MAKI: Durable Task Control for CLI-Based AI Agent Kernels

Abstract

Command-line agent kernels face a durability problem that is easy to miss in single-process demonstrations. Each invocation begins in a new process, while the safety decision that governs execution may have been made by an earlier process. A halt, approval, lease, receipt, or audit commitment held only in memory therefore cannot serve as a reliable control boundary. This paper presents the implementation-level elaboration of the MAKI kernel control plane from a fixed, programmable-logic-controller-inspired kernel sequence into a durable task lifecycle for CLI-based AI agents. The control plane accepts an authenticated task envelope, deduplicates by principal and request identifier, evaluates a persistent halt latch and a tri-state permission gate, binds human approval to the exact request, issues a time-bounded exclusive lease, records executor selection, stores a receipt, optionally attaches one verification result, and reconstructs state only after integrity checks of the event chain, head, commit history, mirror, and external anchor. The work is continuous with five prior MAKI papers and one experimental dataset published before Japanese Patent Application No. 2026-095223. The earlier disclosures established the fixed pre-dispatch order, persistent halt state, role-based permission outcomes, audit recording, scheduler gating, and explicit execution confirmation. Later cross-platform Process of Record consolidation and MCP/CLI integration provided the setting in which implementation-level contracts for those process boundaries were made explicit and tested. The present work records that concrete realization; it does not treat MCP as an enforcement authority. The Phase 2 implementation was evaluated in an isolated root using operationally separate implementation and audit lanes. The 14-file candidate examined in that process comprised six new and eight modified files. Phase 1 passed 56 of 56 tests; Phase 2 passed 68 unique tests; regression passed 179 of 179; the superset produced 183 passes with 11 deselections; and a 23-case threat and failure matrix passed completely. The final multiprocess test started and exited two test child processes, left no spawned test child process running after validation, and produced exactly one successful claimant. Production database writes and canonical source changes were both zero. These results support an implementation claim for the isolated control plane, not a claim of production readiness or completed canonical promotion.