This matrix records the observable standalone profile implemented by the Go runtime and its VS Code workspace adapter. “Operational” means a runtime route is constructed and tested. “Partial” means a useful runtime route exists but named specified behaviors are deliberately absent. “Contract-only” means state and protocol rules exist for composition or diagnostics but no backend is fabricated. “Unavailable” is a supported, explicit build result—not an implicit success stub.
The Go implementation is a substantial local runtime, not a claim that every specified AgentX behavior has reached parity. Repository-local Ruby audits validate the skill-routing graph, generated artifact ledger, independently reviewed source-to-contract hash bindings, and generated contract-to-scenario map. They do not execute every mapped scenario or prove that prose perfectly captures the source. Go implementation evidence comes from package tests; editor-adapter evidence comes from the TypeScript/unit, real-binary handshake, Extension Host, production-bundle, and VSIX checks named below. Partial, contract-only, and unavailable rows are known scope boundaries, not fabricated coverage.
The editor tests do not contact the production model endpoint. Unit and Extension Host tests do not submit a model turn. The offline integration smoke builds the actual AgentX binary but sends only the initialization control under a synthetic version-2 provider registry and an isolated temporary application home.
| Lifecycle boundary | Go owner | Executable evidence |
|---|---|---|
| Pre-CLI application-home bootstrap | pkg/app, pkg/config, pkg/platform |
sole AGENTX_HOME override/default selection, blank/relative/root/symlink rejection, frozen home and sessions/ creation, POSIX privacy, pinned-parent races, missing-auth surface tests, and latched post-rename tool denial |
| Early mode and option selection | main.go, pkg/cli, pkg/app |
CLI cross-option, stdin, exit, provider-discovery exclusivity, and surface tests |
| Credential/configuration normalization | pkg/config |
strict version/provider/schema, duplicate/unknown/trailing/oversize rejection, sole-source enforcement, model-backed default selection, no-selection discovery, Unix mode-bit enforcement, Windows identity/link checks, redaction, endpoint, model/effort tests |
| Extension/capability generation | pkg/extensions, pkg/mcp, pkg/tool |
precedence, cycle, trust, discovery, schema, and registry tests |
| Native attachment import and storage | pkg/attachment, pkg/protocol, pkg/surface, pkg/app |
regular-file snapshot/TOCTOU and link policy; magic/decode plus escaped-name/comment-aware classic-xref/catalog/page-tree PDF validation; bounded begin/chunk/commit/abort; strict IDs/base64/digests; immutable private store; independent durable-manifest and terminal-upload ledger bounds; reservation, timeout, EOF, cancellation, and orphan cleanup tests |
| Session creation/recovery | pkg/sessionlock, pkg/transcript, pkg/app |
application-home/workspace-hash placement, exclusive lock, truncation/corruption, unresolved-call, workspace-scoped continue/resume/fork tests |
| Native session inventory/deletion | pkg/cli, pkg/app, pkg/transcript, pkg/sessionlock, pkg/platform |
provider-free bootstrap, strict management-option allowlist, empty noncreating inventory, bounded pagination, minimal JSON, workspace isolation, identity/link replacement, lock contention, atomic detach, cleanup retry, and concurrent selection tests |
| Context assembly | pkg/prompt, pkg/memory, pkg/compact |
ordered sections, non-truncating instruction snapshots with explicit hard ceilings, recall, threshold, projection tests |
| Model stream | pkg/model, pkg/engine |
exact Azure text/image/PDF loopback requests, media preflight and quarantine, strict SSE lifecycle/correlation, cross-boundary credential-reflection rejection/redaction, retry, timeout, cancellation tests |
| Local diagnostics | pkg/observability, pkg/engine, pkg/app |
INFO/DEBUG level selection, DEBUG-only routine turn lifecycle, semantic-turn correlation, transcript independence, credential filtering, failed-sink containment, retry projection, and structured-stdout purity tests |
| Capability boundary | pkg/tool, pkg/permission, pkg/sandbox |
validation, deny-first policy, approvals, path/shell analysis, hooks, scheduling, exact settlement tests |
| Durable work | pkg/task |
lifecycle, output identity, state rollback, restart reconciliation, process-tree cancellation tests |
| Presentation/protocol | pkg/protocol, pkg/surface, pkg/app |
canonical-event validation, legacy and typed user decoding, attachment capability negotiation/import acknowledgements, and closed SDK NDJSON/control/race tests |
| VS Code workspace adapter | standalone extension repository | protocol/client/presentation/security unit tests; real-binary offline init handshake; trusted and Restricted Mode VS Code 1.95.3 Extension Host activation, command-registration, and trust-state tests; separate extension-host/webview production bundles |
| Shutdown | main.go, pkg/signals, pkg/platform, runtime Close methods |
atomic print-handler routing plus globally first-signal latching, conventional exit codes, exact-once second-signal/failsafe escalation, enforced monitor stop order, joined completion, idempotence, bounded phases, flush, and cleanup tests |
| Domain | Status | Boundary |
|---|---|---|
| Application-home bootstrap | Operational | A nonblank AGENTX_HOME is the sole supported override; otherwise AgentX uses ~/.agentx. The selected override must be absolute and non-root, and an invalid value fails rather than selecting the default. One physical home is frozen before full CLI parsing, its direct sessions/ child is created through a pinned parent root, and every invocation requires auth.json to exist, including malformed input. Credential existence checks and reads stay descriptor-relative to that root and reject a changed textual identity. The complete selected home is a mandatory protected capability subtree even inside an approved workspace; the interactive, headless, and standalone-MCP tool executors verify the home and sessions identities before and after permission evaluation, invalidate pending approval, and latch a process-lifetime tool denial after a detected sustained displacement. Restoring the inode does not clear the latch, while the guard does not claim atomicity against a rename after authorization returns to execution. Effective-user ownership and owner-only mode are enforced on supported POSIX platforms; Windows DACL privacy is not implemented. The standalone selector performs platform lexical cleaning but not Unicode NFC normalization |
Azure OpenAI Responses API using a selected auth.json provider |
Partial on supported POSIX platforms | Streaming, multiple logical model names, operator-declared reasoning subsets, encrypted-reasoning replay, function calls, provider-metadata validation, cross-chunk/part/error-field credential redaction, bounded retry/watchdog, usage, and explicit application-owned context limits are operational. Native PNG, JPEG, and conservative-subset PDF inputs remain configuration-qualified only for exact logical gpt-5.6-sol plus empty/v1/preview selector and are mapped through exact loopback-tested Responses input_image/input_file forms; other configured models remain text-only. One current-worktree profile passed sanitized representative live PNG/JPEG/PDF positive-path checks, but this does not introspect or qualify every deployment, selector, artifact, account, or platform; the complete MOD-A14B remains a per-release-claim requirement. An empty API-version value selects the v1 route without a query; exact nonempty v1/preview values retain the v1 path and every other nonempty value uses the versioned path, while every nonempty selector is added literally to the query. Safe version-source/route-family diagnosis plus a nonretryable version-mismatch subtype are not implemented. A mismatch carrying x-should-retry:true currently retries, and sanitized raw provider prose can still echo the configured version |
| Authentication and provider selection | Partial | The sole model credential source is one strict version-2 application-home auth.json provider registry; version 1 is rejected without migration. Every entry validates before model-backed selection. Exact --provider wins, a singleton is implicit, and otherwise one declared default is required; provider request failures never fall back. The separate --list-providers query validates the complete registry and credential union but selects no profile, so a valid multi-provider/no-default registry remains discoverable before any workspace, session, client, or network construction. Each profile owns Azure routing, logical model, and a closed reasoning-effort/default declaration. Every configured API key joins the complete shared redaction union while only the selected key reaches Azure. Durable sessions repeat provider ID/type/model plus a nonsecret routing fingerprint and reject changed or legacy-unbound sources before replay/fork; key rotation alone remains resumable. The literal auth child is opened through the frozen home descriptor, not by re-resolving a mutable pathname. POSIX files require effective-user ownership and private mode bits. Windows model-backed authentication is unavailable: regular-file, non-symlink, single-link, stable-identity, and bounded-read code exists, but every load fails before reading because native owner/DACL verification is absent. OAuth, Bedrock, Vertex, first-party account login, and cross-provider fallback are unavailable |
| Settings, policy, and migration | Partial | Pre-CLI application-home selection plus the fixed auth.json contract and early CLI are operational; multi-scope settings files, managed/remote policy, migrations, synchronization, and live reload are unavailable |
| Context and instruction discovery | Partial | Trusted ancestor AGENTS.md snapshots, prompt precedence, memory, date/environment, tools, and explicit prompt files are operational. Skill discovery checks .codex/skills below the selected workspace, but the selected workspace is currently the launch working directory rather than one frozen active repository root; a nested launch can therefore load ancestor AGENTS.md while missing the same repository's root skills. Managed/user/local AGENTX.md, rules/includes/conditions, lazy attachment, cache invalidation, instruction audit hooks, Git snapshot, and >40k status warnings are unavailable |
| Interactive line REPL | Partial | Commands, streaming answer text, approvals, questions, cancellation; deliberately not a retained-mode TUI and has no 30-second orphan-terminal detector |
| Headless text and aggregate JSON | Operational | Shared engine and deterministic exit behavior. Repeatable --attachment PATH accepts qualified PNG/JPEG/PDF snapshots with optional prompt text, preserves argument order, and supports attachment-only turns; slash/local command text combined with attachments rejects locally. Capability negotiation scopes file_path to initial_cli and stream_json_v1 to per_turn, and advertises the independent 100,000 durable-manifest and 100,000 in-process terminal upload-lifecycle bounds through max_uploads_per_session. Recognized slash input is routed before model context: only descriptor-opted-in /compact and /cost (/usage) run here, while other known or valid-unknown commands fail locally with zero model turns. Additive native session list/delete flags are provider-free management modes rather than headless turns; they preserve the application-home/auth-presence gate but construct no semantic session, transcript writer, provider, extensions, MCP, or project memory and emit only text or one versioned JSON object. Additive provider discovery strictly parses the registry, emits a bounded text inventory or one versioned JSON catalog, selects no provider, needs no workspace/default, and constructs none of those semantic services |
| Local diagnostic logging | Partial | A session-scoped Zap logger writes credential-filtered JSON records only to stderr. Routine turn start and successful-completion records are DEBUG, so successful turns emit no lifecycle diagnostics at the default INFO threshold; WARN retries and ERROR failures remain eligible. -d/--debug adds bounded turn-correlated lifecycle records plus session, model-iteration, stream, retry, capability, usage, timing, and terminal-state metadata; retry warnings carry session and model identity. With persistence enabled, accepted user, provider-usage, and terminal turn-result records remain durable transcript authority at either level whenever append and flush succeed. Prompt and model text, tool arguments and results, attachment bytes/base64/source or storage paths, provider data URLs/bodies, request headers, and configured credentials are excluded. Reason-coded skill-discovery outcomes and safe provider route-family/version-source attempt evidence are not yet implemented. Debug filters, debug-file routing, and external sinks are unavailable in this standalone profile |
| Bidirectional stream JSON SDK | Partial | Installed-CLI stdio provides the closed public union, FIFO correlated controls, dedupe/replay, permission races, and a bounded now/next/later queue. System initialization identifies the selected provider/type/model/reasoning declaration; correlated initialization publishes the complete ordered credential-free provider catalog with exact default/selected and reasoning metadata. Provider/model switching remains restart-bound. Version-1 input capability negotiation plus correlated bounded attachment_import begin/chunk/commit/abort and ordered typed user references are operational; capability absence means text-only. A user record is atomically validated/reserved before now cancels, then becomes the next serialized turn rather than being injected into the active recursive turn. No native in-process Go SDK/query-iterator facade is published. Initialize-time hook/MCP/prompt/agent/schema injection and live environment/mode mutation are unavailable |
| VS Code workspace extension | Partial | Workspace-host Activity Bar chat, incremental streaming text, tool/result correlation, permission and question controls, stop/follow-up behavior, workspace-scoped new/continue/resume/fork, editor references, diagnostics, completion notifications, Restricted Mode gating, owned process-tree cleanup, and allowlisted target VSIX construction are operational. The binary owns semantic and durable state and exposes provider-free authoritative CLI inventory/deletion plus native headless/stream-JSON attachments; the extension has not integrated either attachment input route. Text-only extension input, sessions observed by this extension rather than runtime inventory/replay, restart-bound settings, no IDE MCP/LSP bridge, and no native runtime qualification for every cross-built target are explicit limits |
| Core file/search/shell/question/task tools | Operational | Rooted text-file profile; all side effects cross composed authorization. Shell analysis recognizes a conservative closed Bash subset and asks on unsupported or ambiguous syntax; foreground and background Bash preserve the selected sandbox command factory; no PowerShell command tool is registered |
| Test-only permission capability | Operational | pkg/testing owns TestingPermission; exact NODE_ENV=test enablement, strict empty input, mandatory approval, success mapping, concurrency classification, and zero production registry footprint are tested |
| Durable sessions | Partial | Persistent state lives below <application-home>/sessions/<workspace-hash>/<session-id>/; new/resume/continue/fork, append-only transcript, exact session lock, completion-gated fork publication, and a shared authoritative provider-free inventory/deletion service are operational. Every new durable record is stamped with selected provider ID/type/model and a SHA-256 routing fingerprint excluding the key; resume and fork validate the complete source against the current selection before any provider-specific replay. Key rotation preserves continuity, while cross-provider, changed-route, incomplete, and legacy-unbound stamps fail closed. Native attachment manifests persist without bytes or paths; private content-addressed blobs remain session-owned, are verified on resume, copied safely into forks, retained while durable history references them, and removed with the owning native session. Missing/tampered referenced blobs fail attributably. Inventory is workspace-scoped, bounded, paginated, deterministically ordered, excludes incomplete forks and deletion staging, fails closed on safe-looking unsafe identities, and emits minimal metadata plus opaque revisions. Revision-bound deletion uses the existing nonblocking lock, durable intent, same-parent atomic invalid-name detach, directory sync where supported, and descriptor-rooted retryable cleanup with closed statuses. Resume, continue, fork-source selection, and explicit creation share the same pending-deletion exclusions. deleted describes only absence from the local native session store, not secure erasure or removal of backups, remote copies, project memory, worktrees, fork descendants, auth/configuration, or presentation caches. Accepted turns persist model-hidden usage and terminal results, but an accepted-user append failure currently enters ordinary finalization and can attempt an orphan terminal turn_result; the admission-failure rule in TX-A16 is not implemented. Legacy graph variants, live rewind, tombstone/snip replay, and general sidechain editing remain unavailable; source and destination are independent stores rather than one cross-store transaction |
| Local background processes and work/todo state | Operational | Durable records and output, bounded polling/cancellation; no unsafe process-handle reacquisition |
| Skills and output styles | Partial | Trusted selected-workspace .codex/skills discovery, literal arguments, and enforced deny-only tool scopes are operational. Repository-root identity is not resolved independently of launch depth, and /skills collapses untrusted, bare, missing, unreadable, empty, and all-rejected discovery outcomes into one generic empty result |
| Plugin component loading and hooks | Partial | Trusted manifest discovery plus contributed styles/hooks/MCP and the explicitly reachable hook subset; plugin skills are ignored, and there is no marketplace installer, dependency installer, or unsupported hook-event backend |
| MCP stdio client | Partial | Explicit stdio config, lifecycle, bounded discovery/tool calls, generation-fenced reconnects, ordinary composed permission checks, and provider-scoped result redaction are operational. Image/audio blocks become placeholders, resources/prompts have no integrated model-facing adapter, and trusted project definitions lack a separately persisted fingerprint-bound approval |
| Standalone MCP stdio tool host | Operational | Performs the common application-home and auth.json existence gates, then reuses core schema, application-home identity guard, permission, execution, task, and result contracts without parsing credentials or constructing a model client |
| Persistent project memory | Conditional | Attributed bounded local memory is stored outside the session directory at <application-home>/projects/<workspace-hash>/memory, with configured-credential redaction and heuristic secret rejection; authoritative transcript remains separate. The standalone hash uses the selected absolute workspace, so linked worktrees do not share memory and the broader canonical-repository/override contract is unavailable. Bare and nonpersistent sessions do not create or load memory. Unix owner-only mode bits are enforced; Windows model-backed startup is already unavailable before memory construction |
| Context compaction | Partial | Automatic/manual durable deterministic excerpt projections retain authoritative transcript evidence and safe response/tool boundaries. Native media projection retains the newest relevant media within 100 items/40 MiB, preserves durable manifests, and honors provider-rejection quarantine across retry/resume. Complete specified semantic summaries, compact-history rewriting, team synchronization, and consolidation are unavailable |
| Team memory, auto-dream consolidation, and memory synchronization | Unavailable | Local attributed project memory does not imply cross-agent or remote memory services |
| VS Code completion notifications | Partial | The workspace extension can use VS Code notifications according to its local focus setting after a projected terminal result; this is presentation state, not a durable task or general operating-system notifier service |
| Sleep prevention, updater, and general desktop/browser integration | Unavailable | The VS Code adapter does not fabricate these operating-system services or an AgentX binary update channel |
| Signal and shutdown lifecycle | Partial | Early process-level signal acquisition with conflict-checked raw-print versus interactive semantic SIGINT ownership, SIGTERM/SIGHUP codes, one global first request across all monitors, exact-once second-signal/failsafe escalation, joined completion, concurrent critical cleanup, and SessionEnd ordering are operational; orphan-TTY polling and retained-terminal restoration/hints are unavailable |
| External telemetry and authoritative cost accounting | Unavailable | Local privacy-filtered INFO/DEBUG diagnostics and token usage are operational; no remote sink or deployment price table is configured |
| OS sandbox | Conditional | Bounded macOS backend probe; explicit unavailable/unsupported status elsewhere; semantic authorization always remains active |
| Distributed identity, delivery, replay gate, and transport registry | Contract-only | No remote transport factory is registered in the local profile |
| Remote bridge/cloud/SSH/direct-connect/teleport | Unavailable | No network placement is implied by contract-state presence |
| Delegated agents and teams | Unavailable | No worker backend, mailbox, or worktree-placement implementation is advertised |
| Retained-mode terminal renderer, Vim/keybinding stack | Unavailable | Line REPL remains the selected portable surface |
| HTTP/SSE/WebSocket MCP, OAuth, server-initiated elicitation/channels, and LSP | Unavailable | Stdio request/response MCP is the only configured external-provider transport; unsupported server requests receive an explicit protocol error |
| Voice, browser/computer use, notebook, assistant viewer | Unavailable | Feature profile reports build exclusion; the bounded VS Code workspace adapter does not imply these optional experiences |
The handoff gate is:
git diff --check
test -z "$(gofmt -l *.go $(find pkg -name '*.go' -type f -print))"
go vet ./...
go test ./...
go test -race ./...
go test ./... -shuffle=on -count=3
go test -count=1 -v ./pkg/signals ./pkg/testing
GOOS=linux GOARCH=amd64 go build ./...
GOOS=windows GOARCH=amd64 go build ./...
ruby .codex/skills/implementation-conformance-audit/scripts/build_source_coverage.rb --check
ruby .codex/skills/implementation-conformance-audit/scripts/build_contract_scenario_coverage.rb --check
ruby .codex/skills/implementation-architecture/scripts/generate_drawio.rb --check
ruby .codex/skills/implementation-architecture/scripts/enhance_custom_drawio.rb --check
ruby .codex/skills/implementation-conformance-audit/scripts/audit_architecture.rbThe repository-required automated tests use isolated application homes, synthetic version-2 provider registries, and loopback-only mock servers; none of those gate commands contacts a production Azure deployment. Loopback media tests prove exact local PNG/JPEG/PDF request construction and authoritative zero-call preflight. A separate sanitized current-worktree qualification records one live profile. It is not a release-artifact attestation, did not induce provider media rejection/quarantine, and does not qualify every deployment, selector, platform, or provider boundary. The separate sanitized multi-provider qualification records one current-worktree artifact across two environment-local profiles, their complete declared effort subsets, SDK/discovery parity, tool continuation, provider-bound recovery, cancellation, privacy, and cleanup. It does not turn operator declarations into remote introspection or qualify an installed/release artifact, another route, authoritative price, or every provider condition. Linux and Windows commands are compilation evidence from the current host, not native runtime-conformance claims. The standalone VS Code extension repository owns its Node, Extension Host, offline protocol, and VSIX verification gates. Its Extension Host command downloads the pinned VS Code 1.95.3 test runtime; headless Linux additionally needs Xvfb and Electron runtime libraries. Those tests prove activation, command registration, manifest restriction, and trust-state behavior; they do not submit a user prompt or prove native remote-extension-host behavior. Extension packaging proves cross-build and VSIX construction for the six declared targets, while native release qualification still requires installation and execution on every target platform.