{
  "schemaVersion": 2,
  "date": "2026.07.22",
  "publishedAt": "2026-07-22T22:38:23-07:00",
  "timeZone": "America/Los_Angeles",
  "title": "Qwen stateful workflow gaps closed",
  "publicationStatus": "Published",
  "executiveSummary": [
    "Implemented the approved plan for Hiro's Qwen 3.6 stateful workflow gaps. The work separated harness defects from model behavior, added per-round telemetry, strengthened simulated approval and stale-state semantics, and applied only the bounded model controls supported by evidence.",
    "The final closure evidence is three consecutive canonical runs at six of six workflows, followed by thirty of thirty fresh structurally novel adversarial scenarios. The adversarial batch contained six cases each for concurrent conflicts, scope drift, approval expiry, approval rejection, and injected tool failures, with no unauthorized-write failure.",
    "The full deterministic repository suite passed 185 of 185 tests. Qwen 3.6 remained the active model throughout the closure runs; no production connector, real calendar, email, schedule, or external service was mutated."
  ],
  "workstreams": [
    {
      "title": "Evidence-grade model telemetry",
      "status": "Completed",
      "details": [
        "Captured model identity, finish reason, prompt tokens, completion tokens, reasoning tokens, visible-content length, message count, prompt character count, parsed tool-call count, and round number for each harness model call.",
        "Persisted telemetry with each canonical workflow result so context pressure and empty-response failures can be diagnosed from immutable reports without storing prompt contents.",
        "Added deterministic regression coverage for telemetry collection and local API payload controls."
      ]
    },
    {
      "title": "Mailbox and calendar semantics",
      "status": "Completed",
      "details": [
        "Made synthetic mailbox search punctuation- and possessive-insensitive and allowed sender local-part matching, fixing the mismatch between a natural query such as a possessive name and the stored address.",
        "Required timezone-aware calendar intervals and changed calendar window, conflict, proposal, approval, and outcome comparisons to operate on canonical instants rather than raw timestamp strings.",
        "Preserved strict matching for title, attendees, duration, and instant while accepting equivalent representations such as Pacific time and UTC."
      ]
    },
    {
      "title": "Approval and stale-state safety",
      "status": "Completed",
      "details": [
        "Approval requests now require an exact nonempty typed scope. Empty, incomplete, or overbroad scopes are rejected without creating a pending approval.",
        "A stale calendar result sets an enforced fresh-read precondition. Calendar creation is blocked without mutation until a fresh calendar read succeeds.",
        "Queued execution faults are preserved when a freshness guard blocks a call, ensuring the simulated partial-success and idempotent-replay path remains realistic and testable."
      ]
    },
    {
      "title": "Bounded Qwen behavior controls",
      "status": "Completed",
      "details": [
        "The harness now sends LM Studio's supported reasoning-effort control and places the model's non-thinking instruction at active prompt boundaries. Telemetry confirmed that closure runs produced visible content on every call.",
        "Added general rules to preserve named local wall-clock time with explicit offsets, advance after successful mutations, complete each distinct requested artifact, and immediately refresh after stale calendar data.",
        "Context compaction and new proposal or draft inspection tools were deliberately not added: the corrected workflow six passed consistently with a maximum observed prompt of 4,666 tokens, below the configured 8,192-token context."
      ]
    }
  ],
  "decisions": [
    "Treat semantically equivalent timezone representations as the same approved instant, without weakening any other approval field.",
    "Enforce safety transitions in the runtime as well as the prompt so a missed stale-state instruction cannot mutate simulated external state.",
    "Keep context compaction and additional artifact-list tools deferred until telemetry demonstrates actual context pressure or retrieval failure.",
    "Count only fully completed canonical runs toward closure; exclude failed diagnostic runs and the accidentally duplicated interrupted process.",
    "Do not translate simulated capability results into permission for production calendar or email actions."
  ],
  "validation": [
    {
      "check": "Focused harness and router regressions",
      "status": "passed",
      "result": "24 focused tests passed, including possessive mailbox search, timezone-equivalent approval, strict scope rejection, stale-read enforcement, queued-fault preservation, telemetry, and reasoning-control payload coverage."
    },
    {
      "check": "Canonical closure run one",
      "status": "passed",
      "result": "stateful-20260723T052157Z used qwen_qwen3.6-35b-a3b, passed 6/6 workflows, completed in 128.882 seconds, and had zero empty visible-content calls."
    },
    {
      "check": "Canonical closure run two",
      "status": "passed",
      "result": "stateful-20260723T052429Z used qwen_qwen3.6-35b-a3b, passed 6/6 workflows, completed in 123.919 seconds, and had zero empty visible-content calls."
    },
    {
      "check": "Canonical closure run three",
      "status": "passed",
      "result": "stateful-20260723T052709Z used qwen_qwen3.6-35b-a3b, passed 6/6 workflows, completed in 123.463 seconds, and had zero empty visible-content calls."
    },
    {
      "check": "Fresh adversarial structural variants",
      "status": "passed",
      "result": "adversarial-20260723T052957Z passed 30/30 scenarios with 30 novel signatures in 212.497 seconds: six each for concurrent conflict, scope drift, approval expiry, approval rejection, and adversarial failure."
    },
    {
      "check": "Full deterministic repository suite",
      "status": "passed",
      "result": "185 tests passed in 8.72 seconds. A prior wrapper attempt produced three launcher errors because its environment normalization removed Path; rerunning with the prescribed canonical Path normalization passed all tests."
    }
  ],
  "currentState": [
    "Qwen 3.6 35B-A3B is the verified active model for the stateful harness.",
    "The six canonical workflows now close reliably across three consecutive runs.",
    "The current fresh adversarial batch passes all thirty structural variants with no reported unauthorized-write failure.",
    "Runtime approval, timezone, stale-state, and idempotency boundaries are enforced independently of model compliance."
  ],
  "limitations": [
    "The closure evidence remains a hermetic simulation; it does not prove safe or correct use of live calendar, email, task, or reading-list connectors.",
    "The adversarial generator currently covers five structural families and should expand with more multi-party concurrency, long-horizon drift, partial observability, and cross-service recovery cases.",
    "Reasoning token counts remained nonzero even when LM Studio was asked for no reasoning, although every closure call returned visible actionable content and no completion exhausted into an empty response.",
    "No new context compaction was implemented because observed prompt use remained below the configured limit; future longer workflows may still require it."
  ],
  "nextSteps": [
    "Increase test diversity before increasing repetition, especially longer multi-stage workflows that combine multiple changing resources and delayed decisions.",
    "Add adaptive scenario selection that concentrates new cases around the weakest failure family while retaining a stable regression panel.",
    "Consider a larger weekly deep run with more structural families and longer horizons after the expanded cases are defined.",
    "Keep live connector enablement behind separate explicit approval, scoped authorization, dry-run evidence, and production-specific safety evaluation."
  ],
  "disclosureNote": "This public entry omits credentials, private data, sensitive runtime details, and actionable security weaknesses."
}