\section{Kungfu Instantiation and Prototype}
\label{sec:design}

The preceding model does not require one physical ledger, causal-object type,
or runtime topology. This section maps it to Kungfu, infrastructure for managing
real-world work with agents. Kungfu realizes accepted causal units as
\emph{Episodes} and supplies single-host authority, projection-readiness, and
continuity mechanisms around them. Episodes are an implementation substrate in
this paper, not a logical prerequisite for observer declaration. Their broader
role as a candidate primitive belongs to companion work. The current Kungfu
path does not yet implement the complete multi-machine observer projection.

\subsection{Runtime fact ledger}

The runtime fact ledger preserves source-local facts, provenance, causal links,
payload evidence, schema bindings, and verification results. Future sync views
also need accepted source ranges and freshness boundaries. The visible timeline
is a projection over the ledger, not the ledger itself.

This distinction matters. If storage flattens remote facts into anonymous local
records, the product loses the ability to explain what was accepted and why. If
the GUI presents a global-looking order without observer metadata, the user or
agent cannot reproduce the view during recovery. Runtime recovery must likewise
rejoin authority at an accepted cut rather than infer continuity from a live
process.

\subsection{Implemented Episode authority}

An Episode is a bounded causal segment with independent identity, manifest,
frame references, content commitments, provenance, schemas, dependencies, and
verification evidence. It gives Kungfu a unit that one observer view can
accept, move, inspect, or reject without treating a physical journal page or
product session as the universal causal boundary. The prototype separates four
authority layers
\cite{kungfu2026episode}:

\begin{enumerate}[leftmargin=*]
  \item An append-only yijinjing manifest journal stores fixed-layout Episode
        lifecycle, frame, reference, and dependency records as authority.
  \item One typed C++ fold derives the canonical current Episode view. Python,
        Node, CLI, and GUI edges do not define independent Episode semantics.
  \item Content-addressed immutable storage resolves payload and schema
        references, with hashes and lengths verified before use.
  \item Structural fsck checks manifest integrity, causal closure, dependencies,
        content evidence, lifecycle state, and safe capabilities. Recovery and
        repair append evidence instead of silently rewriting verified history.
\end{enumerate}

The current Episode query path folds the manifest directly. Kungfu also has
rebuildable SQLite projections for other query surfaces, but the source-registry
projection must not be reported as an Episode projection. A dedicated Episode
projection and its drift/rebuild qualification remain pending. This correction
is important: authority/projection separation is a design invariant, not
evidence that every planned derived store already exists.

\subsection{Exact-cut runtime readiness}

Kungfu's runtime activation contract distinguishes process placement from
semantic readiness \cite{kungfu2026activation}. A runtime handle binds a
workspace, runtime identity, generation, capabilities, and readiness evidence.
A live projection capability is Ready only after a verified durable cut exists
and the projection has reached an explicit projection cut. PID liveness,
sockets, heartbeats, service installation, and GUI presence remain diagnostics;
none establishes the cut.

Recovery creates a new authority-bearing generation. Handles, leases, and
receipts from an older generation fail as stale rather than being rebound to a
reused PID or route. This supplies concrete counterparts for $e$, $c_a$, and
$c_p$ in the observer-incarnation model without making activation a second fact
authority.

\subsection{Fenced continuity across coordinator restart}

Live Peer continuity uses a two-dimensional fence

\[
(\mathit{runtime\_generation}, \mathit{coordinator\_epoch})
\]

and one shared registration schema \cite{kungfu2026peercontinuity}. The runtime
generation advances when the admitted runtime changes; the coordinator epoch
advances for every coordinator process within a generation. Peers report the
last authority they admitted. Both sides reject regressing or non-advancing
authority instead of treating PID, wall clock, or journal presence as proof.

After coordinator loss, a Peer reconnects through bounded retries, clears
candidate projection state, and rejoins the replacement command journal at the
accepted registration cut. Only the corresponding new start request may move
it from Recovering to Ready. Delayed frames from the predecessor cannot satisfy
the new bootstrap. This is a concrete continuity witness for one single-host
runtime boundary: it proves a fenced transition, not an immortal process.

\subsection{Session and presentation continuity}

Kungfu's Agent Session Capsule further separates stable work identity, one
physical provider attempt, control authority, and presentation attachments
\cite{kungfu2026agentsession}. Coordinator and session-stream epochs are
independent. A GUI restart may reattach to a surviving stream, while a Capsule
failure ends the old physical attempt unless provider-supported semantic resume
creates a new one. Product surfaces expose states such as \texttt{recovering},
\texttt{action-required}, and \texttt{ended}; a lost worker is not rendered as
an empty successful session.

This demonstrates why presentation continuity must remain separate from fact
and observer continuity. A terminal snapshot can restore usability, but it does
not establish work completion, evidence quality, or causal truth.

\subsection{Versioned upgrades}

The staged upgrade control plane installs immutable runtime images before Core
selects them \cite{kungfu2026upgrade}. Each workspace generation pins a runtime
build, artifact root, entrypoint, manifest digest, and protocol/schema contract.
Compatibility produces an explicit plan: apply now, defer until idle, require
semantic resume, or block an incompatible transition. Downloading bytes does
not grant live authority.

Readiness commits a generation switch. Rollback changes routing but does not
rewrite Episode, journal, work, or provider-session facts. This supports policy
and implementation identity in the observer model: fact-authority continuity
may survive an upgrade while observer semantics change visibly. The contract
and synthetic fixtures are implemented, but signed platform delivery and a
native upgrade fault campaign remain separate stages.

\subsection{KFD-4 implementation map}

Table~\ref{tab:kfd4-map} distinguishes the generic KFD-4 obligation, its current
Kungfu realization, and the remaining observer-view work. Observer incarnation
and continuity are refinements of the current KFD-4 interpretation, not claims
that its published schema already requires these exact fields.

\begin{table}[ht]
\centering
\small
\begin{tabular}{>{\raggedright\arraybackslash}p{0.21\linewidth}>{\raggedright\arraybackslash}p{0.36\linewidth}>{\raggedright\arraybackslash}p{0.34\linewidth}}
\toprule
Surface & Current Kungfu evidence & Remaining view work \\
\midrule
Logical observer & Source, writer, workspace, runtime, and work-console identity & First-class observer and stable view identifier \\
Incarnation & Runtime generation, coordinator epoch, process-start identity, session-stream epoch & Exported observer-incarnation declaration \\
Accepted facts & Episode manifests, refs, dependencies, durable cut, and projection cut & Multi-source accepted ranges, watermarks, and freshness \\
Projection policy & Deterministic typed fold plus pinned runtime/protocol/schema identity & Versioned cross-source ordering policy, tie-breaker, and Episode projection \\
Causal constraints & In-Episode closure and declared Episode dependencies & Projection-level enforcement over a selected multi-source set \\
Continuity & Stale-authority rejection, accepted-cut rejoin, projection rebootstrap, and recovery states & Cross-host continuity witness and deterministic reproduction \\
Degradation & Structured fsck issues and explicit recovering/action-required states & View-level degradation for incomplete ranges and unknown policy \\
Verification & Episode oracle, fsck, retained runtime report, Peer campaign, and release gates & Exported declaration and projection-level causal fsck \\
\bottomrule
\end{tabular}
\caption{Current Kungfu evidence mapped to the observer-declared timeline contract.}
\label{tab:kfd4-map}
\end{table}

\subsection{Dual-first interfaces and remote work}

The same timeline contract should be usable by humans and agents. A GUI can
show the default observer view while exposing metadata on demand. A CLI or API
can return the same cuts, policy, continuity, and degradation state directly.
Agent-facing surfaces are not secondary integrations; they are first-class
control surfaces for participants that may inspect the system more frequently
than humans.

Real-world agent work often happens on remote machines. A server-side agent may
write facts into a remote Kungfu home while the local GUI remains the user's
primary control plane. Importing or syncing those facts must not imply that the
local observer saw them live. The resulting view needs source location,
accepted range, freshness, policy, and continuity evidence. Generic range- and
Episode-based source sync is not yet complete, so this remains an end-to-end
research boundary.

\subsection{Verification gates}

KFD-4 can be used as a release or product gate for perspective-bearing
surfaces. Passing the gate should mean that the surface exposes the observer,
accepted facts, projection policy, causal constraints, continuity status, and
degraded evidence metadata. It should not mean that every adapter, remote
source, or runtime payload is complete. Stronger claims require their own
KFD-2-style trust assessment.

Kungfu's Episode, runtime-activation, and Peer-continuity qualifiers demonstrate
that evidence discipline. Each binds a claim to source revision, platform,
profile, raw evidence, and non-claims. None automatically certifies every
timeline surface.
