Runtime guarantees and boundaries

This is a guide to the documented release’s contracts. Exact type and implementation details are linked from the Python reference and the release’s runtime contracts.

Construction and ownership

One factory call creates one process-scoped application graph. A session has its own recorded execution identity. Multiple processes coordinate through configured durable stores, claims and fences; sharing a Python object is not the coordination mechanism.

Imports remain inert with respect to active services. Server, worker and run entrypoints explicitly own long-running execution. Construction can perform bounded setup such as opening the selected local store.

Authority

Tool discovery, argument validation, effect classification and execution authorization have different roles. Schema validity does not grant permission. Approval is scoped to its exact action and checks the normal actor/policy boundary. External content cannot authorize capabilities just because it appears in the model context.

Host-process tools are trusted application Python. Use the appropriate execution boundary for untrusted commands. Authentication establishes caller identity; application/store design establishes data isolation.

Durable continuation

Recorded sessions retain history and continuation state. Recovery respects execution ownership and blockers. A pause awaiting input or approval belongs to that exact pending action; an unrelated message is not a replacement resolution.

External mutations need their own stable operation identities, reconciliation and receipts. A missing result may mean the mutation succeeded but acknowledgement was lost. Durable runtime state alone does not prove exactly-once business effects.

Completion and failure

Consume terminal session evidence. session.failed can appear in the event stream; do not rely only on Python exceptions. Structured output success establishes schema validation, while domain assertions establish whether the content is correct.

Cancellation and cleanup are bounded lifecycle work. When cleanup cannot settle, preserve the outcome as unknown or retryable rather than inventing success. A process shutdown does not prove that a remote environment or service was removed.

Evaluation evidence

Candidate outcome, evaluator outcome, runtime health and evidence availability remain distinct. Historical trajectory grading does not rerun a changed agent. Deterministic providers prove execution behavior for their fixtures; live quality requires a fresh candidate run and appropriate assertions.

Read execution, authority, durability, recovery and evaluation for concrete applications of these boundaries.