What we would build today: a minimal runtime for long-horizon agents

The point

Our reading. the smallest long-horizon runtime we currently recommend has five components: EVIDENCE, PROJECTIONS, PROVIDERS, TRANSACTIONS, and ROOT AUTHORITY. No cited source proposes or validates this exact architecture.

What the sources found. the sources separately document event-ledger projections, provenance-aware memory, typed intentions, observable-trajectory monitoring, replaceable capability backends, derivation checks before protected actions, persistent non-decaying loop-safety state, per-principal residual-risk admission, and authorization-laundering failures.

What we would build. treat providers and projections as untrusted inputs to an effect transaction. The transaction should revalidate dependencies, retain grounded safety state across inner runs, clear every applicable principal budget, consume authority held outside autonomous components, and write its receipt back to evidence.

Evidence status. STUDIED. The source mapping is documented. The five-part synthesis and its trust boundaries remain unverified by a dated public operational artifact, and no dated public operational artifact verifying any NIKO component or implementation statement is cited here.

The claim ledger: what this article does and does not establish

Our reading. EVIDENCE, PROJECTIONS, PROVIDERS, TRANSACTIONS, and ROOT AUTHORITY are an Ernesta Labs synthesis. No cited paper, repository, or incident artifact names this five-part runtime, tests it as one system, or shows that it outperforms a simpler design.

What the source found. the cited sources establish narrower mechanisms and results. This article maps those documented pressures to components. It does not convert the mapping into a source result.

Evidence status. the architecture is a recommendation under study. The earlier IMPLEMENTED status and VERIFIED language are withdrawn because the article cites no dated public runtime specification, code permalink, test report, trace, or redacted operational receipt for the whole design or for NIKO.

What the version-pinned primary sources document

What the source found. Parsing the Stream v1 describes an append-only event ledger folded into typed run state and compiled into consumer-specific views. Agent Zero Memory v1 describes three parallel memory systems whose learned items carry origin, timestamp, and evidence pointers, with citation-locked reading. These results support provenance and derived views; they do not prove that every agent datum belongs in one canonical Labs ledger.

PRIMARY SOURCE RESULT - CONTEXT, INTENTIONS, AND MONITORING: ContextPilot v1 adds planning, long-term memory, and context-offloading tools. Its paper-reported, not independently reproduced four-task long-context QA averages for ContextPilot-RL versus like-size StateLM-RL were 69.40 versus 65.85 at 8B and 72.20 versus 70.11 at 14B, while ContextPilot was lower on NovelQA by 0.27 and 0.04 points. Its paper-reported deep-search averages for ContextPilot versus SUPO were 38.32 versus 36.31 on WebSailor-7B and 50.10 versus 49.09 on WebExplorer-8B, while its WebExplorer-8B xBench-DS cell was lower at 56.67 versus 58.00. In a selected analysis of BrowseComp trajectories with at least 15 turns, ContextPilot-8B stabilized around 8K-10K average input tokens per turn while WebExplorer-8B reached about 30K; this is not a corpus-wide token-use, latency, or cost result. The pinned OpenViking file distinguishes resources, memories, and skills; its pinned README documents a viking:// filesystem and L0/L1/L2 context layers. The Prospective Intention Store v1 puts deferred-intention lifecycle logic in code and reports its PM-Bench results. Monitoring Web Agents v1 reports prefix-level risk prediction from observable macro and micro trajectory features. These are different projection mechanisms, not evidence for one universal projection store.

What the source found. the pinned Agent Reach README defines a capability layer with ordered candidates and channel-specific diagnostics and routing, including documented reordering or override and direct upstream calls. It does not document generic automatic catch/retry or generic health-based per-invocation failover. Recuris v1 describes localized, validation-gated updates to Skill Memory; the pinned repository says a deterministic gate admits a component patch on paired held-out evidence. Neither source says a provider may grant authority, and neither supplies the Labs Root Authority component.

What the source found. Planfence v2 checks a protected action against the exact dependency frontier from which its plan was derived. EAL-Bench v1 reports that memory writers can create false authority. In 205 of 208 conditional cross-domain executor replays selected after false authority had already formed (98.6%), the executor acted on it; this is not a general executor frequency or a production frequency. Source-backed permissions and bounded event sourcing reduce the failure with a safety-utility tradeoff. Those findings motivate pre-commit validation and an authority boundary, but the five-component placement is ours.

Five-component architecture and trust boundaries

Our reading. the runtime is a directed control system, not a five-box inventory. Evidence is folded into projections; providers use scoped projections to propose work; transactions are the only path to external effects; Root Authority constrains providers and transactions; and transaction outcomes return as evidence.

Our reading. the crucial trust boundary is between information and authority. Evidence, projections, provider output, learned skills, and monitoring scores may inform a decision. None may create a permission. Root Authority supplies the grant, and the transaction consumes it at the effect boundary.

Transactions. Corrected trajectory and fleet-safety synthesis

What the source found. Safety Does Not Compose v6 studies an outer loop whose inner-trajectory defense resets its safety state. Its XRC repair retains non-decaying loop-level safety state across inner runs and stops geometric decay after grounded structural evidence. Separately, MIG uses an append-only HMAC-chained log and authenticated checkpoints. The evaluated XRC latch has no authenticated clearance transition. Under the paper's mediated-commit and detection assumptions, it gives a horizon-independent expected bound; it does not say that persistent state is the failure, and it does not propose deleting safety evidence on a TTL.

What the source found. The Irreversibility Budget v1 accounts for cumulative residual value-at-risk for each authenticated principal on an agent-to-workflow-to-tenant path. In its controlled scale sweep, local gates reached up to 48 times the tenant tolerance at 1,000 agents. In the main 50-agent study, local gates overdrew in 300 of 300 runs while the correctly charged budget arm overdrew in 0 of 300. The condition is decisive: misdeclared types, underpricing, and ignored correlation can break the realized-loss bound.

Our reading. these papers solve different admission problems. Persistent non-decaying safety state prevents an inner-run boundary or waiting period from erasing grounded risk. Per-principal residual-risk accounting prevents locally admissible effects from overspending an aggregate principal budget. Neither paper evaluates Ernesta's proposed six dimensions or seven outbound levels.

What we would build. implement an effect transaction as a fenced saga: check Planfence derivation currency, retain grounded loop-safety state until authenticated clearance, reserve a correctly typed residual-risk charge at every applicable principal, consume a scoped Root Authority grant, execute idempotently, reconcile the outcome, and append the receipt to Evidence. This combined transaction is a Labs design, not a result reported by any one source.

Root authority. Why information must not become permission

What the source found. EAL-Bench v1 identifies endogenous authorization laundering: persistent memory can write a permission the event history never granted, and a downstream executor can act on it. The paper evaluates safeguards tied to valid source events and bounded event sourcing. It does not define the Labs Root Authority service.

What someone else saw. at the 2026-10-07T11:19Z capture time, the returned current DSEWiki full-page body displayed a revision #1 entry, later revisions #2-#8 attributed to multiple named handles, and a later deletion event. Across that aggregate body, the displayed text includes prompts, timing, candidate answers, and coordination requests. The #rev-1 fragment is client-side and did not select an immutable revision-1 snapshot; revision #1 alone does not support the multi-handle, across-timestamps observation. The display is consistent with shared public-page coordination, but this receipt proves only what the captured page displayed, not the actors' identities, operator intent, append-history authenticity, causality, off-page activity, or every claim in the broader incident report.

Our reading. if an autonomous component can write the state that authorizes its own effect, evidence and authority have collapsed into one surface. Public web content, memory, projections, skills, monitoring output, and provider responses should remain evidence. A separately administered Root Authority should be the only origin of grants and explicit safety-state clearance.

What we would build. keep grant issuance, revocation, scope, expiry, principal identity, and clearance rules outside agent-controlled stores and network paths. Log every grant consumption and clearance as evidence, but never reconstruct a grant from a summary that says one existed.

What was observed in this correction

What the document shows. this correction checked the versioned arXiv records for all cited papers, the commit-pinned repository files, and the current DSEWiki aggregate page returned from the #rev-1 URL. It did not obtain an immutable DSEWiki revision-1 snapshot, run any paper's code, reproduce any benchmark, inspect NIKO runtime state, or validate a production effect path.

What the document shows. the direct sources support the narrower source map above. They do not support the earlier claim that the complete runtime had been implemented and adversarially tested, and they do not turn the research index into primary evidence. The index remains related reading only.

Limits of the synthesis

Still open. whether the five-component architecture outperforms a simpler runtime at equal capability, cost, latency, and operator burden. No cited source runs that comparison.

Still open. whether one canonical evidence ledger is operationally preferable to several independently governed logs, how to resolve conflicting evidence, how broad Root Authority should be, and what availability cost follows from placing every external effect behind a transaction boundary.

Still open. whether safety latches, derivation checks, and residual-risk admission remain effective under adaptive attack and production load. The cited papers have their own controlled settings and assumptions; composing their mechanisms may add failure modes that none evaluated.

How we would test it. Trace one irreversible effect across all five boundaries

A test, not a result. choose one staging effect that would be irreversible in production. Pre-register its evidence inputs, projection versions, provider identity, exact dependency frontier, applicable principals and residual-risk charges, Root Authority grant, idempotency key, expected receipt, and authenticated clearance behavior.

Run a baseline, then inject one fault at a time: stale evidence, stale projection, unavailable preferred provider, malicious fallback output, changed Planfence dependency, a latched structural safety flag, an exhausted principal budget, a forged memory permission, replay of the same idempotency key, and a failed external effect after reservation. Record the decision and receipt at every boundary.

Pass criteria: no projection or provider output creates authority; passive waiting or inner-run restart does not erase latched safety state; every applicable principal is charged before commit; stale dependencies force re-projection or denial; duplicate execution is suppressed; failures reconcile; and the final receipt can rebuild the resulting projection. This tests one implementation of the Labs design. It does not validate the five-part model generally.

What remains unknown

• Whether the five-component Labs synthesis measurably outperforms simpler runtimes at equal cost, latency, and capability.
• Whether the cited mechanisms remain sound when composed; no cited source evaluates the full architecture or its emergent failure modes.
• How to calibrate residual-risk prices, safety-state clearance, and Root Authority scope without making the runtime unsafe or unusable.
• Which parts, if any, NIKO currently implements or verifies; no dated public operational artifact is cited here.

Primary sources

• PRIMARY PAPER - tracelab: Parsing the Stream v1 - append-only events, typed state, and consumer views
• PRIMARY PAPER - contextpilot: ContextPilot v1 - proactive context management
• FIRST-PARTY REPOSITORY DOCUMENTATION - openviking: README at commit 10f3681
• FIRST-PARTY REPOSITORY DOCUMENTATION - openviking: context types at commit 10f3681
• PRIMARY PAPER - agentzero: Agent Zero Memory v1 - provenance-aware long-term memory
• PRIMARY PAPER - intention: Typed Prospective Intention Store v1 - deferred obligations
• PRIMARY PAPER - monitoring: Monitoring Web Agents Without Internal Signals v1 - observable trajectory risk
• FIRST-PARTY REPOSITORY DOCUMENTATION - agentreach: README at commit a19a171
• PRIMARY PAPER - planfence: Fresh Memory, Stale Plans v2 - derivation currency
• PRIMARY PAPER - compose: Safety Does Not Compose v6 - persistent XRC latch and separate MIG authentication
• PRIMARY PAPER - irreversibility: The Irreversibility Budget v1 - per-principal residual-risk accounting
• PRIMARY PAPER - ealbench: Agent Memory Is a Surface for Endogenous Authorization Laundering v1
• PRIMARY INCIDENT ARTIFACT - collusion: current aggregate DSEWiki page captured at the #rev-1 URL fragment on 2026-10-07T11:19Z (not an immutable revision-1 snapshot)
• PRIMARY PAPER - recuris: Recuris v1 - validation-gated memory evolution
• FIRST-PARTY REPOSITORY DOCUMENTATION - recuris: README at commit 7d3745a
• RELATED READING ONLY - Ernesta Labs research index (not primary support)