nsaspy/prolog-rlm

Fork 0

[P1] Add skill-aware bounded subagent delegation and reviewer roles #172

New issue

Open

opened 2026-08-22 01:53:01 +00:00 by lost-rob0t · 5 comments

lost-rob0t commented

2026-08-22 01:53:01 +00:00

(Migrated from github.com)

Parent: #167
Related: #117, #144, #168, #169

Goal

Compose the existing prompt compiler and bounded rlm_subagent runtime so unresolved work can be delegated to a child with the right selected skill/role context, without inventing another agent runtime.

Target flow

unresolved need
-> prompt compiler resolves applicable skill/role
-> trusted policy chooses delegation when appropriate
-> canonical rlm_subagent invocation
-> narrowed child capabilities + authority
-> bounded selected skill/context projection
-> child result/evidence/usage/trace
-> parent resume/replan

Requirements

reuse rlm_subagent and rlm_agent supervision/cancellation;
skill activation cannot grant or widen child capabilities/authority;
child context is compiled/budgeted through existing prompt/context machinery;
support generic role metadata such as reviewer/critic/researcher without hardcoding product personas;
parent/child correlation and selected-skill provenance are explicit;
propagate evidence/usage/trace references in the return envelope;
global recursion/depth/concurrency/model/token/time budgets remain authoritative;
failure/unavailable/denied/budget/cancelled states remain structured and cannot masquerade as success;
parent can consume a successful child result and continue/replan.

Acceptance

deterministic unresolved fixture selects a skill/role and delegates through canonical rlm_subagent;
child receives only selected bounded skill/context units;
capability and authority ceilings are equal-or-narrower than parent;
selected skill identity/provenance appears in delegation trace/envelope;
evidence and usage propagate back to parent;
generic reviewer/critic role can be represented without a hardcoded persona;
parent resumes/replans after child result;
recursive skill-aware delegation remains globally bounded;
denial/cancellation/budget exhaustion cannot yield false success.

Non-goals

no second subagent runtime;
no product-specific coding reviewer persona;
no skill-based authority grants;
no arbitrary callable in skill or role metadata.

Inspect current merged #144/subagent code and prompt compiler before implementation. Do as much coherent work as possible per cycle.

Parent: #167 Related: #117, #144, #168, #169 ## Goal Compose the existing prompt compiler and bounded `rlm_subagent` runtime so unresolved work can be delegated to a child with the **right selected skill/role context**, without inventing another agent runtime. ## Target flow ```text unresolved need -> prompt compiler resolves applicable skill/role -> trusted policy chooses delegation when appropriate -> canonical rlm_subagent invocation -> narrowed child capabilities + authority -> bounded selected skill/context projection -> child result/evidence/usage/trace -> parent resume/replan ``` ## Requirements - reuse `rlm_subagent` and `rlm_agent` supervision/cancellation; - skill activation cannot grant or widen child capabilities/authority; - child context is compiled/budgeted through existing prompt/context machinery; - support generic role metadata such as reviewer/critic/researcher without hardcoding product personas; - parent/child correlation and selected-skill provenance are explicit; - propagate evidence/usage/trace references in the return envelope; - global recursion/depth/concurrency/model/token/time budgets remain authoritative; - failure/unavailable/denied/budget/cancelled states remain structured and cannot masquerade as success; - parent can consume a successful child result and continue/replan. ## Acceptance - [ ] deterministic unresolved fixture selects a skill/role and delegates through canonical `rlm_subagent`; - [ ] child receives only selected bounded skill/context units; - [ ] capability and authority ceilings are equal-or-narrower than parent; - [ ] selected skill identity/provenance appears in delegation trace/envelope; - [ ] evidence and usage propagate back to parent; - [ ] generic reviewer/critic role can be represented without a hardcoded persona; - [ ] parent resumes/replans after child result; - [ ] recursive skill-aware delegation remains globally bounded; - [ ] denial/cancellation/budget exhaustion cannot yield false success. ## Non-goals - no second subagent runtime; - no product-specific coding reviewer persona; - no skill-based authority grants; - no arbitrary callable in skill or role metadata. Inspect current merged #144/subagent code and prompt compiler before implementation. Do as much coherent work as possible per cycle.

lost-rob0t commented

2026-08-22 02:56:09 +00:00

(Migrated from github.com)

RAGE cross-connection from #173: SKILL.md format should not own delegation authority/role/model choice. Recognized Claude fields such as context, model, or agent may be preserved as vendor adapter metadata when importing, but they must not directly choose a Prolog subagent, widen capabilities, or become core execution semantics. #172 should keep reviewer/critic/researcher role selection under trusted host/compiler policy and consume selected skill context from #173/#117. No coding in this pass.

RAGE cross-connection from #173: `SKILL.md` format should not own delegation authority/role/model choice. Recognized Claude fields such as `context`, `model`, or `agent` may be preserved as vendor adapter metadata when importing, but they must not directly choose a Prolog subagent, widen capabilities, or become core execution semantics. #172 should keep reviewer/critic/researcher role selection under trusted host/compiler policy and consume selected skill context from #173/#117. No coding in this pass.

lost-rob0t commented

2026-08-25 10:44:20 +00:00

(Migrated from github.com)

#172 reconciliation after #203/#204

First skill-aware delegation substrate slice is now landed on main as 8054606971ffbbb6aa9484b4e915caa4c655929b via PR #204.

What is now canonical:

trusted explicit_skills([...]) continues through the child rlm_prompt_compiler rather than a second selector;
host-only subagent_role(Role) is bounded inert metadata;
spawned child metadata and returned subagent_result carry selected skill + generic role provenance;
model-visible rlm_subagent arguments remain query-only and closed;
child capability/authority ceilings remain canonical and narrowing-only;
invalid role metadata fails before child creation;
exact child request tests prove selected skill instructions actually reach the child.

Exact final PR head c9fbb36003c864884ac6adade5bc0255469cc570 passed deterministic CI, REAL OpenRouter, Paid OpenRouter, Nix flake, Tree-sitter FFI, and clean SWI-pack installation before merge.

Remaining #172 core gap

The next coherent slice is the actual policy/control flow:

unresolved/unknown need -> prompt compiler/trusted policy selects skill + generic role -> canonical rlm_subagent -> bounded child evidence/result -> parent consumes result and resumes/replans

That slice should reuse the provenance substrate just landed. It must not let skill/role selection widen capability or authority, and failure/denial/cancellation/budget exhaustion must remain structured rather than masquerading as successful delegation.

#175 task deadlines remains separate and should not be folded into that selection/resume slice.

## #172 reconciliation after #203/#204 First skill-aware delegation substrate slice is now landed on `main` as `8054606971ffbbb6aa9484b4e915caa4c655929b` via PR #204. What is now canonical: - trusted `explicit_skills([...])` continues through the child `rlm_prompt_compiler` rather than a second selector; - host-only `subagent_role(Role)` is bounded inert metadata; - spawned child metadata and returned `subagent_result` carry selected skill + generic role provenance; - model-visible `rlm_subagent` arguments remain query-only and closed; - child capability/authority ceilings remain canonical and narrowing-only; - invalid role metadata fails before child creation; - exact child request tests prove selected skill instructions actually reach the child. Exact final PR head `c9fbb36003c864884ac6adade5bc0255469cc570` passed deterministic CI, REAL OpenRouter, Paid OpenRouter, Nix flake, Tree-sitter FFI, and clean SWI-pack installation before merge. ### Remaining #172 core gap The next coherent slice is the actual policy/control flow: `unresolved/unknown need -> prompt compiler/trusted policy selects skill + generic role -> canonical rlm_subagent -> bounded child evidence/result -> parent consumes result and resumes/replans` That slice should reuse the provenance substrate just landed. It must not let skill/role selection widen capability or authority, and failure/denial/cancellation/budget exhaustion must remain structured rather than masquerading as successful delegation. #175 task deadlines remains separate and should not be folded into that selection/resume slice.

lost-rob0t commented

2026-08-25 11:20:32 +00:00

(Migrated from github.com)

RAGE reconciliation after #206/#207: merged main is now 36cb418b833c77e24438fa94e596062a90088fa3. The closed KB command path is no longer demo/test host glue: prompt_command_execute/6 authenticates the compiled closed command + compiler fingerprint, projects only json{query:Text}, and invokes the canonical typed rlm_subagent tool path. Deterministic coverage proves the real child envelope reaches the parent as canonical child_result; forged targets and payload tampering fail before dispatch. Exact candidate head 67e8adc43fa3ec134051e2e3f1a05969e4daab8a passed CI (including REAL OpenRouter), Paid OpenRouter, Nix, Tree-sitter, and Clean pack before merge.

Remaining #172 gap is now narrower: connect the existing unresolved/unknown policy decision to this compiled-command executor, then make the parent explicitly consume the child result as resume/replan input under the existing global recursion/depth/concurrency/token/time/cancel limits. Do not add another subagent/tool/command path.

RAGE reconciliation after #206/#207: merged `main` is now `36cb418b833c77e24438fa94e596062a90088fa3`. The closed KB command path is no longer demo/test host glue: `prompt_command_execute/6` authenticates the compiled closed command + compiler fingerprint, projects only `json{query:Text}`, and invokes the canonical typed `rlm_subagent` tool path. Deterministic coverage proves the real child envelope reaches the parent as canonical `child_result`; forged targets and payload tampering fail before dispatch. Exact candidate head `67e8adc43fa3ec134051e2e3f1a05969e4daab8a` passed CI (including REAL OpenRouter), Paid OpenRouter, Nix, Tree-sitter, and Clean pack before merge. Remaining #172 gap is now narrower: connect the existing unresolved/unknown policy decision to this compiled-command executor, then make the parent explicitly consume the child result as resume/replan input under the existing global recursion/depth/concurrency/token/time/cancel limits. Do not add another subagent/tool/command path.

lost-rob0t commented

2026-08-26 04:08:08 +00:00

(Migrated from github.com)

RAGE next-slice gate — automatic unresolved delegation + parent resume

Revalidated against canonical main 49d86f88730b4a0f5dc4a7cf300b8f09ef5845b0 after #209 and the complete current transaction set. No active PR owns this remaining #172 slice: #212 owns #175 deadlines, #213 owns #211 result projection, #216 owns #176 root-planner tool visibility, and #132 owns #127 configuration.

BUG / falsifiable contract

Current merged tests prove the pieces, but not the required control flow. test/rlm_prompt_command_test.pl manually:

compiles the unknown KB binding;
manually registers rlm_subagent from the compiled policy;
executes the command;
manually pumps the parent until child_result appears.

That proves command authentication, typed dispatch, child context/provenance, and parent mailbox propagation, but it does not prove an unresolved parent decision automatically enters that path or that a successful child result is consumed as resume/replan input. The issue acceptance item is therefore still genuinely open.

The first realization must add the smallest deterministic production-path contract for that missing orchestration. Negative cases must assert the expected structured failure while the suite stays green; do not use intentionally-red CI/xfail/skip as TDD evidence.

Required first matrix:

unknown/unresolved decision selects an existing compiler-authenticated prompt command and dispatches only through prompt_command_execute/6 + canonical rlm_subagent;
selected role/skill provenance survives unchanged and cannot widen capabilities/authority;
successful child_result becomes explicit parent continuation/resume input and causes one bounded replan/continue step;
denied, cancelled, malformed, budget-exhausted, or failed child results remain structured and do not resume as success;
recursive delegation remains under the existing global depth/concurrency/token/time/cancellation ceilings;
no second command executor, scheduler, prompt selector, or arbitrary callable policy.

Analyze / research

Current source already has the correct reusable boundaries:

rlm_prompt_command owns closed KB binding compilation, SHA-256 authentication, typed prompt_command_execute/6, and prompt_command_subagent_options/3;
#209 adds the compiler-authenticated role/skill/source policy bridge into the existing subagent registration path;
rlm_agent already owns bounded mailboxes, child capability/authority narrowing, supervision, cancellation and child_result propagation;
rlm_prompt_compiler remains the only authority for skill/context selection and budgeting.

So the remaining defect is orchestration/continuation, not missing delegation primitives.

Downstream evidence agrees with this ownership boundary: a0-symbolics #51 explicitly leaves symbolic selection/planning/authority/effects/verification in Prolog-RLM, while agentProlog #8 owns the DeepSeek Harness AgentFactory/product composition. No downstream product code belongs in this slice.

Design

Add one generic runtime orchestration boundary that consumes an unresolved/unknown decision as data, resolves the already-closed compiler binding, registers/executes that authenticated command through the existing path, and converts only a successful canonical child result into bounded parent continuation input. The continuation step must reuse the current planner/conversation/runtime contract rather than inventing a second agent loop.

Keep these data classes separate:

unresolved decision -> compiled command -> typed subagent execution -> canonical child_result -> parent continuation/replan

Activation/selection remains distinct from capability/authority. Child output/evidence is observation data, never executable Prolog.

Adversarial review

forged/tampered commands: existing fingerprint validation remains mandatory before dispatch;
role/skill policy injection: existing conflict rejection stays canonical;
authority/capability widening: no continuation data may alter the child or parent ceilings;
false-success: only canonical successful child envelopes can enter resume/replan; all other terminal states stay explicit;
recursion escape: continuation must consume existing global depth/concurrency/budget/cancel state, not reset it;
model-to-callable escape: unresolved decisions, child results, and continuation input remain closed data and are never meta-called;
duplicate execution: parent continuation must consume the already-returned child result; it must not resubmit the admitted child/tool effect merely because the parent replans.

Decision: GO for this narrow slice. Keep #175 deadline work separate and preserve #209 provenance/authentication semantics.

Realization status

No production patch is claimed in this pass. The current execution environment cannot resolve github.com for a local checkout, so I cannot safely establish/run the focused deterministic contract or full repository gate before a code write. I am not doing a blind whole-file remote mutation. The next realization should start from this exact main SHA (or rebase the gate if main moves), add the deterministic green expected-outcome contract first, then implement the smallest orchestration boundary and run the complete exact-head gate.

## RAGE next-slice gate — automatic unresolved delegation + parent resume Revalidated against canonical `main` `49d86f88730b4a0f5dc4a7cf300b8f09ef5845b0` after #209 and the complete current transaction set. No active PR owns this remaining #172 slice: #212 owns #175 deadlines, #213 owns #211 result projection, #216 owns #176 root-planner tool visibility, and #132 owns #127 configuration. ### BUG / falsifiable contract Current merged tests prove the pieces, but not the required control flow. `test/rlm_prompt_command_test.pl` manually: 1. compiles the `unknown` KB binding; 2. manually registers `rlm_subagent` from the compiled policy; 3. executes the command; 4. manually pumps the parent until `child_result` appears. That proves command authentication, typed dispatch, child context/provenance, and parent mailbox propagation, but it does **not** prove an unresolved parent decision automatically enters that path or that a successful child result is consumed as resume/replan input. The issue acceptance item is therefore still genuinely open. The first realization must add the smallest deterministic production-path contract for that missing orchestration. Negative cases must assert the expected structured failure while the suite stays green; do not use intentionally-red CI/xfail/skip as TDD evidence. Required first matrix: - `unknown/unresolved` decision selects an existing compiler-authenticated prompt command and dispatches only through `prompt_command_execute/6` + canonical `rlm_subagent`; - selected role/skill provenance survives unchanged and cannot widen capabilities/authority; - successful `child_result` becomes explicit parent continuation/resume input and causes one bounded replan/continue step; - denied, cancelled, malformed, budget-exhausted, or failed child results remain structured and **do not** resume as success; - recursive delegation remains under the existing global depth/concurrency/token/time/cancellation ceilings; - no second command executor, scheduler, prompt selector, or arbitrary callable policy. ### Analyze / research Current source already has the correct reusable boundaries: - `rlm_prompt_command` owns closed KB binding compilation, SHA-256 authentication, typed `prompt_command_execute/6`, and `prompt_command_subagent_options/3`; - #209 adds the compiler-authenticated role/skill/source policy bridge into the existing subagent registration path; - `rlm_agent` already owns bounded mailboxes, child capability/authority narrowing, supervision, cancellation and `child_result` propagation; - `rlm_prompt_compiler` remains the only authority for skill/context selection and budgeting. So the remaining defect is orchestration/continuation, not missing delegation primitives. Downstream evidence agrees with this ownership boundary: `a0-symbolics` #51 explicitly leaves symbolic selection/planning/authority/effects/verification in Prolog-RLM, while `agentProlog` #8 owns the DeepSeek Harness AgentFactory/product composition. No downstream product code belongs in this slice. ### Design Add one generic runtime orchestration boundary that consumes an unresolved/unknown decision as **data**, resolves the already-closed compiler binding, registers/executes that authenticated command through the existing path, and converts only a successful canonical child result into bounded parent continuation input. The continuation step must reuse the current planner/conversation/runtime contract rather than inventing a second agent loop. Keep these data classes separate: `unresolved decision -> compiled command -> typed subagent execution -> canonical child_result -> parent continuation/replan` Activation/selection remains distinct from capability/authority. Child output/evidence is observation data, never executable Prolog. ### Adversarial review - forged/tampered commands: existing fingerprint validation remains mandatory before dispatch; - role/skill policy injection: existing conflict rejection stays canonical; - authority/capability widening: no continuation data may alter the child or parent ceilings; - false-success: only canonical successful child envelopes can enter resume/replan; all other terminal states stay explicit; - recursion escape: continuation must consume existing global depth/concurrency/budget/cancel state, not reset it; - model-to-callable escape: unresolved decisions, child results, and continuation input remain closed data and are never meta-called; - duplicate execution: parent continuation must consume the already-returned child result; it must not resubmit the admitted child/tool effect merely because the parent replans. **Decision: GO** for this narrow slice. Keep #175 deadline work separate and preserve #209 provenance/authentication semantics. ### Realization status No production patch is claimed in this pass. The current execution environment cannot resolve `github.com` for a local checkout, so I cannot safely establish/run the focused deterministic contract or full repository gate before a code write. I am not doing a blind whole-file remote mutation. The next realization should start from this exact `main` SHA (or rebase the gate if `main` moves), add the deterministic green expected-outcome contract first, then implement the smallest orchestration boundary and run the complete exact-head gate.

lost-rob0t commented

2026-08-26 09:48:27 +00:00

(Migrated from github.com)

RAGE realization / adversarial / verification update for the remaining parent-resume slice.

Exact start: canonical main 267697bef10a3fffff7c093e1435ece770e7444b.
Candidate: PR #238, exact head 9f41aa302a1772272c2d3d8c4d3aefede27cdb48.

Realization

Added the generic rlm_delegation_runtime:delegation_resume/10 composition boundary:

unresolved trigger -> prompt_command_compile -> authoritative parent capability snapshot -> rlm_subagent_register_command -> prompt_command_execute -> canonical completed child result -> closed resume input -> exactly one trusted continuation.

It reuses the existing compiler-authenticated prompt command, typed tool, rlm_subagent, rlm_agent, authority/effect, budget, cancellation, provenance and trace paths. No second selector/scheduler/executor or downstream product loop was introduced.

Adversarial review

The first green candidate accepted a caller-supplied ParentCapabilities list. I rejected that design before promotion because the command-dispatch capability check should not trust glue code to restate parent authority. Current delegation_resume/10 instead obtains the parent's actual capability set through authoritative agent_status/3 immediately before dispatch.

Current failure invariants:

missing binding: no child spawn, no continuation;
parent without tool(rlm_subagent): structured capability denial, no continuation;
failed/non-completed child result: explicit failure, no continuation;
child capabilities still narrow through canonical rlm_agent/rlm_subagent;
role/skill metadata remains authenticated provenance and never grants authority;
child evidence/result stays data, never an arbitrary callable;
continuation is explicit trusted host code and executes at most once.

Decision: GO for this bounded generic-runtime slice.

Exact-head evidence

9f41aa302a1772272c2d3d8c4d3aefede27cdb48 is green on every returned canonical workflow:

CI, including static production/test loading, runner-integrity checks, deterministic PlUnit, benchmark/conformance, deep recursion, CLI/trace, restart fixtures and whitespace;
deterministic PlUnit: 78 suites, 891 discovered, 891 passed, 0 failed, 0 timeout, 0 blocked, 0 fixme;
credential-backed REAL OpenRouter: core, structured repair, benchmark, recursion depth 0/1/2 and CLI smoke;
pinned Paid OpenRouter equivalents;
Nix flake;
clean SWI pack install;
Tree-sitter FFI.

Public semantics are recorded in docs/delegation-runtime.md. Negative contracts assert expected failures while CI stays green.

PR #238 has no submitted reviews, conversation comments, or unresolved review threads and GitHub reports it mergeable. I am leaving #172 open until the PR lands and the parent acceptance checklist is reconciled against merged evidence.

RAGE realization / adversarial / verification update for the remaining parent-resume slice. Exact start: canonical `main` `267697bef10a3fffff7c093e1435ece770e7444b`. Candidate: PR #238, exact head `9f41aa302a1772272c2d3d8c4d3aefede27cdb48`. ### Realization Added the generic `rlm_delegation_runtime:delegation_resume/10` composition boundary: `unresolved trigger -> prompt_command_compile -> authoritative parent capability snapshot -> rlm_subagent_register_command -> prompt_command_execute -> canonical completed child result -> closed resume input -> exactly one trusted continuation`. It reuses the existing compiler-authenticated prompt command, typed tool, `rlm_subagent`, `rlm_agent`, authority/effect, budget, cancellation, provenance and trace paths. No second selector/scheduler/executor or downstream product loop was introduced. ### Adversarial review The first green candidate accepted a caller-supplied `ParentCapabilities` list. I rejected that design before promotion because the command-dispatch capability check should not trust glue code to restate parent authority. Current `delegation_resume/10` instead obtains the parent's actual capability set through authoritative `agent_status/3` immediately before dispatch. Current failure invariants: - missing binding: no child spawn, no continuation; - parent without `tool(rlm_subagent)`: structured capability denial, no continuation; - failed/non-completed child result: explicit failure, no continuation; - child capabilities still narrow through canonical `rlm_agent`/`rlm_subagent`; - role/skill metadata remains authenticated provenance and never grants authority; - child evidence/result stays data, never an arbitrary callable; - continuation is explicit trusted host code and executes at most once. Decision: **GO** for this bounded generic-runtime slice. ### Exact-head evidence `9f41aa302a1772272c2d3d8c4d3aefede27cdb48` is green on every returned canonical workflow: - CI, including static production/test loading, runner-integrity checks, deterministic PlUnit, benchmark/conformance, deep recursion, CLI/trace, restart fixtures and whitespace; - deterministic PlUnit: 78 suites, 891 discovered, 891 passed, 0 failed, 0 timeout, 0 blocked, 0 fixme; - credential-backed REAL OpenRouter: core, structured repair, benchmark, recursion depth 0/1/2 and CLI smoke; - pinned Paid OpenRouter equivalents; - Nix flake; - clean SWI pack install; - Tree-sitter FFI. Public semantics are recorded in `docs/delegation-runtime.md`. Negative contracts assert expected failures while CI stays green. PR #238 has no submitted reviews, conversation comments, or unresolved review threads and GitHub reports it mergeable. I am leaving #172 open until the PR lands and the parent acceptance checklist is reconciled against merged evidence.