feat(kernel): agent graphs — profiles as nodes, optimizable directives as edges (subsumes the driver/loop/supervisor/multishot families)

[drewstone]

One sentence

Nodes are AgentProfiles, edges are typed and carry optimizable prompt directives, a loop is just a cyclic graph — and every existing orchestration family (driverAgent, supervisorAgent, runLoop/loopDispatch, agent-eval's AgentDriver + multishot, VB's hand-rolled shot loop) becomes an instance of this one primitive instead of a sibling implementation.

Why now — measured, not aesthetic

A real 8-round driven run (VB, arc-smart-wallet-product, glm-5.2, 2026-08-01) produced the evidence:

• Rounds 5–7 received a 241-char generic fallback instead of steering (rounds 1–4: ~1,700 chars). The anti-Goodhart filter stripped the driver's instruction and silently substituted boilerplate. In graph terms: the analysis edge worked (the driver's diagnosis was sharp — "the worker is stuck in a self-verification loop"), the delegation edge was severed, and nothing observed the edge. Half the run was unsteered and no artifact said so.
• The driver was structurally incapable of investigating: a single callLlmJson, no tools, no turns, one-sentence system prompt — while driverAgent (with observe_agent, run_analyst, spawn-by-profile, conserved budgets) sat unused in the installed runtime.
• The driver's prompt was assembled by functions (buildWorkerDriverSystemPrompt et al.), so the only GEPA-optimizable surface was a one-sentence registry file while ~200 lines of doctrine sat hardcoded in TypeScript. A role expressed as code is a role that can never improve.

The primitive

type NodeId = string

interface GraphNode {
  id: NodeId
  profile: AgentProfile          // the ONLY way a node is described. No role-builder functions.
}

type GraphEdge =
  // Work flows down. The delegation directive is DATA -> versionable, sweepable, optimizable.
  | { kind: 'delegates'; from: NodeId; to: NodeId; directive: PromptHandle }
  // Findings flow anywhere: an analyst lens over N nodes' traces, delivered to ONE node,
  // wrapped in a directive telling the recipient what to do with the analysis.
  | { kind: 'analyzes'; analyst: string; over: NodeId[]; to: NodeId; directive: PromptHandle }

interface AgentGraph {
  nodes: GraphNode[]
  edges: GraphEdge[]
  deliverable: DeliverableSpec   // termination is mandatory, not optional
  budget: Budget                 // conserved pool across the whole graph
}

runGraph(graph, opts): Promise<GraphResult>

Driver↔worker is the two-node cyclic instance. "Agent 3 analyzes outputs of 1 and 2 and reports to 1 only" is one edge, not a framework:

{ kind: 'analyzes', analyst: 'convergence', over: ['w1', 'w2'], to: 'driver', directive: h('convergence-report/v0') }

Acceptance test for the whole design: an agent can author a working topology as plain data in ≤20 LOC (code-mode teachable). If a scheduler, DAG validator, builder API, or DSL appears, we have rebuilt ADC's workflow engine — which stays on the paid platform and is explicitly not this.

Semantics that are load-bearing (each one paid for in incidents)

1. Edge delivery is observable. Every traversal appends to an edge ledger: delivered | stripped | fell-back | empty, with byte counts. The 241-char incident is the motivating case — an unobservable edge cannot be trusted and its directive cannot be optimized. (Generalizes VB's new steering-integrity.jsonl.)
2. Oracles are environment, not nodes. Graders/verifiers must not be addressable in the graph — an edge to them leaks the rubric (VB's rubric leak needed a 5-site chokepoint redaction precisely because the grader's vocabulary reached the driver). "Everything is a profile" has exactly one exception and this is it. Analysts may read the environment's verdicts; nodes may not read the environment's internals.
3. Conserved budget or no cycles. A cyclic graph without conserved-pool semantics never terminates. Keep driverAgent's existing model: per-child reservation from one pool (perWorker, maxLiveWorkers), deliverable as the only success exit, loopUntil semantics for bounded retry.
4. Directives live in the prompt registry (prompts/<surface>/v<n>.md pattern), one surface per edge. That is what makes every edge a GEPA/DSPy optimization target with the downstream node's outcome delta as feedback — createDspyRlmTraceEngine (agent-eval ≥0.140) is the intended engine. The GEPA→DSPy migration must be finished first (see deletions).

What this subsumes — the deletion/absorption ledger

At least four sibling orchestration families exist across two packages plus VB. Post-graph, each is either an instance (thin wrapper allowed during migration) or deleted:

agent-runtime/kernel (245 exports today):

• driverAgent → the star-topology graph instance. Its analyzeOnSettle hardwires findings→spawning-driver; generalizing that destination to to: NodeId + directive IS the analyzes-edge. Keep the internals, retire the bespoke surface.
• supervisorAgent, supervise, superviseSurface, createSupervisor → a supervisor is a driver profile with a different directive. Candidate for instance-of-graph; audit for anything genuinely unique (span recording stays).
• runLoop, loopUntil, loopDispatch, loopCampaignDispatch, routerToolLoop — five loop entry points. runGraph + deliverable should leave at most runLoop (the executor) + loopUntil (the combinator); the dispatch pair looks like campaign-layer sugar that belongs beside campaigns, not in kernel.
• dumbDriver, naiveDriver → these are directives (information-poor steering policies), not drivers. Re-express as registry prompts on a delegates-edge; delete the functions. (VB independently duplicates them as buildDumbContinuationPrompt/buildNaiveContinuationPrompt — same knowledge, third copy.)
• runTree, pipeline, replaySpawnTree, worktreeFanout → audit: tree = acyclic graph; if runTree is not expressible as runGraph we have two graph runtimes.

agent-eval:

• AgentDriver (a SECOND driver, persona-plays-a-user) → a driver profile whose directive is the persona. Instance, then delete the class.
• buildDriverSystemPrompt, buildWorkerDriverSystemPrompt, decideNextUserTurn → delete the functions, keep what they know: the harness capability brief and the "never write a thin steer" contract become seed data in the initial directive prompts, which GEPA then optimizes away from. Role-as-function is the anti-pattern this issue exists to end.
• ./multishot (runMultishot, runMultishotMatrix, MultishotDriverEmptyError, computeCellComposite, runJudge) → a third loop family, added while VB forked its own. The matrix/judge/composite parts are eval-layer and stay; the loop should be a graph instance. MultishotDriverEmptyError becomes an edge-ledger empty event.
• PairwiseSteeringOptimizer + the GEPA remnants → confirm createDspyRlmTraceEngine fully supersedes; delete what it replaced (AxGepaSteeringOptimizer is already gone in 0.140.1; VB's gepa-reflective-proposer.ts targets the deleted class and is dead code walking).

VB (blueprint-agent scripts/experiments) — the proof-of-subsumption consumer:

• lib/sandbox-driver/shot-loop.ts + lib/shot-reviewer.ts + shot-reviewer/ (~2,000+ lines) → two profiles + a 2-node graph. The doctrine in context.ts (200 hardcoded lines) becomes the driver directive's seed prompt. VB keeps ONLY: realness gate, search arms, verticals (per its own charter §5/§6).
• VB_USE_RUNTIME_CHAT half-migration (transport only, default off) → subsumed by the above.

Ship plan

• P0 — spec + skeleton: AgentGraph types, runGraph executing the 2-node cyclic case by delegating to driverAgent internals; edge ledger; directives resolved via prompt registry. No deletions yet.
• P1 — proof on a real cell: VB's arc-smart-wallet-product run replayed as a graph (same worker profile, driver doctrine as directive seed) side-by-side vs the legacy shot loop. Replacement is measured, not asserted: pass-rate, realness, edge-ledger completeness, tokens.
• P2 — analysts as edges: generalize analyzeOnSettle destination; route a real TraceAnalyst's findings to a named node with a directive; edge-directive GEPA/DSPy pass on the driver edge.
• P3 — absorption: supervisor/multishot/AgentDriver become instances; deletion ledger executed package by package with a discriminating test per deletion (a green suite that cannot tell the old path is gone is not evidence — proven twice this week).

Open questions

1. runTree vs runGraph — one runtime or two? (Audit pending.)
2. Where does the edge ledger persist — per-run artifacts (VB pattern) or the OTLP trace itself (agent-trace-contract now has span links with agent.link.kind; steered_by is already specced)? Leaning OTLP: one trace carries topology + delivery.
3. Budget semantics for analyzes edges (analyst spend attribution — the analyzing node, the observed node, or the graph?).
4. Does DeliverableSpec suffice as the only termination, or do cyclic graphs need per-edge traversal caps as a backstop? (Leaning: yes, cap per edge, fail loud.)

---

Living issue — updated as the VB substrate-reconciliation survey and the kernel audit land. Evidence trail: VB run artifacts oc-glm52@generic-arc-smart-wallet-product-r0 (prompt-shot-N.txt, reviewer-memory.jsonl, steering-integrity work), agent-trace-contract@1.0.2 span-link semantics.

[drewstone]

Survey landed (4 agents, adversarially verified) — the thesis is confirmed, refined in four places, and the kill-list is concrete

Full verdict in the VB session artifacts; the decisive findings, each re-run before inclusion:

The deepest fact: VB's "substrate adoption" is a type-check, not a behavior

Every @tangle-network/agent-runtime/kernel import in VB production code is import type — erased at compile time. The only genuine runtime edges are runDelegatedLoop and the constant SHARED_AUDITOR_RULES. 911 lines (driver-profiles.ts, refine-loop.ts, + 446 lines of tests) construct Driver objects whose plan() is never called in production and whose decide() is tautological at its single call site — all five "topologies" produce identical behavior. VB_DRIVER_PROFILE=blind (documented as "the compute-matched baseline a real driver must beat") runs the identical full-length reviewer-coached loop, so every driver A/B ever run against it measured refine-vs-refine.

Tier 1 (wrong numbers / hidden failure), all confirmed:

1. reviewerProfileHash fingerprints a file that is not the prompt. profiles/vb-reviewer.json (last touched 2026-05-22) vs the live doctrine in shot-reviewer/context.ts (2026-07-17): 0 of 9 sentences overlap. Every leaderboard row's promptHash describes a prompt that was never sent.
2. deGoodhartSteering kills the reviewer for obeying the rule. Line-scoped filter; a negated instruction ("Do NOT surface literal concept strings — implement the real behavior") matches the gaming patterns and is deleted; 259 authored chars → 0 kept → fixed 241-char boilerplate, stored byte-indistinguishable from authored steering. No substituted flag anywhere in the RunRecord.
3. The driver-profile axis controls nothing (above).

The thesis is the upstream fix — and the pin blocks it

On pinned agent-runtime 0.109.0, SupervisorProfile has no prompt field, so a canonical AgentProfile silently loses its entire authored prompt: measured 1,700 authored chars → driver received 1,026 chars of defaultSupervisorPrompt, contains authored text: false, no error. Fixed in 0.117.0 (prompt?: AgentProfilePrompt, "disagreeing values are a fault, not a pick"). Same silent-role-discard defect at both layers (VB's fallback + the substrate's profile drop). Also: 0.109 ships two contradictory default supervisor policies (1,026-char "do small work YOURSELF" vs 1,191-char "you do NOT do the work"), selected by entry point.

Substrate deletions confirmed:

• buildWorkerDriverSystemPrompt — zero callers in any package (2 occurrences in the whole compiled bundle: definition + export list). Delete; its knowledge → HARNESS_BRIEFS seed data.
• buildAuditorSystemPrompt — contributes 2 characters (a separator) over its two already-exported constants.
• AgentDriver + ProductClient in agent-eval — a one-product REST client welded to a driver, living in the generic substrate; 0 constructions anywhere. Move to the product repo.
• runLoop is already a deprecated alias of runAgentRounds on the installed version — the graph runtime should target supervise, not it.
• Even the new multishot (0.140.1) mixes the abstractions: profile: AgentProfile beside required buildOpener/buildDriverSystemPrompt callbacks in one options object. The thesis has to be pushed into it, not just consumed from it.

Where the thesis breaks (the section that matters most):

(a) The search arm cannot ride the substrate worker path — BridgeSeam has no mcp field. VB delivers the you.com/Exa treatment as a sibling of the profile (mcp: { mcpServers } + env overrides). Route a worker through workerFromBackend({backend:'bridge'}) and the treatment is silently dropped — the run still completes and still emits a number, with the treatment never firing. This is the recorded "0 search calls = INVALID" class. The seam needs an mcp field before any search arm uses the graph path.
(b) DriverAgentOptions.systemPrompt: string | ((task) => string) is deliberate — per-leaf material is task-derived. The honest resolution is tools, not data: the driver stops being handed the workdir tree / verification block and spends turns fetching them (read_workdir, run_execution_gate, observe_agent). Real cost, right shape.
(c) Canonicalizing the worker profile is a coupled cli-bridge change (bridge dialect: top-level systemPrompt), not a local refactor.
(d) The grader must never become a profile. graderBlindStop()/executionGate is the firewall that stopped a realness-gated fake ranking #1. An optimizable oracle hands the optimizer its scoring function. The driver is a profile; the oracle is code with a frozen contract.

Repair, not proposal

scripts/experiments/profiles/vb-reviewer.json is already the driver profile — canonical shape, git-tracked, 1,622-char prompt.systemPrompt — used today only as a hash source. And surface-prompt-registry.ts is already the versioned-prompt-as-data mechanism. The graph work extends these; it does not invent them.

First three moves (ordering: unblock → make measurement honest → remove the poisoned arm):

1. Bump the pin (runtime 0.109→0.117, eval 0.135→0.140.1, interface 0.36→0.40). On the current pin the thesis is unexecutable — profiles lose their prompts silently. Verify: the 1700-char probe reads back contains authored text: true.
2. Make vb-reviewer.json the prompt SOURCE, not just the hash source (one edit at context.ts:317). Verify: sentence overlap 0/9 → 9/9.
3. Delete driver-profiles.ts + refine-loop.ts + 446 test lines; make blind real (shotsTarget=1). Verify: VB_DRIVER_PROFILE=blind logs exactly one shot, zero reviewer invocations.

P0 runGraph design updated accordingly: target supervise (not the deprecated runLoop), require the 0.117 profile resolution, add the BridgeSeam.mcp field to the P0 scope since the search arms are a launch consumer.

[drewstone]

Requirement added: distributed graphs — nodes on different machines — and a measured correction to "this is already done"

Graph nodes will execute in ADC/sandbox.tangle.tools sandboxes on different machines. The trace graph is therefore a distributed trace, and cross-boundary context propagation must work out of the box or the edge ledger (and every analyst that reads it) sees disconnected fragments.

Probed 2026-08-01 — it is NOT already done:

boundary	W3C traceparent handling today
agent-dev-container (all packages)	none (grep hits were error-propagation comments)
@tangle-network/sandbox SDK	none
cli-bridge main	none — inbound traceparent support exists only on the unmerged trace-emitter branch
agent-runtime 0.117	1 string occurrence in the supervisor bundle; no propagator

Consequence: any run whose worker lives in a remote sandbox severs the trace at the first HTTP hop. VB↔bridge (same host) was the easy case and even that is unmerged.

Design constraint (OSS-first, no hand-rolling): adopt W3C TraceContext end to end — traceparent/tracestate headers on every HTTP hop, the TRACEPARENT env var convention at every process-spawn boundary (sidecar → harness process). Use @opentelemetry/api's W3CTraceContextPropagator in emitters; the zero-dep contract stays zero-dep (it already ships deriveHexId(…, 16|8) precisely so human run ids map into the W3C hex space, and validateTraceSpans already warns non-hex-id naming the consequence "cannot be correlated with a W3C traceparent").

Boundaries the propagation spec must cover, in order of traffic:

1. graph host → cli-bridge (HTTP, local) — land the existing branch
2. graph host → sandbox.tangle.tools API (HTTP, cross-machine)
3. sandbox API → sidecar (spawn) — TRACEPARENT env
4. sidecar → harness/agent process (spawn) — TRACEPARENT env
5. agent → router / MCP servers (HTTP out) — headers again
6. events/results flowing back (SSE) — span/trace ids stamped on events so the return path correlates without trusting clocks

Distributed-specific semantics for the edge ledger: an edge whose two ends are on different machines must not depend on clock agreement (span links, not timestamps, carry causality — already the contract's position), and a severed hop must surface as a ledger event (unpropagated), not as silently disconnected roots — the validate capability table already knows how to say "cross-machine correlation unavailable: N roots carry no inbound link".

Investigation + per-boundary design dispatched; findings will land here.

[drewstone]

Boundary map landed — four findings that change the distributed design

Full hop-by-hop map (7 hops, each with file:line) in the session artifacts; the decision-changers:

1. The sandbox path is propagation-ready TODAY at hop 2 — zero code change

CreateSandboxOptions.env (sdk types.ts:444-445) flows: API sandboxes.ts:4150-4157 → provision payload → docker driver docker-create-container.ts:242,:723 → container env = the sidecar's process.env. The env gate is a blocklist (isForbiddenEnvVarName, runtime-contracts:284-333 — LD_*/PATH/proxy/TLS/SIDECAR_) and TRACEPARENT/TRACESTATE are not in it. Opposite polarity from cli-bridge's allowlist, which is the one that needed a change. Caveat: create-time env is static per box — right for one-node-one-box graph nodes; per-run context still needs the sidecar run-request field (hop 3).

2. The Claude Code harness already joins a W3C trace with zero changes

The shipped binary extracts TRACEPARENT/TRACESTATE from env into its own OTel context (verified by grep over the installed 2.1.220 bundle: if(yn()&&Z.TRACEPARENT) return …extract(e,{traceparent:Z.TRACEPARENT,…})). Set the env var at spawn and the harness's own telemetry lands in our trace.

3. ADC already has the precedent channel — extend, don't invent

x-tangle-trace-id (ptid_<uuid>, sdk-telemetry/stage-span.ts:19-22) rides edge header → orchestrator (proxy.ts:323-331 clones ALL inbound headers, so a traceparent header already transits API→orchestrator untouched today) → container env as AGENT_STARTUP_ID (project-manager.ts:4360). It is per-lifecycle-op and non-W3C, but it is exactly the channel shape traceparent should ride beside. Hop 1's only real gap: the SDK doesn't expose custom headers — one choke point (Sandbox.fetch, client.ts:1331-1375) fixes every call; note the batch-streaming path bypasses the wrapper (:1251-1254) and needs the same injection.

4. ⚠️ Contract collision: agent-runtime 0.117 already ships a competing, non-W3C convention

TRACE_ID/PARENT_SPAN_ID env (traceContextToEnv/readTraceContextFromEnv, supervisor bundle :4379-4516), and its docstring explicitly rejects W3C traceparent: "adopting it alongside this one would fork the contract." So a graph node spawned by the runtime today gets TRACE_ID/PARENT_SPAN_ID while every standard tool (and the Claude harness, per #2) reads TRACEPARENT. The two carry identical bits (hex trace id + span id) so a dual-write shim is lossless — but this is a decision, not a detail:

Operator decision needed → recommendation: dual-write both pairs at every spawn boundary now (lossless, unblocks everything), migrate the runtime to W3C as the single convention in its next major. The runtime's stated fork-avoidance argument is inverted by finding #2 — the ecosystem already speaks W3C; TRACE_ID/PARENT_SPAN_ID is the fork.

Also mapped

• Hop 4 (agent→router): headers are harness-owned; ANTHROPIC_CUSTOM_HEADERS exists for the claude family; egress iron-proxy cannot inject inside TLS — router-side correlation falls back to span links from the harness's own spans (chore: update Tangle agent packages #2 makes this workable).
• Firecracker/host-agent drivers asserted symmetric but unverified — flagged, not assumed.
• The failure-semantics lens was killed by a transient API auth blip mid-run; resumed (cached lenses replay, synthesis re-runs with full input). Findings land here when it completes.

[drewstone]

Final propagation spec — all four lenses landed, re-verified; two premise claims died and one reverses sequencing

The spec table (each code site re-read this session; "severed" = the observable event when context does not cross)

#	boundary	mechanism	change	owner
B0	VB host → SDK create	env: {TRACEPARENT} on the one create call (sandbox-driver.ts:478)	one line	blueprint-agent
B1	SDK → sandbox API	traceparent header via W3CTraceContextPropagator.inject() inside Sandbox.fetch + the batch-stream bypass (client.ts:1251-1260 hardcodes its own headers)	small, SDK-only — API→orchestrator already clones inbound headers	agent-dev-container
B2	API → orchestrator → container env	CreateSandboxOptions.env	none — verified permissive end-to-end (blocklist, TRACEPARENT not in it)	agent-dev-container
B3	sidecar → harness process	env inheritance works today; per-run context = optional field on the run/stream schema (multi-turn box reuse)	none / schema	agent-dev-container
B4	graph host → worker (runtime seams)	canonicalize to TRACEPARENT (read it first, legacy TRACE_ID fallback; write both one release). Seam matrix: pi/cli/sandbox have env channels; router/router-tools/provider have no worker process; bridge/cli-worktree have no channel today	small, one repo	agent-runtime
B5	host → cli-bridge worker	corrected premise: no trace branch exists anywhere (grep over 40+ refs → 0) — the emitter work is uncommitted worktree state only. And the bridge spawn env is an allowlist that strips TRACEPARENT today (sanitizeHostEnv, verified, not asserted). Header → extract → allowlist add → worker env	schema + small, from scratch	cli-bridge
B6	late spans → readers	wire needs nothing (buildIndex groups by trace_id, so concatenation IS the merge); work is read-side: traces CLI multi-input + journal reconciliation	feature	traces
B7	direct model HTTP (router/provider)	genuinely no standard boundary — the one declared hand-off; host journals the reason	none	—

Id-minting: the divergence is executed proof, not a concern

Three shipped derivations, one run id, three different trace_ids — distinct-count = 3 — and one is not even valid hex and embeds the raw run id in the wire id (a leak vector visible in the output):

derivation	site	output
padTraceId (FNV fold)	agent-eval store-to-otlp.ts:426	0871c028… valid
padTraceId (strip+zero-pad)	agent-eval otel-export.ts:212 and textually identical agent-runtime otel-export.ts:637	vbwebgrounded20260801cella000000 — invalid, leaks the run id
contract deriveHexId(runId,16)	ids.ts	2967e16d… valid

Rule adopted: deriveHexId(runId, 16) is the ONLY legal derivation; both padTraceId families are retired in favor of importing the zero-dep contract (2 sites in agent-eval, 1 in agent-runtime). The contract's own non-hex-id validator already fails the otel-export variant — shipped code violates the shipped validator today.

Distributed additions to the graph spec

1. trace.unpropagated host-side journal event {nodeId, expectedTraceId, backend, reason: no-env-channel | no-worker-process | caller-omitted} — the runtime journal already records per-spawn settlement incl. in-doubt, so this rides an existing ledger.
2. Child-side fresh-root marker — a fallback mint stamps tangle.trace.unpropagated=true + the human run id, so a severed hop is a queryable span, not a silent stranger trace.
3. Late join is free at the wire — concatenation is the merge; the CLI grows multi-input.

Sequencing (reversed from the earlier lean)

The cli-bridge branch that was to "land first" does not exist as a branch. New order: B0+B2 immediately (one line + zero change, gives VB↔sandbox joined traces this week) → B4 runtime canonicalization (small, unlocks every seam) → B1/B3 (SDK header + per-run schema) → B5 cli-bridge (from scratch, with the emitter's uncommitted worktree state as the starting material) → B6 reader features.

[drewstone]

P0 shipped: #704 (feat/agent-graph-694, 0.121.0).

Beyond the spec as written, the adversarial audit rounds forced three ledger-truthfulness fixes now locked in by load-bearing probes (each fails under a micro-revert of its fix):

1. Vanished analyzes events — an analyst returning undefined, or findings carrying nested undefined, threw inside the RFC 8785 digesting subscriber; the event-bus contract makes a throwing subscriber invisible to every subscriber, so the traversal left no row, no journal line, no error. Fixed at the producer: finding events are canonicalized to finite JSON before publish (nested undefined stripped, non-serializable payloads recorded as such). The online-detector publish path (span.toolName optional) had the same class and goes through the same canonicalizer.
2. Analyzes cap raised GraphEdgeCapError — only delegates caps close the spawn cycle; analyzes exhaustion is now observable-only (unpropagated / traversal-cap-exhausted rows), matching the type's own doc.
3. Refused spawn ledgered delivered — spawn rows are provisional until the agent.spawn hook binds a live worker; rows still unbound at flush rewrite to unpropagated, 0 bytes, reason no-live-worker-bound (covers both refused-after-factory and keyed re-spawn deduplicated to a completed result).

Vocabulary change vs the spec: fell-back is dropped from EdgeDeliveryOutcome — no kernel path can produce it today, and shipping an unproducible outcome in a truthfulness ledger is exactly the defect the ledger exists to catch. It returns when a producer lands (the VB steering-fallback migration is the natural first one).

Remaining from this issue, in order: P1 (replay a VB cell as a 2-node graph vs the legacy loop, measured), propagation boundaries B1/B3/B5/B6, P3 absorptions (supervisorAgent/multishot/AgentDriver as graph instances).

[drewstone]

Audit: runGraph vs the ADC workflow engine (drew asked whether our node model is capable enough — agents, trace analysts, codemode scripts — while staying small, hookable, fully observable, cost-traced).

Scale: ADC's engine is ~42k LOC source (~93k with tests), 13 DB tables, inside products/platform/api — a multi-tenant workflow product (billing, human gates, cron, connectors, durable DB runs). Ours is a ~950-LOC in-process kernel primitive. They already share the deep invariants, independently: guarded-cycles + visit budget (default 25) ≈ our conserved budget + mandatory deliverable + traversal caps; their per-node edge-verdict journal ≈ our edge ledger (ours goes further: byte counts + adversarially-probed truthfulness); their trace.analyze node ≈ our analyzes edges; their capability registry ≈ our node pinning; their RunCostCap ≈ Budget.maxUsd (already present). Convergent evolution — validation, not duplication.

Node-capability verdict — no new node kinds needed:

• agent.run topologies (single|fanout|loop|inference config enums; dynamic "not modeled yet") — ours expresses these AS graphs; the dynamic case is our native one. Subsumed.
• script.run (codemode) — the real question, and the answer is the executor seam, not a node kind: a node is a profile whose AgentSpec.executor runs a script (the test leafSeam is literally this shape). It inherits settle/spend/ledger/OTel for free. ADC's own design confirms the pattern ("runs in the customer's sandbox — no new isolate/security boundary"). Action: one documented example of a script-backed node; zero kernel surface.
• trace.analyze as a node — refused; analysts stay environment reached by analyzes EDGES with a routable destination (oracle-leak doctrine + mid-run delivery to a live node, which their post-hoc node can't do).
• decision (human gate), wait.timer/event, integration.invoke, notify, sub-workflow.run — product/durability concerns, refused at the kernel. A human gate, if ever needed, is also just an executor that awaits an external event. Sub-graph-as-node stays the recorded P3 (runTree unification).
• parallel/foreach — multiple delegates edges / driver-issued spawns. Native.
• Declarative edge guards/conditions (their 654-LOC condition DSL + expression language) — refused: in an agent graph the DRIVER is the condition evaluator; a guard DSL is the first step to a second scripting engine, which their own expression-language docstring warns about.

One real gap found and fixed (pushed to #704): runGraph built its own spawn-binding hook and swallowed the caller's — RunGraphOptions.hooks now composes caller RuntimeHooks onto the same event stream via composeRuntimeHooks, with a kernel test proving neither observer starves the other.

Worth lifting later (substrate-first — agent-eval analytics, not runtime): their deterministic per-node health rollup (workflow-health.ts, 321 LOC: visits/failures/cost/avg-duration + failure clustering by normalized error signature) as a pure function over our ledger + journal.

Also noted: ADC pins agent-interface@0.38.0 — AgentProfile is already the shared noun across both engines; the alignment point is the type layer, not shared machinery. Their live event bus is in-process-only exactly like ours (their comment names Redis as the upgrade); the durable channel on our side is the journal.

[drewstone]

P0 MERGED — #704 landed on main as 0.122.0 (0.121.0 was taken by the Sandbox 0.16 cohort mid-flight).

Content verified on main: src/runtime/supervise/graph.ts, src/runtime/supervise/prompt-registry.ts, W3C TRACEPARENT dual-write, deriveHexId OTLP ids. Final scope beyond the audit rounds already logged here: seven review-driven correctness fixes (routed-finding failures always ledgered; node.profile.name === node.id enforced; duplicate analyst ids refused; GraphEdgeCapError only blames the cap when the cap ended the run; mergeTraceEnv keeps a caller's trace identity authoritative on the W3C wire; UUID-form ids export dash-stripped and joinable across versions; leaderboard continuation restored to the exact no-op) plus caller RuntimeHooks composition on runGraph — each proven load-bearing by micro-revert falsification. 2,324 tests on the merged tree.

Recorded follow-ups (non-blocking): bus-refuses-the-delivery-attempt-record sub-path (documented, root fix suggested in the audit); analyst-routing integration test suite; createPropagatingTraceEmitter emit-pipeline tests; severed-hop stamping coverage.

Next from this issue, in order: P1 (replay a VB cell as a 2-node graph vs the legacy loop, measured), propagation boundaries B1/B3/B5/B6, P3 absorptions.

[drewstone]

P1 harness merged (#710) — offline-proven; live run gated on three audited wiring gaps, the decisive one being substrate asymmetry (loop arm = bare chat call, graph arm = full worker).

New scoped component: the chat-transport executor — a first-class lightweight worker executor over bare /v1/chat/completions (no sandbox). One component, three jobs:

1. closes P1's substrate-asymmetry validity threat (both arms on the same substrate);
2. gives conversation-shaped graphs a native worker (simulated-user persona as a NODE profile → GEPA-optimizable; turns = ledgered traversals);
3. becomes the migration target that lets the two real downstream runMultishot consumers (gtm-agent eval matrix/soak, tax-agent user-sim) move to 2-node conversation graphs without losing lightness — after which agent-eval's multishot subpath deletes cleanly.

Multishot end-state corrected accordingly: deprecate-with-recipe → migrate gtm-agent + tax-agent → delete. (The kernel driver deletions — driverAgent/supervisorAgent/steeringDrivers — are unaffected: no cross-repo consumers.)

[drewstone]

Phase-2 PRs open: #713 (analyst-as-node + watchWorkers passthrough, 0.124.0) and stacked #714 (steering-drivers deletion, 0.125.0). Both adversarially audited SHIP with micro-revert falsification.

Kill-list correction, on the record: the deletion pass's stop-rule fired on driverAgent/supervisorAgent — they are not parallel legacy surfaces but the execution engine runGraph runs through (runGraph → supervise() → supervisorAgent → driverAgent; the external-harness driver arm exists only in supervisor-agent.ts). The earlier "~6 consumers each" were doc-comment mentions. Deleting them would re-implement ~1,545 LOC inside supervise.ts — a move, not a deletion. They stay, and the subsumption ledger in this issue is corrected accordingly.

Analyst-as-node ships with one documented limit: durable-run resume does not yet compose with analyst-node graphs (process-local in-flight map; journal-level marking is the fix). Queued behind the chat-transport executor + P1 live.

[drewstone]

Phase 2 complete on main: #713 (analyst-as-node + watchWorkers, 0.124.0) and #714 (steering-drivers deleted, −570 LOC net, 0.125.0; driverAgent/supervisorAgent kept as the engine per the corrected subsumption ledger). Remaining from this issue: chat-transport executor → P1 live parity → VB shot-loop swap → gtm/tax multishot migration → agent-eval multishot deletion. Deferred kernel items on record: durable-resume × analyst-nodes; sub-graph delegation (P3); per-node budgets; graph-run resume from journal.