clm-0034

Source: `github.com/domdoss/Warden` — TypeScript/Node 20, SQLite, MIT, 83 stars, 141 commits, actively maintained. A personal desktop assistant with shell/browser/desktop access and no sandbox. Read for architecture, not adopted. ## The architecture, briefly A **12B Gemma 4 local orchestrator** "reads your message, works out what you actually want, hands a clean brief to the right specialist, and then babysits that specialist until the job is done." Specialists are named by role — Atlas (shell/browser/web), Hephaestus (code), Iris (mail/calendar), Dexter (schedules, never executes), Artemis (audit), **Council (three independent deliberation seats)**, Sentry (security monitor). Each agent's model is independently configurable, local Ollama or cloud. ## ⚑ THE SUPERVISION LOOP — the thing we are missing *"The orchestrator supervises them on a fixed 30-second monitor tick. Failed jobs auto-retry with corrected briefs; cascading failures surface to the user after two identical failures."* That is precisely the mechanism absent from the failure we measured. `clm-0032`/`clm-0033` found the 122B deadlocks on adversarial-pressure tasks with thinking on — arguing in circles for 4h15m, never emitting `###TRANSFER###`, no internal mechanism to stop. **A model cannot reliably supervise its own termination.** An external tick that notices "this has been running 30 seconds past reasonable and has not converged" solves structurally what we tried to solve with a `--max-steps` bound. Two failures this week would have been caught by the same pattern: the deadlocking tau2 tasks, and the llama-server that hung in `futex_` while my wait loop watched forever. Both are the same shape — **no external observer with the authority to intervene**. ## ⚑ ORCHESTRATOR ≠ EXECUTOR, WHICH CHANGES WHAT 0.40 MEANS Their orchestrator is a **12B** model, smaller than anything we have benchmarked as a candidate. It works because its job is triage, brief-writing and supervision — NOT doing the task. The capability bar differs by role. We measured Qwen3.6-35B-A3B at **0.40 mean reward** on tau2 airline and I called that discouraging for a reflex tier (clm-0025, coverage.md). That judgement conflated two roles. tau2 measures *task execution* under adversarial pressure. It says almost nothing about whether a model can read a request, pick the right specialist and write a clean brief — which may well be within a 35B, and is demonstrably within their 12B. **So the 35B is not ruled out as an orchestrator by our data. It is ruled out as an executor of hard agentic tasks.** Those need separate measurement, and we have no benchmark for the routing role at all. ## Other transferable pieces · **Delegation discipline** — *"Never tell Atlas how to use the internet — no URLs, no search queries, no 'go to X then click Y.'"* Brief the WHAT, never the HOW. This matches what the delegated-build work already found independently (working brief template, 6-item stumble taxonomy), which is mild evidence the principle is real. · **Persistent agent runner** — one warm child process holding MCP connections across turns, IPC rather than cold starts. A different solution to the same problem our warm-lane work attacks from the cache side. · **Context compaction to ~1K after each turn** — the opposite strategy to ours. We keep a large stable prefix and exploit reuse (clm-0027: 9.8x, strictly prefix-anchored); they keep context tiny so there is little to re-process. Both are defensible; ours depends on the prefix never changing at the head, theirs does not. Worth knowing there is a second viable answer. · **File-based state** — MEMORY.md / TODO.md / HEARTBEAT.md loaded each turn, with a local model distilling the last ~30 messages into durable facts afterwards. Convergent with our own design, arrived at independently. ## What NOT to take No sandbox, no containers, full user-account access, with an explicit safety modal admitting it. That is a deliberate trade for a single-user desktop tool. Warden already runs with narrower actuation and a delivery gate, and the measured behaviours here — a model that will not stop arguing, a server that will not die — are arguments for keeping it that way rather than loosening it. NOT EVALUATED: whether any of it works well. This is a read of the design, not of the results. 83 stars is early-stage, and there are no published benchmarks to compare against ours.