This manifest is the dependency contract for the curated Git history. Each stage must be green and must not contain capabilities assigned to later stages. Commit dates are ordinary reconstruction dates; none are backdated.
| ID | Subject | Contains / tests / invariant | Intentionally absent |
|---|---|---|---|
| C01 | chore: establish AgentFoundry project foundation |
Packaging, shared identity/version contracts, audit, CI, test harness. Tests reject empty identity. Invariant: every scoped operation can carry tenant identity. | Runtime, tools, planning, state, policy, multi-agent |
| C02 | feat(runtime): add typed single-agent execution baseline |
Model protocol, fake model, validated response and usage/latency record. Tests invalid output and accounting. | Tools, RAG, memory, multi-agent |
| C03 | feat(tools): introduce typed tool contracts and safe dispatch |
Registry, schemas, semantic validation, capability checks, timeout, normalized trace. Failure tests. | Planning and autonomous loops |
| C04 | feat(planning): add bounded task planning and versioned execution |
DAG validation, bounded executor, revisions, loop/time/token budgets. | Retrieval and multi-agent |
| C05 | feat(retrieval): add provenance-aware evidence retrieval |
Immutable evidence versions, lexical/vector seams, ACL filters, citations, dedup/freshness benchmark. | Long-term memory |
| C06 | feat(context): add explicit context construction and budget policies |
Full, sliding, retrieval, summary and artifact strategies with token/cost metrics. | Shared multi-agent workspace |
| C07 | feat(memory): add trust-gated long-term memory |
Signed provenance, trust gate, supersession/expiry, in-memory and pgvector seams; tamper tests. | Workflow state masquerading as memory |
| C08 | feat(async): move long-running work behind durable job admission |
202-style job contract, queue/worker/events/cancel/backpressure, tenant admission tests. | Durable workflow checkpoint semantics |
| C09 | feat(durability): persist workflow checkpoints across worker failure |
Checkpoint protocol, resume-by-reference, failure injection; optional PostgreSQL adapter. | Lease takeover protection |
| C10 | feat(durability): fence stale workers during run recovery |
Lease epoch/fencing tokens; stale write rejection test. | Scheduling atomicity |
| C11 | feat(durability): make state transition and scheduling intent atomic |
Transactional outbox model; both dual-write failures tested. | External side-effect guarantees |
| C12 | feat(effects): add idempotent action ledger for consequential tools |
Effect taxonomy, deterministic key/fingerprint, conflict prevention. | Ambiguous provider reconciliation |
| C13 | feat(effects): reconcile ambiguous side effects before retry |
UNKNOWN state and provider-query reconciler; never-blind-retry test. |
Policy and approval |
| C14 | feat(policy): gate agent capabilities through deterministic authorization |
PDP contract, deterministic deny-by-default baseline, decision record, optional Cedar adapter. | Human approval authority |
| C15 | feat(approval): bind durable approvals to exact proposed actions |
Action hash, plan version, expiry/revocation/resume/current-policy recheck. Mutation attack test. | Sandbox isolation |
| C16 | feat(sandbox): isolate untrusted tool execution behind a provider seam |
Test provider and rootless-gVisor adapter; resource/fs/egress contracts; explicit unavailability. | Composed production runtime |
| C17 | feat(runtime): compose governed durable single-agent execution |
Policy, budget, approval, checkpoint, effects, tools and model composition; T0 benchmark. | Verifier and multi-agent |
| C18 | feat(verification): add information-isolated producer verification |
Typed artifact handed to independent verifier; deterministic comparison and catch-rate metric. | Specialist fan-out |
| C19 | feat(multi-agent): add bounded parallel specialist execution |
SubAgentSpec, bounded parallel dispatch, disjoint task/step identities, optional LangGraph adapter. |
Claims of topology superiority |
| C20 | experiment(multi-agent): compare agent topology value |
T0/T1/T2 manifest and quality/cost/latency/duplication/failure metrics. | Shared mutable workspace |
| C21 | feat(workspace): coordinate agents through typed shared state |
Claims, evidence, artifacts, gaps, decisions, optimistic versions and merge rules. | Pattern catalog |
| C22 | feat(patterns): add interchangeable collaboration topologies |
Supervisor, producer/verifier, hierarchy, peer, debate, dynamic fan-out scenarios. | Universal-best-pattern claim |
| C23 | experiment(cache): evaluate safe agent reuse layers |
Authority/version-complete cache keys, revocation/stale/stampede/cross-tenant tests. | Model provider routing |
| C24 | feat(models): add observable model routing budgets and fallback |
Model tiers, routing manifest, attribution, escalation and bounded fallback. | Hierarchical spend reservation |
| C25 | feat(finops): reserve agent spend before execution |
Useful hierarchy levels, atomic reserve/commit/release and fail-closed store behavior. | Database RLS |
| C26 | feat(tenancy): enforce tenant isolation through storage |
Tenant-scoped stores and PostgreSQL RLS adapter; cross-tenant denial tests. | Evaluation claims |
| C27 | feat(eval): evaluate components trajectories and outcomes |
Deterministic metrics, calibrated judge seam, safety and immutable run manifest. | Exported observability topology |
| C28 | feat(observability): reconstruct end-to-end agent execution |
Nested trajectory spans, versions/cost, in-memory exporter and optional OTel/Langfuse adapters. | Retry/failure policy |
| C29 | feat(reliability): add bounded failure containment |
Timeout taxonomy, retry budget/backoff, breaker, bulkhead, quarantine and degraded result. | Adversarial system suite |
| C30 | test(security): prove agent controls fail closed |
Prompt/tool/memory/tenant/capability/approval/sandbox/policy/exfiltration attacks. | Compliance guarantee |
| C31 | feat(compliance): add verifiable audit and erasure |
Hash-chain audit, WORM protocol/emulator label, crypto-shred and signed evidence pack. | Hosted-cloud WORM claim |
| C32 | feat(learning): gate improvement proposals through evaluation |
Prompt/retrieval/routing/memory/LoRA proposals, promotion gate, honest rejection. | Automatic deployment |
| C33 | feat(release): gate agent changes through replay shadow and canary |
Versioned release manifest, replay/shadow/canary/rollback gates. | Cross-version workflow migration |
| C34 | feat(versioning): safely resume workflows across system upgrades |
PIN/MIGRATE/LATEST per component; current authorization is always re-evaluated. | Chaos conclusions |
| C35 | test(chaos): validate recovery across production agent failure surfaces |
Deterministic failure injector and checked-in measured report for named surfaces. | ARIA-specific composition |
| C36 | feat(reference): compose AgentFoundry capabilities into ARIA |
Deep-research reference scenario using shared core; no duplicated mechanisms. | New core capability |
| C37 | docs: publish AgentFoundry capability and architecture guide |
Final architecture, matrix, labs, scenarios, experiments, rejected complexity, limitations, run/history guide. | Unsupported production claims |
Before each commit: inspect status/diff/staged diff, run its relevant tests, and
record Why, What changed, Invariant, and Evidence/tests in the commit
body. After each group of six commits, inspect git log --oneline --reverse for
dependency leaks and repair locally before continuing.