[EPIC] Model-independent Zara identity and graceful intelligence degradation #336

New issue

Open

opened 2026-09-08 02:03:34 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:34 +00:00

Owner

Goal

Make Zara's durable identity and command authority independent of any single LLM/provider/RLM backend, with an explicit cognitive capability ladder that degrades gracefully instead of switching from works to broken.

Conceptual ladder:

frontier remote model
  -> remote/open model or bounded RLM mode
  -> local large model
  -> local small model
  -> bounded normalizer/semantic grammar
  -> Prolog symbolic reasoning
  -> deterministic hard reflex

Zara identity substrate

The following must remain outside replaceable model weights/sessions:

principal identity and relationships;
durable conversations/memory/evidence state;
user policy and programmable commands;
permissions/capability grants;
semantic vocabulary and provider placement;
personality/speech configuration where product-owned;
causal/effect history;
goals/plans that are explicitly persisted;
runtime/device state.

A provider/RLM/model change must not silently create a new Zara persona with unrelated authority or memory.

Capability profiles

Define runtime-advertised cognitive profiles with explicit support for tasks such as deterministic intent, bounded rewrite, conversation, summarization, extraction, planning, web research and tool proposal. Routing chooses the lowest/most appropriate available tier under user policy, privacy, latency and quality constraints.

Model/RLM authority boundary

Current master may use pinned Prolog-RLM direct mode where configured. Treat that as one replaceable cognitive backend, not the identity or authorization kernel. RLM/model outputs remain untrusted proposals until typed semantic/policy validation. Tool/capability authority stays with Zara runtime policy.

Failure/degradation semantics

provider/model/RLM failure falls through only where policy allows;
no cloud fallback when user selected local-only/offline;
no model/RLM fallback can bypass typed command policy;
unsupported tasks return explicit capability-unavailable state;
pending work is generation-fenced when the cognitive backend changes;
diagnostics expose backend/model/version/quantization/revision where known without secrets.

Cross-platform relationship

#622 remains the concrete Android offline implementation and must not be closed as superseded. This epic generalizes the same principle across daemon, desktop and future devices and defines model-independent identity semantics.

Tests

Run the same deterministic command/personality/memory ownership fixtures while progressively removing frontier model, network, Prolog-RLM/direct-mode backend, local large model and local small model. Prove supported symbolic/reflex behavior survives and unsupported conversational work fails honestly. Include backend replacement mid-turn, cancellation, privacy policy, no-network assertions and state continuity.

Acceptance

Zara remains the same principal-scoped assistant when models/providers/RLM backends disappear or change: available intelligence shrinks predictably, deterministic supported actions continue, and no fallback silently expands network access or authority.

Parent architecture: #624 Integrates with: current provider/model stack including merged #233 Prolog-RLM direct-mode support, #150 semantic authority, #622 Android offline-first runtime, and daemon/client architecture #127. The obsolete #124 embedded-client design is not a dependency. ## Goal Make Zara's durable identity and command authority independent of any single LLM/provider/RLM backend, with an explicit **cognitive capability ladder** that degrades gracefully instead of switching from `works` to `broken`. Conceptual ladder: ```text frontier remote model -> remote/open model or bounded RLM mode -> local large model -> local small model -> bounded normalizer/semantic grammar -> Prolog symbolic reasoning -> deterministic hard reflex ``` ## Zara identity substrate The following must remain outside replaceable model weights/sessions: - principal identity and relationships; - durable conversations/memory/evidence state; - user policy and programmable commands; - permissions/capability grants; - semantic vocabulary and provider placement; - personality/speech configuration where product-owned; - causal/effect history; - goals/plans that are explicitly persisted; - runtime/device state. A provider/RLM/model change must not silently create a new Zara persona with unrelated authority or memory. ## Capability profiles Define runtime-advertised cognitive profiles with explicit support for tasks such as deterministic intent, bounded rewrite, conversation, summarization, extraction, planning, web research and tool proposal. Routing chooses the lowest/most appropriate available tier under user policy, privacy, latency and quality constraints. ## Model/RLM authority boundary Current master may use pinned Prolog-RLM direct mode where configured. Treat that as one replaceable cognitive backend, not the identity or authorization kernel. RLM/model outputs remain untrusted proposals until typed semantic/policy validation. Tool/capability authority stays with Zara runtime policy. ## Failure/degradation semantics - provider/model/RLM failure falls through only where policy allows; - no cloud fallback when user selected local-only/offline; - no model/RLM fallback can bypass typed command policy; - unsupported tasks return explicit capability-unavailable state; - pending work is generation-fenced when the cognitive backend changes; - diagnostics expose backend/model/version/quantization/revision where known without secrets. ## Cross-platform relationship #622 remains the concrete Android offline implementation and must not be closed as superseded. This epic generalizes the same principle across daemon, desktop and future devices and defines model-independent identity semantics. ## Tests Run the same deterministic command/personality/memory ownership fixtures while progressively removing frontier model, network, Prolog-RLM/direct-mode backend, local large model and local small model. Prove supported symbolic/reflex behavior survives and unsupported conversational work fails honestly. Include backend replacement mid-turn, cancellation, privacy policy, no-network assertions and state continuity. ## Acceptance Zara remains the same principal-scoped assistant when models/providers/RLM backends disappear or change: available intelligence shrinks predictably, deterministic supported actions continue, and no fallback silently expands network access or authority.

nsaspy referenced this issue

2026-09-08 02:10:17 +00:00

P2 — implement authenticated Android ZARA/1 client enrollment, reconnect and session continuity #173