Pysolate within Vinculum

核验基线： /Users/yuzhe/projects/agent-python-runtime，commit 08d212c6876856d2150716af5935c6a85b6d68af（2026-07-31）。

用途： 将 Pysolate 当前实现映射到 Vinculum 的 Harness–Runtime architecture，并区分 Current、Proposed 与 Deferred。这里不复制 benchmark 数字，也不把其他项目的 artifact 当作证据。Canonical system boundary 见 architecture.md，机制名称见 concept-catalog.md。

1. 当前实现边界

能力	状态	当前证据入口	真实含义
CPython/WASI bounded executor	Current	`README.md`, `docs/architecture.md`	运行生成 Python；Guest 无 ambient Host access
Host-owned policy boundary	Current	`README.md`, `docs/threat-model.md`	Host 持有 limits、grants、credentials、lifecycle、receipts
Fresh-instance baseline	Current	`docs/session-lifecycle-contract.md`	portable fail-closed baseline
Prepared single-use lifecycle	Current	`README.md`, ADR 0008, scheduler report	served slot 不回 ready pool；避免把不完整 reset 当安全复用
Linux COW single-use direction/implementation	Current but bounded	ADR 0008, `docs/reports/scheduler-experiment-results.md`	共享 prepared pages、按 single-use replacement；不是完整 CPython reset 或通用生产 SLA
Host `ExecutionRef`	Current	`docs/agent-trace-plugin.md`	绑定 Agent coordinates、logical invocation、attempt、execution 与 effective code digest
Capability receipts	Current, bounded	`runtime/capability/broker.go`; `runtime/receipt/receipt.go::Receipt`	Host broker binds calls to run/catalog/handler/effect identity；不代表 provider final state 已解决
Frozen `ToolCatalogSnapshot`	Current, bounded	`runtime/toolcatalog/catalog.go::Snapshot`; `runtime/toolcatalog/catalog.go::BuildSnapshot`	canonical schema、projection、grant、effect/policy 与 catalog digest 在 Run 内冻结
In-Python typed tool path	Current, bounded	`eval/agentic/python.go::PythonExecutor`; `runtime/capability/broker.go`	generated Python 通过 Host broker 调用 typed tools；不持有 provider credential
Transaction/effect state model	Current foundation; general live-write claim absent	`runtime/transaction/coordinator.go::Coordinator`; `runtime/transaction/ledger.go::JournalSnapshot`; ADR 0007	operation/attempt/approval/reconciliation/receipt 语义已有；外部 adapter qualification 与生产 write plane 未完成
Production policy compiler	Current, bounded	`runtime/scheduler/production_policy.go::CompileProductionPolicy`; `docs/production-policy.md`	将 memory/CPU/greed 编译为 Host-owned policy；greed 不得放宽硬边界
Metadata/digest trace store	Current, optional	`docs/agent-trace-plugin.md`	versioned events、sequence/digest validation、read-only query/export
Structural playback/fork lineage	Current, optional	`docs/agent-trace-plugin.md`	检查 recorded event stream 与 fork origin；不重新执行 provider/tool/code
Artifact/manifest verification	Current	`docs/supply-chain.md`, bridge/adapter docs	启动前绑定 artifact、manifest、ABI、size、revision、SHA-256
Reproducibility research/gates	Current infrastructure; profile-specific claims only	`docs/reproducibility.md`	有双构建、stage-localization 和 artifact qualification；不得笼统声称所有 artifact reproducible
Hermes local bridge	Current, opt-in	`docs/hermes-runtime-bridge.md`	private Unix socket、required invocation trace、无 network capability/provider
Codex MCP adapter	Current, opt-in	`docs/codex-mcp-adapter.md`	stdio 单工具 adapter；不观察完整 Codex lifecycle/final state

2. 当前明确没有的能力

能力	状态	原因/来源
Provider-output exact replay	Deferred	portable trace 不保存 provider body
Python source/input/result 的 portable raw replay	Deferred by privacy boundary	metadata-only trace 明确排除 raw bodies
Harness checkpoint restore	Deferred	Harness 需持有 compatible checkpoint bytes；Runtime 不拥有
Stateful session/capsule	Deferred	lifecycle contract 是 retained design boundary，不是实现
Served-slot safe reuse	Deferred	当前 single-use；linear memory restore 不等于完整 mutable-state restore
Qualified external write/effect plane	Proposed / not yet claimed	ADR 0007 的 core state model 已实现；生产 adapter qualification、live write 与 recovery guarantees 尚未建立
Distributed ACID across providers	Non-goal	provider effects 需要 journal/reconciliation，不能由 Runtime 提供
Arbitrary rollback	Non-goal	reversible / compensatable / irreversible 必须分开
Full Hermes/Codex Agent replay	Deferred / out of adapter scope	adapter 不拥有 conversation/model/routing/final-state lifecycle
Semantic/outcome-equivalent replay	Proposed	需要 task oracle、state projection、checkpoint、external stubs/twins
Counterfactual selective recomputation	Proposed	需要 causal dependency graph 与 effect isolation
Unknown external-system effect proof	Not generally attainable	最多 record/infer/document uncertainty

3. Pysolate 如何嵌入 Vinculum

text

Agent / Harness
  ├── Hermes bridge or Codex MCP adapter         [Current, narrow]
  ├── full lifecycle/checkpoint/oracle           [Mostly outside current Runtime]
  │
  ▼
Control Plane
  ├── Host limits/grants/identity                [Current]
  ├── frozen typed tool/effect catalog           [Current, bounded]
  └── approval/commit state model                [Current foundation; live write unqualified]
  │
  ▼
Execution Plane
  ├── CPython/WASI                               [Current]
  ├── fresh/prepared/single-use COW              [Current, strategy-qualified]
  └── complete served-slot restore               [Deferred]
  │
  ▼
Effect Plane
  ├── typed Host capability/receipts             [Current, bounded]
  ├── operation/attempt/reconciliation ledger    [Current foundation]
  └── qualified live adapters/recovery           [Proposed]
  │
  ▼
Evidence Plane
  ├── ExecutionRef + metadata events             [Current]
  ├── structural playback/fork lineage           [Current]
  └── claim-aware cross-plane bundle             [Proposed]
  │
  ▼
Verification / Replay
  ├── integrity/read-only queries                [Current]
  └── input/state/outcome/counterfactual replay  [Proposed]

4. Vinculum implementation slices

Slice 1 — Claim Manifest（低风险）

在不增加 raw capture 的前提下定义：

claim IDs 与 verifier status；
artifact/base/authority/execution/effect/outcome claim dependency；
verified | contradicted | insufficient | stale；
现有 ExecutionRef/trace 的 adapter。

验收：现有 metadata-only run 只能得到 structural-only，测试必须拒绝伪造 R1/R2 claim。

Slice 2 — Controlled deterministic fixture

建立一个完全可控、read-only 或 reversible local fixture：

frozen clock/random/input；
authoritative state snapshot；
final-state oracle；
R1 input-injection replay；
R2 state-equivalent replay。

验收：真实执行与 replay 都通过 exact artifact gate；replay 不连接外部系统。

Slice 3 — Known external adapter

选择支持 provider idempotency 和 readback 的低风险 API：

intent journal；
operation/attempt/provider identity；
timeout/ambiguous fault injection；
reconciliation；
stub replay。

验收：ambiguous outcome 不 blind retry；readback 后才能终止。

Slice 4 — Unknown read-only recorder

只观察动态网页/CLI：

capture/canonicalize；
sensitive-field gate；
inferred contract candidate；
drift detector；
local fixture。

验收：任何推断都无法自动增加 credential、tool exposure 或 commit authority。

Slice 5 — Cross-plane evidence graph

把 Agent coordinates、ExecutionRef、capability/effect receipt、checkpoint ref 和 final-state oracle 串成 Evidence Bundle。

验收：独立 read-only verifier 可以判定证据缺口；删除任一 required edge 会从 verified 降为 insufficient。

5. 不应在当前 Runtime 内承担的职责

为保持架构边界，以下应由 Harness/Effect/Verification plane 承担，而不是继续塞进 Runner.Run：

provider parsing 与 model lifecycle；
conversation/memory state；
user approval UI；
direct-tool routing；
business rollback/compensation；
raw prompt/provider storage；
task-specific semantic oracle；
counterfactual branch planning。

Runtime 的核心价值是：给定 Host-authorized request，执行精确 artifact/base 下的 bounded generated program，并产出可绑定的 execution evidence。

Pysolate within Vinculum ​

1. 当前实现边界 ​

2. 当前明确没有的能力 ​

3. Pysolate 如何嵌入 Vinculum ​

4. Vinculum implementation slices ​

Slice 1 — Claim Manifest（低风险） ​

Slice 2 — Controlled deterministic fixture ​

Slice 3 — Known external adapter ​

Slice 4 — Unknown read-only recorder ​

Slice 5 — Cross-plane evidence graph ​

5. 不应在当前 Runtime 内承担的职责 ​