Implementation status and evidence ledger

This page answers one deliberately narrow question: what is real in the current tree, through which host, and with what evidence? It is not a release announcement and it is not a substitute for executable tests. It reconciles historical design documents with the source so that an old “done” label cannot quietly become an architecture guarantee.

Read the system map first for ownership, the change map before editing a boundary, and the roadmap for ordered future work. The status vocabulary below is the same vocabulary future audits should use.

Status vocabulary🔗

“Implemented” never means “finished forever.” It means the audited claim is reachable and tested at the stated scope. A unit-tested leaf with no host caller remains scaffolded. A UI that returns an honest unavailable error is a correctly implemented error boundary around an incomplete feature.

Evidence hierarchy🔗

The audit uses this order when sources disagree:

1. public types and reachable runtime branches;
2. integration tests and the normative language corpus;
3. focused unit tests;
4. generated schemas and protocol fixtures;
5. current internal documentation;
6. historical root documents, comments, wiki prose, and remembered demonstrations.

The snapshot inspected the workspace manifests, all composition roots, the 77 conformance suites, the kernel router and handlers, MCP mappings, configuration consumers, Reef resolution, prompt producers, journal schema, and CI definitions. It does not certify every OS backend on every kernel version, every third-party adapter executable, or performance targets on release hardware.

Executive dashboard🔗

Host-surface parity🔗

The same syntax crate does not imply the same runtime environment. “Local” below means the interactive shoal REPL or shoal -c; “kernel” means direct newline-delimited JSON-RPC; “MCP” means the stdio facade; “LSP” is editor analysis only.

The most important parity gap is composition, not parsing: the CLI installs config, aliases, environment, init scripts, adapters, prompt state, journal/frecency, and Reef scopes independently; the kernel session constructor installs a smaller subset. A shared evaluator builder is therefore a prerequisite for claiming one language environment across human and agent surfaces.

flowchart TB
accTitle: Host-surface parity
accDescr: Shows the components and relationships described in Host-surface parity.
  Core["AST + syntax + evaluator"] --> Local["local host builder"]
  Core --> Kernel["kernel Session::new"]
  Local --> LC["config + init + adapters + Reef + prompt + journal"]
  Kernel --> KC["journal + event forwarding + session state"]
  MCP["MCP"] --> Kernel
  Gap["parity gap"] -.-> LC
  Gap -.-> KC

Crate-by-crate maturity ledger🔗

The “proof surface” column names the kind of executable evidence, not an immutable test count. Test counts should be generated by CI rather than copied into prose.

Language implementation matrix🔗

Syntax and dispatch🔗

The canonical behavioral inventory is the language conformance contract. At this audit the corpus contains 1,310 cases across 77 suites. The observed harness result was 1,306 passed, 0 failed, 4 skipped; skips are host-dependent and are not counted as proof of the skipped behavior. Never copy the older 1,218/74 figure from the retired roadmap back into current docs.

Values and methods🔗

Method metadata and executable dispatch are currently drifted in two exact ways:

• SEQ_METHODS advertises .get for table and range receivers while runtime dispatch accepts only list-plus-integer and record-plus-string;
• bool runtime dispatch supports .str and .display, while bool metadata omits them.

Completion/docs generation must not treat metadata as proven executable truth until a bidirectional fixture asserts that every advertised receiver/method pair dispatches and every dispatched pair is advertised. See value method dispatch.

Namespaces and commands🔗

The builtin identity registry is centralized in the syntax crate and consumed by evaluation, completion, highlighting, and LSP. That portion of the old R4 roadmap is implemented. The actual resolution sequence for functions, aliases, adapters, Reef tools, interpreter runners, and ambient PATH remains distributed across evaluator modules. It is working behavior, but its precedence is harder to audit and easier to diverge than one typed resolver result.

Structured namespaces for JSON, YAML, TOML, CSV, math, HTTP, OS, and config are reachable. External HTTP effects are represented, but Leash has no OS network-enforcement backend; an effect can be planned/denied without a claim that allowed traffic is network-confined.

Execution and concurrency matrix🔗

The most severe execution-context defect is not a missing convenience feature: child evaluators created by spawn, parallel, on, and .shl paths do not consistently inherit the parent Leash, Reef state, and config capability. A restricted parent can therefore construct a less-restricted child. Treat this as a security correctness issue, not ordinary composition cleanup.

Security and authority status🔗

Authentication and session identity🔗

Session identity must be fixed before treating names as tenant boundaries. Either key sessions by authenticated owner plus name or persist an explicit ACL and reject unauthorized attach. A journal principal column does not repair access control after a shared evaluator has already been returned.

Token administration also needs an honest serving-state contract. shoal-token atomically rewrites disk state, while the kernel retains the TokenStore it opened at startup. A newly created token is unusable and a newly revoked token can remain usable until kernel restart; only expiry is checked against current time on each validation. profile/--cap values are echoed, not enforced.

Effects, policy, and enforcement🔗

No documentation should collapse these layers into the sentence “Leash sandboxes commands.” State the effect coverage, policy verdict, backend dimensions, and unsupported dimensions separately.

Protocol and agent surface status🔗

Kernel router🔗

The router exposes session, parse/complete, exec, value, task, PTY, plan, capability, journal, event, blob, and explain method families. Attachment and parameter requirements are documented in the kernel protocol. The route is real and extensively tested, but the following contract defects remain:

• cap.request does not require an attachment or authenticate an approving principal before setting a stored plan’s approved bit;
• journal.query does not require an attachment and does not restrict results to a caller principal;
• a plan ref is the first 16 hex characters of a hash over effects, reversibility, and estimates—not source/session/principal—so equal-shape plans overwrite one HashMap slot;
• the 16 MiB frame limit is applied after read_line has already accumulated a newline-free frame;
• value.get with format = "raw" can return full raw_base64 without the ordinary 64 KiB clamp;
• MCP does not special-case that raw payload, so the bypass crosses the facade;
• DateTime wire values are documented as RFC3339 but produced as Unix-second decimal strings;
• outcome spans now travel when OutcomeVal carries one, including through elision, and are omitted honestly when the producer has no source anchor;
• task.suspend and task.resume return TASK_CONTROL_UNAVAILABLE;
• kernel live events use bounded 256-event subscriber queues and coalesced gap summaries, but the separate in-language EventBus still uses unbounded subscriber channels;
• journal and transcript cursors survive restart through durable indexes, while most other state does not.

The raw-fetch path is not automatically wrong—agents sometimes need exact bytes—but it needs its own explicit offset/length budget or blob/ref resource contract. “Raw” must not mean “unbounded.”

MCP facade🔗

Tools and resources map to real kernel methods and have live-kernel integration coverage. MCP does not embed the evaluator, which keeps one source of runtime truth. However, resource unsubscribe currently acknowledges without owning and terminating the dedicated subscription connection/thread. Repeated subscribe/unsubscribe therefore has a lifecycle leak until the facade stores cancellation handles.

Refs and elision🔗

Inline value encoding, recursive budgets, CAS blobs, and scoped dynamic refs are implemented. The wire must preserve these distinctions:

flowchart TB
accTitle: Refs and elision
accDescr: Shows the components and relationships described in Refs and elision.
  Value --> Small{"within recursive budget?"}
  Small -->|yes| Inline["typed inline WireValue"]
  Small -->|no| Ref["summary + scoped ref"]
  Bytes --> Blob["CAS blob + shoal://blob URI"]
  Dynamic["task / PTY / stream / plan"] --> Live["session-owned live ref"]
  Restart -. "invalidates" .-> Live
  Restart -. "does not invalidate" .-> Blob

Configuration status🔗

The typed loader, precedence rules, environment overrides, validation, aliases, environment, init, adapter paths, completion settings, history fields, prompt basics, and Reef user scope are real. The exact schema and consumers live in the configuration reference.

Accepted-but-inert fields are a contract problem:

Core config selects one nearest ancestor project file, while rich prompt loading checks a different project path rule. Preserve compatibility for legacy prompt.template, but converge discovery and typed ownership rather than keeping two independent parsers.

Prompt, editor, and LSP status🔗

The prompt crate is correctly pure: a PromptContext snapshot enters and rendered lines/styles leave. This is a strong boundary. The local producer does not yet populate the entire model:

• editing mode is hardcoded to Emacs;
• multiline is hardcoded false;
• output mode is hardcoded Human;
• stash count is zero;
• battery and custom module data are not gathered;
• git status is gathered synchronously rather than from a deferred/event-driven cache.

Reedline completion, highlighting, history, menu/picker, and keybinding paths are implemented. They share builtin names but duplicate context heuristics. LSP diagnostics and completion work, while declaration/reference understanding is based on token-level indexing rather than the evaluator’s module, export, closure, and dynamic command-resolution semantics. The full audit is in prompt, editor, and LSP.

Reef and adapter status🔗

Reef🔗

Manifest parsing, ancestor discovery, semver constraints, provider queries, lock records, content hashing, view construction, runner selection, evaluator resolution, and which reporting are real. Important qualifications:

• a manifest with an empty tools table can be dropped even when runner/hermetic-only options should arguably define a scope;
• normal discovery skips malformed or unreadable manifests rather than surfacing a diagnostic;
• evaluator scope caching is keyed too coarsely around cwd and lacks a robust ChainKey/mtime invalidation model;
• an unknown tool constrained to latest does not imply exhaustive remote probing;
• lock persistence errors can be swallowed;
• version probes may execute before Leash policy evaluation;
• view identity hashes names/paths rather than executable contents.

See the Reef resolution reference for the exact pipeline.

Adapters🔗

Adapters are data-driven command descriptions and output parsers, not magic wrappers around all versions of a tool. The current tree contains substantially more definitions and command tables than the older “42 adapters” roadmap count. Catalog size is best generated during the site build or release process; prose should describe coverage classes and validation rather than freeze a number.

Interpreter-class adapters are real. Their relationship with parser-recognized interpreter blocks still needs a single discoverable registry or a generated parity test.

Persistence status🔗

SQLite WAL, version stamping, unfinished rows, zstd-compressed blake3 CAS, output metadata, typed undo inverses, pins, garbage collection, query filters, and durable transcript payloads are implemented. The journal storage reference records the schema and lifecycle.

Four current limitations deserve release-note visibility:

1. kernel execution writes a coarse whole-submission row while the embedded evaluator writes fine per-statement rows into the same schema, without a row-kind or parent-exec column;
2. journaling call sites often swallow storage failures to preserve command execution, so durability is best effort unless the host surfaces a health event;
3. evaluator spill adoption pins blobs without an automatic owner/release lifecycle;
4. shoal-history and doctor derive a different default XDG root than evaluator/kernel state.

Crash persistence is intentionally asymmetric: an appended row with NULL completion columns survives; live task/PTY/ref/session objects do not.

Platform matrix🔗

“Runs on Rust” is not evidence for Windows support. The kernel transport, PTY, job control, signals, sandbox, executable resolution, path encoding, and undo safety rules all require coherent Windows design and integration tests.

Quality and test evidence🔗

Current evidence🔗

• the conformance corpus is the normative language behavior suite;
• crate unit tests cover leaf invariants and many error paths;
• integration tests exercise interactive CLI, config wiring, process/PTY behavior, daemon restart, and a live MCP-to-kernel route;
• CI runs formatting, Clippy, tests, and release builds on Ubuntu and macOS;
• fuzz targets exist, but their CI build is non-blocking and coverage is shallow;
• Criterion commands exist for parser, evaluator, prompt, and wire benchmarks.

The benchmark thresholds in historical BENCHMARKS.md are review budgets, not evidence that the current commit meets them on a standardized machine. The site’s tooling and quality page preserves exact commands and separates measured results from desired ceilings.

Known quality gaps🔗

• workspace lint tables exist, but member manifests do not inherit them;
• stronger lint candidates have live violations and must not be enabled as decorative policy;
• two corpus harnesses duplicate fixture/schema behavior;
• NO_COLOR=1 in the ambient environment makes ANSI-expecting highlighter tests fail; the same 13 tests pass when that variable is unset;
• test presence is uneven across crates, with significant inline unit coverage that directory counts do not reveal;
• protocol bounds, slow-consumer behavior, principal isolation, and child-capability inheritance need dedicated adversarial tests.

Historical-document reconciliation🔗

These root documents were valuable design inputs. Their durable material has been absorbed into the internal atlas; their counts and status language are not current authority.

Historical wave disposition🔗

Release claim checklist🔗

Before calling a subsystem “done,” answer all of these with links to executable evidence:

1. Which composition roots can reach it?
2. Which configuration or capability state reaches those roots?
3. Which values, errors, and spans survive local, kernel, and MCP boundaries?
4. Which queues, frames, collections, and outputs have hard bounds?
5. What happens on cancellation, disconnect, crash, and restart?
6. Which principal owns each session, ref, plan, blob, task, and PTY?
7. Which effect is derived and which OS backend enforces it?
8. What is advisory, unavailable, or platform-specific?
9. Which focused invariant test and which live-boundary test prove it?
10. Which diagrams, public docs, protocol fixtures, and migration notes changed?

Highest-impact open findings🔗

This is a status list, not the work order; ordering and exit criteria live in the roadmap.

1. cap.request can approve a stored plan without an authenticated attachment, and journal.query exposes shared journal rows without caller scoping;
2. token create/revoke changes are invisible to a running kernel and token cap/profile fields are descriptive rather than enforced;
3. child evaluators can lose the parent’s Leash and related capabilities;
4. named kernel sessions are not durably owned by the authenticated principal;
5. local and kernel evaluator composition roots diverge materially;
6. raw value fetch and newline-free frame accumulation bypass intended wire bounds;
7. MCP does not own facade-side subscription lifetimes, and the separate language EventBus remains unbounded even though the kernel EventBus is bounded;
8. plan refs collide across equal effect shapes and journal coarse/fine rows lack an explicit relationship;
9. accepted configuration fields overstate host behavior;
10. Reef discovery, caching, probe authority, and lock persistence favor silent continuation;
11. stream stdin/wire transport and kernel task control are incomplete;
12. WASM remains a leaf scaffold, and Windows remains a separate architecture project.

Audit maintenance protocol🔗

Update this ledger in the same change that changes reachability or removes a qualification. Do not replace an explicit caveat with “fixed” unless the new proof includes the lowest invariant and the real composition boundary. If a feature becomes intentionally unsupported, documenting and testing the error is better than preserving an unreachable status claim.