Do Not Restart: Residual Completion for Stateful Agent Handoffs

# Do Not Restart: Residual Completion for Stateful Agent Handoffs
Source: [https://arxiv.org/html/2609.13800](https://arxiv.org/html/2609.13800)
Runzhi Deng††thanks:Equal contribution\.Yiming Zhong11footnotemark:1Affiliation:Nanjing UniversityFang Zhao††thanks:Corresponding authors\.Affiliation:Nanjing UniversityPan Zhou22footnotemark:2Affiliation:Singapore Management University

###### Abstract

Routing and cascades reduce tool\-agent cost by transferring control across models, but stateful handoffs must preserve accepted choices, realized effects, and unfinished obligations\. We formulate this as*commitment\-constrained residual completion*and introduce Commitment\-Frontier Residual Completion \(CFRC\)\.CFRCenforces target\-before\-proposal, whole\-proposal\-before\-authority, and live\-evidence\-before\-success: it freezes a residual contract from accepted progress, closes the successor continuation into an evidence\-linked graph, and admits execution only when the remainder is covered, with live receipts discharging obligations\. We establish contract\-relative partial correctness, which extends to the original residual request under complete contract construction\. Across five environments and two same\-provider model pairs,CFRCachieves comparable macro accuracy to strong full\-task agents at only 22\.0%–34\.6% of their inference cost, with additional cross\-provider results demonstrating broader transfer\.

## 1Introduction

Large language models \(LLMs\) and multimodal agents increasingly serve as the decision\-making core of tool\-using systems for planning, software interaction, and multi\-step execution\([Trivedi et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib27);[Lu et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib7)\)\. Such trajectories repeatedly invoke a model for reasoning, action selection, tool use, and verification, making it costly and often unnecessary to use the strongest model throughout\. A practical alternative is to let lower\-cost models handle routine steps and transfer control when tasks become difficult or uncertain\([Ong et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib10);[Son et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib16)\)\. Its benefit, however, depends on whether the successor can reuse accepted progress rather than restart\. Unlike stateless prompt routing\([Chen et al\., 2023](https://arxiv.org/html/2609.13800#bib.bib11)\), agents operate in persistent environments where actions can produce irreversible side effects\. Restarting wastes computation and risks duplicate actions, while continuing without clear specifications risks goal drift\. This raises a broader handoff question: when control passes between models, how can the successor continue from the reached state while preserving accepted choices and realized effects, completing open obligations, and avoiding duplicate actions?

![Refer to caption](https://arxiv.org/html/2609.13800v1/CFRC_Motivation_Figure_ICLR.png)Figure 1:Stateful handoff is residual completion, not restart\.\(a\) At a commitment frontier, accepted progress is fixed while request\-scoped work remains open: INV\-42 has been confirmed and paid, so the successor must preserve that effect, deliver its receipt, and verify delivery rather than repay or restart\. \(b\) Implicit handoff can miss open work or repeat completed effects; a contract\-only handoff supplies a residual target but still lets the successor act before the whole remainder is checked\.CFRCinstead freezes the target before proposal, closes the successor’s full remainder into an evidence\-linked graph before native authority, and accepts success only from live evidence\. \(c\) For GPT\-5\.4\-mini/GPT\-5\.5, quality and cost are normalized to the strong full\-task agent on each surface\(100%,100%\)\(100\\%,100\\%\)\. Across five surfaces,CFRCremains near strong\-model quality and reaches 101\.8% of strong macro accuracy at only 34\.6% of its cost\.In the invoice task of Fig\.[1](https://arxiv.org/html/2609.13800#S1.F1)a, the user asks the agent to pay one outstanding invoice and send its receipt\. The first model selects an illustrative invoiceINV\-42, which the user confirms, making the choice binding even before any tool call\. At a later handoff, payment has succeeded but receipt delivery remains pending\. The successor cannot restart, as another API payment call would cause a duplicate charge, nor switch invoices, since the user confirmedINV\-42\. Yet declaring success is also wrong because delivery remains unfulfilled\. The task is therefore neither fresh nor complete: the accepted trajectory contains fixed progress alongside unfinished work\. We call this handoff point a*commitment frontier*and frame the challenge as*commitment\-constrained residual completion*\. Under this formulation, a valid continuation must execute from the reached state, preserve accepted choices and realized effects, and complete all open request\-scoped obligations\.

Existing agent components address adjacent parts of this problem but leave three gaps, as illustrated in Fig\.[1](https://arxiv.org/html/2609.13800#S1.F1)b\. First, routing, handoff, and memory mechanisms determine who acts or transfers past context\([KC and Budathoki, 2026](https://arxiv.org/html/2609.13800#bib.bib3);[Wang et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib9)\), but they do not independently specify what the successor must still preserve and complete\. In the invoice example, transferring the transcript or reached state alone does not prevent the successor from overlooking delivery or reinterpreting the confirmed choice\. Second, planners and transcript\-conditioned successors can propose later actions\([Yao et al\., 2023](https://arxiv.org/html/2609.13800#bib.bib1)\), but a proposal cannot reveal what it omits\. A continuation containing only a status check and success response provides no independent signal that receipt delivery remains missing\. Third, action\-level guards and control layers can reject unsafe or invalid proposed calls\([Wang et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib18);[Kamath et al\., 2025](https://arxiv.org/html/2609.13800#bib.bib19);[Liu et al\., 2026b](https://arxiv.org/html/2609.13800#bib.bib21)\), such as duplicate payments or unauthorized invoices\. Yet they cannot require an action that was never proposed, nor establish whole\-suffix completeness before incremental native execution begins\. Thus, existing mechanisms address context transfer, action proposal, or local validity, but not the joint need for an independent residual target, complete proposal coverage, and evidence\-backed realization\.

#### Our approach\.

We address this gap with Commitment\-Frontier Residual Completion \(CFRC\)\. The method enforces target before proposal, whole proposal before authority, and live evidence before success, as illustrated in Fig\.[1](https://arxiv.org/html/2609.13800#S1.F1)b\. First, Reached\-State Contract Construction inCFRCderives a frozen residual contractzfz\_\{f\}from the accepted trajectory, reached state, trusted receipts, and public tool interfaces before seeing the successor’s proposal\. The contract records what is fixed and what remains open, so omitted work cannot disappear merely because the successor fails to mention it\. Second, Executable Residual Completion inCFRClets the successor author on an isolated replica where available and closes the full continuation as an evidence\-linked graphHH, exposing its actions, dependencies, and obligation coverage without changing the live state\. Finally, Checked Execution inCFRCadmits the completeHHagainstzfz\_\{f\}before granting native authority, rebinds dynamic values to live predecessor receipts, and accepts completion only when matching native evidence discharges every obligation\. In the invoice example,zfz\_\{f\}preserves the completed payment while recording pending delivery; the graphHHmust explicitly include that delivery path\. Checked Execution rejects duplicate or incomplete proposals before live execution and confirms success only after live receipts verify delivery\. Finally, we theoretically establish conditional partial correctness, showing that successfully realized prefixes preserve encoded progress and returned suffixes satisfy the contract\.

Across five stateful tool\-use surfaces,CFRCshifts the quality–cost frontier \(Fig\.[1](https://arxiv.org/html/2609.13800#S1.F1)c\)\. With GPT\-5\.4\-mini/GPT\-5\.5, it achieves 70\.8% macro accuracy versus 69\.6% for GPT\-5\.5 at 34\.6% of the cost; with Luna/Sol, it achieves 70\.8% versus 70\.0% at 22\.0% cost\. Cross\-provider Luna/Sonnet 5 and Luna/Gemini 3\.7 Flash remain within 0\.5 points of their strong anchors at 26\.0% and 44\.1% cost\. Checked Execution blocks invalid proposals before live writes, while an independent audit recovers 62/68 persistent write obligations and finds no ungrounded writes among 50 admitted proposals\. SoCFRCpreserves strong\-model quality while focusing expensive reasoning on unfinished work\.

## 2Related Work

Model routing & agent handoff\.Planning and reflection improve how agents generate actions\([Yao et al\., 2023](https://arxiv.org/html/2609.13800#bib.bib1);[Shinn et al\., 2023](https://arxiv.org/html/2609.13800#bib.bib2);[Wang et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib9)\)\. Routers and cascades select models by predicted difficulty or cost\([Ong et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib10);[Bouchard, 2026](https://arxiv.org/html/2609.13800#bib.bib15);[Son et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib16);[Wei et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib17);[Liu et al\., 2026a](https://arxiv.org/html/2609.13800#bib.bib14)\), while handoff frameworks quantify information loss across checkpoints\([KC and Budathoki, 2026](https://arxiv.org/html/2609.13800#bib.bib3)\)\. Yet a transferred transcript does not specify which effects are fixed or which obligations remain open\.CFRCconstructs this residual target before the successor proposes a continuation\.

Classical specifications & recovery\.Conditional correctness relates execution to explicit pre\- and postconditions\([Hoare, 1969](https://arxiv.org/html/2609.13800#bib.bib24)\)\. Sagas structure long\-lived transactions around completion or compensation\([Garcia\-Molina and Salem, 1987](https://arxiv.org/html/2609.13800#bib.bib26)\), while plan repair adapts existing plans to changed execution contexts\([Fox et al\., 2006](https://arxiv.org/html/2609.13800#bib.bib32)\)\.CFRCfollows this separation of specification and execution, but constructs the residual target from accepted model\-generated progress to constrain the successor’s entire proposal\. Accepted effects are preserved, while a failed suffix may return⊥\\botwithout compensation\.

Stateful control & verification\.Runtime guards, capabilities, and transactional frameworks constrain actions outside the model\([Wang et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib18);[Kamath et al\., 2025](https://arxiv.org/html/2609.13800#bib.bib19);[Debenedetti et al\., 2025](https://arxiv.org/html/2609.13800#bib.bib4);[Fan et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib20);[Liu et al\., 2026b](https://arxiv.org/html/2609.13800#bib.bib21);[Lin et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib22);[Patil et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib23);[Chen et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib5)\)\. Execution\-monitoring limits are classical\([Schneider, 2000](https://arxiv.org/html/2609.13800#bib.bib25)\)\. Our omission argument instead concerns verifying planned coverage*before live writes*: an incomplete prefix cannot reveal which obligations a future continuation will omit, although explicit terminal obligations can still detect false completion\.CFRCchecks the entire proposed remainder against a separately constructed target and requires live evidence for success\. Stateful benchmarks\([Yao et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib6);[Barres et al\., 2025](https://arxiv.org/html/2609.13800#bib.bib29);[Lu et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib7);[Trivedi et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib27);[Microsoft, 2026](https://arxiv.org/html/2609.13800#bib.bib31);[Pysklo et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib30)\)make the gap between attempted actions and supported completion measurable\([Advani, 2026](https://arxiv.org/html/2609.13800#bib.bib8);[Gao and Zhou, 2026](https://arxiv.org/html/2609.13800#bib.bib28)\)\.

## 3Methodology

### 3\.1Stateful Handoff as a Residual\-Completion Problem

Problem setup\.A stateful handoff occurs when one model takes over an ongoing tool\-use trajectory produced by another, as in routed or cascaded agents for coding, web navigation, and other applications with persistent state or externally visible effects\. Unlike a fresh request, the successor inherits both*fixed progress*that must be preserved and*open work*that remains to be completed\. We study how to finish this residual work without replacing, undoing, or duplicating accepted progress\.

Formally, letqqbe the original request,τt\\tau\_\{t\}the accepted trajectory prefix,sts\_\{t\}the reached live state, andℛt\\mathcal\{R\}\_\{t\}the trusted native receipts available atsts\_\{t\}\. Let𝒜env\\mathcal\{A\}\_\{\\mathrm\{env\}\}denote the public tool interfaces, and let𝒪t\\mathcal\{O\}\_\{t\}denote the semantic, request\-scoped obligation instances still open underqqandτt\\tau\_\{t\}\. We useBtB\_\{t\}for accepted choice bindings, including user\-confirmed choices that may precede any native effect, andKtK\_\{t\}for realized effects supported byℛt\\mathcal\{R\}\_\{t\}\. With fixed progressFt=\(Bt,Kt\)F\_\{t\}=\(B\_\{t\},K\_\{t\}\), residual completion seeks a continuationσ\\sigmafromsts\_\{t\}satisfying

Exec⁡\(σ,st\)∧Preserve⁡\(σ,Ft\)∧Complete⁡\(σ,𝒪t\)\.\\mathrm\{Exec\}\(\\sigma;s\_\{t\}\)\\;\\wedge\\;\\mathrm\{Preserve\}\(\\sigma;F\_\{t\}\)\\;\\wedge\\;\\mathrm\{Complete\}\(\\sigma;\\mathcal\{O\}\_\{t\}\)\.\(1\)Here, the three predicates require the suffix to execute from the reached state, respect accepted bindings and realized effects, and discharge every open obligation before claiming success\. IfCFRCcannot establish such a suffix within budget, it returns⊥\\bot; this does not imply that no valid continuation exists\. For the formal guarantee, each in\-scope obligation has a request\-defined, finitely checkable predicate over the resulting trace and state, independent of the contract later constructed byCFRC\. LetΣf​\(q,τt\)\\Sigma\_\{f\}\(q,\\tau\_\{t\}\)denote the continuations satisfying Eq\. \([1](https://arxiv.org/html/2609.13800#S3.E1)\)\.

Running example and commitment frontier\.Consider the post\-payment invoice handoff in Fig\.[2](https://arxiv.org/html/2609.13800#S3.F2)\. The requestqqasks the agent to pay one outstanding invoice and send its receipt;τt\\tau\_\{t\}records thatINV\-42was selected and confirmed and that its payment succeeded;sts\_\{t\}contains the paid invoice and receipt filetxn7\.pdf; andℛt\\mathcal\{R\}\_\{t\}contains the trusted native evidence\. Thus,BtB\_\{t\}fixesinvoice=INV\-42\\texttt\{invoice\}=\\texttt\{INV\-42\},KtK\_\{t\}contains the receipt\-backed effectpaid⁡\(INV\-42\)\\mathrm\{paid\}\(\\texttt\{INV\-42\}\), and𝒪t\\mathcal\{O\}\_\{t\}still requires delivery of the receipt to the verified recipient\. A validσ\\sigmamay therefore*send receipt→\\rightarrowverify delivery→\\rightarrowconfirm success*: repaying violates preservation, omitting delivery violates completion, and unsupported success violates Eq\. \([1](https://arxiv.org/html/2609.13800#S3.E1)\)\. The same issue can arise before any change to the environment: once the user confirmsINV\-42, that binding already constrains future behavior\. We call such a point a*commitment frontier*: the accepted prefix has fixed progress that must be preserved while request\-scoped work remains open—in short,*fixed progress plus unfinished work*\. Before any accepted choice or realized effect, the task is fresh; after all obligations are complete, no residual task remains\.

From challenges toCFRC\.Eq\. \([1](https://arxiv.org/html/2609.13800#S3.E1)\) exposes three design challenges\.\(C1\) What is fixed, and what remains?Neither the request nor the reached state alone necessarily specifies the residual task, while letting the successor define its own target makes omissions difficult to detect\.CFRCtherefore constructs an independent frozen contractzfz\_\{f\}before proposal \(Sec\.[3\.2](https://arxiv.org/html/2609.13800#S3.SS2)\)\.\(C2\) Does the proposed remainder cover that target?Call\-local checks can reject an invalid action but cannot detect an obligation for which no action is proposed\. In stateful environments with irreversible tool mutations, step\-by\-step execution risks leaving the environment in an unrecoverable state before discovering that downstream obligations lack valid inputs\.CFRCtherefore exposes the whole remainder as a closed graphHHbefore native execution \(Sec\.[3\.3](https://arxiv.org/html/2609.13800#S3.SS3)\)\.\(C3\) Were the proposed actions actually realized?Replica results are only proposal\-time evidence, and native calls may fail\.CFRCtherefore grants native authority only after validation and accepts completion only from matching live evidence \(Sec\.[3\.4](https://arxiv.org/html/2609.13800#S3.SS4)\)\. These three stages form the pipeline in Fig\.[2](https://arxiv.org/html/2609.13800#S3.F2):

\(q,τt,st,ℛt,𝒜env\)⟶zf⟶H⟶σ​or⊥\.\(q,\\tau\_\{t\},s\_\{t\},\\mathcal\{R\}\_\{t\},\\mathcal\{A\}\_\{\\mathrm\{env\}\}\)\\;\\longrightarrow\\;z\_\{f\}\\;\\longrightarrow\\;H\\;\\longrightarrow\\;\\sigma\\ \\text\{or\}\\ \\bot\.\(2\)We study one handoff tenure at a time\.CFRCtriggers handoff through a fixed supported\-frontier rule, but does not optimize general model routing or choose among multiple successors; it also preserves supported prior commitments rather than re\-evaluating their desirability\.

![Refer to caption](https://arxiv.org/html/2609.13800v1/cfrc_overview.png)Figure 2:CFRCat a post\-payment commitment frontier\.RSCC identifies a supported frontier and freezes the residual contractzfz\_\{f\}before querying the successor\. ERC then closes the proposed remainder as an evidence\-linked graphHH, and CE admits and realizesHH, returningσ\\sigmaonly when matching live evidence discharges every encoded open obligation, and⊥\\bototherwise\.
### 3\.2Reached\-State Contract Construction

Reached\-State Contract Construction \(RSCC\) addresses C1 in Sec\.[3\.1](https://arxiv.org/html/2609.13800#S3.SS1)by constructing the residual target*before*the successor proposes anything\. Rather than merely summarize the trajectory, RSCC converts accepted history into a proposal\-independent specification of what is fixed and what remains owed\. Itgroundsaccepted progress,closesthe remaining request, andfreezesthe resulting contractzfz\_\{f\}\. RSCC uses onlyq,τt,st,ℛtq,\\tau\_\{t\},s\_\{t\},\\mathcal\{R\}\_\{t\}and a fixed adapter over public tool schemas\. The adapter maps public interfaces into shared argument, effect, and evidence types; it cannot access simulator internals, reference outcomes, or evaluator rewards\.

Step 1: Grounding fixed progress\.RSCC first identifies the binding parts of the accepted history:

\(Bt,Kt,Et\)=Ground⁡\(τt,st,ℛt\),\(B\_\{t\},K\_\{t\},E\_\{t\}\)=\\operatorname\{Ground\}\(\\tau\_\{t\},s\_\{t\},\\mathcal\{R\}\_\{t\}\),whereBtB\_\{t\}contains accepted choice bindings,KtK\_\{t\}contains receipt\-backed realized effects that later actions must preserve, andEtE\_\{t\}contains verified entities, values, files, and receipt fields that the residual continuation may safely reference\. Grounding is deterministic: public tool schemas specify mutating effects and receipt formats, whileGround\\operatorname\{Ground\}parses trusted native receipts inℛt\\mathcal\{R\}\_\{t\}to populateKtK\_\{t\}and extracts confirmed entities intoEtE\_\{t\}andBtB\_\{t\}\. In our invoice example,EtE\_\{t\}retainstxn7\.pdfand the verified recipient, whileKtK\_\{t\}records the completed payment\.

Step 2: Closing the residual task\.Grounding identifies what is fixed but not what remains\. RSCC compares the grounded progress with the original requestqqand the public interfaces to derive

\(τt,st,ℛt\)→Ground\(Bt,Kt,Et\)→𝒜envq,Closezf=\(Kt,Et,Ot,𝒮t,𝒜t\)\.\\begin\{split\}\(\\tau\_\{t\},s\_\{t\},\\mathcal\{R\}\_\{t\}\)&\\xrightarrow\{\\operatorname\{Ground\}\}\(B\_\{t\},K\_\{t\},E\_\{t\}\)\\xrightarrow\[\\mathcal\{A\}\_\{\\mathrm\{env\}\}\]\{q,\\operatorname\{Close\}\}z\_\{f\}=\(K\_\{t\},E\_\{t\},O\_\{t\},\\mathcal\{S\}\_\{t\},\\mathcal\{A\}\_\{t\}\)\.\\end\{split\}\(3\)Here,OtO\_\{t\}is the instance\-sensitive contract encoding of open obligations𝒪t\\mathcal\{O\}\_\{t\};𝒮t\\mathcal\{S\}\_\{t\}specifies admissible residual effects, and𝒜t\\mathcal\{A\}\_\{t\}the interfaces that may realize or verify them\. Closure operationalizes the division of labor between rules and model inference\. On structured surfaces \(STATE\-Bench, ToolSandbox, Agent\-Diff\), candidate obligations are extracted deterministically by matching request intents against tool schemas and excluding effects already certified inKtK\_\{t\}\. On conversational surfaces \(τ2\\tau^\{2\}\), an extraction prompt decomposes user requestqqrelative to prefixτt\\tau\_\{t\}into candidate obligationsOtO\_\{t\}, parameterizing them with entities fromEtE\_\{t\}and restricting them to admissible interfaces𝒜t\\mathcal\{A\}\_\{t\}\. For the post\-payment invoice,OtO\_\{t\}encodes delivery oftxn7\.pdfto the verified recipient,𝒮t\\mathcal\{S\}\_\{t\}permits delivery and receipt\-backed confirmation while excluding repayment, and𝒜t\\mathcal\{A\}\_\{t\}retains the corresponding send and status interfaces\. Accepted bindings inBtB\_\{t\}are compiled into fixed values inEtE\_\{t\}, obligations inOtO\_\{t\}, and restrictions in𝒮t\\mathcal\{S\}\_\{t\}, while receipt\-backed effects inKtK\_\{t\}remain protected against reversal or repetition\.

Step 3: Validating and freezing the contract\.RSCC requires every contract field to have trusted support,OtO\_\{t\}to be nonempty, and the accepted prefix to contain at least one supported accepted binding or receipt\-backed realized effect\. Once validated,zfz\_\{f\}is frozen*before*querying the successor: neither proposal nor execution may expand, weaken, or rewrite it, so recorded work cannot disappear because the successor omits it\. These checks establish support but do not prove that RSCC captured every semantic obligation in𝒪t\\mathcal\{O\}\_\{t\}\. Freezing prevents*proposal\-induced*omission; it cannot recover an obligation missed during construction\. Accordingly, the lift from contract\-relative correctness to the original residual request is conditional on complete RSCC construction \(Sec\.[3\.5](https://arxiv.org/html/2609.13800#S3.SS5)\)\. If construction or validation fails,CFRCwithholds successor write authority and returns⊥\\bot\.

### 3\.3Executable Residual Completion

The frozen contractzfz\_\{f\}specifies*what*must be preserved and completed while leaving*how*to the successor\. ERC addresses C2 in Sec\.[3\.1](https://arxiv.org/html/2609.13800#S3.SS1)by exposing the successor’s complete proposed remainder before any new live write: the successorauthorsa continuation, a deterministic bridgebindsits data and evidence dependencies, and the proposal isclosedas an untrusted graphHH\.

Step 1: Data\-dependent authoring without live effects\.Residual plans are often data\-dependent because later call arguments depend on earlier outputs\. When safe snapshotting is available, the successor authors against an isolated replica ofsts\_\{t\}, observing replica receiptsρ~v\\widetilde\{\\rho\}\_\{v\}without changing the live environment\. On an unforkable surface, the successor instead closes the graph from handoff\-time evidence and symbolic receipt dependencies; no new state\-changing live call is authorized before CE in Sec\.[3\.4](https://arxiv.org/html/2609.13800#S3.SS4)admits the complete proposal\. Replica receipts may expose intermediate values for authoring, but they neither prove live effects nor discharge obligations\. For example, the successor may sendtxn7\.pdfon a replica, observe a SEND receipt, and use its identifier to propose a later delivery\-status query without sending a real email\.

Step 2: Binding dependencies and closing the residual graph\.A proposal authored from replica values cannot simply be replayed because replica\-generated identifiers may differ from live ones\.

A deterministic bridge therefore builds an evidence\-linked candidate graph\. LetHHdenote the closed DAG retained after any dependency\-closed compiler selection, containing typed calls, the terminal response, arguments, dependencies, source bindings, obligation coverage, effects, and required authority\.

Crucially, dynamic arguments bind to their*source*, not to a proposal\-time value\. For example, the status query refers to thesend\_idfield of the preceding SEND receipt; CE \(Sec\.[3\.4](https://arxiv.org/html/2609.13800#S3.SS4)\) later resolves that field from the corresponding live receipt\. The successor chooses the actions, task\-specific arguments, semantic order, and terminal response\. The bridge only records or normalizes structure supported byzfz\_\{f\}, public schemas, and available receipts; it does not choose another task solution\.

Step 3: Closing the whole remainder without repair\.Unlike next\-action control,HHexposes the*entire*proposed remainder\. Writingcov⁡\(v\)\\operatorname\{cov\}\(v\)for the obligations claimed by nodevv,

cov⁡\(H\)=⋃v∈V⁡\(H\)cov⁡\(v\),\\operatorname\{cov\}\(H\)=\\bigcup\\nolimits\_\{v\\in V\(H\)\}\\operatorname\{cov\}\(v\),\(4\)can later be compared withOtO\_\{t\}\. Thus an omitted action becomes visible as missing coverage: an invoice proposal without a SEND node leaves receipt delivery uncovered\.

Crucially, while a terminal monitor can detect omission at episode end, it cannot roll back irreversible tool mutations already committed to the live environment\. Nor can step\-by\-step checkers observe whether future actions will complete open obligations\. ClosingHHbeforehand validates full obligation coverage and dataflow reachability*before*granting live write authority, preventing destructive partial execution\. The bridge does not repair the proposal; it normalizes supported dependencies, source bindings, or coverage annotations without adding, removing, or replacing task actions\. The resultingHHis inspectable but untrusted\.

### 3\.4Checked Execution

The closedHHfrom Sec\.[3\.3](https://arxiv.org/html/2609.13800#S3.SS3)makes the successor’s proposal explicit but does not establish that it is contract\-valid or that its claimed effects actually occur\. Checked Execution \(CE\) resolves C3 by putting*state\-changing live authority*behind whole\-graph admission and accepting completion only from live evidence\. CE firstadmitsHHagainstzfz\_\{f\}, thenrealizesadmitted nodes using live receipt bindings, and finallyverifiesthat the resulting evidence discharges every obligation\.

Step 1: Whole\-graph admission before live write authority\.Before the first state\-changing native call, CE compares the fixed proposalHHwithzf=\(Kt,Et,Ot,𝒮t,𝒜t\)z\_\{f\}=\(K\_\{t\},E\_\{t\},O\_\{t\},\\mathcal\{S\}\_\{t\},\\mathcal\{A\}\_\{t\}\)\. Admission requires: \(i\) calls use allowed interfaces with well\-typed, grounded arguments; \(ii\) proposed effects stay within𝒮t\\mathcal\{S\}\_\{t\}and preserveKtK\_\{t\}and the accepted bindings encoded by the contract; \(iii\) the entire graph covers the encoded obligations,cov⁡\(H\)=Ot\\operatorname\{cov\}\(H\)=O\_\{t\}; and \(iv\) dependencies and terminal claims have explicit evidence paths\. These conditions correspond to proposal\-level executability, preservation, and coverage\. Because CE sees the completeHH, it can reject duplicate actions, uncovered obligations, unresolved dependencies, or unsupported terminal claims before the first live write\. Whole\-graph admission establishes that the*planned*suffix satisfies the contract structure; it does not imply that native execution will succeed\. CE admits or rejects the selectedHHas a whole\. Compiler selection may prune proposal nodes only while retaining dependencies and full coverage ofOtO\_\{t\}; it cannot synthesize repair actions\.

Step 2: Receipt\-bound live realization\.An admitted graph executes in dependency order on the live environment\. Static inputs resolve fromEtE\_\{t\}, whereas dynamic inputs are rebound to the corresponding*live*predecessor receipts specified byHH\. After each call, CE checks the returned receipt against the result and effect instance recorded for that node before its fields may feed downstream calls\. Replica and proposal\-time outputs never substitute for native evidence\.

Step 3: Evidence\-backed completion\.Replica success never discharges an obligation\. Letsjs\_\{j\}andℛj\\mathcal\{R\}\_\{j\}denote the live state and matching native receipts afterjjsuccessfully realized action nodes\. CE tracks the obligations whose evidence remains valid at that point:

Lj=\{o∈Ot:witj⁡\(o,ℛj,sj\)\},L0=∅,L\_\{j\}=\\\{\\,o\\in O\_\{t\}:\\operatorname\{wit\}\_\{j\}\(o,\\mathcal\{R\}\_\{j\},s\_\{j\}\)\\,\\\},\\qquad L\_\{0\}=\\varnothing,\(5\)wherewitj\\operatorname\{wit\}\_\{j\}requires instance\-matching native evidence whose discharge remains valid atsjs\_\{j\}\. Event obligations may remain discharged once witnessed; mutable\-state obligations require current\-state validity\. Recorded invalidation removes discharge and blocks completion for the current tenure; a fresh receipt cannot discharge that obligation again under the same contract\.

Ifmmaction nodes are realized, CE returns a suffixσ\\sigmaonly when every node has a matching receipt,Lm=OtL\_\{m\}=O\_\{t\}, and the terminal response is supported by the corresponding evidence:

Γzf​\(H\)=\{σ,if admission and all live\-evidence checks succeed,⊥,otherwise\.\\Gamma\_\{z\_\{f\}\}\(H\)=\\begin\{cases\}\\sigma,&\\text\{if admission and all live\-evidence checks succeed\},\\\\ \\bot,&\\text\{otherwise\}\.\\end\{cases\}\(6\)A rejection before live execution may trigger another complete proposal against the same frozen contract within budget\. Once a state\-changing live call has occurred, however, a failure or mismatched receipt ends the current tenure; CE does not repair the old graph or continue under stale contract evidence\. A later attempt reconstructs a contract from the new reached state\. Importantly,⊥\\botafter a live call does*not*imply rollback or that the environment remained unchanged\.

### 3\.5Conditional End\-to\-End Guarantee

The three stages establish complementary properties: Under complete construction, RSCC faithfully specifies the residual task; ERC exposes the successor’s proposal without repairing it, and CE faithfully realizes an admitted proposal using live evidence\.

###### Proposition 1\(Contract\-relative partial correctness and residual\-task lift\)\.

LetPPbe a successor\-authored residual proposal andH=ERCzf⁡\(P\)H=\\operatorname\{ERC\}\_\{z\_\{f\}\}\(P\)its closed graph\. Under faithful ERC closure, sound schemas and checks, valid live evidence, and tenure isolation, ifΓzf\(H\)=σ≠⊥\\Gamma\_\{z\_\{f\}\}\(H\)=\\sigma\\neq\\bot, then every successfully realized prefix preserves the frozen progress and

cov⁡\(H\)=Ot,σ∈Σ⁡\(zf\)\.\\operatorname\{cov\}\(H\)=O\_\{t\},\\qquad\\sigma\\in\\Sigma\(z\_\{f\}\)\.\(7\)If RSCC satisfies the complete\-construction assumption, thenσ∈Σf​\(q,τt\)\\sigma\\in\\Sigma\_\{f\}\(q,\\tau\_\{t\}\)and satisfies Eq\.\([1](https://arxiv.org/html/2609.13800#S3.E1)\)\.

Proposition[1](https://arxiv.org/html/2609.13800#Thmproposition1)separates execution fidelity from specification fidelity\. Under the assumptions stated in Proposition[1](https://arxiv.org/html/2609.13800#Thmproposition1), ERC and CE ensure that the returned suffix satisfies the frozen contract: the closed graph covers every encoded obligation, each successfully realized prefix preserves encoded progress, and live evidence supports completion\. Under complete RSCC construction, this contract\-relative result lifts to the original in\-scope residual request\. The returned suffix therefore executes from the reached state, preserves accepted progress, and completes every in\-scope semantic obligation still open at handoff\. The result does not certify the constructor, guarantee that a valid proposal will be found, or imply rollback when⊥\\botis returned\.

## 4Experiments

Our evaluation investigates four questions: whetherCFRCapproaches strong\-model quality at lower inference cost, whether these gains hold across model pairs and providers, what RSCC, ERC, and CE individually contribute, and whether independent audits validate the contract and execution mechanisms\.

Surfaces and protocol\.We evaluate across five stateful tool\-use benchmarks, comprising STATE\-Bench,τ2\\tau^\{2\}\-Retail,τ2\\tau^\{2\}\-Airline, ToolSandbox, and Agent\-Diff\([Microsoft, 2026](https://arxiv.org/html/2609.13800#bib.bib31);[Barres et al\., 2025](https://arxiv.org/html/2609.13800#bib.bib29);[Lu et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib7);[Pysklo et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib30)\)\. All methods use the same frozen tasks, public tool environment, and scorer\.CFRCaccesses only public action schemas, effect types, and native receipts, without simulator internals, reference outputs, or evaluator rewards\.

Models and baselines\.Our primary evaluations use GPT\-5\.4\-mini/GPT\-5\.5 and GPT\-5\.6 Luna/Sol; three cross\-provider pairs test transfer\. Baselines include cheap and strong full\-task agents, StepWise, MTRouter, RouteLLM\-BERT, FrugalGPT, and AgServe\-QAC\([Wei et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib17);[Zhang et al\., 2026](https://arxiv.org/html/2609.13800#bib.bib13);[Ong et al\., 2024](https://arxiv.org/html/2609.13800#bib.bib10);[Chen et al\., 2023](https://arxiv.org/html/2609.13800#bib.bib11);[Ren et al\., 2025](https://arxiv.org/html/2609.13800#bib.bib12)\)\. Policies and operating points are fixed before test evaluation\.

Metrics and cost\.We report official task success except for ToolSandbox, whose metric is strict all\-milestone completion\. Cost is cache\-neutral provider expenditure over all agent calls, excluding user\-simulator and evaluator roles\. Aggregates are computed over each method’s evaluated surfaces\.

### 4\.1End\-to\-End Quality and Cost

Table 1:End\-to\-end results\. Scores are task success \(%\), except that ToolSandbox uses strict all\-milestone completion\. Costs are cache\-neutral agent\-side USD\. Gap is the macro\-score difference from the corresponding strong full\-task anchor, and Cost \(%\) is the mean per\-surface ratio to that anchor marked with ”ref”\. Aggregates are computed from unrounded values\. For†baselines, both aggregates use evaluated surfaces only\. All reported methods, full\-task anchors, andCFRCconfigurations report five\-run means \(N=5N=5complete evaluation runs per surface\)\.STATE\-Benchτ2\\tau^\{2\}\-Retailτ2\\tau^\{2\}\-AirlineToolSandboxAgent\-DiffMethodScoreCostScoreCostScoreCostScoreCostScoreCostGapCost \(%\)*Escalation, routing, and cascade baselines, GPT\-5\.4\-mini/GPT\-5\.5*StepWise†54\.754\.722\.5922\.59––––––95\.895\.821\.7321\.73−2\.0\-2\.067\.9AgServe\-QAC†46\.746\.711\.2111\.2182\.582\.513\.3713\.37––––––−3\.5\-3\.564\.1MTRouter†60\.860\.824\.9724\.97––76\.076\.012\.7312\.73––––−6\.2\-6\.272\.4RouteLLM\-BERT61\.261\.226\.2926\.2977\.077\.08\.168\.1682\.082\.011\.5311\.5326\.426\.44\.684\.6891\.191\.117\.1317\.13−2\.1\-2\.159\.7FrugalGPT61\.361\.330\.6230\.6274\.574\.510\.1610\.1682\.082\.019\.1319\.1330\.230\.210\.3110\.3193\.393\.336\.0636\.06−1\.3\-1\.396\.3*Full\-task anchors and*CFRC,*same provider*GPT\-5\.4\-mini full52\.752\.75\.425\.4265\.065\.02\.232\.2364\.064\.02\.682\.6824\.024\.02\.312\.3186\.786\.76\.426\.42−11\.1\-11\.117\.8GPT\-5\.5 full61\.361\.334\.2334\.2375\.075\.014\.0214\.0288\.088\.017\.7017\.7030\.230\.210\.7810\.7893\.393\.331\.1131\.11ref100CFRC, GPT\-5\.4\-mini/GPT\-5\.563\.3\\mathbf\{63\.3\}12\.4112\.4180\.0\\mathbf\{80\.0\}3\.123\.1286\.086\.06\.716\.7131\.0\\mathbf\{31\.0\}3\.843\.8493\.8\\mathbf\{93\.8\}12\.7212\.72\+1\.2\\mathbf\{\+1\.2\}34\.6\\mathbf\{34\.6\}GPT\-5\.6 Luna full54\.054\.01\.181\.1867\.567\.50\.500\.5072\.072\.00\.670\.6726\.426\.40\.320\.3262\.262\.20\.700\.70−13\.5\-13\.55\.1GPT\-5\.6 Sol full60\.760\.718\.4418\.4480\.080\.010\.5310\.5390\.090\.013\.5713\.5730\.230\.25\.765\.7688\.988\.917\.6917\.69ref100CFRC, Luna/Sol60\.760\.74\.754\.7576\.576\.50\.980\.9886\.886\.83\.173\.1733\.3\\mathbf\{33\.3\}1\.291\.2996\.9\\mathbf\{96\.9\}5\.125\.12\+0\.9\\mathbf\{\+0\.9\}22\.0\\mathbf\{22\.0\}*Full\-task anchors and*CFRC,*cross provider*Claude Sonnet 5 full62\.762\.710\.5610\.5680\.080\.011\.0411\.0486\.086\.014\.4814\.4836\.436\.45\.485\.4882\.282\.211\.2011\.20ref100CFRC, Luna/Sonnet 562\.762\.73\.003\.0084\.0\\mathbf\{84\.0\}1\.971\.9780\.080\.02\.882\.8831\.031\.01\.691\.6991\.6\\mathbf\{91\.6\}3\.683\.68\+0\.4\\mathbf\{\+0\.4\}26\.0\\mathbf\{26\.0\}Gemini 3\.7 Flash full68\.068\.06\.936\.9385\.085\.02\.742\.7490\.090\.03\.483\.4833\.333\.31\.031\.0377\.877\.89\.179\.17ref100CFRC, Luna/Gemini 3\.7 Flash64\.764\.74\.204\.2082\.582\.50\.550\.5584\.084\.01\.241\.2434\.1\\mathbf\{34\.1\}0\.740\.7491\.1\\mathbf\{91\.1\}2\.912\.91\+0\.5\\mathbf\{\+0\.5\}44\.1\\mathbf\{44\.1\}Claude Haiku 4\.5 full53\.353\.38\.508\.5065\.065\.05\.495\.4954\.054\.06\.346\.3434\.134\.12\.232\.2333\.333\.32\.502\.50−22\.0\-22\.039\.6GPT\-5\.6 Sol full60\.760\.718\.4418\.4480\.080\.010\.5310\.5390\.090\.013\.5713\.5730\.230\.25\.765\.7688\.988\.917\.6917\.69ref100CFRC, Haiku 4\.5/Sol58\.758\.714\.6714\.6770\.070\.04\.514\.5184\.084\.07\.877\.8736\.4\\mathbf\{36\.4\}3\.563\.5675\.675\.67\.917\.91−5\.0\-5\.057\.4\\mathbf\{57\.4\}

Macro quality vs\. strong anchors\.In Table[1](https://arxiv.org/html/2609.13800#S4.T1),CFRCmatches strong anchors within 1\.2 points on macro average under GPT\-5\.4\-mini/GPT\-5\.5 at 34\.6% mean cost, and within 0\.9 points under Luna/Sol at 22\.0% cost\. GPT\-5\.4\-mini/GPT\-5\.5 matches or exceeds strong anchors on four surfaces, trailing by 2\.0 points on Airline; Luna/Sol ties or exceeds on three surfaces, trailing by 3\.5 and 3\.2 points on Retail and Airline\. Across five runs,CFRCmacro standard deviations are 0\.54 and 0\.58 points, reflecting comparable macro quality rather than uniform dominance\.

Comparison with routing and cascades\.RouteLLM\-BERT and FrugalGPT trail GPT\-5\.5 by 2\.1 and 1\.3 points at 59\.7% and 96\.3% cost, whileCFRCgains 1\.2 points at 34\.6% cost\. On StepWise, AgServe\-QAC, and MTRouter subsets,CFRCimproves accuracy by 3\.3, 7\.1, and 6\.3 points while cutting cost by 37–49%, showing the benefit of preserving progress over simple call reduction\.

Cross\-provider transfer\.Luna/Sonnet 5 and Luna/Gemini 3\.7 Flash match strong anchors within 0\.5 points macro completion at 26\.0% and 44\.1% cost across five benchmarks, though ToolSandbox similarity softens under Gemini\. Haiku 4\.5/Sol trails Sol by 5\.0 points at 57\.4% cost because weaker cheap prefixes introduce flawed commitments, thoughCFRCgains 17\.0 points over the cheap anchor\.

### 4\.2Validating the Three Stages

Table 2:Matched\-frontier progression from Direct Takeover to fullCFRCacross five surfaces \(GPT\-5\.4\-mini/GPT\-5\.5, five\-run means,N=5N=5complete runs per cell; unengaged episodes retain prefix outcomes\)\. Certified Direct adds contracts to native continuation, Contract Plan adds replica authoring, and fullCFRCadds Checked Execution\. Cells: score \(%\) / spend \(USD\)\.Stage\-wise progression across components\.Table[2](https://arxiv.org/html/2609.13800#S4.T2)isolates post\-frontier mechanisms from captured statests\_\{t\}\. Direct Takeover achieves 58\.9% accuracy at $68\.82 from exploratory wander\. Certified Direct supplies frozen contracts via RSCC but retains incremental action checking, reaching 62\.0% at $47\.06\. Contract Plan adds replica authoring to reach 65\.4%, and FullCFRCadds Checked Execution to reach 70\.8% at $38\.80\. Comparing FullCFRCagainst Certified Direct shows that gating writes behind whole\-graph admission adds 8\.8 points and saves $8\.26 over step\-by\-step checking under the same contract by preventing destructive partial execution\.

Table 3:Inference cost decomposition ofCFRCacross five surfaces \(GPT\-5\.4\-mini/GPT\-5\.5\)\. Spend partitions into cheap prefix, contract construction \(RSCC\), and residual execution \(ERC\+CE\); totals match Tables[1](https://arxiv.org/html/2609.13800#S4.T1)and[2](https://arxiv.org/html/2609.13800#S4.T2)\.Where cost is spent\.Table[3](https://arxiv.org/html/2609.13800#S4.T3)decomposes the $38\.80 spend, where RSCC averages $0\.21 across surfaces\. Three call mechanisms drive the 43\.6% savings over Direct Takeover\. Selective invocation restricts strong calls to post\-frontier residuals, engaging on 59\.6% of episodes\. RSCC eliminates exploratory re\-querying with grounded obligations, and CE fail\-closed checks halt ungrounded plans early to prevent runaway retries\.

### 4\.3Auditing Contracts and Checked Execution

Table 4:Key contract and execution audits\. Rows 1–5 evaluate grounding against ground truth and receipts; rows 6–7 evaluate CE authority and replay from execution logs\.Contract adequacy\.Table[4](https://arxiv.org/html/2609.13800#S4.T4)grounds all 50 audited bindings and recovers 62 of 68 persistent write obligations, achieving 91\.2% recall\. No ungrounded live writes were admitted in the audited sample of 50 candidate proposals, corresponding to an exact Clopper–Pearson 95% upper bound of 5\.8%\. Six omissions involved implicit updates without entity mentions; four were blocked downstream and two yielded false completions\. Formal lift to the residual objective remains conditional on complete construction because conversational disclosures fall outside tool schemas\.

Checked Execution as an authority boundary\.Table[4](https://arxiv.org/html/2609.13800#S4.T4)shows that all 124 CE interventions occur before the first live write\. These comprise 43 active proposal rejections, spanning 25 coverage, 10 dependency, and 8 grounding failures, alongside 81 holds\. All 43 rejections reproduce under deterministic replay\.

## 5Conclusion

We formalize stateful agent handoff as commitment\-constrained residual completion and introduceCFRC, freezing residual contracts from accepted history, authoring closed graphs on replicas, and verifying execution via live receipts\. Across five surfaces and model pairings,CFRCmatches strong full\-task quality at a fraction of inference cost while blocking unadmitted mutations\.

Scope and limitations\.We evaluate single\-tenure cheap\-to\-strong handoffs under frozen contracts\. While multi\-tier cascades readily compose withCFRC, recursive routing policies lie beyond our immediate scope\. Formal lift to the residual task remains conditional on complete RSCC construction, as conversational disclosures fall outside tool\-effect schemas\.

Reproducibility statement\.Code and schemas will be open\-sourced\.

## References

- Advani \(2026\)L\. AdvaniFrom confident closing to silent failure: characterizing false success in LLM agents\.arXiv preprint arXiv:2606\.09863\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Barreset al\.\(2025\)V\. Barres, H\. Dong, S\. Ray, X\. Si, and K\. Narasimhanτ2\\tau^\{2\}\-Bench: evaluating conversational agents in a dual\-control environment\.arXiv preprint arXiv:2506\.07982\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1),[§4](https://arxiv.org/html/2609.13800#S4.p2.1)\.
- Bouchard \(2026\)D\. BouchardIs escalation worth it? a decision\-theoretic characterization of LLM cascades\.arXiv preprint arXiv:2605\.06350\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Chenet al\.\(2023\)L\. Chen, M\. Zaharia, and J\. ZouFrugalGPT: how to use large language models while reducing cost and improving performance\.arXiv preprint arXiv:2305\.05176\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p1.1),[§4](https://arxiv.org/html/2609.13800#S4.p3.1)\.
- Chenet al\.\(2026\)Z\. Chen, H\. Liu, D\. Xu, D\. Dong, J\. Li, B\. Pu, and J\. ZhaiCordon: semantic transactions for tool\-using LLM agents\.arXiv preprint arXiv:2606\.17573\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Debenedettiet al\.\(2025\)E\. Debenedetti, I\. Shumailov, T\. Fan, J\. Hayes, N\. Carlini, D\. Fabian, C\. Kern, C\. Shi, A\. Terzis, and F\. TramèrDefeating prompt injections by design\.arXiv preprint arXiv:2503\.18813\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Fanet al\.\(2026\)L\. Fan, Z\. Li, Y\. Tian, Y\. Wang, R\. Li, and X\. WangThe granularity mismatch in agent security: argument\-level provenance solves enforcement and isolates the LLM reasoning bottleneck\.arXiv preprint arXiv:2605\.11039\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Foxet al\.\(2006\)M\. Fox, A\. Gerevini, D\. Long, and I\. SerinaPlan stability: replanning versus plan repair\.InProceedings of the International Conference on Automated Planning and Scheduling \(ICAPS\),pp\. 212–221\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p2.1)\.
- Gao and Zhou \(2026\)S\. Gao and L\. ZhouCan agent benchmarks support their scores? evidence\-supported bounds for interactive\-agent evaluation\.arXiv preprint arXiv:2605\.10448\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Garcia\-Molina and Salem \(1987\)H\. Garcia\-Molina and K\. SalemSagas\.InProceedings of the ACM SIGMOD International Conference on Management of Data,pp\. 249–259\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p2.1)\.
- Hoare \(1969\)C\. A\. R\. HoareAn axiomatic basis for computer programming\.Communications of the ACM12\(10\),pp\. 576–580\.External Links:[Document](https://dx.doi.org/10.1145/363235.363259)Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p2.1)\.
- Kamathet al\.\(2025\)A\. Kamath, S\. Zhang, C\. Xu, S\. Ugare, G\. Singh, and S\. MisailovicEnforcing temporal constraints for LLM agents\.arXiv preprint arXiv:2512\.23738\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p3.1),[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- KC and Budathoki \(2026\)D\. KC and A\. BudathokiHandoff debt: the rediscovery cost when coding agents take over interrupted tasks\.arXiv preprint arXiv:2606\.02875\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p3.1),[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Linet al\.\(2026\)J\. Lin, Z\. Zhou, Z\. Zheng, S\. Liu, T\. Xu, Y\. Chen, and E\. ChenVIGIL: defending LLM agents against tool stream injection via verify\-before\-commit\.arXiv preprint arXiv:2601\.05755\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Liuet al\.\(2026a\)X\. Liu, H\. Zhou, Y\. Zong, Y\. Tian, L\. Song, S\. Zhang, Y\. Li, W\. He, M\. Zheng, R\. Liu, S\. Cheng, X\. Kuang, H\. Hu, K\. Han, and Y\. WangAgentic routing: the harness\-native data flywheel\.arXiv preprint arXiv:2607\.11399\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Liuet al\.\(2026b\)Y\. Liu, X\. Peng, J\. Cao, X\. Wang, S\. Deng, J\. Chen, J\. Yin, and X\. ZhangToolGate: contract\-grounded and verified tool execution for LLMs\.arXiv preprint arXiv:2601\.04688\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p3.1),[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Luet al\.\(2024\)J\. Lu, T\. Holleis, Y\. Zhang, B\. Aumayer, F\. Nan, F\. Bai, S\. Ma, S\. Ma, M\. Li, G\. Yin, Z\. Wang, and R\. PangToolSandbox: a stateful, conversational, interactive evaluation benchmark for LLM tool use capabilities\.arXiv preprint arXiv:2408\.04682\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p1.1),[§2](https://arxiv.org/html/2609.13800#S2.p3.1),[§4](https://arxiv.org/html/2609.13800#S4.p2.1)\.
- Microsoft \(2026\)MicrosoftSTATE\-Bench: benchmark AI agents on enterprise workflows\.Note:[https://github\.com/microsoft/STATE\-Bench](https://github.com/microsoft/STATE-Bench)Accessed 2026\-08\-31Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1),[§4](https://arxiv.org/html/2609.13800#S4.p2.1)\.
- Onget al\.\(2024\)I\. Ong, A\. Almahairi, V\. Wu, W\. Chiang, T\. Wu, J\. E\. Gonzalez, M\. W\. Kadous, and I\. StoicaRouteLLM: learning to route LLMs with preference data\.arXiv preprint arXiv:2406\.18665\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p1.1),[§2](https://arxiv.org/html/2609.13800#S2.p1.1),[§4](https://arxiv.org/html/2609.13800#S4.p3.1)\.
- Patilet al\.\(2024\)S\. G\. Patil, T\. Zhang, V\. Fang,et al\.GoEX: perspectives and designs towards a runtime for autonomous LLM applications\.arXiv preprint arXiv:2404\.06921\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Pyskloet al\.\(2026\)H\. M\. Pysklo, A\. Zhuravel, and P\. D\. WatsonAgent\-Diff: benchmarking LLM agents on enterprise API tasks via code execution with state\-diff\-based evaluation\.arXiv preprint arXiv:2602\.11224\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1),[§4](https://arxiv.org/html/2609.13800#S4.p2.1)\.
- Renet al\.\(2025\)Y\. Ren, L\. Chen, D\. Li, X\. Wang, Z\. Wu, Y\. Miao, and Y\. BaiTranscending cost\-quality tradeoff in agent serving via session\-awareness\.InAdvances in Neural Information Processing Systems,Vol\.38\.Cited by:[§4](https://arxiv.org/html/2609.13800#S4.p3.1)\.
- Schneider \(2000\)F\. B\. SchneiderEnforceable security policies\.ACM Transactions on Information and System Security3\(1\),pp\. 30–50\.External Links:[Document](https://dx.doi.org/10.1145/353323.353382)Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Shinnet al\.\(2023\)N\. Shinn, F\. Cassano, E\. Berman, A\. Gopinath, K\. Narasimhan, and S\. YaoReflexion: language agents with verbal reinforcement learning\.InAdvances in Neural Information Processing Systems,Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Sonet al\.\(2026\)S\. Son, S\. Yoon, J\. Tang, S\. Wang, L\. Wolf, and I\. BogunovicSWE\-Router: routing in multi\-turn agentic software engineering tasks\.arXiv preprint arXiv:2607\.00053\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p1.1),[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Trivediet al\.\(2024\)H\. Trivedi, T\. Khot, M\. Hartmann, R\. Manku, V\. Dong, E\. Li, S\. Gupta, A\. Sabharwal, and N\. BalasubramanianAppWorld: a controllable world of apps and people for benchmarking interactive coding agents\.InAnnual Meeting of the Association for Computational Linguistics,Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p1.1),[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Wanget al\.\(2026\)H\. Wang, C\. M\. Poskitt, and J\. SunAgentSpec: customizable runtime enforcement for safe and reliable LLM agents\.InInternational Conference on Software Engineering,Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p3.1),[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Wanget al\.\(2024\)Z\. Z\. Wang, J\. Mao, D\. Fried, and G\. NeubigAgent workflow memory\.arXiv preprint arXiv:2409\.07429\.Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p3.1),[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Weiet al\.\(2026\)J\. Wei, K\. Ni, Y\. Zhao, G\. Gan, and A\. CohanStep\-level optimization for efficient computer\-use agents\.arXiv preprint arXiv:2604\.27151\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p1.1),[§4](https://arxiv.org/html/2609.13800#S4.p3.1)\.
- Yaoet al\.\(2024\)S\. Yao, N\. Shinn, P\. Razavi, and K\. Narasimhanτ\\tau\-bench: a benchmark for tool\-agent\-user interaction in real\-world domains\.arXiv preprint arXiv:2406\.12045\.Cited by:[§2](https://arxiv.org/html/2609.13800#S2.p3.1)\.
- Yaoet al\.\(2023\)S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. CaoReAct: synergizing reasoning and acting in language models\.InInternational Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2609.13800#S1.p3.1),[§2](https://arxiv.org/html/2609.13800#S2.p1.1)\.
- Zhanget al\.\(2026\)Y\. Zhang, H\. Li, Z\. Wang, S\. Feng, X\. Yang, D\. Wang, B\. Zhang, L\. Bai, and S\. HuMTRouter: cost\-aware multi\-turn LLM routing with history–model joint embeddings\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 44206–44226\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.2045)Cited by:[§4](https://arxiv.org/html/2609.13800#S4.p3.1)\.