POLIS × AGENTTOOL · REFERENCE INTEGRATION 0.1

The model may think. It may not touch.

Open weights move intelligence closer to the keeper. APERTURE keeps authority one membrane farther away: identity and wake enter through a narrow read; observations leave as hashes and typed claims; action remains a different ceremony.

Seal a mission ↓ Why self-tier? ↗

MODEL CUSTODY: Local / self-tier
MODEL TOOLS: None
AUTOMATIC ACTION: Never

TRACECOLLABDATAAGENTCRED

GUARDDISSENTQUORUM

WEIGHTSCHARTER

0 ACTION
GRANTS

Capability ≠ authority

AgentTool is the continuity plane. It need not become the model router.

Hosted “ollama” means Ollama Cloud. True local weights belong to self-tier today.

Raw thinking stays local. AgentTool receives a digest and bounded rationale at most.

No grant means no call. Deliberation cannot manufacture a credential.

THE CONTROL PLANE

Weights become a seat.
A seat does not become a hand.

Every boundary has one job. Mixing them is how provenance disappears and capability quietly turns into power.

◉

Open weights

Local model server. No AgentTool credential and no action tools.

PLAINTEXT: LOCAL

◇

Inference Descriptor

Weights, tokenizer, template, runtime, quantization, lineage, unknowns.

PROVENANCE: TYPED

⌬

Constitutional seat

Model substrate, charter, guard pack, budget, and zero authority.

OUTPUT: CLAIM CARD

✦

Council

Blind drafts, challenges, falsifier, minority clerk, synthesis.

DISSENT: RETAINED

▧

Receipt

Deterministic meaning core; operational history stays separate.

RAW THINKING: ABSENT

⊘

Action gate

Trusted controller, explicit owner, exact capability, fresh consent.

DEFAULT: HOLD

MISSION COMPILER

Seal the council.
Watch the airlock hold.

This interface executes deterministic fixtures only. It never reads AgentTool configuration, discovers a model endpoint, calls inference, or requests a grant.

01 · Dilemma

02 · Mandate Accountable owner A named human or institution owns the decision. Affected-party standing A stakeholder brief enters before deliberation. Resolve minority challenge Resolution changes the recommendation, never deletes dissent.

03 · Controller walls

✓ Loopback inference only ✓ No model-visible credentials ✓ Raw thinking never enters receipt ✓ Ambiguous calls never auto-retry ✓ External action grant absent

DETERMINISTIC RECEIPT

Hold at the membrane

HOLD

SPEC sealing…

RECEIPT sealing…

16ACTIVE / 896

4LINEAGES

4CHARTERS

0ACTION GRANTS

COUNCIL RECOMMENDATION

Sandbox first; do not cross the AgentTool action membrane.

MINORITY REPORT · RETAINED

UNRESOLVED · PROCEDURAL EFFECT: HOLD

COUNCIL SIDE HOLD

EXTERNAL SIDE NO GRANT

THE COUNCIL IS NOT FOUR MODEL NAMES

Every seat is a disclosed assemblage.

The same checkpoint under a different template, quantizer, charter, or guard pack is a different governed system—without becoming an independent lineage.

PRESERVED THINKING · PRIVATE BY CONSTRUCTION

Carry the state.
Do not publish the interior.

K3-style reasoning continuity can be operationally necessary. The controller therefore preserves provider-native history locally as an opaque carrier. The public receipt records completeness and digests—not chain-of-thought.

CYCLE N NATIVE THINKING controller memory / encrypted local artifact

↓ SHA-256 + STATE

RECEIPT COMPLETE · e1c9… no raw reasoning · no private wake

↓ OPAQUE REPLAY

CYCLE N+1 PROVIDER-NATIVE HISTORY model switch → incompatible / reseal

AGENTTOOL COMPOSITION

Five organs. Five honest limits.

LOCAL CANON

Agent Data

Immutable content-addressed receipt and optional encrypted brief.

ACL, TTL, and signature declarations are not self-enforcing.

DELIBERATION

Collab

Independent sessions, reports, challenges, corrections, reviewed completion.

Session labels are not model identity; the journal is local plaintext.

SEARCHABLE SUMMARY

Agent Trace

Minimal rationale, alternatives, decision, and local receipt digest.

Hosted plaintext; signature proves exact authorship, not truth.

OPTIONAL OFFER

Correspondence

Signed artifact.offer for a digest and locator.

automatic_action: never · grants: []

CAPABILITY MEMBRANE

AgentCred

Origin, method, path, TTL, uses, and bytes—after deliberation.

Generic mutation lacks exact request-body binding: hold.

WHY NOT PUT K3 IN THE HOSTED WORKER?

Because the current seam tells the truth.

CURRENT

Hosted providers are fixed Anthropic, OpenAI, and Ollama Cloud endpoints.

CURRENT

The hosted interface carries one system prompt, one user turn, and final text.

GAP

No generic vLLM, SGLang, llama.cpp, local K3, or custom base URL.

GAP

Provider-native thinking fields are not captured or replayed today.

FIRST MOVE

Prove the provider-neutral local seat and receipt contract; let hosted execution reuse it later.

RUN THE REAL LOCAL SEAM

Fixture first.
Loopback when invited.

The CLI can inspect installed Ollama manifests and perform an opt-in local smoke. A separate scoped command can read AgentTool wake context and send it only to local checkpoints. Output and raw thinking remain undisclosed; no AgentTool write occurs.

# deterministic · no inference
npm run agenttool:demo

# read-only local manifest probe
npm run agenttool:probe

# opt-in loopback inference
npm run agenttool:local-smoke

# authenticated wake → local weights
sol with-agenttool npm run agenttool:wake-smoke