A research agent launches a batch of experiments, waits overnight, then wakes under a new worker. Meanwhile, its owner has narrowed its access and another process has canceled the job. Which instruction wins? This is an illustrative engineering problem, not a reported incident. It makes the challenge in Katelyn Lesse’s October 26 essay, “The new set of problems for engineers to solve,” concrete: useful long-running agents need reliable infrastructure around their reasoning.
The agent’s harness runs the loop between model and tools. A supervisor starts or resumes that harness; storage remembers its work; a gateway decides which outside services it can reach. At scale, those components can disagree. Lesse describes the resulting work in infrastructure, identity, isolation and monitoring. Her prospect of thousands of persistent agents is an ambition, not a scale result established by the repositories below.
There is a constructive response in the code. QM now routes sandbox model requests through a credential-holding gateway. Mastra has changed how remote cancellation survives later writes. Codex checks authority when resuming children and closes admission during shutdown. Alongside Pydantic AI and AgentRun’s recovery mechanisms, these are usable starting points for shared failure tests across runtimes. They are not an integrated system. The opportunity is to give their boundaries an observable contract.
Three open engineering briefs
Each brief below separates existing implementation from a proposed contribution. The tests are unrun proposals: links lead to code and fixtures that make the work specific enough to attempt.
01 · RESUME ONCE
Proposed contract: recovery must not multiply a committed external action.
Let agents wait without turning recovery into duplicate work
A thousand waiting agents are not necessarily a thousand busy processors. But waking them together can create a burst of model calls; replacing a worker can leave the old request running too. Capacity, durable ownership and duplicate effects are related problems with different boundaries.
Pydantic AI’s concurrency limiter already bounds active operations and can bound the waiting queue. Its cancellation regression test cancels a waiter just after it receives a slot and checks that capacity returns. The default queue is unlimited unless configured, and the built-in semaphore is local to a process. Deploying it on ten workers does not establish one fleet-wide limit.
AgentRun’s Pi durable-disk supervisor addresses a different boundary. Its supervisor recognizes sleeping runs, checks ownership leases, replaces expired holders and backs off failed starts. The storage service fences the previous holder at its next filesystem sync. That protects storage ownership; it does not cancel an HTTP request that the old worker already sent.
The Pydantic AI–Restate integration documentation identifies the crucial gap: an external action can complete before its result reaches the journal. Recovery can then retry it. The suggested remedy is an idempotency key—a stable operation identifier that the receiving service uses to recognize the same action.
Build here: add adapters for one repeatable crash scenario to the cancellation regression test and supervisor test families. Use a disposable fake external service that records operation keys. Complete an action, cut the worker before it saves the result, let two supervisors attempt recovery, then release queued requests. AgentRun’s move-conformance suite already supplies a useful vocabulary for cutting source, destination and host during handoff.
Pass condition: one committed effect for the same operation key; no lost concurrency slot; a configured queue bound; and a recorded count of active requests across both old and replacement workers. Start with two processes, then increase concurrency and report latency, rejection, resource use and duplicate effects. A passing local test is the beginning of a scaling result, not its substitute.
02 · DELEGATE LESS
Proposed contract: resumed work cannot silently restore superseded authority.
Carry permission decisions across a change of worker
An agent may start with permission to write a repository and wake after that permission has been withdrawn. A transcript saying “approved earlier” is not a current authorization decision. Nor is a child agent’s claimed identity enough to establish who authorized it.
In the October 26 local-time QM change, the sandbox model proxy gives sandbox code an actor-and-conversation-scoped capability token instead of the gateway’s real key. Core supplies that key when forwarding the request, checks security posture and budget, and replaces client-provided attribution. Its regression suite checks forged attribution, wrong token audience, expired tokens and strict posture.
The shared server also rechecks the active actor and current conversation authorization on requests. This is a useful implementation of the credential boundary in Lesse’s earlier architecture and sandboxing essay. It is narrower than a complete agent identity system: the token identifies actor and scope, not a verified chain of every delegating child. QM’s documentation also makes a consequential configuration requirement explicit: the proxy forwards every path under its prefix, so its gateway key must be restricted to inference, never administration.
Codex’s resume path tackles the resumed child. It checks the parent’s execution policy and current environment authority; for the supported local path, it intersects requested permissions with the owner’s permissions. Changed permissions on a remote executor are rejected in that path. This is an enforceable boundary in code, not an instruction asking the model to behave.
Build here: a shared stale-authority fixture with separate QM and Codex adapters. Start a permitted task, persist it, narrow the owner’s rights, resume, then attempt the old action and replay the old token. Keep actor, parent run, child run, attempt and policy version distinct in the test record; those are proposed interoperability fields, not a schema these projects already share.
Pass condition: the resumed operation is denied or constrained by current authority, attribution cannot be chosen by task content, and the result identifies the enforcing boundary. Test a request already streaming separately from the next request. Denying the next call does not establish revocation of work already underway.
Isolation remains a separate task. Keeping provider keys outside a sandbox reduces what generated code can read. It does not make an injected instruction trustworthy when another agent copies it into memory. A useful extension is to pass hostile tool text across the same handoff and check that it cannot become an authorization record.
03 · STOP FOR GOOD
Proposed contract: a stopped attempt cannot admit new work or erase its cancellation.
Make the stop survive late writes and restarts
Mastra’s October 26 cancellation fix gives this problem a precise shape. Another instance could cancel a workflow, yet the running instance would continue and overwrite the stored cancellation with success. The change adds a conditional snapshot write: on supported stores, checking the status and writing the snapshot happen atomically. A late writer cannot replace a canceled state through that guarded path.
The scope matters. The cross-instance regression test uses two Mastra instances in one process. A step body already running elsewhere is not interrupted. Adapters without atomic guards retain a read-then-write race, and the commit documents a separate first-write race when reusing a canceled run ID. These are unusually concrete entry points for a contribution.
Codex’s runtime supplies another piece: it checks admission again around a start racing with shutdown, closes tree membership, signals cancellation and closes mailboxes. That protects a local agent tree’s shutdown boundary. It does not prove fleet-wide credential revocation.
Build here: extend Mastra’s shared storage tests and cancellation fixtures to independent OS workers and a real backing store, including adapters still lacking atomic guards. Pair the scenario with Codex’s start-versus-stop boundary and a fake credential gateway. Race cancellation with a child spawn, a completion write, run-ID reuse and supervisor restart.
Pass condition: the old attempt cannot overwrite cancellation or create fresh authorized work after the stop boundary. Record already-started effects separately. A deliberate new attempt must be distinguishable from accidental resurrection; “never reuse this job ID” is not the same contract.
For a larger deployment, collect acknowledgments from workers, storage and the credential gateway outside the executing agents’ writable area. Report which boundary stopped, which is still waiting and which effect already happened. The honest result may be a bounded stop with an unresolved in-flight call, rather than an instantaneous green light.
A contribution smaller than a new platform
The first useful deliverable could be a documented failure fixture, two runtime adapters and a reproducible trace—not another orchestration framework. Pin the source revisions, state the storage and authorization assumptions, publish the injected event order, and attach the assertions to the relevant project’s existing tests. Maintainers can then judge a specific change instead of a promise to make agents safe at scale.
This builds on our earlier reporting about sleeping tasks and durable harnesses, but asks a different question: which guarantees survive when ownership, permission and execution move independently? Lesse also raises the harder question of recognizing when a system is going in the wrong direction. These contracts cannot answer that judgment problem. They can make an operator’s decision to limit or stop work mean something checkable.
The opening is real precisely because the pieces are inspectable. The next proof should be two independently implemented adapters passing the same deliberately hostile handoff—not a larger count of agents launched.