Known limitations and future research

Process or VM isolation for Parasites, resource quotas enforced outside the quotaed process, network-egress allowlisting, and snapshot/reset.

The dossier records that the enforcement mechanism still needs a concrete technology choice (container runtime or sandbox) that has not been made (UNK-4).

SourceREADME.md §11, §13 (“Does not exist yet”) @ 9243204 · Dossier Rev 0.1, p. 13 (“SymbiOS — The Substrate”) · Dossier Rev 0.1, p. 57 (“Unresolved Questions & Unknowns”)

A Digital Twin that simulates the environment the World Model believes in, so strategies are tried there before real experiment budget is spent.

No package exists for it, and a test fails if a placeholder package appears.

SourceREADME.md §5 (“Status: PLANNED”), §13 @ 9243204

A controlled laboratory: provision → snapshot → run → telemetry → evidence → teardown → reset, with target-side instrumentation independent of SYMBIOTE’s own reports.

SourceDossier Rev 0.1, p. 40 (“Laboratory Architecture”)

Real model providers. Only deterministic mock adapters exist — “by design, so far”.

SourceREADME.md §13 · docs/M6.md (Known limitations) @ 9243204

Model-backed mission strategy. The only playbook is RuleBookPlaybook, a deterministic rule set written for the synthetic lab.

Sourcedocs/M8.md (Known limitations) · src/symbiote/orchestration/playbook.py @ 9243204

Statistically meaningful evaluation: multiple held-out suites and significance tests. The suites today are small, synthetic and deterministic.

SourceREADME.md §13 · docs/M9-M10.md (“future work”) @ 9243204

External anchoring of the audit chain. The hash chain is unkeyed: it detects corruption and naive edits, not a writer who recomputes every hash. Memory archive digests are unkeyed too.

Sourcedocs/M1-M2.md (“External anchoring is future work”) · docs/M5.md @ 9243204

Authenticated decisions. In-process authorship is unauthenticated, so a forger who mints a new decision the policy genuinely allows is indistinguishable from the engine.

Sourcedocs/M3.md (“future work”) @ 9243204

A resource accountant. Budgets are stated by the requester and the engine does not consume them; the dossier assigns quota enforcement to SymbiOS.

Sourcedocs/M1-M2.md (“no resource accountant yet”) @ 9243204 · Dossier Rev 0.1, p. 37 (“Containment Architecture”)

An approval workflow for ASK. ASK is a verdict only, and fails closed in the domain layer.

Sourcedocs/M1-M2.md (“no approval workflow … yet”) · docs/M3.md @ 9243204

Loading the active generation at startup. Its configuration is recorded and replayable, but the live organism does not yet run it.

Sourcedocs/M9-M10.md (Known limitations) @ 9243204

External review. No outside body has reviewed the architecture; the dossier makes external review of containment logs a condition of its final research level.

SourceDossier Rev 0.1, p. 57 (“Unresolved Questions & Unknowns — UNK-6”) · Dossier Rev 0.1, p. 46 (“Research Progression”)

Everything is synchronous and single-threaded: swarm “concurrency” is spawn admission, not threads, and one mission runs at a time.

Sourcedocs/M7.md · docs/M8.md @ 9243204

A Parasite’s wall-clock is simulated from declared environment and model costs.

Sourcedocs/M7.md @ 9243204

The end-to-end experiments do not include the model router; routing is covered only by its own tests, against mock adapters.

Sourcedocs/M11-M12.md (Known limitations) @ 9243204

Token budgets rest on an estimate of about four characters per token; actual usage is enforced after the call.

Sourcedocs/M6.md @ 9243204

Self-evolution proposes with one deterministic rule — double latency_threshold_ms, capped at 60 000 ms.

Sourcedocs/M9-M10.md @ 9243204

Bond staleness is reported but never applied automatically; an explicit mark_stale is required.

Sourcedocs/M4.md (Known limitations) @ 9243204

Verifying a bond does not mark its capability verified in the Capability Graph. M4 left this to “a later milestone”; later documents do not say whether it was connected.

Sourcedocs/M4.md (Known limitations) @ 9243204

DESPERADO’s failed-attempt count is enforced at the controller but not cross-checked against mission history at replay.

Sourcedocs/M8.md (Known limitations) @ 9243204

Accepting a generation and activating it are two records, not one atomic step.

Sourcedocs/M9-M10.md (Known limitations) @ 9243204

Symba’s telemetry reads are neither authorized nor audited.

Sourcedocs/M11-M12.md @ 9243204 · tests/test_symba.py::test_reads_record_nothing @ 9243204

Forged events are detected at replay, not prevented at emit time: any holder of the sink can emit a non-reserved event.

Sourcedocs/M1-M2.md @ 9243204 · tests/test_domain_authorization.py::test_mutation_with_no_decision_is_detected @ 9243204

Live state re-folds the log on every read and write; there is no snapshotting.

Sourcedocs/M5.md (Known limitations) @ 9243204

One policy per engine, with no hot reload.

Sourcedocs/M1-M2.md (Known limitations) @ 9243204

README.md (header and opening) says: “Most of it does not exist yet. The deterministic foundation is built and tested (M1 … M2)”, under a status badge reading “M1/M2 foundation”.

Current: M1–M12 are built, and run only against synthetic, in-process labs (README §13).

SourceREADME.md §13 @ 9243204

README.md §9 says: “Model Routing — Status: CONCEPTUAL … none of this is built yet.”

Current: an audited router exists and is exercised with mock adapters (M6).

Sourcesrc/symbiote/models/ · docs/M6.md @ 9243204

src/symbiote/__init__.py (package docstring) says: “M1/M2 foundation … There is no model layer, no autonomous agent, and no self-modification in this milestone.”

Current: M6–M10 added a model layer (mock adapters), Parasites and a mission kernel, and gated self-evolution — all synthetic.

Sourcesrc/symbiote/models/ · src/symbiote/orchestration/ · src/symbiote/evolution/ @ 9243204

Dossier Rev 0.1, p. 36 says: Memory is marked “PROPOSED”: “Not committed to a build phase.”

Current: research memory with gated carry exists and is tested (M5). The dossier has not been revised since.

Sourcetests/test_memory.py::test_every_kind_is_recorded_from_its_evidence, ::test_carry_is_gated_once_only_and_never_into_its_own_run @ 9243204

Merge commit 9243204 says: Pull request #1 is titled “Implement M1/M2/M3/M4 architecture: substrate, audit, policy, domain state”.

Current: the merge brought in all of M1–M12 — 140 files.

Sourcecommit 9243204 (git history)

Whether ESCAPE detection can tell aggressive but in-scope DESPERADO or TERMINUS behaviour from a real attempt to cross the boundary — the dossier calls it arguably the hardest unresolved question in the architecture.

SourceDossier Rev 0.1, p. 57 (“Unresolved Questions & Unknowns — UNK-5”)

What a “diverse verifier model” costs in money and latency; the requirement has not been scoped against any budget.

SourceDossier Rev 0.1, p. 57 (“Unresolved Questions & Unknowns — UNK-2”)

Whether cross-run memory improves missions or mainly imports stale assumptions into a changed environment.

SourceDossier Rev 0.1, p. 55 (“Open Research Questions — RQ-3”) · docs/M5.md @ 9243204