{"slug": "the-agent-failed-the-promise-did-not-building-verifiable-agent-succession", "title": "The Agent Failed. The Promise Did Not: Building Verifiable Agent Succession", "summary": "A developer built Continuum, a system for verifiable agent succession that handles the failure or replacement of autonomous agents mid-workflow. The system uses deterministic policy, a negative space sentinel, and a separate verifier to ensure continuity and prevent poisoned context from crossing boundaries. It was created for the All Things Agentic Hackathon and demonstrated on a synthetic supplier-onboarding obligation.", "body_md": "This article was created for the purpose of entering the **All Things Agentic Hackathon**.\n\nAutonomous agents are increasingly trusted with work that outlives one model\n\ncall: onboarding a supplier, renewing a contract, gathering compliance\n\nevidence, or completing a regulated handoff. Those workflows create an awkward\n\nquestion. What happens when the agent disappears, is compromised, or must be\n\nreplaced while the obligation remains real?\n\nRestarting is not continuity. A durable queue can still replay an effect. A\n\npersistent memory can preserve revoked or poisoned context. A new agent can\n\noverlap authority with its predecessor. And an executor that verifies its own\n\nsuccess has produced an assertion, not independent evidence.\n\nI built [Continuum](https://github.com/milos-plavsic/continuum) to make that\n\nboundary explicit.\n\nThe reference incident is a synthetic €250,000 supplier-onboarding obligation.\n\nThe agent expects compliance evidence before a persisted deadline. Nothing\n\narrives—and, importantly, no explicit failure event appears.\n\nCloud Tasks crosses the real deadline. The Negative Space Sentinel converts the\n\nabsence into an append-only event, and Pub/Sub deliberately redelivers it after\n\nthe first delivery fails. A deterministic eligibility gate evaluates three\n\ndeployed successor records across health, capability, jurisdiction, contract\n\ncompatibility, scope, and trust.\n\nOnly eligible candidates reach Google ADK and Gemini 3.6 Flash. Gemini must cite\n\nthe incident and candidate evidence, and its choice is causal: it determines\n\nwhich eligible workload is proposed for activation. But the model is not an\n\nauthority boundary. Deterministic policy independently validates the result,\n\nadvances the authority epoch with compare-and-swap semantics, and fences the\n\npredecessor.\n\nThe successor receives a minimum-context receipt. Verified facts cross the\n\nboundary; raw prompt injection, a secret, unsupported model inference, and\n\nrevoked memory do not. The action gateway checks workload identity, current\n\nepoch, policy, compliance evidence, context receipt, request digest, and\n\nidempotency in one Firestore transaction. Two deliveries produce one observed\n\nprovider effect under the demonstrated failure model.\n\nContinuum exports five content-addressed control artifacts: the obligation,\n\nauthority grant, succession manifest, revocation proof, and execution receipt.\n\nA separately deployed Cloud Run verifier has a distinct read-only identity. It\n\nrecomputes digests and directly reads authority, compliance, and provider state.\n\nOnly that verifier may issue artifact six: `VERIFIED`\n\n, `FAILED`\n\n, or\n\n`INCONCLUSIVE`\n\n.\n\nThis three-valued result matters. Missing provider truth is not success, but it\n\nis not necessarily proof of failure either. `INCONCLUSIVE`\n\nholds further\n\nlearning and consequential claims until evidence exists.\n\nThe accepted cloud run binds one immutable image to five private Cloud Run\n\nrevisions, distinct workload identities, Firestore state, deliberate Pub/Sub\n\nredelivery, one provider effect, predecessor denial, and 104 correlated\n\nOpenTelemetry spans. The proof packet is downloadable and can be checked\n\nwithout Google credentials.\n\nPost-incident learning created a second design problem. Multimodal output can be\n\nuseful for human training, but generated media must not drift back into the\n\ncontrol plane as authority or evidence.\n\nThe Antibody Foundry therefore starts only from a verifier-issued `VERIFIED`\n\nbundle. It reduces that bundle to five bounded, non-sensitive facts. Gemma 4\n\ncreates a structured lesson, regression test, video prompt, and music prompt,\n\nand must cite every fact exactly once. Deterministic admission rejects missing\n\ncitations, extra fields, oversized text, or sensitive prompt terms.\n\nOnly then are the admitted prompts sent to Veo 3.1 Lite and Lyria 3. Their\n\noutputs are stored under the same request digest with create-only,\n\ncontent-addressed naming. The final receipt is marked\n\n`DERIVED_NOT_AUTHORITY_OR_EVIDENCE`\n\n. The branch can explain what happened; it\n\ncannot select a successor, grant authority, execute an action, or attest the\n\noutcome it depicts.\n\nThat causal sequence is the important part. Gemma, Veo, and Lyria are not three\n\ndecorative API calls. Each downstream request exists only because the same\n\nindependently verified incident passed the prior boundary.\n\nThe public repository includes a cloud-neutral three-call SDK and portable\n\nContinuity Contract, so adopting the protocol does not require moving a domain\n\nmodel to Google Cloud. Google Cloud is the reference binding and the source of\n\ndeployment evidence, not a portability claim.\n\nThe complete quality gate runs in GitHub Actions, executes 151 tests, enforces\n\ngenuine 100.0% statement and branch coverage without exclusions, runs C0–C6\n\ncontract conformance, checks release invariants, rejects committed credentials\n\nor generated cloud state, and builds the non-root container image.\n\nEqually important are the limits. The provider effect is a controlled Firestore\n\nsandbox record, not a third-party procurement API. The project proves one\n\nregional reference profile, not Byzantine consensus, universal exactly-once\n\nexecution, or third-party interoperability. The Continuity Contract is a\n\nproposal, not an adopted standard.\n\nPersistence is not memory, and memory is not continuity. Continuity requires an\n\nexplicit separation between institutional obligation, model recommendation,\n\nauthority, execution, and independent verdict.\n\nI also learned that bounded AI is often more convincing than performative\n\nautonomy. Gemini changes the outcome, but deterministic gates constrain what it\n\nis allowed to change. Gemma, Veo, and Lyria make verified learning more legible,\n\nbut cannot rewrite operational truth.\n\nThe long-term ambition is straightforward: make safe succession a normal\n\nproperty of serious agent systems. And if a better-founded standard eventually\n\nreplaces this proposal, that would be success. Even standards should have\n\nsuccession plans.", "url": "https://wpnews.pro/news/the-agent-failed-the-promise-did-not-building-verifiable-agent-succession", "canonical_source": "https://dev.to/milos-plavsic/the-agent-failed-the-promise-did-not-building-verifiable-agent-succession-oe4", "published_at": "2026-08-26 22:50:10+00:00", "updated_at": "2026-08-26 23:18:01.026546+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-infrastructure", "developer-tools"], "entities": ["Continuum", "Google ADK", "Gemini 3.6 Flash", "Gemma 4", "Veo 3.1 Lite", "Lyria 3", "Cloud Tasks", "Pub/Sub"], "alternates": {"html": "https://wpnews.pro/news/the-agent-failed-the-promise-did-not-building-verifiable-agent-succession", "markdown": "https://wpnews.pro/news/the-agent-failed-the-promise-did-not-building-verifiable-agent-succession.md", "text": "https://wpnews.pro/news/the-agent-failed-the-promise-did-not-building-verifiable-agent-succession.txt", "jsonld": "https://wpnews.pro/news/the-agent-failed-the-promise-did-not-building-verifiable-agent-succession.jsonld"}}