Milestone: Smart/Tool agent role separation over prolog-rlm #4

New issue

Open

opened 2026-09-24 23:34:49 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-09-24 23:34:49 +00:00

(Migrated from github.com)

Source: https://github.com/lost-rob0t/zero-forge/blob/master/docs/architecture.md ("Agent boundary", "Tool-selection repair")
Lineage: port-mapping milestone derived from ZeroForge

Scope

Port the hard role separation onto prolog-rlm agents/authority:

Smart Agent (rlm agent/subagent): reads bounded KB + evidence context,
records threat model and falsifiable invariants, proposes artifact drafts
and repairs. Must not execute tools directly.
Tool Agent: selects exactly one allowlisted registered tool and constructs
arguments; must not write exploit logic, artifact content, or completion
decisions.
Workflow (rlm plan/graph): owns ordering, retry/repair budgets, routing,
and terminal status. Never silently converts failures into success.
Independent provider/model config per role; legacy shared-model config is
rejected.

Acceptance criteria

Role boundary tests: Smart cannot invoke tools; Tool cannot emit artifact
content; violations fail closed with structured errors.
Workflow terminal states are exhaustive (completed / failed / blocked) and
every transition is traceable via rlm traces.
Stub/plumbing mode artifacts can never validate, save, or complete.

Dependencies

Evidence collection milestone (tools the Tool Agent selects).

Non-goals

No model-provider lock-in; providers resolve through prolog-rlm model APIs.
No auto-approval of artifacts anywhere in the graph.

Implementation approval is not inferred from this issue.

**Source**: https://github.com/lost-rob0t/zero-forge/blob/master/docs/architecture.md ("Agent boundary", "Tool-selection repair") **Lineage**: port-mapping milestone derived from ZeroForge ## Scope Port the hard role separation onto prolog-rlm agents/authority: - Smart Agent (rlm agent/subagent): reads bounded KB + evidence context, records threat model and falsifiable invariants, proposes artifact drafts and repairs. Must not execute tools directly. - Tool Agent: selects exactly one allowlisted registered tool and constructs arguments; must not write exploit logic, artifact content, or completion decisions. - Workflow (rlm plan/graph): owns ordering, retry/repair budgets, routing, and terminal status. Never silently converts failures into success. - Independent provider/model config per role; legacy shared-model config is rejected. ## Acceptance criteria - Role boundary tests: Smart cannot invoke tools; Tool cannot emit artifact content; violations fail closed with structured errors. - Workflow terminal states are exhaustive (completed / failed / blocked) and every transition is traceable via rlm traces. - Stub/plumbing mode artifacts can never validate, save, or complete. ## Dependencies - Evidence collection milestone (tools the Tool Agent selects). ## Non-goals - No model-provider lock-in; providers resolve through prolog-rlm model APIs. - No auto-approval of artifacts anywhere in the graph. Implementation approval is not inferred from this issue.