Runtime-Independent Persistent Agents: Preserving Identity, Memory, and Code Across Models, Harnesses, and Servers
Zhenyu Zhao, Roy Zhao
Independent Researcher / Paul G. Allen School of Computer Science & Engineering, University of Washington
cs.SE, cs.AI
2026-09-01
Enoch splits identity, memory, and code from the model and harness; a frozen commit passes 833 core tests, with single-axis swaps observed but no behavioral-fidelity scores.
Calling something "an agent" usually means the model plus harness running right now. That answers what produces the next action. It does not answer what has to stay continuous for two executions, weeks apart, to count as the same agent. A personal assistant can move from Telegram to Slack, from a laptop to a server, swap reasoners, and still be treated as one agent by its user. Persistent memory, resumable sessions, provider adapters, and versioned code already exist. They do not, by themselves, define the agent boundary.
If the model is replaced, did the agent migrate or die? If the same memory is copied onto two machines, which copy is the continuation? If a chat session resets, was a new agent created? Those are lifecycle questions.
The persistent agent is a continuity-bearing substrate P = (I, M, B): an architectural identity record, private durable memory plus workflow state, and a versioned software body (code, prompts, tools, policies, tests, provider contracts). The execution substrate E = (R, H, D) supplies a reasoner, harness, and host. Interaction surfaces S are chats, APIs, email, UIs. A deployment is A = P ▹ (E, S). Changing E or S is migration, not creation, when an authorized protocol keeps attributable lineage and transfers continuation authority inside a governed boundary.
Continuity is lineage, not bitwise identity. Memory may grow, the body may evolve under review, identity may change under declared rules. A pure runtime migration keeps the identity version, extends memory ancestry, and keeps the same body revision. A UUID is not enough: copy a directory to two servers and both copies share the identifier. Without an authority lease or fencing epoch, both cannot safely act as the unique continuation.
Authorized migration has six phases: quiesce and fence the old execution, checkpoint, validate, bind target providers, rehydrate, then verify and resume. The source stays authoritative until the target passes verification; failure rolls back. After promotion, the source stays fenced even if it reconnects. Six invariants pin identity lineage, memory ancestry, body revision, at-most-one cooperating authority, explicit capability deltas, and a ban on letting process or surface labels overwrite installed identity.
Enoch is the reference body, not an installed identity. body.yaml describes the body; self.json stores the installed identity; they load separately. Five provider kinds sit behind contracts: Chat (Telegram, Slack), Runtime (only Codex is bundled live at the frozen snapshot), VCS (Git), Review (GitHub and local), Service (launchd, systemd).
Evidence is frozen to public commit c8013ed on 31 August 2026. A clean-room run on CPython 3.12.13 passed 833 core tests, plus 92 provider and library tests run apart from the core suite.
| Claim | Strongest evidence |
| Identity/body split | Demonstrated: independent validation of self.json and body.yaml |
| State migration and rollback | Demonstrated: backup, idempotence, manifest-last commit, restore on failure |
| Chat surface swap | Two references: Telegram, Slack |
| Host-service swap | Two references: launchd, systemd |
| Runtime swap | Contract-level only: registry, fake-runtime switching |
| Authority handoff and fencing | Demonstrated: daemon epochs, stale-token rejection |
| Single-axis substitution | Operationally observed: reasoner version, surface, host machine |
The paper is explicit about what this is not. Mechanical substitutability and authorized system continuity are supported. Equal task performance, behavioral invariance, and a controlled all-axis migration matrix are not.
Anyone shipping a long-lived personal agent will hit "is it still the same one after we swap the model." This paper gives a cut you can implement: separate what currently generates behavior from what remains the same over time. The first can change. The second moves through checkpoints, lineage, and exclusive continuation authority.
The engineering takeaway is direct. A chat transcript is not the mind. Session continuity is not agent continuity. A fresh harness session after migration is expected. Context is rebuilt from identity, memory, body, and durable work records. Copying memory does not copy authority.
This is an architecture paper plus a reference implementation. It does not measure whether swapping Claude for GPT keeps the persona. What you can take is the boundary and the migration transaction, not a fidelity score.
The design comes from one young open-source lineage. The snapshot has no second bundled live reasoning harness. There is no controlled all-axis matrix, and no numbers for behavioral continuity, downtime, cost, or operator burden. Conformance tests catch interface and lifecycle bugs; they cannot prove an external provider is semantically equivalent or safe.
The authority invariant only binds cooperating executions that honor the authority store. A detached copy with unrevoked credentials is out of scope. Stronger enforcement needs credential rotation, provider-side leases, or an external authority service. Multi-embodiment, divergent-memory merge, and recovery after irreversible external effects are left open.
Single-axis substitution is "operationally observed," not a controlled experiment. 833 passing tests show the machinery runs. They do not show the agent still knows you after a model swap.