Continuity Kernel Secures Long-Lived Agent State

Problem

The paper studies how persistent AI agents should govern evolving, versioned state so that storage retention does not equate to authority. Without an explicit control plane, concurrent proposals from models, tools and background workers can produce stale overwrites, un‑audited exposures and self‑authorising privilege escalation. The authors frame agent state governance as an activation problem: continuity must mean an unbroken, authorised lineage of accepted branch heads rather than mere retention of stored objects.

Approach

They propose the Continuity Kernel (CK), an activation contract that separates off‑commit candidate preparation from a short, deterministic activation transaction. Untrusted proposers create typed candidate proposals that target an exact predecessor head or a typed absence. Preparation collects and signs evidence and derives a sealed candidate off‑commit. Activation revalidates ownership, pre‑state authorisation, freshness and effect uniqueness via a fixed 17‑stage predicate and records exactly one terminal disposition: Commit, Reject, Quarantine or Defer. Only Commit atomically advances the branch head and installs the complete accepted unit comprising state, authority, lineage, effects, outcome and receipt. The design specifies lifecycle operations (branch creation, writer handoff, migration, restoration), receipt formats with verification levels, and explicit assumptions (A1–A9) covering cryptography, atomic serialization, context availability, non‑recycled scopes and verification objects. The protocol is formalised and exercised with an executable bounded model implemented in Python that exhaustively explores a finite state abstraction.

Key Findings

• The activation contract enforces exact predecessor succession and pre‑state authorisation: only one complete predecessor can have at most one accepted successor and a serialized absence can have at most one genesis.
• Protocol evaluation across a bounded model reached 2,808,230 reachable states and 5,526,474 state‑changing transitions with zero encoded invariant violations and 100% coverage of named protocol witnesses.
• Empirical transition results: 916,956 commits (10.33% of attempted transitions) while concurrency and identifier protections caused roughly 37.00% of attempts to be rejected for stale heads, id reuse conflicts or reclaimed effects, demonstrating active race isolation.
• The bounded simulator achieved 31,132 transitions/sec with average evaluation latency ≈32.12 microseconds per transition on a single‑threaded CPython run, showing the model is tractable at the tested depth.
• The protocol provides stable execution identity and at‑most‑once effect binding when its explicit assumptions hold; receipts distinguish attestation from durable inclusion and require additional proofs for inclusion guarantees.

Limitations

Safety claims are conditional on nine explicit assumptions (cryptographic key custody, atomic serialization by the storage substrate, availability of commit‑time context and trusted time, non‑recycled identifier scopes, and availability of verification objects). The executable model is a finite abstraction: it treats preparation and activation as single logical steps and does not model storage‑engine failures, write‑ahead logging crashes, network partitions, or storage‑driver bugs. Signed receipts are not proof of durable commit unless backed by inclusion evidence. CK does not make external side effects atomic with internal state changes and introduces commit‑time overhead requiring storage‑level optimisation for high throughput.

Implications

Offensively, if a system lacks a CK‑style kernel an adversary or buggy proposer can replay requests, reuse or forge identifiers, bind stale heads, omit or forge evidence, reorder operations, or attempt self‑authorising changes to escalate privileges or create conflicting authoritative state. Even with CK, attackers can target implementation gaps: compromise of signing keys, exploitation of storage engine bugs or network partitions, or inducing signed but uncommitted receipts could cause false claims of authority. Remote side effects remain vulnerable because CK does not make them atomic with internal state, so adversaries might exploit timing to produce inconsistent external impacts.