EKOS — Enterprise Knowledge Operating System

LLM descriptions, grounded in real code.
Not vibes — persisted evidence.

Most entity pages for undocumented code were empty — a name, a diagram, nothing else. RFC 0088 asks an LLM to describe what a module or function actually does, grounded in its real compiled structure or real source text, persists the answer to the ledger at commit time, and — when a human comment already exists — flags a real discrepancy instead of trusting it blindly. Verified end to end against a real local model, zero API cost. That live run found two real bugs a passing test suite hadn't; both fixed the same session.

"Not documented in source." — nothing else RFC 0088, post-commit, evidence-grounded 104/116 real symbols, 0 errors 2 real bugs found live, fixed same day
§ 01 / the real gap
what a real, undocumented function's page looked like, before

A name. A diagram. Nothing that says what it does.

RFC 0087 already surfaces a real ////@moduledoc/docstring/JSDoc comment when one exists — real, but honest about doing nothing when it doesn't, which is most real code in most real codebases. And even where a comment does exist, it can be stale, wrong, or incomplete — RFC 0087 can only surface what a comment claims, never check it against what the code actually does.

a real entity page, before RFC 0088
# try_fetch (RustSymbol)

## Definition
_Not documented in source._

## Properties
_No compiled properties._

// no relationships, no diagram
// worth drawing either
§ 02 / a design correction, found before writing code
reading semantic/ledger source directly, not assumed

Not a CompilerPass. This pipeline's ledger versions whole objects, not patches.

The obvious design — a new CompilerPass writing ai_overview onto the same object id an earlier pass already created — would have been actively dangerous. merge_graphs/build_ckm never dedupe objects sharing an id across two passes, and each ledger version is a complete snapshot, not a diff. A bare partial object could become the new "current" version and silently regress every real structural property (kind, arity, RFC 0087's own description) another pass already wrote.

§ 03 / the actual feature
ai_overview, ai_usage, ai_comment_check — new, persisted KIR properties

Grounded in real source. Flagged, never silently trusted, when a comment might be wrong.

a real generated page, after — real, unedited (local llama3:latest)
# hash (ElixirSymbol)

## Definition
_Not documented in source._

## AI-Assisted Overview
A function that takes a password as input and returns
the hashed version of it, using the Bcrypt library.

## Evidence
- ai_overview grounded in hash's own real source lines

Real source, sliced by a new compiled source_span (Rust via syn's joined spans, Elixir via the existing block-depth stack), redacted through RFC 0043's baseline before it ever reaches a provider. When a real human comment already exists, ai_comment_check answers consistent/stale/incomplete — a real, visible callout on the Definition section, never a silent overwrite of the real extracted comment text.

§ 04 / live, zero real cost
a real local Ollama model — no cloud API spend to verify this

104 of 116 real symbols described. 0 errors.

27
real modules/subsystems described
104/116
real symbols described (12 honest, real skips — no block to span)
0
errors — a small model's own JSON non-compliance degrades cleanly, confirmed separately

A real, deliberately small subsystem — lib/plausible/auth, 15 files — kept a real end-to-end run to minutes on a free local model instead of the multi-hour real cost the full 900-module backend would take. Plausible.Auth.Password's real page: "responsible for performing password-related calculations and checks... hashing, and matching passwords" — grounded, not guessed, and devlog_90's own identity-resolution fix still holds (exactly 3 real relationships, no phantom edges).

§ 05 / found by that live run, not by 17 passing tests
a real File.name is relative to its own [observe] paths entry, not the workspace root

0 symbols described. Real source_span data. A real path bug, one layer down.

Symptom, first real runReal root cause
"116 skipped without a source span"Compiled CKM genuinely had real source_span data on all of them — checked directly, not assumed
File.name == "password.ex"Real path relative to its own [observe] paths entry, not cwd — the real lib/plausible/auth/ prefix silently dropped
Fixed: real_file_path + a corrected project_key conditionbase != cwd replaces counting [observe] paths entries — still empty for the common paths = ["."] case, now also correct for one scoped subdirectory

The real analytics backend's own config never triggered this — it lists eight separate observe path entries. Only a smaller, more targeted real scope (exactly what a "small piece of backend architecture" test asked for) exercised the single-entry shape. A second, separate live-found bug: this session's own new Ollama provider selection silently ignored [llm].model, inherited from a pre-existing gap two other files still have — flagged, fixed only where new code introduced it.

§ 06 / same session, deterministic side
no LLM involved — found reading real generated pages directly

A phantom module, a dead-end Component View, a mixed layer — all real, all fixed.

BeforeAfter
multi-target alias X.{A, B} → one phantom edge to the bare shared prefix, never defmodule'd anywherereal per-leaf edges — a lookahead pre-scan handles mix format's own one-leaf-per-line wrapping
"no crate directory matched" on every non-Rust workspacereal compiled Rollup fallback — 5 real subsystems, clearly labeled
System Decomposition: aggregate counts onlynew Layer Breakdown — priv correctly split, 291 real backend files + 1 real frontend asset

The exact page this whole effort's own multi-alias fix targeted — PlausibleWeb.Live.CustomerSupport.Team — now lists all 7 real dependent modules by name instead of one phantom object with no file, no properties, and no real relationships of its own.

§ 07 / the honest scorecard
shipped and real — not means finished

What's real now. What's deliberately still open.

Real, shippedDeliberately deferred
Module/subsystem/symbol overviews, Rust + Elixir source_spanJS source_span — same pattern, not yet wired (Python fixed the same day, devlog_98)
ai_comment_check — stale comments flagged, never silently trustedPer-symbol re-verification against real code regardless of scope size — a materially larger, separately-scoped ask
Project-level Purpose/Architecture-style, honestly blank with no README to ground itRisk KIR kind + real ## Major risks
Cost-gated (ekos commit --yes), opt-in, same UX --prose establishedReal Architecture confidence from an LLM judgment, not just the deterministic evaluator

Nothing in the right column is a bug hidden from this deck — every one is named, scoped, and reasoned about in its own RFC or devlog.

try it yourself — nothing hidden, before or after

Same repo. Real local model. Real output.

terminal
$ ekos commit --yes    # shows a real call-count estimate first

# [llm-description] in ekos.toml
enabled = true
scope = "modules"      # cheaper default — "all" also covers symbols
Full workspace gateResult
cargo build/test/clippy -D warnings/fmt --checkClean, every fix
New tests this effort30+ new tests — 17 for the LLM-description pass alone, each against real fixtures or a real bug found live
EKOS · Grounded LLM Descriptions — RFC 0087, RFC 0088, devlogs 91-94 · every example on this page is real output, unedited · github.com/alexeyban/EKOS