated standard Agent Server; async Run handles; API/Worker separation; production PostgreSQL/Redis recovery acceptance and licensing remain explicit
Temporal Task HTTP server	Opt-in, separate service	Task server: confirmed remote Start; retention-bounded idempotency and History events; independent Workflow Worker; production HA/capacity acceptance remains open
Temporal fault prototype	Default-off, experimental	Independent Temporal Worker: local SQLite History and application ledger; offline model fixture; standard Agent Server profile unchanged

Reference curriculum mapping (learn-claude-code s01–s20)

This is module coverage, not a claim that every module is enabled or that the default server is production-ready.

	Mechanism		Mechanism
s01	agent loop	s11	error recovery
s02	bash/read/write/edit/glob	s12	task system
s03	permissions	s13	background tasks
s04	lifecycle hooks	s14	durable cron
s05	TodoWrite	s15–17	teams, protocols, autonomy
s06	subagents	s18	task-bound worktrees
s07	agent and owner-scoped skills	s19	MCP
s08	four-layer compaction	s20	comprehensive registry
s09	memory lifecycle	s10	per-call runtime prompt

MINILOOP_FAKE_LLM=1 MINILOOP_FEATURES=all PYTHONPATH=python python -m mini_loop

Before exposing the server

The default is a development harness, not a host-level multi-tenant sandbox. Before binding beyond loopback:

1. Configure token authentication. PYTHONPATH=python python -m mini_loop refuses an open bind without it.
2. Run PYTHONPATH=python python -m mini_loop.audit locally, or PYTHONPATH=python python -m mini_loop.audit --url http://host:port against the live server.
3. Choose explicit sandbox, secret-masking, persistence, and retention policy for the trust level of the callers.
4. Add OS/container isolation and resource limits when prompts or tools are untrusted; workspace path checks alone are not that boundary.

The audit exits non-zero for high or critical findings. See the extension guide for the concrete Sandbox, SecretRegistry, StateStore, and authentication seams, and hardening notes for the evidence behind them.

Use the runtime

REST and SSE

The OpenAPI page at /docs is the complete route reference. The common route families are:

Purpose	Route
Health and runtime posture	GET /healthz
Create or list sessions	POST /sessions, GET /sessions
Inspect or delete one session	GET /sessions/{id}, DELETE /sessions/{id}
Run a turn	POST /sessions/{id}/messages
Run with live events	POST /sessions/{id}/messages/stream
Steer, fork, cancel, or change mode	POST /sessions/{id}/steer, /fork, /cancel, /mode
Inspect transcript, approvals, or events	GET /sessions/{id}/transcript, /approvals, /events
Inspect or export trajectories	GET /sessions/{id}/trajectories, GET /trajectories/...
Preview and publish a personal skill	POST /sessions/{id}/personal-skills/preview, /personal-skills/{draft_id}/commit

SID=$(curl -s -XPOST localhost:8000/sessions \
  -H content-type:application/json -d '{}' | jq -r .id)

curl -sN -XPOST localhost:8000/sessions/$SID/messages/stream \
  -H content-type:application/json \
  -d '{"message":"write fib.py, run it, and explain the result"}'

Every event carries seq, ts, session, and type; agent events also carry lineage and turn correlation. Last-Event-ID supports reconnection. assistant_text.phase is authoritative: commentary means the turn continues, while final_answer means the agent is returning. The terminal done event is always final_answer. See Agent trajectories for the recording, viewer, export, privacy, and retention model.

Personal-skill publication additionally requires token authentication and an owner-resource root. Preview is a bounded, masked, short-lived draft; commit accepts its digest, never overwrites an existing skill, and activates only in a future independently resolved session. The full contract and examples live in Skills and user-scoped knowledge.

Python composition

Use the same runtime without the default server, or inject only the seams your application owns:

import asyncio

from mini_loop import SessionManager, build_client, default_registry, load_settings

async def main():
    settings = load_settings()
    manager = SessionManager(
        settings,
        build_client(settings),
        tool_registry=default_registry(),
    )
    try:
        session = manager.create(owner="local-user")
        answer = await session.run(
            "inspect this repository and summarize its entry points"
        )
        print(answer)
    finally:
        await manager.stop()

asyncio.run(main())

See examples/custom_agent.py for a composed domain agent and EXTENDING.md for every injectable interface.

Extend the harness

The loop itself does not need to change when the surrounding business logic does:

Need	Primary seam
Add or restrict capabilities	ToolRegistry, ToolCatalogSnapshot, RoleToolPolicy
Enforce policy or observe lifecycle	Hooks, permission/approval, result observers
Change model-visible context	system_builder, Compactor, skills, memory, token-efficiency stages
Change provider behavior	ModelProvider, client, transport, recovery
Add durability or evidence	StateStore, action journal, trajectory store, event_sink
Isolate tenants and credentials	Authenticator, workspace_factory, Sandbox, SecretRegistry
Compose the whole policy set	Harness

The extension guide contains the contracts, runnable examples, concurrency rules, and failure boundaries. Experimental orchestration is kept separate:

• Verified loop design documents the explicit, library-only execute → verify → fold coordinator and the opt-in Guardian.
• Dynamic workflow research and implementation boundary documents the default-off, read-only, process-local workflow MVP. It is not Claude Code workflow-script compatibility and is not restart-safe.

Architecture

The layered architecture base image summarizes the canonical map below. Each iteration edits this base image to highlight its changes; added or removed architecture parts also update the base. The image's right column records deployment and authority boundaries. The current Task server architecture shows the independent Agent Server layers and this iteration's Python module boundaries. The source reading guide maps HTTP handling, task orchestration, Temporal access and acceptance tooling. The Go runtime assembly includes an explicitly marked external CPython parser; that process is a selected dependency and does not represent a native Go grammar.

Go custom tools can explicitly bind a concrete ExtensionInput, ExtensionInputCodec[T] and ExtensionToolHandler[T] with NewTypedExtensionTool. The existing gate runs before/guard/permission and journal admission before decoding or validation. Provider input stays an inert, immutable observation in transcripts and action identity; the named application payload exists only at execution. Schema-only registrations retain their missing decoder refusal. No custom tool is installed by default. Model MCP inputs retain closed root observations until the whole tool batch is prepared as Source dict(input or {}). Falsey roots become empty objects; pair arrays become named ordered mappings, and invalid truthy roots fail before any batch effect. Original model history stays unchanged. Explicit caller MCP inputs and callable handler arguments remain object-only. Fifty-two actual Source auto/readonly/root/batch profiles compare failures, hooks, prepared client arguments, outputs and external-risk refusal; a readOnlyHint grants no trust. Direct/SSE and history/masked clones retain originals, including through native SQLite reopen and explicit owner restore. Non-string scalar keys remain inert until keyword binding after permission; unhashable keys fail preparation. Sorted query faults retain Source stage even without an active reducer.116 direct and116 actual journal profiles compare these stages, hashes, history and earlier effects; broader nonfinite-object/ NaN-identity/transport profiles remain separate acceptance. Tool callbacks receive a fixed ToolAuthority.Scope with the current Session label/depth. Session dispatch stamps this informational lineage; it cannot grant capabilities, select an owner or bypass role/depth policy. Eighteen actual Source child role/capability/risk profiles compare complete selected schemas, fresh requests, fixed scope, peer context and results. Custom codecs/handlers survive role selection; filtered tools remain unavailable, Explore still refuses writes, and human approvals do not enter peer context. Custom schema metadata can use protocol.ExtensionToolSchema to retain all finite JSON fields, including refs, numeric enums and fractional bounds. This immutable observation does not resolve refs or validate arguments. Thirty-two actual managed Source owner sessions compare schema snapshots, fingerprints, model requests and typed effects across16 shapes; non-object schema preservation does not imply model-server acceptance. Native SQLite close/reopen retains catalogue events and explicit restoration rebinds the operator catalogue under current interactive permission, with foreign-owner refusal. Source readonly-write refusal happens in its default before hook; the native gate retains guard-before- permission ordering. This timing difference remains explicit.

Memory side-model replies are parsed completely into closed JSON variants before any write. Nonfinite numbers and ignored extras remain inert observations; owner-scoped extraction consumes at most five items and retains earlier writes if a later item fails. Consolidation skips non-object entries; UTF-8 write failures preserve earlier replacement writes after owner-scoped deletion. No reply field can select an owner, origin or path. Name/description use Python str before header normalization; non-text types fall back to project. Consolidation checks original identity fields before conversion: arrays/objects fail before deletion and other non-text values cannot inherit stored string identities. Named memory.Body observations now preserve original container length and defer body faults to the store write phase. Truncation diagnostics precede container failure or text masking/UTF-8 encoding. This retains earlier writes after scoped replacement without retaining JSON payloads. Model entries with missing bodies also select this observation lane. Invalid fallback names fail before body consumption. Other headers reach masking before authenticated original-name hashing and final UTF-8 encoding; masking can repair content without changing the identity used for a filename. Anonymous and authenticated owners are checked separately. Ordinary masker panics are contained at the corresponding side-query boundary, so extraction faults can still proceed to consolidation. Consolidation's initial List remains outside its handler. Partial writes and lifecycle-lock release are preserved; cancellation and native lease/persistence failures still propagate. Named caller profiles now preflight the full selected reply before writes or owner-scoped replacement. The fixed default Source paths admit 979 total containers for direct side operations, 974 for Agent.run/SSE capture and 970 for synchronous HTTP POST capture. The trusted HTTP constructor selects an ephemeral parsing profile; snapshots and peer delegation carry no such selector. Ignored and post-five fields participate in admission; large finite text/width controls remain accepted. Sixty-four real authenticated POST/SSE routes compare wire finals/events, owner and foreign records, lifecycle state and model budgets. Other host/caller stacks, custom recursion settings, resource exhaustion, broader side effects and full memory acceptance remain open.

Go built-in feature catalogues publish tools in Python registry order, including independently selected decisions, workflows and AST additions. Caller-supplied catalogues keep their order; capability filtering retains the selected subsequence. ManagerConfig.EnableFeatures selects all 48 Source tools using the fixed CPython 3.11.3 diagnostics backend unless a provider is explicitly supplied. Custom catalogues retain their inventory; full-profile lifecycle binding still supports default background/team notices. Independently selected workflow/AST/decision additions retain Source order. The full MINILOOP_FEATURES is accepted by the launcher and CLI when the fixed interpreter is available, or by embedding callers that supply a diagnostics provider. A missing or wrong-version default interpreter fails before resource construction. Explicit injector lists (including empty lists) replace default background/team injection; nil retains selected lifecycle defaults. Workflow and core control injection remain appended, and child copies preserve this selection. Go /healthz.features reports deployment EnableFeatures, including caller-backed full startup; selecting independent optional groups does not change that flag. Go /healthz.posture observes live/default runtime components, persisted write faults and credential coverage counts without creating a session. Native component labels may differ from Python; the null-store marker remains NullStateStore for Source remote audit. Shell metadata reports an injected sandbox or explicit None; unobservable custom executors/factories fail observation. The opt-in Go sandbox package implements Seatbelt policies, credential-protecting platform selection and workspace rebinding through shell.Config.Sandbox. Actual macOS tests verify protected reads/copies, confined writes, denied/allowed local network access and linked-worktree commits without sibling working-file access. Host execution remains the default; Seatbelt provides no resource caps. ManagerServices.Sandbox binds the default factory directly, including fresh sessions and later workspace switches. Configuring it with a custom BashFactory is rejected before allocation; custom factories own their sandbox boundary. Empty-fleet posture reads template metadata without binding or executing it. Actual managed turns and pinned children retain read/write restrictions and explicit extra roots across a parent workspace switch. Launcher.Options.Sandbox binds the same backend through its timeout-preserving factory. SDK inspection reports the selected type and an optional detached reason; real HTTP health and model-tool turns observe this selection. No CLI flag or implicit confinement is added. Native SQLite close/reopen tests also verify restored HTTP sessions bind the current caller sandbox policy: the old extra writable root is revoked, the new one is usable, protected reads remain denied and the original workspace/history is retained. Restoration stays an explicit operator action. The standalone Go audit library consumes a typed health report and returns Source-compatible sorted findings and text. Its JSON boundary rejects ambiguous known-field types, preserves absent/null/empty distinctions and ignores future fields. audit.Fetch and go/cmd/miniloop-audit --url read public /healthz with a ten-second deadline and a 1 MiB response cap. The command prints build/pid and findings, returning 1 for high/critical findings and 0 otherwise. Without --url, the command constructs and audits a local deployment; health does not automatically audit. Findings reflect reported metadata, not an independent proof of confinement or persistence. Run from go/: go run ./cmd/miniloop-audit --url http://localhost:8000.

audit.Settings separately audits selected configuration, authentication/bind, current workspace write permissions and trajectory content selection. It preserves Source check order, follows symlink targets and observes missing/cyclic roots without creating them. Nil environment reads the process; an explicit empty map is empty. Invalid authentication and unexpected stat faults return errors. The library does not construct runtime services or imply live-manager auditing. audit.ComposeLive combines those configuration findings with concrete tool, secret-cache, persistence and problem-ledger observations to implement the full Source finding logic. It preserves shell-sensitive severities, exact log counts and final severity/check sorting. The SDK audit.Manager now combines configuration checks with SessionManager.ObserveDeploymentAudit: manager/template tools, sandbox metadata, cached secret reports, persistence faults, manager-held diagnostics and merged MCP records from all published sessions. Snapshots detach mutable fields and callbacks run outside manager locks. Observation creates no session, reads no historical recording and resolves no credential values. This privileged fleet API requires a trusted local caller; it is not owner admission. Per-session task/gate/owner diagnostics retain their existing self-audit path. No health/model-tool path calls this API.

launcher.AuditDeployment shares native resource construction with the server, audits the empty local fleet and stops its owned manager/transport before returning. It opens no listener, restores no session and invokes no model/tool. Injected stores and diagnostic providers retain caller ownership. The no-URL command captures environment once, loads selected settings, prints exact Source findings and returns 1 for high/critical findings or operational faults. Like Source, non-URL arguments select local mode and PORT is ignored. Source's local entry point does not activate the workflow environment setting; explicit SDK workflow options remain available. Construction may create workspace/shared-resource roots; serving still refuses unauthenticated public binds, while local audit reports that configuration. From go/: go run ./cmd/miniloop-audit. Full CLI features use the fixed CPython backend and verify it before construction. Native providers now allow an absent API key during construction/inspection, report <absent> and refuse model requests before HTTP or retries. Non-streaming token-ceiling checks retain Source priority over missing authentication. The missing-credential failure carries typed TypeError identity through existing recovery and error-result projection. Supplied keys retain header/size admission; Launcher now discovers SDK profiles, OAuth and federation through named settings.

The Go dotenv library parses scalar UTF-8 text, resolves variables and returns a detached environment map, preserving Source spans/lines, nullable values, syntax recovery, duplicate order and partial application faults. Find/Walk now search logical ancestors using an explicit caller-frame/cwd context; interactive/debugger/frozen selection follows Source. Values/LoadFile read regular files, followed symlinks or FIFOs, with fallback text, strict UTF-8, universal newlines and optional UTF-8-signature/Latin-1 decoding. Loading checks the disabled flag before discovery/read, and decode faults change no environment. These are privileged local SDK filesystem reads; no tool gate or remote route calls them. No function changes process environment or cwd. Missing caller origin is refused rather than guessed from compiled Go source paths. Pure SDK inspection continues to report DotEnvDiscovery=false; executable entry points now perform the startup preparation described below.

config.PrepareEnvironment now composes dotenv override=true with Source's custom-base-URL authentication cleanup. A dotenv fault retains prior writes and prevents cleanup; a successful disabled load still allows cleanup. PreparedEnvironment privately owns the values and explicitly reveals detached snapshots; ordinary diagnostic rendering contains no environment values. Callers prepare once, then use pure config.Load for settings evaluation. This local SDK composition creates no workspace or process writes. Both executable mains now invoke internal/commandenv.Initialize before argument interpretation, signal hooks or runtime construction. Compiled Go commands use the pinned Source frozen-program branch: search cwd and ancestors. This differs from ordinary Python source execution's configuration-module origin; SDK callers can still supply that explicit origin. The entry point publishes complete or partial prepared effects to process environment, so default Bash/background/MCP children receive the same variables; a loading fault returns before runtime creation. Runtime signal hooks start afterward so startup FIFO reads remain terminable. CLI dump reports actual enabled/disabled discovery and still creates no manager/listener or model probe; it now reads dotenv files and updates its own process environment. Pure config.Load and launcher inspection remain unchanged.

go/reload.NewWatcher implements the explicit StatReload fallback development contract. Operator roots are captured once; polling follows Uvicorn StatReload's first-seen baseline, increasing floating-point mtime comparison and reset semantics. Go watches .go; an explicit Python profile watches .py for differential checks. Matching directory names and resolved file symlinks retain Source behavior. The separate typed reload.Builder compiles one operator-selected local package using the existing Go toolchain, host target and readonly module mode. Each attempt owns a private output directory; failed attempts clean it, while a successful Artifact checks its retained executable bytes and releases them on Close. Build cancellation ends the owned compiler group on macOS/Linux. reload.Supervisor now retains the parent TCP listener, stops/joins each old child before replacement, and owns child artifacts through shutdown. Failed builds keep observing for source repair. The standalone CLI now selects this supervisor when MINILOOP_RELOAD is nonempty (including 0 or false). It watches cwd .go paths, builds ./cmd/miniloop from the Go module in cwd/ancestors, or an operator --reload-module directory, using the existing local toolchain. The parent owns no manager/session runtime. Native children receive the retained TCP descriptor before dotenv loading and recheck authentication against its actual bind address before constructing a manager. The private role marker is removed from prepared and tool-child environments; dotenv cannot turn an inherited child into another supervisor. Replacements reload dotenv/configuration and reset process-local sessions. Dump reports selection without discovering/building a module. This development path is implemented on macOS/Linux and adds no model-selected module, dependency or automatic restoration. reload.NewEventFilter separately implements the captured POSIX default WatchFiles filename policy with named Go/Python language profiles. It matches removed paths and suffix directories lexically, excludes hidden/backup basenames and retains eligible sources inside hidden parent directories. It has no root, filesystem or execution authority and is selected by the explicit native event SDK. Actual installed Source filtering/native events/environment/cancellation are archived in python-watchfiles.json; the default filter replays in Go. The archive now also captures 20 actual forced-PollWatcher operations, repeated missing-path notifications, a cycle fault and expanded environment conversion. reload.SelectObserverProfile now replays environment/host/override selection; reload.NewObserver(ctx, config) binds that captured profile to an owned native or polling subscription. Profile fields are private and retain no environment. Polling compares signed whole-second mtime, follows links lexically and retains Source's repeated missing-path notifications. Duplicate raw changes do not extend its quiet window. Close joins its worker, including maximum uint64 delays. The construction context cancels initial polling or Linux native traversal; successful subscriptions remain caller-owned until Close. Selected debug output reports raw lexical paths (native flags or zero for polling); Go diagnostic text differs from Rust internals. reload.NewNativeEvents now owns an explicit macOS/CGO FSEvents subscription using captured flags 18, zero latency and since-now. Its typed batches retain lexical kernel names, coalesce events and replay all 16 real Source recipes; The Darwin callback now filters lexical paths against its privately captured recursive roots and admits only recognized change/loss flags; historical/type-only sentinels cannot create a batch or poison another subscription. Three independent boundary probes reproduce the former differences. Prior native timing failures remain under investigation; these admission fixes do not prove their cause. Each Darwin stream now owns a serial dispatch queue using Apple's supported FSEventStreamSetDispatchQueue API. Start and stop/invalidate run on that queue. Close waits for active callbacks and drains queued work before stream/queue release and removal of the typed Go registry entry. Immediate and concurrent Close retains the same ownership contract without retaining a private CFRunLoop or OS thread. Prior timeouts remain open until repeated temporal validation completes. Cancellation retains unread events. Kernel drops or a bounded queue overflow report errors requiring operator recovery; they never silently prove event fidelity. NewNativeEvents retains its explicit native profile. The separate observer factory selects captured native/ polling profiles on Linux and macOS; the CLI now selects the same captured profile. Linux native observation uses an owned nonblocking inotify descriptor with recursive directory registration, filesystem-order alias projection and dynamic subtree updates. Directory/file link loops are skipped, access-only opens are inert, and moved roots retain Source's lexical projection. Kernel queue overflow/unmount and malformed records fail explicitly. Close joins its worker and releases every descriptor; construction cancellation releases partial registrations. The backend uses standard Go/syscall APIs and works with CGO disabled. Linux Source captures 18 native recipes and explicit boundary probes separately in python-watchfiles-linux.json. The CLI selects native observation by default on Linux and macOS/CGO. Captured WATCHFILES environment settings select forced polling; Linux uname release drives WSL automatic polling. macOS without CGO requires explicit forced polling. Installed Python Uvicorn 0.49.0 selects WatchFilesReload (watchfiles 1.2.0); Go uses the captured event/filter policy with its named Go source-language profile.

The explicit reload.BuildWorkspace allocates a private compiler/artifact parent. Build attempts, returned artifacts and bound observers lease it; Close refuses active users. Builder sets GOTMPDIR and TMPDIR only for its compiler process. A bound observer excludes this allocated subtree before batching/capacity accounting; polling also skips directory aliases into it. Kernel-loss flags still report faults. Real CGO compilation inside a watched root verifies temporary .go files do not trigger source batches. The CLI shares this workspace between its builder and observer, then closes it after joining children and closing the observer.

reload.SupervisorConfig now selects exactly one StatReload Watcher or event Observer. After listener admission, Run owns the event subscription and joins its read worker during cleanup, after stopping the child and releasing its artifact. A synchronous typed batch handoff bounds read-ahead through builds. Empty filtered batches do not rebuild; observer faults terminate with cleanup. SourceChanged exposes the full detached Paths batch and retains Path as its first entry. Real HTTP child tests verify native and polling replacement, failed-build recovery, retained sockets and released workspace leases. Actual CLI tests cover both native and forced-polling selection, dotenv refresh and cleanup with compiler temporaries inside the watched root.

Same-subscription queue/control diagnosis keeps the original recipe assertions, then writes a distinct control only after recording the original result. A temporary 100ms timer on the stream's serial queue changes diagnostic scheduling. In this one cohort hidden fails readiness before its operation, with300 observed queue marks before the result (maximum gap110.977ms); its later control C event arrives in0.570s. The other three operations pass and all four later controls have C events. This excludes a whole-queue sustained block in this cohort; it does not explain missing readiness delivery or establish temporal acceptance. Original runtime/ fixtures/deadlines/defaults unchanged, prior failures remain open. Queue/control receipt.

Required native callback-window diagnosis retains one unchanged four-case race+atomic cohort: ignored-hidden passes with one C event after operation; ignored-backup, ignored-text and transient-source time out with zero C callback batches/items in the original operation window. All four have C readiness events before operation. This excludes subsequent filename filtering as an explanation for these failures; it does not identify kernel cause or queue liveness. Attempted CGO Go overlay markers were not observed, so registry/admission-fence conclusions stay unproven. The reusable collector retains only witnessed C/test markers; the original cohort and executed diagnostic source remain in the raw callback receipt. No runtime, fixture, timeout, backend, dependency or default changes; full native acceptance remains incomplete.

Current final-acceptance review baseline: runtime 606630f, actual CI 3fccc2b and current publication evidence. Original P0/P1/G0–G7 acceptance is complete within its recorded finite scope. The final receipt and five-row delta close the original ledger at 344 verified / 0 incomplete / 0 blocked. Application statement coverage is 85.53%; contract row counts are a separate inventory. The short completion article maps each original work package to its evidence and boundaries.

The unchanged 1,864 inputs bind 16 host gates, including Python 2,256 passed / 28 skipped, and the real GitHub arm64 Source/full/vet/race gates. The retained original bytes also pass the unchanged verifier. Both Go cohorts pass all 6,955 required named identities, including parser 62, IDNA 84, core 31, persistence recipes and browser interaction. Thirteen Linux optional/platform skips and two packages without test files retain their reasons; six Darwin-only cases have actual host ordinary/race passes. The profile remains3GiB container memory, 1GiB Go soft target, CPU 2, package 1, test 2 and offline serial validation. CPython3.11.2 Source capture and the approved external CPython3.11.3 backend are observed separately. Earlier failed/stopped attempts retain their exact status.

Previous evidence-retention review baseline: 960fb87 + actual bootstrap logs. The corrected GitHub run passed all four stages and its on-run verifier, including the real browser interaction test. Artifact replay then found that bootstrap uses logs/ while the transport listed bootstrap-logs/. The transport now retains the producer's actual directory, with a producer-to-archive contract test. A complete rerun is pending; the original ledger remains339/0/5 until the retained bytes also pass the unchanged verifier. See the observed retention correction.

Previous operator-validation review baseline: fc53a97 + browser-tool visibility and explicit platform skips. The first real GitHub arm64 job ran Source/full/vet/ race to successful command exits, but its final verifier rejected unreviewed skips. Six are Darwin-only Seatbelt tests with actual host ordinary/race passes; one is a missing Node executable inside the validation image. The corrected bootstrap reuses the runner's existing Node for the browser interaction test, which must actually pass. Exact Linux platform skips retain their original names and reasons. The complete four-stage rerun remains pending; the ledger stays339/0/5. See the observed failure and correction.

Previous operator-pipeline review baseline: ee9a5dd + GitHub arm64 orchestration. The explicit development workflow prepares fixed public inputs, then runs Source/full/vet/race serially in one pinned image with offline 3 GiB containers. Go's 1 GiB soft target, two cores, package concurrency one, test parallelism two, raw Linux pressure and owned-process cleanup remain observable. The Go base configuration matches the previous local image. Source3.11.2 and native3.11.3 are probed separately; current runtime bytes still match the16 host gates. Retained logs carry exact package/test outcomes and byte hashes; cache trees are excluded from transport. Local preparation and18 small infrastructure tests do not count as completed Linux gates. See the remote validation path.

Previous operator-runner review baseline: a1fb80b + isolated Linux runner. The new development runner records real Linux MemAvailable/PSI and owned RSS, keeps 3 GiB / 1 GiB, two cores and offline complete stages, and binds its pressure helper with Source provenance. Eight small guard tests pass. Application components, authority, defaults and validated runtime inputs are unchanged.

Previous operator-input review baseline: f9dc43b + fixed public CI bootstrap. The official arm64 Go manifest resolves to the same 874a8b40 configuration as the prior local base. Public bootstrap assets preserve the original Source plan, capture script and 22-wheel hashes; actual remote stages remain to be run. The application architecture and all 1864 validated runtime inputs are unchanged.

Previous validation resource review baseline: runtime 606630f, documentation at 32a2286. The user approved four times the proposed 768 MiB / 256 MiB profile: the new runner uses a 3 GiB container limit and a 1 GiB Go soft target. Two cores, package concurrency one, test parallelism two, offline inputs and owned-resource cleanup remain; the first observed memory-pressure warning stops the stage. The original sealed runner stays unchanged. The first new Source preflight stopped before container creation because the host was already at warning; all 24 subsequent readiness samples were also warning. This is a capacity block, not a pending resource approval or a test failure. Earlier current-runtime Source evidence remains valid; no new native gate or row delta is claimed. See the approved profile and actual preflight.

Previous validation review baseline: runtime 606630f, documentation at 322f925. The Linux arm64 Source-only stage recaptured all six platform-sensitive groups (66 recipes) using CPython 3.11.2 on the unchanged sealed resource profile. It took 12.32 seconds with a cgroup peak of 161,345,536 bytes (153.87 MiB), normal recorded host pressure, no OOM and confirmed owned-resource cleanup. All 1864 current runtime inputs still match the prior 16 host gates. This stage does not execute the native CPython 3.11.3 probe, parser/IDNA Go consumers or Linux Go full/vet/race. Those three Linux native gates await resource-policy approval; the original ledger remains 339 verified / 0 incomplete / 5 blocked. See the Source evidence and iteration image.

Previous runtime review baseline: 77a57cb + native IDNA slice. Go provider hostname admission now uses project-owned RFC 3492 Punycode and complete fixed Source data: CPython Unicode 14 NFC/direction/mark/virama properties, plus idna 3.18 Unicode 17 validity, context, script and joining properties. The whole-host ASCII bypass is chosen before Unicode lowercasing. Unicode labels must already be NFC; this does not repair spelling through UTS 46. Constructor and request refusals preserve the captured Source phase, while the configured audit identity stays separate from the encoded request target. IDNA adds no Go module and launches no Python process. Generated Source data and upstream notices are retained with reproducible exporters. Current host full Go, vet, race, exact Python suite,268 Source contracts, four type audits and generated-byte checks pass on the same1864 inputs. The unchanged84 IDNA cases pass in ordinary and race tests; native NFC/Punycode also compare actual fixed Source observations. Application statement coverage is85.53% (per-package, tools excluded). The original required-row ledger remains339/0/5 until the complete platform receipt and explicit delta. Linux resource settings remain sealed pending lower-memory profile approval. See the native IDNA iteration.

Previous runtime review baseline: b8dd27a (fixed CPython slice). The Go full-feature profile now selects a fixed external CPython 3.11.3 ast.parse diagnostics backend when no explicit provider replaces it. The parser receives decoded source over stdin, uses isolated interpreter startup, never executes that source, and has two shared process slots, bounded input/output and cancellation. Missing or mismatched Python fails before launcher/audit resources are created. The real 62-case parser suite and default Manager/HTTP/CLI integration checks pass. Current host full Go, vet, race, exact Python suite, Source contracts and four type audits also pass; current Linux Source six-group validation passes. The native CPython 3.11.3 probe also passes; Linux full was stopped after host memory pressure rose, and vet/race were not started. A lower-memory validation profile awaits explicit approval; no required-row delta is applied. The IDNA algorithm, fixed Source property tables and unchanged 84-case consumer are preserved as a prepared patch pending explicit module approval; they are not adopted runtime behavior. See this iteration.

Previous runtime review baseline: local main e9b6390. The original P0/P1/G0–G7 criteria have been reconciled against current implementation and the 24-gate host/Linux receipt. Native persistence/restart evidence now has a seven-group recipe ledger, with matching 25 top-level and 49 subtest pass names in all four ordinary/race platform cohorts. The original finite inventory remains 339 bounded verified, zero evidence-incomplete and five dependency-blocked rows. IDNA and default CPython parser approvals still require implementation, actual native consumers and validation before closure. The Go parser backend is not implemented; the proposal reuses a fixed external CPython runtime for ast.parse. Existing architecture components, authority, control/data flow and defaults are unchanged. Root pytest discovery now targets python/tests so retained evidence copies under var/ cannot enter the documented test command. See the original-criteria review.

Previous runtime review baseline: local main a378a2b. This iteration preserves escaped lone-surrogate SDK text in five existing named fields and closed input/ caller observations. Escaped snapshots support inspection; actual subsequent model requests retain strict encoding before credentials and HTTP. Source SDK and native typed reply admission expose different intermediate boundaries for six rejected profiles, recorded explicitly with the finite corpus. The shell encodes its complete sandbox-selected argv before creating a process: DC80–DCFF use filesystem surrogateescape bytes, other surrogate code points fail, and native raw-byte embedding behavior is preserved. The default managed team remains unchanged. A test-only native assembly verifies the real teamless HTTP branch; corrupt mailbox errors use Source's outer-error response projection. See the contract and platform evidence.

Previous runtime review baseline: local main 48fd26d. That iteration added a shared native identity helper: a streamed executable-content fingerprint and one package-initialization process timestamp, PID and wall-clock uptime. Failed fingerprint reads remain explicit and retryable; successful results stay cached. Python hashes its source tree, so cross-language digest equality is not required. Launcher and health use the same identity; explicit embedding build labels remain available. Managed sessions expose detached raw-artifact limits and closed state for operator inspection, and the real startup consumer compares all three previously omitted store observations. Actual Source evidence covers all sixteen Harness fields and precise public audit, resource and plain/layered skill seams. The original platform, SDK, teamless HTTP and dependency gates remain separate. See the iteration evidence.

Previous runtime review baseline: local main da43c18. That iteration aligns public authentication environment parsing with Python whitespace and duplicate owner diagnostics, and Cron admission with ordered field-level 422 details before owner lookup; authentication remains first. Actual Source contracts also compare two complete workflow detail responses, 14 real registry selections, eight manager profiles and all 57 tool definitions with native production catalogues and bound services. Six default/explicit-None construction profiles exercise Null masking and persistence through run/stop. These are finite catalogue, binding and boundary checks; tool execution, default parser selection, teamless HTTP and full platform/migration acceptance retain their separate gates. See the iteration evidence.

Previous runtime review baseline: local main 78d95bc. That iteration follows actual Source post-stuck follow-up requests through both the native fake and the fixed SDK's local HTTP transport. A process-local observation of the exact unpublished tool batch permits dispatch; public transcript validation remains strict. The observation carries no authority and is not restored or inherited. The existing Context layer also exposes typed SectionsBuilder, RuntimeFacts and MemorySystemBuilder helpers with explicit caller-owned inputs; default prompt wiring is unchanged. Eight minimal Linux groups pass with actual same-platform Source fixtures; full Linux/race and original migration acceptance remain open. See the iteration evidence.

Previous runtime review baseline: 9950878. Configuration parsing now follows Python str.strip for U+001C–U+001F in booleans, modes, AST settings, blank numeric defaults, blank path selection and decision credential validation. Nonempty numeric input still uses the numeric parser's narrower whitespace rules; nonempty paths retain their literal spelling. The actual Source corpus has 128 settings recipes: the original 64 are unchanged, and the new 64 expose 52 failures on the previous native implementation. The focused config suite passes after this fix; complete gates and the original required-row audit are recorded in this iteration. No component, dependency or feature selector is added.

Previous runtime review baseline: 6ea2fd2. The stuck-detector iteration accepts the public Source's six integer threshold fields without blanket constructor rejection. An explicit all-zero configuration remains distinct from the Go zero-value detector's default policy. Monologue runs first; nonpositive unproductive/low alternating values disable those rules, while zero/negative repeat counts retain Python slice and empty-window fault behavior. A named StuckInspectionError propagates before built-in result-history publication; custom detector failures retain completed-result pairing. Source post-fault follow-up requests and Go's earlier model-ingress refusal are recorded separately; this iteration does not certify that caller boundary. See the iteration evidence.

Previous runtime review baseline: 51bdcc0. The raw-query iteration retains malformed percent text and semicolons, follows the captured ASGI Latin-1 and percent-decoded UTF-8 replacement behavior, and selects last values into six named fields. One request admission carries the authenticated principal and handler query observations, clearing the fallback bearer before caching. The optional named ResultAuthenticator distinguishes accepted, rejected and failed operations; default token comparison faults preserve the captured plain 500 response. Legacy bool authenticators retain their existing injection seam. Actual Source covers 24 raw-query cases; the earlier 99 valid-encoding captures remain byte-identical. Native/performance verification is recorded separately. Current iteration evidence.

Previous review baseline: 7a295d9. The HTTP scalar-query iteration selects the last repeated parameter and distinguishes an empty value from absence. Named integer/boolean parsing preserves the captured FastAPI conversion and 422 fields, with validation before owner/store lookup. Header credentials retain precedence; query tokens remain confined to /events paths, and a request's principal is cached once. The 99 actual Source cases include native SQLite epoch/trajectory reads and explicit durable SSE cursor/cleanup controls. Current iteration evidence.

Previous review baseline: ac4d603. The SDK caller-observation iteration retains unknown or malformed discriminator values, scalar/list roots and nonfinite metadata in a named immutable SDKCallerObservation. The pinned SDK's construction defaults are applied only at provider admission; historical decode preserves stored values. A safe tool can execute before a nonfinite caller causes the next model request's finite encoder to fail. The enclosing tool-use ID remains execution identity. Current validation and measured coverage were recorded in the iteration receipt.

Previous validation review baseline: f913d20. The current memory-efficiency iteration keeps this architecture unchanged. Isolated CLI tests now pass the outer Go resource budget to their startup/reload children; product configuration and defaults are unaffected. Race and all-package coverage ran as separate serial gates. The resource record records two passing budget regressions and native/polling real reload checks (sampled peaks 48.16/403.91 MiB). After the user relaxed validation budgets, full Go, vet, race and Python checks passed, along with full-package atomic coverage: app 89.43%, all Go 89.18%, provider 86.79%. The recovery and budget delivery is integrated into local main. Two unchanged IDNA/parser consumer prerequisites keep complete migration acceptance open. The latest delivery preserves earlier stops, linker warnings and exact resource observations. No measured before/after memory reduction is claimed.

Runtime implementation started from local main 69cba43; this delivery aligns default recovery construction with the actual Python source. A nonempty explicit or MINILOOP_FALLBACK_MODEL value wins; otherwise FALLBACK_MODEL_ID is read when Recovery is constructed and then retained. Whitespace remains a literal model name. Explicit Go environment maps capture their legacy input, including empty or absent values, so later ambient changes cannot supply a fallback. Public Settings snapshots still expose only the modern setting. Nine constructor, eleven Agent constructions and six actual Agent.run scenarios cover precedence, construction timing, DirectRecovery and an untruncated 513-byte legacy model. Default managed sessions construct their own recovery policy; five actual Manager scenarios compare sequential session selection and explicit policy sharing. Children continue to inherit their parent's policy. Validation and remaining acceptance boundaries are recorded with this slice's delivery.

Previous runtime review baseline: 1b8e3e8; that iteration publishes named permission decisions at their actual policy decision points, before later rules or tool effects. Session event scope, masking, live publication and historical codecs carry the four decision fields without granting authority from stored events. Fourteen actual Python managed-session profiles now match native decision order, identity, tool outcomes and masking, including a later approval error/cancel. All twenty existing hook profiles now assert their permission-event fields; the eight original readonly reason differences are repaired. Full-suite and integration validation for this implementation are recorded with its delivery.

Previous runtime review baseline: local main 66f3645; that iteration captures the provider hostname boundary before native IDNA implementation. The existing Unicode direct/SSE request-object probes still differ from Source; existing ASCII request and actual HTTP Host contracts pass. The Source corpus records original-host ASCII selection, Unicode lower/IDNA ordering and invalid-host rejection, with exact installed library and Unicode-data versions. The native consumer and proposed fixed dependencies await approval and implementation. This is contract evidence; runtime topology, authority and defaults are unchanged.

Previous runtime review baseline: local main 82b14bf; that iteration reviews the Python/Go fake-HTTP performance instrument and the original acceptance index. Its isolated server environments explicitly retain conservative CPU/thread settings and a soft Go memory target, and the report records these settings. The surrounding validation process still monitors task-owned RSS and host pressure. These are test-workflow controls, not runtime service defaults or OS hard caps. The existing Mermaid topology and interactive map stay unchanged.

Previous runtime review baseline: local main fabe9bd; that iteration reviews explicit role profiles and child catalogue isolation. A retained before-change probe selects read_file in Source for the dotted-I role while the old Go policy selects another role's write_file. Role lookup now uses the existing Python Unicode strip/lower helpers, preserving dotted-I expansion and contextual final sigma instead of merging distinct caller-defined roles.

Ordered profiles first apply raw-key replacement at the key's original position, then normalize role keys with last-value-wins collisions. Explicit empty role and policy capability values are accepted. Tool registration still refuses empty or all-Python-whitespace capability names; valid duplicates collapse while names retain their literal spelling and first occurrence order. A tool is delegated only when its complete nonempty capability set fits the selected role. Child labels lowercase the original role without stripping its whitespace; normalized Explore aliases still select readonly mode.

The bounded Source capture records 34 selection cases, seven real _run_subagent/InProcessSubagents child recipes and six invalid capability registrations. It observes selected schemas/traits, effects, results, raw child labels and peer provenance with inherited human approvals cleared. Required slice gates now pass across retained validation segments, including full Go/vet/race/Python. Two earlier host-pressure stops remain recorded; fresh coverage uses only the complete successful race output. Full migration acceptance remains open. Retained cohort evidence. Explicit caller-defined roles do not widen the model task enum, readonly policy, depth quota or trust boundary. README Mermaid and the interactive JSON annotate existing Session/ToolGate components; topology and the architecture base image remain unchanged. Role policy seam.

Previous verified review: local main 2ca0266, public Go RunContext constructors and provenance observed by a real session. Seventy actual Source Agent.run profiles combine 14 default/human/peer contexts with five message/peer derivations. They capture optional versus explicit-empty text, capability membership, tool contexts, emitted correlation identities and fresh message relationships. The retained native-before probe shows explicit-empty human channel/stamp values being replaced by defaults.

HumanRunConfig.Channel and StampedBy now use *string: nil selects the existing defaults; a pointer to empty text preserves that explicit value. This requires Go callers that set either field to migrate their source to pointers. PeerAgentRunContext(delegatedBy, PeerRunConfig) creates fresh peer authority; its required string argument may be empty, optional actor/stamp/parent values remain distinct from absence, and the config accepts no approvals. Peer derivation uses this constructor and clears inherited human approvals. WithNewMessage retains its existing provenance and supplied-capability rules; capability membership alone does not promote peer or untrusted authority.

Validation still requires a nonempty message identity and a closed authority variant; empty channel/stamp metadata is accepted. Snapshots remain observations and cannot restore live authority. The existing Go Session node records this public constructor boundary without changing components, connections, defaults or trust rules. Final validation and fresh coverage are recorded separately under var/go-public-run-context-2026-10-13/verified; arbitrary Python objects, direct dataclass overrides and broader host/platform acceptance remain separate. Public RunContext seam. The architecture base image remains unchanged.

Previous verified review: local main fbe8ad4, output-step hashing and admission of a mixed tool batch. Thirty-two actual Source Agent.run profiles combine four exclusive/parallel layouts, three failure positions plus valid controls, and semaphore capacities one and two. The initial native comparison failed 22 profiles: later exclusive effects could run after a hash fault, and a failed batch could retain a valid prefix in its step ledger.

Each dispatched call now emits its tool_result event before computing the output hash. A UTF-8 hash failure stops later exclusive calls and later parallel groups; calls already scheduled in the same parallel group finish. The session prepares steps locally and admits them only after the entire batch succeeds. A failed batch appends neither steps nor a tool-result message to history and sends no second model request; earlier tool effects and emitted events remain observable. This ordinary hash error does not trigger cancellation repair. Parent cancellation takes precedence over a simultaneous hash error and keeps the repair path, including cancellation by a result observer. Other errors keep their existing recovery behavior.

The fixture covers immediate handlers; delayed peers, broader cancellation, host/platform behavior and full migration acceptance remain separate. Final frozen gates and fresh coverage are recorded under var/go-batch-step-boundary-2026-10-13. The existing Go Session node carries this boundary in README Mermaid and the interactive JSON. There is no new component, permission, dependency or default; the architecture base image remains unchanged. Batch admission seam.

Previous verified review: local main 115f147, public spill text/effect boundary. ToolResultBudget encodes every original target before budget/clock/mask/filesystem effects, so masking cannot rescue surrogate text. 25 actual public Source profiles compare zero/large budgets, later invalid targets, older ignored batches, directory-first callbacks, partial files, unchanged messages and result-ID code points/cap. The prior native probe could accept or write masked invalid text; its probe and22 failing comparisons remain in the delivery evidence.

Actual Source Agent loops add8 required AST profiles: invalid raw result text emits the result event, fails output step_hash UTF-8, and returns no result batch or second request. Native checks raw output before JSON can replace it, retaining Source's ordinary unanswered-batch state. Cancellation/other repair remains. The first full ordinary cohort's five AST failures are retained separately.

workspace.Files.EnsureDirectory supplies the same guarded immutable workspace boundary and creates the output directory before clock/mask. It checks before and after creation; it is not OS confinement or cross-process symlink fencing. The existing typed UTF-8 error and immutable legacy-text helpers are reused. No new service, dependency, model tool, default, owner or authority. Existing public helper composition/lifetime rules and61 previous profiles remain. README Mermaid and interactive JSON reflect preflight before spill and guarded directory creation; architecture components and base image are unchanged. Full frozen gates and final migration limits remain recorded separately in the delivery receipt.

Public helper contract; text/effect receipt; composition seam.

Previous verified implementation review: implementation 833e16f, native MCP ordered scalar-key mapping and Source fault-stage alignment.116 direct and116 actual journal profiles pass required assertions, including original88 differences and added nonfinite roots/ values. Immutable named entries preserve first-key kind, Python numeric equality and last-value replacement. Unhashable keys fail batch preparation; non-text keyword binding fails after permission, sorted query faults precede result observers even without an active reducer. Explicit/callable MCP objects stay finite; external risk unchanged. Direct/SSE, clone/mask/archive and seven real SQLite close/reopen/owner-restore profiles preserve original roots, event stages, current authority and fresh leases without external-effect replay. Frozen1695 inputs pass Source247/manifest, focused Go/Python, four type gates, collector/body inventory, ordinary Go/vet/race+atomic, full Python,19 scans, 6 guards and diff. Consumer inspection exits1 only for the absent syntax-parser consumer. Current receipt. Previous full Python memory-scaling failure remains retained without a runtime/ threshold fix or cause claim; this new implementation cohort is separate. Broader mapping/NaN-identity/caller/transport and original P0/P1/G0-G7 stay open.

Passing-race statement coverage: app 89.38% (33496/37478), all Go 89.13% (33862/37993), Provider 86.67% (1522/1756). Current coverage. Darwin statements only; native C/subprocess interiors, Python, branches and other profiles excluded. Original migration acceptance and historical temporal reliability remain open.

Previous verified runtime baseline: implementation 48f7b85, based on main 6cb887e, with finite MCP model-root observations and whole-batch preparation. Fifty-two actual Source profiles and four native SQLite reopen/owner-restore cases pass;48 original failures retained. The first full cohort exposed one obsolete model-null assertion; its failed log and interrupted race are retained. Actual Source evidence now requires model-null preparation while explicit MCP null remains refused. Frozen1686 inputs pass Source245, focused controls, four type audits, body inventory, ordinary Go/vet/ race+atomic, full Python,19 scans,6 guards and diff. Parser consumer inspection still exits1. Darwin statements:app89.40% (33313/37264), all Go89.15% (33679/37779), Provider86.67% (1522/1756). See the full receipt and iteration image. No connection, external risk, approval, owner, default or dependency changes. Nonfinite/non-string-key/wider roots and public/platform/type/temporal profiles, default syntax/IDNA approvals and full original migration acceptance remain open.

Timing evidence review after f9d4f61: four paired post-spawn timing scenarios and Python workload profile retain the original ordinary Go/Python failures. Runtime and thresholds are unchanged; injected delays establish a timing boundary, not the missing original failure cause. The diagnostic iteration image highlights observations on the existing base without adding or deleting components.

plus citation-bearing native SQLite recovery proof, plus native SQLite reopen and restored HTTP tool-turn proof of current sandbox policy binding, plus explicit Manager full-feature composition, plus actual CPython syntax-parser contracts, plus Source-compatible explicit injector overrides, plus Source-ordered Go built-in feature catalogues, plus Source full-feature composition contracts, plus native process-kill generation recovery, plus native cron/SQLite reopen proof, plus Launcher caller-owned state injection, plus native managed SQLite close/reopen proof, plus native SQLite action/approval rows, plus native SQLite transcript and event rows, plus native SQLite session metadata and leases, plus standalone native SQLite schema opening, plus Source timeout overflow/error ordering, plus timeout conversion Source contracts, plus native benchmark post-construction narrowing, plus benchmark filter-order Source contracts, plus Launcher and benchmark efficiency settings activation, plus benchmark efficiency Source contracts, plus efficiency startup Source contracts, plus native entered-workspace child artifact allocation, plus Agent request projection Source contracts, plus explicit Agent response policy adoption, plus Agent response adoption Source contracts, plus typed multi-stage registry/runtime, plus multi-stage registry Source contracts, plus typed response policies and settings, plus response policy Source contracts, plus typed request optimization library, plus request optimizer Source contracts, plus shared observation component lifecycle, plus efficiency lifecycle Source contracts, plus typed observation orchestration library, plus observation-pipeline Source contracts, plus typed observations and builtin reducers, plus observation/reducer Source contracts, plus typed masked-artifact recovery tool, plus artifact-recovery Source contracts, plus native scoped masked RAM storage, plus masked raw-store Source contracts, plus native immutable efficiency contracts, plus token-efficiency type Source contracts, plus Guardian Launcher activation, plus Guardian HTTP Source contracts, plus manager-owned per-action Guardian binding, plus manager-selected Guardian Source contracts, plus native readonly Guardian/explicit reviewer, plus Guardian Source review/adapter contracts, plus native AST text/final tool-result encoding, plus AST text/provider encoding Source contracts, plus native AST decimal conversion faults, plus AST decimal conversion Source contracts, plus AST Launcher environment selection, plus AST HTTP Source contracts, plus explicit runtime AST model tools, plus AST tool declarations and closed input variants, plus native AST semantic operations, plus AST public-operation Source contracts, plus native AST results and captured payload classification, plus shared CPython JSON syntax diagnostics, plus AST payload invocation Source contracts, plus native AST canonical path and bounded glob selection, plus AST path-selection Source contracts, plus full private AST source snapshot construction, plus anchored AST snapshot filesystem primitives, plus native three-state AST ignore matching and control decoding, plus AST ignore Source contracts, plus AST snapshot filesystem Source contracts, plus foreground shell start/Interrupt registration serialization, plus standalone AST executable probing and bounded process capture/cancellation, plus typed AST configuration/status and inert version-output parsing, plus AST adapter Source admission/probe contracts, plus explicit diagnostics launcher forwarding and actual HTTP/model replay, plus diagnostics HTTP Source contracts, native diagnostic file scanning and closed parser results, plus diagnostics parser-boundary Source observations and explicit typed diagnostics provider/tool composition with the fixed CPython 3.11.3 default syntax backend, managed stored-request reconstruction and typed historical request reconstruction and independent transcript-search launcher/CLI selection and actual Source runtime replay, plus explicit session-bound transcript_search and the typed bounded transcript-search library and Source-selected task-child MCP binding and parent-retained connection cleanup, plus typed native InProcessMCP handlers and Python result text, plus explicit MCP launcher selection and operator server forwarding, plus default-off managed MCP connections, identity-based last-holder close after turn drain, fresh fork connection state, and default-off raw-session connect_mcp and exclusive inventory publication, plus immutable MCP registration snapshots and explicit runtime catalogue injection, plus the native stdio MCP client library, phase-specific unbounded ledger metrics, final HTML UTF-8 validation and private traceview output, the Python directory split, its package-relative default skills path, and the Go typed loop, execution gate and workspace files, bounded glob search, todo/skill/question handlers, typed model requests, token metering, four-layer context compaction and typed subagent execution with run provenance, action replay and typed journal transitions, a bound approval broker with session grants and textual questions, and optional registered-secret masking across the implemented Go result/recording paths, and a real foreground workspace shell with typed results, group cancellation and bounded capture, plus default cache annotations and bounded stuck detection, core lifecycle telemetry, bounded subscriptions and managed turn admission/cancellation, plus typed prompt hooks/injectors, Todo reminders and shared model/tool pools with ordered parallel groups, and process-local fleet composition, owner-scoped lookup, workspace policy and draining deletion/shutdown, plus typed HTTP authentication, REST admission, idempotency/rate bounds and SSE projection, plus bounded steering, live permission modes and owned HTTP wakeup, plus completed-boundary conversation forks with fresh scratch workspaces and typed lineage, plus an explicit direct Anthropic-compatible HTTP adapter and bounded SDK retries, plus typed SSE assembly, provisional stream progress and shown-text interruption repair, plus typed default Agent recovery with retries, escalation, continuation, reactive shrink and fallback, plus captured stream-progress settings and stateful signed fake-model calls, plus typed environment settings, embedded default skills and a standalone HTTP launcher, plus a typed private spill store and masked string-Bash preservation, plus default per-run trajectory JSONL recording and owner-scoped list/inspect/export, plus the typed HTML ledger, filtered record visitor and independent traceview CLI, plus the embedded public development console and full browser shell, plus an optional typed persistent task graph and owned task-board HTTP view, plus the operator library worktree lifecycle and task binding, plus five explicitly installed worktree tools and serialized execution workspace switching with retained lifecycle cleanup ownership, plus an explicit typed managed-worktree factory with source directory-cleanup semantics, plus a typed operator background-command service with merged byte capture and orphan records, plus two explicitly enabled background tools, conditional Bash dispatch, bounded completion injection, interruption survivor markers and manager-owned close/join with independent startup selection, plus selected child scopes retained for lifetime cleanup with independent qualified IDs and completion queues, plus an explicitly bound typed cron operator scheduler with masked persistence, disarmed restoration, exclusive minute claims and cancellation/join, plus manager-owned cron with fresh untrusted turns, owner-scoped operations, delete/stop joins and standalone startup, plus three explicit cron model tools, four owned cron HTTP operations and individual launcher selection, plus concrete schema-v7 state contracts and archival event decoding, plus optional injected session state, request guards and confirmed lease-loss cancellation, plus explicit injected-store manager restoration, lease-gated approval expiry and crash-tail repair, plus lazy stable-identity cron restoration with bound/factory workspace selection, plus owner-scoped bounded event-store SSE catch-up with distinct ordinal/sequence types, plus configured-store transcript epoch reads with concrete historical snapshots, plus explicit typed plan-mode tools, review callbacks and log-folded prompt guidance, plus explicit typed goal tools, CAS snapshots, bounded default stop continuation and disarmed log restoration, reviewed 2026-10-11 (Go baseline 014e913 with owned literal-path transport, detached JSON read/write spans and serial Darwin callback queue ownership; native watcher temporal acceptance and prior measured coverage stay explicit; default diagnostics and remaining full-runtime acceptance stay explicit). The optional decision tool evaluates explicit state through a configured provider; its typed result returns through the existing permission, tool-result, and event boundaries.

Current architecture review baseline: 2026-10-17, 2b85676 plus the single Task runtime cleanup. API, Worker and Temporal deployment roles are unchanged; the Worker no longer registers the obsolete V1 Task Workflow. Within the Task API process, http.py handles ASGI and authentication, protocol.py defines stable errors, identities and the operation interface, service.py orchestrates tasks, and backend/ owns Temporal Run/History access, signed cursors and readiness. Shared Workflow determinism lives in temporal_support/, without a production dependency on the offline prototype. Repository-only acceptance scenarios, fixtures and support live in tooling/; published script and production CLI paths retain compatibility. Its independent Bearer API confirms remote Workflow Start before returning 202; retained Temporal History owns task identity, status and events. The sole runtime.py:TaskWorkflow retains the current wire identity TaskWorkflowV2 / task-v2 and carries a bounded native saver journal across Continue-As-New. The default Task queue is mini-loop-task. Deployment-owned model Activities run real Deep Agents, including deterministic native summarization and general-purpose subagents. A separate Task container profile uses one immutable application image for API and Worker, with role-specific secret files and same-process startup. API readiness checks the configured namespace with a bounded, coalesced RPC; liveness does not depend on Temporal. The shared TLS settings remain explicit. Signal handling explicitly wakes an idle event loop; Worker drain and hard-deadline budgets stay unchanged; library callers retain process ownership. No owner Memory is installed. The standard Agent Server profile, earlier offline fault prototype and Python/Go runtimes keep their own paths. Temporal Python SDK 1.34.0, Deep Agents 0.7.25, Agent Server 0.16.0, and CLI 0.4.35 remain fixed. Validation of this refactor belongs to its separate delivery record; earlier Go review labels retain their original scope. The Task acceptance matrix maps the requested behavior to concrete evidence and separates it from production HA and capacity targets. The earlier cold-restart experiment used the 08b4333 application image; its receipt remains historical evidence for that exact build.

flowchart LR
    Caller["Callers<br/>Python · REST · SSE"]

    subgraph Control["Control plane"]
        Entry["Python FastAPI / CLI / console<br/>python/mini_loop/server.py · __main__.py"]
        Trust["Authentication + ownership<br/>auth.py · RunContext"]
        Manager["SessionManager<br/>composition · scoped resources · shared semaphores"]
        Drafts["Personal-skill drafts<br/>sanitized preview · TTL · process-local"]
        Entry --> Trust --> Manager
    end

    subgraph Runtime["Per-session runtime"]
        Session["AgentSession<br/>lock · transcript · event stream · lease"]
        Agent["Agent._loop<br/>model ↔ tool loop · stop semantics"]
        Context["Context pipeline<br/>agent skills · owner skills / memory<br/>compaction · cache · metering · token efficiency"]
        Catalog["Immutable tool view<br/>ToolCatalogSnapshot · RoleToolPolicy"]
        Gate["Execution pipeline<br/>before → guard → permission → execute<br/>after → result observers"]

        Session --> Agent
        Agent -->|build bounded request| Context
        Agent -->|ordered ToolCall batch| Catalog --> Gate
    end

    Provider["Model provider<br/>streaming transport · recovery"]
    Backends["Tool backends<br/>files · shell · AST · diagnostics · MCP · custom tools<br/>sandbox · secrets · spill"]
    Decisions["Optional DecisionProvider<br/>Jev API or explicit LLM estimates<br/>choice · score · noul"]

    subgraph Async["Optional orchestration"]
        Coordination["Background · cron · tasks · teams<br/>worktrees · subagent provider"]
        Workflow["WorkflowService<br/>fixed AGENT / VERIFY / REDUCE DAG<br/>read-only fresh workers"]
    end

    subgraph Evidence["State and evidence"]
        State["SQLiteStateStore<br/>session epochs · events · leases"]
        Resources["Owner resource files<br/>user skills · Markdown memory"]
        Journal["Action / approval / goal / plan logs<br/>replay · CAS · recovery state"]
        Trace["Events · trajectory JSONL · trace viewer<br/>audit · problems · runtime posture"]
    end

    subgraph GoPort["Go runtime assembly · independent Go code + explicit external parser · in progress<br/>operator type gates: syntax / public / private / variables · no runtime grants"]
        GoTeams["Go team protocols<br/>bounded mailbox / 200 handshakes<br/>owned GET / injection / idle turns"]
        GoImprovement["Go improvement / verified core<br/>lineage · verified Git proposals<br/>live GET / owned proposal POST"]
        GoSelfAudit["Go self-audit observer / snapshot core<br/>activity · problems · trajectories · skill usage<br/>suggestions · inadmissible task drafts"]
        GoBenchmarkLibrary["Go benchmark instrument<br/>admitted tasks · setup · effect judges<br/>construct → setup → restrict → run<br/>typed statistics · conservative paired verdict"]
        GoLaunch["Go cmd/miniloop · launcher<br/>streamed artifact content ID · shared process identity<br/>full profile: fixed CPython diagnostics or explicit provider · explicit RepoRoot binding<br/>typed settings · efficiency / Guardian / AST / workflow / decision / memory selection · bind guard<br/>optional caller-owned store · explicit restoration<br/>ordinary / inherited child listener · actual bind guard · signal shutdown"]
        GoReload["Optional Go development reload parent<br/>cwd native / forced-polling observer · readonly native build<br/>owned compiler workspace<br/>retained TCP socket · stop / join / replace<br/>SDK: owned Observer or StatReload · bounded handoff<br/>build-failure recovery · child artifact / observer cleanup"]
        GoObserverSDK["Explicit Go observer SDK · captured typed profile<br/>macOS / CGO serial FSEvents queue · Linux inotify · PollWatcher<br/>captured roots / recognized native changes<br/>lexical filtered batches · duplicates deduplicated<br/>cancel retains unread events · Close joins/releases<br/>leased compiler workspace exclusion · kernel loss retained<br/>CLI captured environment / host selection"]
        GoEntry["Go HTTP / SSE / browser handler<br/>Python config strip / numeric parsing distinction<br/>owned routes / raw query decode / named admission cache<br/>Cron ordered field-level 422 before owner lookup<br/>owned team view / non-consuming peek / opaque internal errors<br/>embedded protected OpenAPI / Swagger / ReDoc / OAuth redirect<br/>health reports deployment selection · actual typed runtime posture<br/>bounded ingress · typed JSON / event projection<br/>owned catalogue / memory / drafts · typed admission<br/>trusted POST / SSE memory profile selection<br/>explicit transcript-search / diagnostics selection"]
        GoCLIEnv["Go commandenv · executable mains only<br/>Source frozen origin · cwd / ancestors<br/>publish prepared process environment<br/>faults before dispatch · disabled status"]
        GoStartupEnv["Go config.PrepareEnvironment · local SDK<br/>dotenv override=true → base-URL auth cleanup<br/>private env · explicit detached Reveal<br/>explicit origin · no process writes"]
        GoDotenv["Go dotenv · local SDK library<br/>typed bindings · explicit caller/cwd discovery<br/>file / FIFO decode · detached environment application<br/>Source 1.2.2 · detached SDK effects"]
        GoRemoteAudit["Go audit libraries · cmd/miniloop-audit<br/>public health GET · 10s deadline · bounded response<br/>typed report → findings / text / exit status<br/>local construct → full findings → stop · privileged Manager SDK"]
        GoTrust["Authenticator<br/>Python whitespace / ordered duplicate-owner diagnostics<br/>one admitted principal · owner-scoped routes"]
        GoProvider["Model providers<br/>Stateful signed fake · direct Anthropic-compatible HTTP<br/>captured SDK raw paths / literal dot normalization / strict Source IDNA14+17 / project-owned NFC and RFC3492 / default ports<br/>literal path: private standard Transport clone / proxy policy once / route-specific wire URL clone / owned idle pool<br/>HTTP proxy absolute-form · direct / HTTPS origin-form · standard CONNECT / TLS<br/>captured / injected credentials · automatic profile / OAuth / federation<br/>RAM token cache · best-effort private profile file cache<br/>request auth before HTTP / retry · SDK Unicode observations / strict next-request encoding · typed replies + inert SDK caller roots / defaults / nonfinite metadata / extensions + server tool-use inputs + container-upload + server search results / tool references / fetched documents / code / Bash / editor replies + citations + usage schema · SSE · UTF-8 tool-result wire · named usage observations / metering · SDK usage metadata / whole-usage projections / delta faults · per-delta partial input · named nonfinite SDK snapshots / legacy archives / finite HTTP encoding · inert unknown-model calls · deferred Bash and background binding failures / named shell root observations / named Bash option projections / nonfinite Bash/background command observations / masked Bash and background display projections · SDK retries"]
        GoDecisionLibrary["Optional decision providers · default off<br/>closed choice / score / noul judgments<br/>masked state + result projections · fixed Jev HTTP<br/>isolated current-LLM query · shared model pool"]
        GoManager["Go SessionManager<br/>explicit full profile · custom catalogue / injector overrides<br/>owner lookup · atomic shell posture / persistence faults<br/>resource snapshots / default scoped memory<br/>workspace policy · raw stores / component lifecycle · drain<br/>detached raw-artifact limits / closed posture"]
        GoManaged["Go ManagedSession<br/>admission · active cancellation · status / done<br/>completed fork history · lineage · stored epoch / request reads"]
        GoControls["Owned session controls<br/>bounded steering · live mode · posture notes"]
        GoSession["Go Session<br/>Python role strip/lower · raw duplicate order before normalized selection<br/>raw lowercase child label · Explore aliases stay readonly<br/>trusted human / peer context · omitted ≠ empty metadata<br/>snapshots remain observations · peer derivation clears approvals<br/>prompt hooks · explicit injector overrides · Todo reminder<br/>all-call shell / MCP preparation · ordered scalar keys · staged binding/query faults · ordered parallel groups · inherited pools · events<br/>result event → output hash · exclusive stop / parallel group join<br/>whole successful batch → step ledger / result history<br/>integer stuck thresholds / named Source slice faults<br/>exact unpublished-batch observation; strict public validation<br/>configured coalescing · interrupted text<br/>DefaultRecovery · modern / explicit then captured legacy fallback<br/>live / side history ownership<br/>default goal stop · bounded continuation<br/>optional writable memory capture"]
        GoContext["Context pipeline · typed public helper SDK<br/>explicit sections / runtime facts / scoped memory builders<br/>fitted schemas · exact custom schema metadata · skills · cache · token meter<br/>pinned layers · optional closed memory selection/index / team inbox<br/>trusted caller parsing profile · no authority grant<br/>original UTF-8 preflight → guarded spill → snip → micro → summary · optional plan guidance<br/>efficiency: observation · response → request guard/ledger → cache"]
        GoBrowser["Embedded Python browser sources<br/>public console / ui shell<br/>authenticated data requests"]
        GoTraceCLI["Go traceview CLI<br/>operator-selected export / stored runs<br/>private standalone HTML"]
        GoTraceView["Typed ledger / HTML renderer<br/>selected header fields · typed span fold<br/>phase-specific metric ints · unbounded sums<br/>legacy payload inspectors · final UTF-8 check<br/>escaped text · embedded CSS / filter JS"]
        GoTraces["Private trajectory JSONL<br/>per-run owner · masked full fields<br/>privacy before UTF-8 · archival model snapshots / metadata / metrics<br/>closed summary views · strict list UTF-8<br/>append-only files · no session restore"]
        GoArchives["Workspace compaction artifacts<br/>.task_outputs · .transcripts<br/>guarded directory before spill clock / mask"]
        GoActions["Optional journal / session state<br/>typed replay · epochs · events · restore<br/>SQLite sessions · epochs · events · leases · audit<br/>explicit caller store · operator restore<br/>optional session-bound search · typed reader<br/>historical request reconstruction · managed stored reads"]
        GoMCP["Go MCP connect_mcp / registration / adapters<br/>closed input · exact schema · bounded RPC<br/>exclusive publication · raw owner collisions<br/>managed connection lifetime · fork isolation<br/>stdio / in-process · launcher selection<br/>task-child binding · parent-retained cleanup"]
        GoMCP -. explicit fixed MCPCatalog snapshot .-> GoGate
        GoGate -. MCPTools: approved exclusive connect / publish .-> GoMCP
        GoManager -. explicit shared handles / last-holder drain and close .-> GoMCP
        GoLaunch -. explicit MCPTools / MCPServers selection .-> GoMCP
        GoSecrets -. explicit credential scrub / passthrough .-> GoMCP
        GoSecrets["Optional Secret Registry<br/>named lookup · cached values · masked copies<br/>typed environment selection API"]
        GoApprovals["Optional approval broker<br/>park · resolve · timeout · cancel<br/>session grants · MINILOOP_GUARDIAN readonly review · typed store seam"]
        GoGate["ToolGate<br/>Source-ordered built-ins · caller catalogue order<br/>literal capability subset · duplicates collapse · blank names refused<br/>optional pinned catalogue subset<br/>before → guard → permission → execute<br/>after → observer<br/>finite journal fingerprints; begin failure skips after<br/>text refusals · fault flags<br/>explicit typed extension codec / handler<br/>Session-stamped informational label / depth<br/>callback panic diagnostics: type only"]
        GoBash["Workspace shell.Executor<br/>selected sandbox argv → filesystem codec → process launch<br/>process groups · deadline · shared capture<br/>serialized foreground start / Interrupt tracking<br/>opt-in Seatbelt · parameter paths · workspace rebind<br/>selected environment · masked typed result<br/>spill.Store: string preservation only"]
        GoFiles["Filesystem libraries<br/>workspace read · write · edit · glob<br/>bound path · anchored create / prepared catalogues<br/>skill publication · snapshots · memory lifecycle lock<br/>configured diagnostics scan · CPython 3.11.3 ast.parse<br/>AST probe / bounded process · private source snapshots<br/>ignore frames · bounded copy · cleanup<br/>canonical selectors · basename globs<br/>typed semantic reads · explicit ASTConfig tools"]
        GoPythonParser["External CPython 3.11.3<br/>isolated ast.parse child · source stdin only<br/>no source execution · bounded process lifetime"]
        GoBackground["Explicit background service / runtime tools<br/>typed tasks · independent contexts / groups<br/>merged byte capture · named wait policies · orphan ledger"]
        GoBgLedger["Workspace .background records<br/>masked command · pid · start time<br/>orphan report; no process/session restore"]
        GoBackground -->|shared argv / environment / group control| GoBash
        GoBackground -->|atomic best-effort in-flight files| GoBgLedger
        GoGate -. optional background tools / Bash dispatch .-> GoBackground
        GoBackground -. bounded completion / live interruption count .-> GoSession
        GoManager -. delete / stop after turn drain: cancel and join .-> GoBackground
        GoLaunch -. explicit background-tools flag .-> GoBackground
        GoChildren -. selected background tools: separate scopes / queues .-> GoBackground
        GoCron["Explicit operator cron<br/>typed jobs · five fields · disarmed restore<br/>native SQLite scheduled sessions · fresh authority<br/>per-session controls · ticker / run cancellation<br/>callback panic diagnostics: type only"]
        GoCronStore["Operator cron JSON / claim files<br/>masked prompts · mark before dispatch<br/>exclusive minute claim; no external transaction"]
        GoCronRunner["Managed resolver / scheduled runner<br/>fresh untrusted ManagedSession.Run<br/>live reuse / injected-store restore"]
        GoManager -->|default ownership / owner-scoped operations| GoCron
        GoLaunch -. Serve starts disarmed restored jobs .-> GoCron
        GoManager -. revoke turns then stop / join .-> GoCron
        GoGate -. optional three cron tools; no model arm .-> GoCron
        GoEntry -->|owner-scoped list / schedule / cancel / arm| GoCron
        GoLaunch -. explicit cron-tools selection .-> GoGate
        GoCron -->|atomic persisted mark / O_EXCL claim| GoCronStore
        GoCron -->|only after occurrence admission| GoCronRunner
        GoCronRunner -->|fresh untrusted serialized turn| GoManaged
        GoCronRunner -. stable identity lookup / restore .-> GoManager
        GoWorktrees["Explicit worktree service / tools<br/>Git create / keep / inspect / safe remove<br/>task binding · audit · exclusive enter"]
        GoDraftLibrary["Go userresources draft / preview libraries<br/>typed candidate / two-attempt model seam<br/>explicit standalone Session adapter<br/>owner + session + digest · operator create-only publication"]
        GoSkillCapture["Go admitted-turn evidence<br/>process-local · 64 messages / 40k characters<br/>mask before budget · sticky screening failure"]
        GoWorkflow["Optional manager-owned WorkflowService<br/>trusted launch / manage · shared worker pools<br/>process-local DAG / outbox · cancel / join<br/>18 observation kinds · scoped summaries<br/>archival scalars / SSE · authenticated HTTP launch · owned reads / cancel"]
        GoGate -. explicit-human workflow tools .-> GoWorkflow
        GoWorkflow -. events / summaries / later-turn results .-> GoSession
        GoResources["Bound session resources<br/>TodoWrite · load_skill · ask_user · compress · task<br/>optional task / plan / goal / team / workflow / masked recovery tools · goal CAS snapshots<br/>snapshot · digest check · deferred summary"]
        GoChildren["Fresh subagent / auditor sessions<br/>capability-selected tools · peer RunContext<br/>inherited seams / pools · fresh counters"]
        GoLaunch -. parent role: nonempty MINILOOP_RELOAD .-> GoReload
        GoReload -. native child: fd handoff / actual bind recheck .-> GoLaunch
        GoReload -. owned subscription: read / Close / join .-> GoObserverSDK
        GoLaunch --> GoEntry --> GoTrust --> GoManager
        GoEntry -->|public static documents| GoBrowser
        GoBrowser -->|authenticated API / SSE| GoTrust
        GoLaunch -. construct / stop / caller store / sandbox / explicit restore .-> GoManager
        GoManager -. explicit typed workspace factory .-> GoWorktrees
        GoManager -->|create / fork / restore · owned teammate idle turns · bind resources / sandbox| GoManaged --> GoControls --> GoSession
        GoControls -. mode at permission evaluation .-> GoGate
        GoSession --> GoContext
        GoContext -->|strict request / observed retained batch dispatch| GoProvider
        GoProvider -->|typed replies / bounded provider error detail| GoSession
        GoContext --> GoArchives
        GoManaged -->|start / ordered capture / finish| GoTraces
        GoManaged -->|successful terminal flush + capture capability| GoSkillCapture
        GoEntry -. owner-scoped list / inspect / export .-> GoTraces
        GoEntry -->|owned bounded document| GoTraceView
        GoTraceCLI -->|operator read| GoTraces
        GoTraceCLI --> GoTraceView
        GoSession -->|prepare all call inputs, then parallel groups / barriers| GoGate --> GoBash
        GoGate --> GoFiles
        GoFiles -. default syntax provider: source stdin / typed result .-> GoPythonParser
        GoManager -. owner / admission / lease / preview + commit .-> GoDraftLibrary
        GoSession -. standalone non-live preview .-> GoDraftLibrary
        GoSession -. caller JSON admission / owner memory .-> GoFiles
        GoGate --> GoResources
        GoGate -. explicit external-risk decision tool .-> GoDecisionLibrary
        GoDecisionLibrary -. isolated complete-only query .-> GoProvider
        GoGate -. optional five model tools .-> GoWorktrees
        GoWorktrees -. serialized files / shell / sandbox scope .-> GoFiles
        GoWorktrees -. prepare before publishing execution scope .-> GoBash
        GoSession -. injected state / leases / restore / catch-up / epochs .-> GoActions
        GoGate -. replay / search / settle .-> GoActions
        GoGate -. permission ask .-> GoApprovals
        GoGate -. decision-time masked permission events .-> GoSession
        GoResources -. textual question .-> GoApprovals
        GoApprovals -. scoped approval events .-> GoSession
        GoApprovals -. explicit / owned Guardian review .-> GoChildren
        GoSecrets -. bind gate / context / recording / shell .-> GoSession
        GoResources -->|task / depth gate| GoChildren
        GoChildren -->|shared efficiency root · scoped stores / settings · fresh ledger| GoContext
        GoChildren -->|selected tools| GoGate
        GoChildren -. scoped events .-> GoSession
    end

    subgraph DeepAgentsServer["deepagents-server/ · independent opt-in runtime"]
        DAAuth["Bearer authentication + owner scope<br/>private Threads · Runs · store namespaces"]
        DAAPI["Standard Agent Server API only<br/>submit Run → handle · poll / SSE / cancel<br/>0 execution slots"]
        DAWorkers["Independent background Worker pool<br/>2 concurrent slots by default · per-thread enqueue<br/>same immutable image · isolated execution loops"]
        DAGraph["Deep Agents 0.7.25<br/>planning / subagents · model-tool loop<br/>sync checkpoint durability per submitted Run"]
        DAFiles["Virtual files only<br/>StateBackend: per-thread checkpointed files<br/>/memories/: owner-scoped StoreBackend<br/>no host shell / local filesystem backend"]
        DADev["Local development: langgraph dev<br/>in-memory backend + local snapshots<br/>not production durability"]
        DAPostgres["Production PostgreSQL · durable volume<br/>pending Runs · claims · checkpoints · owner store<br/>crash/redeploy acceptance still open"]
        DARedis["Production Redis<br/>ephemeral wakeups · cancellation · events"]
        DAAuth --> DAAPI
        DAAPI -->|persist Run / return handle| DAPostgres
        DAAPI -. wake / inspect / cancel .-> DARedis
        DARedis -. notify .-> DAWorkers
        DAPostgres -->|claim queued / recover eligible Run| DAWorkers
        DAWorkers -->|save checkpoint / execution status| DAPostgres
        DAWorkers --> DAGraph --> DAFiles
        DADev -. local combined backend mode .-> DAAPI
    end
    subgraph TemporalPrototype["deepagents-server/temporal_prototype · optional experimental · default-off"]
        TPClient["Trusted local PrototypeClient<br/>start / query / cancel · fixed owner adapter<br/>not production HTTP or Temporal ACL"]
        TPHistory["Temporal CLI local dev server<br/>SQLite Workflow History<br/>not a production HA deployment"]
        TPWorkflow["Separate Temporal Worker · SDK 1.34.0<br/>real Deep Agents loop in Workflow<br/>full messages / files / todos snapshot at CAN"]
        TPModel["DeepAgentsPlugin model Activity<br/>model I/O stays outside Workflow replay"]
        TPFixture["TranscriptModel offline fixture<br/>no live model provider configured"]
        TPMemory["Named memory put/get Activities<br/>stable operation IDs · commit-before-ack fault gate"]
        TPApp["Application SQLite · local shared file<br/>trusted owner binding · memory · effect ledger<br/>not TaskControlPlane / outbox / HA storage"]
        TPClient -->|submit / inspect| TPHistory
        TPHistory -->|task queue / replay| TPWorkflow
        TPWorkflow --> TPModel --> TPFixture
        TPWorkflow --> TPMemory --> TPApp
        TPClient -. trusted owner binding .-> TPApp
    end
    subgraph TaskServer["deepagents-server/task_server · opt-in Task HTTP service"]
        TSClient["Task clients<br/>Bearer + Idempotency-Key + message"]
        TSAPI["Independent Task HTTP API process<br/>http → TaskService → backend · shared protocol<br/>submit · status · result · cancel · retained events<br/>202 only after remote Start confirmation"]
        TSHistory["Independent Temporal service / retained History<br/>stable TaskID / first Run · immutable request memo<br/>retained Run chain / signed per-Run event cursors"]
        TSConnection["Shared Temporal client settings<br/>CLI environment / explicit library object<br/>verified TLS · CA · mTLS pair · server name · API key"]
        TSLaunch["Independent Task image / role launcher<br/>non-root · role-specific secret files<br/>same-process API or Worker · external Temporal"]
        TSProcess["Worker process CLI lifecycle<br/>SIGTERM / SIGINT → SDK shutdown<br/>grace + hard deadline · library serve stays caller-owned"]
        TSWorkflow["Single TaskWorkflow · runtime.py<br/>Deep Agents · portable native saver journal<br/>CAN every 8 safe parent model boundaries · no Memory"]
        TSActivity["DeepAgentsPlugin model I/O Activity<br/>fixed openai:task-server deployment alias<br/>Temporal retry / heartbeat"]
        TSModel["ChatOpenAI provider<br/>model + credentials from Worker environment<br/>no public fixture selector"]
        TSClient -->|authenticated request| TSAPI
        TSLaunch -. API startup / liveness and readiness .-> TSAPI
        TSLaunch -. Worker startup / 20s container stop budget .-> TSProcess
        TSConnection -. startup client configuration .-> TSAPI
        TSConnection -. startup client configuration .-> TSProcess
        TSAPI -->|Start / inspect via optional verified TLS| TSHistory
        TSProcess -->|stop polling / drain claimed work| TSWorkflow
        TSHistory -->|SDK polling / replay via optional verified TLS| TSWorkflow
        TSWorkflow -->|bounded native checkpoint / Continue-As-New| TSHistory
        TSWorkflow --> TSActivity --> TSModel
    end
    DAProvider["OpenAI provider<br/>server-configured credentials / model"]
    Caller -. explicitly select independent module .-> DAAuth
    DAGraph -->|model requests| DAProvider

    Caller --> Entry
    Caller --> GoStartupEnv
    GoLaunch -. CLI main only .-> GoCLIEnv
    GoRemoteAudit -. CLI main only .-> GoCLIEnv
    GoCLIEnv --> GoStartupEnv
    GoCLIEnv -. inherited process environment .-> GoBash
    GoStartupEnv --> GoDotenv
    Caller --> GoDotenv
    Caller --> GoRemoteAudit
    GoRemoteAudit -. public health report .-> GoEntry
    GoManager -. template components / detached fleet diagnostics .-> GoRemoteAudit
    GoRemoteAudit -. local composition / owned shutdown without listening .-> GoLaunch
    Caller --> GoEntry
    GoEntry -->|GET lineage / POST proposal; bound owner| GoImprovement
    GoManager -->|fixed bus / protocols; owned idle loop / inbox / task claims| GoTeams
    GoEntry -->|owned team GET; peek latest 50| GoTeams
    GoManaged -. explicit verified task / proposal admission .-> GoSession
    Caller -. explicit typed observations .-> GoSelfAudit
    GoManaged -. owner admission before diagnostic / recording IO .-> GoSelfAudit
    GoEntry -->|report / suggestions / drafts; admitted owner scope| GoSelfAudit
    GoSession -. optional self_audit via ToolGate; trusted view .-> GoSelfAudit
    Caller -. supplied results / transcripts .-> GoBenchmarkLibrary
    GoEntry -->|authenticated fake-only comparison / rate budget| GoBenchmarkLibrary
    GoBenchmarkLibrary -. explicit operator arm create / run / stop .-> GoManager
    Caller -. operator owner directory binding .-> GoFiles
    Caller -. explicit operator evaluation .-> GoDecisionLibrary
    Caller -. explicit library selection .-> GoWorktrees
    Caller -. operator-owned background commands .-> GoBackground
    GoWorktrees -. pinned task files; execution scope switch .-> GoResources
    Manager -->|bind owner · create / restore / route| Session
    Manager -. preview current session .-> Drafts
    Manager -. explicit digest commit .-> Resources
    Resources -. new-session snapshot .-> Context
    Context -->|model request| Provider
    Provider -->|text / tool_use| Agent
    Gate -->|guarded dispatch| Backends
    Backends -->|masked result| Agent
    Gate -. approved typed query .-> Decisions
    Decisions -. typed result; no action .-> Agent

    Manager -. owns shared services .-> Coordination
    Coordination -. bounded next-turn injection .-> Session
    Gate -. explicit-human launch / manage .-> Workflow
    Workflow -. process-local read-only workers .-> Provider

    Session -->|persist transcript + cursor| State
    Gate -->|record action outcome| Journal
    Agent -->|emit spans + lifecycle| Trace
    Entry -. SSE / inspect / trace view .-> Trace
    GoContractInputs["Source fixtures · active Go source · test JSON<br/>current exporter manifest + separate platform captures"]
    GoContractAudit["Go contractaudit · explicit operator CLI<br/>literal / direct-call candidate links · hashes · test-root results<br/>no runtime authority · no semantic-parity certificate"]
    GoContractEvidence["Repository contract inventory receipts<br/>candidate references · branch conditions · observed test roots"]
    GoContractInputs --> GoContractAudit --> GoContractEvidence
    GoCI["Operator GitHub arm64 acceptance job<br/>fixed public images · Source then full / vet / race<br/>3 GiB · two cores · offline test containers"]
    GoContractInputs --> GoCI --> GoContractEvidence

Loading

The Deep Agents lane has its own dependency lock and standard Agent Server API. Compose separates the API (zero execution slots) from background workers (two slots by default); both use the same immutable image and shared PostgreSQL and Redis. A submission returns a portable Thread/Run handle after admission. The HTTP connection and later polling do not own execution lifetime. Independent Threads run concurrently; Runs on one Thread enqueue serially. The job client requests durability="sync" and provides status, wait, cancel and explicit null-input checkpoint continuation. A local wait timeout does not cancel work.

PostgreSQL owns pending Runs, execution claims, checkpoints and owner Store; Redis provides ephemeral wakeups, cancellation and events. Graceful shutdown allows 180 seconds, while Compose allows 210 seconds before termination. The pinned server bounds native execution attempts at three by default and each attempt at 24 hours. Eligible crash recovery and operator-requested continuation are different paths: a terminal model/graph error is inspected before resuming unfinished checkpoint tasks as a new Run. The client does not retry submissions automatically; request_id helps reconcile uncertain responses and does not enforce deduplication. Neither checkpointing nor retry guarantees exactly-once external effects, and SSE is not a durable token log.

Bearer authentication binds the owner before private resource access. Virtual files and /memories/ retain their thread/owner scopes; host shell and cron remain disabled. This module does not route through SessionManager or the Go tool gate. langgraph dev remains an in-memory development mode with local snapshots. Production worker crash/redeploy recovery requires the applicable license and a real PostgreSQL/Redis acceptance run; it is not established by a development snapshot test. Deployments must preserve token-owner mappings, persistent volumes and graph/checkpoint schema compatibility. See the module guide and long-task operating contract for commands, recovery limits and current validation evidence. The durable Task control-plane design compares execution backends and future SQL admission/outbox/quota layers. The current Task HTTP path below delegates authority directly to Temporal; it does not install those business database layers. This module remains independent of the original Python/Go business logic and runtimes.

The optional Temporal fault prototype is a separate experiment under deepagents-server/temporal_prototype, selected with the optional temporal dependency extra and an independent Worker CLI. Its Workflow executes the real Deep Agents loop; the SDK plugin schedules model I/O as an Activity. The configured model is an offline transcript fixture, so this path does not call a live provider. Owner-memory tools schedule named Activities against a separate local application SQLite file with owner bindings and an effect ledger. Virtual files and todos remain graph state; an explicit Continue-As-New boundary carries the full versioned snapshot.

The local Temporal CLI stores Workflow History in its own SQLite file. That History, the application ledger, and the standard Agent Server PostgreSQL are different data stores. Trusted local client checks are not production HTTP authentication or Temporal service ACLs. Prototype fault acceptance is reported separately; its existence does not establish production HA or capacity. The standard Agent Server API does not route into this prototype automatically. The separate Task HTTP service below uses its own versioned Workflows and live-provider adapter. Its new Continue-As-New protocol transports native saver writes; it does not inherit this prototype's memory ledger or snapshot protocol.

The opt-in Task HTTP server exposes POST /v1/tasks plus task status, result, cancellation and retained History-event pages. Bearer authentication chooses the owner; the service derives a stable TaskID from owner and Idempotency-Key. Concurrent API replicas rely on Temporal Workflow-ID admission: matching immutable request content reuses the task, while a different payload returns 409. A 202 response requires a confirmed remote Start or an owned matching existing Workflow. An uncertain Start returns an unknown outcome with the stable TaskID, and does not acknowledge local-only admission. This deduplication lasts within Temporal retention, rather than forever.

Its Python module structure keeps HTTP authentication/admission and response handling in http.py, task operations in service.py, and Temporal Run/History reads, signed cursors and readiness in backend/. The shared protocol.py has no HTTP or Temporal client dependency. These are in-process ownership boundaries; the diagram's API component remains one deployed role. Common Workflow determinism is isolated in temporal_support/. Repository-only tooling/acceptance/ separates executable fault scenarios from reusable support and offline fixtures, while scripts/ preserves existing command paths. The production wheel excludes this tooling.

Only runtime.py:TaskWorkflow is registered. Its existing Temporal name TaskWorkflowV2, payload version task-v2 and snapshot schema 2 identify the current serialized contract, not a second implementation. Obsolete V1 Tasks are no longer accepted or executed; this pre-production module has no V1 migration requirement. Matching current keys still reuse the same immutable request. Model Activities resolve a fixed alias to ChatOpenAI using Worker environment settings; HTTP input cannot select a provider or fixture.

The Workflow continues after each eight safe parent model boundaries, after preceding tools, subagents and summarization have settled. A bounded journal of public saver writes preserves native channels, routing, pending writes, DeltaChannel ancestry and private summary state; it is carried in Temporal History, without a second persistence service. The same TaskID and first-execution identity span new RunIDs. The original total 24-hour timeout is not reset, and the task is limited to 512 parent boundaries; this is not a bound on all model calls, including summary calls or the general-purpose subgraph. The latter retains its native 9999-step recursion setting; each parent invocation retains 128 steps. The transport refuses oversize state at 16 MiB raw journal, 384 KiB compressed checkpoint or 512 KiB continuation envelope. These budgets bound this protocol, not an unlimited-duration or constant-size History guarantee.

Native summarization triggers at 40 messages or 16000 tokens and keeps 12 messages; Workflow-owned time/IDs stabilize its state and archived virtual files. The native patch-tool slot also retains repair behavior in the parent and general-purpose subagent. Memory, arbitrary graph migration and universal custom-tool compatibility remain outside this implementation.

Status and results follow the verified execution chain; cancellation is pinned to its first Run. History events retain independent per-Run IDs and signed namespace/owner/TaskID/RunID cursors. Optional run_id selects retained earlier Runs, with verified first/previous/next navigation and an explicit incomplete flag when an adjacent Run has expired. Pages contain History metadata, not a durable token stream; API replicas share the deployment cursor secret.

The Worker CLI process handles SIGTERM/SIGINT with explicit SDK shutdown: stop new polling, allow already claimed or buffered work to drain, then ask unfinished Activities to cancel after the configured grace interval. A shutdown retry consumes the Activity's existing attempt budget; it does not cancel the user Task or reset its deadline. The CLI defaults to 2 seconds of grace and a 15-second hard deadline; a second signal or elapsed deadline exits the owned process with code 70. An unresponsive Activity then recovers through its native timeout and retry policy. Library serve does not install signal handlers or force process exit. These are process-lifecycle controls, not Worker Versioning, cluster-wide quotas or a capacity guarantee.

API and Worker share TemporalConnectionSettings and one eager SDK connection factory. Only their production CLIs load MINILOOP_TASK_TEMPORAL_*; library callers pass settings explicitly, with plaintext as the explicit default even when security variables exist in the host environment. TLS can use a CA, paired client certificate/private key, verified server-name override and API-key metadata. Security fields require TLS; invalid combinations, unreadable bounded files and connection failures stop startup without plaintext fallback. The server-name override controls SNI, HTTP/2 authority and certificate verification; there is no skip-verification switch. Credentials are loaded once, so rotation requires rebuilding the Client and replacing API/Worker processes. These settings protect client transport, not History payloads at rest or namespace ACL policy. The local mTLS fault tunnel is test infrastructure, not a deployed component; native Temporal server TLS, Cloud API-key authorization and cross-host HA remain separate acceptance.

The Task container profile builds from the locked Temporal extra and an approved fixed Python base image. It starts API and Worker through a same-process role launcher, with non-root containers, read-only root filesystems and bounded temporary storage. API receives only its HTTP token mapping and cursor secret; Worker receives its model key. Both may receive their own Temporal credentials. The existing licensed Agent Server Dockerfile/Compose remain a separate profile. API /healthz is process liveness; /readyz uses a one-second namespace RPC and one-second result cache, coalescing concurrent probes. Readiness requires DescribeNamespace permission and does not prove Start permission, Worker capacity or HA. Dependency outages must not be used as liveness failures. The container stop budget is 20 seconds, longer than the existing 15-second Worker hard deadline. A local container replacement test cannot establish multi-host fault domains or production Temporal/database availability.

This path uses no new business SQL ledger, admission database or outbox. The separate Temporal service owns execution and History persistence; production HA, retention, quotas and capacity remain deployment responsibilities and have not been accepted by this iteration's source/config changes. Per-process API and Worker bounds are not cluster-wide quotas. Raw Temporal access must be restricted to trusted API/Worker processes; HTTP Bearer checks are not Temporal service ACLs. The standard Agent Server, offline prototype and original Python/Go paths retain their own entry points.

The operator CI job is outside the deployed runtime. Its networked bootstrap fetches only the existing fixed public inputs; test containers receive the selected source and public dependencies with networking disabled. Evidence transport retains raw receipts and logs. Candidate discovery by contractaudit and executed CI assertions are separate evidence; neither grants runtime authority or changes feature defaults. Each actual Source/native cohort must share its revision, image, platform and six fixture overlays before it can be used for the final required-row transition.

The standalone go/sqlitestate library now opens a pinned SQLite connection, sets WAL/NORMAL/foreign keys, and applies Source schema-v7 creation and additive upgrades. Its schema/index/version/data effects match 22 actual Python database cases, including partial migration failures and unbounded version refusal. It owns connection cleanup; additive upgrades can survive a later open failure. It now implements agent.SessionStore and agent.LeaseStore with typed rows, immutable creation time, derived event cursors and detached Todo/steering metadata. Deletion uses BEGIN IMMEDIATE and rolls back operational rows on failure while retaining audit tables. Conditional lease UPDATEs preserve expiry equality and separate tenant identity from process ownership; two connections cannot both claim. Explicit cancellation checks precede SQL admission and transaction commit. Record reads use current typed Todo/steering variants and fail on unsupported metadata. TranscriptStore and EventStore now append behind BEGIN IMMEDIATE, preserving global message ordinals across epochs and retaining old history. Event ordinals remain distinct from live sequences; known historical events decode as untrusted metadata. DecodeStoredMessage reads large known histories without widening the network frame cap; tool input/caller boundaries and stored-event limits remain. The shared closed JSON reader copies ordinary string byte spans between quote, backslash and C0 delimiters. Escape parsing, surrogatepass values, malformed native bytes, duplicate-key replacement and strict final wire policies remain unchanged. Unescaped short keys/text are independently cloned so they do not retain a large input archive. Fourteen Source text/key recipes retain their 56 byte hashes and now also verify 56 decoded projections; syntax/control/raw-byte and backing-memory checks cover the changed reader. No observation becomes executable authority.

The shared closed JSON value encoder copies valid UTF-8 text spans between quote/backslash/control escapes. Valid scalar UTF-8 cannot contain surrogatepass code points; malformed bytes still use the original rune projection. ASCII archive text except DEL reuses this byte-equivalent path; Unicode, DEL and legacy surrogate escaping retain their original ASCII archive projection. Fourteen compact CPython text/object-key recipes compare length and SHA-256 for strict/legacy UTF-8, spaced UTF-8 and ASCII archive bytes, including large text, all C0 controls and scalar edges. Named variants, insertion order, nonfinite refusal, final UTF-8 policy and byte budgets retain their boundaries. This changes encoder work, not stored schemas or restoration/permission rules. The maximum decision case now passes its original shared budget in the focused race+atomic gate; broader runtime acceptance remains open.

Native action/approval SQL now completes agent.StateStore conformance. Upserts preserve original identity and creation fields; explicit transactional recovery marks started actions unknown without proving foreign effects stopped. Approval reads preserve SQL NULL versus empty tool-use IDs and restore no grants. Library-injected Manager restoration now has native database close/reopen proof: seven actual Source recipes plus a live Manager-created session retain history, metadata, repair epochs and resumed requests. Foreign leases prevent repair and model admission; Stop releases owned leases. launcher.Options.StateStore now forwards an explicit caller-owned backend; App.RestoreSessions delegates operator restoration without making it automatic at construction or Serve. Stop drains Manager work and releases leases but never closes that backend. Inspect reports process-local or injected selection without probing or asserting durability. Native HTTP tests reopen SQLite and retain owner-scoped transcript/resumed turns. Native cron/SQLite close-and-reopen tests now cover all seven scheduled Source restoration recipes and a real durable one-shot job. Jobs remain in .cron.json, while session history/leases use SQLite. Manager Start keeps restored jobs disarmed; operator arm triggers lazy restoration and a fresh untrusted turn. A further reopen retains run_count and the one-shot removal. A dedicated child test process now persists a request/lease, blocks in model generation and is killed without Stop or Close. Another process preserves the foreign lease until expiry, then reloads, repairs the unanswered user turn and resumes; a later reopen retains run_count=2. This proves one process-kill generation window, not power-loss or external-effect atomicity. Other crash windows and wider archival profiles remain pending.

Go Manager selects an off/normal shared efficiency root by default. Library callers can configure ManagerEfficiencyConfig or inject ManagerServices.TokenEfficiency; Start initializes once without granting service authority. Writable default catalogues in enforce mode receive private masked RAM stores and recovery tools; readonly and caller-owned catalogues are not automatically widened. Same-workspace template stores retain shared identity. Delete releases the last live session holder after consumers drain; Stop drains sessions, cron, workflows and cleanup, then closes all distinct stores before shared components. Source lifecycle reports and store selection are checked against 14 captured Manager scenarios. Launcher settings now select mode/style in Launcher and benchmark composition. Switched-workspace writable enforce children allocate fresh stores from detached settings only when recovery survives role selection. Child-created stores are transient RAM; old workspace refs stay confined to their original store, while component lifecycle remains shared.

The main diagram describes the current Python runtime under python/. The separate Go subgraph is a process-local port in progress with an embeddable HTTP handler and a standalone go/cmd/miniloop launcher. It runs independently of Python, embeds the default code-review skill, and owns listening and shutdown. Default trajectory files are enabled and private spill storage is best-effort; configured but unavailable optional features refuse activation. Executable startup loads dotenv from cwd/ancestors with Source frozen-program semantics, then passes one prepared environment snapshot into typed settings/auth and checks the requested host and actual listener before admitting unauthenticated traffic. --dump-config reports redacted settings/availability without creating a runtime or probing a model; it is not the full Python effective-posture report. See Go startup. Explicit RuntimeConfig.PlanModeTools / ManagerServices.PlanModeTools add enter_plan_mode and exit_plan_mode through the same execution gate. Both stay registered while inactive and remain exclusive read-risk tools. A whole boolean plan_mode event records every successful call, including repeated entry; restore folds the log's last value. The default system builder adds soft planning guidance, while custom builders receive SystemContext.PlanMode and choose their own prompt. Sandbox/permission modes remain independent. Optional PlanApprover receives typed plan text and bound caller authority; rejection, fault or cancellation retains planning. Nil uses Python's headless auto-approval. Inactive/invalid/rejected plan results keep source error text with failed=false; callback/hook faults set failed=true. Journal settlement, observers, events and stuck steps preserve that distinction. Model result blocks omit is_error. --plan-mode-tools selects this individual service; no human approval UI is implied by that flag. Forks start inactive. Selected child handlers own fresh state; default role profiles omit these capability-free tools. Stored-event SSE and trajectories carry the boolean event, and injected-store restore reloads it without starting a turn or recovering reviewer authority. Native SQL restart and the combined feature bundle remain open. See Go plan mode.

The five Go goal tools are individually selected by GoalTools or --goal-tools. Create/resume require caller-stamped explicit human provenance; authenticated HTTP, cron and peer turns do not provide it. Complete/block use revision CAS. The default stateless GoalContinuation stop hook requests bounded continuation and blocks at the cap. An explicit StopHooks list replaces it; an empty list turns the consumer off. Goal records are per-session facts, with detached owned GET /sessions/{id}/goal projection. Concrete goal_change snapshots reach capture/trajectory/SSE; restore folds them but always disarms. Forks and selected children start fresh. No native SQLite durability is implied by injected-store restoration. See Go goals.

go/decisions now provides named Request/Result/Question/Answer/TokenUsage and an explicit Provider seam. State and descriptions use six closed JSON variants; choice distributions, probability-weighted score rubrics and noul probabilities are validated without changing the provider's answer. Jev uses the source fixed URL, disables redirects, bounds the full call including retry waits, and retains the actual served model and usage. Construction performs no network request. The operator library remains available independently. Explicit RuntimeConfig or ManagerServices DecisionTools now binds the external-risk tool through the common gate; provider injection alone does not activate it. Both backends receive masked, revalidated explicit state and share model limits. The LLM child uses a fresh complete-only query with no parent history/tools/cache/stream/meter, shared recovery and isolated fallback. Typed metadata reaches existing event sinks; full masked input is private trajectory evidence. Default-off, readonly and approval guards remain authoritative during replay. The interactive map aggregates bound decision handlers in Session Resources and transports in Go providers; its Go-path card explains the isolated query. The Go launcher now accepts MINILOOP_DECISIONS=llm or jev, retaining explicit backend precedence and credential-free inspection. Source snapshots cover large-result retention and cooperative cancellation. Go additionally masks the closed result before escaping to prevent encoded backend model values from leaking through output/journal/recording sinks. Native SQL decision restart is verified by go/sqlitestate/decision_restart_test.go; live-provider audit remains open. See Go decisions.

go/userresources now separates user-authored skill fields from agent skills. Its pure typed constructor validates and normalizes canonical SKILL.md content; owner directory keys hash exact trusted identifiers without trimming or folding. An explicit DirectoryResolver now pins the configured physical root, creates private 0700 digest/skills/memory directories, refuses pre-planted child links and caches immutable exact-owner bindings. It is an operator filesystem library, aggregated with filesystem backends in the interactive map. Optional launcher configuration and authenticated capture/publication are implemented below. skills.NewLayeredCatalog now provides explicit agent/user provenance, collision refusal, a shared prompt budget and source-owned serve-time verification; it is available through explicit owner-bound RuntimeConfig and ManagerServices snapshots. go/memory now provides typed Markdown Store/ScopedStore libraries: exact owner keys, scoped replacement, lexical search, lazy index/cache and secret masking. Explicit RuntimeConfig.MemoryTools now installs typed remember/recall through the common permission gate. Runtime construction requires a matching scoped store or uses the admitted owner resource bundle; ManagerServices.MemoryTools selects these tools with an explicit resolver. Model inputs contain no owner/root. Selected children retain the bound store, and read-only mode denies writes. Explicit remember acquires the Store-owned process-local lifecycle lock; scoped bindings of the same Store share it. Waiting is cancellable. Ordinary scoped operations use a separate lock, allowing extraction/consolidation to hold the lifecycle across multiple operations. This is neither rollback nor external process fencing; independent Store instances do not share the lock. With both tools selected, automatic memory selection now uses a 200-token side request, falling back to lexical search. It injects selected provenance blocks after prompt rewriting and before the user message is appended. The side request uses normal model/recovery/limiter/cache/event flow without changing the live token meter. An explicit false MemoryAuto disables selection; its value is detached. The dynamic index appears only with recall, and is appended only when it changes. The extraction stage now cleans recalled contexts, runtime facts and tool-result bodies, sends the source 40,000-character JSON tail, and writes at most five owner-bound auto_extracted records incrementally. Its normal agent_turn side request uses recovery/cache/transport/events without taking live history or token meter ownership. Automatic capture now holds the lifecycle across extraction and consolidation on a normal final answer, a stop-hook continuation stuck halt, and round exhaustion. Read-only mode, MemoryAuto=false or a missing tool pair skip it. Provider-error and cancellation exits initiate no capture. The source's tool-batch stuck halt has no capture call; Go preserves this measured omission. At ten owner memories, a 2,500-token memory_consolidation side request replaces only the bound owner's records, retaining unchanged origins and marking changed facts consolidated. Ordinary capture failures emit a bounded masked memory_capture_error and preserve the completed result; cancellation and native transcript/lease failures propagate. Typed memory/extract counts and capture errors support detached access and archival reads without granting authority. Default tools and launcher activation remain unchanged. Root configuration remains pending; carrying a bundle alone installs no tools. userresources.NewResolver now composes exact-owner directory, layered skill and bound memory snapshots, caching only complete bindings. Its operator problem view preserves owner-local logs and skips shared deployment diagnostics. Explicit ManagerServices.UserResources now resolves trusted owners before create/fork/restore session construction; RuntimeConfig.UserResources validates a complete matching owner bundle before filesystem effects. Sessions and selected children keep their fixed catalogue and scoped memory binding; forks resolve the latest cache. The nil default keeps legacy skills. Launcher activation remains pending. Operator-only publication is implemented. go/durable adds the publication prerequisite: component-wise no-follow directory opens, bounded regular-file reads and fsynced create-only hard links. The hard link is the commit point; post-commit cleanup cannot turn success into a retryable error. Catalog.WithSourceDocument prepares a detached, path-ordered snapshot without filesystem effects, using the normal parser and retaining full source verification. It refuses name/path collisions and carries an independent bounded diagnostic log. Resolver.PublishSkill composes canonical validation, raw-field secret screening and health checks, fresh disk collision checks, bounded no-follow idempotent verification, prepared receipts/catalogues and create-only files. Successful publication replaces only the resolver cache for future resolutions, preserving live snapshots and the bound memory service. It remains an operator library. Typed process-local draft storage, model preview, admitted-turn projection and owned HTTP skill routes are implemented below; launcher memory roots and independent selection are implemented. Custom maskers without a typed registration surface fail closed.

go/background is an explicit operator library; native runtime sessions can select RuntimeConfig.BackgroundTools. Typed task IDs/statuses, independent contexts and native process groups let admitted commands outlive the caller turn. It shares shell argv, credential scrubbing/injection, masking and bounded cleanup with foreground execution, while merging stdout/stderr and counting raw bytes. The default capture is five million bytes; rendering keeps the tail at 50,000 characters and names overflow/nonzero exit. Foreground Interrupt excludes background groups. CancelAll requests cancellation and returns joinable handles; Close cancels and joins the current handles; Close requires caller-owned admission quiescence and permits later Run. The workspace .background ledger masks commands before atomic best-effort writes. A new manager reports orphan outcome/PID liveness without re-running or signalling the PID. It is evidence, not session/process recovery or ownership. Full results retain 100 completions, listings and notification projections keep the newest 50; metadata and undrained notifications still grow like Python. Rebind prepares future cwd/sandbox together; admitted tasks stay pinned and the ledger retains its original root. Go cleans cancellation even before process start, where actual Python can leave running metadata and an orphan record. Two optional tools use the common gate and exact typed inputs, including null identity and shell approval prefixes. Enabled Bash can enqueue explicit/heuristic background work; foreground Bash keeps structured results. Per-session lazy state delivers the newest 50 completion messages and a typed background_result event before model requests; interruption markers name live survivors. Workspace entry publishes a prepared background executor with the other bindings. ManagerServices can explicitly enable the feature for fresh sessions and forks. Delete/stop close and join created task ownership after the active turn drains, before workspace reclamation; an idle background owner is cleaned asynchronously. The startup --background-tools flag selects this service independently of the still unsupported comprehensive MINILOOP_FEATURES bundle. Explicit role selection of background tools gives a child independent task state and a qualified ID prefix; the parent retains its scope for recursive lifetime cancellation/join after the child returns. Queues and checks remain local to each scope. The root adopts existing evidence before admitting children; a child never adopts the live parent's ledger. Default roles keep foreground Bash and omit these tools. Root restart adoption reports qualified child records without controlling their PIDs. This adds guards around an actual source gap: inherited source injectors can orphan a live parent's record, and child return has no automatic service close. No host lease or cross-process/shared-session ledger arbitration is claimed. Bare library callers quiesce admission before CloseBackground; retained child metadata/queues are not globally bounded. Default tools remain ten. See background library. go/cron is an explicit operator library: named job/session IDs, five-field matching, per-session cancel/arm, masked atomic files and exclusive minute claims. Restored jobs stay disarmed until an operator authorizes them in this process; activation is never persisted. Occurrence marks and one-shot removal are saved before dispatch, so save/claim failures report lost work and never dispatch it. The manager owns a scheduler by default, matching Python, and resolves live sessions into fresh untrusted ManagedSession.Run turns without retaining the scheduling caller's actor or grants. Owner-scoped library operations hide foreign sessions/jobs. Delete removes future jobs before scratch cleanup; stop revokes turn admission, drains sessions, then cancels/joins cron. Standalone Serve starts loaded jobs without arming them. Explicit CronTools / --cron-tools installs schedule_cron, list_crons and cancel_cron through the common gate. Arm is confined to the owned operator HTTP/library surface. Four HTTP operations work independently of model-tool activation; fork retains activation with fresh jobs, while selected children report unconfigured. Durable session restore remains pending. Raw operator Start remains explicit. Independent live writers still hold stale whole-file state; claim files do not transact with external effects or prove exactly-once execution. See cron library. go/worktrees is an explicitly selected library service: named records and task binding, Git status/ahead checks plus Git's independent refusal, and local JSONL audit events. Factory failures can return plain directories, matching Python; that fallback is not a Git branch. agent.NewWorktreeWorkspaceFactory(service) explicitly adapts this service to ManagerConfig.WorkspaceFactory, without installing model tools. Factory paths are scratch, matching Python: ordinary delete removes even dirty directories after draining/shared-reference checks, but leaves Git registration and branches. Stop and PreserveWorkspace retain them. An explicitly supplied CreateSessionRequest.Workspace instead passes owned/bindable admission and remains after deletion. The model/operator service Remove API has independent dirty/ahead and native Git guards; manager directory cleanup does not call it. This is an actual Python cleanup gap, not a pending source Git-aware reclaimer. RuntimeConfig.WorktreeTools / ManagerServices.WorktreeTools installs five typed model tools through the common risk/permission gate. enter_worktree is an exclusive barrier even with a custom execution classifier: it prepares files, shell/sandbox, approval/question surfaces and the replacement catalogue before publishing execution scope. Later model context, hooks, tools and fresh children use that scope. Manager Info, task HTTP roots, trajectory attribution and scratch cleanup retain the original lifecycle workspace, so deletion preserves entered work. Initialized task boards remain pinned; lazy first admission after entry uses the new root. Fresh in-process children bind current files/shell but start without the parent worktree service/task board; selected worktree tools report unconfigured. The default system builder follows SystemContext; supplied fixed prompts retain their source contract. Built-in shell rebinding retains secrets, spill, deadlines, capture and interrupt ownership; custom executors require an explicit workspace factory. Comprehensive feature activation remains pending. Go additionally reclaims unpublished scratch on construction failure; with a Git factory this removes the directory while leaving registration and branch, unlike Python create, which leaves the allocation. Audit append is not a transaction with Git/task binding or a host ownership/lease boundary. The solid Python path is one ordinary turn; dotted paths are optional or asynchronous. The Python default agent skills now resolve from python/skills/ regardless of the current working directory; MINILOOP_SKILLS_DIR still overrides it. The Go port types all ten Python default tool inputs, but its immutable workspace catalogue registers bash, read_file, write_file, edit_file and glob through NewWorkspaceSession; the older NewSession convenience constructor still registers Bash only. File effects bind one resolved workspace and check paths at execution; write permissions use the same resolver. This file boundary does not provide OS shell confinement. Glob preserves Python filename matching, filters resolved results to the workspace and budgets enumeration before sorting and deduplication; it supports cancellation and bounds open directory handles. NewRuntimeSession adds TodoWrite, load_skill and ask_user through that same gate, with state bound to its session and owner. It uses explicit skill and textual-question interfaces; a nil skill source is an empty catalogue, and a nil question surface reports unavailability. The deployment skill loader snapshots bounded bodies and descriptions and verifies the normalized source hash at load time. User-scoped skill layering remains pending. Todo, stop and stuck events, model/tool spans, text phases, activity labels, compaction receipts, approval events and scoped child events share a typed, sequenced 200-event backlog. Bounded subscriptions retain the newest 2,000 live events; late replay excludes ephemeral deltas. EventsAfter returns only the available in-memory suffix. HTTP/SSE replays that bounded suffix; durable cursor gap recovery remains pending. RuntimeConfig.EventSink receives detached, masked records in publication order; failures become bounded diagnostics and do not abort the turn. A slow synchronous sink can delay the emitter. Sinks may inspect ManagedSession.Info, event snapshots or subscriptions, but must not recursively emit or call the blocking Messages accessor during a run. Model requests consume one fitted, immutable schema snapshot and the deployment skill descriptions. Provider usage anchors the token meter; unrelated summary calls do not change that anchor. Workspace-backed sessions use the four-layer compactor, which writes bounded tool-result previews and full transcript archives inside the bound workspace before generating a summary. Empty or failed summaries preserve the transcript. NewRuntimeSession also registers compress; it crosses the write-risk gate and defers the summary until the whole tool batch is paired. The Bash-only constructor uses in-memory snip/micro for an unbound injected executor; a real workspace-bound executor selects the workspace compactor. Internal automatic compaction can write workspace artifacts even with a readonly tool mode, matching the Python ordinary-agent path; a read-only worker must explicitly select InMemoryCompactor. Default cache annotation projects at most four ephemeral breakpoints into a detached wire request, including summary calls; raw transcript blocks retain no cache fields. The system prefix takes one slot, with eligible user blocks selected at the Python stride. RuntimeConfig.CachePolicy can select NullCachePolicy or a custom typed policy. The fake counts annotated wire payloads and enforces the four-point ceiling; real provider reuse and savings have not been verified. Existing system block-list input and user-resource prompt sections remain pending. Optional RuntimeConfig.Secrets binds a typed registry to the gate, compactor, event backlog and approval surface. Tool results are masked after post hooks and before journal settlement, observers and model results; raw executed arguments and live model-call history retain their original values. Deployment masking remains off by default. Registered values resolve lazily and stay cached until explicit re-registration; failed lookups retry after 60 seconds and unresolved or short values are reportable. Matching includes interleaved ANSI controls, Unicode characters and longest values first. JSON recording projections mask strings and keys before final escaping, with bounded size/depth and last-value key collision semantics. Default compaction masks spill files, archives and summaries; fresh children retain the same registry. Typed environment APIs scrub registered names and select only names mentioned by the command. The real go/shell.Executor consumes this environment before spawning /bin/sh in its bound workspace. RuntimeConfig.Secrets creates a credential-scoped executor copy; copies retain the shared explicit interrupt tracker. Full captured streams are masked before rendering/truncation, including credentials split across pipes. The shared capture budget is 5,000,000 decoded characters, preserving Python's existing "bytes" notice; stdout and stderr retain their own channels otherwise. A 120-second default deadline covers process exit and pipe EOF. Cancellation, timeout and overflow kill the new process group; bounded repeat signals cover a child joining during a concurrent fork, including explicit interruption. Cleanup closes pipe readers after a further bounded five seconds if a detached child still holds them. A descendant that deliberately starts a new session is outside that group and is not reclaimed by group cancellation. The gate preserves structured failure and detached exit/timeout/overflow/duration metadata for observers; replays retain stored text without inventing fresh process metadata. Legacy injected string executors remain supported. Host execution is the default: workspace cwd and the typo blocklist do not provide shell confinement. A typed rebinding Sandbox argv seam binds the opt-in go/sandbox Seatbelt backend. NewDefault protects the host credential paths, adds operator exclusions, and returns an explicit unavailable wrapper outside supported hosts; Require instead refuses construction. Paths use separate -D parameters. Workspace entry replaces ordinary writable roots, retains explicit extra roots and rediscovers shared git metadata. Actual macOS tests cover command execution through this shell executor, including read/copy/write denial, network opt-in and worktree commits. This is a filesystem/network boundary, with no CPU, memory or PID caps. A read deny-list does not protect unlisted copies of secrets. No sandbox is installed implicitly. Runtime process tests ran on macOS; Linux process-group code has not been run on a Linux host, and other platforms reject executor construction. Typed HTTP JSON and SSE data now use the optional recording projection; durable-storage and optional-feature sink coverage remains pending. The explicit go/provider.Client sends typed Anthropic-compatible requests over HTTP, retaining cache annotations, served-model identity, signed thinking and default-tool input variants. HTTP retries match the pinned Python SDK 0.107.1: two retries, selected status codes, retry override headers and bounded SDK backoff/Retry-After rules. Request and reply bytes are capped, contexts own calls/waits, redirects are refused, and diagnostics scrub the configured API key, bearer token and custom authentication header values. Explicit typed provider.Config.AuthToken and ordered Headers support SDK header precedence for direct and streaming requests. Construction captures header values; later caller edits cannot change request authority. The adapter consumes explicit credentials; Launcher captures ANTHROPIC_AUTH_TOKEN and ANTHROPIC_CUSTOM_HEADERS in secret settings. A nonempty Settings API key suppresses environment bearer selection, matching Python Settings/provider_for. Explicit empty environment keys retain an empty header alongside bearer auth. Snapshots and configuration reports discard these live credentials. Explicit Config.Credentials adds a context-owned token provider and one shared process-local cache per Client, with SDK 120/30-second refresh windows, five-second advisory failure backoff and one token-endpoint 401 forced retry. Static effective auth headers bypass dynamic fetch. Dynamic auth adds the OAuth API beta flag; model 401 does not invalidate or replay a request. Request-local client projections scrub their own token even during concurrent rotation. Waiters can cancel; provider callbacks must honor contexts. Explicit invalidation does not fence an in-flight fetch or external effects. Explicit provider.NewFileProfile now reads named configuration, re-reads guarded credential files and performs user OAuth refresh through the same cache. The profile's base URL owns token exchange; a supplied model base URL retains precedence for model requests. Workspace headers are copied into caller configuration. Refresh writes a unique private 0600 temporary file, syncs it, atomically replaces the credential file and best-effort syncs the parent. Unknown credential extensions survive; named credential fields remain private. Profile construction does not discover the environment. Explicit provider.NewFederation now exchanges a named immutable identity assertion with the jwt-bearer grant. Literal assertions are captured; projected token files are reopened on every exchange and follow their rotated symlinks. Federation sends both beta flags only to the token endpoint. Scope is informational; organization/rule and optional service-account/workspace fields retain named request ownership. Token replies are bounded to 1 MiB, assertions to 16 KiB, and callbacks/errors cannot expose secret diagnostics. The same Client cache owns reuse and forced exchange retry. FileProfile now dispatches oidc_federation with required selection checks before disk reads. Its private file cache survives client reconstruction, reuses tokens with more than 30 seconds remaining, and supports forced bypass. Invalid expiry re-exchanges; atomic writes preserve refresh-token/extension fields. Filesystem write failure leaves the exchanged token usable in memory. Profile credentials retain private-file guards, and workspace selection belongs in federation's token body.

protocol.TokenUsage now models cache-creation buckets, inference geography, thinking-token details and server-tool request counts with named nested types. Its codec preserves absent/null/value and closed future extensions; clones detach mutable fields. WithSDKDefaults explicitly materializes nullable SDK fields. Event projection masks metadata strings and extension keys/values before escaping, without mutating authoritative usage. Stored event decoding retains this shape. Native text_editor_code_execution_tool_result replies retain a closed view/create/replace/error union. Named content, file type, update flag, lines, nullable integer line metadata and nullable error messages preserve SDK values, including integers above machine width. SDK null defaults and sparse/history forms stay distinct. Immutable extensions, masked clones and SQLite reopen retain all 48 SDK captures. Stream caller decoding is selected by block kind, so opaque caller extensions on editor observations are preserved while client caller validation stays intact. Editor observations do not read, create or modify files. The selected native SSE path reparses nonempty accumulated tool input with a separate jiter-compatible partial decoder. Completed fields and nested containers survive EOF; incomplete scalar members are omitted. Empty deltas retain initial client/server input. Invalid syntax is refused at its input delta, before block stop. Raw buffers remain bounded before parsing; stopped values still pass named client ToolInput or observational ServerToolInput validation. Named read-only SDK observations preserve legacy NaN/Infinity at snapshot/archive boundaries; standard request and event JSON encoding remains finite. Strict complete JSON syntax and archival decoding remain enforced. All 98 SDK input snapshots and 42 jiter edges match the boundary decoder; 78 finite client and server captures match final content, history and SQLite reopen. Finite Bash non-mapping roots retain named binding failures, settled after hooks and permission without invoking the handler; all 51 captured actual Source consumer cases match. The four captured nonfinite client/server inputs survive direct/SSE snapshots and SQLite message reopen; two named client tool events survive SQLite reopen. Valid next-request transcripts fail finite encoding before transport. Broader known-field consumer adaptations remain open. Four managed memory/SQLite HTTP turns now preserve the captured Bash observations in SSE and live archives. Their action journals refuse finite input fingerprints before creating authority; before/guard run, after is skipped, and result receives the encoding failure. Detached observation queries and cache-bearing request estimates retain legacy numbers; standard request/event JSON remains finite. Native managed trajectory model snapshots now preserve the captured Bash NaN/Infinity observations through actual JSONL writes and fresh readers. Four Source/native cases cover content on/off, decoded key/value masking, cache-bearing next-request messages, and unchanged live inputs. Request optimization uses detached observation values and retains the protocol shape guard; actual transport encoding stays finite. Broader nonfinite historical consumers still need separate proofs. Actual SQLite close/reopen and Manager restore now retain the two captured Bash observations, restore interactive mode, and re-decode catch-up records as untrusted. Neither restoration nor catch-up creates actions or invokes handlers. A resumed model request retains the observation and fails finite encoding before transport. Declared ToolCaller variants retain unknown fields as immutable extension metadata across client/server tool-use and web-search/web-fetch replies. Direct caller tool_id is retained as an extension; typed ToolID remains empty. Code-execution caller IDs now use named SDKMetadataText observations for empty, null, numeric, boolean, list and object values; a missing ID normalizes to null. ToolID is a string-only projection; explicit CodeExecutionToolCaller construction still requires nonempty text. All 160 fixed-SDK direct/SSE captures cover four block kinds and both code caller tags, retaining the original 48 cases unchanged. Caller metadata is masked with keys and values, cloned without mutation, and retained through archival decode and SQLite reopen. Network decoding remains bounded; historical callers follow the parent archival policy. Provider admission also retains unknown/missing/null/non-text discriminator values, scalar/list caller roots and NaN/Infinity in an immutable named SDKCallerObservation. Another 224 pinned SDK direct/SSE captures cover these profiles. List mapping elements receive the SDK's first-branch type: null default without adding a missing code caller ID. Historical decoding never reapplies these defaults. Legacy history, masking and SQLite reopen preserve the complete observation; ordinary network JSON remains finite. Eight real SDK forwarding cases and three actual Source Agent runs establish that a safe tool executes before a nonfinite caller fails next-request encoding, with no second transport request. Strict public caller decoding still refuses unknown roots. Observations never replace the enclosing tool-use ID or grant tool, owner or permission authority. The SDK's 12 declared ContentBlock kinds are represented; complete provider and default-path parity still require the remaining field/consumer audit. Native bash_code_execution_tool_result observations use a separate named result/error union, output files, stdout/stderr and shared ExecutionReturnCode. Five SDK errors include output_file_too_large; future codes and extensions survive. The Bash result and file tags remain distinct from ordinary code-execution tags. Stream null defaults, sparse/history codecs, masked clones and SQLite reopen retain all 26 SDK captures. Provider Bash metadata does not select the client Bash tool, execute commands, open output files or require client result pairing. Native code_execution_tool_result replies retain ToolUseID and a closed ordinary/encrypted/error content union. Named outputs preserve file IDs, stdout or encrypted stdout, stderr and an ExecutionReturnCode integer without machine-width truncation. Immutable extensions survive at root/result/output/error levels. SDK stream defaults are explicit; sparse/history codecs retain omission and larger outputs. All 28 SDK captures survive SQLite close/reopen. File IDs and encrypted text stay observations; this layer does not execute code, open files or decrypt. Native web_fetch_tool_result replies retain ToolUseID/Caller and a closed fetched-document-or-error union. Fetched documents have named URL, retrieved time, title, citation configuration and a closed text/PDF source with verbatim data and media type. Root/result/document/source/configuration extensions stay immutable. SDK ingress selects nested null defaults and observed stream-only null fields; sparse/history codecs preserve omission and larger frames. All 42 SDK direct/SSE captures survive SQLite close/reopen, with invalid named UTF-8 fields rolling back the batch. Fetch observations do not open URLs/documents or execute client tools. Native server_tool_use observations retain named ID, ServerToolName, ServerToolInput and optional ToolCaller. The SDK declares input as an object without individual input fields, while actual SDK decoding also retains finite non-mapping roots. Its named Go wrapper owns an immutable closed JSON tree. Twelve actual client/server SDK direct captures retain these roots through forwarding and history. Root extensions and sparse/null caller state survive forwarding and history. SSE input fragments accumulate through the partial decoder, while empty fragments leave initial input intact; stopped values undergo named domain validation. These observations never select client execution or require client tool-result pairing. SQLite reopen preserves all 32 SDK captures. Native tool_search_tool_result replies retain a named ToolUseID and a closed references-or-error union. Tool references preserve their names, including names outside the client registry; errors preserve code and nullable message. Immutable extensions survive at root/result/reference/error levels. SDK direct/SSE defaults include null error messages and stream-only null text/citation/parsed-output fields. Forwarding, masking, cloning and historical codecs retain this observational data; references do not register tools or enter client tool dispatch.

Native web_search_tool_result replies use a named ToolUseID and Caller with a closed results-or-error content union. Results retain title, URL, encrypted content and nullable page age; errors retain a named error code, including captured future codes. Immutable extensions survive at root/result/error levels. SDK caller/page-age null defaults are selected at transport ingress; archival codecs preserve sparse shape and support historical frames beyond the network bound. These server-side observations are forwarded and masked, and do not enter client tool dispatch.

Native replies also accept container_upload through a named ContainerUploadBlock with FileID. Direct and SSE captures preserve the SDK wire projection, including SSE-only null text/citation/parsed-output fields. It stays inert transcript metadata; client tool dispatch still selects only tool_use. Forwarding, clone isolation, masked projection and stored-message decoding retain the same closed variant.

Direct HTTP and SSE now decode complete named usage, preserve closed extensions and apply SDK null defaults, including missing nested counters. SSE updates server-tool counts according to the SDK accumulator. Named UsageCount observations preserve scalar/structured values; Source metering projects only numeric variants. Native integer and finite float bounds remain explicit. Direct/SSE integration verifies masked usage in actual SQL event payloads before and after database reopen, typed archival reads and resumed writes, and newly opened recording readers over private JSONL files. Complete provider scope acceptance remains open. Both profile grant paths use the Source 30-second default token timeout. Launcher now selects explicit profiles (including active pointers), complete environment federation, then fallback profiles when API key/auth token are undefined. Defined empty static credentials suppress discovery. A defined empty auth token still emits Authorization: Bearer , matching SDK presence semantics; an empty key alone remains missing request auth. Explicit profile faults occur at construction; bad fallback profiles defer missing-auth refusal until requests. Fake providers bypass discovery. Selectors are captured; projected files and explicit identity readers can rotate. Real CLI process identity reads remain live independently of dotenv selection; explicit SDK environment maps retain captured literals unless given a reader. Snapshots discard live selection. Borrowed ProviderTransport remains caller-owned, and ProviderNow is an optional clock seam. The launcher explicitly passes its validated environment settings. This adapter supplies SDK-level retry; the session now applies separate default Agent recovery: at most ten transient retries, bounded outer waits, token escalation, whole-answer continuation, one reactive shrink and optional fallback model. Backoff waits release shared model permits. Context overflow retries only after request shrink, and mirrors paired live history explicitly. Fallback selection persists per session; children inherit the policy with fresh fallback state. A nonempty modern/explicit model takes precedence over legacy FALLBACK_MODEL_ID, which is captured at Recovery construction. Explicit environment maps retain their own legacy input and never fall through to the ambient environment. The model is not stripped or capped at 512 bytes; provider admission remains independent. Default Launcher/benchmark managers defer construction to each session; an explicitly injected Recovery remains shared and takes precedence over default configuration. Existing sessions and their child policies keep the captured value. Explicit provider.NewStreaming adds bounded SSE assembly and validates text, signed thinking and complete tool JSON before returning a final reply. Per-session StreamingProvider progress defaults to coalescing at 200 Unicode characters or 200 ms on fragment arrival. Explicit captured StreamProgressConfig thresholds propagate through manager/fork/child construction; zero or negative values flush every nonempty fragment. Clock callbacks must be concurrency-safe when shared. A fake client owns an atomic message-ID sequence, prepends signed thinking by default, and exposes an explicit streaming view that lifts the direct ceiling. Thinking, responder, delay and ceiling settings are typed and explicit; the standalone launcher captures MINILOOP_FAKE_DELAY and passes it at fake-client construction. Fresh ephemeral stream IDs correlate provisional commentary with authoritative final/commentary events; progress never replays. Only shown answer text is preserved on managed cancellation, and successful streams clear partial state, including internal summaries. Body drops surface to Agent recovery as a fresh generation, whose stream_start supersedes prior progress. The protocol text block now owns immutable named citation variants for character, page, content-block, web-search and search-result locations, including arbitrary-size signed indices and absent/null metadata. Unknown or malformed SDK citation data is preserved as closed JSON extension values; cloned requests and storage encoding retain it, and recording projections mask keys and values. These values describe provider output and confer no execution authority. HTTP replies normalize missing SDK fields and validated integer coercions; SSE appends initial/delta citations in order without emitting text progress for citations. Default streamed text retains parsed_output: null; structured output formats remain unsupported. Request text rewrites retain immutable metadata. Thirty-five actual SDK mock HTTP cases and two streamed/forwarded cases pin this profile. Search/server-tool content blocks remain unsupported. Production endpoint/cache savings are unverified. The Go session uses one typed gate for rewrites, guards, permission, execution and observers. Its event backlog, approvals and cancellation repair are process-local. RuntimeConfig.ActionJournal optionally binds a replay journal: final rewritten inputs are hashed after guard/permission checks, terminal results replay through post hooks, and unknown actions only retry after a verifier proves non-landing. write_file has a workspace-bound verifier; Bash has none. Typed settlement precedes result observers; cancellation settles as cancelled. The memory journal keeps every action identity while bounding retained result text. StoredActionJournal supplies transitions over an explicit ActionStore; the native go/sqlitestate backend implements action/approval storage and recovery (audit_test.go); storage remains explicitly selected. agent.SessionRecord and separate session/transcript/event/lease/approval-read contracts model the v7 projections. DecodeStoredEvent reads current known event variants into detached typed rows; historical provenance has untrusted authority and cannot reinstall human grants. RuntimeConfig.StateStore and ManagerServices.StateStore now opt into live session projection, pre-request transcript checks, epoch replacement, event-first capture and process lease admission/renewal. Default manager journals and approval rows use the supplied backend; explicit service overrides retain their own stores. Queued steering is saved before acknowledgment. Delete disables writes before cancellation and removes operational rows; stop releases leases after turn drain. Ordinary write faults are reported by PersistenceStatus; confirmed renewal loss cancels the turn before later model/tool admission. Renewal requires transcript growth, and session metadata can retain running after the last growth beat. Snapshots 44/45 execute actual Python SQL and session guard/capture probes; Go compares typed projections and runtime ordering through a test-only backend. SessionManager.RestoreSessions(ctx) now rebuilds recorded owner, binding, system/run/status, highest epoch references, Todo and steering over the injected store. It recreates missing saved workspaces, starts interactive with no turn, claims before expiry/repair and reloads pending foreign-held snapshots on admission. Restore faults refuse publication and release owned leases without removing old rows/workspaces. Stop waits for restore and prevents late publication. Source snapshot 46 pins Python's repair-time metadata overwrite and physical sequence reset; Go preserves metadata and sequences, and delays repair until claimed. No stored human grants or activation are restored. Cron now resolves missing handles through RestoreScheduledSession inside its owned cancellation context. Saved bound sessions use the recorded path; saved scratch calls the current factory. Scheduled construction uses the current system builder, matching the source omission of recorded explicit system. Missing rows become anonymous; an injected SQL-like store cannot grant a lease without a row, so that first turn is refused/reported without creating a row. With no backend it is an ordinary ephemeral turn. Stop cancels pending restore reads and waits for their cleanup. Source snapshot 47 makes the next real offline model request. Plan/goal variants and folding remain pending. Driver approval, a real Go backend, native restart validation and state-backend launcher selection remain required. ManagedSession.CatchUpEvents reads at most the newest 2,000 stored rows, using EventOrdinal for physical positions and EventSequence for SSE IDs. Observers subscribe before reading, then de-duplicate both historical and queued records. Fresh/invalid/negative cursors keep the recent backlog; no store keeps memory-only replay. Historical reads are context-owned, do not hold the live persistence lock, validate scope/order/known variants and reinstall no authority or grants. Read faults fail the HTTP request with an opaque 503 before SSE headers; they do not change writer degradation/lease status. Source snapshot 48 invokes the actual endpoint iterator with SQLite/Null. It measures a 50-event hole when ephemeral sequences are incorrectly used as stored ordinals, and huge-ID SQL overflow; Go uses a physical window plus sequence filtering and saturates valid huge IDs. The parser retains Python 3.11 default integer syntax and its 4,300-digit bound. Queue shedding and the 2,000-row window can still leave visible gaps; this is a bounded resume, not complete history or cross-process live tailing. The injected store seam and native SQLite close/reopen are implemented; the Launcher HTTP and managed catch-up restart tests retain owner and untrusted-history boundaries. The Go sessionquery library now supplies typed historical search results through an explicit read-only Reader, distinct from live protocol messages. It scans at most 20 recent epochs and returns at most 20 snippets of 240 Python characters, carrying coverage warnings into its rendered text. Snapshot 147 compares eight actual SQLite search recipes and four absent/null-store surfaces, preserving stored object order and Python Unicode lowercase offsets. Reads propagate context cancellation and backend errors. Explicit SessionQueryTools now registers the read-only parallel transcript_search tool behind the gate. Managed sessions bind the configured store and trusted session identity; a manager without storage returns empty history, while bare/explicitly selected child tools retain Source's unavailable notice. Query inputs cannot name an owner or session. The adapter projects existing typed stored messages; it does not widen the storage contract to arbitrary archival rows. Snapshot 148 now compares actual model turns through Source SQLite and native injected stores, including the current tool-use query and old history after a live rewrite. Source fake caller omission is preserved; ordered catalogues, exact results and epochs match. Two real HTTP recipes match default versus selected tool names and Null-store results. launcher.Options.SessionQueryTools and standalone --session-query-tools select the tool independently; inspection reports selection without starting runtime or widening MINILOOP_FEATURES support. The launcher still has no native state backend and returns an empty search over its no-op reader. The sessionquery.Reconstruct library now returns a closed Found/MissingStart/ LegacyEpoch result through an explicit ReconstructionReader. Named RequestEvent variants carry only historical start/catalogue/system/capability data; the output is an inert RequestProjection, distinct from executable model requests. It retains first matching start, physical-order early stop, latest preceding matched projections, missing/null sequence differences, exact Python numeric/structural fingerprint equality, truth/int conversion and negative/large prefix slicing. Snapshot 149's 32 SQLite recipes and actual old-request stability after a live rewrite match Go. Context and backend errors propagate separately from named count/sequence faults. Returned slices/capability records detach. Managed EventStore/TranscriptStore binding, native SQLite and remaining nonfinite/surrogate archival profiles remain open.

ManagedSession.ReadTranscript(ctx, selection) returns a detached persisted epoch, including old compaction inputs and unfinished crash tails. Current selection is the zero value; explicit integer selections retain out-of-range identities for not-found errors. No live-memory substitution, flush, repair, model turn or lease claim occurs. Empty storage has current epoch zero; a missing intermediate epoch inside the highest bound returns an empty message array. The owned HTTP route validates its last repeated epoch query after authentication and before owner lookup, matching the source. Snapshot 49 compares 56 real FastAPI/SQLite/Null responses; backend read failures return opaque 503 and do not change writer status. No journal claims cross-process dispatch ownership or restart-safe exactly-once effects. Default subagents do not inherit the parent journal, matching Python fresh child state. Compaction files are durable local artifacts, not a session-restoration store. Future SQLite and optional-feature sinks must use the same recording boundary as they are ported. RuntimeConfig.Approvals optionally binds one process-local broker to the permission and textual-question surfaces. It checks session, owner and workspace binding, records typed approval rows through an optional ApprovalStore, and emits typed required/timeout/grant/reviewer events into the session backlog. Human remembered grants precede the optional reviewer and expire with explicit session cancellation; they are never persisted. Reviewer faults abstain, and reviewers cannot bypass readonly or final-deny rules. An empty question answer remains answered. Explicit broker cancellation records cancelled; cancellation of the waiting context removes the pending entry and leaves its last stored row pending, matching Python. Store faults are reported without changing the human decision. The optional redactor masks previews before JSON escaping and answers before storage; RuntimeConfig.Secrets supplies the registry for the bound session without changing a shared broker configuration. Fresh children do not inherit the parent broker surface. Authenticated approval routes bind the admitted owner and requested session. Injected-store restore-time expiry is implemented with native SQLite approval/recovery coverage in go/sqlitestate/audit_test.go. task is the tenth runtime tool and crosses the execution-risk gate before delegation. The default in-process provider creates a fresh child history, todo state and token meter, with a capability-selected subset of the parent catalogue. Explore uses readonly mode; general-purpose/worker children use interactive mode independently of the parent. Default roles omit unclassified tools, including task. Custom role policies can select them, with built-in handlers rebound to each child. The depth limit (default 2) is checked before calling even a custom provider; child rounds default to 30. Run provenance is caller-stamped, never inferred from model text. Default child derivation drops human actor and approvals, records peer authority and links the parent message. Child events retain label, depth and detached provenance in the parent's bounded backlog. Round exhaustion leads with an explicit stop marker before partial output. Default stuck detection retains the latest 20 final rewritten tool input/output hashes per user turn. Five Python rules detect repeated results, repeated errors, unproductive tools, alternating calls and continued monologues. One reminder clears the window; a repeated signal halts with paired results and a stop marker before partial text. With default thresholds, monologue detection applies when an explicit StopHook requests continuation. RuntimeConfig.StuckDetector can select NullStuckDetector; children inherit policies and hooks with fresh windows and nudge budgets. Optional input absence and explicit JSON null remain distinct in wire payloads and identity hashes. Typed UserPromptHooks rewrite submitted text in order (nil keeps it; empty replaces it) before the user row. Named Injectors append fully validated message batches before runtime facts and compaction on every model round. Their detached views include caller-stamped authority; injected text cannot grant authority. Children inherit both seams. An open todo board receives a reminder after three tool batches without an attempted TodoWrite; this counter persists across user turns. Consecutive parallel-safe calls share a group; exclusive calls wait for the preceding group and form ordered barriers. A typed per-call classifier overrides the static flag before gate rewrites; error, panic or invalid mode means exclusive. Read file and glob are parallel by default; readonly alone does not opt in. Results and stuck steps retain model order even when completion order differs. Cancelled groups join every started worker before repairing history; completed results survive while unfinished calls are unknown. Custom concurrent handlers and hooks must synchronize their state and honor context cancellation. RuntimeConfig.ModelLimiter optionally supplies a shared model pool, including summary calls; nil is unbounded like a bare Python Agent. Each session has a parallel-tool pool of eight unless ToolLimiter is explicitly shared. Children inherit the exact pools. Exclusive tools bypass the tool pool, so default task delegation can progress through a child. NewSessionManager supplies shared eight-slot model/tool pools, a process-local approval broker and bounded-result action journal by default. Typed environment configuration and the standalone launcher are implemented. Direct HTTP and SSE model calls are available through go/provider.Client and StreamingClient; default Agent recovery wraps each attempt. NewManagedSession privately owns a runtime and adds context-aware turn admission, idle/running/error status and operator cancellation. Queued callers cannot replace the cancellation target; admission is rechecked after waiting. Info reads immutable live snapshots without waiting for the loop lock and refines running activity to awaiting approval or stuck. A turn commits its terminal decision before emitting final events; cancellation at that point returns false. NewSessionManager owns these handles and requires an explicit, already established owner for create/get/list/cancel/delete. Foreign and missing IDs return the same typed error. The HTTP handler binds that owner from one admitted principal, with foreign and missing sessions returning the same 404. Binding is disabled unless allowlisted roots are supplied; resolved paths are checked against policy before existence, and the manager scratch root cannot be bound. Bound directories are retained. Scratch deletion closes admission, revokes approvals, drains the active turn and then reclaims the directory only when no live or retiring handle shares it. Stop closes fleet admission and joins pending creation and deleted-session cleanup, preserving surviving scratch directories. Caller cancellation ends the Stop wait; shutdown continues and can be joined again. Factories receive typed session bindings and must not recursively create/delete/stop the manager. Nil skills remain an empty catalogue; deployment loading is explicit. The launcher best-effort constructs a private spill.LocalStore at the configured root (./var/spill by default; empty disables it). Typed ManagerServices.Spill and RuntimeConfig.Spill bind the store to independent real shell executors, retaining selected credentials and shared process cancellation. ExecuteBash corresponds to Python's string run_bash: over 50,000 characters it preserves the already-masked captured output, then appends an opaque locator and retrieval hint. The default Bash adapter calls ExecuteBashResult instead; both actual Python and Go currently bypass preservation on this structured path. The store being configured does not imply the default tool preserves its full output. Compaction artifacts remain a separate workspace path. Spill namespaces use the workspace basename, hashed for grouping; they are not owner ACLs. The local store limits artifacts to 8,000,000 UTF-8 bytes, creates a private root/new namespace (0700) and exclusive leaves (0600), and syncs the file. Existing namespaces are retained as in Python. Leaf exclusivity does not confine parent-directory races or sandbox the host shell. Store errors keep the preview; no TTL or automatic purge exists, and deletion/shutdown retains evidence. Go additionally rejects invalid UTF-8, honors cancellation and checks short writes. Failed-write cleanup checks the leaf identity before removing it; that check and unlink are not atomic against host tampering.

go/trajectory.Store records independent per-run JSONL files, enabled by default in the launcher at MINILOOP_TRAJECTORY_ROOT or <workspace root>/.trajectories. A configured root failure refuses startup. ManagedSession owns start, ordered non-ephemeral capture and finish; full masked model inputs/outputs and tool or child results reach the file without entering the 200-record live backlog. Terminal status/duration are captured before the final event write, and the live persistence receipt is published after file finish. Recording errors degrade to an explicit masked diagnostic without rewriting the run outcome. MINILOOP_TRAJECTORIES=0 disables recording; MINILOOP_TRAJECTORY_CAPTURE_CONTENT=0 recursively redacts source content fields. The library uses named writer/reader/store interfaces and typed metadata.

Recorded owner checks precede full-document reading or streaming. Legacy null-owner records use the manager's bounded remembered owners; owned files remain readable after session deletion and server restart. Listing summaries retain one capped record at a time. JSON inspect/export refuse source files over eight MiB; JSONL exports stream 64 KiB byte chunks without holding append locks across client waits. Default deletion retains evidence; explicit library RemoveTrajectories joins the writer before purge. New roots use 0700 and files 0600; existing modes remain as in Python. The store uses 32 process-local striped locks and adds a 64 MiB single-record limit. Append close is not an fsync guarantee, locks do not coordinate processes, and filenames/owner fields are not a host filesystem sandbox or ACL. Files survive restart, but do not restore transcripts, leases or durable SSE cursors. The Python HTML ledger is available at /trajectories/{id}/view, after the same owner and eight-MiB checks. The independent go/cmd/traceview renders an exported file, trajectory ID or recorded session to a self-contained 0600 HTML file. Its typed rows fold span pairs, preserve child depth/request numbering and retain unknown events as inspector text; unclosed spans have no invented duration. Totals cover all rows before the 2000-row tail cap; previews and inspectors retain Python character caps. Embedded CSS/filter JS match the source language and typography. The file CLI has no whole-file eight-MiB cap; its reader retains Go's 64 MiB single-record limit. VisitRecords streams detached encoded values with a typed query and yielded-record limit; filters may scan the entire file. It holds no append lock across a visitor. Offline reads are an operator capability.

go/httpapi.New returns a standard http.Handler over that manager. Twenty-eight method/path combinations implement basic health, create/list/detail/delete, message/stream/cancel, approvals/resolution, mode/steer/fork, events, the owned task-board view, five trajectory read/view/export operations, the public / console and /ui shell, and configured-store transcript epoch reads (Null storage retains 404). Token/anonymous authentication is resolved once; the ten-MiB ingress cap precedes it. An admitted HTTP turn remains untrusted, with only the personal-skill capture-source stamp. Completed message retries use detached owner/session/key snapshots before spending rate budget; non-streaming admission rejects busy turns atomically. Stream submissions queue, and a disconnect cancels their own active turn or admission wait. Event observers replay the bounded backlog with cursor deduplication and optional envelopes; a positive resume cursor also reads the configured event store before queued live delivery. Typed flat event JSON and HTTP responses use the optional recording projection without changing live model history; encoder failures return no raw fallback. These are process-local handler services: the embedding application owns listening/shutdown and must call RefuseOpenBind before listening. The standalone launcher supplies that ownership and additionally checks its actual listener. Native SQL/HTTP restart evidence is delivered in go/launcher/state_test.go; final default/fleet/health-posture acceptance remains open. Full FastAPI validation detail/coercion parity remains open. Injected-store restoration and bounded catch-up exist with the native SQLite backend; latest nonfinite restore/catch-up composition is tested in go/sqlitestate/nonfinite_restart_test.go. Both browser documents use embedded copies of the Python source HTML/CSS/JS. python/tools/export_go_webui.py --check verifies the copies; no Python process, source checkout, external assets or static directory mount is needed at runtime. The UI's existing core session/turn/approval/control/trajectory flows consume the typed Go APIs. Cron list/schedule/cancel/arm APIs and the owned Goal read endpoint are also implemented, alongside owned skill catalogue, preview/commit and memory reads. Optional Team/Workflows/Improve/Benchmark and Self-audit APIs remain unimplemented, so those panes currently show source error states. Serving the complete source shell is not full UI feature parity. go/tasks is a named file-backed task graph under each workspace's .tasks. Explicit RuntimeConfig.TaskTools / ManagerServices.TaskTools install five tools through the same bound handler and execution gate; they are off by default and are distinct from the default task delegation tool. Dependencies gate claims; exclusive owner markers arbitrate across processes, and abandoned markers report without takeover. Writes mask before escaping, fsync a fresh file, rename beside the target and best-effort sync the directory. Rendering retains the last 50 rows with 200-character subjects and missing-dependency diagnostics. The owned HTTP Tasks view checks admission before opening the board and lists structured records without consuming claims. File state is workspace-local; no lease, automatic stale-claim takeover or session recovery is implied. Comprehensive MINILOOP_FEATURES activation remains unsupported until the other groups ship. Managed controls have a separate lock from model/transcript execution. Library Steer parks at most 100 inputs, each capped at 16,000 Unicode characters with a truncation marker, dropping the oldest. The next round injects one ordered user_interjection after custom injectors and before context budgeting; events project the first 2,000 characters. HTTP steering of an idle session publishes an owned background holder before responding and runs the original text as a new turn; busy steering queues for the next round. Request disconnect does not own this background turn, but manager deletion/shutdown drains it. It uses default untrusted provenance, matching Python's steer wakeup. Mode changes become effective at permission evaluation after before/guard hooks; prior decisions are not revoked. After the first run starts, a real mode change queues a separate harness-authored posture_update with its meaning for the model. Pre-first changes and no-ops stay silent. Fresh children retain their selected mode and never drain parent controls. Steering is stored/restored when an explicit StateStore is supplied; posture remains process-local. Native SQLite steering restart is covered by the actual Source manager recipes in go/sqlitestate/manager_restart_test.go. Manager Fork and the owner-scoped HTTP fork route copy only an idle, paired transcript while holding source admission. The child inherits explicit system and current mode, uses the manager default model, and has fresh tool/control state and a newly provisioned scratch workspace. Typed forked_from lineage and cloned history are installed before publication; session_forked appears in the source stream after successful construction. Failed construction emits no success event and reclaims its unused scratch directory. Empty histories and repaired cancellation boundaries can fork. Go forks remain process-local; Python with a real StateStore also flushes the fork before its first turn, which remains G5 work here. The interactive map folds ManagedSession into the Go SessionManager node together with its private trajectory file service, folds the launcher into Go HTTP / SSE together with the independent ledger CLI/renderer, and folds controls into Go Session. Raw child sessions emit core spans and text without outer status/done events. Transcript replacement increments event epochs, including with no state store. Tool failures and denials retain their flags in telemetry; paired model-visible results omit is_error, matching Python. Empty refusal content uses an empty string because the strict request domain forbids empty block arrays. Absent and explicit-null provider caller metadata remain distinct. See the parity matrix.

ManagedSession.ReconstructRequest reads the configured typed event/transcript store for its own session ID and returns a closed historical request projection. It preserves physical event order and the exact stamped epoch, including superseded transcripts. The caller owns authorization; reads do not take turn admission, flush live messages, claim a lease, repair crash tails or reinstall historical capabilities. Missing or disabled storage returns the Source missing-start result. Native provider-boundary and rewrite tests retain their injected backend scope. The native SQLite backend is implemented; inspector-specific composition still needs G7 reconciliation.

A nonnil RuntimeConfig.DiagnosticsProvider or ManagerServices.DiagnosticsProvider explicitly installs the typed diagnostics tool with Source read/parallel traits. Its input can choose only an optional workspace path; the provider receives an immutable root/target selection after explicit-path confinement. Reports always name the provider scope and preserve its order/severity vocabulary, with the Source 50-report cap. Manager construction and explicitly selected task children bind the current execution workspace. Provider IO releases the handler lock and honors context cancellation. The provider remains caller-owned and must support concurrent use; launcher.Options.DiagnosticsProvider forwards that explicit handle into managed sessions. Inspection reports selection without callbacks, and shutdown does not close the caller-owned provider. Six actual Source HTTP/model traces cover disabled, tree, target, null, escaping input and provider failure. CLI/default parser selection remains pending. diagnostics.NewPythonSyntaxDiagnostics(parser) now implements native file selection, Source component sorting, stat byte warnings, UTF-8 replacement/universal newlines and report-stop behavior around an explicit closed-result parser interface. Source tree symlink-file behavior is retained; explicit target paths still pass confinement first. Replay of actual parser input hashes/results verifies the scanner, not a Python grammar. The language-parser implementation/selection remains pending.

Foreground shell startup now holds the process-tracker lock through Start and PID publication. Interrupt therefore cannot miss a child that has already begun effects while its parent is still registering it. Startup failure releases the lock, and the background path retains its separate lifetime owner.

The standalone Go astcontext library now validates explicit configuration and parses captured version output into closed statuses and immutable probe records. Environment names/digests normalize into detached snapshots; semantic components use Python-pinned Unicode decimal blocks without machine-integer overflow. Zero configuration/status values and unrepresentable timeouts are refused. Version parsing is inert. A separately constructed astcontext.Adapter now probes a configured operator executable after workspace-local refusal and optional SHA-256 recheck. Its argv child has a selected environment, independent stdout/stderr byte caps and one deadline shared by child exit and pipe drains; cancellation kills/joins the child. Buffered drains preserve Source 64 KiB read-or-EOF ordering, including timeout-before- overflow for a small over-limit writer that keeps its pipe open. Darwin/Linux retain the launched process-group ID to stop pipe-holding descendants even after the direct child exits. Other platforms have direct-child cleanup only. Private Source snapshots, structured AST payloads and explicit semantic-read tool installation and Launcher environment selection are implemented below. Executable verification precedes launch and is not an atomic file pin.

The internal AST ignore component now preserves ignore/keep/unmatched decisions, compiled-pattern counts and selected indices against installed Source pathspec 1.1.1. Root anchors, globstar, file/directory precedence, escapes and character classes use Go standard regular expressions; Source star/length guards remain in force. Ignore controls drop invalid UTF-8 for matching and use Python splitlines while their raw bytes remain available for copying. The private snapshot builder now supplies traversal and copy. Reversed character ranges remain compiler failures with native diagnostic wording; payload/tool integration is implemented below.

The private AST snapshot filesystem layer now owns no-follow directory handles, opens children relative to those handles and reads metadata with fstatat before opening selected regular files. Single-component names reject traversal; scans count all names against a limit and reopen the directory for an independent offset. Close-on-exec descriptors remain anchored after pathname replacement. Darwin and Linux amd64/arm64 metadata backends are implemented; other backends refuse secure metadata access. Native tests run on Darwin arm64; cross-compilation alone does not prove other platforms at runtime. The integrated private builder is described below; these handles alone are not a public path-selection or permission boundary.

The private Adapter.withSnapshot now builds the complete bounded tree before a callback and removes its temporary directory on every return, callback error or panic. It keeps original deduplicated target order while copying shallower targets first, applies Source language/default-ignore policy plus cached root/nested control frames, and counts files/bytes/entries/depth/ignore bytes/patterns/match operations. Explicit files bypass tree filters; recursive symlinks, special files and VCS metadata are skipped. The nearest non-symlink .git marker sets the project frame; a synthetic marker and raw ignore bytes accompany selected directory snapshots. Copies have mode 0400 and live rewrites after copy do not change captured bytes. All 36 actual Source recipes match paths, manifests, hashes, modes, refusal messages and successful cleanup on Darwin arm64. The constructor distinguishes caller cancellation from its copy deadline. It does not freeze files during concurrent writes, interrupt arbitrary blocking filesystem syscalls, or install a model tool. Canonical selectors, bounded globs, CLI payloads, runtime AST tools and Launcher wiring are implemented below. Linux evidence is compile-only.

Private AST selection now validates 64-item/2048-character string arrays, canonicalizes operator workspaces and resolves exact user paths with Source non-strict realpath and symlink-before-dot-dot ordering. Exact paths follow internal links; basename globs open static components through no-follow handles and enumerate at most 10,000 entries before hidden-name, fnmatch and regular-file filtering. Matching uses the existing Python-compatible rune matcher, not filepath.Match. Copy reopens selected matches with NOFOLLOW, so a later symlink swap cannot reach the snapshot callback. All 80 Source recipes are exercised: 76 compare native output/error text and four non-string inputs are refused at typed JSON decoding. Glob expansion deadlines are checked during entry iteration, retaining Source empty-directory behavior; external cancellation remains an error. These private helpers now serve the semantic operations, typed CLI payloads and explicit model-tool runtime integration below.

The internal jsonsyntax scanner now supplies shared closed diagnostic codes and Python character offsets. HTTP retains its existing 985-container/4300-digit profile and wire projections; AST payload decoding can select its own profile. Successful JSON still lowers into existing closed value/typed request decoders. Eight actual malformed AST CLI outputs match Source diagnostic wording/positions; HTTP syntax, encoding, number, depth and surrogate regression tests remain gates. No AST payload interpreter or model tool is installed by this extraction.

Native astcontext now has closed Operation and immutable Result/Payload records. The private captured-output classifier preserves envelope numeric equality, values-only path rewriting, error-before-import handling, iterable warnings/errors, arbitrary integer metrics and partial/ambiguity/no-match precedence. All 65 actual Source observations replay: 61 compare exact ASCII/UTF-8 JSON and four preserve ordinary TypeError text. Detached records/warnings and strict standard-JSON nonfinite refusal are tested. Actual semantic subprocess execution, explicit model-tool runtime selection and Launcher configuration are implemented below. CPython recursion/stack limits still need final profile work. Source result strings and final UTF-8 wire encoding are separate boundaries, implemented below. AST decimal integer failures now preserve Source ValueError wording and digit counts. Exact metric sums exceeding 4300 output digits fail before warning publication. Twelve Source invocation/public recipes exercise precedence and error text; native public operations clean frozen snapshots before returning Source no-probe error results. Shared decoder profiles remain unchanged.

Native astcontext Adapter now implements RepoMap, FileOutline, ShowSymbol and SymbolReferences using closed density/view/reference-kind options and typed request records. Every operation canonicalizes/validates paths, builds the existing bounded no-follow snapshot, probes the operator executable in the original workspace, then executes direct CLI argv and classifies output before snapshot cleanup. Leading-dash patterns use attached --expression values; show preserves signature flags and bounded glob early returns (32 visible matches/16384 UTF-8 bytes), without executing a probe. All 26 public Source contracts compare exact ordered result JSON, probe/command argv, original cwd and removal of private snapshots through actual native CLI children. The child independently verifies external 0400 source copies; a mutation of the live workspace during child execution still reads original bytes. Workspace executables are refused before side effects and caller cancellation remains a Go error. Four model-tool registrations and explicit runtime selection are implemented below. Final extreme recursion/stack profiles remain open; decimal faults and lone-surrogate result strings are implemented below.

Native protocol now declares four AST ToolInput variants with named density, view and reference-kind enums, detached required arrays and optional presence pointers. Canonical sorted UTF-8 identity and recording-only string masking preserve supplied fields without inserting execution defaults. The model schema projection matches all four actually installed Source declarations, including default values, maxLength, array limits, numeric bounds, descriptions and additionalProperties=false. InputSchema adds named MaxLength/Minimum/Maximum/Default fields with detached clones and typed validation; defaults use existing immutable closed JSON variants. The Go boundary refuses non-string arrays, unknown fields, null fields and invalid enums. These are explicit typed admission refusals, not a claim of parity for every malformed dynamic Python handler input. Scalar/count semantic errors still belong to the existing adapter. Explicit runtime registration is implemented below.

RuntimeConfig.ASTConfig and ManagerServices.ASTConfig now explicitly install the four Source-compatible read/parallel AST tools through the existing ToolGate. Nil keeps them absent; invalid zero config fails construction before runtime setup. The Manager detaches the operator config and forwards it through its shared session construction path. The handler captures the current identity/workspace binding under lock, then executes immutable request state without holding the mutation lock. Foreign session/owner/workspace authority is refused. Selected task-child definitions rebind to fresh child handlers while sharing only the stateless configured adapter; existing read-capability policy selects all four tools for Explore. Real native CLI tests exercise a read-only four-tool model batch, eight version/command executions, source freeze modes, values-only path rewriting and post-tool cleanup. Guard denials start no child, workspace transitions rebind the root, manager config reassignment cannot affect sessions and an actual task-child performs its own probe and operation. Installed schemas/traits/capabilities match Source export 158. Launcher settings/environment/CLI selection and HTTP end-to-end Source traces remain next; default tool installation is unchanged. Final AST malformed/extreme output profiles, SQLite, diagnostic parser selection and G0-G7 remain open.

Most feature bundles are opt-in. The workflow store, workflow-local journal, outbox, and verified-loop coordinator are process-local or library-only. The Guardian is an opt-in reviewer inside the existing approval boundary, not a new source of authority.

Typed decisions are also default-off, including with MINILOOP_FEATURES=all. Both decision backends use the existing external-risk permission gate. Jev preserves the service's returned model, probabilities, confidence, and usage; the separately selected LLM backend labels its probabilities as estimates. Neither backend executes the selected action or grants permission to do so. Decision results use existing tool and event records; no decision database, session-restoration mechanism, or HTTP route is added. See Typed decisions for configuration and evidence boundaries.

Go userresources.DraftStore is a separate operator library with no runtime or HTTP binding yet. Its immutable handles retain private owner/session identity; public previews detach evidence arrays. FIFO quotas cannot evict another owner, and commit cleanup checks object identity after publication, including after TTL. It does not write skill files or invoke a model. Separate pure skill projections filter legacy protocol history or preserve already-admitted text, mask strings and retain a whole-message suffix under the source Unicode JSON budget. Display labels grant no role or provenance. ManagedSession now records trimmed admitted input/final pairs after successful terminal flush, only with the trusted capture capability stamped by HTTP admission. Ordinary/peer/cron turns, failed admission and cancellation do not gain evidence. Keys/labels/content are masked before 64-message and 40k compact Unicode JSON bounds; eviction removes single oldest messages, preserving source omission counts. String-history compaction markers set a sticky exclusion flag. Short/unresolved or unavailable secret screening rejects new evidence and latches a preview refusal without failing the completed turn. Detached evidence is process-local, fresh per agent and not reconstructed from restored/forked history. The separate candidate parser now checks exact schema fields, recursive sensitive-output refusal, create/skip semantics and unique in-range integer evidence before canonical skill validation. It retains only typed validated fields; source JSON duplicate-key and nonfinite-type outcomes are preserved without retained nonfinite values. A separate typed SkillPreviewer now implements the source projection/focus/masking, two-attempt generation/repair, health checks and owner/session-bound draft retention through an explicit non-live model interface. An empty supplied ledger never falls back to history. The repair prompt contains a safe reason, never the previous output. Standalone Session.PreviewPersonalSkill now binds that seam to the normal model cache/recovery/limiter/telemetry path with personal_skill_preview purpose and empty tools, concatenating only text blocks. It serializes with core turns and preserves live history/token-meter ownership. Manager construction now owns one process-local DraftStore and injects it through the common create/fork/restore runtime factory, preserving fleet-wide quotas and owner/session/digest binding. A new manager gets a fresh pool; drafts are never reconstructed from persisted state. Manager PreviewPersonalSkill now checks owned handles, rejects anonymous/disabled publication configuration and rechecks accepting identity after admission. It requires the lease and always supplies the capture ledger, including empty state. Previews retain idle turn status and count; a separate private lifetime is cancelled and joined by deletion/stop, including lease-acquisition waiting. This native join is additional to Python’s currently turn-only cleanup. CommitPersonalSkill now rejects readonly before peeking at the owner/session/digest-bound draft. It publishes through the existing create-only resolver, returns next_session activation, then discards only the exact draft. Publication failure retains the draft; expiry/cancellation after durable success cannot rewrite the receipt. Existing live snapshots remain unchanged. HTTP preview/commit routes now inherit one authenticated principal and bounded ingress, decode closed request values and require owned sessions before manager admission. Service policy/draft errors keep typed code/message details and reviewed status. Responses use detached masked JSON. Preview creates a process-local draft; commit publishes only its reviewed digest. Source routes do not add rate accounting. Valid JSON request errors now preserve ordered Pydantic validation lists, locations, context and input through a closed diagnostic tree; strings and keys are masked before encoding. Syntax errors preserve source code-point positions and safe messages. Only application JSON media types enter parsing; missing/other media retain byte-string input. Byte detection now follows source BOM precedence and NUL heuristics for scalar UTF-8/16/32 JSON, independently of charset parameters. Invalid units/truncation refuse before syntax processing. Source surrogatepass code points remain transient boundary data through syntax processing and exact duplicate-key overwrites. Escaped pairs become scalars; raw UTF-32 pairs remain separate code points. Active non-scalars match the safe source plain 500 response, while malformed documents retain their syntax errors. Scalar-only normalized data enters concrete requests; no replacement character substitutes for rejected Unicode. Numeric parsing now normalizes finite doubles and negative integer zero, preserves arbitrary precision integers within the pinned source 4300-digit limit, and retains an explicit nonfinite diagnostic variant until duplicate resolution. Surviving nonfinite values match source plain 500; oversized integers fail during parsing with source 400 even when later overwritten. Parsing now permits up to 985 nested containers in the pinned CPython/default Uvicorn HTTP profile, while echoed validation input permits 978 before a safe source plain 500. Only retained echoed values consume that budget; discarded duplicate values remain eligible for admission. Request diagnostics use a separately bounded masking projection so deep strings and keys stay masked; ordinary recording retains its 256-depth limit. TestClient thresholds differ due to its stack, and alternate interpreter/server stacks are not claimed covered. Previews grant no publication authority.

The owned GET /sessions/{session_id}/skills route now returns the exact description source retained by that session's model requests, through a concrete session/catalogue response and the existing registered-secret projection. Reads do not load skill bodies or refresh the owner's publication cache. Existing sessions retain their snapshot after publication; new independent sessions and forks resolve the current owner bundle. Other owners cannot observe it; open deployments retain their single anonymous principal. Custom catalogue exceptions return safe plain 500.

Go embedding can supply ManagerServices.Memory as one shared Markdown store; when nil, manager construction creates <workspace root>/.memory with its configured secret masker. An unavailable shared root fails construction, including when an owner resource resolver is selected. Create, fork and ordinary/scheduled restoration bind the admitted owner before runtime publication; an explicit owner resource resolver takes precedence. This binding alone does not install memory tools. Standalone startup constructs shared storage at MINILOOP_MEMORY_ROOT or <workspace root>/.memory; an optional MINILOOP_USER_RESOURCES_ROOT selects owner-local resources. --memory-tools installs remember/recall, and --memory-auto=false disables their automatic selection/capture. Both roots must construct successfully, including the shared root with owner-local resources selected. Pure configuration inspection does not construct them.

Owned memory GET routes read the session's fixed owner binding. The list exposes only name/type/description/origin; the body route returns name/type/description/body. Memory writes remain visible to existing same-owner sessions, unlike pinned skill catalogues. Neither read refreshes owner resource bindings or enables model tools. Native backing-store failures return a safe plain 500; a removed root differs from Python's empty glob result. Snapshot 89 compares 45 actual Python HTTP outcomes across shared, owner-local and anonymous modes; native tests add output masking and failure containment.

SQLite durability applies only when a real StateStore is configured; the default server keeps the documented Null* boundaries. Owner skills and Markdown memory are digest-resolved files, not SQLite tenant isolation.

The native go/benchmark operator library aggregates supplied task results and compares paired arms. Six explicit measurement fields use exact integers, finite doubles or source-compatible booleans, with detached storage and optional values. Passes require a strict majority; medians retain integer/float identity. Any task regression wins over improvements; ordered performance warnings do not change the verdict. Transcript metrics count identical read windows as waste and preserve source rendered-error vocabulary. Snapshot 90 compares 51 actual Python outcomes. agent.SelectTools now pins an optional immutable whitelist before runtime gate construction; the same subset supplies model schemas and executable handlers. The zero value retains installed tools; an explicit empty selection removes all. Unknown names cannot activate optional features, and permission modes stay intact. Selection belongs to one construction: independent sessions, forks and restored handles use their configured profile, without restoring this transient selection. It is not a persisted policy or host sandbox. Child role policies narrow the selected parent catalogue. benchmark.RunArm now owns a manager and runs each admitted task in a fresh anonymous interactive session. Construction and setup precede first-turn tool restriction, preserving allocated store ownership. Setup faults abort the arm; run/judge faults score failed rows, and cancellation aborts with joined manager teardown. Duration covers only the run; cost/motion use the actual final typed transcript. Workspaces remain available for inspection. Caller-owned custom factories must supply isolated paths. This is explicit operator launch authority. POST /benchmark now constructs four independent fake clients and owned arms, exposing visible rows and heldout comparison. It reads supported configuration freshly per request, retains the app deployment skills path and joins managers before deleting transient a/b roots. Main provider/owner snapshots are not inherited. Explicit external memory/trajectory paths keep their configured semantics. Unsupported comprehensive features, workflow, guardian, token-efficiency remain errors; those runtime profiles are not claimed migrated. The five visible and three heldout admitted tasks now have concrete immutable specifications, typed trusted judge/setup callbacks and detached optional tool names. Prompts, 6000-line log bytes, permissive substring/existence judges and Python Unicode splitlines semantics match snapshot 91's eight specifications, 50 actual judge outcomes and seed digest. Text reads are strict UTF-8 in the pinned source environment; directory/read failures remain judge errors. These callbacks do not admit model-generated task definitions. Snapshot 92 compares actual visible/heldout default-fake arms, empty workloads, setup/run/judge faults and provider-failure recovery. A recovered error text is still judged as source does. Native fault labels differ from Python exception classes; the recovered fault fixture measures 38 native tokens versus 32 source tokens because of that diagnostic spelling. All eight default-fake task effects/final texts/metrics match. The launcher uses FakeProvider.ObjectView() to reproduce Python fake-object transcript serialization, omitting caller metadata while preserving the raw client wire view and real-provider absent/null distinctions. Empty history costs zero. Go problems.Log now retains 50 distinct FIFO entries with exact nonnegative integer occurrence/lifetime/eviction counters. Repeats retain their original position; returning evicted messages restart retained counts. Clear resets counts without changing capacity. Snapshots detach slices and integer storage. Approval and in-memory action holders now expose the optional typed SelfAuditProblems seam, recording every occurrence while preserving their legacy Problems() API. The live manager now collects these and native cron, trajectory, skill, task, gate and memory diagnostics through detached typed snapshots. Stored-journal diagnostics still require an optional adapter; optional model binding is described below. The Go selfaudit library now renders concrete observations for session activity, problem ledgers/counts/churn, trajectory trends, skill-load correlation and cron arming. Owner filtering, global inclusion and source scan/report bounds are explicit. Suggestions remain strings for human review; benchmark drafts contain only a fixed null expectation and cannot become admitted tasks. It performs no IO or model calls. ObserveSelfAudit reads actual managed sessions and native holders, then streams admitted recording events without manager/session locks across IO. Snapshot 96 compares six real Python manager/session profiles; native tests exercise actual JSONL, scan caps, cancellation, private fault classes and lazy task diagnostics. GET /self-audit now serves the live plain-text report; /self-audit/suggestions and /self-audit/bench-task-drafts serve typed inert proposals. Authentication pairs the admitted owner with no fleet ledgers; an open deployment retains its operator view. These source GETs ignore query/body overrides and spend no rate budget. Curation uses ledger-only collection, skipping Info, cron overview and recording IO. Registered-secret projection fails closed, and plain text is recapped after masking. Snapshot 97 compares 72 actual Python HTTP responses across open, authenticated and owner-resource deployments. Explicit SelfAuditTools installs the source read-risk/readonly/exclusive model tool through ToolGate. The bound observer and finite trusted SelfAuditView control visibility; the default owner view collects only that session owner's resources. An explicit operator view retains Python's unscoped report. Standalone --self-audit-tools chooses owner view under configured auth and operator view when open. This corrects Python model-tool fleet visibility under auth; model arguments cannot select another owner or global inclusion. New/restored/forked managed runtimes use the same construction map. Selected children inherit the bound view; default role capabilities do not acquire this capability. A bare activated runtime without an observer returns the source no-manager notice. Observation runs without reentering the turn lock; cancellation is retained, projection uses the existing tool-result boundary, and injected observer panics expose a fixed private failure. Source report caps apply before ordinary result hooks and secret projection, as with other model tools. Snapshot 94 retains 26 source processing profiles. Adapters must authorize owner scope before storage reads, mask private output and capture failures without their private messages. Owned memory observation reads a binding-local ledger of explicitly attributed write/replacement diagnostics. Unreadable shared filenames stay in privileged raw store diagnostics. Separate bindings do not aggregate each other; owner resource fleet views currently retain attributed binding diagnostics, so unattributed per-resource store errors remain a documented collection gap. The observer adds a 64 MiB total event-byte budget, reported by class if exceeded, alongside source 100-session/50-recording/200-event limits. The Go team bus now implements the source in-memory and JSONL mailboxes with 16,000-character messages, 100-message queues/delivery and a 2,009,600-byte tail read. A consume reports loss with the source notice and ledger; peek neither drains nor reports malformed rows on behalf of a future reader. Persisted masking acts on keys and values before ASCII JSON escaping; in-memory messages retain source unmasked behavior. Historical rows use the same immutable closed Python JSON variants as the improvement archive, including distinct integers/floats and observable nonfinite/surrogate values that cannot enter a standard HTTP response. Managed sessions bind team=id/name=lead during creation and restoration; forks bind their own identity. GET /sessions/{session_id}/team checks owner before IO, returns the latest 50 and performs no second historical-data mask or rate spending. Snapshot 107 compares 32 source mailbox recipes; snapshot 108 compares 11 actual HTTP outcomes plus the source custom-agent teamless projection. Native TCP tests prove viewing leaves all 75 messages for subsequent delivery and foreign callers cannot trigger an owned unreadable mailbox error. Python and Go reject dot path components before IO; lexical checks and instance locks provide neither filesystem confinement nor cross-process delivery transactions. Actual Python manager state binds the shared mailbox as bus, while self-audit scans a distinct teams slot. Shared bus problems therefore do not enter either actual manager's fleet or owner report. Differential probes preserve unread mail; adding fleet bus aggregation would be a source enhancement, not missing parity. Explicit team activation now supplies round injection and owned teammate idle/task scheduling, described below. All ten source team/protocol tools now have concrete input variants, source schemas, immutable metadata and sorted/masked recording projections; the codec rejects model-supplied identity/root fields. Snapshot 109 compares 74 actual source keyword bindings and JSON identities, including metadata key collisions. These codecs define the input layer. Manager-bound tool execution is described below; automatic round injection follows the installed team slice. The Go team library also provides a native process-local protocol coordinator: shutdown requests/acknowledgments, task-plan requests, plan submissions/reviews, correlated responses and a global 200-handshake table. Resolved history is evicted before live pending requests. Reports retain a truncated preview while oversized instructions are refused. State publication/resolution precedes delivery; filesystem failure may leave the table changed, and a malformed row may fail after the inbox has drained and earlier shutdown acknowledgments have been sent. These are source semantics, not an outbox transaction. Snapshot 110 compares 25 actual Python manager recipes and 117 operations with fixed time/UUIDs and a trusted roster construction fixture. Member sessions and bus IO are real; spawning is not claimed by that seam. Correlation retains the source request-ID/type/status rule, without adding sender verification. Closed JSON response truthiness, Python str/repr and ASCII indent rendering preserve historical data. Printable characters are pinned to Python's Unicode 14.0.0, including characters assigned later in Go's database. The coordinator is now owned by the manager alongside its bus. Ten team tools are independently enabled by ManagerServices.TeamTools or standalone --team-tools, including spawn_teammate for an owned concurrent initial turn. The fixed session identity supplies sender/team/root; model arguments cannot select them. Source roster checks, broadcast refusal counts, lead-only shutdown/plan/review, and exact inbox/protocol notices use the same gate and declared source traits. read_inbox remains source read-risk/read-only despite draining and sending acks. A private binding guard precedes journal replay as well as new effects; foreign, deleted and stopped bindings cannot recover private inbox results. Accepted shutdown assignments remain sticky even after partial consume faults. Selected delegated children inherit tool schemas with their own guard but no parent manager/bus state, matching the source unconfigured-child boundary. Snapshot 111 compares eleven real installed-handler recipes; native tests add gate rewrite/mask/replay, owner scope, readonly acknowledgment, selection/forks and child authority isolation. A real HTTP model round verifies tool publication/send/read and repeated non-consuming GET. Native SpawnTeammate publishes a fresh owner-bound member in the parent's original lifecycle workspace, inheriting the fixed skill/memory bundle without another resource resolution. It uses the manager model/system builder and interactive permission mode, with a teammate prompt prefix and named peer provenance that drops human capabilities. The child shares the original task board and omits recursive spawn. Name reservations prevent concurrent duplicates. Its initial run is independent of the spawning request; normal completion delivers a result to lead. Delete/stop cancel and join the worker before shared scratch reclamation; deleting the parent leaves the child registered, and bound workspaces are retained. Native tests cover these boundaries and construction rollback, stopped publication, readonly gating and parent-turn mutex independence. Snapshot 112 now exercises real Python spawning before 8 injector and 11 idle-loop recipes. It checks initial resource inheritance, exact prompts/results, named peer contexts, retained task effects, partial inbox errors and prepared worktree path selection. With nil injector selection, round injection runs after background notifications; an explicit injector list replaces these lifecycle defaults. Team injection drains only the bound registered inbox and emits a typed team_inbox count before rendering. Delegated subagents have no manager binding and cannot consume parent mail. The owned worker proceeds from its initial result into the source idle loop: poll, consume, pop sticky shutdown, react to messages, then claim the first runnable task. Message turns use raw historical JSON with default Python spacing; round injection uses cleaned indented rows. Activity resets the monotonic deadline. Claims retain the original task board/lifecycle root; existing named worktrees select an atomic execution workspace rebind, with original-root fallback when missing/invalid. Idle turns use fresh session_manager peer provenance without human grants. Normal timeout reports an idle notification; shutdown/cancellation does not. The lifetime is joined on delete/stop; timeout/shutdown does not unregister the handle. Poll/timeout settings reach the launcher. Team identity/runner state is process-local and not restored as a teammate. An actual Python SQLite close/reopen recipe and native injected-store reconstruction verify ordinary lead identity, retained owner/workspace/history and old unread teammate mail without a restarted runner or recovered roster. Persisted running status can remain without active work. Manager roots and restored handles use the source label main; explicit teammate labels remain their names. Native SQLite remains unimplemented. Full feature activation and the other open migration packages remain pending. The shared bus self-audit omission matches actual source, as documented above. Team tools are off by default; task/worktree model tools retain their separate selection. The separate Go workflows library now supplies finite named node/run/attempt/ verification/source states, immutable definition projections and artifact records. Snapshot 113 compares actual Python defaults, all state predicates, canonical UTF-8 digests, derived/explicit identities and normalized artifact effects. Definitions recompute saved hashes and separate semantic content from revision metadata. Typed schema/value projections retain Python integer/float identity. Snapshot 114 now compares 36 definition/DAG, 18 schema, 21 value, four submission and nine verification recipes. Native validators preserve refusal order, read-only tool budgets, the three supported engine node kinds, DAG acyclicity and the source JSON Schema subset. Numeric schema admission excludes booleans; enum/const use Python equality. Structured artifact completion binds the controller's attempt IDs and validates its schema before creation. Run provenance snapshots and their named IDs now live in go/runmeta; the agent retains its private trusted RunContext and source-compatible public aliases. Decoded snapshot data cannot mint a trusted context or grant execution authority. Snapshot 115 compares 46 actual Python run/node/claim/attempt/outbox projections and eight constructor refusals. Native records use named identities/counters, closed immutable object args/payload and detached optional/slice fields. Strict record decoders retain source defaults, array order, empty identities and negative counters; null or invalid status values cannot acquire default execution states. Historical provenance remains inert data, including unrecognized authority text. Snapshot 116 now compares 53 actual store operations, the full 169-entry run transition matrix and three canonical hash refusals. InMemoryStore registers immutable definitions, deduplicates session/key launches, keeps detached reads and performs versioned transitions and atomic claims under one process-local mutex. Empty claims increment the version; active nodes follow definition order. Dependency readiness and concurrency scheduling remain engine-owned. This core neither authorizes launch nor validates argument schemas. Snapshot 117 compares 14 actual attempt starts and 32 commit/replay outcomes. Native attempt CAS, terminal settlement and artifact provenance binding update the attempt/node/run projections in source order. Store accepts independent terminal-state combinations and does not validate artifact schemas or establish verification truth. The source late invalid-verification failure, including its partial artifact/attempt effects, is preserved and recorded; typed callers should supply known verification variants. Snapshot 118 compares 131 cancellation, finish, failure and finalization profiles with repeated outcomes and full state projections. Unstarted attempts settle in claim insertion order. Cancellation retains source reason/refusal effects and the two-version RUNNING-to-CANCELLED path without active nodes. FinalizeRun requires successful nodes and an existing artifact, then creates one typed completion outbox record; artifact ownership remains an upper-layer check. Outbox reads are detached and ordered. Snapshot 119 compares 106 actual outbox enqueue/lease/acknowledgment/release profiles and repeated state projections. Enqueue deduplicates run/kind; bounded claims select in insertion order before sorting results and do not mark delivery. Session-scoped acknowledgment/release retain source sequential effects on a later refusal. Caller append must precede acknowledgment; this store does not perform external delivery. Snapshot 120 compares 65 whole graph retention profiles, the default 500-run bound and timestamp ties. PruneTerminalRuns evicts only terminal runs without unread notifications, removing owned nodes/attempts/artifacts/outbox/keys/launches and both insertion indexes under one mutex. Parent references in surviving runs remain historical metadata. Evicted launch keys start fresh on replay, making deduplication a retention window. Snapshot 121 compares 42 actual Python engine profiles and five constructor limits. The native engine schedules definition-ordered dependency batches through an explicit WorkflowRunner, shares an optional AttemptPool, serializes each run and settles structured artifacts, verifier fallback and cooperative cancellation. Inputs retain source scalar/list folding and dependency names can overwrite args. Wall-time budget handling remains service-owned. Idle execution locks are reclaimed; decoded provenance cannot supply live runner authority. Snapshot 122 compares eight real Python isolated worker profiles. Go FreshWorkflowRunner constructs fresh readonly sessions with an Explore catalogue, exact synthetic artifact schema, confined/masked reads, fresh in-memory compaction and typed trusted live context resolution. Named peer contexts drop human capabilities. Invalid submission can repair; duplicate capture keeps the first value. Native tests exercise widened-catalogue readonly denial, isolated histories, no context-management writes and engine/worker completion. The operator runner is callable. Snapshot 123 compares 33 actual Python service projection/delivery profiles, including the real parent injector. ServiceViews now returns coherent detached status and ordered summaries, retains first launch turns, clears pruned bookkeeping and claims at most 50 later-turn notices. Strict >8,000 UTF-8 bytes selects a 2,000-code-point preview and retrieval hint. Run diagnostics retain source outbox fallback. An explicit NotificationAppender receives the untrusted-data wrapper before ack; failed construction or append releases claims. This callable adapter is not bound to live parent sessions. Snapshot 124 compares 20 actual Python dynamic-admission recipes. DefinitionAdmission captures concrete operator caps, strips runtime-owned identity/source fields, validates the definition before ordered process-cap checks and returns immutable content plus the source policy digest. Admission alone grants no authority. Snapshot 125 compares three actual tool schemas, eight canonical/action identities, 20 advertised-shape refusals and 18 memory/SQLite journal profiles. Protocol now carries concrete Workflow/WorkflowStatus/WorkflowCancel inputs, original immutable object definition/ args and a shared named run ID. Recursive masking leaves the original input unchanged; admission does not replace the raw journal payload. Existing native journals begin, bind and refuse conflicting replays with full source record effects. The native stored journal still uses an injected store, not a native SQLite driver. Snapshot 126 compares 23 actual Python owned-service profiles. Native agent.WorkflowService checks trusted human launch capabilities, admits arguments, binds actions and owns background execution, wait/cancel, wall-time limits, terminal outbox effects and closed lifecycle/progress events. Queued replay requires a matching trusted live context; persisted provenance cannot grant authority. Close and parent deletion cancel and join workers; caller timeout leaves background cleanup owned. Active tasks pin graphs until terminal publication finishes. Observer failures are bounded and do not change execution results. The service is an explicit operator library; manager/model/HTTP installation, SSE/archive integration and automatic parent notification append remain pending. Snapshot 127 now compares 21 actual Python workflow tool handler profiles and exact risk/readonly/barrier traits. Explicit RuntimeConfig.WorkflowService activates the three tools and binds its own journal; WorkflowTools alone exposes the source unavailable-service boundary. Managed launch captures the real parent turn and original model input. Trusted launch/manage capabilities and immutable identity/workspace guards run before cached results. Tools retain sorted spaced UTF-8 JSON, source session filtering and cancel reason. The GoResources node includes this explicit runtime surface. Snapshot 128 compares 12 actual Python manager composition/cleanup profiles. ManagerServices.WorkflowTools or an injected WorkflowService now activates one fleet-owned service, captured caps, its journal and a shared attempt pool. Default workers inherit model/tool pools and readonly seams. Normal creation, fork and restore bind the service; autonomous teammates omit all three tools. Delete revokes lookup/admission and joins workflows through terminal publication before scratch reclamation; failed cleanup pins shared workspace paths for shutdown retry. Stop owns service closure even if its caller cancels. Managed launch and cancellation snapshot share an admission barrier, so a pending launch cannot escape deletion cleanup. Defaults remain off. Snapshot 129 now compares the 12 emitted workflow event variants through actual Python session capture, masking, subscriber/sink/backlog and SQLite rows. Manager parents route events through the common Go event bus, injected state store and active trajectory; archival decoding keeps provenance untrusted. Session info and existing owner-scoped HTTP projections expose typed workflow summaries. Workflow SSE uses normal resume cursors plus the source sequence alias. Snapshot 130 compares the actual manager-installed workflow injector: no delivery in the launch turn, custom-injector ordering, later-turn append-before-ack, and no duplicate on a further turn. Go manager parents now install this path automatically when workflows are enabled; failed appends release claims. Result messages retain the Source untrusted-artifact-data wrapper and grant no capability. Snapshot 131 compares dedicated workflow HTTP routes; snapshot 132 verifies actual default Source lifespan activation. Go supports the Source environment flag and --workflow-tools. Snapshot 133 compares all eighteen Source observation kinds, complete finite JSON payloads, optional phase identity and ten constructor refusals. Historical unknown fields and non-approved decisions remain inert data in an immutable JSON value; recursive masking precedes capture. The native service still emits twelve typed variants. Reserved observations do not activate controllers or grant authority. Snapshot 134 exercises nonfinite numbers, escaped surrogate text/keys and masked key collisions through actual Source session capture, SQLite and the observe route. Go restores these inert payload values and emits them through owned TCP SSE catch-up; standard JSON serialization still refuses historical scalars. Source SQLite accepts nonfinite values but degrades surrogate writes while SSE can publish escaped text. Snapshot 135 compares ten Source trajectory file/privacy recipes and forty actual HTTP outcomes. Native file append, scanning, summaries, JSON assembly and filtered iteration preserve nonfinite payloads. Content privacy runs before UTF-8 encoding; redacted surrogate text can be written, while surviving surrogate keys/text fail without appending bytes. Owned JSON downloads retain archival scalars, while ordinary JSON details stay strict. Snapshot 136 compares fourteen Source ledgers, complete HTML hashes, file assembly, CLI output and seventy HTTP outcomes. Native ledgers preserve historical nonfinite payloads and surrogatepass inspector text without turning them into live authority. Preview and inspector caps count Source characters; final HTML UTF-8 validation runs after capping. Visible surrogate text fails, while fully capped text can render successfully. File, trajectory-ID and session CLI loads retain private 0600 output. Ordinary JSON details and downloads keep their separate scalar boundaries. The native Go SQLite backend is implemented; trace-view-specific SQLite composition and remaining permissive metadata profiles need final reconciliation. Snapshot 137 adds eleven historical metadata recipes and fifty-five HTTP outcomes. Streaming summaries select only used fields; archival JSON retains complete metadata, unknown metrics and original scalar identity. Ledger/file readers ignore unused root, header and terminal fields before typed decoding. Empty legacy metadata values and arbitrary inert metadata members match Source rendering and owned encoding boundaries. Snapshot 138 compares forty historical summary field recipes and 280 HTTP outcomes. TrajectorySummaryArchive retains named closed metadata, metrics and timestamp values; producer settings and native scan counters keep their concrete types. Full archived summaries and lists preserve Source values, including unknown metrics. Owned lists filter rows before their masked strict UTF-8 projection. Truthy non-object metadata fails summary/list and owned admission while direct document reads remain available. Direct page and successful HTTP page/list contents match Source. Ledger metric conversion, timing/input/output profiles, trace-view-specific native SQLite composition and full G7 remain open. Snapshot 139 compares seventy-one metric recipes and 284 HTTP outcomes. Named IntegerCount values retain unbounded token sums; MetricValue retains closed historical counters until render-time int conversion. Usage conversion stays at ledger build, header counter conversion at render, and integer formatting observes the Source 4300-digit limit. Pair metrics honor Source scalar key equality. Render now returns HTML or a typed error; RenderUTF8 preserves the final text boundary after caps. Snapshot 140 captures sixteen real Source stdio discovery/result cases. The Go mcp.StdioClient library starts and reuses a native child, serializes requests, filters unrelated IDs, bounds handshake/discovery waits and JSON-RPC lines, withholds registered secrets except explicit passthrough, and restarts dead children on the next call without replaying a failed effect. Discovery values are inert closed JSON; they grant no authority. Tool calls use the supplied context; blocked pipe-write cancellation kills that child to avoid abandoning a partial request. Snapshot 141 compares seven real Source registration scenarios with ten publications, namespace normalization and original-name/timeout outputs. MCP inputs lower to an explicit closed object variant before dispatch, masking and action hashing. Schemas retain refs, numeric enums and Source null/bool metadata as inert closed values; they do not validate arguments or grant authority. MCPRegistry.Register publishes a new immutable catalogue, preserving raw server ownership, description caps and external risk with advisory readonly hints. Existing snapshots retain old handlers. RuntimeConfig.MCPCatalog explicitly installs an operator-discovered snapshot through the existing model-request/gate path; default tools are unchanged. Client lifetime is still operator-owned. Nonfinite/surrogate argument profiles remain unsupported at the strict protocol boundary; the stdio library's archival values do not expand it. Timing/input/output, remaining model/tool scalar and MCP archival profiles, MCP-specific native SQLite composition and full G7 remain open. Snapshot 142 runs five real Source Agent batches: aliases versus raw server names, lazy factories, idempotent connection, same-batch discovered tool calls, same raw server replacement through another alias, cross-server collision refusal, empty server catalogues/empty aliases and withheld-credential diagnostics. Raw Go sessions explicitly selecting MCPTools install connect_mcp as external/exclusive. Successful connection replaces the immutable inventory after prior parallel groups have joined; remaining calls in that batch use the new inventory, matching Source. The next request fits fresh schemas; already built request schemas remain unchanged. Initial ToolSelection is applied at construction; newly discovered tools are added by the authorized connection even if absent from that initial subset, as in Source. MCPProblems() exposes the bounded per-session diagnostics. Factories must retain lifecycle ownership in the raw-session seam. Snapshot 143 adds six real manager recipes for shared clients, factory clients, deletion, stop and fresh fork state. Explicit ManagerServices.MCPTools binds ordered ManagedMCPServer entries through identity-bearing MCPConnection handles. Create/fork/restore receive independent connection state; delete/stop retain holders until their turns drain and close only the last holder. Configured but unused handles stay operator-owned. Factories are retained before discovery, including failed registrations and old raw-name replacements, so cleanup cannot lose a created connection. These failure-path retentions strengthen Source cleanup rather than claim identical historical leaks. Close failures become bounded cleanup diagnostics. Reacquisition waits for an in-progress close; reusable clients may then restart. Snapshot 144 runs three actual Source HTTP configurations through manager_factory and individual registry toggles. Go launcher.Options.MCPTools/MCPServers forwards trusted named servers into the managed lifetime, and standalone --mcp-tools selects the connector. The default executable has no configured servers, matching Source default CLI composition; server definitions come from embedding operator code. Inspection reports the selector without invoking factories or exposing aliases/commands. Native tests compare MCP catalogues, outputs and close counts through real HTTP, and execute a real Go stdio child that starts only on authorized connection and is reaped on App.Stop. Explicitly registered credentials are scrubbed; the default Null registry inherits the environment as in Source. Full MINILOOP_FEATURES stays unsupported. Snapshot 145 captures twelve actual Source InProcessMCP outputs, ordered definitions, duplicate dispatch and Close reuse. Native mcp.NewInProcess accepts named definitions and context-aware handlers returning immutable closed values through the public InProcessValue alias. Python str conversion preserves scalar/container text; ordinary errors become Source Error text, cancellation propagates, and native handler panics become type-only diagnostic text. Discovery snapshots detach their containers; duplicate definitions retain order while dispatch selects the last handler. Close is a reusable no-op, and bare results have no stdio result cap. The adapter implements managed cleanup and still crosses external permission regardless of readOnlyHint. Snapshot 146 runs four actual task-child recipes. The default capability policy excludes MCP tools with empty capabilities; custom policies can select existing connectors/calls. Selected runtime connectors bind fresh child alias/registry state from detached parent server configuration. Borrowed call handlers retain their client, while child registration replaces only child tools. Factory closures retain the enclosing managed parent's lifetime through task drain, including child-only connections; deletion waits for a cancelled child call before close and scratch reclamation. This strengthens Source child-factory cleanup gaps. The typed worker runtime alias is accepted without changing Source's narrower advertised enum. Tests use an explicit permissive operator permission policy to probe binding; production defaults and Explore readonly enforcement stay intact. No default activation or durable claim. The separate Go improvement library now classifies touched verifier paths and computes a typed 16-byte acceptance-instrument fingerprint. It matches the four source root-relative globs, their ordering, file-symlink behavior and unreadable read marker. Substring touch classification has a broader scope than those globs. Snapshot 99 compares actual source classification and ten filesystem digests. The archive now appends typed lineage records to archive.jsonl, masking keys and values before IO. This is a best-effort index: filesystem failure still returns the allocated ID; the proposal branch commit remains authoritative. Snapshot 100 compares source null/empty fields, owner/parent metadata, masking and write failures. Its per-instance lock does not establish cross-process fencing. Archive.List now retains unknown legacy fields and non-object rows in a closed compatibility value, reads newest first, and filters by a caller-bound owner before counting the limit. Snapshot 101 compares 27 source reads. Malformed JSON lines are skipped; UTF-8, integer-conversion, nesting and scoped non-object failures abort. IO errors return an empty index, matching source. It reads the whole file and applies no additional masking to old rows. The Go nesting profile permits 1000 containers; the exact CPython call-stack-dependent cutoff is not established. The manager now owns the archive at workspace_root/.improvements without creating its directory at startup. Default GET /improvements binds the authenticated owner, or uses an operator-wide view on an open deployment. Snapshot 102 compares 46 source HTTP responses, including historical secret retention, empty/IO results and private plain 500s. GET ignores owner/limit/body overrides and spends no rate budget. Nonfinite and lone-surrogate response values fail before response bytes are written. The receipt-gated verified loop, proposal branch/commit flow and POST improvement operation remain pending; HTTP inventory is now 38/44 operations (35 patterns). The separate verifiedloop package now supplies detached task/checkpoint/receipt values, five closed patch-operation variants and a pure atomic ApplyPatch. Only a same-contract, complete, clean receipt covering the requirement permits verified status; stale CAS and every supporting foreign receipt are refused. Snapshot 103 compares 32 actual source folds and byte-identical hash/canonical identities. Task hash intentionally excludes source surface/persistence metadata. Duplicate checkpoint IDs keep source first-lookup/last-fold semantics. These are explicit library transitions. Service now coordinates trusted Worker and AcceptanceRunner effects, baseline/per-judgment integrity probes and three typed telemetry variants. ShellAcceptance reuses a configured shell executor, while WorkspaceIntegrity samples the four source verifier globs. Snapshot 104 compares 22 actual source coordinator scenarios; native tests also run real workspace commands and detect tampering even when acceptance restores the instruments. ManagedSession.RunVerifiedWithContext now binds one admitted cancellable turn to the real worker subagent, configured structured command executor and typed session events. Worker effects retain role/permission hooks; operator-supplied acceptance runs directly on the executor as in Python, without model tool approval. Optional instrument checks use the execution workspace. Verified events pass through the existing masking, stored-event, trajectory and subscription pipeline. Configured leases are renewed at worker/acceptance/event/return boundaries because these tasks do not grow the parent transcript. This is not continuous process fencing or OS confinement. The trusted caller owns external owner admission. Proposal POST /sessions/{session_id}/propose-improvement now binds the admitted session owner and manager archive, refuses busy admission, and runs in the session's existing execution workspace. It neither creates a worktree nor spends rate budget, matching source; the operator prepares an isolated checkout. Snapshot 106 compares 41 real Python HTTP admission/validation outcomes with an observed effect seam. Native TCP tests also execute a child write, acceptance, actual Git commit and owner-scoped archive read. The selfimprove service composes the verified loop with fixed Git status/add/commit/diff/branch commands and optional archive lineage. ProposeImprovementWithContext holds managed admission through the entire proposal, binds the session owner and emits typed improvement_proposed events. Snapshot 105 compares 17 source scenarios; native tests also create actual Git branch commits and cancel before staging. Failed add/commit returns the working-tree change; unverified attempts still produce reviewable proposals. Source staging includes all changed paths, so the operator must supply an isolated workspace. No merge, model tool or HTTP operation is added. Native revisions use signed 64-bit counters with overflow refusal, and canonical text must be scalar UTF-8. Receipt records are not signatures or proof that an acceptance command has executed. A verified loop must sample the fingerprint before each acceptance judgment; computing or restoring a digest alone does not establish verified completion. Personal-skill previews are process-local; a committed SKILL.md is durable, never replaces an existing skill, and appears only in future session snapshots.

The Go HTTP workflow list, detail and cancel routes resolve the admitted session owner before accessing the optional manager-owned service. Cancellation reduces capability and requires ownership without minting human launch authority. Required cancel-body validation precedes session lookup; ingress authentication remains first. The Go workflow HTTP launch route requires an authenticated deployment and an owned parent, then stamps only workflow.launch with explicit_human authority. Its action_id derives a stable msg_ identity for journal replay; absent/null/empty actions receive a fresh wfhttp_ identity. General HTTP messages retain untrusted authority. Workflow execution is selected by MINILOOP_EXPERIMENTAL_WORKFLOWS or the explicit Go --workflow-tools flag. All four process caps are captured from typed settings; defaults remain disabled. The manager owns worker pools, journal, cancellation and terminal publication through normal launcher shutdown.

Open the interactive architecture for guided request, tool, and orchestration views. Its source is docs/mini-loop-system.architecture.json. The Mermaid block above remains the canonical GitHub view.

Architecture maintenance contract

• Review and update the runtime baseline on every implementation iteration.
• When ownership, control/data flow, authority, persistence, entry points, or defaults change, update the Mermaid, boundary explanation, and interactive specification in the same commit.
• Keep default-on, default-off, process-local, library-only, and durable claims distinct.
• Regenerate interactive HTML from its JSON source; never hand-edit generated HTML.

Go AgentGuardian now derives a fresh readonly auditor from a pinned typed parent environment. GuardianReviewer can be explicitly installed as ApprovalBrokerConfig.Reviewer; masked ASCII previews cap at 2000 characters. Eighteen Source reviews and four adapters match prompts, catalogues, text results and verdicts. Both narrow and operator-widened catalogues preserve zero-write enforcement. Parent history remains unchanged; child provenance is peer-agent and lineage role is auditor. Session.Guardian captures outside a running parent turn; it must not recursively acquire the parent turn lock from an approval callback. ManagerServices.GuardianEnabled now selects a per-action review from the current owned turn, using an immutable parent snapshot and a cloned approval surface without changing the shared broker/policy. Fresh reviews see the current owner/workspace/catalogue; remembered human grants still answer first. Native manager tests match the seventeen Source recipes' applicable approval outcomes/receipts and refusal boundaries, plus concurrent full owned turns. Ordinary provider faults remain Source-style error text and can contain a parsed verdict; constructor faults abstain through broker containment. Cancellation escapes without parking a human. Launcher now forwards MINILOOP_GUARDIAN to this owned binding and reports guardian_enabled during side-effect-free inspection. The flag is accepted independently of the still-unsupported comprehensive feature bundle. Eleven real Source/Go HTTP turns match model-visible catalogues, review prompts, tool results, human parking and actual canary-file effects. The default human path is unchanged; shared model/tool pools retain their existing nesting behavior.

AST Result.ToJSON now matches Source compact result strings, preserving lone surrogates through the closed value's existing surrogatepass representation. Strict JSON/UTF-8 byte encoders remain separate. Tool-result block wire encoding refuses invalid UTF-8 before direct/streaming provider HTTP, preserving the Source SDK's zero-transport outcome instead of replacing text. Eight Source operations/Tool.run/SDK recipes match native output and cleanup; readonly runtime execution keeps the exact result text. Go provider errors retain FailureProtocol; exact Python exception text and broader transcript/SSE/recording Unicode profiles are not claimed aligned.

The Go Launcher forwards MINILOOP_AST_OUTLINE_ENABLED/BINARY/SHA256/TIMEOUT/ MAX_OUTPUT_BYTES into the managed AST adapter. Selection is default off; activation requires a trusted absolute executable and SHA-256 pin. The Source defaults are 10 seconds and 1,000,000 output bytes. Settings inspection and --dump-config report selection without executing a probe. Fourteen Source HTTP/model traces compare catalogues, exact results, actual child argv/cwd and private snapshot removal; path/digest/version/output/timeout failures retain the common gate and readonly session binding. This completes Launcher selection for the implemented AST tools; extreme malformed output profiles and full migration gates remain open.

Go efficiency currently provides immutable component descriptors and optimization receipts as an independent library. Closed stage/mode/status/lossiness/cost values, unbounded typed integer limits/metrics, validated digests/references, bounded warning codes and detached projections match 68 actual Source constructor recipes. An explicit RawStore now holds caller-masked UTF-8 text in session-local RAM, with cryptographic refs, trusted-clock TTL, capacity and integrity checks and close/clear/discard/sweep. Workspace/directory are provenance only; no raw artifact files are created. Explicit RuntimeConfig.TokenArtifactTools installs bounded read_token_artifact via the common gate, with caller-owned store lifetime and pinned session/owner/workspace authority. Character pagination plus header/continuation stays within 50,000 UTF-8 bytes; unbounded numeric pagination and explicit null retain typed replay identity. Existing tool selections and custom same-name catalogue entries remain intact. Explicit Agent reducer integration is described below; Manager/default runtime composition and Launcher mode/style selection are installed. Immutable MaskedObservation/ObservationReduction and two builtin reducer libraries now match twenty Source constructors and 69 reducer inputs. DeterministicLosslessReducer preserves Python ANSI, Unicode-14 diagnostic and path rules. ObservationPipeline now orchestrates explicit typed bindings in off/shadow/enforce modes with byte/token inflation and double-reduction guards, recoverable masked RAM retention and safe fault receipts. WithRawStore clones share component serialization and synchronized token estimates. Explicit Agent adoption and Manager/child composition are installed; Launcher mode/style selection is installed. Observation components now expose optional typed Initialize/Health/Close hooks, clone-shared cached reports, exclusive health admission and close-before-drain fencing. Timed drain failures remain retryable; hook faults are contained class-only records. Bare store bindings remain caller-owned; Manager owns its managed session/template stores. Masking before/after the plugin boundary and multi-stage identity registration are described below; default Launcher settings selection is installed. RequestPipeline now optimizes immutable provider-neutral RequestDocument values through explicit RequestOptimizer/OptimizationContext/result types. JSON data uses closed recursive variants; no generic service map or opaque raw JSON is retained. Frozen-prefix guards, mode ordering, inflation, ownership, failure receipts and cancellation match Source. Common componentRuntime owns typed hooks, call gates, counters and drain state for each stage's clones. Observation/request/response libraries remain separate roots when independently constructed. Registry now supplies global-ID admission and snapshots; Runtime composes all three stages into one lifecycle/call/ counter root. Same pointer instances share locks and lifecycle hooks, while distinct objects with equal IDs in direct StageComponents retain independent hooks. Clones share admission/draining with explicit caller-owned raw-store binding. Agent request ledger is now installed by explicit RuntimeConfig.TokenEfficiency; observation adoption and Manager/child composition are installed; Launcher mode/style selection is installed. The Agent consumer now guards role/count/tool identities, error flags and stable protocol blocks before lowering eligible payloads to named message variants. Its transient ledger reuses provider projections while preserving authoritative history; model/system/tools remain outside the request optimizer document. ResponsePipeline now uses named immutable response settings, ordered string-pair metadata and unbounded output caps. PassthroughResponsePlanner and explicit opt-in ConciseResponsePlanner preserve Source bounds, metadata order, dataclass-repr receipts and output ceilings. Unchanged settings precede ceiling checks; shadow measures candidates before enforce-only cap protection. Safe failures retain the prior context. The shared coordinator handles each response root's clone admission and draining. RuntimeConfig.TokenEfficiency now installs explicit Agent response planning before cache annotation on agent_turn purpose, using latest user text, output-cap budget and ConciseResponse opt-in. The provider receives appended instructions and a tighter cap; verbosity/metadata remain provider-neutral. Receipt events retain metrics and warning count while excluding digests, warning strings and content. Typed event masking, detached snapshots and archival replay preserve this projection. Request optimization now runs before cache annotation, with latest-assistant/full prefix freezing and cross-round projection reuse. Protected skill previews bypass request/cache seams and remask/refreeze selected messages for every recovery call. Observation adoption and Manager/child composition are installed. Environment activation remains pending. See E0-E6 in GO_PORT_PLAN.md for the remaining sequence.

Go explicit observation adoption runs after full output masking and before journal settlement/result observers. Journals retain full masked authority; model results, observers, events and trajectories receive the candidate plus its masked recovery marker. Replay and read_token_artifact skip reduction. Envelope inflation discards unused raw refs and reports authority metrics. readonly/absent recovery tools forbid raw writes; foreign workspace stores are detached. ObservationRawConfig snapshots persist/minimum-byte settings; defaults are true/4096 only within an explicitly injected runtime. Shared component/store lifetime and default Manager composition remain caller-owned/pending. A typed stage-error event contains no plugin text.

Protected API documentation

Go serves /openapi.json, /docs, /docs/oauth2-redirect and /redoc from embedded resources generated by python/tools/export_go_api_docs.py. GET/HEAD, method refusals and trailing-slash redirects match the captured default Source routes. They inherit the shared request body cap, authentication and security headers; query credentials remain restricted to event streams. Documentation reads no sessions and grants no execution authority. These requests finish inside the HTTP entry after authentication; the diagram's entry-to-Manager path describes service requests. The schema covers the same 40 explicit business paths as Source, and resource generation is a build/check operation with no Python dependency in the running Go server.

Source UI templates retain their external library references and the existing CSP. HTTP template/schema parity is verified; browser rendering of the external libraries is not claimed. Custom ASGI mounts/root paths are outside this default route capture. Refresh/check with .venv/bin/python python/tools/export_go_api_docs.py --check.

Business routes use private named route segments, finite verbs and ordered method/handler declarations. Source's first registered route determines 405 Allow; recognized trailing-slash paths redirect with 307 and preserve host, scheme and query. Routing reads the fully decoded path without ServeMux dot/empty-segment cleaning or escaped-slash parameter matching. A matched handler receives named path values; refusals and redirects invoke no business handler. The shared body cap and one authentication admission precede every routing decision, including public-path slash variants. Query credentials remain stream-only.

All 168 actual Source routing requests are required native TCP assertions. They include the original 160 requests and eight dot, empty-segment, encoded-slash and repeated-slash boundary cases. Python transport capture preserves literal dot paths at ASGI ingress because httpx otherwise normalizes them before delivery. Optional diagnostic output remains available to compare historical baselines; its exit alone is not a parity claim. Custom mounts, forwarded-host deployments and the full public-entry scope audit remain open.

Provider endpoint paths

Direct and streaming providers construct the outbound messages path from the validated base URL's original path bytes. Literal dot segments follow captured HTTPX normalization; existing percent escapes and repeated slashes remain intact. The SDK adds a slash only when absent before appending v1/messages. The configured endpoint used in audit identity is retained. The original 40 SDK requests across 20 path profiles remain required, including Unicode, spaces, encoded slashes/dots, repeated trailing slashes and literal parent/current segments. The expanded inventory adds 92 printable ASCII path characters (excluding percent/query/fragment delimiters), for 224 required direct/SSE requests. All 224 now match, including literal backslash, caret and pipe. Source raw_path maps to explicitly populated Go URL.RawPath; URL.String retains the full captured URL. URL.EscapedPath remains the standard Go canonical view and is not claimed to equal Source raw_path. Construction performs no HTTP request. Existing credential admission and redirect refusal remain in place. Query/userinfo/fragment restrictions retain their current native admission rules; general hostname/port normalization and custom transport acceptance remain outside this path capture.

Accepted hostname spelling uses the existing Python Unicode 14.0.0 casing tables before native transport IDNA, matching HTTPX's whole-host lower() order. This preserves dotted-I expansion and contextual sigma across label separators rather than applying Go rune casing. Numeric ports lose leading zeros and default HTTP/HTTPS ports are omitted. IPv6 spelling/brackets and configured audit identity remain intact. All 32 captured ASCII/IPv6 direct/SSE requests remain required. Forty actual loopback HTTP requests compare Host, target, method, API-key and TCP dial authority against SDK captures. Only TCP destination is redirected; HTTP encoding/parsing and provider/SDK behavior are real. The expanded inventory includes dotted-I, repeated/mixed dotted-I, uppercase Unicode/sharp-s, final/medial/across-dot/combining sigma, Armenian and Cyrillic hosts. Baseline matches 12/34; the native casing change matches 34/34, including the original two required dotted-I failures. No dependency is added. Unicode request-object/custom transport spelling still differs from Source's ASCII IDNA view. General IDNA validation/normalization, broader admission and TLS/SNI equivalence remain open; this wire inventory does not establish them. Six additional literal backslash/caret/pipe path requests now match real-wire target comparisons, giving 40/40 matches. The representation probe established that one Go URL representation cannot retain full Source spelling and all wire target forms at once. For these literal paths, the client owns a clone of the standard Transport. Proxy policy observes the original request once per attempt; a private wire URL clone selects origin-form for direct/HTTPS and absolute-form for HTTP forward proxy. Standard net/http retains Host/IDNA encoding, CONNECT, TLS verification, dialing and pooling. Response.Request refers to the original metadata view. Caller Transport is never mutated; CloseIdleConnections releases the selected pool. Ordinary paths use the existing transport. Custom non-standard RoundTrippers receive the metadata view and retain responsibility for their encoding/routing; their wire parity is unproven. The broader IDNA dependency proposal remains pending and is not needed for this casing change.

An additional 24 actual transport captures cover HTTP forward proxy, HTTPS direct and HTTPS CONNECT, each with ordinary/backslash/caret/pipe paths in direct/SSE. The owned TLS origin verifies the pinned test certificate and fixture.invalid hostname; CONNECT relays opaque TCP bytes. All 24 native targets now match, including the original 18 required failures. All 16 TLS SNI observations and eight CONNECT authorities agree; API-key is absent from CONNECT and present in application requests. Proxy requests use absolute-form; both HTTPS application routes use origin-form. This confirms the transport route must choose the target form. The explicit proxy/certificate, single hostname and HTTP/1.1 scope do not establish environment proxy discovery, proxy authentication, HTTP/2 or general TLS/IDNA equivalence. Source handlers/sockets join after SDK reply validation; remaining owned sockets are aborted for tunnel shutdown. This is test teardown, not a production transport change. All 24 cases remain required assertions.

A subsequent 68-observation URL scope audit captures the actual Python provider factory and both SDK request modes with injected HTTP boundaries. It distinguishes authority/empty-fragment representation differences from existing native admission refusals. This is an inventory prerequisite, not a parity gate or a real-network acceptance claim. See URL scope evidence.

Completed provider reply metadata

Go protocol.ModelReply preserves the SDK container and stop_details through direct HTTP, SSE accumulation, immutable value copies and public JSON. Named container/refusal fields retain nullable text/timestamp observations and finite unknown extensions. Provider ingress selects SDK datetime normalization; archive decoding preserves the stored observation. SSE retains the initial container and replaces stop details only for a non-null delta, matching the 196 captured SDK 0.107.1 observations. Whole-container validation selects Pydantic timestamp/date parsing; invalid container fields select SDK loose construction with Python numeric/Unicode date semantics. Microsecond rounding and negative float handling follow their distinct captured paths. Invalid dates remain observations, and archives do not re-normalize stored expiry values. Metadata supplies no execution authority. The existing Agent event projection still reports content, stop reason, served model and usage. This reply data-shape change leaves the canonical architecture flow and defaults unchanged; wider provider/custom-transport acceptance remains open.

Named usage observations and metering

Whole-usage implementation review at local main baseline 7095efb adds a closed private observation variant with no count authority. DecodeSDKUsage selects SDK loose construction explicitly: missing/null usage projects to null, scalar/list usage to a Python text envelope, and partial objects receive null required counts. Native TokenUsage object admission still requires both count fields. Provider SSE start preserves the observation before the captured delta assignment failure. Clone/masking, reply/event archives and SQLite reopening retain projected shapes; explicit usage null remains distinct from absent event usage. The required Source inventory is86 direct/SSE cases and48 snapshots, including nested model/list repr. Model-array repr construction uses temporary named model selection and closed observations without calling the counted usage decoder. Arbitrary integer lexemes and eligible integer text survive without meter authority; SDK float-to-integer validation retains its signed64-bit boundary and preserves larger finite floats. The layered base topology and execution-authority boundaries remain unchanged. Full provider/default/non-Darwin and G0–G7 acceptance remain open.

SDK count fields use immutable UsageCount variants for integer, float, bool, text, null, array and object observations. Known fields remain named; only unknown metadata uses the extension boundary. Direct required counts preserve their observed kind, while optional SDK integer fields normalize eligible scalars. Pure model-array construction counts significant decimal digits for its SDK integer-text limit; thousands of leading zeros may normalize to a small inert integer. Oversized significant digits remain text. Text normalization checks integer digits, correctly placed integer separators and an optional all-zero fractional tail without floating-point conversion. Nonzero fractional tails and malformed forms remain text observations; large integer text within the native count range retains its exact integer value. Known metadata with non-object/non-text shapes uses immutable UsageMetadataObservation variants, preserving integer lexemes and finite floats without metering conversion. Each named nested model validates its required counts as a unit before coercion; invalid models retain fallback count kinds. Wrong-shaped model arrays supply defaults only to their top-level mapping entries, without count coercion. SSE start validates metadata and count eligibility together; deltas retain the previously accumulated input kind unless explicitly replaced. Captured SSE start/delta validation is applied per stage before accumulation. Metering accepts integers/floats/bools, truncates fractions, ignores text and structured values, treats zero as no observation and allows negative anchors before clamping used context. Compaction receipts retain observed count kinds. Decision estimates require nonnegative integer variants and reject projections from other kinds. Clone/masking and archival/SQLite codecs preserve observations without adding authority. Native integer and finite float metering bounds remain explicit adaptations; complete provider/port acceptance remains open.

Model Bash input binding failures

Finite model-reply Bash objects with extra parameters or a missing command, and non-mapping array/null/text/number/bool inputs, retain named binding failures through direct/SSE decoding, clone/masking and historical reads. Known fields remain typed; immutable extras contain only unknown parameters. The gate settles the failure after before hooks, guards, permission and journal checks, before invoking any handler. Before hooks can replace the input with valid arguments; denial still takes precedence. Failed outcomes use the existing after hooks and result observers. Explicit DecodeToolInput admission stays strict. BashRejectedArguments retains finite non-mapping observations with a closed named kind; no handler receives them. ServerToolInput retains immutable observational roots, including legacy SDK numbers, without client dispatch. Named BashBackgroundRequest and BashApprovalProposal retain finite optional-field observations. Execution receives the explicit Python-truth boolean and only string-array proposal tokens; invalid proposals cannot supply a grant. Original option values survive direct/SSE, clones, masking, history and SQLite reopen. All 56 actual Source activation/option consumer cases match native foreground/background selection and approval candidates; 28 wire samples (27 unique inputs) match direct/SSE and SQLite reopen. Explicit caller admission stays strict. Finite non-text commands now retain a named BashCommandObservation and closed kind. Permission/approval consumers read its Python str(value) projection; native handlers return a named split/lower failure at the corresponding consumer stage. Explicit background requests initialize the owned manager before split failure, matching Source, without starting a task. Extra-argument failure and before/guard rewrites or denials retain precedence. Thirty-six actual consumer profiles and 20 actual permission profiles match; 44 unique command/option inputs retain raw values through direct/SSE, clones, masking, history and SQLite reopen. Nonfinite inputs and other default-tool consumer types remain open. Tool display now reads the same observation text after recording-copy masking, preserving Source None, number/container representations and bounded previews without executing that text. Thirty-six actual Source tool_use event labels and 12 independent masking/display profiles match; key collisions, Unicode and opaque shell previews preserve the live input. Explicit background_run now shares the Source shell label rules; 14 actual masked string-command profiles verify search/list/read, opaque shell, Unicode and bounded previews without changing the live command. Direct background_run now retains named command observations and binding failures through model decoding, cloning, masking, historical reads and canonical action identity. The common gate settles invocation failures after hooks/guards/permission and journal admission, while actual command consumers initialize the owned manager before split failure without allocating a task. Eighteen actual Source profiles match display, final input, hook/result order and background initialization/task numbering. Before rewrites and denials retain precedence. Known timeout/prefix fields remain typed; their broader coercion audit, nonfinite optional fields and complete provider/port acceptance remain open.

Background optional observations and wait policies

Model background replies retain named BackgroundTimeoutObservation and approval proposal metadata. Known integer timeout accessors remain available; execution lowers observations into a concrete BackgroundWait policy after the common gate. Falsy values use the configured default; bool/fraction/negative numeric deadlines, immediate NaN, positive infinity and post-spawn type/overflow faults match 48 Source task profiles. Finite deadlines beyond time.Duration use bounded timer steps rather than overflow or early rejection. Explicit typed caller admission remains strict. Clones, masking, canonical identities and archived messages preserve observations; finite JSON still refuses nonfinite values. Only valid string-array approval proposals reach existing candidate validation; readonly calls allocate no task. Source type/overflow faults leave processes running. Native execution deliberately kills and joins those groups before settling the same error text, preserving its resource-ownership boundary. NaN uses the unguarded Source profile's immediate timeout. An outer Python watchdog changes that profile to completion; exact timer-heap parity is not claimed. Native direct/SSE and SQLite message close/reopen preserve all 48 option inputs. The 48 captured SDK and managed optional profiles are checked separately below; broader SDK consumers and full-state recovery remain open.

The captured SDK forwarding path rejects nonfinite request observations before credential fetch or HTTP. Go direct and streaming adapters classify this as FailureNonfiniteRequest / ValueError and retain nonretryable protocol recovery evidence. Session accepts the optional named ProviderErrorDetail projection only at its final provider error boundary, bounds it to 500 runes, and emits the same assistant/event detail. Other failures retain native diagnostics. All 48 captured managed optional profiles now assert their final reply text.

Missing model tool observations

Unknown model tool names now retain an UnknownModelToolObservation with finite, immutable argument data. Missing registry entries settle as Unknown tool: NAME after before hooks, guards, permission and journal checks, through ordinary failed after/result handling. All 32 actual Source recipes match, including all three permission modes, scalar/container roots, empty/Unicode/case-sensitive names, input rewrites, denials and post-result replacement. Missing tools create no approval requests or handler effects. Direct and SSE model replies retain the same observations, as do masked clones, canonical identities and stored messages. Typed executable inputs still require their concrete native decoder. Malformed known-tool inputs cannot fall back to this observation. A custom schema alone cannot execute it; the gate reports the missing native input decoder instead. Explicit NewTypedExtensionTool now binds a named input codec after this gate. Broader extension coercion, unknown MCP root shapes and nonfinite inputs remain under audit. Strict explicit DecodeToolInput admission remains strict.

The Go inspection/estimation JSON formatter reuses closed text span encoding after its existing string unmarshal. It keeps raw non-string token spelling, including legacy NaN/Infinity observations, and the caller's ASCII/UTF-8 and separator mode. Exact projection bytes preserve token-meter and compaction thresholds. This adds no decision or execution authority and changes no SQLite lease, replay or readonly rule; the original maximum replay test still shares its 30-second context.

Legacy compact/pretty inspection text uses the scalar UTF-8 codec only after the standard UTF-8 check. Surrogatepass text and malformed native bytes retain their original lowering path; a legacy Python string remains distinct from final UTF-8 wire bytes. Key order, indentation, nonfinite spelling and caller trust are unchanged. The original maximum SQLite restart/replay/readonly test keeps its 30s shared context.

Memory-selection replies now use immutable closed JSON observations before any index is selected. Python-compatible NaN/Infinity are ignored as floats; booleans remain integer indices, duplicates and order remain, and only the first five valid indices reach owner-bound memory records. Ignored fields still participate in full parse failures: a 4301-digit integer, malformed suffix or excessive nesting causes lexical fallback even after a valid earlier index. No reply value selects an owner, path, execution grant or live-conversation meter anchor. The archive decoder retains its separate1000-container profile. A trusted private selector preflights the whole memory-selection reply at982/980/978/972/976 total containers for direct/Agent/Managed/POST/SSE callers. Three hundred actual Source array/object cases pin adjacent boundaries; custom host/other caller stacks remain separate acceptance.

Repository map

Path	Responsibility
python/mini_loop/agent.py	Python async model/tool loop and execution pipeline
python/mini_loop/session.py	Python per-session history, lock, events, lease, and persistence bridge
python/mini_loop/manager.py	Python composition root, ownership, shared services, session lifecycle
python/mini_loop/server.py	Python FastAPI factory, REST/SSE surface, embedded console
python/mini_loop/builtins.py	Python default and comprehensive tool registries
python/mini_loop/workflows/	Python experimental read-only declarative workflow runtime
python/tests/	Python offline loop, safety, persistence, concurrency, API, and seam coverage
python/tools/	Python verification and benchmark scripts
python/examples/	Runnable Python custom composition
go/	Independent Go implementation; see the parity matrix for current coverage
deepagents-server/	Independent opt-in Deep Agents graph on standard LangGraph Agent Server, with its own environment, lock, authentication and deployment configuration
go/audit/, go/cmd/miniloop-audit/	Typed remote health audit and standalone CLI
go/httpapi/	Embeddable typed authentication, REST admission and process-local SSE
go/identity/	Streamed native executable fingerprint and shared process identity; success-only cache and wall-clock uptime
go/runtimeconfig/	Pure validated-settings translation shared by Launcher and fake benchmark
go/efficiency/	Typed registry, shared three-stage runtime/lifecycle, scoped masked RAM/recovery; Manager, child and Launcher adoption; default off/normal
go/secrets/	Typed optional credential lookup, environment selection and masking
go/internal/	Shared Python filename matching and pinned Unicode/text semantics
go/testdata/	Generated Python tool, OpenAPI, and SQLite contract snapshots
docs/	Design evidence, research, hardening record, and roadmap
research-site/	Read-only browsable projection generated from docs/*.md

Use EXTENDING.md instead of reading modules in directory order; it follows the construction seams from caller identity through serving.

Configuration

python/.env.example is the Python configuration index. The main groups are:

Concern	Variables
Provider	ANTHROPIC_API_KEY, MODEL_ID, ANTHROPIC_BASE_URL
Runtime limits	MINILOOP_MAX_CONCURRENT_*, turn/token/compaction/bash limits
Optional modules	MINILOOP_FEATURES, MINILOOP_GUARDIAN
Typed decisions	MINILOOP_DECISIONS=off|llm|jev, TYPESAFE_API_KEY, MINILOOP_DECISION_MODEL
Workspace and resources	MINILOOP_WORKSPACE_ROOT, MINILOOP_BINDABLE_ROOTS (directories a session may be bound to via POST /sessions {"workspace": ...}; empty refuses binding), MINILOOP_REPO_ROOT, MINILOOP_USER_RESOURCES_ROOT, MINILOOP_MEMORY_ROOT
Evidence	MINILOOP_TRAJECTORIES, MINILOOP_TRAJECTORY_ROOT, content-capture settings
Token efficiency and AST	MINILOOP_TOKEN_EFFICIENCY_*, MINILOOP_AST_OUTLINE_*

MINILOOP_EXPERIMENTAL_WORKFLOWS supplies settings for an explicit local integration; it does not enable workflows on the default FastAPI server.

Validation

The explicit go/tools/contractaudit command inventories fixture references and candidate Go test callers. Export Source with --check --manifest <path>, save go test -json stdout separately from stderr, then pass -manifest <path> and -results <stdout-path> to the operator command. -require-results rejects absent candidate passing root results; its rejection is retained while the syntax parser has no native consumer. Root test success does not certify fixture reads, branch coverage or semantic assertions. The Linux watchfiles fixture is outside the current exporter and selected only on Linux; a Darwin root pass cannot prove its comparison. Dynamic/method/global-constant paths require separate review.

From go/, go run ./tools/typeaudit -root . checks package-level production type bodies across all platform files for any, empty interfaces and JSON raw messages. Function-local ingress DTOs and generic constraints are excluded. Add -public to inspect compiler-resolved exported type payloads in the active build profile: cross-package aliases, nested retained fields, generic arguments and signatures nested in those type bodies. Top-level functions and named struct methods are outside this traversal. The compiler inventory uses only Go standard library tooling and existing module dependencies. Imported aliases and erased interfaces are expanded; external structs and named nonempty capabilities remain opaque platform boundaries. Private fields reachable from exported types are covered by -public. Add -private to resolve every active package-level unexported type root from the compiler-selected source files, including generated CGO declarations. It detects imported aliases, instantiated generic payloads and erased external aliases even when no exported type references the root. Add -variables to resolve every exported/private package variable, including inferred declarations, instantiated generic containers, imported aliases and stored function signatures. It shares the active compiler/CGO source resolver and opaque platform boundaries. Constants, blank declarations, tests and function locals are excluded. Select only one of -public, -private and -variables per invocation. Inactive platform definitions retain the syntax audit's separate scope for named types; inactive variables are not checked. These checks do not inspect function-local types, function bodies, runtime data flow, named method implementations or external library internals. Runtime topology and feature defaults are unchanged by this audit tool. These checks complement the remaining external-type and runtime data-flow review.

python/tools/go_port_performance.py compares isolated default Python/Go fake HTTP workloads with actual Bash file effects and joined server shutdown. Build Go separately, then run .venv/bin/python python/tools/go_port_performance.py --go-binary /absolute/path/to/miniloop --output /tmp/go-port-performance.json. The report retains raw samples, build identity and host metadata; default access logging is retained, and sampled RSS is not peak memory.

Interruption tests cancel after a real captured assistant_delta, holding the event boundary until cancellation. Partial-answer and thinking checks wait for their specific text; delayed-start cases exercise startup slower than the former 120ms timer. Cancellation readiness has a ten-second failure bound. This changes test coordination, not production transport or interruption behavior.

The default test suite is offline and deterministic. Runnable documentation examples select the fake provider inside their test fixture, including examples that reload settings and construct their own client. Root pytest.ini targets python/tests, which contains all tracked Python test files; saved test copies under var/ are outside default discovery. Explicit test paths remain available:

.venv/bin/python -m pytest -q
.venv/bin/python python/tools/verify_invariants.py

Additional mutation guards and source scans protect load-bearing boundaries: The mutation runner first passes the unmodified target, then requires a pytest test-call failure from its mutant. Collection/fixture errors, skipped or empty baselines and timeouts are invalid evidence. Fast tests also validate mutation syntax and collect every recorded selector.

.venv/bin/python python/tools/verify_guards.py
.venv/bin/python python/tools/verify_scans.py

The current Go slice is checked independently:

cd go
go test ./...
go vet ./...
go test -race ./...

Check the Python contract snapshot before extending the Go port:

.venv/bin/python python/tools/export_go_contracts.py --check
.venv/bin/python python/tools/export_go_unicode.py --check

Documentation map

Question	Document
How do I inject or replace a runtime seam?	Extending mini-loop
How do I run the independent Deep Agents server?	Deep Agents server guide
Which external architecture informed that module?	Managed Deep Agents / Agent Server reference design
Why does a guard or invariant exist?	Hardening notes
What is durable, inspectable, or exported?	Agent trajectories
How do owner skills and memory resolve?	User-scoped skills and memory
How do typed judgments and Jev integrate?	Typed decisions
What is the verified-loop adoption status?	Verified loop design
What remains before a broader agent platform?	Agent Platform Roadmap
What informed the token-efficiency design?	Token-efficiency components
What is the Python-to-Go migration sequence and current parity?	Go port plan, parity matrix, public scope inventory, and provider scope audit
Where are the source-level external studies?	Research Atlas

Go efficiency startup selection

runtimeconfig.ManagerEfficiency converts validated config.Settings into detached agent.ManagerEfficiencyConfig selections. Launcher and request-time fake benchmark construction both use it. Off/normal remains the default; shadow observes reducer candidates, enforce applies reductions, and enforce/concise adds instructions with a tighter response cap. Configured persistence, threshold, TTL and capacities reach Manager-owned scoped masked RAM stores. App.Serve initializes the shared root before listening and Stop drains sessions before store/component closure.

Nine Source HTTP traces match actual native listener/provider/shell requests and metric-only receipts, including readonly, disabled persistence, below-threshold output and raw recovery. Two separate benchmark Source reports compare selected settings using four isolated fake arms. Benchmark now constructs the complete session, runs setup, then calls ManagedSession.RestrictTools before its first turn. Already allocated stores stay owned until manager drain/close, matching Source order. The comprehensive MINILOOP_FEATURES bundle and SQLite backend remain unavailable.

Managed tool restriction before the first turn

ManagedSession.RestrictTools accepts an immutable ToolSelection under exclusive admission and the core lock. It replaces the inventory with a newly owned subset, retaining installed order and ignoring unknown names. Repeated restrictions cannot restore removed tools. Busy, closed, cancelled and previously used/restored sessions refuse mutation. The same gate inventory supplies model schemas and execution admission; published snapshots and construction-time service/store bindings remain unchanged. Ordinary CreateSessionRequest.ToolSelection still filters before store allocation. Benchmark deliberately uses the post-construction seam after setup to match Python run_arm. Seven actual Source recipes cover store identity, schemas and shutdown; additional native tests cover removed write effects and admission.

Component timeout overflow

Efficiency descriptors retain arbitrary-size positive integer milliseconds. Invocation first converts the exact ms/1000 ratio, matching Python integer true division. A finite ratio may exceed Go scheduling range and retains duration saturation; an infinite ratio produces a named OverflowError before the component body runs. Stage receipts and initialization reports contain the safe fault code. Close returns the typed error, retains admission fencing, and caches no success. Twenty-five actual Source operations cover three stages and initialize/close, including 2**1024 milliseconds that remains finite only after ratio conversion.

Nonfinite known Bash inputs and batch preparation — 2026-10-11

Named Bash command, option and rejected-root observations retain SDK NaN and Infinity without producing executable argv or grants. Strict explicit callers and outbound HTTP JSON remain finite. The entire model batch prepares copied inputs before any hook or effect; a later invalid root prevents an earlier valid call from executing. The original assistant observations remain in history.

Actual pinned Source captures cover 24 unique direct/SSE inputs, 36 standalone gate profiles and 24 managed runs. Six managed roots fail before the gate; eighteen object inputs fail finite journal fingerprinting after before/guard, without an action entry or after hook. Named archive round trips retain identity; these new profiles do not establish SQLite restart parity. Native readonly checks are separate from Source profile comparisons. Falsy roots and string-key pair lists have explicit batch normalization; non-string pair keys are unsupported. Broader background inputs, SDK error-text fidelity and complete migration remain open.

Nonfinite background command and root observations — 2026-10-11

The background model decoder now retains named nonfinite commands, rejected roots and immutable unknown parameters through direct/SSE, masking, identity and archives. Standard caller/request/event encoding remains finite. The same shell batch preparation applies before the gate; a later bad root prevents an earlier valid background call from creating a manager or task. Standalone command consumers initialize the owned manager before split failure, allocating no task. Unknown parameters and non-mapping invocation failures do not initialize it; before rewrites and denials retain precedence.

Actual Source/native comparisons cover 27 standalone profiles, 18 managed profiles and 18 unique SDK inputs. Python and native SQLite message close/reopen preserve those 18 observations; valid next HTTP encoding fails before transport. Managed journal fingerprint refusal precedes manager initialization. Native readonly checks show no observation supplies a grant. Shared capture helpers retain the existing Bash fixture observations unchanged. Timeout/approval-prefix coercion, broader input variants and complete migration acceptance remain open.