| 1 | # Harness-style execution migration |
| 2 | |
| 3 | This document defines the current execution behavior introduced from the |
| 4 | `main-v2@986a6bc967` baseline, using the freshness and recovery principles from |
| 5 | the DeepSeek Harness reference `master@c291e7961a`. Reasonix keeps its Go |
| 6 | runtime, permission model, sandbox, Goal, Plan, checkpoints, and multi-agent |
| 7 | support. It does not adopt the Cordis plugin framework. |
| 8 | |
| 9 | ## Current behavior |
| 10 | |
| 11 | - Structured file writers require a host-observed current version. Any |
| 12 | successful text window is sufficient. Successful writes refresh it. |
| 13 | - Calls take effect in actual execution order. `read → edit → edit → bash` can |
| 14 | complete in one provider batch. An ordinary failure does not cancel later |
| 15 | independent calls. |
| 16 | - Large reads are bounded outputs. Pagination is optional and never prevents a |
| 17 | command, network call, another file, or final completion. |
| 18 | - Started calls without a reliable result are durable `unknown` facts. They |
| 19 | cause an advisory recovery message, never a tool ban or implicit replay. |
| 20 | - The model judges completion. `complete_step`, `review_report`, read-policy |
| 21 | receipts, final-readiness proof, operation settlement, Auto Guard review, and |
| 22 | recovery confirmation cards are retired. |
| 23 | - Consecutive identical calls receive parameter-free reminders at counts 3, 5, |
| 24 | and 8. The calls still run. |
| 25 | |
| 26 | Three limits are intentional. A window read is not a claim of whole-file |
| 27 | review. Bash and MCP calls are outside the file-observation policy. An unknown |
| 28 | external side effect has no host-enforced duplicate-execution guarantee. |
| 29 | |
| 30 | File-operation failures use stable codes: `FS_NOT_OBSERVED` asks for a current |
| 31 | window read, `FS_STALE_VERSION` asks for a reread after an external change, |
| 32 | `FS_NOT_FOUND` reports an absent source, and `FS_ALREADY_EXISTS` reports a |
| 33 | protected create/move collision. These are local call failures and never create |
| 34 | a global pending operation. |
| 35 | |
| 36 | ## Compatibility |
| 37 | |
| 38 | | Old data or API | Current handling | |
| 39 | | --- | --- | |
| 40 | | `source_token` argument | Parsed by compatible JSON decoders, ignored for authorization, absent from public schemas. | |
| 41 | | ReadCompletion, ReadPause, proof receipts | Preserved when decoding and saving historical sessions; never activate a gate. | |
| 42 | | `complete_step`, `review_report`, read receipt calls | Return one ordinary `tool_retired` result. | |
| 43 | | Auto Guard sidecar and configuration | Readable as history; not attached to the executor and not written by current config saves. | |
| 44 | | Tool recovery query | Returns immutable facts with `retired=true`. | |
| 45 | | Tool recovery action | Returns stable `tool_recovery_retired`; never replays an operation. | |
| 46 | | Unknown extension fields | Retained by the existing session compatibility container. | |
| 47 | |
| 48 | The public tool set and descriptions changed. The first request after upgrade |
| 49 | therefore has one expected provider-prefix cache miss. Tool order and the new |
| 50 | prefix remain stable afterward. Desktop retains its service/shell contract |
| 51 | digest check; mixed incompatible shell and service builds are unsupported. |
| 52 | |
| 53 | ## Issue-sequence validation |
| 54 | |
| 55 | | Reports | Previous trigger | Current assertion | Coverage | |
| 56 | | --- | --- | --- | --- | |
| 57 | | #9994, #9995, #10067, #10103 | An edit caused later bash or edits to remain evidence-blocked. | A successful write refreshes observation; bash is independent; three read/edit/bash/edit cycles complete. | Go integration and file-tool tests; Desktop displays normal cards. | |
| 58 | | #10053 | A bounded or pure read created unavoidable full-read debt. | One large-file window may be followed by bash and a final answer. | Agent harness test and bounded-read test. | |
| 59 | | #10085 | Reads in the same provider batch could not authorize its writer. | Results update observation synchronously in provider execution order. | Same-batch `read → edit → edit → bash` test. | |
| 60 | | #10153 | `outcome_unknown` installed a cross-session network/tool barrier. | Unknown is recorded once; subsequent diagnostic and identical calls use ordinary policy. | Recovery integration and retired endpoint tests. | |
| 61 | |
| 62 | Local disk tests also cover unseen overwrite rejection, stale recovery after a |
| 63 | reread, same-size external replacement with restored mtime, permission changes, |
| 64 | aliases, competing writers, and no-overwrite creation. Encoding, buffer, |
| 65 | notebook, symbol, move, and multi-edit behavior remains owned by their existing |
| 66 | tool suites. Windows native identity has a Windows-only test and must be run on |
| 67 | a Windows host; cross-compilation alone is not acceptance evidence. |
| 68 | |
| 69 | ## Removed runtime systems |
| 70 | |
| 71 | The runtime no longer contains full-read debt and continuation gates, |
| 72 | source-token authorization, operation prepared/applied/settled state changes, |
| 73 | proof-driven todo advancement, final-readiness recovery, repeated-call |
| 74 | rejection, evidence-gain progress/storm intervention, or an attachable Auto |
| 75 | Guard reviewer. Historical provider/session types remain only where decoding or |
| 76 | read-only display requires them. |
| 77 | |
| 78 | The publication sequence is: resolve target, apply permission/sandbox/range |
| 79 | policy, lock, obtain current source and compare the observation, compute the |
| 80 | change, compare again, publish through the same route, update observation, and |
| 81 | return the actual result. ACP lacks conditional atomic write, and local checks |
| 82 | cannot stop an arbitrary external writer after the final check; neither route |
| 83 | is described as a universal CAS. |
| 84 |