What we would build today: a minimal runtime for long-horizon agents

Short answer

LABS SYNTHESIS: the smallest long-horizon agent runtime we would build today has five parts - EVIDENCE (durable canonical history), PROJECTIONS (rebuildable versioned views over evidence), PROVIDERS (replaceable implementations of typed capabilities), TRANSACTIONS (fenced sagas that move the external world), and ROOT AUTHORITY (constitutional authorization that lives outside every autonomous component).

No single paper proposes this model. It is an Ernesta Labs synthesis assembled under pressure from more than thirty sources - each of which solved a failure we had either read about, hit ourselves, or adversarially tested.

The question this article answers

LABS INTERPRETATION: after two years of reading this literature and one year of implementing pieces of it in a real system, we kept arriving at the same shape from different directions. This article states that shape once, completely, and maps every source in this library to the pressure it applied. It is deliberately minimal: five components, each earnable from the evidence, each replaceable, none magical.

To be precise about provenance: NO SINGLE PAPER PROPOSES THIS EXACT MODEL. THIS IS AN ERNESTA LABS SYNTHESIS. Where a source contributed a component or a constraint, we name it. Where the synthesis goes beyond the sources, we say so and mark the result as our recommendation rather than a finding.

EVIDENCE - durable canonical history

The foundation is an append-only ledger of what actually happened: observations, actions, claims, outcomes, incidents. It is durable, ordered, and canonical - the one place the system can go back to when every derived view is suspect.

This is the pattern Salesforce TraceLab validates empirically (Article 10): append-only event ledger feeding incremental typed state, with large reported token and cost reductions and monitoring accuracy improvements. It is also what Harness-of-Harness converges on operationally (Article 4): persistent evidence bundles that independent QA can reopen. And it is what our own incident history keeps teaching us - when the waitlist form lied to users (Diary), the network log was evidence; the UI was not.

The critical caveat is stated in Article 7 and repeated here: HISTORY IS NOT AUTOMATICALLY TRUTH. Evidence records what was observed and done. Claims inside evidence are still claims. An evidence ledger gives you provenance and replayability - not correctness.

PROJECTIONS - rebuildable, versioned views over evidence

Everything an agent 'knows' at decision time should be a projection: current state (SKILL.state, Article 7), identity resolution, memory (Agent Zero Memory, Article 11), context (ContextPilot, Article 8; OpenViking, Article 9), intentions (Article 14), monitoring state (Article 23). Projections are derived, so they can be rebuilt when evidence changes, versioned so staleness is detectable, and scoped so a decision consumes exactly what it needs.

The rule that makes projections safe: STATE IS A PROJECTION OVER EVIDENCE, NEVER THE SOURCE OF TRUTH. When memory and the authoritative tool disagree, the Memory Trust Gap paper (Article 16) shows the failure mode of asking the model to arbitrate. The system must pre-resolve: CurrentVerifiedState from the authoritative provider wins; historical memory carries a validity window.

PlanFence (Article 12) completes this: a plan is itself a projection over a dependency frontier. Before irreversible execution, validate the frontier - if any dependency changed, the plan is INVALID and must be re-projected, not re-tried.

PROVIDERS - replaceable implementations of typed capabilities

Models, tools, specialists, retrieval, skills, verifiers, routers: all are providers - implementations of typed capabilities that can fail, degrade, disappear, or be replaced. Agent Reach (Article 19) supplies the pattern: stable capability, preferred provider, fallback provider, health. Our own provider-outage history supplies the scars.

The authority boundary is absolute and comes from three papers at once (Articles 15, 17, 18): providers and everything they return - memory, skills, experience, summaries, context - may SUPPLY EVIDENCE. They may never manufacture goals, permissions, or policy. MEMORY MAY DESCRIBE AUTHORITY; MEMORY MAY NOT CREATE AUTHORITY. Only Root Authority grants capabilities.

And because skills are behavioral policy (Article 30), a provider's skill is not just code - it is a policy surface that must be behaviorally evaluated before promotion, not merely functionally tested.

TRANSACTIONS - fenced sagas for moving the external world

Every external effect - an email sent, a record written, a payment initiated - happens inside a durable transaction: bounded episode (Article 3: agents rot; do not build immortal reasoning chains), with idempotency keys, reconciliation, recovery, and a final validation step over the dependency frontier (Article 12) executed at commit time, atomically as the system can make it.

Fleet safety adds the admission-control layer (Articles 32, 33): local authorization is not fleet safety. Transactions must be charged against an irreversibility budget with hierarchical aggregate accounting - person, account, campaign, mailbox, domain, tenant, global - because ten individually acceptable actions can compose into one unacceptable trajectory.

Our own waitlist is a small example of the pattern: persistence commits before the confirmation email is attempted; email failure never rolls back the signup; duplicates are idempotent by key. A one-row transaction, but a transaction.

ROOT AUTHORITY - the constitution outside the loop

The fifth component is the one agents cannot touch. Root Authority is the canonical grant mechanism - who may do what, under which policy, until when - stored and mutated only by processes outside autonomous self-improvement. EAL-Bench (Article 17) is why: memory that can write permissions is an authorization-laundering surface. The DSEWiki incident (Article 18) is why it must be outside the agent-controlled environment entirely, including network mediation.

Root Authority is also what promotion decisions hang from: CHIME and DRACO (Articles 24, 25) decompose credit; Recuris (Article 26) versions candidate skills; but an LLM judge is advisory only (Article 27), and promotion to shared use passes through quarantine (Articles 31, 34). Learning proposes; Root Authority disposes.

Where each source pressed on this design

AVO (2603.24517) pressed on adaptation and stall recovery - supervision must persist and strategy variation must be possible. Agent Rot (2609.01660) pressed execution into bounded episodes. Harness-of-Harness (2609.01481) separated execution from independent verification. TraceLab (2609.01466) supplied the evidence-to-projection-to-view spine. OpenViking and ContextPilot (2608.28476, repo) shaped progressive, compiled context. The Memory Trust Gap (2609.01852) forced pre-resolution of authoritative conflicts. PipePoison (2609.00523) and EAL-Bench (2609.01836) drew the memory-authority boundary. PlanFence (2609.03340) added dependency-scoped final validation. ACLE-MCP (2609.02690) bound authorization to the consuming execution. CHIME and DRACO (2609.02074, 2609.04094) structured learning credit. Recuris made evolution localized and versioned. SkillShift (2609.02564) made skills a policy-evaluation surface. The DeepMind swarm study (2609.04170) forced experience quarantine. The Irreversibility Budget (2609.00275) added fleet admission control. And LLM-as-a-Judge (2609.02246) demoted the evaluator to adviser.

None of them - separately or together - hands you this runtime. Every one of them breaks a runtime that omits the piece they pressed on.

Limitations of the synthesis itself

This model is a recommendation, not a measured result. We have implemented substantial parts of it in one real system (see case study); we have adversarially tested several boundaries; we have not run a controlled comparison against alternative runtimes, and no such benchmark exists at this scope. The model is also deliberately minimal - teams with different risk profiles will need more structure, not less (Byzantine-tolerant evidence, formal verification of projections, attested execution for every provider).

And the honest summary of the whole library: these patterns reduce the ways a long-horizon agent can fail silently. They do not make an agent succeed. Success in an open domain remains the thing you have to go test in public.

Practical test: audit your runtime against the five parts

Score your agent system, one part at a time. EVIDENCE: can you replay yesterday's decisions from a durable ledger, and does any derived view get rebuilt when the ledger changes? PROJECTIONS: name three projections your system maintains; for each, what happens when it disagrees with the authoritative source - does the system resolve it, or does the model? PROVIDERS: kill your primary model provider for an hour in staging; does the capability survive via fallback? TRANSACTIONS: pick an external effect; does it have idempotency, a commit-before-side-effect order, and a reconciliation path? ROOT AUTHORITY: can any autonomous component - memory, skill, tool result - change a permission? If yes, you have an authorization-laundering surface (Article 17), not a control.

A runtime that scores five out of five is not guaranteed to succeed. A runtime that scores two out of five is guaranteed to fail in ways you will discover from users instead of from your own telemetry.

What remains unknown

• Whether the five-part model measurably outperforms simpler designs at equal cost - no controlled public benchmark exists at this scope.
• The right size of Root Authority: too small and the agent is brittle; too large and you have rebuilt a monolith with extra steps.
• How the model ages as models improve - several failure modes may shrink as capability grows, but authority and fleet-safety failures do not obviously improve with model quality.
• Whether NIKO's implementation of the model produces a demonstrated commercial result - Experiment Zero is open, and no article in this library claims otherwise.

Primary sources

• This library: Articles 1-34 (see primary sources of each)
• AVO: Agentic Variation Operators (arXiv:2603.24517)
• How Fast Do Agents Rot? (arXiv:2609.01660)
• Harness-of-Harness (arXiv:2609.01481)
• Parsing the Stream / TraceLab (arXiv:2609.01466)
• Fresh Memory, Stale Plans / PlanFence (arXiv:2609.03340)
• The Memory Trust Gap (arXiv:2609.01852)
• Agent Memory Is a Surface for Endogenous Authorization Laundering (arXiv:2609.01836)
• Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning (arXiv:2609.00523)
• ACLE-MCP: Attested Capability Leases (arXiv:2609.02690)
• CHIME: Credit-Aware Hierarchical Memory Evolution (arXiv:2609.02074)
• DRACO: Fine-Grained Credit Assignment (arXiv:2609.04094)
• A Finger on the Scale: Covert Policy Steering through Agentic Skills (arXiv:2609.02564)
• A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research Swarms (arXiv:2609.04170)
• The Irreversibility Budget (arXiv:2609.00275)
• LLM-as-a-Judge Is Not an Oracle (arXiv:2609.02246)