Inquirium

Based on:

• doc/project/40-proposals/063-inquirium-model-inquiry-organ.md
• doc/project/40-proposals/064-inquirium-implementation-recommendations.md
• doc/project/40-proposals/055-bounded-deferred-operation-contract.md
• doc/project/60-solutions/018-classification/018-classification.md
• doc/project/60-solutions/019-middleware/019-middleware.md
• doc/project/60-solutions/023-artifact-delivery/023-artifact-delivery.md
• doc/project/60-solutions/029-bounded-deferred-operations/029-bounded-deferred-operations.md
• node:model-runtime/README.md

Planned extension:

• doc/project/40-proposals/090-inference-execution-provenance-and-non-local-disclosure.md

Related schemas:

• model-runtime-catalog.v0.2.2
• inquirium.generate.request.v1
• inquirium.generate.response.v1
• inquirium.generate.output-envelope.v1
• inquirium.embed.request.v1
• inquirium.embed.response.v1
• inquirium.batch-embed.request.v1
• inquirium.batch-embed.response.v1
• inquirium.classify.request.v1
• inquirium.classify.response.v1
• inquirium.rerank.request.v1
• inquirium.rerank.response.v1
• inquirium.summarize.request.v1
• inquirium.summarize.response.v1
• inquirium.transform.request.v1
• inquirium.transform.response.v1
• inquirium.image-generate.request.v1
• inquirium.image-edit.request.v1
• inquirium.image.response.v1
• inquirium.train-adapt.request.v1
• inquirium.adapter.manifest.v1
• inquirium.adapter.response.v1
• inquirium.effect-intent.v1
• inference-execution-posture.v1
• inference-execution-provenance.v1

Status

Implemented MVP foundation; component status is partial for the additive execution-provenance slice. The earlier correctness/acceptance gaps P089-012 and P089-013 are closed, not remaining MVP blockers.

The bounded inquiry organ, host policy boundary, runtime-adapter substrate, conformance gate, direct data-plane pilot, and first local and remote provider paths have implemented foundations. Raw-file admission uses explicit, default-unknown adapter data-plane characteristics, exact runtime/model and lease-policy checks, and host-local no-egress enforcement. The OpenAI embedding DTO now accepts validated private provider metadata without exposing it in the neutral result; a full managed-adapter daemon regression uses a controlled fake provider. This is integration evidence, not live-provider acceptance. Additional provider families, richer evaluator profiles, and production trainer backends are additive extensions. The provider-neutral posture and provenance schemas plus their pure comparison, join, projection, migration, and Schema Gate foundation are implemented under P090-003; Inquirium's producer binding and result- carrier migrations are now partial. The daemon admits explicit provider-neutral execution characteristics per active runtime without inferring realized facts from transport or catalog posture. The real Agent-passage generate path has an exact result sidecar and durable V2 propagation; direct successful generate, embed, classify, rerank, summarize, transform, image-generate, and image-edit operations also commit exact sidecars in durable traces. Typed pre-I/O generate refusal records proven non-dispatch. P090-004a adds bound generate/embed results, sanitized failure dispatch evidence, a shared V2 response envelope, parent-preserving summarize/transform and current embedding cache/restart. P090-004b additionally carries runtime-bound classify/rerank results, classify/rerank/image HTTP failures, and explicit public V2 selection for the eight synchronous operations. Image publication derives its response or refusal from the exact runtime execution parent. P090-007a/007b now cover Assistant preview/execute, separate UI disclosure and finalized publication repair. The exact producer evidence precedes settlement; committed plans repair trace/charge/transcript projections without another inference. P090-004b2/004b2a cover ordinary synchronous-text Agent controller recovery. P090-004b3/004b4 add bounded batch execution, exact training commits and image-byte recovery, with artifact sidecars committed before descriptor visibility. Replay verifies the source and destination rather than invoking the adapter again. The local producer review additionally bounds worker shutdown, compensates refused queue admission without overwriting concurrent claims, and separates a known image terminal from failed result persistence. An uncommitted execution remains fenced; missing durable evidence never authorizes reinference. P090-004c adds the ten-operation terminal matrix, intrinsic ingress separation, sanitized pre-dispatch refusals and exact terminal/provenance trace pairs. Synchronous trace sinks, image byte/commit faults and corrupt replay preserve the known observation. Deferred result-object failure retains a separate bounded owner journal fact: BDO stores diagnostic digests, not the source bytes, and neither that projection nor the failure fact authorizes publication or redispatch. The common gate requires all fully qualified proofs in one bounded run, from explicit Cargo targets with captured completion output. A failure to bind an observation preserves its dispatch class instead of creating non-dispatch. Preparation refusals commit atomically without a dispatch-intent window; committed-image retrieval failure has a distinct public terminal class. Admission trace writes are bounded, and Legacy refusal taxonomy is retained. Generalized segmented/file/query batching, effect carriage and federated projections remain open; no physical acceptance is implied. These additive P090 capabilities do not change the implemented-MVP claim.

Date

2026-07-13

Executive Summary

Inquirium is the Node organ for bounded model inquiry. It gives workflows one provider-neutral capability surface for generation, embedding, classification, reranking, summarization, transformation, image work, and bounded model adaptation without exposing provider protocols or granting models authority.

The governing split is:

consumer intent
  -> Inquirium semantic operation and host policy
  -> model-runtime candidate and adapter-instance execution
  -> typed result, denial, artifact, or deferred outcome

model-runtime is the execution substrate, not the workflow-facing organ. Adapters translate concrete provider protocols and process mechanics. The host retains model selection, classification, grants, budgets, prompt assembly, conformance, leases, persistence, and effect authority. Model output is candidate evidence and never authorizes its own effects.

Context and Problem Statement

Model runtimes differ in transport, lifecycle, model naming, context limits, sampling controls, modalities, cost, locality, and egress behavior. Letting each workflow or provider adapter own these semantics would duplicate policy and couple the system to accidental implementation details.

Inquirium creates a stable semantic boundary above those mechanics. Consumers request an operation and constraints. The host selects a routable runtime, assembles policy-owned context, invokes the corresponding adapter instance, and normalizes the result. New model providers can therefore be added without changing workflow contracts, while new semantic operations begin in inquirium-core rather than as provider-specific endpoints.

The closed operation-descriptor registry uses the canonical dotted operation names batch.embed, image.generate, image.edit, and train.adapt at its schema boundary. Hyphenated entry and implementation refs remain stable identifiers rather than operation names. Every invocation path reuses the model-runtime-host admission gate before executing an enabled handler, including capability-passport and local control surfaces.

Proposed Model / Decision

Architectural Strata

1. inquirium-core owns substrate-free operation and policy data contracts.
2. inquirium-host owns pure admission, selection, prompt, budget, output, and returned-value effect-intent decisions.
3. The daemon composition root owns authenticated dispatch, concrete stores, supervision, transport invocation, leases, traces, and effect execution.
4. model-runtime owns runtime catalogs, adapter instances, lifecycle, capabilities, health, and conformance evidence.
5. Runtime adapters translate between neutral Inquirium requests and one model execution interface. They hold no ambient Orbiplex authority.

One adapter implementation may serve many configured adapter instances, and one adapter instance may serve many model bindings and runtime candidates. Selection is by runtime/ref; transport lifecycle is by adapter.instance/ref; provider-facing model names belong to model bindings.

Authority Boundary

Local control or an explicit inference grant is required before invocation. allowed_calls is shape admission, not authority. Missing classification, runtime support, conformance, grant, model binding, prompt content, lease, or output-policy evidence fails closed.

Model-returned control values and plans are inert proposals. The host validates and may forward them to an owning component, but Inquirium does not execute tools, mutate relationships, publish artifacts, or run an agent loop merely because a model requested it.

Admission locality and egress policy answer what execution the host may select. They are not evidence of where one particular inference was performed. The host must derive that separate realized provenance after dispatch and preserve its evidence strength for downstream consumers.

Must Implement

Semantic Operation Contracts

Responsibilities:

• expose operation-specific request and response contracts rather than one loose provider-shaped envelope;
• validate bounded inputs, outputs, parameters, classifications, and refs at the Inquirium boundary;
• keep provider-specific model names and controls in host-owned bindings;
• represent denial, degradation, invalid output, unsafe output, deferred work, and artifact output as typed values.

Status: done.

Runtime Selection And Adapter Execution

Responsibilities:

• select only healthy, routable, policy-compatible runtime candidates;
• separate adapter implementation, adapter instance, model binding, runtime candidate, and runtime instance identities;
• supervise local adapter processes by adapter instance while routing semantic invocations by runtime candidate;
• require signed adapter manifests and explicit operator authorization for egress-capable adapters;
• support local deterministic, local HTTP, and supervised remote provider paths without making a transport shape part of operation semantics.

Status: done.

Current Adapter Family Inventory

The current implementation has several orthogonal adapter axes. A transport kind describes how one adapter instance is invoked; a protocol profile describes what execution interface it translates; a managed runtime family describes how one local provider process and its model assets are launched. These axes must not be flattened into provider or Inquirium operation semantics.

Axis	Current family	Solution-level boundary
Adapter-instance transport	deterministic_stub	Host-local, provider-free fixture path for smoke, refusal, and acceptance evidence; never a production fallback.
Adapter-instance transport	command_stdio	One-shot stdin/stdout execution under host-owned timeout, framing, environment, output, and sandbox policy.
Adapter-instance transport	http_local	Managed or unmanaged loopback HTTP execution, including direct OpenAI-compatible chat-completions mapping.
Adapter-instance transport	http_api	Remote or externally managed HTTP execution under explicit egress, classification, endpoint, timeout, and budget policy.
Adapter-instance transport	channel_json	Host-mediated invocation of a supervised middleware module over its declared channel path.
Bundled protocol adapter	OpenAI Responses, Anthropic Messages	Provider translation supplied as supervised middleware modules behind the neutral Inquirium adapter contract, not compiled into Inquirium Core.
Bundled deterministic protocol fixture	local simulator	A supervised simulator module used for protocol conformance; distinct from the provider-free deterministic_stub adapter-instance transport.
Managed local runtime launcher	llama_server, mlx_lm_server	Verified local provider launch families below http_local; they share the OpenAI-compatible mapping but retain distinct platform and model-materialization constraints.

Exact manifests, transport fields, launcher arguments, platform admission, environment isolation, health checks, and conformance fixtures belong to node:model-runtime/README.md, the Node runtime catalog, and Node tests.

A full external agent runtime is deliberately absent from this inventory. A one-shot edge bridge may reduce an external agent response to candidate evidence, but durable identity, controller state, tools, and Room participation belong to Orbiplex Agent. Draft Proposal 089 (doc/project/40-proposals/089-external-agent-runtime-adapter-contract.md) defines that separate External Agent Runtime Adapter boundary.

Operation Descriptor Registry

Inquirium keeps InquiriumOperation as a closed typed algebra, while exposing one domain-owned descriptor per operation. A descriptor identifies the exact request and response contracts, code-backed handler, model-runtime requirement, capability owner, deferred behavior, and operator-visible identity. It describes implemented semantics; configuration cannot invent a new operation.

The daemon validates the operator-enabled descriptor subset at startup and checks it before every generate, embed, batch-embed, classify, rerank, summarize, transform, image-generate, image-edit, and train-adapt boundary. Disabled or empty effective sets fail closed before handler execution. Adding another operation therefore still requires a contract and enum revision, implementation, fixture, and Schema Gate coverage.

Operator-package descriptors reuse the shared P085 signed semantic-entry lifecycle. The package binds the exact Inquirium domain/ref/revision/implementation/digest tuple; the active projection is generation- and operator-bound and is rechecked against current grants. Rollback and restart preserve the exact binding generation, while revocation removes new-use authority immediately. This lifecycle does not let a package invent an InquiriumOperation or bypass operation, runtime, egress, budget, classification, and output admission.

Prompt, Context, And Output Policy

Responsibilities:

• assemble host-owned prompt layers monotonically across HostRoot, organ, operation, profile, model binding, and adapter instance;
• keep response locale independent from instruction locale;
• project bounded session memory from immutable facts while leaving summary production to another configured component or workflow;
• negotiate structured output with adapters while retaining host validation;
• enforce input/output rails, classification-aware egress, bounded repair, and a closed inert communication-control vocabulary.

Status: done.

Conformance And Operator Visibility

Responsibilities:

• persist host-owned conformance reports bound to the current canonical fixture digest and optional profile/host-class scope;
• keep candidates non-routable when required passing evidence is absent, stale, or failing;
• expose healthy and routable as separate operator-visible states;
• emit metadata-only, host-keyed traces without prompt, model output, vectors, image bytes, or protected context.

Status: done.

Scoped Pre-execution Inference Posture

Responsibilities:

• bind inference-execution-posture.v1 to the assertion owner, exact runtime/profile subject and generation or validity, invocation scope, and versioned processing-boundary ref;
• preserve open, bounded provider refs and disclosure state without granting the provider control over local admission, filtering, consent, or UI policy;
• treat missing, expired, invalid, contradictory, or unrelated-boundary posture as unknown or non-match rather than inferring it from transport, hostname, model, or adapter names;
• keep posture as preflight policy input only; it grants no inference, egress, context, raw-file lease, or effect authority and is not realized provenance.

Status: partial; the shared contract, pure comparison foundation, and a conservative host derivation function exist. Operator HTTP now exposes exact runtime/profile declarations bound to current catalog and provider-registry digests, owner, invocation scope, generation, boundary and validity; missing or changed bindings return a typed non-match. The admitted provider registry has shared CLI/UI preview-confirm-install tooling and canonical import validation. This inspection grants no authority. P090-004a also checks optional independently admitted Agent/external-runtime invocation policy against exact scope and current configuration before new I/O. Runtime preflight inspection reuses that checker; exact replay retains historical evidence without re-execution. Guided policy installation and broader consumer projections remain open in P090.

Realized Inference Execution Provenance

Responsibilities:

• derive the provider-neutral inference-execution-provenance.v1 descriptor from selected runtime/adapter/model facts and host-known dispatch and egress evidence rather than from a transport-name heuristic;
• distinguish admitted locality and egress policy from the realized path and its evidence class;
• attach or content-addressedly reference the descriptor on every inference-derived result and post-dispatch terminal outcome; represent a pre-dispatch refusal as dispatch = not-dispatched with locality = not-applicable, and insufficient post-dispatch evidence as unknown rather than implicit locality;
• preserve or monotonically join provenance through deferred completion, result transformation, artifacts, caches, replay, traces, effect intents, and consumer projections;
• allow policy-controlled provider redaction without dropping known non-locality, egress, uncertainty, or evidence class; keep provider session, account, credential, request, and endpoint details at the runtime edge.

Status: partial; Proposal 090's shared schema, pure join/projection, migration, and Schema Gate foundation are implemented. inquirium-core owns an exact response-bound sidecar. The daemon's explicit runtime characteristics feed direct-success traces for generation, embedding, classification, reranking, summarization, transformation, and image work; missing characteristics remain unknown, and the Agent-passage generate path durably replays its conservative descriptor. P090-004a binds generate/embed success and failure at invocation, preserves generate ancestry through translation and current embedding cache, and verifies exact Agent passage restart. P090-004b exposes explicit public V2 selection without silent downgrade, binds classify/rerank at invocation and retains image execution ancestry through publication or refusal. Proposal 064 tracks the scoped durable batch/training/image checkpoint separately from remaining terminals, general effects, remote resolution and full acceptance. Runtime/model refs and diagnostics alone do not satisfy this capability.

For synchronous text, a finalized Assistant publication plan retains the exact received source, response classification and ordered trace, charge and transcript intents. Recovery authenticates the original request and checks session excision; it does not authorize another invocation or reconstruct evidence from current routing. A possibly dispatched attempt without a committed plan remains fenced. The bounded failure/restart gate passes under P090-007b and P090-012a; batch, training and general artifact/deferred recovery are not implied by this path.

Direct Data Plane And Artifact Outputs

Responsibilities:

• issue bounded, expiring, operation- and runtime-bound leases for artifact, object-store, query, and allowlisted local-file scopes;
• validate canonical path containment fail-closed and enforce operation-scoped host-owned data-plane eligibility from explicit adapter/runtime characteristics, not transport names (P089-012);
• use bounded deferred operations for long-running batch embedding and model adaptation;
• verify output digest and size before object-store publication and preserve lease, runtime, model-binding, and operation provenance.

Status: done for the bounded pilot tracked by P063-13 and inq-direct-data-plane in P064. P089-012 closes raw-file eligibility with default-unknown AdapterDataPlaneCharacteristics, exact runtime/model binding, both lease policies, host-local read-only access and no-egress enforcement. The daemon regression file_lease_admission_requires_explicit_data_plane_policy_and_no_egress pins fail-closed admission. Broader artifact/deferred inference-provenance preservation remains partial under P090; this pilot does not certify it.

Budgets, Caching, And Effect Intents

Responsibilities:

• enforce token and cost budgets before and after provider work;
• make retries and structured-output repair visible to accounting;
• allow opt-in deterministic response caching only when stable model and policy snapshots are part of the key;
• return typed trace, transcript, budget-charge, and artifact-output intents to the daemon rather than performing hidden writes inside the policy stratum;
• compile model-authored candidate plans into inert, grant-checked Inquiry Flow values without scheduling them.

Status: done.

May Implement

Additional Runtime And Evaluator Profiles

Provider families, deterministic operation-specific caches, grammar/native schema profiles, and signed evaluator critics may be added when they preserve the same host authority and conformance boundary.

Status: post-mvp.

Production Model Adaptation Backends

Concrete trainers may replace the deterministic reference behavior behind the existing train.adapt admission, deferred execution, evaluation, and artifact publication contract. A trainer does not receive publication authority.

Status: post-mvp.

Operational Caution From Enacted Sources

P064 implements a post-MVP host prompt layer derived from daemon-validated P082 operational-context evidence. The mapping from the closed impact class to caution text is deterministic, versioned, and non-droppable for feed-dependent passages; publisher-authored summary text remains inert context. This adds neither an Inquirium adapter field nor model authority, and missing or inconsistent context fails collaborative-live invocation closed. Staleness is decided only by P082's current source-generation and effective-publication predicate; Inquirium introduces no context TTL. The optional summary is capped by P082 at 512 UTF-8 bytes before it reaches prompt shaping.

Golden tests pin layer ordering and the instruction hash, while refusal and monotonicity tests prove that local floors and multiple feeds cannot drop a production or critical caution. The publisher summary is never interpolated into the host-authored layer. Host-owned request metadata and the durable Inquirium trace carry deterministic selection provenance: local policy ref, local floor, selected class, and every source class paired with its exact operational-context digest. The composition root passes that bounded trace projection directly instead of deriving it from caller metadata or provider output. An audit can therefore distinguish a source declaration from a stricter local elevation.

Status: done post-mvp.

Trade-offs

The extra semantic layer adds explicit DTOs, manifests, catalog references, and host validation. In return, workflows remain provider-neutral, policy stays auditable, and local or remote models can be substituted without moving authority into adapters. Some provider features arrive later because they must first obtain a neutral contract and a fail-closed host path.

Failure Modes And Mitigations

• Unknown runtime or binding: deny rather than selecting an ambient default.
• New transport bypasses local-only policy: use positive transport allowlists so unknown variants fail closed.
• Adapter claims its own conformance: accept only daemon-run, fixture-bound reports.
• Caller overrides provider model identity: reject host-owned binding-key overrides.
• Prompt or output policy cannot be applied: stop before egress or suppress release with a typed terminal result.
• Lease escapes its scope: canonicalize, bind, expire, and reject raw remote file access.
• Cache corruption or stale affinity: validate the cached result and fall back to a real invocation without weakening authority.
• Admission policy or transport kind is mistaken for execution proof: derive provenance from evidence at the host boundary and preserve its evidence class.
• Provenance is dropped, downgraded, or made falsely local by a cache or projection: content-bind the descriptor, compose monotonically, preserve unknown, and fail closed on conflicting or stripped values.
• Provider disclosure is too broad: redact exact provider identity and provider-native session/request details independently of the non-locality and egress facts that consumers need.
• Model proposes an effect: keep the proposal inert and hand it to the owning capability boundary only after independent admission.

Open Questions

No unresolved question blocks the implemented MVP solution. New operation families, evaluator authority, or provider-specific extensions require their own proposal or an explicit revision of the implementation recommendations.

Next Actions

1. Preserve the dependency-direction and conformance gates as new operations and adapters are added.
2. Productize local model provisioning according to Proposal 066 Decision 8.5.1 and its post-MVP tracker, without changing the semantic contracts; concrete trainer deployments remain a separate product integration.
3. Implement durable agent loops in the Agent organ rather than extending Inquirium into an orchestration authority.
4. Implement Proposal 090 through the dependency-ordered P064 tracker: contract, host derivation, terminal-result carriage, persistence across cache/artifact/deferred/replay paths, then cross-layer acceptance.

Out Of Scope

• owning durable agent lifecycle or autonomous control loops;
• granting model-returned tool calls or plans effect authority;
• replacing Sensorium, Artifact Delivery, Memarium, Scheduler, or Agent;
• using provider sessions or caches as authoritative Orbiplex memory;
• making one provider API or implementation language the semantic contract.

Consumes

• authenticated host capability calls and inference grants;
• runtime catalog, model binding, adapter manifest, and conformance data;
• classified context and host-owned prompt policy;
• leases, artifact refs, query refs, and budget state.

Produces

• typed operation responses and denials;
• scoped provider-neutral inference-execution-posture.v1 values for admitted runtime/profile bindings — partial host derivation; preflight exposure remains planned;
• provider-neutral realized inference-execution provenance descriptors or content-bound references on inference-derived results — partial for the Agent-passage generate vertical and direct-success operation traces;
• verified artifact descriptors and deferred-operation refs;
• metadata-only trace and accounting intents;
• inert control proposals and compiled Inquiry Flow values.

Related Capability Data

• 044-inquirium-caps.edn

Implementation Recommendations

The implementation-specific contract, invariants, tracker, and extension rules remain in doc/project/40-proposals/064-inquirium-implementation-recommendations.md. That document refines this solution; it does not define a separate component.