[P0] Propagate permanent RLM operator context to internal model requests #200

New issue

Closed

opened 2026-08-25 10:06:42 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-25 10:06:42 +00:00

(Migrated from github.com)

Parent/design authority: #183
Related provider-surface gate: #176
Starting main: 2ceba4c0f4a64e95233849a92def6e4fbf95b8b7

Deterministic regression evidence

Current rlm_completion/4 compiles the default RLM operating skills and injects them into the root planner request as one system message. After the planner returns a typed plan, however, completion_after_recursive_validation/... constructs plan_run/5 runtime options containing providers, tools, context options, and budget only.

Current rlm_plan then executes every model(...) step by constructing a fresh provider request with exactly one user message:

model_request{
    messages:[message{role:user, content:Prompt}],
    options:RequestOptions
}

Therefore an RLM-internal model/leaf request — including one nested below rlm(...), parallel(...), or retry(...) — does not inherit the permanent operating skills that #183 requires throughout an RLM/agent run.

This is not a new architecture decision. #183 explicitly approves permanent provider-visible context across root planner, recursive/subagent, internal model/leaf, and repair/retry requests while leaving raw standalone LM calls raw.

RAGE / TDD contract

Analyze

The missing seam is host-owned runtime projection from rlm_completion into rlm_plan; the skill compiler itself already produces the bounded system message correctly. Recompiling skills independently inside rlm_plan would create a second policy path and is rejected.

Design

Carry the already-compiled permanent provider message(s) as a host-owned rlm_plan runtime option. Internal model(...) execution prepends those messages to its one user prompt. Nested RLM, parallel, and retry execution already reuse the same immutable Runtime value, so they inherit the projection without a second compiler or per-node re-selection.

Raw llm_query/3 remains unchanged. Empty/disabled skill projection yields the current single-user-message request. Runtime message projection changes visibility only; it grants no capabilities, handlers, authority, or effects.

Adversarial review

The implementation must prove:

default permanent RLM skills appear exactly once in an exact captured internal model request;
a model step nested under rlm(...) inherits the same permanent context;
retry/nested wrappers cannot duplicate permanent instructions;
trusted skill_mode(off) removes permanent instructions from internal model requests;
trusted per-skill disable removes only that skill from internal model requests;
raw standalone llm_query/3 remains a single user message;
model-authored plan data cannot inject/replace the host-owned prefix;
child/runtime capability narrowing remains unchanged — visibility never grants execution authority.

Decision gate

GO. This slice is inside the explicitly approved #183 architecture. If implementation requires a second compiler, model-controlled provider prefix, capability widening, or any materially different permanent-context ownership model, stop and return to #183 design review.

Acceptance

TDD regression captures the exact internal provider request and is red on starting main for missing permanent skills.
Internal/nested model request receives default permanent skills exactly once.
Retry path receives them exactly once per provider request.
skill_mode(off) propagates to internal model requests.
per-skill trusted disable propagates to internal model requests.
raw llm_query/3 remains unchanged.
no capability/authority/tool-runtime semantics change.
focused completion/plan tests pass.
complete deterministic repository gate passes.
exact-head GitHub Actions, including configured REAL OpenRouter and Nix/clean-pack gates, are green before merge.

Non-goals

no #172 skill-aware role/delegation selection;
no new subagent API;
no #175 timeout work;
no tool/MCP projection redesign beyond what is required by this permanent-message seam;
no compaction reconstitution in this slice;
no downstream Agent Zero/DeepSeek Harness product code.

Parent/design authority: #183 Related provider-surface gate: #176 Starting main: `2ceba4c0f4a64e95233849a92def6e4fbf95b8b7` ## Deterministic regression evidence Current `rlm_completion/4` compiles the default RLM operating skills and injects them into the root planner request as one system message. After the planner returns a typed plan, however, `completion_after_recursive_validation/...` constructs `plan_run/5` runtime options containing providers, tools, context options, and budget only. Current `rlm_plan` then executes every `model(...)` step by constructing a fresh provider request with exactly one user message: ```prolog model_request{ messages:[message{role:user, content:Prompt}], options:RequestOptions } ``` Therefore an RLM-internal model/leaf request — including one nested below `rlm(...)`, `parallel(...)`, or `retry(...)` — does not inherit the permanent operating skills that #183 requires throughout an RLM/agent run. This is not a new architecture decision. #183 explicitly approves permanent provider-visible context across root planner, recursive/subagent, internal model/leaf, and repair/retry requests while leaving raw standalone LM calls raw. ## RAGE / TDD contract ### Analyze The missing seam is host-owned runtime projection from `rlm_completion` into `rlm_plan`; the skill compiler itself already produces the bounded system message correctly. Recompiling skills independently inside `rlm_plan` would create a second policy path and is rejected. ### Design Carry the already-compiled permanent provider message(s) as a host-owned `rlm_plan` runtime option. Internal `model(...)` execution prepends those messages to its one user prompt. Nested RLM, parallel, and retry execution already reuse the same immutable Runtime value, so they inherit the projection without a second compiler or per-node re-selection. Raw `llm_query/3` remains unchanged. Empty/disabled skill projection yields the current single-user-message request. Runtime message projection changes visibility only; it grants no capabilities, handlers, authority, or effects. ### Adversarial review The implementation must prove: 1. default permanent RLM skills appear exactly once in an exact captured internal model request; 2. a model step nested under `rlm(...)` inherits the same permanent context; 3. retry/nested wrappers cannot duplicate permanent instructions; 4. trusted `skill_mode(off)` removes permanent instructions from internal model requests; 5. trusted per-skill disable removes only that skill from internal model requests; 6. raw standalone `llm_query/3` remains a single user message; 7. model-authored plan data cannot inject/replace the host-owned prefix; 8. child/runtime capability narrowing remains unchanged — visibility never grants execution authority. ### Decision gate **GO.** This slice is inside the explicitly approved #183 architecture. If implementation requires a second compiler, model-controlled provider prefix, capability widening, or any materially different permanent-context ownership model, stop and return to #183 design review. ## Acceptance - [ ] TDD regression captures the exact internal provider request and is red on starting main for missing permanent skills. - [ ] Internal/nested model request receives default permanent skills exactly once. - [ ] Retry path receives them exactly once per provider request. - [ ] `skill_mode(off)` propagates to internal model requests. - [ ] per-skill trusted disable propagates to internal model requests. - [ ] raw `llm_query/3` remains unchanged. - [ ] no capability/authority/tool-runtime semantics change. - [ ] focused completion/plan tests pass. - [ ] complete deterministic repository gate passes. - [ ] exact-head GitHub Actions, including configured REAL OpenRouter and Nix/clean-pack gates, are green before merge. ## Non-goals - no #172 skill-aware role/delegation selection; - no new subagent API; - no #175 timeout work; - no tool/MCP projection redesign beyond what is required by this permanent-message seam; - no compaction reconstitution in this slice; - no downstream Agent Zero/DeepSeek Harness product code.