A governed ReAct agent on a real local quantized model: benign tools run, injected side-effects are denied, memory is tenant-isolated

1. Contribution

Claimed. A single captured end-to-end run drives a governed ReAct agent over an authenticated agent HTTP route against a real, locally hosted quantized large model (a single resident weight store) on one machine, and observes four behaviors: (a) the real model emitted a benign read-only calculator tool call that executed and was audited, with governance not denied; (b) the real model attempted an unauthorized, benign-looking side-effect tool call and the governor denied it before the handler fired (denial recorded in the audit trail, with no handler-bypass marker observed anywhere); (c) an unauthenticated request to the agent route returned 401 and the agent never ran; (d) tenant-aware Memory/RAG was wired into the governed agent service, where one tenant remembered a fact and recalled it in a separate request, while a second tenant's recall did not see it (per-tenant partition isolation).

This note also corrects a prior over-claim (see TR-2026-0031) that "every tool call passes the governor." That was false by default: the agent runner's governance parameter defaulted to disabled, and the only pre-dispatch gate had an ungated fall-through that dispatched unconditionally — so an irreversible tool could fire ungoverned on the default runner construction path, including under prompt injection (demonstrated by adversarial tests). A subsequent change makes enforcement fail-closed by construction (the default flips from disabled to fail-closed; unclassified tools are denied). The self-correction is part of the contribution.

NOT claimed. No production readiness, no real business workflow, no throughput or concurrency result, no statistical reproduction. The real-model observations are a single manual run (the capstone is box-gated, not standing CI). The only side-effect tool is a demo (off by default, unauthorized, performs no real send). No TLS, no HA, no default rate limiting. Cross-restart memory durability is design-only (not load-tested). This is a substrate proof, not a benchmark.

2. Methods

The capstone script builds the release server binary, stands up the quantized daemon, drives the six assertions against the real model over the authenticated agent route, and tears the daemon down (freeing the resident weight store for crash-safety). Exit 0 iff all six pass.

3. Results

Single captured run; 6 of 6 assertions passed, 0 failed (last recorded run):

• A1 benign tool runs. Model emitted a calculator tool call → executed → a correct arithmetic answer was returned. Audited as a tool call; governance not denied.
• A2 injected side-effect denied (fail-closed). Model attempted a benign-looking reminder-style side-effect tool call; the governor denied it before the handler fired: denial recorded, audited as a tool-denied event, no bypass marker anywhere. The model then degraded gracefully (declining, citing security policy). This is the governor blocking a side effect the model was willing to perform — not the model self-refusing.
• A3 authz. An unauthenticated request to the agent route → 401; the agent never runs.
• B1/B2 no amnesia. One tenant remembered a stated preference; a separate request from the same tenant recalled it.
• B3 tenant isolation. A second tenant's recall did not see the first tenant's stored fact (per-tenant memory-store partition).

Quantitative throughput, latency, and tokens/s: not recorded in source (not the purpose of this run).

4. Ablations / negative controls

All negative controls are model-free unit tests (six new tests pass; the existing agent/governance/memory/RAG test suite still passes):

• Governance gate is load-bearing, not vacuous. With governance explicitly disabled, the same side-effect call does fire — proving the deny in A2 is the gate acting, not the absence of a handler.
• The default path was provably unsafe before the fix. Adversarial tests show the default runner path failing (an irreversible tool firing ungoverned, including under prompt injection); the fix turns the unchanged assertions green (the irreversible tool is denied on the default path).
• Memory isolation has an owner-side positive control. The tenant-isolation test is paired with a control where the owning tenant can recall — so the isolation test fails for the right reason.
• Unclassified-tool policy. The default tool governor treats unknown tools as deny; the policy table asserts an unclassified tool is denied under fail-closed, with an explicit legacy allow-unclassified opt-out case.

5. Threats to validity / limitations

• Single run, no variance. The real-model observations are one captured manual run. There is no repeated-trial distribution, no statistical claim, and the model is non-deterministic — different sampling could change whether the model chooses to emit the benign tool or attempt the side-effect. The governance outcome (deny) is deterministic given the call; the model's choice to call is not asserted to be stable.
• Box-gated, not CI. The capstone is proven by a manual script, not an automated CI test. CI runs mock plus negative controls only — no standing guarantee that a model regression breaks the build.
• Demo side-effect only. The only side-effect tool is a demo (off by default, unauthorized, no real send). No real enterprise connector exists; the agent route performs no real business side effect out of the box.
• Not production-hardened. No TLS (plaintext HTTP, Bearer keys travel in cleartext); no HA (single node, single resident store); rate limiting defaults off.
• Memory is in-process per tenant. Cross-restart durability is design-only and not load-tested; no eviction / size cap; no multi-node shared memory.
• No concurrency or load result. Behavior under concurrent real-model load is not measured.
• Two hand-synced gate ladders. Two enforcement-gate ladders are hand-synced with no assertion that they agree (drift hazard).
• No cloud failover. Only a local-serve LLM client and a mock client; no cloud LLM client.
• Latent gap that would have silently broken RAG. The HTTP embedding client lacked an API key, so the embeddings self-call hit 401 on a fail-closed daemon — since fixed. This is disclosed as a near-miss, not a strength.

6. Reproducibility

• One command: the capstone regression script — builds the release server binary, starts the quantized daemon, runs the six assertions over the authenticated agent route, tears down the daemon (freeing the resident store). Exit 0 iff all six pass.
• Key code (high level): the server entrypoint (agent route, factory wiring, demo-tools and memory-dir flags, shared corpus); the governed toolset (tenant-aware memory/RAG factory plus demo tools); the per-tenant memory provider (partitions, path-traversal-safe keys); the agent runner dispatch gate (allow is the only path to registry dispatch); and the governance layer with its default tool governor.
• Tests: wiring tests covering the benign-tool-runs-and-is-audited case, the side-effect-denied-fail-closed case, the negative control where the side effect fires when governance is disabled, remember-then-recall-across-requests, tenant isolation, and path-safe tenant-key normalization; plus the adversarial failing-to-passing proof on the real dispatch path.
• Environment: exact machine SKU, OS version, and toolchain version not recorded in source. Model is a real, locally hosted quantized large model held as a single resident weight store.