Kairo Runtime Integrity Sprint

The invariant that started it

The sprint was not a single feature. It was an epistemic correction across lifecycle state, tool results, memory retrieval, journal provenance, cross-session continuity, response acceptance, training contracts, and release engineering. The through-line was simple: preserve what the machine actually established, and do not let fluent prose or a later lifecycle phase strengthen it.

What changed epistemically

This distinction now survives farther through the system: from tools and retrieval adapters, through engine state and model context, into contradiction checks and durable settlement. It is still not a promise that every future defect has been eliminated. It is a larger set of boundaries at which the system can say what it knows—and what it does not.

Contents

1. A completed response is not a successful action

Kairo previously had paths where a bounded conversational ending could obscure a failed requested action. The corrected lifecycle separates five facts: response completion, requested-action outcome, verification, review, and durability. Repair, containment, cancellation, interruption, timeout, or shutdown may change how the response ends; once a typed tool outcome exists, those later phases may not erase it.

This state is coherent: the conversation ended, but the requested operation did not succeed. The final model receives compact authoritative current-turn state; deterministic contradiction checks reject prose that upgrades failed or indeterminate action state. Bounded repair is attempted, and a truthful containment response is used if repair cannot resolve the contradiction. Full mechanics are in Fail-loud runtime.

2. Background work became reconstructably durable

The background path was hardened around a descriptor double-close race, serialized journal appends, append-before-publish ordering, lost acknowledgements, restart reconstruction, and typed process output. Process output is now represented as empty, nonempty, or unknown, with a byte count when established. Exit code zero does not imply empty output; an absent or unreadable output artifact yields unknown, not empty.

3. Journal provenance records boundary facts, not cognition

journal_retrieval_events records candidate evaluation by the audited foreground retrieval path: query/hash, ranking, eligibility, selection or withholding, algorithm/configuration, and job/candidate provenance. journal_context_injections separately records selected, non-withheld journal blocks durably exposed at an identified model-call boundary, including location, hash, size, range, and retrieval linkage.

Audit or injection-confirmation failure removes journal-derived context before inference. The tables are append-oriented and protected against ordinary mutation, with a bounded authenticated purge exception in schema. They are not universal logs of every memory operation, and a missing row does not prove that memory was absent or that retrieval never ran. See Journal provenance.

4. “I could not check” no longer becomes “nothing exists”

Remote-memory failures already carried an error; the correction ensured consumers promoted that error into authoritative current-turn state, projected it to final generation when retrieval truth matters, persisted it, and rejected unsupported absence claims. The same principle now governs durable stance lookup: an unavailable stance inspection cannot support “no stance exists.”

5. Sensitive cross-session continuity stopped treating similarity as identity

An explicit-intimacy exception had allowed same-class text with fused similarity at or above 0.50 to bypass ordinary lexical overlap. An adversarial corpus showed that topical resemblance was not continuity: different people, ownership frames, quoted or third-party speech, and fictional or hypothetical material could cross sessions.

The bypass now requires an independent continuity assessment—supported, contradicted, or unknown—plus no hard contradiction. Entity/person, ownership, discourse-frame, and gross-context contradictions veto even high similarity for this sensitive class. Unknown falls back to ordinary admission; similarity may rank a candidate, but cannot establish continuity. Public examples are synthetic and abstract. See Continuity and retrieval.

6. A negative response-quality result was preserved

The production peer-room relevance rule is lexical: for recognized peer-message forms with at least six concrete terms, a draft must reuse at least one exact concrete term. Controlled open-versus-bounded pairs demonstrated a real weakness: a responsive paraphrase can be held with zero overlap, while the same substantive answer can pass when a bounded question supplies an anchor.

A deterministic 9B semantic fallback was calibrated in shadow. It recovered some false rejects, but the expanded 224-case corpus showed unacceptable drift admission and uncertainty on the untouched holdout; adversarial fluent drift also fooled it. Human replication was absent, embeddings did not generalize, and fresh natural shadow traffic provided no new applicable zero-overlap denominator. Decision: KEEP_CURRENT_GATE. The harness remains explicitly non_authoritative and shadow_only; structured response-quality attempt telemetry remains useful independently.

7. Subjectivity stance integrity without a consciousness conclusion

At the audited baseline there was no durable promoted assistant.belief.consciousness_stance record and no identity_stance_versions row. There was unresolved belief material and conversational first-person language, but neither is equivalent to a governed durable stance.

Stance-status questions now trigger authoritative stance inspection. Successful empty lookup can support “no durable promoted stance currently exists”; an outage yields unknown and cannot support absence. This protects durable-state claims without censoring philosophical positions. Kairo’s first-person statements remain meaningful self-report, but they are not external proof of phenomenal experience. See Subjectivity stance integrity.

8. Training contracts were corrected, not merely resealed

Globally appending the journal capability block changed 2,970 prompts across 14 corpora, left old supervision incomplete in 802 exhaustive-inventory manifestations and 802 DPO manifestations, weakened 14 inventory evaluations, and created 118 new DPO prompt-limit crossings. The correction made capability context task-conditioned, updated exhaustive SFT answers and DPO preferences, strengthened evaluation membership checks, and fixed context budgeting rather than hiding truncation.

All 14 corpora were rebuilt canonically and resealed after semantic review. Runtime and training representations are checked against the same required journal propositions and non-implications. Final public identities: R3/student-dataset seal fa488098…f41866; linguistic audition aa3db859…c13a2. Hashes are abbreviated here to reduce visual noise; the release manifest retains the complete values.

9. The deployment failures were part of the evidence

The first validated code existed in a dirty worktree, and the old installer mutated a live virtual environment in place. Release engineering moved to clean commits, immutable environments, wheel and installed-file attribution, atomic systemd switches, maintenance ingress, deterministic canaries, and prepared rollback artifacts. A validated Python 3.14.6 environment could not be preserved by copying a venv onto the Python 3.14.4 production host, so the candidate was rebuilt and fully validated against the exact production interpreter identity.

RC1 rolled back after model-selected smoke tests exercised the wrong paths, accepted a compressed stale answer, and amplified recovery latency. RC2.x replaced infrastructure canaries with deterministic authenticated endpoints, preserved action outcomes through containment and cancellation, and made ingress maintenance fail closed. Later attempts found that a background canary still depended on model/reviewer completion, then finally reached the true process boundary and failed.

The final live background canary completed in approximately 0.129 s with state exited, exit code 0, output_state=empty, zero output bytes, valid journal chain, and successful restart reconstruction—with zero model, reviewer, or permission activity. The deterministic mutation canary completed in approximately 0.076 s. SQLite integrity was ok, schema remained 16, stance state was unchanged, and traffic reopened. The release history is detailed in RC2 deployment record.

Timeline

1. Fail-loud lesson An unavailable check must not look like a pass.
2. Verifier and lifecycle correction Completion, action, verification, review, and durability become separate.
3. Durability correction Background journals, reconstruction, lost acknowledgement, and typed output are hardened.
4. Capability projection Journal facts survive compact prompt selection and remain 35B-owned.
5. Recall truthfulness Unavailable and successful-empty become distinct through settlement.
6. Continuity correction Independent anchors and contradiction vetoes replace similarity-as-continuity.
7. Training correction and reseal Task-conditioned context, corrected supervision, canonical rebuild.
8. Immutable release engineering Clean scope, wheel/environment attribution, atomic switch and rollback.
9. RC1 rollback Nondeterministic smoke paths, stale response, and latency reveal missing production conditions.
10. RC2.x corrections Deterministic canaries, maintenance ingress, action preservation, production Python identity.
11. Final cwd diagnosis Canary-only inaccessible working directory produces the last process-start failure.
12. RC2.6 Deterministic canaries pass; integrity holds; traffic reopens; DEPLOYED_HEALTHY.

10. Evidence matrix

11. What this does not prove

• It does not prove phenomenal consciousness—or its absence.
• It does not prove that injected memory was attended to, semantically used, influential, or causal.
• It does not make every conversational self-report an authoritative durable state.
• It does not make every completed response evidence that the requested action succeeded.
• It does not make missing provenance evidence proof of absence.
• It does not show that the lexical response-quality gate is semantically ideal; it shows that the tested replacement was not safe enough.
• It does not show that passing tests and canaries eliminate all future runtime defects.

Release identity

Evidence basis: release manifest and source hashes; schema and execution paths; deterministic and authenticated regressions; canonical training rebuilds; durable job, workbench, journal, and stance records; live deployment canaries. Private prompts, memory contents, credentials, network addresses, filesystem paths, and personal identifiers are intentionally omitted.