Intrikata Stack

1. Abstract

Agentic coding sessions start cold: hundreds of skills and agents, multi-project memory, optional MCP backends, and no deterministic opening move. The intrikata stack is a pair of portable skills — megapraxis (session bootstrap) and metamegapraxis (meta-auditor of that bootstrap) — that make cold start operationally honest and then audit the auditor.

This white paper specifies the current technical system from the live megapraxis catalog: 53 traps. Package 1.6.9 still ships the older 35-trap skill text; that lag is named below and is not used as the section 7 inventory. The paper covers boot modes, disk-verifiable probes, verdict vocabulary, SwarmInvocation dialect, semantics-aware bridge short-circuits, multi-harness install paths, direct Cloudflare Pages docs delivery with a standby edge Worker, D1 live state, Intrikata Topology, and the optional per-user console operant. Every “complete” claim is bounded by explicitly named Tarski residuals; what cannot be decided is never silently absorbed into success.

*Snapshot #8 (2026-08-06) rolled 35 traps (19+1+4+0+9+2). The live catalog is 53; traps 36–53 are in megapraxis references/traps.md and in §7 below. Snapshot #7 remains historical. Package 1.6.9 still contains the 35-trap skill text — that is package-lag, not the catalog. Live re-check: /api/snapshots/latest.

2. Problem statement

2.1 Cold start entropy

Modern agent harnesses (Claude Code, Codex CLI, Grok Build, Cursor, Gemini CLI) load large inventories: skills, plugins, MCP servers, agents, hooks, and project memories. Without a disciplined bootstrap:

• the agent re-derives machine state from partial listings and invents counts;
• silently broken (“dark”) plugins remain advertised as available;
• HTTP health checks pass while stdio MCP children are dead;
• docs claim routes and registrations that code never shipped;
• audits declare “all closed” while undecidable gaps are folded into green.

2.2 The meta problem

A bootstrap skill that itself drifts becomes a liability: it briefs confidently on stale or wrong state. Therefore the stack includes a second skill whose sole job is to audit the first — traps, bridges, coverage deltas, and multi-lens swarms — without mutating disk unless the operator issues an explicit apply.

2.3 Multi-harness reality

Not every session has the Intrikata Topology MCP or a local Intrikata Topology server. Filesystem-fallback is a designed first-class path (Tier 0). Graph-backed features are optional. Onboarding short-circuits must not force a ~150K-token self-audit swarm onto every new project.

3. Thesis and design principles

3.1 Invariants (load-bearing)

1. Truth-on-disk. Unverified claims are dropped, never emitted. Missing counts render as count-skipped, never as guesses.
2. Content anchors, not line pins. Evidence cites symbol names or grep-stable phrases; line numbers drift with edits.
3. Trap roll-call is contract. Each of 53 catalog traps yields CLOSED / OPEN / DOC-ONLY / N/A / UNKNOWN / META (or OPEN-benign / N/A-filtered) with a probe.
4. Tarski honesty. Residuals are classified (decidable / semi-decidable / undecidable) and listed; never silently defaulted.
5. Read-only meta-audit by default. metamegapraxis proposes patches as artifacts; apply is a separate explicit mode.
6. No recursive meta. metamegapraxis never invokes itself; depth-bounded swarms carry caller provenance.
7. Harness truth beats settings belief. Runtime resolution wins over “I enabled it” (trap #3 / #21).
8. Short-circuit ≠ skip residual. Byte-identical re-audits may reuse a prior verdict for ~20 tokens; genuine novelty still pays full price.

4. System architecture

4.1 Production ingress and ownership

The *.pages.dev names are deployment aliases, not product names. Public documentation uses Intrikata Stack and Intrikata Topology. Code identifiers retained for compatibility—such as praxis-local-realize and the praxis Codex plugin package id—are labeled as identifiers rather than brands.

4.2 Components

5. megapraxis — session bootstrap

megapraxis runs at session start (or on demand). It detects mode from cwd shape and history, inventories skills/agents/MCP, flags dark plugins, reads project memory and git state, and emits a short dashboard briefing.

5.1 Boot modes

5.2 Backend tiers

• Tier 0 — filesystem-fallback. Skills and local files only. Valid briefing; footer _via: filesystem_.
• Tier 1 — Intrikata Topology HTTP. Optional local server for coverage grids and graph reads.
• Tier 2 — intrikata-topology MCP. Full ops, swarm dispatch, ASEC persistence.

Missing MCP is not a failed install. On pure Grok orientation, traps #4/#5 are N/A unless graph features are in scope.

5.3 Briefing contract

The briefing is a contract, not a narrative. Counts come from enumeration or are marked skipped. Dark-plugin alerts name the directory and reason. Completeness verdicts use the shared vocabulary (§8). No machine-identifying detail is required for a correct brief.

6. metamegapraxis — meta-auditor

Where megapraxis briefs the session, metamegapraxis briefs megapraxis: traps, bridge integrity, coverage deltas, proposed patches, and optional multi-lens swarm dispatch.

6.1 Modes

Selectors are compositional in 1.6.9: one optional focus plus any phase flags run in the canonical order audit → diff → swarm → propose → apply. apply all authorizes selected disk mutations but never implies the separate dispatch authorization.

6.2 Performance budget

Hard ceiling ≈ 12 tool calls for audit mode (soft target 10). When a same-session megapraxis boot exists, coverage MCP gathers are reused (0 of 5 spent). Bridge consultation can short-circuit repeat audits against byte-identical surfaces.

7. The 53 operational traps

Silent-failure classes learned in production. Each has a signal (disk/runtime signature) and a fix. Live roll-call: Live State tab / API.

Status vocabulary for roll-call: CLOSED, OPEN, UNKNOWN, DOC-ONLY, N/A, META, plus OPEN-benign / N/A-filtered where the probe class applies. The tallies must sum to 53 for a current full catalog audit; older baselines (26, 34, 35) publish their smaller inventory and delta explicitly. Traps 29–32 are the route/auth/CSP family; 34–39 the deploy-safety cluster; 40/42/47/48/50 the concurrency cluster; 43/45/51 the secret-handling cluster; 52–53 the ASEC-dispatch cluster.

8. Verdicts and Tarski honesty

8.1 Verdict vocabulary

Audit cycles terminate with an explicit verdict from a closed set:

• converged — decidable surface closed under stated probes
• converged-modulo-restart — closed after harness process restart
• converged-modulo-harness — closed for a given harness (e.g. Grok Tier 0)
• extend — decidable work remains; epistemic state improved
• extend-stable — extend queue saturated; no further cheap gains
• degrade — previously closed items re-opened or regressed
• cycle-complete-extend-deferred — cycle finished; residual work deferred with names
• INCOMPLETE (with reason) — stop condition with explicit cause
• budget_exhausted — wall/token/agent budget hit before verdict quality

8.2 Canonical undecidables (must appear every audit)

1. unknown-unknowns — no probe can detect; flag for next swarm
2. true-lens-independence — report observed model/runtime families; shared-family lenses are only partially independent
3. fixed-point-vs-plateau — current cycle may be plateau; subset-check required
4. state-validity-horizon — graph cache TTL not absolute
5. converged-vs-correct — tests-satisfied ≠ system-correct

8.3 Observation-class buckets

When a finding instantiates one of: values-question, oracle-required, telemetry-required, intent-vs-drift — it is listed under undecidable observation-class, not folded into decidable.

9. SwarmInvocation and MetaMethodology

9.1 When a swarm is mandatory

Self-audit of the auditor is the canonical multi-lens case: a single Claude-family context cannot claim lens-independence. metamegapraxis composes the seed swarm megapraxis-self-audit and requires an explicit operator dispatch before fire (~150K tokens class cost).

9.2 Seed composition

Rule: pipeline. Each member sees prior steps’ findings. Contributions persist as graph nodes with contributed_to edges; coordinator finalizes the SwarmInvocation in place.

9.3 Name-encoding dialect

SwarmInvocation rows use a schema-free, colon-delimited name encoding (ASEC dialect), also used for onboarding certificates:

SwarmInvocation::inv-mmgp-YYYYMMDD-<seq>-<slug>
  ::source=metamegapraxis
  ::class=surface-audit|onboarding-short-circuit|self-audit
  ::verdict=converged|extend|…
  ::harness=grok-build|codex|claude-code
  ::package=1.6.9
  ::production_branch=master
  ::notes=…

Machine-readable short-circuit certificates live at /demo/grok-onboard.json and /demo/codex-onboard.json. Surface-audit cert: /demo/surface-audit.json.

9.4 CTL endofunctor (operational)

MetaMethodology cycles follow: audit → classify → bridge → apply → verify → converge. Named residuals from cycle N become audit inputs for cycle N+1. Decidable items get concrete remediations; semi-decidable items queue policy refinement; undecidable items stay named.

10. Bridge flywheel

Recurring reasoning compiles into bridges: memoized transfer rules consulted before new work. Classes include short-circuit, pre-populate, delta-scope, routing, template.

10.1 Fixed-point short-circuit

The historical 1.6.0 saturation certificate fingerprints first-party audit files plus canonical live skill membership, enabled state, layer assignment, orphan state, and completeness. An unavailable semantic fingerprint disables the shortcut. For target d7d96f62…d887, a fresh five-role verification finalized converged; the next identical phase=start returned bridge::fixed-point-short-circuit (autonomous), referenced the prior verdict, and wrote no new SwarmInvocation. Package 1.6.1 preserves that mechanism but changes the audited surface, so the old hash remains historical evidence rather than a current fixed-point claim. See the convergence certificate.

10.2 Manifest integrity

BridgeCompilationManifest.bridge_ids[] must resolve to live Bridge nodes. Drift classes:

• A named-but-unresolved placeholder
• B dangling reference
• C mis-categorized kind
• D retired-but-listed-active
• E active bridge missing from manifest
• F stale total count

Snapshot #8: 15/15 resolved-active, 0 drift. Five of those fifteen remain class-unclassified in the exporter display, which is a classification residual rather than referential drift. Snapshot #7 (13/13) is historical.

11. M/G/S/MGS layer model

Skills and agents are classified into four layers used for coverage grids:

Completeness requires zero tarski-unclassified inventory items under the active classifier, plus an explicit residual section. Snapshot #8 reports completeness=converged with tarski_unclassified=0 for both skills (304 enabled / 32 dark) and agents (26 enabled / 19 dark) on the origin machine. This is a statement about that persisted snapshot, not a universal or indefinitely fresh guarantee.

12. Site and API materialization

12.1 Purpose

docs.intrikata.com materializes the stack as a public Cloudflare Pages project: static explainer + operational Live State + distributable package + proven-cycle receipts. Core content and controls remain first-party; Google Fonts and Cloudflare Insights are optional presentation/telemetry resources whose client-side blocking does not impair the application.

12.2 Layout

intrikata-stack/
├── public/                 # deployed artifact root
│   ├── index.html          # System / Live State / Proven Cycle
│   ├── whitepaper.html     # this document
│   ├── install.md, onboard-*.md, harness.md, backend.md
│   ├── adapters/           # AGENTS.md, CODEX, GROK, GEMINI, Cursor
│   ├── demo/               # cycle.json, onboard certs, surface-audit
│   ├── pkg/                # intrikata-stack-skills.zip
│   ├── git/intrikata-stack.git  # dumb-HTTP clone / marketplace
│   └── llms.txt            # agent discovery
├── functions/api/snapshots/  # D1-backed list/get/post
├── edge-proxy/              # standby intrikata-docs-edge + trap 29/30 probes
├── export_state.py         # Intrikata Topology → scrub → POST
├── build_package.py        # zip + bare git from live skills
├── schema.sql · wrangler.toml · validate.py
└── README.md

12.3 Snapshots API

Contract: API routes always answer as APIs (JSON + correct Content-Type), never HTML SPA fallback.

12.4 Canonical-host edge contract

docs.intrikata.com serves intrikata-stack.pages.dev directly through its Pages custom domain, matching the direct-Pages topology surface. The former docs.intrikata.com/* route to intrikata-docs-edge was removed after repeated browser-only 403s survived upstream normalization and edge-policy changes. The Worker remains deployable at workers.dev as a reversible Trap 29 standby, but production acceptance requires no x-intrikata-docs-edge marker.

The zone Browser Integrity Check baseline is off and the obsolete hostname-specific BIC configuration rules are disabled. One first-order custom rule covers exactly docs.intrikata.com and topology.intrikata.com, skipping Browser Integrity Check and Cloudflare’s automated Security Level for those public static hosts; intrikata.com remains outside that bypass. Bot Fight Mode is off, and a cookie or generic 403 is never treated as causal evidence by itself.

12.5 Production branch trap

npx wrangler pages deploy public --project-name=intrikata-stack --branch=master

13. Distribution package and harness adapters

13.1 Package contents (v1.7.1)

• Portability-scrubbed megapraxis, metamegapraxis, praxis-local-realize, and megametapraxis skill trees
• Claude + Codex plugin manifests for marketplace install
• install.py with harness targets
• Onboarding playbooks: Claude/Codex/Grok
• Adapters under adapters/ for AGENTS.md family, Cursor rules, Gemini, Grok
• Readiness-honest singularity R&D guide plus matching specs/rdgap-v2.1.json contract
• Checksummed MANIFEST.json

13.2 Local realize (self-realizing, cross-agent, cross-OS)

Package 1.6.8 ships skill praxis-local-realize and scripts realize.py / backend_stub.py that materialize this white paper’s local architecture on Windows, macOS, and Linux for Claude Code, Codex, and Grok skill roots. Tier 0 (skills only) is a complete valid deployment; Tier 1 adds the HTTP stub from §12/BACKEND; Tier 2 full MCP graph remains optional and is never silently claimed by a Tier 0/1 success. --verify-only builds its evidence in memory and writes no certificate.

• Playbook: /onboard-local.md
• Direct scripts: /scripts/realize.py · /scripts/backend_stub.py
• Cert: /demo/local-realize.json

13.3 Optional assistant runtimes

A full backend may expose ClaudeCode, CodexCode, and GrokBuild behind one OP_CONTEXT contract. CodexCode invokes codex exec using the Codex installation's subscription authentication. If the Codex CLI is unavailable at launch, it may fall back to the official OpenAI CLI Responses API using CODEXCODE_OPENAI_API_KEY only in that child process. Missing fallback credentials point to the official API-key page; they do not replace desktop authentication, and no key is packaged or published.

13.4 Install short-circuits

Playbooks: onboard-codex.md · onboard-grok.md · install.md · harness.md.

14. Intrikata Console and per-user operant

After skills install, operators who want graph isolation without running a local Intrikata Topology server can use Intrikata Console (first-run tutorial). The gold coach is five steps. The cascade is: skills → identity + profile + org → graph bootstrap → optional local bridge → application artifact → recovery factors. The first satisfied domain stops rediscovery of that domain.

1. instance new <handle>
2. profile set Your Name then org new <name> (gold coach 2/5 and 3/5)
3. bootstrap (optional Cloudflare operant)
4. reconcile when template drift is reported
5. operant — reads the seven per-instance machinery graphs in D1; provision downloads JSON for Topology import

The current public bootstrap certificate records 7 machinery graphs, 881 seed nodes, 2 preserved runtime nodes, template fingerprint 432f3a2c5c16, and stripped run history for the production default instance. These are certificate-scoped operational facts, not universal constants. Certificates: operant-bootstrap.json · instance-onboard.json.

This operant is not required for a valid megapraxis briefing. The console’s contact verification, recovery key, optional device certificate, local-bridge session, and application export surfaces are separate capabilities; their presence does not promote a Tier 0 filesystem install to full Tier 2 graph parity.

15. The unconverged perpetual residual operant system

Sections 5–14 describe the parts. This section states what the whole is: megapraxis, metamegapraxis, MetaMethodology, SwarmInvocation, and the intrikata instance layer compose into a single unconverged perpetual residual operant system — a loop whose product is the wisdom of what to do next over a maximally optimal time horizon, generated by the system reflecting on its own M/G/S/MGS layers inside each instance.

15.1 Unconverged by construction

Every convergence verdict in the stack is scoped: converged is always per-cycle, per-surface, per-probe-set. Global, final convergence is not merely unachieved — it is excluded by the verdict grammar itself. The five canonical undecidables (§8.2) must appear in every audit, so the residual catalog is never empty. A system whose residual set could reach zero would have a terminal state; this one cannot, and that is load-bearing:

15.2 The operant loop, formally

“Operant” is meant in the behavioral sense: the system emits behavior, consequences select future behavior, and the selection history is persisted. The mapping is exact, not decorative:

One full revolution: state → briefing → next-move → action → verdict → score/bridge update → new state. megapraxis reads the world; metamegapraxis reads megapraxis; the MetaMethodology CTL cycle (audit → classify → bridge → apply → verify → converge) turns findings into applied diffs; SwarmInvocation records what happened; the next boot sees a changed system.

15.3 Wisdom over a maximally optimal time horizon

“What to do next” is computed against four horizons simultaneously, not greedily against the current turn:

• Turn horizon — the briefing’s single next-move line, feedback-rule-checked so it never re-proposes a corrected mistake.
• Session horizon — tier-A skill ranking, pending threads, open methodology cycles offered for resume or abandonment.
• Cross-session horizon — graph-persisted verdicts, memory, and coverage deltas: cycle N+1 starts where N actually ended, not where it was believed to end.
• Asymptotic horizon — the bridge flywheel drives the marginal cost of recurring decisions toward zero, so attention concentrates permanently on the novel residual. The optimum is not “answer fastest now” but “spend this cycle so future cycles are cheaper.”

The recommendation surface therefore behaves like a policy improving over its own history: short-circuits make known territory nearly free, full-cost swarms are reserved for genuine novelty (§10.1), and ritual invocation — paying swarm cost on known ground — is an explicitly named anti-pattern.

15.4 Self M/G/S/MGS reflection in the instance

The reflection is not metaphorical: the system’s self-description is literally the data each instance carries. An Intrikata bootstrap seeds the seven machinery graphs — among them the M/G/S/MGS Fusion Complex (which classifies the stack’s own skills, megapraxis included), the Agent Swarm Extension Complex (which contains megapraxis-self-audit, the swarm that audits the auditor), and the Caramello Bridge Complex (the compiled habits). The classifier that files megapraxis under META is itself a node reachable from the instance that runs megapraxis: the loop closes inside the instance, per user, in isolation.

Certificate evidence (2026-07-19): the production default was reconciled to graphs=7, seed_nodes=881, plus two preserved runtime nodes. New instances deliberately start without inherited convergence-run history. Contact verification and recovery remain access-plane concerns; they do not change the graph-completeness claim.

15.5 Why perpetual operation does not decay into waste

A loop that never terminates invites two failure modes: burning full cost on unchanged state, and declaring false fixed points to stop early. The stack closes both: byte-identical audit surfaces re-emit the prior saturating verdict for ~20 tokens (no waste), while the fixed-point-vs-plateau residual is named undecidable in every audit (no false stop). The system idles nearly free and pays exactly when reality changes — which is the only economically stable configuration for a process designed to run forever.

16. Proven cycle (receipts)

On 2026-07-17 the stack ran a full loop against itself and published receipts at /demo/cycle.json (Proven Cycle tab on the home page). Abbreviated stages:

Evidence tiers: live re-checked by the browser; graph scrubbed at build; origin attested at build, not client-checkable. The CRITICAL finding (arg unwrap landed in a zero-caller dead method) was discovered because dispatch tooling failed during the cycle — the trail includes the machinery’s own failure.

17. Named residuals catalog

Non-exhaustive but explicit for this paper’s scope:

18. Threat model and scrub contract

18.1 What is published

Public snapshots intentionally exclude: absolute filesystem paths, usernames, full UUIDs, project slugs, and free-text that fails the redaction pass. Trap names, bridge names, verdicts, and counts are generic system vocabulary and publish as-is.

18.2 What the site is not

• Not a remote code execution surface for skills (static + token-gated ingest)
• Not the Intrikata Topology application (that is the sibling topology surface)
• Not a claim that the minimal per-user operant equals full local/MCP graph parity
• Not a substitute for harness security boundaries

18.3 Security and credential boundaries

Pages _headers enforce a restrictive CSP: first-party scripts plus the hash-pinned inline bootstrap and optional Cloudflare Insights; inline script attributes are disabled; Google Fonts and the Insights connection are explicitly scoped. The remaining posture includes X-Frame-Options: DENY, nosniff, strict referrer policy, and a locked-down Permissions-Policy. A client extension may block the Insights beacon with ERR_BLOCKED_BY_CLIENT; that is non-functional telemetry loss, not an application failure.

The docs Worker removes browser cookies, Access assertions, and client-address headers from the upstream Pages request, while allowing explicit bearer authorization only on snapshot-ingest paths. Authentication and recovery tokens are returned only through declared Intrikata hosts. Static artifacts contain no API keys, OTP secrets, or user contact data.

19. Operations runbook

19.1 Publish a new snapshot

# Windows launcher or a known venv — never an unverified Store alias (trap #6)
py export_state.py --selftest
py export_state.py --dry-run
py export_state.py

19.2 Rebuild package after skill edits

py build_package.py        # regenerates zip + dumb-HTTP git + public mirrors
py build_demo.py           # refreshes scrubbed demo artifacts
py validate.py             # pre-deploy checks

19.3 Deploy production

npx wrangler pages deploy public --project-name=intrikata-stack --branch=master
# Optional standby refresh; wrangler.toml intentionally defines no production route
cd edge-proxy
npx wrangler deploy

Pages deployment is the production docs state transition. A standby Worker deployment does not update the static package and must not recreate docs.intrikata.com/*; attaching that route is an explicit rollback that reopens Trap 30 acceptance.

19.4 Verify the custom-host boundary

cd edge-proxy
node --test test.mjs
node probe-trap29.mjs
node probe-trap30.mjs browser-evidence.json

For a reported browser-only failure, verify the original profile first, then correlate its exact CF-Ray in Security Events. Production docs are direct Pages, so an x-intrikata-docs-edge marker indicates route drift or an explicit rollback. Cloudflare Trace is configuration evidence, not a substitute for the failed request identity.

19.5 Local dev

npx wrangler pages dev public --port 8788 --d1=DB=intrikata_stack

19.6 Session operator loop

1. /megapraxis — orient
2. /metamegapraxis — audit
3. propose → review → apply for decidable items
4. swarm + explicit dispatch when multi-lens required
5. export snapshot + deploy when public surfaces change

20. References and live surfaces

DocumentRevision::doc-intrikata-20260813-whitepaper-v1-6-1
  ::source=grok-build+megapraxis-traps-md
  ::class=technical-whitepaper
  ::verdict=verified-local
  ::whitepaper=1.6.1
  ::adds=section-7-53-trap-catalog
  ::historical_swarm=inv-mmgp-20260718-whitepaper
  ::surface=https://docs.intrikata.com/whitepaper
  ::package=1.6.9
  ::snapshot=8
  ::snapshot_inventory=35
  ::source_inventory=53
  ::production_branch=master