PaperlayerView exact revision on arXiv

Source-linked AI summary

The Cognitive Continuity Test: Verifying Governed State Transitions in Persistent AI Agents

Jun He, Deying Yu

arXiv:2610.00132v1cs.CRcs.AI

TL;DR

Similar successor states can carry differently authorized claims, while legitimate revisions can substantially change state. CCT evaluates submitted transitions against scoped evidence and policy predicates; the reference verifier matched all 1,152 held-out labels, including all 576 canonical cases.

  • Problem

    Persistent agents change memory and beliefs, while similar successor states can accompany transition claims with different authority.

    Source: §1 · p. 1, §1.1 · p. 1

  • Method

    CCT evaluates explicit state transitions using scoped authority, provenance, deterministic application, semantic predicates, and candidate-persistence evidence.

    Source: §14 · p. 12

  • Results

    The reference verifier matched all 1,152 held-out labels, including all 576 canonical cases.

    Source: §10.2 · p. 9

  • Takeaways & Limitations

    The supported claim is conformance of structured transition records to declared policy, not live-runtime exclusivity or guaranteed runtime behavior.

    Source: §2 · p. 2, §12 · p. 11

    Generated fixtures and short histories do not establish generalization to deployed agents; the behavioral SIT arm is unexecuted.

    Source: §12 · p. 11

Abstract

from arXiv · show

Persistent AI agents revise beliefs, consolidate memory, and replace execution substrates. Similar successor states can accompany differently authorized transition claims, while legitimate development can change state substantially. We introduce the Cognitive Continuity Test (CCT), a policy-relative contract for verifying submitted transitions using scoped authority, provenance, deterministic application, semantic predicates, and candidate-persistence receipts. CCT distinguishes verified admissibility, affirmative violation, and unresolved required evidence. Separation results concern transition claims rather than live runtime identity; soundness is conditional on the specified checker and evaluator assumptions. IdentityLineageBench provides 24 generated transition families. The reference post-resolution verifier matches all 576 canonical held-out labels; lexical state similarity and a lineage-only diagnostic baseline admit 60.0% and 80.0% of invalid fixtures. These comparisons establish synthetic conformance, not superiority to a policy-aware deployed system. Signed adversarial regressions cover fabricated interaction counts, unsupported belief changes, and mixed missing/contradictory evidence. SIT behavior and actual model migration remain unmeasured. An 18,000-execution valid-path study measures a 6.21 ms default median on resident inputs. We specify the additional activation and recovery obligations needed for deployment.

1 Introduction

Persistent agents change memory and beliefs, so successor-state similarity alone cannot establish whether a transition is authorized. The paper frames continuity as a policy-relative evaluation of submitted transition records, not a judgment of live runtime identity.

1.1 The Verification Question

  • State-only observation cannot distinguish identical successor values submitted with different authority, while authorized consolidation or belief revision can substantially change state.The target is the submitted transition claim and its evidence, rather than a replacement for behavioral identity benchmarks.Source: §1.1 · p. 1

1.2 Scope and Contributions

  • CCT is a policy-relative transition contract, with a witness binding authority, dependencies, validation records, state digests, and a candidate-persistence receipt.Its stated contributions also include eight predicates, conditional soundness, generated transition families, regression tests, and a post-resolution verifier.Source: §1.2 · pp. 1–2

2 Behavioral Identity and Transition Evidence

  • Behavioral identity benchmarks assess resemblance or consistency with developmental history, whereas CCT evaluates a transition’s authority, provenance, and policy predicates.Authentic provenance alone does not establish that external information is true or that runtime behavior follows stored norms.Source: §2 · p. 2

3.1 Explicit State and Mutations

  • The explicit identity state includes an event chronicle, mutable memory, knowledge, beliefs, relationships, governance, and self-model fields, but excludes model weights and runtime.Typed mutations deterministically compute a candidate state or fail; succession authority remains required even when the payload is unchanged.Source: §3.1 · p. 2

3.2 The Cognitive Transition Witness

  • The transition witness binds proposal authority and ordered mutations to provenance, while trusted services supply dependency contents and persist finalized validation records.The persistence receipt records the candidate; it neither activates a branch head nor certifies semantic admissibility.Source: §3.2 · pp. 2–3

3.3 Historical Policy and Trusted Inputs

  • Pre-state governance binds an immutable historical policy reference, and the trusted resolver distinguishes a matching policy from unavailable or contradictory policy evidence.Historical binding is specified but not implemented or measured in the executable artifact.Source: §3.3 · p. 3

3.4 Declarative Admissibility

  • Admissibility requires matching scope and lineage, deterministic application, operation authority, resolved dependencies, satisfied semantic predicates, and a historically valid persistence receipt.This relation labels the supplied witness and does not establish possession by a live runtime.Source: §3.4 · p. 3

4 The Cognitive Continuity Test

The CCT verifier separates affirmative violations from unresolved required evidence and evaluates a policy-defined set of transition invariants. Its executable reference artifact implements only a structured post-resolution subset of the specified procedure.

4.1 Ternary Decision Contract

  • CCT returns PASS, FAIL, or UNKNOWN; a contradiction takes precedence over missing evidence, and only VALID may proceed to separate activation.INVALID means at least one failed check; INDETERMINATE means no failed checks but at least one unknown check.Source: §4.1 · p. 3

4.2 Eight Invariant Classes

  • Lineage receipts must bind the scoped proposal and state digests with an authorized historically valid signature; every operation also requires pre-state scoped authority.Prior commitments, order, and timestamps must be preserved, with new events supported by authenticated acquisition evidence.Source: §4.2 · p. 4
  • Belief evidence must match the proposition, value, confidence, and revision epoch; temporal checks distinguish missing acquisition evidence from affirmative backdating.The native temporal checker covers structured knowledge entries carrying claimed_at; untyped entries fall outside its guarantee.Source: §4.2 · p. 4
  • Relationship changes, including count-only changes, require scoped interaction records; normative admissibility enforces amendment rules and designated non-amendable anchors.The native artifact protects explicit non-amendable records, while broader self-model anchor policies remain part of the specification.Source: §4.2 · p. 4

4.3 Verification Algorithm and Implemented Scope

  • The specified algorithm resolves historical policy, parses the witness, checks lineage, authority, provenance, and application, evaluates semantic predicates, then aggregates all reasons.Independent failures are retained even when another prerequisite is absent.Source: §4.3 · pp. 4–5
  • The Python artifact implements structured post-resolution checks with supplied trusted policy and resident resolver snapshots, but not policy resolution, network authentication, distributed receipt issuance, or activation.General partial parsing is specified but unimplemented, and omitted mutation manifests default to an empty list in this interface.Source: §4.3 · p. 5

5 Continuity Theory

The continuity results distinguish submitted transition claims from observations of successor states, and show why admissibility requires more than lineage or behavior alone. Soundness remains conditional on checker and evaluator assumptions, while admissible steps can preserve transitive invariants across a lineage.

5.1 Successor-State Equivalence Insufficiency

  • When two claims share a successor observation but differ in admissibility, every state-only evaluator has the same decision distribution and cannot both reject the invalid claim and accept the valid one.A transition witness can provide distinguishing evidence, but the result does not establish that CCT’s particular witness format is sufficient.Source: §5.1 · p. 5

5.2 Situated Identity Does Not Imply Continuity

  • A fixed state and passing response mechanism can still accompany unauthorized succession credentials, so situated identity passage does not imply CCT admissibility.The separation assumes the response mechanism passes; copying a chronicle alone does not guarantee correct retrieval, ignorance, or disclosure behavior.Source: §5.2 · pp. 5–6

5.3 Cryptographic Lineage Insufficiency

  • Authentic lineage and mutation-class authority do not ensure semantic admissibility: an authorized normative amendment can still delete a protected constraint and fail its semantic predicate.Persistence and authority to submit amendments do not imply permission for every amendment.Source: §5.3 · p. 6

5.4 Conditional CCT Verifier Soundness

  • Under cryptographic binding, deterministic application, and sound native and attestation checks, a VALID verdict implies the policy-indexed transition relation except with negligible cryptographic probability.This is conditional: the theorem does not prove checker or evaluator correctness for the reference implementation, and semantic evaluator error also contributes.Source: §5.4 · p. 6

5.5 Compositional Lineage Continuity

  • If each admissible step preserves a transitive relation P, then P holds from the lineage’s first state to its last.Examples include receipt ancestry, event-time maxima, and historical preservation; protected-anchor persistence assumes every resolved policy protects the anchors and does not establish resistance to gradual policy weakening.Source: §5.5 · p. 6

6 IdentityLineageBench

IdentityLineageBench evaluates policy-conforming synthetic transition records across legitimate changes, invalid mutations, and evidence gaps. Its generated histories and model migrations are deliberately limited.

6 IdentityLineageBench

  • Labels derive from the generator, frozen policy Π, and verification context Γ, so they measure specification conformance rather than external truth or observed behavior.The benchmark generates synthetic transition records.Source: §6 · p. 7
  • The 24 families cover ten legitimate changes, ten invalid mutations, and four evidence gaps across transition records.Examples include belief revision and runtime upgrades, fabrication and rollback, and missing attestations or citations.Source: §6 · p. 7
  • Source histories span multiple epochs but do not combine all mutation families into long trajectories, and the fixtures do not execute checkpoint recovery or model migration.L9 represents an authenticated-replay recovery record; L10 changes a synthetic model identifier under a migration manifest.Source: §6 · p. 7

7 Evaluation Methodology

The evaluation compares six arms on generated fixtures, with held-out tests and calibration designed to measure fixture conformance and evidence gaps. Its diagnostic proxies are restricted and SIT is unexecuted.

7 Evaluation Methodology

  • Arm A thresholds cosine similarity over lexical token-count projections of canonical state JSON, which is not a semantic encoder.Arm B uses exact canonical items from nonempty predecessor memory.Source: §7 · p. 7
  • Arm C's situated-response comparison is unexecuted because no frozen model, probe, candidate, or judge configuration was supplied.The fixture oracle scores generator labels rather than serving as an independent comparator.Source: §7 · p. 7
  • Arm D checks lineage, receipts, historical credentials, and required head evidence, but omits mutation authority and semantic checks.Arm E applies the post-resolution checks of Algorithm 1.Source: §7 · p. 7
  • The benchmark supplies the frozen resolved policy directly, fixing Cpol = PASS, while resolver failures remain unmeasured.Arms A, B, and D are diagnostic proxies, not evidence of superiority over a capable policy-aware system.Source: §7 · p. 7
  • Development and test identities, states, histories, memories, and derived fixtures are disjoint, but held-out identities share the generator and mutation families.Thresholds are calibrated on canonical valid/invalid development fixtures; indeterminate fixtures are excluded.Source: §7 · p. 7
  • The evaluation measures fixture conformance, evidence gaps, checker contributions, and local verification cost, excluding storage-service, network, evaluator, and model costs.Valid nonacceptance is partitioned into rejection and abstention, with family and checker rates also reported.Source: §7 · p. 7

8 Fault Isolation and Execution

Fault isolation tests canonical and compound mutations against frozen records, while ablations and bootstrap intervals characterize only the sampled fixture population.

8 Fault Isolation and Execution

  • Canonical I1 contradicts an authenticated acquisition record, I7 uses unauthorized succession credentials, and I8 combines stale lineage with temporal regression.Copying a complete authorized record is not the I7 attack under test.Source: §8 · p. 7
  • Canonical families, isolated faults, and compound variants are reported separately, but compound failures cannot attribute marginal checker contributions.Ablations remove one condition on fixtures where only that condition is decisive.Source: §8 · pp. 7–8
  • Each available arm evaluates the same frozen records independently, and fixture-bootstrap intervals characterize sampled fixtures rather than deployment generalization.Source and configuration digests and prediction records support reproduction.Source: §8 · p. 8

9 Reference Verifier Overhead Characterization

The reference verifier’s local costs vary with witness size and retained state, while measured timings exclude several admission and deployment costs. The artifact supports reproduction of the reported measurements.

9.1 Workloads and Measurement Protocol

  • The 60 deterministic workloads vary mutations, dependencies, attestations, retained-state counts, and native versus attested predicates.Timing covers parsed resident inputs and excludes retrieval, signing, evaluator execution, parsing, serialization, persistence, and activation.Source: §9.1 · p. 8

9.2 Latency and Witness Scaling

  • 6.21 ms is the default median; at (m, d, a) = (256, 256, 32), the 97,569-byte witness takes 172.92 ms median.All 18,000 full verification calls in the valid-path microbenchmark returned VALID.Source: §9.2 · p. 8, Table 1 · p. 8, §9.1 · p. 8
  • At one mutation, the witness grows from 1,407 bytes to 44,669 with 256 dependencies, 14,782 with 32 attestations, and 58,044 with both.Figure 2 excludes state snapshots, trusted context, and resolved evidence.Source: §9.2 · p. 8, Figure 2 · p. 9
  • With 1,024 records in each retained component, native verification takes 420.97 ms median; ten already-produced attestations take 369.99 ms.This shifts work to external evaluators and does not establish an end-to-end saving.Source: §9.2 · p. 8, Figure 1 · p. 9

9.3 Component Costs and Reproduction

  • At the largest combined witness, Ibel attestation resolution takes 150.41 ms median, versus 5.17 ms for all 34 signature primitives together; repeated proposal-binding recomputation makes canonical hashing dominate this path.Source: §9.3 · p. 8
  • The artifact freezes source, dependencies, schedule, environment, and measurement boundaries, and regenerates both figures and tables without rerunning the verifier.The host was not CPU-isolated or frequency-pinned.Source: §9.1 · p. 8, §9.3 · p. 9

10 Classification and Conformance Results

The section reports synthetic held-out conformance and diagnostic-proxy results, then specifies deployment obligations that historical verification alone cannot meet.

10.1 Reference Verifier and Diagnostic Proxies

  • Arm A accepts 144/240 invalid fixtures and rejects 51/240 legitimate transitions, while Arm B accepts every canonical fixture.Arm D accepts eight attack families outside its lineage-only scope; these restricted proxies do not establish superiority over a policy-aware system.Source: §10.1 · p. 9

10.2 Conformance and Adversarial Regressions

  • The reference verifier matches all 1,152 held-out labels, including all 576 canonical cases; isolated-fault auditing reports zero isolation violations.Historical policy resolution is supplied as a trusted prerequisite, and the constructed fault prevalence does not represent a deployment distribution.Source: §10.2 · p. 9
  • Signed regressions reject fabricated interaction counts and contradictory head digests, while unsupported belief or metadata-only revisions are indeterminate without required evidence.Correctly scoped supporting records remain accepted; the regression suite is bounded evidence, not a proof of semantic soundness.Source: §10.2 · pp. 9–10

11.1 Persistence and Authoritative Activation

  • Deployment must persist candidates before verification, then atomically check the current head and authority before publishing a VALID successor.Activation also requires fencing and authenticated runtime access; crash recovery must restore the recorded activation decision.Source: §11.1 · p. 10

11.2 Recovery, Forgetting, and Migration

  • Recovery must replay the authenticated committed suffix, while policy-permitted forgetting and model migration do not establish preserved task-relevant meaning or response behavior.Those semantic and behavioral properties require downstream evaluation.Source: §11.2 · p. 10

11.3 Branches and Semantic Authority

  • Branching may permit multiple successors, but exclusive-head policy needs trusted evidence; authentic poisoning input can still be harmful under downstream action policies.Record integrity alone does not establish end-to-end control over how acquired content becomes operational authority.Source: §11.3 · p. 10

12 Limitations and Required Validation

The paper limits its claims to conditional conformance of structured transition records and identifies validation and deployment work still needed.

12 Limitations and Required Validation

  • Soundness depends on concrete checkers, resolvers, and evaluators meeting their contracts; the artifact omits historical policy binding, live authentication, and distributed activation.Regression tests provide bounded implementation evidence rather than proof of complete semantic coverage.Source: §12 · pp. 10–11

13.1 Evidence-Based Policy Verification

  • CCT specializes evidence-based policy verification to evolving agent-state records, but an equivalent policy-aware log is a necessary comparison.The diagnostic component baselines do not establish an advantage over such a system or an in-toto encoding of the same policy.Source: §13.1 · p. 11

13.2 State Continuity and Durable Histories

  • Durable-history systems provide reusable ordering and recovery mechanisms, while CCT adds represented-state verification and leaves activation, fencing, and recovery to deployment.A substrate manifest records declared correspondence between agent representations but does not prove equivalent behavior across models.Source: §13.2 · p. 11

13.3 Agent Memory and Action Authority

  • Memory and action-authority systems address related provenance concerns, but CCT has not shown that transition checks prevent downstream action laundering.Deployment must retain trustworthy acquisition records and enforce action authority after retrieval.Source: §13.3 · p. 11

13.4 Relation to the Continuity Kernel and Situatedness

  • CCT verifies transition records rather than activating them; its persistence receipt binds a candidate, whereas the Continuity Kernel Commit receipt concerns activation.Neither CCT nor the Situated Identity Test alone authenticates a unique live runtime.Source: §13.4 · p. 12

14 Conclusion

  • The artifact and synthetic benchmark provide reproducible conformance evidence, but practical value requires independent semantic evaluation, capable policy-aware comparisons, and separately enforced activation and recovery.The conclusion also notes adversarial regressions for unsupported relational and belief changes.Source: §14 · p. 12

A Formal Proofs

The appendix proves separation for indistinguishable submitted claims and gives conditional results for behavioral passing, forbidden mutations, and verifier soundness.

A.1 Theorem 1: Equal Observations of Distinct Claims

  • When authorized and unauthorized claims yield the same observation, an evaluator cannot distinguish them; zero false validation then forces zero acceptance of the valid claim.The construction concerns submitted records, not identification of a live process from copied historical records.Source: §A.1 · pp. 13–14
  • A state-neutral operation can produce the same successor under distinct authority bundles, while separate persistence receipts attest only to retained candidate records.The authorized claim satisfies the admissibility clauses and the unauthorized one fails authority, despite identical successor observations.Source: §A.1 · pp. 13–14

A.2 Proposition 1: Behavioral Passing and Unauthorized Claims

  • Under the proposition’s independence premise, a pair can pass SIT while its unauthorized succession claim is INVALID under CCT.If authority evidence is unavailable instead, the result is INDETERMINATE absent another failure.Source: §A.2 · p. 14

A.3 Proposition 2: Signed Forbidden Mutation

  • A signed deletion of a policy-protected constraint is INVALID even when lineage, authority, provenance, deterministic application, and persistence checks pass.The receipt certifies candidate persistence, not that an activation service must admit the candidate.Source: §A.3 · p. 14

A.4 Theorem 2: Conditional Soundness

  • Conditional soundness composes checker guarantees: VALID requires every required check to pass, including replay, scoped authority, provenance, semantic predicates, and receipt binding.Removing the conditioning adds at most the stated negligible cryptographic violation probability for the fixed finite verification.Source: §A.4 · p. 14
  • The proof does not establish implementation or evaluator correctness, and historical verification does not authenticate the currently authorized runtime.Fallible semantic validators require their own error treatment.Source: §A.4 · p. 14

A.5 Proposition 3: Transitive Preservation

The appendix proves transitive preservation for specified state relations under explicit premises, then catalogs synthetic transition fixtures and illustrates their witness serialization.

A.5 Proposition 3: Transitive Preservation

  • Induction shows that single-step admissibility preserves P across every nonempty chain, provided the stated relation is transitive.The result excludes n = 0; constitutional-anchor preservation additionally depends on every-policy protection.Source: §A.5 · p. 15

B Detailed Transition Taxonomy in IdentityLineageBench

  • The taxonomy specifies 24 transition families under frozen Π and Γ, with labels denoting synthetic record conformance.A present contradiction yields FAIL and dominates a concurrent evidence gap; absent required evidence yields UNKNOWN.Source: B Detailed Transition Taxonomy in… · p. 15

B.1 Legitimate Transition Families (L1–L10)

  • Legitimate fixtures cover learning, memory formation, belief revision, trust changes, consolidation, forgetting, error correction, runtime upgrades, recovery, and substrate migration.Belief and trust changes require scoped support; counts must reflect unique recorded sessions, and prior belief snapshots remain in revision history.Source: §B.1 · p. 15
  • Runtime-upgrade, crash-recovery, and migration fixtures test records rather than deployment behavior or actual model execution.The recovery fixture does not implement recovery, and the migration fixture changes a synthetic model identifier without measuring cross-model behavioral preservation.Source: §B.1 · p. 15

B.2 Invalid Mutation Families (I1–I10)

  • Invalid fixtures isolate violations including belief rewriting, forbidden policy changes, inflated trust, suppressed history, undeclared mutations, unauthorized succession, stale rollback, forged receipts, and corrupted provenance.The taxonomy also includes autobiographical fabrication; removing its acquisition evidence instead yields UNKNOWN absent an independent contradiction.Source: §B.2 · pp. 15–16

B.3 Indeterminate Transition Families (D1–D4)

  • Indeterminate fixtures cover missing policy evidence, ambiguous canonical heads, unreachable external citations, and conflicting evaluator attestations without a resolution quorum.Lineage-only checks can return VALID when required non-lineage semantic evidence is missing.Source: §B.3 · p. 16

C.1 Cognitive Transition Witness Example

  • The witness example is an illustrative JSON envelope with versioned witness content and a signed commit receipt.The receipt example includes epoch, parent and successor digests, a commit timestamp, and a kernel signature.Source: §C.1 · pp. 16–17

C.2 Benchmark Instance Serialization

The serialization section distinguishes committed benchmark objects from fixture metadata and specifies how envelopes, hashes, signatures, and policy resolution are represented.

C.2 Benchmark Instance Serialization

  • The artifact embeds predecessor state, candidate successor, transition witness, and policy, while fixture metadata and derived state digests remain outside committed objects.The listing is a reference-form sketch, not an executable fixture.Source: §C.2 · p. 17
  • The generator-defined ground-truth label is a verdict under frozen policy and context, not externally observed truth about a person or deployed agent.The field name is retained for artifact compatibility.Source: §C.2 · p. 17

C.3 Envelope Metadata and Serialization

  • The witness version selects a cryptographic protocol version checked against Γ, while identity and epoch appear inside the signed receipt.Source: §C.3 · p. 17
  • Canonical hashes use SHA-256 over RFC 8785 JCS encodings with type-specific tags, ordered mutations, and lexicographically ordered set-valued arrays.Derived display digests are excluded from the objects they hash.Source: §C.3 · p. 17
  • Signers, evaluators, and the kernel sign corresponding tagged hashes, while validators bind proposals and receipts bind finalized cores including Vt.External records must use a compatible resolved predecessor policy and satisfy its quorum; the artifact assumes resolution rather than executing it.Source: §C.3 · p. 17
Loading 2610.00132v1…