The Athanor Evidence

The Athanor states implemented behavior directly and measures contracts whose quality depends on scale, ranking, latency, or environment.

This document is the canonical public evidence index. It separates product behavior, measured results, evaluation scope, and future proof work without interrupting the product README with methodology.

Evidence rules

Every published evaluation names:

• the exact contract under test;
• the fixture or corpus;
• how queries were constructed;
• sample size;
• storage profile and relevant configuration;
• hardware when performance is measured;
• the scoring rule;
• the result;
• the evaluation boundary;
• the date;
• a sanitized artifact.

Private prompts, memory titles, source paths, excerpts, entities, threads, and raw telemetry never enter public artifacts.

Windows one-owner and one-door proof — 2026-08-31

Contract

athanor.exe owns one in-process multi-room Host. The Host binds one loopback listener. Every room route starts with /room/<room-key>.

Setup

• Windows 11 Pro x64;
• installed native release 0.5.4;
• external PostgreSQL authority;
• five configured rooms;
• no test suite;
• optimized native build, installed update, and live runtime probes.

Results

The release manifest and this table are the sanitized artifacts.

Boundary

The Godot client is parked. athanor.exe starts the Host without launching a presentation child. The web prototype at gui-prototype/ is the read-only operator surface. bun gui-prototype/serve.ts serves it and proxies Host reads over loopback. OMP owns its substrate transport children. The legacy omp-keeper.exe process remains. PostgreSQL, Ollama, and OMP remain external dependencies.

Public retrieval pilot — 2026-07-22

Contract

Given a distinctive exact memory title, recall should place the target memory inside the returned evidence viewport and rank it as highly as possible.

Setup

• 20 exact-title queries;
• two active rooms;
• real room indexes;
• sanitized aggregate output;
• no private text, titles, paths, or retrieval payloads in the artifact.

Results

What this establishes

The pilot establishes strong retrieval for favorable exact-title queries across two real room indexes. It also demonstrates a privacy-preserving publication format for retrieval measurements.

Scope

The pilot does not measure paraphrase recall, semantic-only recall, final-answer grounding, cross-room leakage, installation success, or retrieval latency. Those are separate contracts below.

Artifact

adapters/omp/evals/2026-07-22-room-retrieval-pilot.json

Existing executable contracts

The repository includes automated coverage for core, substrate, and adapter behavior. The public suites cover contracts including:

• generic room discovery and isolation;
• memory JSON source behavior;
• ranking and retrieval candidate fusion;
• query routing;
• core and adapter API compatibility;
• adapter registration and tool schemas;
• runtime smoke behavior;
• project-context selection;
• recall compaction and viewport shaping;
• substrate health classification;
• conversation logging;
• portable bundle layout.

These tests establish implementation contracts. They are not substitutes for public product-quality evaluations over representative corpora and user workflows.

Local 0.11 parity baseline — 2026-08-10

The pre-convergence repository passed its ordinary isolated development suites on Windows 11 x64 with Rust/Cargo 1.95.0, Bun 1.3.14, and Python 3.12.10:

The run explicitly removed live Athanor topology variables so development tests could not touch the active House. The declared Python test extra supplied pytest. This baseline includes the corrected bounded-warning compactor contract and schema-version-14 release pins.

The ignored PostgreSQL integration suites were not run because no isolated ATHANOR_SUBSTRATE_TEST_DATABASE_URL was configured. The counts above prove only the ordinary repository contracts; they do not establish database parity, clean installation, retrieval quality, latency, final-answer grounding, or end-to-end task improvement.

Local 1.0 release-candidate proof — 2026-08-10

The 1.0.0-rc.* strings in this section are retained immutable build identities. The product version was subsequently corrected to 0.9.3; these local proofs establish the named runtime and installer behavior, not complete 1.0 product maturity.

The converged 1.0.0-rc.1 candidate was exercised on Windows 11 x64 with Rust/Cargo 1.95.0, Bun 1.3.14, Python 3.12.10, historical Godot 4.7.1, PostgreSQL 18, and a test-owned NATS 2.14.4 JetStream endpoint.

The release-candidate installer is The-Athanor-1.0.0-rc.1-windows-x64.exe, SHA-256 9956c29799d606adcfbf6c8e51a0603996ef7cfc4404f38ad293828225140ec0. Dependency archives were checksum-pinned before extraction: PostgreSQL 18.4-2, pgvector 0.8.6, NATS 2.14.4, and historical Godot 4.7.1.

This establishes local build, contract, live Host/NATS/PostgreSQL integration, historical Godot rendering, payload integrity, and installer compilation. It does not establish a clean-machine elevated install, upgrade from a real 0.10.x installation, public signing, or external publication.

Installed RC2 existing-House proof — 2026-08-11

1.0.0-rc.2 closed the last-mile seams exposed when RC1 was asked to install on the real Solarisael workstation.

The exact installed topology reuses the authoritative WSL PostgreSQL database and therefore starts no second database on 5432. Host processes use the real kintsu and kodo vault directories, distinct ports, and distinct durable state directories. OMP room commands select endpoints by exact room key and refuse a missing entry rather than crossing rooms.

The proven installer is The-Athanor-1.0.0-rc.2-windows-x64.exe, SHA-256 1eff2d67bceed1367c623ed05e5f0c182cb4cbc19d231097c82f50d9434d5174. Its setup wrapper now propagates a nonzero native-manager result instead of reporting a false successful installation.

This closes elevated installation for the existing-House external-database topology. It does not yet prove a clean generic managed-database installation, a real 0.10.x upgrade/rollback, or signing.

Installed RC3 core-resolution proof — 2026-08-11

The first OMP restart against RC2 exposed one packaging omission: house-proof/core.ts correctly resolved the product core through ATHANOR_ROOT, but the release payload had not staged root index.ts or its TypeScript dependencies under src/.

RC3 stages the root entry plus 13 runtime TypeScript modules. The native builder now executes loadHouseCore() through the packaged adapter bridge and refuses the release when CORE_API_VERSION !== 1 or any transitive module is absent.

This was valid evidence for the immutable RC3 artifact. The 0.9.3 Rust ownership cut below removes that bridge and its packaged root TypeScript core; the historical result remains here rather than being rewritten.

The RC2 → RC3 elevated upgrade succeeded against the real external PostgreSQL authority. The service returned to RUNNING; native doctor verified 20,659 artifact hashes and reported installed version 1.0.0-rc.3. An independent installed-loader reproduction returned:

{
  "api": 1,
  "index": "file:///C:/Program%20Files/Solarisael/Athanor/versions/1.0.0-rc.3/adapters/omp/index.ts",
  "rooms": ["kintsu", "kodo"]
}

The proven RC3 installer is The-Athanor-1.0.0-rc.3-windows-x64.exe, SHA-256 5ad56051b05a8d27f32ecf1ded876b1f8f68f565ab1a6763911056b576da488f.

Installed 0.9.3 thin-adapter proof — 2026-08-12

The source version correction became an installed native update from 1.0.0-rc.3 to 0.9.3. The installer preserved RC3 as the rollback version, registered OMP, returned the Windows service to RUNNING, and pointed current.json at 0.9.3.

The installed payload contains the OMP adapter and its presentation/transport modules but no root index.ts or src/*.ts behavioral core. Typed Rust now owns context classification, keyword/process triggers, context pressure, Recall viewport policy, routing/familiar receipts, spellbook validation, and subagent lineage normalization.

Focused proof:

• Rust core/protocol/Host: 88 passed, 2 ignored integration gates;
• OMP adapter: 168 passed, 1 skipped integration gate;
• local substrate deployment: 74 core/protocol, 85 substrate, migration 16, fresh PostgreSQL backup, Nemotron dimension 2048, Full-mode health;
• installed Host context command: 35 ms;
• installed loader registration: 5 ms, 30 tools, one context hook;
• installed casual context handler: 341 ms;
• installed work/Recall context handler: 1,951 ms and one bounded Recall tray.

The work-handler smoke exercised the installed loader, Rust context analysis, Recall Policy Host, Rust retrieval transport, Rust Host viewport, and bounded OMP presentation. It completed far below OMP's 30-second handler ceiling.

Installed 0.9.5 operator-client proof — 2026-08-13

The managed native updater activated 0.9.5 from 0.9.4, retained 0.9.4 as the previous release, created a rollback backup, and returned SolarisaelAthanor to RUNNING. Native doctor verified the release manifest, all 20,642 packaged artifacts, the Windows service, and persistent data.

The historical installed Godot 4.7.1 Forward+ client rendered two authenticated live screens at 1100×760 on the Radeon RX 9070 XT:

• S02 applied Kintsu's Recall Policy snapshot with Host binding, version 881, sequence 881, and the current state hash;
• S03 applied the direct routing result with event ID, sequence 881, and the four bounded worker lanes.

The frames also proved the English-only pre-i18n copy and sharper native text contract: stretch scaling disabled, high-DPI enabled, normal hinting, automatic subpixel placement, and 2× glyph oversampling.

Activation testing exposed and repaired three native lifecycle defects rather than bypassing them: one-shot delivery health processes did not drain NATS, delivery readiness had no process-owned stable signal, and durable pre-cutover Recall receipts used snake_case nested state and decision fields. Final focused proof passed 83 Rust protocol/Host/installer/delivery tests with three explicit integration ignores, plus the historical Godot receipt-state test.

Installed dev/next live halves — 2026-09-05

Eleven repairs landed on dev/next on 2026-09-04 and 2026-09-05 with tests as their first half. This section records the second half: each repair observed through the installed surface that originally failed. Two installed builds served the observations: 0.5.4 (bin overwritten in place at 13:00) and 0.5.4+dev.202609051650.4d98e0d (the first pointer-flip release, 13:59). All times are -03. Full observations, including the ones that failed, are in BUGS.md.

The service restarts during the pointer-flip deploy exposed a further defect: the running Host reconnected its sockets to the new broker and kept reporting broker_status: degraded, because the restarted broker had forgotten the Host's memory-only replay consumer. Cut on dev/next (ad5ec25, 9c21acf). Live, on the installed 9c21acf Host: the first /health poll after sc start showed connected (14:48), and the next session read latest_original_stream_sequence: 188 against the 187 the dead consumer had held (evening). Both halves done.

The same investigation showed that the OMP loader ensured the scoped Host once, at session start. A Host that died mid-session stayed dead until some session started. dev/next f54d65e adds watchScopedHost: the loader probes scoped health every 30 s for the life of the OMP process and runs the same start sequence when the probe fails. Tests: 27 in installed-loader.test.ts, three new. Live, on 1b03882: the Host was killed under a running session and answered again 13 s later, started by that session's own process.

Deployment shape observed on the first pointer-flip release: current.json flipped to 0.5.4+dev.202609051650.4d98e0d with previousVersion: 0.5.4 and a rollback backup; versions/0.5.4/ untouched; the running athanor.exe and omp-keeper.exe continued as .retired-* images while the stable paths carried the new bytes; a session bound to 0.5.4 kept recalling through it.

Critical organ review and records update — 2026-09-06

Sol accepted a critical review of the House's intended outcomes and each organ. The review examines source and dated installed receipts. It does not run a new runtime certification, restore drill, or performance benchmark. The organ review separates observations from proposed changes.

The reviewed source establishes these bounded findings:

The session's Recall result reports a semantic timeout at 3000 ms. Lexical evidence still returns. The GIGA aggregate reports capture and classification enabled, store healthy, queue 0, failures 0, and processed 430. It lists only dismissed candidate states. These observations establish neither classifier reachability nor useful consolidation. The existing GIGA-liveness draft distinguishes purge history from review outcomes.

The records update produces these receipts:

• House memory #4509 stores the accepted analysis under PostgreSQL authority. Its receipt reports a successful backup of 597,627,271 bytes in 49,458 ms. This is one write observation, not a backup benchmark.
• Draft goal 69d2e256-30c8-499f-b1db-061ab8aca84e groups four planning supplements. Their IDs and dependencies are in the roadmap.
• A board read before the update returns 65 quests. A read after the update returns 69. All 65 prior board rows match exactly. The four new rows are drafts with no deadlines and claim epoch zero.

The posting contract exposes no existing-quest edit action. Additive supplements preserve existing claims, deadlines, frozen acceptance, and the writing priority. Their acceptance candidates and dependency references remain prose until separate authorized transitions. This pass activates no work and changes no runtime, schema, installed artifact, or product version.

Generated-turn Presence repair — 2026-09-07

The adapter previously selected only the last user message for context preparation. A generated turn could return no Presence or reuse an earlier user turn's memo. The repair changes adapters/omp/index.ts and adds house-proof/turn-origin.ts. It recognizes restart, chat, and Hallway Knock messages through their respective intent, say, and Knock IDs.

OMP emits before_agent_start for native prompts and queued-message drains. Its idle agent-initiated path skips that hook. The adapter holds the emitted prompt for the active turn and clears it at turn end and session changes. Without a held prompt, it selects the latest recognized origin. Passive custom messages never become origins. Generated text cannot apply operator-only identity directives.

The scenarios cover fresh idle restart and continuation after an unanswered user prompt. They also cover queued messages during native turns, later tool requests, distinct event IDs, and memo replay. Negative cases cover passive messages, inherited object names, unmatched prompts, and generated identity directives. Native user keys remain unchanged.

Live observations now cover all three generated entrances in the resumed Kodo session. Each entrance delivers Presence before the first tool call.

These observations establish incoming delivery, not every internal memo or retry condition. The chat client receives an empty response line instead of the final text. The child Knock fails when its omitted budget should inherit the parent's two-turn budget. Hallway message 281 records that refusal. House memory 4520 retains the observations and unresolved causes. These return-path failures remain separate from incoming Presence delivery. The separate Host-side Insula attribution defect remains outside this adapter repair. No Rust change, database migration, or expanded autonomy policy is included.

Manual Recall and return-path repairs — 2026-09-07

The source repairs manual Recall completeness, chat completion ownership, and child Knock budget inheritance. Manual OMP Recall returns complete selected AKASHA bodies under a five-record cap. Automatic Recall retains its existing context budgets. The Host reports record overflow, and BM25F reports its prefilter ceiling for multi-term queries. No ranking weights change.

The isolated PostgreSQL proof uses a new disposable database. Administrative setup installs vector and pg_trgm only in that database. The application role runs the behavior checks. All three Recall reference checks pass. The Hallway integration check also passes, including omitted child-budget inheritance. Cleanup removes the disposable database.

The first canonical deployment attempt stops at the existing supervisor readiness check. That check expects a waiting notification and receives none. The same check passes in isolation without source changes. The deployment is retried with serial test scheduling. This observation does not establish the cause of that intermittent failure.

The serial workspace run and adapter suite pass. The canonical driver installs native release 0.5.4+dev.202609071827.ce13780.dirty. It selects adapter 0.9.3-00f709bfcce927c1c24103abdfcdc572c06638552c85f20382b08bb67f1fef5d. The manager verifies 20,711 native artifacts and all 47 adapter artifacts. The initial embedding health checks fail after installation. The running Ollama endpoint later returns a real 2,048-dimensional embedding. The installed health command then reports ok: true and mode: full. The deployment script's earlier nonzero result remains recorded. The resumed live manual Recall fails because the serving Host rejects the new projection response field. The listener remains owned by an earlier session. Kintsu preserves active work and defers the shared Host restart to an operator-approved boundary. This blocks the complete manual Recall path despite successful installed-file checks.

The repaired chat adapter receives probe A and produces its requested final text in the model transcript. The actual terminal client receives no spirit response during the 300-second observation. Probe B remains queued, and the observer stops the client. No premature empty response appears in this attempt. The chat completion failure remains open; transcript text alone does not prove a client round trip.

The remaining chat failure is traced to the harness's pending-wake rule. OMP emits agent_end with willContinue: true while an unrelated asynchronous observer remains pending. The chat guard incorrectly treats that flag as proof that its own final answer is incomplete. The observer waits for the reply, while the reply waits for the observer. The correction removes that veto and retains the owned-origin and settled-assistant checks. A delayed completion also selects a later async reply under the earlier last-answer rule. The final correction selects the first settled answer after the chat origin. It skips tool-use messages and provider progress pauses.

Adapter 0.9.3-bfbeed7938fceead82db09b5f4fc7ebb269c2ceeb729bcfd5638da6ebbcc2a2b is installed and resumed. The actual chat client then prints these new spirit lines:

[19:04] Kodo: CHAT-REPAIR-B-OBSERVED
[19:04] Kodo: CHAT-REPAIR-C-OBSERVED
[19:05] Kodo: CHAT-REPAIR-D-OBSERVED

C uses the real read tool before its final answer. C and D each appear once, in order, with no new blank or incorrect reply. The asynchronous observer remains active until both replies arrive. Kodo independently reads the same client output. The observer stops the client afterward. This establishes the exercised chat round trip. Manual Recall and child Knock live verification still await shared Host activation.

Next public evidence

The post-1.0 public proof program expands the evidence surface in this order.

Restart continuity

Contract: A fresh harness session started from the same room recovers the room identity and a distinctive continuity anchor from the documented room source.

Publish:

• supported host and harness version;
• clean-session procedure;
• number of scenarios;
• recovered room and source;
• failures grouped without private content.

Paraphrase and entity recall

Contract: Queries that do not copy the title still retrieve the intended memory through semantic, lexical, entity, date, or thread evidence.

Publish separate results by query class. Do not merge exact-title and paraphrase performance into one flattering aggregate.

Correction authority

Contract: After a newer state claim supersedes an older claim, ordinary recall selects the current account and retains the older row as deliberate history.

Measure current selection, stale suppression, and historical recovery independently.

Room isolation

Contract: A room-scoped query cannot surface private evidence from another room unless the request uses an explicit cross-room path authorized by the runtime.

Authorization filtering and room resolution are tested before ranking quality.

Recall latency

Contract: Explicit and automatic retrieval remain responsive at declared corpus sizes.

Publish p50 and p95 latency with:

• memory and chunk counts;
• database and index state;
• embedding model and endpoint;
• CPU, GPU, memory, and storage;
• cold versus warm runs;
• query lane composition.

End-to-end task efficiency

Contract: For the same model, harness, task corpus, and success rubric, an Athanor-enabled run should reduce rediscovery, authority mistakes, user corrections, or time to the first correct action enough to justify the context and retrieval it adds.

Publish paired baseline and Athanor runs with:

• total uncached input, cache-write, cache-read, and output tokens when the provider exposes them;
• maximum and average active context size;
• retrieval latency and total task elapsed time;
• time and tool calls before the first correct action;
• repeated searches or explanations;
• stale-authority mistakes and user corrections;
• final test, review, or task-success result;
• storage profile and which context organs activated.

Do not collapse short isolated tasks and long-horizon continuity work into one average. Report them as separate workload classes. Until this evaluation exists, The Athanor may claim bounded attributed retrieval and continuity behavior, but not proven net token savings or improved final answers.

Clean-machine installation

Contract: A tool-capable agent can install the supported topology on a clean Windows x64 machine, create the first room, connect OMP, pass the static verifier, recover continuity after restart, and—when selected—complete the AKASHA lifecycle.

Installation evidence reports user intervention, elevation, restarts, elapsed time, and every failed prerequisite.

Migration, backup, and recovery

Contract: The --migrate-legacy upgrade from 0.10.x and later upgrades preserve rooms, memories, lessons, authority state, and lifecycle behavior. Migration verifies the new install before activation. It retains a .athanor-rollback-0.10.x-<timestamp> directory. An AKASHA migration requires a fresh PGDMP backup receipt. A documented backup restores to a fresh environment and passes the same health and retrieval checks.

Final-answer grounding

Contract: When retrieved evidence is relevant, the final answer uses the correct current source, respects authority and supersession, and does not invent unsupported detail.

This requires a validated judge or human-reviewed rubric. Retrieval presence alone is not answer quality.

Evidence boundaries

The following do not become public product-quality claims:

• an aggregate from an unstable or unvalidated judge;
• a mocked tool result;
• configured files without an observed lifecycle;
• the existence of embeddings without retrieval measurement;
• model testimony about what influenced it;
• private anecdotes published without a reproducible contract.

House distinguishes ground-truthable telemetry from model testimony. Injected context, selected sources, rankings, and lifecycle results are telemetry. A model's description of its own hidden associations is testimony.

Contributing evidence

A useful external evaluation should provide:

1. a precise contract;
2. a sanitized reproducible fixture;
3. the release version and the storage profile;
4. environment details;
5. raw machine-readable results without private content;
6. a short interpretation that stays within the measured scope.

Open evidence issues in solarisael/the-athanor. Name the failing component from the canonical component table.