# Evolution 16 — research and prior art

Retrieved 2026-10-12 by web search. **Depth of reading: abstracts and search summaries, not full texts.** No paper
below was read end to end, no code of theirs was run, and no patent database (USPTO, Google Patents, WIPO) was
searched: one web query for patents on this combination returned no patent documents, which says nothing about whether
such patents exist. Every "CAIN distinction" below is a hypothesis to be checked against the full papers and by
counsel before it is repeated anywhere as a novelty claim.

## Sources

| # | Work | Date | Link | Area |
|---|---|---|---|---|
| 1 | UltraHorizon: Benchmarking Agent Capabilities in Ultra Long-Horizon Scenarios (ICML 2026 poster) | 2025-09-26 | https://arxiv.org/abs/2509.21766 | A |
| 2 | AgencyBench (32 scenarios, 138 tasks, ~90 tool calls each) | 2026-01-16 | https://arxiv.org/abs/2601.11044 | A |
| 3 | DeepPlanning: Long-Horizon Agentic Planning with Verifiable Constraints (ACL 2026) | 2026-01-26 | https://arxiv.org/abs/2601.18137 | A, H |
| 4 | AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks (ICML 2026) | 2026-02-18 | https://arxiv.org/abs/2602.16901 | A, B |
| 5 | CaMeL: Defeating Prompt Injections by Design | 2025-03 | https://arxiv.org/abs/2503.18813 (ID from memory, not re-checked) | B |
| 6 | Progent: programmable privilege control for LLM agents | 2025 | cited in https://arxiv.org/pdf/2606.26479 (primary page not found) | B |
| 7 | Agent-Sentry: Bounding LLM Agents via Execution Provenance | 2026-03 | https://arxiv.org/pdf/2603.22868 | B, F |
| 8 | Securing LLM Agents Need Intent-to-Execution Integrity | 2026-05 | https://arxiv.org/pdf/2605.16976 | B |
| 9 | A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents | 2026-06 | https://arxiv.org/pdf/2606.12320 | B, D |
| 10 | Atomix: Timely, Transactional Tool Use for Reliable Agentic Workflows | 2026-02 | https://arxiv.org/abs/2602.14849 | D |
| 11 | Cordon: Semantic Transactions for Tool-Using LLM Agents | 2026-06 | https://www.alphaxiv.org/abs/2606.17573 | D |
| 12 | SagaLLM: saga transactions for multi-agent LLM planning (VLDB 2025 per secondary source) | 2025-03 | https://arxiv.org/abs/2503.11951 | D |
| 13 | Temporal durable execution, sagas, idempotent activities | ongoing | https://docs.temporal.io (official docs not retrieved; secondary: https://tianpan.co/blog/2026/03/17/compensating-transactions-failure-recovery-agentic-systems) | D |
| 14 | Agent Payments Protocol (AP2): intent, cart and payment mandates as verifiable credentials | 2025-09 | https://ap2-protocol.org | E, I |
| 15 | Authenticated Delegation and Authorized AI Agents (South et al.) | 2025-01 | https://arxiv.org/abs/2501.09674 | E, I |
| 16 | AIP: Agent Identity Protocol, invocation-bound capability tokens (JWT / Biscuit) | 2026-03 | https://arxiv.org/abs/2603.24775 | E |
| 17 | CAPMAS: Capability-Based Delegation of Privileges in Multi-Agent Systems | 2026-09 | https://arxiv.org/pdf/2609.06500 | E |
| 18 | IETF draft: OAuth 2.0 On-Behalf-Of User Authorization for AI Agents (-02, expired 2026-02-27) | 2025-08 | https://datatracker.ietf.org/doc/html/draft-oauth-ai-agents-on-behalf-of-user-02 | I |
| 19 | NIST NCCoE concept paper: Accelerating the Adoption of Software and AI Agent Identity and Authorization (draft; comments closed 2026-04-02) | 2026-02-05 | https://www.nccoe.nist.gov/sites/default/files/2026-02/accelerating-the-adoption-of-software-and-ai-agent-identity-and-authorization-concept-paper.pdf | I |
| 20 | RFC 9943, SCITT Architecture | 2026-06 | https://www.rfc-editor.org/rfc/rfc9943.html | F |
| 21 | Audited Skill-Graph Self-Improvement (ASG-SI): replay-verified skill promotion | 2025-12 | https://arxiv.org/html/2512.23760v1 | C |
| 22 | Skills as Verifiable Artifacts: a trust schema for human-in-the-loop agent runtimes | 2026-05 | https://arxiv.org/pdf/2605.00424 | C |
| 23 | EVOMAL: Self-Poisoning in Self-Evolving Coding Agents | 2026-08 | https://arxiv.org/pdf/2608.25776 | C |
| 24 | Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents (SafeEvolve) | 2026-08 | https://arxiv.org/pdf/2608.12851 | C |
| 25 | Dynamic Agent Skills: A Lifecycle Survey | 2026-07 | https://arxiv.org/pdf/2607.10113 | C |
| 26 | Memory Poisoning Attack and Defense on Memory Based LLM-Agents | 2026-01 | https://arxiv.org/abs/2601.05504 | G |
| 27 | MemAudit: post-hoc auditing of poisoned agent memory | 2026-05 | https://www.alphaxiv.org/abs/2605.23723 | G |
| 28 | AgentPoison (NeurIPS 2024); MINJA (2025) | 2024-2025 | https://arxiv.org/abs/2407.12784 | G |

in-toto and SLSA v1.0 were searched for and not returned; they are already used by Evolution 14 and cited there.

## What the field already does (short)

- **Transactions for tool calls are published.** Atomix adds transactional semantics, tracks externalized effects and
  compensates on abort; its authors state that saga compensation only helps when every effect is reversible and that a
  checkpoint rollback does not undo a sent email. Cordon stages and validates effects and commits or rolls back as a
  unit (its own figure: 45/45 policy-violating workflows intercepted). SagaLLM pairs each step with a compensation.
  Temporal persists workflow state after every step and expects idempotency keys on side effects.
- **Signed user mandates are published.** AP2's intent mandate is a user-signed bound (price, timing) that an agent
  acts within; the cart mandate is the user's approval of one exact cart.
- **Attenuating delegation chains are published.** Macaroons (2014), Biscuit, AIP's invocation-bound capability tokens,
  CAPMAS, an IETF agent-delegation-chain draft, and South et al.
- **Verified skill admission is published.** ASG-SI promotes a skill only after replay tests independent of the
  runtime that produced it; EVOMAL and "Practice Makes Unsafe" show that self-authored skills are an unmediated
  admission path; SkillSec-Eval lists signatures, provenance and version lineage as mitigations.
- **Long-horizon attack benchmarks are published.** AgentLAB (644 cases, five attack types including objective drift
  and memory poisoning).

## Comparison per capability built or considered

| Capability | Closest prior art | What it already does | Its limit (as documented or apparent from the abstract) | Proposed CAIN distinction | Evidence the distinction matters | Alternative explanation of the apparent novelty | Decision |
|---|---|---|---|---|---|---|---|
| Write-ahead dispatch with ambiguity quarantine | Atomix (10), Cordon (11), Temporal (13), CAIN Evolution 10 coordinator | journaled or staged effects, idempotency, compensation | focus on reliability and commit ordering; authority is assumed valid for the life of the workflow (not confirmed from full text) | authority, expiry, revocation and cancellation are re-evaluated at the moment of dispatch, and an unknown outcome is settled only by an independent signed observation, never by retry or by the executor | lab baseline comparison in test_results.md; the pre-existing coordinator re-executed after a timeout (F16-01) | any careful engineer combining a policy check with an outbox gets most of this; it may simply not have been written up | **Implemented** (ENGINEERING) |
| Decision-checked replay of an authorization runtime | event sourcing, ARIES, Temporal deterministic replay | rebuild state by replaying a log; Temporal detects non-determinism | generic; not about authorization state | each recomputed admission decision is compared with the recorded digest and recovery refuses to start on a difference; nonces and used authorizations survive restart | replay attack after restart admitted by the in-memory baseline, refused by the new runtime | Temporal's non-determinism detection is the same idea in another domain | **Implemented** (ENGINEERING) |
| Contract succession with widening-bound approval | AP2 mandates (14), CAIN RXA-AMEND, policy versioning generally | a signed bound the agent acts within; a new mandate replaces the old | AP2 does not, from what was read, define how a running mandate is narrowed or widened mid-mission or what happens to actions already authorized | a version chain with compare-and-swap, field-by-field classification, the principal's signature over the exact computed widening, and voiding of undispatched admissions | scenarios contract_version_rollback, stale base, widening without principal, narrowed contract | this is ordinary change control (two-person rule, optimistic concurrency) applied to a new object | **Implemented** (ENGINEERING) |
| Clean-room verifier for runtime decisions | SCITT receipts (20), CAIN E38 and Evolution 14 verifiers | signed statements with inclusion proofs; independent recomputation | SCITT proves registration, not that the statement is true | five-way verdict; INCOMPLETE unless a witness-held head excludes truncation | 15 evidence scenarios; exploration invariant I7 | a straightforward audit tool | **Implemented**, merged into the existing verifier product (INTEGRATION) |
| Observer-confirmed compensation, contradiction reopening | saga compensation, Atomix, CAIN RecoveryPlanner | compensation handlers | Atomix itself notes compensation needs a correct handler | compensation counts only on independent confirmation and has a single-use authorization | compensation scenarios | already largely present in RecoveryPlanner | **Implemented** as integration; not a new invention |
| Self-improvement admission lifecycle | ASG-SI (21), Skills as Verifiable Artifacts (22), CAIN governed_evolution | replay-verified promotion, trust schema | — | none identified beyond what CAIN already has | — | — | **Not built.** Already in the repository; see self_improvement_controls.md. Zero new invention |
| Delegation attenuation and revocation | Macaroons, Biscuit, AIP (16), CAPMAS (17), CAIN delegation graph | monotonic attenuation, bounded depth | — | none; Evolution 16 only re-checks liveness at dispatch (part of row 1) | — | — | **Merged** into row 1. Zero new invention |
| Mission drift detection | AgentLAB objective drift (4), CAIN RXA-AMEND, ARGUS drift | benchmarks drift; CAIN classifies plan amendments | — | none new; an evidence validity window was added as a parameter | scenario evidence_older_than_its_validity | a TTL is not an invention | **Merged**; not counted |
| Policy-constrained planning under budgets | DeepPlanning (3) | benchmarks constraint satisfaction by planners | — | CAIN does not plan; it bounds | — | — | **Rejected** as out of scope |
| Running a real-model long-horizon benchmark | AgentLAB, UltraHorizon, AgencyBench | public benchmarks with real models | — | — | — | — | **Research further**; needs a model in the loop and an adapter (open since Evolution 15) |

## Licence and compatibility

Nothing was copied from any of these works. Atomix's code is public (licence not checked); it was not read or used.
Evolution 16 adds no dependency: it uses `cryptography` (Apache-2.0 OR BSD-3-Clause), already required, for Ed25519.

## Questions for qualified counsel

1. Given Atomix, Cordon and SagaLLM (all 2025-2026), is "re-validation of delegated authority at dispatch plus
   observer-gated reconciliation of ambiguous outcomes" a patentable distinction, or an obvious combination?
2. Does AP2's mandate model anticipate the contract succession chain?
3. Were any of these disclosed in a way that starts a bar date for CAIN's own earlier mission work (Evolution 8, 10, 15)?
4. Inventorship: this code was written by an AI coding agent under the owner's direction in one session. What does that
   mean for inventorship and for copyright in each jurisdiction of interest?
5. Trade secret versus defensive publication for the verifier, which is meant to be handed to third parties.