PaperlayerView exact revision on arXiv

Source-linked AI summary

Runtime-Independent Persistent Agents: Preserving Identity, Memory, and Code Across Models, Harnesses, and Servers

Zhenyu Zhao, Roy Zhao

arXiv:2609.00546v1cs.SEcs.AI

TL;DR

Long-lived agents can change models, harnesses, sessions, and hosts while preserving identity, memory, and code lineage, but model-plus-harness descriptions do not define that continuity. This paper separates a continuity-bearing substrate from replaceable execution and interaction bindings, implements the design in Enoch, and reports evidence for mechanical substitutability and authorized continuity while leaving behavioral continuity unmeasured.

  • Problem

    Existing model-plus-harness boundaries do not specify what must remain continuous for executions at different times to belong to the same agent.

  • Method

    The paper defines a runtime-independent boundary separating identity, private durable memory, and versioned code from replaceable reasoners, harnesses, hosts, and interaction surfaces, with authorized migration semantics.

  • Results

    The implemented architecture provides executable evidence for contracts, portable installation, state migration, recovery, and substitutions across reasoner versions, interaction surfaces, and host machines.

  • Takeaways & Limitations

    The design supports treating governed replacement bindings as auditable lifecycle operations while preserving attributable lineage and continuation authority.

  • Takeaways & Limitations

    The evidence does not yet include a second bundled live reasoning harness, a controlled all-axis migration matrix, or measurements of behavioral continuity, downtime, cost, or operator burden.

Abstract

from arXiv · show

Agent systems are commonly described by the model and harness that currently produce their behavior. That boundary is useful for one execution but underspecifies a long-lived agent that may change models, orchestration harnesses, interaction sessions, and host servers while retaining one identity, memory, and executable code lineage. We present a runtime-independent architecture for persistent agents. A continuity-bearing substrate $P_t=(I_t,M_t,B_t)$ contains an architectural identity representation, private durable memory, and a versioned software body. A replaceable deployment binding comprises an execution substrate $E_t=(R_t,H_t,D_t)$, which supplies a reasoner, harness, and host, and a set of interaction surfaces $S_t$, such as chat, API, or user interface bindings. A deployed execution is $A_t=P_t\triangleright(E_t,S_t)$; changing either replaceable layer is migration, not agent creation, when an authorized protocol preserves attributable lineage and transfers continuation authority within a governed deployment boundary. We define six continuity invariants and a quiesce--checkpoint--validate--bind--rehydrate--resume protocol. Enoch realizes the design as a reusable body plus private installed identity, memory, workflow state, and continuation authority, with infrastructure dependencies behind versioned provider contracts. A clean-room run of the frozen public commit passes 833 core tests and 92 provider and library tests executed separately from the core suite; deployments have exercised reasoner-version, interaction-surface, and host-machine substitutions while retaining continuity-bearing state. This evidence supports mechanical substitutability and authorized system continuity, not behavioral invariance or exhaustive pairwise evaluation. The downstream measurement question is whether an authorized continuation still recalls, composes, and enacts its identity.

1 Introduction

The paper reframes a persistent agent as continuity-bearing identity, memory, and executable body rather than the model or harness currently producing behavior. It formalizes migration across execution and interaction bindings and implements the boundary in Enoch.

  • Motivation: The boundary addresses whether executions at different times remain the same agent when models, processes, machines, or sessions change.These are architecture and lifecycle questions beyond prompt engineering.
  • Runtime-independent boundary: Persistent identity comprises architectural identity, private durable memory, and a versioned executable body.These components form the continuity-bearing substrate, distinct from replaceable execution and interaction layers.
  • Runtime-independent boundary: Models, harnesses, and servers form a replaceable execution substrate, while chats, APIs, email, and interfaces are replaceable interaction surfaces.Both layers shape or carry behavior but are not necessary invariants of longitudinal identity.
  • Migration semantics: Migration semantics distinguish authorized rebinding from restart, evolution, identity update, replication, and descent.The architecture preserves attributable lineage and continuation authority rather than treating each deployment as a new agent.
  • Reference architecture: Enoch maps the boundary to a reusable versioned body, installed identity and memory, provider contracts, durable workflow state, fencing, and conformance suites.The implementation reports executable mechanism evidence together with its limits.

2 System Model

The system model separates a continuity-bearing persistent substrate from replaceable execution and interaction bindings. Continuity follows attributable lineage and authorized transitions rather than behavioral sameness or byte identity.

  • Persistent substrate: The persistent substrate comprises architectural identity, private durable memory, and a versioned executable body.Memory includes continuity-relevant workflow state, while the body includes code, prompts, tools, policies, tests, provider contracts, and evolution mechanisms.
  • Execution and interaction bindings: The replaceable execution substrate supplies a reasoner, orchestration harness, and host, while interaction surfaces provide external endpoints.These layers can change without becoming the agent’s durable identity.
  • Deployment binding: A deployed execution instantiates the persistent substrate through execution and interaction bindings rather than transferring ownership of identity to them.A particular Slack thread or API endpoint belongs to the interaction-surface binding, not the persistent substrate.
  • Continuity semantics: Persistence permits memory growth, reviewed body evolution, and authorized identity updates when attributable lineage remains continuous.Auditable continuation is not byte equality and may include checkpoint metadata, schema migration, or new experience.
  • Continuity semantics: Behavioral identity fidelity is empirical and important, but it cannot serve as the storage identifier or sole protection against copied-process authority.Different models may vary in wording, competence, or style while executing the same persistent substrate.
  • Continuity semantics: Replication without an authority lease, fencing epoch, or declared multi-embodiment policy cannot safely establish a unique continuation.Identity, attributable lineage, and transition authority are jointly required; a stable label alone is insufficient.

3 Architecture

The architecture makes runtime independence operational through semantic provider contracts, separated ownership areas, and governed migration. It preserves authority and durable work across rebinding while failing closed when providers cannot safely support an effect.

  • Provider abstraction: Portable application logic consumes normalized semantic operations and opaque provider identities instead of infrastructure-specific events or descriptors.Adapters isolate Telegram, Codex, Git, GitHub, and launchd representations from the portable core.
  • Provider abstraction: Interaction rebinding changes the current attachment rather than the agent’s identity, and removing chat surfaces leaves the agent temporarily unreachable through chat.The body retains communication capability and policy, while accounts, channels, sessions, and provider identifiers belong to the surface binding.
  • Provider abstraction: Provider selection verifies task requirements and provider grants before side effects, making reduced capability explicit and failing closed when no safe provider is available.A provider swap may reduce capability without changing who the agent is.
  • Storage and custody boundaries: The design separates reviewed software body, private state, and retained artifacts into distinct physical ownership areas.Private state includes installed identity, memory, credentials, queues, schedules, sessions, and provider cursors; artifacts can follow different retention policies.
  • Migration and custody: Authorized migration fences the old execution, checkpoints state, binds and rehydrates the target, then verifies continuity before authority transfers.Failure before verification leaves the source authoritative, while failed target activation rolls back to the checkpoint.
  • Migration and custody: The logical substrate can move through separate mechanisms for public code, encrypted private memory, and target-host secrets, with manifests recording versions and hashes.Private bytes need not enter the body repository.
  • Migration and custody: Durable intent records, idempotency keys, and fencing epochs prevent stale processes from claiming or finalizing work across provider failures.Providers lacking reconciliation or idempotent delivery must fail closed to avoid duplicate effects.
  • Migration and custody: A new harness session reconstructs context from identity, memory, body, and durable work records rather than treating a provider-native transcript as the agent’s mind.Only selected facts, commitments, relationships, and pending work enter memory through explicit retention and workflow policies.

4 Authorized Migration Protocol

Authorized migration replaces execution resources or interaction surfaces while preserving the continuity-bearing substrate, lineage, and governed continuation authority. The protocol also makes self-description an environment-aware post-migration check rather than an identity assumption.

  • Migration quiesces work, checkpoints continuity state, validates the target, binds it, rehydrates state, and resumes execution.The checkpoint includes identity, body, memory, workflow state, pending work, provider cursors, and artifact references.
  • The protocol preserves identity lineage, memory ancestry, body revision, continuation authority, capability visibility, and self-description.Identity updates or body evolution require separate governance rather than occurring implicitly during runtime migration.
  • Within the governed boundary, authority fencing prevents stale cooperating executions from producing authoritative effects after migration.This guarantee assumes participating executions honor the authority store and affected providers enforce fencing or reconciliation contracts.
  • Execution, process, interaction-surface, and deployment labels remain environment metadata rather than overwriting installed identity.Behavioral self-representation is treated as a post-migration test, not as proof of continuity.

5 Reference Implementation

Enoch implements the architecture as a reusable versioned body paired with private installed state and provider contracts. The frozen snapshot demonstrates broad test and operational coverage, while its evidence remains bounded.

  • Enoch is a reusable open-source agent body, not itself an installed agent identity.The implementation evidence is frozen to public Git commit c8013ed249bc11bc13f3843ed0f0cb9729f858c1 on 31 August 2026.
  • Enoch separates body.yaml from private self.json, loading the body manifest and installed identity record as distinct inputs.The body supplies code, tools, policies, tests, provider contracts, and lineage; the installed record supplies identity-bearing private data.
  • Agents may share a body revision while remaining distinct in identity, memory, private-state lineage, and continuation authority.Copying the body alone neither copies nor instantiates an agent.
  • Private state holds memory, configuration, queues, schedules, provider cursors, runtime keys, and authority metadata, while retained evidence uses a separate artifact namespace.
  • Migration protects versioned private state through validation, daemon-liveness checks, backups, late manifest commits, and restoration after failures.
  • The bundled snapshot includes only Codex as a live reasoning runtime, making a second harness an extension point rather than a cross-provider live result.
  • 833 core tests and 92 separately executed provider and library tests passed in a clean-room run of the frozen public commit.The evidence supports architectural substitutability, failure handling, and individual-axis feasibility, not equal task performance or behavioral fidelity.

6 Evaluation Protocol for Full Migration

The proposed full-migration evaluation varies environment dimensions under a frozen substrate checkpoint and measures both authorized system continuity and behavioral identity fidelity.

  • A complete evaluation should vary one environment dimension at a time before testing combined migration.
  • Each run keeps the evaluator outside the target agent and records authorized system continuity alongside behavioral identity fidelity.
  • The pre-migration installation includes identity, memories, a body commit, an unfinished task, and delivered and pending external effects.

7 Discussion

The persistent-substrate view treats models and harnesses as replaceable execution resources across time, while preserving lineage through authorized state and authority controls. The discussion limits this claim to system continuity rather than behavioral equivalence or unrestricted copying.

  • Models and harnesses strongly determine instantaneous capability but are execution resources across the agent’s longitudinal timeline.Replacing reasoning machinery need not break authorized system lineage when the persistent substrate and authority remain.
  • Persistent agents extend logical-actor ideas with identity representations, autobiographical memory, executable self-modification, relationships, model-dependent behavior, and copying governance.Distributed-systems mechanisms are necessary but not sufficient for these richer continuity problems.
  • Copied memory can evidence history without proving exclusive continuation, so promotion authority must remain anchored in authorized lineage and a single promotion point.Future multi-embodiment agents require explicit policies for concurrency, reconciliation, and responsibility attribution.
  • Runtime portability may reduce provider lock-in but can move an agent into a less capable security boundary.Capability loss should fail closed, while capability gains require authorization rather than following automatically from the target server.

8 Related Work

Prior work explains agent execution, memory, identity, and state transfer, but this paper focuses on the longitudinal boundary when the executing composition changes. It generalizes agent-owned software bodies into explicit whole-agent migration semantics.

  • Cognitive and multi-agent frameworks explain agent execution and composition, while this paper addresses continuity when the executing composition changes.
  • Distributed-systems abstractions separate logical entities and durable computation from physical execution through actors, virtual actors, checkpointing, and mobile code.
  • Persistent-memory and identity systems support continuity through memory, reflection, planning, executable skills, stability metrics, and redundant identity anchors.
  • The Continuity Kernel governs authoritative state-head lineage and atomic state operations, whereas this paper defines the longitudinal agent components and their rebinding.
  • Self-evolving systems make resources mutable, while this work extends the agent-owned software body to an explicit persistent, execution, and interaction boundary.

9 Limitations

The evaluation is limited to one young open-source lineage and operational substitutions without controlled all-axis or behavioral evaluation. Authority guarantees also depend on cooperation within a governed deployment boundary.

  • The architecture derives from one young open-source agent lineage and lacks a controlled all-axis matrix or measurements of behavioral continuity, downtime, cost, and operator burden.
  • Provider conformance detects interface and lifecycle violations but cannot establish semantic equivalence or security for external implementations.
  • The authority invariant applies only to cooperating executions within a governed deployment that share or honor the authority store and provider contracts.
  • Detached or malicious copies with unrevoked credentials can act outside the governed boundary; stronger enforcement requires credential rotation, leases or fencing, or an external authority service.
  • The decomposition does not cover coordinated multi-embodiment, divergent-memory merge, or recovery after irreversible external effects.

10 Conclusion

The conclusion separates a persistent agent’s continuity-bearing substrate from its replaceable execution and interaction bindings. Enoch implements this boundary, while combined migration experiments remain the next test of system continuity and behavioral identity fidelity.

  • Identity, memory, and versioned code form the continuity-bearing substrate, while models, harnesses, servers, and chats are replaceable execution or interaction bindings.
  • These replacement bindings can be changed through governed, auditable lifecycle operations rather than treated as creation of a new agent.
  • Enoch implements the boundary with separate body and identity loading, shareable body lineage, durable private state, five provider contracts, and guarded transitions.
  • A controlled combined migration is proposed to test authorized system continuity and behavioral identity fidelity across models, harnesses, interaction surfaces, and hosts.
Loading 2609.00546v1…