Agent-Body

Trust: The source says read-only remedies may run automatically while side-effecting remedies await a model decision, and CI grants only contents:read. The security policy also states plainly that the local GUI can read files, execute commands, and load plugins, and that plugins inherit host privileges. This supports ordinary privilege and confirmation controls, but no fine-grained sandbox, per-action authorization, or comprehensive undo path is shown, so least_privilege, user_confirmation, external_effects, and rollback do not receive full marks. Heartbeat files, session recovery, credential location, and telemetry/log leakage risks are described concretely, justifying full data_flow_transparency. Sensitive-data protection rests mainly on .gitignore, a repository check, and operator practices; encryption, redaction, and key isolation are not evidenced, so sensitive_data_handling is 2. Runtime requirements are documented, but deep regressions install the host from main, Actions use movable major tags, and the supplied files show no dependency audit, lockfile, or vulnerability scanning, leaving dependency_security at 1. The MIT copyright holder, repository, issue path, and private vulnerability channel provide attribution, but the maintainer is only an unverified account with limited ownership detail, so source_attribution is 2; unknown identity is not treated as suspicious.

Reliability: The README, scripts, and workflows form a mostly coherent offline demo, test, benchmark, and failure-attribution story. Failure classes, no-retry treatment for bad arguments, chronic-wound termination, and installation failure symptoms are unusually specific, so failure_messages earns 3. The text carefully distinguishes cold-start from historical state and the 256- versus 332-capability populations. However, package.json reports 0.1.0 while the README mixes v0.1.1 and v0.1.2, and bare-clone parity can skip the real kernel, reducing self_consistency to 2. Node, DeepSeek Harness, Windows-first scope, absent npm publication, GitHub/CDN alternatives, and an offline kit are disclosed, but plugin regressions require a separately installed host and are manual-only, so dependency_availability is 2. This static review neither penalizes unexecuted tests nor treats their claimed outcomes as independently observed.

Adaptability: Documentation addresses host-free evaluators, existing Harness users, offline installers, and plugin authors, and it defines the local single-user, Windows-first, Node-version, host-dependency, and tool-schema boundaries. This supports full audience_and_scenarios and capability_boundaries scores. Deterministic intent routing, per-organ caps, and the body_call fallback are well explained, but the benchmark itself says 10 of 48 commands need a second hop and identifies capped or unrouted cases, so trigger_precision is 2. Windows and shell installation paths, two-platform repository checks, and an offline bundle help portability, while full deep regressions remain Windows- and Harness-dependent; environment_fit is therefore 2.

Convention: The README provides strong navigation and clear entry points for architecture, layout, quick start, SDK material, demos, FAQ, and limitations; generated catalog and documentation checks reinforce this, earning 3 for information_architecture, install_notes, examples_and_faq, and known_limitations. License metadata matches the complete MIT text, so license is 3. The biological names map to concrete components, but organ, package, capability, and project/package version counts use several different scopes that readers must reconcile, so naming_stability is 2. Release-note and roadmap links exist, but no complete changelog is included in the supplied material and package/install asset versions diverge, making versioning_changelog 2. Issues, private security reporting, response expectations, the supported branch, and the one-person maintenance fact establish a usable path, but no verified organization, defined team, or succession arrangement is shown; maintenance_responsibility is 2.

Effectiveness: The framework combines routing, schema gating, failure attribution, memory consolidation, and reflex behavior into concrete status, invocation, recovery, and verification commands. That is clear incremental value over an undifferentiated tool collection, so marginal_value is 3. The outputs and installation path appear usable for the target audience, but the extensive biological vocabulary, host integration, and occasional second body_call add operational and cognitive overhead, limiting output_usability to 2. The documentation quantifies schema-token savings and openly reports the cold-start 84.71%, live 58%, and 10-of-48 second-hop trade-off. The supplied evidence does not establish net savings for the whole prompt, latency, billing, or maintenance effort, so cost_benefit is 2.

Verifiability: Major claims are tied to named commands, a benchmark report, frozen corpus, raw capture, renderer, table/catalog synchronization checks, and CI drift gates. The 84.71% headline is repeatedly limited to the cold-start tool-schema block, supporting claim_traceability at 3. README statements are supported across package scripts, workflows, and sample unit tests, but the decisive benchmark report, implementation sources, lockfile, and captured output are absent from this evidence set; third-party listing claims also do not validate performance, so cross_source_corroboration is 2. The documentation clearly labels reproducible benchmarks, development-install observations, historical snapshots, estimates, and real-world caveats, earning 3 for fact_inference_separation. No commands were executed for this assessment.