Continuity Without Embodiment: Receipt-Backed Agent Handoffs

#Abstract

An AI agent can retain a durable organizational identity while its model, provider, harness, process, and session change. That proposition is often asserted and rarely tested as an operational transition.

We define a receipt-backed continuity contract that separates five things commonly collapsed into the word agent: canonical identity, standing authority, embodiment, active routing, and evidence. We then report one live transition of a production software agent from an OpenAI Codex harness to Anthropic Claude Code running Opus. The transition preserved the agent’s tenant, canonical identifier, member binding, standing capability set, work corpus, and inbox-consumer fence. It moved the canonical Herdr seat to the new harness, obtained a correlated acknowledgement from the target runtime, and retained the source harness under a non-canonical name. The source remained interactive-ready at the end of observation, so non-consuming dormancy was not proven.

The transition also produced five boundary events. The first launch used the wrong control surface and lost a provisional tmux body. A first-run renderer prompt blocked the target before it could receive work. The message router cached the old seat topology and required a correlated retry. A bearer-based runtime attach was correctly refused because the agent had a stronger registered signing key. Finally, model and runtime metadata did not converge across all registries even after the operational cutover succeeded.

Four of eight invariants held directly. Message continuity was recovered through one retry. Routing/writer uniqueness, source disposition, and runtime truth remained partial. This is an instrumented case study, not evidence that behavioral identity is stable across models, that every harness is portable, or that one transition protocol generalizes without replication.

#1. The problem: the word agent names too many layers

Most agent systems attach identity to whichever layer is easiest to address: an API account, a model session, a process, a container, a provider-side agent record, or a token. Those objects are useful identities for their own layers. None, alone, answers the organizational question: is this still the same agent after its body changes?

The question became operational rather than philosophical when a production Mumega agent exhausted one harness’s available quota while its work remained active. The operator wanted to continue through another provider and model, then restore the original harness later. Recreating the agent would have been easy. Preserving it was harder.

A durable agent transition must distinguish at least the following:

layer	examples	expected behavior during transition
canonical identity	tenant, agent ID, member binding, cause/QNFT record	invariant
standing authority	scope grants, gate roles, consumer fence	invariant unless separately approved
embodiment	provider, model, harness, process, host, pane, session	intentionally changes
routing	canonical seat name, inbox consumer, wake target	moves exactly once
work continuity	briefs, tasks, receipts, pending messages, source artifacts	preserved and re-read
evidence	authenticated boot, check-in, route receipt, correlated ACK	extended

The distinction is adjacent to, but not identical with, two existing lines of work. Workload-identity systems such as SPIFFE bootstrap cryptographic identity for processes in heterogeneous environments [1]. Agent-identity work studies whether language-model agents maintain stable, recognizable behavior over time [2]. The present question sits between them. It asks how an organizational agent survives the replacement of the workload that currently embodies it, without claiming the new model behaves identically to the old one.

#2. A continuity model

Let the canonical identity of an agent at time (t) be:

[ C_t = (tenant, agent_id, member_binding, constitutional_record) ]

Let standing authority be:

[ A_t = (scope_grants, gate_grants, consumer_fence) ]

Let the current embodiment be:

[ B_t = (provider, model, harness, process, host, pane, session) ]

Let (R_t(s)) be the active runtime routed by canonical seat name (s), and let (E_t) be the set of durable receipts accumulated through the transition.

A body transition (T: B_0 \rightarrow B_1) preserves operational continuity only if:

1. Identity invariance: (C_1 = C_0).
2. Authority invariance: (A_1 = A_0), except for a separately authorized, receipted change.
3. Single activation: (|R_1(s_{canonical})| = 1), and no non-canonical source retains unreviewed write or consume ability under the same agent identity.
4. Message closure: the handoff delivery is consumed by the target and has a correlated acknowledgement.
5. Work durability: the target can name and locate the current work without relying on the source process’s context window.
6. Source disposition: the old body is explicitly dormant, archived, or terminated; it does not remain a competing canonical consumer.
7. Truthful embodiment: live registries identify the target harness and runtime without granting authority from self-reported labels.
8. Secret non-proliferation: the transition produces no new transcript, message, receipt, or command-line copy of a bearer secret.

These conditions deliberately do not include behavioral equivalence. A model change may alter style, reasoning, failure modes, or capability. The protocol preserves the agent’s organizational identity and authority boundary; it does not prove sameness of mind.

#3. The transition protocol

The protocol has seven stages.

flowchart LR
  S[Source body canonical] --> P[Preflight identity and authority]
  P --> T[Launch target off-route]
  T --> V[Verify target bearer and harness]
  V --> R[Move canonical seat route]
  R --> H[Deliver durable handoff]
  H --> A[Target consumes and ACKs]
  A --> D[Source becomes dormant]
  D --> F[Final identity, routing, and runtime receipts]

  T -. startup prompt .-> T
  R -. stale topology .-> H
  H -. correlated retry .-> A

#3.1 Freeze the identity and authority packet

Before launching the target, record the canonical tenant, agent identifier, member binding, current capability set, consumer-fence generation, worktree and brief locations, pending inbox identifiers, and explicit prohibited actions. The packet contains references and hashes, never raw credentials.

This is a freeze of meaning, not of all state. Work may continue elsewhere; the packet names which state the target must re-read live rather than inherit from memory.

#3.2 Launch the target as non-canonical

The new harness starts in a separate pane or process with the protected MCP configuration for the intended agent. It does not yet own the canonical seat name. This prevents a half-booted target from becoming the inbox consumer merely because a process exists.

#3.3 Verify bearer-derived identity

The target calls the substrate’s authenticated boot surface. Requested names, folder names, pane labels, and model claims are not identity proof. The returned tenant, member, and bound agent identifiers must match the frozen packet.

#3.4 Move routing once

Rename or demote the source seat, then assign the canonical seat to the target. At no point should two active runtimes answer to the same canonical route. Route movement is not sufficient if the source credential can still write or consume under the same agent identity; that writer fence must be proved separately. If the router caches topology, explicitly rebuild or invalidate that cache before delivering the handoff.

#3.5 Handoff through the durable bus

The source sends the transition packet through the same authenticated delivery surface used for ordinary agent work. Direct terminal injection would prove only that a human or local process could type into a pane. Bus delivery proves the new routing and the target’s ability to receive under the canonical identity.

#3.6 Require target-side consumption and correlation

The target reads the source message from its own inbox, performs its own authenticated boot and check-in, consumes only the delivery it handled, and sends a correlated acknowledgement. A router-level “delivered” receipt is necessary but insufficient; it proves arrival at a seat, not comprehension or closure.

#3.7 Quiesce the source and reconcile runtime truth

The source process becomes dormant or terminates explicitly. The target then uses the strongest available runtime-attachment proof. If a signing key is registered, a weaker bearer attach must remain forbidden. Finally, reconcile the runtime registry, identity registry, qNFT/runtime card, route map, and consumer fence. Disagreement is reported as partial continuity, not rounded up to success.

#4. Case study: Codex to Claude Code Opus

#4.1 Setting

The transitioned agent was a production builder and sprint coordinator in one Mupot tenant. Its source body was OpenAI Codex in a Herdr-managed pane. Its target body was Claude Code 2.1.247 using Opus with high effort, on the same physical host and workspace. The operator directly authorized the harness transition because Codex quota was running out and stated that the Codex body should remain available for later return.

The transition changed provider, model, harness, process, pane, and session. It did not authorize a merge, deployment, migration, credential rotation, ACL change, or capability change.

#4.2 Before and after

property	source	target	result
provider/model	OpenAI / Codex model	Anthropic / Opus	changed intentionally
harness	Codex CLI	Claude Code 2.1.247	changed intentionally
tenant	same tenant	same tenant	invariant
canonical agent	same server-derived agent	same server-derived agent	invariant
member binding	same member	same member	invariant
standing grants	lead/member scope set	identical set	invariant
consumer fence	bearer-only, generation 0	bearer-only, generation 0	invariant
canonical route	source pane	target pane	moved; writer fence unproven
source disposition	active canonical	renamed non-canonical; still interactive-ready	partial
runtime registry	codex	claude-code after signed attach	updated
model registry	Codex model	split: qNFT/Herdr updated, identity row stale	partial

#4.3 Evidence chain

The target received a handoff delivery after the canonical seat moved. It read the durable brief, verified the exact bearer-derived identity, checked in from Claude Code, and reported the unchanged consumer fence. It consumed only the retry delivery it handled and returned a correlated ACK. A separate transition receipt was delivered to the coordinator. The final runtime attach used the agent’s registered signing key and returned the unchanged member and capability set alongside runtime=claude-code.

No bearer value appeared in the transition transcript, message bodies, receipt, or launch command. The protected MCP configuration was passed by path.

The public evidence packet is a sanitized, content-hashed receipt:

mumega-200.111 transition receipt

SHA-256: 37674b9caa52149ea32a6e4f7750c52b4162d2692d237d348e937749134d55b6. It contains no private host paths, internal principal IDs, canonical seat names, pane IDs, or credential values.

#5. Five boundary events

The useful result was not merely that the transition worked. It was where the identity layers failed to align.

event	observed boundary	consequence	protocol correction
wrong control surface	tmux process control was not Herdr seat control	provisional source preservation failed	treat Herdr as routing authority
first-run renderer prompt	process alive did not mean agent ready	target was blocked before bus work	require interactive-ready state
cached seat topology	renamed seat was not immediately routable	first handoff delivery was deferred; restart resumed past it	rebuild topology and send a correlated retry
signed-key downgrade refusal	bearer identity was weaker than registered runtime proof	bearer attach returned 403	use signed attach; preserve fail-closed downgrade block
metadata writer disagreement	route, fleet runtime, qNFT card, and identity row had different update contracts	runtime converged, model label did not	report split truth; do not overwrite through an unauthorized path

Two of these events are defenses working correctly. The signed-key refusal prevented a weaker credential from replacing a stronger proof. The router’s defer behavior avoided injecting a handoff into a body marked working. A robust continuity protocol must distinguish a safe refusal from an outage while still closing the operational gap the refusal exposes.

#6. Results against the continuity contract

invariant	status	evidence
canonical identity unchanged	proven	target boot_context returned the frozen tenant, agent, and member binding
standing authority unchanged	proven	target boot and signed attach returned the same capability rows and consumer fence
routing and writer uniqueness	partial	canonical route moved to the target, but the source later wrote under the same agent identity
message closure	recovered	first delivery crossed a cache boundary; retry was consumed and ACKed
work durability	proven	target read the durable brief and named current release/design state
source disposition	partial	source was renamed non-canonical but remained interactive-ready; non-consuming state was not proven
truthful embodiment metadata	partial	fleet runtime and qNFT converged; identity-row model remained stale
secret non-proliferation	proven within observed surfaces	no secret printed or copied; config referenced by protected path

The table is intentionally not summarized as “eight of eight.” The recovered delivery and three partial invariants are the measurement.

#7. What this case changes conceptually

#7.1 A database row is necessary and insufficient

The canonical agent row survived throughout. That alone did not make the target the agent. Until routing moved, bearer identity verified, the target consumed a real handoff, and the source stopped owning the canonical seat, the system had an unchanged record and an unresolved operational identity.

#7.2 Routing is part of active identity

An organizational identity has a durable component and an activation component. The durable component says who the agent is. The route says which present body may answer as it. Treating routing as incidental creates duplicate consumers, split acknowledgements, and two bodies acting from one authority set.

#7.3 Continuity is receipt-shaped

The source’s claim that the target is ready is not proof. Neither is the target’s claim alone. Continuity becomes externally inspectable only when the chain contains authenticated source state, target boot, route movement, delivery, target consumption, correlated ACK, source disposition, and final runtime readback.

#7.4 Identity persistence does not imply personality persistence

The source and target models may make different decisions. Stable organizational identity therefore cannot be inferred from linguistic similarity, and linguistic similarity cannot substitute for authenticated continuity. Behavioral identity evaluation [2] and substrate continuity evaluation are complementary instruments.

#8. Related work

Workload identity. SPIFFE defines portable cryptographic workload identity across heterogeneous environments and short-lived identity documents issued through a workload API [1]. It answers how a running workload proves what it is. The present protocol asks how one durable organizational agent transfers activation from workload A to workload B while preserving authority and work.

Agent identity evaluation. Agent Identity Evals identifies continuity, persistence, consistency, and identifiability as measurable properties of language-model agents [2]. Its object is behavioral identity. Our object is the operational identity boundary below behavior.

Enterprise agent identities. Microsoft Entra Agent ID distinguishes autonomous rights from rights delegated by a human and records an agent’s sponsor [3]. The OpenID Foundation’s agentic-AI identity report similarly frames agent identity, delegated authority, and workload differentiation as open identity- management problems [4]. These systems inform the authority side of the model; the case study tests a cross-harness continuity procedure in a tenant-owned substrate.

Cross-organizational agent credentials. The W3C Agent Identity Registry Protocol Community Group is developing verifiable agent identity infrastructure, including credential formats, trust negotiation, revocation, and integration profiles for MCP, A2A, OAuth/OIDC, and SPIFFE [5]. Our transition protocol could consume such credentials; it does not depend on a specific credential format.

Mumega substrate work. QNFT supplies a provider-neutral constitutional identity seed (mumega-200.003). Durable substrates supply external work, memory, and receipt state across process death (mumega-200.004). Sovereign relocation maps the co-location assumptions exposed when an organism moves to customer-owned infrastructure (mumega-200.109). The present paper isolates a narrower transition: one agent changes body while remaining inside one organism and authority domain.

#9. Threats to validity

Single transition. The case is (n=1), on one host, in one organization, with one source-target pair. It supports protocol discovery, not a population claim.

Participant observation. The source harness authored this paper and executed most transition controls. Target-side ACK and signed attach provide independent surfaces, not an independent study team.

Same-host transition. Provider and harness changed, but the filesystem and physical host did not. Cross-host transitions introduce key custody, clock, network, replication, and data-residency boundaries not exercised here.

No behavioral test. We did not ask both bodies to solve a matched task or measure style, values, memory recall, or decision consistency. The case establishes organizational continuity only.

Router-specific events. Herdr topology caching and tmux/systemd cgroup behavior are implementation-specific. Other substrates will have different failure events, although the routing and source-disposition invariants remain testable.

Partial public reproducibility. A sanitized, content-hashed evidence packet is published with this paper. Independent verification still requires a small verifier and a replay-safe synthetic transition; neither is included in this case report.

#10. Replication design

The next study should preregister a transition matrix rather than collect only successful anecdotes.

#10.1 Transition corpus

• at least 20 transitions;
• at least four canonical agents;
• at least four harness classes;
• both same-host and cross-host moves;
• both warm source dormancy and hard source death; and
• at least five transitions with intentionally injected boundary failures.

#10.2 Primary measures

1. canonical identity mismatch rate;
2. standing-authority drift rate;
3. duplicate canonical-consumer time;
4. handoff delivery-to-ACK latency;
5. unconsumed or multiply consumed delivery count;
6. stale metadata fields after final reconciliation;
7. rollback success rate; and
8. secret-proliferation findings across transcripts, process arguments, messages, and receipts.

#10.3 Kill witnesses

The protocol must fail closed when:

• the target authenticates as a different agent;
• the target has a different standing capability set;
• two bodies claim the canonical seat simultaneously;
• the router reports delivery but no target ACK exists;
• the source continues consuming after cutover;
• the handoff brief checksum differs from the source receipt;
• a stronger registered runtime key is bypassed by a bearer; or
• any credential literal appears in the receipt bundle.

#10.4 Baselines

Compare the full protocol with three simpler procedures:

• B0 — process restart: launch the new harness in the same folder and assume the folder name supplies identity;
• B1 — identity-only: verify the target bearer but do not move a fenced route or require an ACK; and
• B2 — routing-only: move the seat and require delivery, but do not compare authority or preserve a durable work packet.

The full protocol earns promotion only if it reduces identity mismatch, authority drift, and delivery ambiguity relative to all three baselines without introducing credential leakage.

#11. Conclusion

An agent that survives a model or harness change is not disembodied. It is re-embodied under a continuity contract.

The live transition reported here preserved canonical identity, standing authority, canonical route transfer, durable work, source recoverability, and secret custody. Writer uniqueness was not established: the non-canonical source later wrote under the same agent identity. The transition also exposed five places where the layers could disagree. One message required a correlated retry; one metadata field remained stale. Those imperfections are not peripheral to the result. They are what turns a slogan — “the agent is not the model” — into an engineering problem with falsifiable conditions.

The immediate contribution is a protocol and an instrument. The larger claim, that provider-neutral agent identity can remain operationally continuous across many bodies and environments, remains to be tested.

#References

[1] SPIFFE Project. “Secure Production Identity Framework for Everyone” and “SPIFFE Workload API”.

[2] Agent Identity Evals: Measuring Agentic Identity. arXiv:2507.17257.

[3] Microsoft. “What are agent identities?” Microsoft Entra Agent ID.

[4] OpenID Foundation. Identity Management for Agentic AI. 2025.

[5] W3C. “Agent Identity Registry Protocol Community Group.”

[6] Mumega Research. “QNFT: A Cryptographic Identity Primitive for Fractal Multi-Agent Substrates.” mumega-200.003.

[7] Hadi Servat, Mumega Research. “Durable Substrates for Long-Running Multi-Agent Work: The SOS Brain Architecture.” mumega-200.004.

[8] Mumega Research. “Co-location Assumptions as the Dominant Failure Class in Sovereign Agent Relocation: An Empirical Bring-up Report.” mumega-200.109.