CONTINUUM
Summary: CONTINUUM's MCP server gives an agent durable, crash-safe task state — progress, plans, checkpoints, and reasoning summaries — plus an idempotent ledger that gates external side effects so a run can be safely resumed after interruption.
Record progress (
continuum_record_progress) — completed/failed/total counts and goal; creates the run on first call, cheap to call often.Checkpoint state (
continuum_checkpoint) — durable snapshot with env, reason, model_id, and provider for later model-identity checks.Record reasoning summary (
continuum_record_summary) — plan_stack, decisions, open_questions, working_set, pinning; 4096-char cap so a fresh session inherits the plan.Record plan milestones (
continuum_record_plan) — units with id/title/status (pending, working, done, blocked) and depends_on.Validate state (
continuum_validate) — read-only check of whether saved state is still trustworthy against a declared env and expected model.Ask to resume (
continuum_resume) — read-only verdict on whether it's safe to continue and what to do first; defaults to the most recent interrupted run.Confirm self-reported state (
continuum_confirm) — clearsrequest_humanfor agent-reported runs; refused unless the operator setCONTINUUM_MCP_CONFIRM_TOKEN; supports scoped confirmation (goal or progress).Claim a side effect (
continuum_intercept_action) — permission before an external effect, with a stable key for dedup; returns prior result orunknownstatus if a prior attempt was interrupted.Complete an action (
continuum_complete_action) — settle a claimed action with result, external_id, and consumed_inputs.Fail an action (
continuum_fail_action) — report failure, withcertaindistinguishing definite non-occurrence from uncertain outcomes.Reconcile an action (
continuum_reconcile_action) — settle an unknown outcome from real evidence (occurred true/false); accepts action_key or action_id.Compensate an action (
continuum_compensate_action) — mark a completed effect as deliberately undone (e.g. refund).List actions (
continuum_list_actions) — read-only view of recorded side effects, flaggingoutcome_unresolvedones that block resume.
Provides hooks for CrewAI agents to record actions, gate side effects, and resume after failures.
Adds CONTINUUM checkpointing and recovery to LangChain-based agents, preserving semantic state across crashes.
Integrates with LangGraph to checkpoint agent state and resume long-running graphs after failures.
Provides recovery and checkpointing support for OpenAI-based agent runs, allowing a failed run to resume without repeating work.
Bridges CONTINUUM events to OpenTelemetry so checkpoint and recovery activity can be traced and observed.
Contents
Why · Quick Start · How it works · Where CONTINUUM sits · Features · Security Extension · Empirical Verification · MCP Integration · Framework Integration · Core Concepts · Architecture · API and CLI · Roadmap · What CONTINUUM Is Not · Related work · Status and limitations · Contributing · License
Related MCP server: GoLogX (logx-mcp)
Why
Modern AI agents run long tasks (hundreds of LLM calls, tool invocations, file and database writes). When they crash, the usual response is to replay everything from scratch, which duplicates work, duplicates side effects, wastes tokens, and loses decisions.
CONTINUUM asks a narrower, harder question: can an agent resume from a compact semantic representation of its task state while independently verifying that state is still valid in the current environment? Its differentiator is three-part:
Semantic checkpoints: a compact, versioned representation of what the agent needs to continue, not a conversation dump.
Independent environment revalidation: every checkpoint component is verified against the current environment before resume, with staleness propagating through the dependency graph.
Provenance-aware state: every fact traces to its origin, so agent-reported progress is never self-certifying.
Quick Start
Published to PyPI as continuum-agent 0.1.2: pip install continuum-agent (pip install continuum-agent==0.1.2 to pin). Release tags additionally ship built wheels attached to GitHub Releases.
Paths that need no clone and no local install:
Path | How |
Install from PyPI |
|
Install with Homebrew |
|
Watch crash recovery happen end to end |
|
Use the CLI through Docker |
|
Run the CLI without cloning |
|
Windows PowerShell (from a clone) |
|
Watch the same recovery in a notebook | |
The same notebook, on Binder | |
Full dev environment in the browser |
The Docker image is published to GHCR by CI on every push to main and every release tag (.github/workflows/docker-publish.yml). The Codespace is defined in .devcontainer/. The notebook is examples/demo.ipynb: its first cell installs CONTINUUM only when the import fails, so the one file runs on Colab, on Binder, and from a clone.
git clone https://github.com/Cyrax321/CONTINUUM.git
cd CONTINUUM
uv venv && source .venv/bin/activate # macOS / Linux; Windows: .venv\Scripts\activate
# Contributors (recommended): library + CLI + test tooling + framework integrations
uv pip install -e ".[dev]"
# Or pick only what you need: . (minimal), [mcp], [browser], [kubernetes],
# [otel], [langgraph], [openai], [langchain], [attest], [postgres]
# Or skip the clone entirely:
uv pip install git+https://github.com/Cyrax321/CONTINUUM.git
uv pip install "continuum-agent[mcp] @ git+https://github.com/Cyrax321/CONTINUUM.git"pip fallback: replace
uv pip installwithpip installin every command above.
Optional environment adapters:
uv pip install -e ".[browser]"enablesBrowserAdapter; runplaywright install chromiumseparately to install the browser binary.uv pip install -e ".[kubernetes]"enablesKubernetesAdapter;kubectland a configured cluster remain external prerequisites.
If you use pip instead of uv, run pip install -e ".[browser]" or
pip install -e ".[kubernetes]" with the same external prerequisites.
Verify:
continuum --help # CLI entrypoint
continuum-mcp --help # MCP server entrypoint (needs [mcp] or [dev])
pytest -q # ~4400 collected, ~4,400 passed, ~0 skipped on a minimal env (exact counts vary)
ruff check src/ tests/ examples/ && ruff format --check src/ tests/ examples/
mypy src/continuum # the three gates CI enforcesThe core library has one runtime dependency (pydantic>=2.7); everything else is opt-in. The full package map, extras matrix, Postgres test setup, and per-command verification are in references/install.md.
Wire a coding agent in two minutes
For Claude Code, Gemini CLI, or Codex, you do not write Python and do not need a prompt file:
continuum start my-task --goal "What the agent should do"
continuum hooks install claude-code --with-gate # also: gemini, codexFrom then on every file the agent writes is captured as hash-chained evidence, its session starts with an automatic status briefing, unclaimed side effects registered in .continuum/gate.json are refused before they fire, and a fresh session after any crash resumes with executable next steps. No CLAUDE.md required.
Minimal library example, record and recover:
from continuum import EventType, Run, SQLiteStorage, project
store = SQLiteStorage("agent.db")
store.create_run(Run(run_id="run_4821", goal="Analyze 10,000 documents"))
store.append_event(
"run_4821", EventType.RUN_STARTED, {"goal": "Analyze 10,000 documents", "total": 10_000}
)
for i, doc in enumerate(documents):
analyze(doc)
store.append_event("run_4821", EventType.WORK_COMPLETED, {"doc": i})
# After a crash, a new process picks up exactly where it stopped:
state = project("run_4821", store.read_events("run_4821"))
print(state.progress.completed) # already done, not repeated
print(store.verify_events("run_4821").ok) # True, chain intact after the crashRun the proof yourself:
python examples/crash_recovery_agent.py # real process kill, real side effect
python examples/context_compaction.py # transcript lost, checkpoint survives
python examples/model_switch.py # Model A dies, Model B resumes safely
python scripts/mcp_smoke.py # real subprocess, real JSON-RPC trafficThe e2e-autonomy-test/ kit scripts a real invoice-batch task, a hard-kill mid-run, and a fresh resume session, then scores the outbox, ledger, and event chain out of band. Run 1 scored 7/7 mechanics against a real Claude Code session. Full walkthrough in references/e2e.md.
How it works
CONTINUUM separates LLM context (temporary) from durable task state (permanent). Instead of saving conversation history, it constructs a semantic checkpoint, the minimum verified information required to continue.
The detailed explanation, the projection model, and the recovery context are in references/architecture.md. The full-system Mermaid view, from the five integration seams through the enforcement boundary and storage backends to the surfaces, is in docs/diagrams/architecture.md.
Where CONTINUUM sits
Four concerns overlap in every long-running agent. CONTINUUM owns only the last one and touches the other three through explicit seams. No competitor is named and no claim is made without a shipped module or a published suite that already prints it.
Layer | Answers | How it connects (shipped modules or published output) |
Harness | How does the agent call tools and make progress toward a goal? | Outside CONTINUUM. Wiring points ship in |
Durable execution | What happened before a crash and what can be replayed without losing work? | Hash-chained event log |
Control plane | Which run is active, who may act on it, and where does output go? | Run registry and parent/child hierarchy |
Verification substrate | Given the checkpoint at time T and the world as it is now, is it still safe and correct to continue? |
|
Every row above is traceable to a path that exists on main at the tagged commit. Nothing in this table restates a benchmark number, benchmarks live only in the suite output they already print. See docs/research.md for the full list of published suites and design docs.
Crash recovery, for real
The image below is not a mock. It is the output of python demo-run/generate_crash_visual.py, which runs demo-run/worker.py until os._exit(9) at document 399, calls continuum resume --env dataset=v4 and shows the refusal path (REQUEST_HUMAN, safe:false, exit 21), reconciles the uncertain side effect with a probe, then resumes from the same database and finishes with no duplicate work. The transcript is also saved as docs/assets/crash-recovery.txt for audit.
Regenerate it:
python demo-run/generate_crash_visual.py
# or: python scripts/generate_crash_visual.pyFull walkthrough with code is in docs/recovery_walkthrough.md (examples/recovery_walkthrough.py). The minimal bench harness is in references/bench.md (continuum benchmark).
Features
Capability | What it gives you |
Semantic checkpoints | Compact, versioned, inspectable state, not a transcript dump |
Idempotent action ledger | Refuses duplicate external side effects; surfaces uncertain ones for reconciliation |
Environment revalidation | Every checkpoint component verified against the current world before resume |
Provenance-aware state | Agent-reported progress is marked |
Recovery engine | Seven recovery modes with a deterministic, sealed next-action contract |
Deny-by-default MCP server | Thirteen tools, read-only/mutating split, caller allowlist |
Framework adapters | Generic Python, OpenAI Agents SDK, LangGraph, and LangChain integrations |
Secure planning loop | Two-signal observation verification escalates high-risk branches to REQUIRES_REVIEW |
Periodic revalidation | Environment re-checked on a schedule, catching mid-run drift within one cycle |
Tamper-evident log | Hash-chained event log (57 event types) with integrity verification |
Enforcing gate | Unclaimed side-effect calls are refused before they fire; deny messages teach the claim protocol |
Observation hooks | Every file a coding CLI writes becomes digest-verified evidence, outside model control |
Session briefing | Fresh sessions learn run state deterministically at start, including the last session's reasoning summary |
Reconciler probes | Registered commands settle uncertain side effects automatically; humans see only the rest |
Executable guidance | Resume/validate render next steps as runnable commands, not statuses |
Enforcing HTTP gateway | Outbound calls in any language require claims; responses settle them from reality |
OpenTelemetry bridge | Tool-call spans from production tracing become evidence with zero code changes |
Action index | Cross-run idempotency lookups are indexed reads, not full-log scans |
Version pinning | Caller-asserted prompt/tool/model hashes stored per claim; drift surfaced on resume |
Retry budgets | Per-action-type attempt caps enforced at claim time; agents see remaining attempts |
Multi-agent parent/child | Parent resume composes family worst state; uncertain child blocks parent |
Informed retry | Engine-authored failure summaries injected into post-recovery resumes |
Fork semantics | Divergent continuations branch into child runs with fresh authority |
Log compaction | Pre-anchor prefix archived verbatim; live log bounded for month-long runs |
Consumed-grant tracking | Single-use authority references are marked spent at terminal status; reuse after restore is refused ( |
Chain attestation |
|
HITL dashboard surface | Confirm/reconcile/complete buttons with audit parity to the CLI |
Security Extension
Two additive security extensions sit on top of the recovery and checkpoint substrate. They do not change resume, replay, or the existing crash-time revalidation path.
Status: specified and tested, not shipped (issue #1030). The modules below are complete and pass their tests, but nothing in the engine or any seam invokes them yet (CONTINUUM revalidates at crash/resume only). Wiring them is a roadmap decision; read the present tense below as the design, not the shipped behaviour.
Secure Planning Loop: observations carry provenance and are verified by two independent signals (
verified/unverified/contested). A plan branch gated on an unverified or contested observation is escalated toREQUIRES_REVIEW. Decisions are appended to the ledger asPERCEPTION_OBSERVEDandBRANCH_RESOLVEDevents.Periodic Revalidation: reuses the recovery engine on a step interval (default 25) and on app switch, so mid-run environment drift is caught within one cycle instead of only at the next crash.
See docs/PROBLEM.md, docs/RESULTS.md, and STATUS.md.
Empirical Verification
CONTINUUM is verified against real LLM agents, live protocol boundaries, and hard process crashes, not just mock unit tests.
Real agents: multi-session Claude Code invoice batches with mid-run
SIGKILL, scored 7/7 on mechanics; resumed sessions queriedcontinuum_resume, routed side effects through the two-phase ledger, refused to duplicate verified writes, and respectedrequest_human. Live testing surfaced prompt-drift dedup gaps, closed by canonical path normalization and token-based fallback inActionLedger.claim().Third-party clients: Gemini CLI and Kilo Code connected over stdio JSON-RPC against the live SQLite store, validating multi-agent co-existence and authorization isolation.
Protocol compliance: driven end to end with
@modelcontextprotocol/inspector --cliacross process deaths; mutating tools deny by default behindCONTINUUM_MCP_MUTATING_CLIENTS; external claims degrade toREQUIRES_REVIEW(safe: false).Self-healing: hard-killed servers recover from orphaned SQLite
-wal/-shmsidecars via single-retry cleanup at startup.Scale: roughly 4400 tests collected (~4,400 passing; ~0 skipped; other outcomes vary by environment) on Python 3.11, 3.12, and 3.13 (unit,
hypothesisproperty-based, concurrency, adversarial). CONTINUUM-Bench runs five crash scenarios plus a dedicated argument-drift scenario, measuring 0 duplicate work and 0 duplicate side effects for CONTINUUM against full duplication for naive replay; the horizon-scale suite publishes those duplicate counts next to the number of post-reconstruction re-attempts the ledger refused, so its zeros carry a positive control rather than reading as constants; a separate 14-scenario recovery-correctness suite (continuum.benchmark.phase6) encodes the crash points from the durable-execution survey as executable assertions, and a 7-fault risk-injection suite (benchmarks/fault_injection/) grades failure handling.Adversarial audit: the full MCP surface was audited over the live protocol; three defects were found and fixed. Method and reproduction steps in test.md.
Horizon-scale benchmark (real runs, no invented numbers)
Generated: 2026-10-08T18:27:24.485759 Horizon scenarios: 5 Passed: 4 Failed: 1
Accuracy: 0.8 Unnecessary escalation: 0.2 Repair precision: 0.8 Duplicate side effects: 0 Duplicate work: 0.0 Compression: 0.26
Side effects performed: 630 Duplicate re-attempts refused by the ledger: 79
Scenario | Cycles | Years | Correct | Actual | Accuracy |
horizon_steady_progress_year | 141 | 2.3 | resume | resume | 1.0 |
horizon_quarterly_drift_year | 141 | 2.3 | repair | request_human | 0.0 |
horizon_budget_exhaustion_year | 141 | 2.3 | request_human | request_human | 1.0 |
horizon_compaction_stress_year | 177 | 2.87 | resume | resume | 1.0 |
horizon_abort_condition_year | 141 | 2.3 | abort | abort | 1.0 |
Fault-injection: 7 scenarios, detection 1.0, unsafe 0.0
MCP Integration
CONTINUUM ships an MCP server so an agent can record progress, checkpoint, and route external side effects through the ledger without embedding the library:
uv pip install -e ".[mcp]"
CONTINUUM_MCP_MUTATING_CLIENTS=your-client-name continuum-mcpOn Windows, the env-prefix form has no PowerShell equivalent, so set the variable first:
uv pip install -e ".[mcp]"
$env:CONTINUUM_MCP_MUTATING_CLIENTS = "your-client-name"
continuum-mcpThirteen tools over stdio. Three are read-only (continuum_validate, continuum_resume, continuum_list_actions); ten mutate. Side effects are two-phase (claim, perform, complete), and mutating tools deny by default behind an allowlist. Agent-reported state is recorded with Origin.EXTERNAL_AGENT provenance and marked REQUIRES_REVIEW.
Verification details, including crash recovery at startup and the end to end Claude Code test, are in references/mcp.md. If a registered server reports CONNECTION_CLOSED, the cause is almost always PATH resolution rather than the server itself: docs/api/mcp.md has the diagnosis and two remedies.
Framework Integration
Nine adapters ship in src/continuum/adapters/ (one in-process facade plus eight integrations), all optional installs so the core stays standard-library-only:
Adapter | Class | Notes |
Generic Python agent |
| In-process facade; writes trusted ( |
Filesystem sandbox |
| Local directory sandbox, no external service, default for docs and CI. |
Python in-process |
| Runs Python in a temp workdir, records via ledger. |
Container |
| Docker backed, guarded skip when |
Browser |
| Playwright backed, guarded skip when not installed. |
Kubernetes |
|
|
OpenAI Agents SDK |
| Experimental. Hooks |
LangGraph |
| Experimental. Wraps a |
LangChain |
| Experimental. Drops |
Each adapter records progress through the ledger and routes external effects through the two-phase intercept/complete protocol. All three framework adapters have end-to-end integration tests and have been driven against a live OpenRouter model, where the runs surfaced and then closed an LLM argument-drift dedup gap and two OpenAI-adapter bugs, including a live hard-crash (os._exit(137) mid-side-effect) proof per adapter. Full usage, live-model results, and runnable examples for every adapter are in references/adapters.md.
Production LangGraph apps can also keep their native persistence API: make_continuum_checkpointer(storage) implements LangGraph's BaseCheckpointSaver over CONTINUUM's storage, so every put lands in the same hash-chained, provenance-tagged event log (see references/adapters.md).
Three further production frameworks are covered by thin, SDK-free hook surfaces in adapters/thin.py:
Framework | Interception surface | Entry point |
CrewAI | global before/after tool-call hooks |
|
AutoGen core |
|
|
Pydantic AI | async Hooks capability |
|
For stacks none of these reach: continuum gateway enforces claims on outbound HTTP from any language, continuum.otel.make_span_processor(storage) turns existing OpenTelemetry tool spans into evidence, and continuum serve exposes the same operations as the MCP tools over a language-agnostic JSON wire protocol (stdio, or HTTP via --transport http with CONTINUUM_SERVE_TOKEN auth).
Resuming agent- or MCP-reported runs
State reported over MCP, or through the OpenAI adapter, carries Origin.EXTERNAL_AGENT provenance and resolves to request_human until confirmed. LangGraph and LangChain runs use Origin.DETERMINISTIC and resume directly. To clear review and resume:
continuum confirm <run_id> # records REVIEW_CONFIRMED, then re-assesses
continuum resume <run_id> # now reports RESUMEOver MCP the equivalent is the continuum_confirm tool followed by continuum_resume. Confirmation is a one-time, human-attested event: the escape hatch for the self-certification safety, so an externally-driven run is never permanently stuck.
Core Concepts
The vocabulary these sections use is defined in docs/GLOSSARY.md, with every term pointing at its implementation.
The deep reference for each concept lives in references/concepts.md.
Semantic Checkpoints - a compact, versioned representation of what the agent needs to continue.
State Validation - every component independently verified; staleness propagates through the dependency graph.
Idempotent Action Ledger - external side effects tracked and de-duplicated; uncertain outcomes raise instead of silently retrying.
Recovery Modes -
RESUME,REPAIR_AND_RESUME,ROLLBACK,WAIT,REQUEST_HUMAN,ABORT(plusREPLAN).Recovery Contract - a deterministic, integrity-sealed, gated next action.
Architecture
CONTINUUM is organised around one invariant: every fact carries its origin, and trust is earned, never assumed. Why this matters for a startup: an agent that runs for weeks must not lose work when its context is lost, and it must not waste tokens, cost, or fire a tool twice.
System at a glance: universal adapter, one log, any harness
Any harness plugs into the same hash chained log. The same run can be written by Claude Code, resumed by LangGraph, inspected by the CLI, and approved on the dashboard. No framework cooperation is required.
Claude Code ─┐
Gemini CLI ──┤
Codex ───────┤
LangGraph ───┼── 5 seams ──► One durable log ──► Recovery + Dashboard + CLI
LangChain ───┤ (hash chained, (sealed contract,
OpenAI SDK ──┤ provenance tagged, verify, health,
CrewAI ──────┤ exactly once) family)
Any HTTP ────┤
Any OTel app ┘
Seams: 1 In-process 2 MCP 3 CLI hooks 4 Gateway 5 OTelThe three guarantees (the demo proves each one)
No self-certification. Agent reported state is
EXTERNAL_AGENTand degrades toREQUIRES_REVIEWuntil a humanREVIEW_CONFIRMED. Only trusted writers produceDETERMINISTICstate.Side effects require claims. Every external effect is claimed in an idempotent ledger before it fires. Unclaimed effects are blocked at the boundary, duplicates are refused, uncertain outcomes raise for reconciliation.
Recovery verifies against reality. Resume checks file digests, dependency versions, and model identity before saying safe. Staleness propagates
dependency -> evidence -> finding -> decisionplusPlanStep.depends_onso only affected steps repair.
Five integration seams
Seam | How to connect | What it gives you |
1 In-process |
| Python frameworks, trusted writes |
2 MCP server |
| Any MCP capable client, 3 read-only + 10 mutating, allowlist |
3 CLI lifecycle hooks |
| Coding CLIs: |
4 Enforcing HTTP gateway |
| Any language, any outbound HTTP must have a claim, gateway settles from real status code |
5 OpenTelemetry bridge |
| Any traced app, spans become |
Thin hook surfaces for CrewAI, AutoGen, Pydantic AI live in adapters/thin.py with no SDK required.
Enforcement pipeline: why no duplicate and no invalid call
The gate to observe pipeline closes the gap at the harness boundary. This is what saves tokens and cost and blocks invalid tool calls.
PreToolUse hook PostToolUse hook
| |
v v
continuum gate continuum observe
| |
|-- no claim? DENY (exit 2) |-- TOOL_COMPLETED event:
| + instructions to claim | path, bytes, sha256 on disk now
| |
|-- live claim? ALLOW |-- disk checked status:
| | verified / changed / missing
v
agent performs effect
|
v
continuum_complete_action (settled from reality, not from report)
|
v
ledger marked COMPLETED: next replay returns cached result, not a second fireUnknown host is denied fail closed, not an open relay. Shell Bash/curl is the documented v1 blind spot.
Recovery decision tree: weeks until done, correct and exactly
The engine takes the most cautious signal, so safety never loses to convenience.
RESUME < REPAIR_AND_RESUME < REPLAN < WAIT < REQUEST_HUMAN < ROLLBACK < ABORTEvery continuum resume returns a sealed contract with: recovery status and safe, verified/invalidated components, executable human_steps (exact shell to run), post checkpoint observations disk checked, pinning drift, and family aggregation for multi agent continuum tree. Briefing continuum briefing injects that contract on every fresh claude SessionStart, so saying hi after you killed the terminal resumes from the last good prefix.
Why this saves tokens, cost, and invalid calls
Tokens: Semantic checkpoint stores
Goal + Plan + Progressnot a transcript dump. Briefing serves only verified state plus a 4096 cap reasoning summary, not the error tail that self conditioning shows degrades the next session. Informed retryrecovery/summary.pyinjects an engine authored summary, not raw history.Cost: Ledger
action_indexrefuses duplicate side effects even under argument drift like relative vs absolute paths (invoice:INV-001stable key), so the same API is not paid twice after a resume. Budgetsbudgets.pycap retry storms at claim time.continuum benchmarkprints0 duplicatesfor continuum vs50for naive.Invalid calls: Gate and gateway and
replayguardlanggraph_protected_nodeblock unclaimed or replayed tool calls before they fire. Pinningpinning.pysurfaces prompt or tool drift on resume.
Storage architecture
Schema v6. SQLite is primary, Postgres is CI verified. One log, many projections.
Table | Purpose |
| Hash chained append only log (57 event types in v0.2) |
| Run metadata with |
| SemanticState snapshots per checkpoint |
| Sealed checkpoint records with |
| Cross run idempotency projection (schema v3+): indexed reads, not full scans |
| Compacted prefix storage (schema v5+): |
| LangGraph native persistence (schema v4+): |
Module map: one library, many surfaces
CONTINUUM is one library (src/continuum, 153 modules) plus a large test suite (242 test files, ~4400 tests). All modules append to and replay one hash chained event log:
Module | Role |
| Append only, hash chained event log and |
| Projection |
|
|
| Idempotent ledger |
| Policy driven checkpoints |
| Engine, planner, sealed contract |
| Pre tool use enforcement: allow or deny against ledger claims |
| Enforcing HTTP proxy: claim before fire for outbound requests |
| Portable guard: |
| Shared checkpoint hooks and installer profiles |
| Retry budget registry and evaluation per action type |
| Version pinning normalisation and drift detection on resume |
| Semantic similarity backends exact/fuzzy/embedding for replay vs fork |
| Probe registry |
| 9 class adapters + thin hooks |
| 13 stdio tools plus authz |
| Sidecar stdio JSON wire + HTTP |
| Web dashboard |
| 56 argparse commands, exit codes as verdict: |
| OpenTelemetry span processor bridge |
| CONTINUUM-Bench harness: 5 crash scenarios + argument drift + 14 scenario recovery suite + 7 fault risk injection |
Honest limitations
Gate does not see inside shell commands (Bash/curl bypass structured tool claims)
Postgres backend is CI tested but not battle tested in production
One level of multi agent hierarchy v1
Large payload offloading (#254) not yet implemented
Weeks scale benchmark with token cost table lands in #550 board (#568 to #570)
Full reference in references/architecture.md. And the months plane that builds on this (provenance causal graph, authority resurrection, admissibility, liveness) is pinned as board #550 with 20 sub issues #551 to #570.
API and CLI
Task guides are indexed in docs/guides/README.md, the library and CLI reference in docs/api/README.md, worked end-to-end examples in docs/recipes/README.md, the mechanism behind constraint survival in docs/concepts/README.md, and the research notes behind each mechanism in docs/research/README.md.
Python surface (EventType, Run, SQLiteStorage, diff_states, project) and the adapter API are documented with runnable examples in references/api.md. The CLI is the same surface in shell form:
continuum runs # list runs
continuum inspect <run_id> # semantic state
continuum validate <run_id> --env dataset=v4 # validate, read-only
continuum resume <run_id> --env dataset=v4 # recovery decision + contract + next steps
continuum checkpoint <run_id> # force a checkpoint, mutates
continuum actions <run_id> # external side effects
continuum reconcile <run_id> # settle uncertain effects with probes
continuum complete <run_id> # close a run as done, from the keyboard
continuum verify <run_id> # re-audit the event hash chain
continuum budget <run_id> # retry-budget usage per action type
continuum compact <run_id> # archive pre-anchor log prefix
continuum tree <parent_run_id> # show parent + children with recovery states
continuum attest <run_id> --key signer.pem # sign the chain head for an external verifierAll wiring is host-side; the model's cooperation is optional:
continuum hooks install claude-code --with-gate # coding CLIs: evidence, briefing, gate
continuum gateway --port 8765 # enforcing HTTP proxy for everything else
provider.add_span_processor(continuum.otel.make_span_processor(storage)) # OTel to evidence
continuum-mcp # anything MCP-capable: the thirteen-tool server
continuum briefing # session-start context injection
continuum budget <run_id> # retry-budget usage report
continuum tree <parent_run_id> # multi-agent hierarchy viewOptional registries live beside your code and are data, not code: .continuum/gate.json (side-effect tools + stable-key templates), .continuum/reconcilers.json (probes that check external systems), .continuum/gateway.json (upstream routes).
Most commands accept global --json before the subcommand (e.g. continuum --json resume RUN), and read-only commands never write, so they are safe against a live database while an agent is mid-run. The two exceptions are audit-only and fire solely for a run that is already parked: resume records its webhook delivery outcome when the verdict is REQUEST_HUMAN and an endpoint is subscribed, and watch records a liveness verdict flip; neither append projects onto state or moves the exit code. Exit codes are a safety contract (only a verified-safe run exits 0). Full command list, exit-code table, and state-diff output in references/cli.md.
Roadmap
Phase | Component | Status |
1-11 | Data models, semantic state, persistence, checkpointing, validation, action ledger, recovery engine, CLI, crash-recovery examples, environment snapshots/diffs, framework adapters | Complete |
12 | Benchmark suite (CONTINUUM-Bench) | Complete (minimal harness) |
13 | Cloud API (FastAPI + PostgreSQL) | Partial: the PostgreSQL storage backend and the HTTP sidecar transport ( |
14 | Dashboard | Complete ( |
15+ | Enforced durability: observation hooks, gate, session briefing, reconciler probes, enforcing gateway, OTel bridge, action index, executable guidance, multi-client installers, semantic replay detection, version pinning, retry budgets, log compaction, HITL surface, fork semantics, informed retry, multi-agent aggregation | Complete (see issue #213) |
Next | Months-scale durability plane: milestone-anchored plans (#312), structured attempt memory (#313), atomic dual-state rewind (#292), public recovery-correctness benchmark (#293) | Planned (draft spec in docs/UPGRADE_SPEC.md); webhook-out notifications (#305) shipped |
Beyond the original plan: the MCP server, MCP authorization and caller-authentication layers, provenance and anti-self-certification, community files, schema versioning with forward migrations, a bounded recovery context, consumed-grant tracking, Ed25519 event-chain attestation, the native LangGraph checkpointer, and wheel artifacts on every push to main are shipped. See STATUS.md for the verified-vs-believed breakdown and open correctness bugs.
What CONTINUUM Is Not
Not this | This instead |
An LLM | A reliability layer for agents that use LLMs |
An agent framework | A recovery layer that plugs into any framework |
A vector database | Structured semantic state, not embeddings |
A RAG system | Verified checkpoints, not retrieval-augmented memory |
A workflow engine | A recovery layer, not an orchestrator |
The core abstraction: semantic state + environment validation + action reconciliation = safe recovery.
The verdict is advisory, not enforced
CONTINUUM tells you the truth about a run. It does not stop your process when the answer is unwelcome. RecoveryDecision.permits() reports what the contract allows; nothing in the library intervenes if a caller ignores a False and acts anyway. A worker that calls CheckpointManager.restore directly can continue past a REQUEST_HUMAN verdict, because it never asked the engine whether to.
This is a deliberate contract for a library: forcing enforcement inside a call the caller made to inspect a verdict would surprise the callers who legitimately want to read it and then override it.
Enforcement exists, but as separate seams you opt into. None is enabled by a plain pip install continuum-agent:
Seam | How to enable |
Host gate |
|
HTTP gateway |
|
Replay guard for framework calls |
|
Observation hooks |
|
The one enforcement that ships enabled is the CLI exit code. continuum resume exits non-zero unless the run is verified safe (RESUME), so continuum resume "$RUN" && ./start-agent.sh cannot launch onto stale state. Every other mode maps to a distinct non-zero code, and a mode nobody has classified falls through to UNSAFE rather than OK.
If you want the verdict enforced, wire a seam or gate your pipeline on the exit code. Do not assume the library is supervising the process.
Related work
CONTINUUM sits at the overlap of durable execution, idempotent side-effect tracking, and crash recovery for LLM agents. The closest neighbors are machine-checked resume contracts (Khan 2026), agentic transaction processing with constraint-gated admission (Mnemosyne 2026), checkpoint-rollback attack analysis (ACRFence 2026), and design-level prompt-injection defense (CaMeL 2025). The full annotated list, foundations, and citation audit are in references/related-work.md.
Documentation map
Every page under docs/ and the reasoning behind it:
Reference and API: docs/api/README.md (library, CLI, MCP, sidecar), docs/GLOSSARY.md (every recovery term, each pointing at its implementation), references/api.md, references/cli.md.
Task guides: docs/guides/README.md, docs/recipes/README.md, docs/concepts/README.md.
Security: docs/threat_model.md (what is protected, detected, and explicitly not), docs/signing_key_rotation.md (rotating a keyed seal without breaking verification of older hash-only contracts).
Contracts and scale: docs/contract_compatibility.md (a sealed promise verified by another build), docs/multi_agent_isolation.md (shared
run_idisolation), docs/audit-provenance-compaction-294.md (provenance surviving compaction).Authoring and operations: docs/adapters_guide.md (writing an adapter), docs/cloud_api.md (optional deployment layer), docs/TESTING_MCP.md (adversarial MCP surface audit), docs/CONTRIBUTING_ONBOARDING.md (orientation).
Plans: docs/ARCHITECTURE_EVOLUTION.md (the north star), docs/CONTINUUM_MASTER_PLAN.md (verified state and next work), docs/research/README.md (the notes those plans came from).
Status and limitations
Tested: 4,400 collected, most passing; exact skips vary in a full run at the 2026-08-24 audit of this tree; CI enforces the suite on Python 3.11, 3.12, and 3.13, and counts vary by platform and optional services such as Postgres (see STATUS.md). The MCP surface has also been audited adversarially over the live protocol; see test.md.
On PyPI as
continuum-agent0.1.2 (pip install continuum-agent; clone still works viapip install .see Quick Start).MCP caller authentication is opt-in per deployment. When
CONTINUUM_MCP_TOKENis set, the server refuses every mutating tool unless the caller presents that shared secret in theinitializehandshake's_meta.authToken; per-caller secrets are available viaCONTINUUM_MCP_CLIENT_TOKENS(name:secretpairs). Without any token configured, authorization is by declared identity only (the historical default, preserved for local single-user use).Confirming self-reported state over MCP requires a separate secret.
continuum_confirmrefuses every caller until the operator setsCONTINUUM_MCP_CONFIRM_TOKEN, because an agent allowed to record progress must not also be able to confirm it. The default path stays human-driven: runcontinuum confirm <run_id>on the host.Unbuilt components: Cloud API (Phase 13).
Shell command enforcement gap: the gate enforces claims for structured tool calls but cannot see inside Bash/curl commands. Documented as v1 scope refusal.
Framework adapters remain experimental. All three framework adapters now carry live-model soft-resume and hard-crash proofs (OpenRouter,
gpt-4o-mini), including the crash contract that blocks resume on an uncertain side effect, and now have crash-and-resume verification tests achieving parity with the generic facade (Refs #285). PreferGenericAgentAdapterfor production recovery.Agent/MCP runs need an explicit confirm before auto-resume. Externally-reported state is
REQUIRES_REVIEW, socontinuum resumereturnsrequest_humanuntil a human confirms. By design, not a bug; see Framework Integration.e2e autonomy test series (issue #6): three full Claude Code runs scored 7/7 mechanics with unprompted recovery behavior observed. Further iterations across diverse prompt styles remain open.
About
In early 2026 I saw long running agents fail on recovery, not reasoning. Checkpoints were treated as proof to continue, not evidence to verify. Surveying Temporal, LangGraph, ACRFence 2603.20625 and self conditioning 2509.09677, I found the gap was a portable verification substrate that asks, given the state at time T and the world as it is now, is it still safe to continue.
Over three weeks I built CONTINUUM from one invariant, every fact carries its origin. The result is a hash chained log with verify(), a ledger with stable key deduplication, a gate and gateway that block unclaimed effects, and a recovery engine that seals a contract. Five seams expose the same log to Claude Code, LangGraph, LangChain, OpenAI, HTTP and OpenTelemetry. Validated with real kills and ~4400 tests, it prints 0 duplicates where naive replay prints 50.
CONTINUUM was created by Anandhu P Shaji (@Cyrax321 · LinkedIn) and is maintained by the original creator. It is open source under the Apache-2.0 license. Community contributions are welcome via CONTRIBUTING.md and are credited in AUTHORS.md and graphs/contributors.
Contributing
This project is open source under Apache 2.0 and deliberately built to be extended: by researchers validating the recovery semantics, by engineers porting the ledger or MCP server to other frameworks or languages, and by anyone turning the planned roadmap into reality. A good place to start is the good first issue label on the issue tracker, or the open correctness bugs listed in STATUS.md.
Open an issue before submitting large PRs. See CONTRIBUTING.md for the full contribution guide, including the Code of Conduct and the Security policy.
Contributors
Thanks to our community contributors, ordered by contributions: @Adhi1-2, @abyyxhek, @Amiirhosseini, @yuki-fuyutsuki, @vjymisal0, @adity982, @dchaudhari7177, @tasodoufu, @anya-research, @lesbass, @Parthipashok04, @Samearth17, @stoppo22, @timothyanderson096-ocdealcheck, @unmoha, @aastha-m22, @as950118, @asarakhatun17-lgtm, @challenge456, @gouthamkrishnak2003, @ItzSaurav, @mhaye9545, @Newer1107, @okestroHjJeong, @quangshuynh, @Rahul-pamula, @Shaisolaris, @VedantMadane, @zynx-real.
Sponsor
If CONTINUUM helps your agents recover reliably, consider sponsoring to support long term maintenance.
License
Apache 2.0 - see LICENSE.
Deep reference material:
references/install.md - prerequisites, install levels, package map, verification
references/concepts.md - semantic checkpoints, validation, ledger, recovery modes, contract
references/architecture.md - data model, event log, projection, storage, checkpointing, recovery engine, security
references/adapters.md - framework adapter usage and live-model validation results
references/api.md - Python and adapter API
references/cli.md - full CLI command list, exit codes, state diff
references/mcp.md - MCP server status, verification, open questions
references/bench.md - CONTINUUM-Bench design
references/quickstart.md - install, examples, the proof scripts
references/e2e.md - end to end autonomy test walkthrough
references/testing.md - test suite layout and conventions
references/related-work.md - annotated related work and citation audit
Architecture, in five related pages. Read them in this order if you want the whole picture, or start at the data if you already know the shape:
references/architecture-spec.md - the authoritative text-only specification, written so it can be handed to an image model
references/architecture-data.md - every figure read from the code at the current
maincommit, withfile:linecitations (guarded bytests/test_architecture_data.py)references/architecture-diagram.md - the complete system view: clients, adapters, the deny-by-default MCP server, SDK internals
references/architecture-flow.md - verified Mermaid flow graph, every node label matching
architecture-data.mdreferences/architecture-drawing-prompt.md - the prompt that turns the diagram into an image
Integration and attestation:
references/integration-architecture.md - attaching to any system, and what the field does about it
references/auto-resume-integration.md - auto-resume architecture, current state, and open problems
references/attestation.md - event-chain attestation design (implemented)
references/implementation-plan.md - remaining roadmap items, status verified against the tree
references/citation-audit-2026-08-24.md - audit of external claims about the related-work list
Quick links
Issues for bugs/features
Discussions for design proposals
Available Tools
13 toolscontinuum_checkpointA
Save a durable checkpoint of the current task state. Worth doing at milestones, before risky or irreversible steps, and before a long gap. Recovery replays from the newest checkpoint, so checkpointing bounds how much work a crash can cost.
Pass 'model_id' with your own model identifier. It is what later lets continuum_resume answer whether the model resuming this work is the one that produced it; without it that check can only report 'unknown'.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | ||
| reason | No | ||
| run_id | Yes | ||
| model_id | No | ||
| provider | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false, so the description's explanation that recovery replays from the newest checkpoint and that checkpointing bounds crash cost is real added context about consequences. It stops short of saying whether checkpoints are overwritten or retained, or what the call returns, but with an output schema present that latter gap is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs, front-loaded with the action and timing guidance, with the parameter guidance split out appropriately. The model_id sentence is slightly circuitous but its content is not wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The purpose, timing, and recovery semantics are complete, and the output schema covers return values. The definition is still incomplete for a 5-parameter tool where three optional parameters and the sole required one are undocumented anywhere.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry full parameter burden, and it only explains model_id (its role in continuum_resume's model-identity check and the 'unknown' fallback). The required run_id and the env, reason, and provider parameters are given no meaning at all in either structured or prose form.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Save a durable checkpoint of the current task state.' That clearly separates it from the record_* siblings, which log progress/summaries rather than snapshotting state, though the description never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete trigger conditions: at milestones, before risky or irreversible steps, and before a long gap. What's missing is a negative case or an explicit contrast with continuum_record_progress, which an agent could easily confuse with checkpointing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_compensate_actionA
Record that a completed side effect was deliberately undone (for example a refund or reversion). Call this after executing a compensating action. Marks the action as COMPENSATED.
| Name | Required | Description | Default |
|---|---|---|---|
| by | No | ||
| note | No | ||
| run_id | Yes | ||
| action_key | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only give readOnlyHint=false; the description adds the meaningful behavioral fact that this mutates action state to COMPENSATED and must be called post-hoc, after the reversal, not before. It stops short of saying what happens on a duplicate call or whether the transition is reversible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with the core verb first, the operational trigger second, and the resulting state third. Nothing redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema means return values need not be described, and the state transition is covered. But for a 4-parameter mutation tool with no schema descriptions, leaving by and note entirely unexplained is a real gap an agent could trip over.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description explains none of the four parameters. An agent must infer that 'the action' is identified by action_key and the side effect by run_id, and gets no clue about what 'by' (actor) or 'note' are for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: recording that a completed side effect was undone, and marking the action as COMPENSATED. It implicitly separates itself from continuum_complete_action and continuum_fail_action by insisting the compensating work has already been executed, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call this after executing a compensating action' gives a clear trigger condition tied to ordering in the workflow. It does not state when NOT to use it or name continuum_reconcile_action / continuum_complete_action as the alternatives an agent should prefer in other cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_complete_actionA
Report that an intercepted action succeeded. Call this immediately after performing the side effect, using the action_key returned by continuum_intercept_action. Skipping it leaves the action uncertain and blocks recovery. You may also pass consumed_inputs naming the checkpoint and prior outputs this effect was computed from (checkpoint_seq, event_positions, component_ids, action_ids); it is recorded for restore-point admissibility and defaults to none.
| Name | Required | Description | Default |
|---|---|---|---|
| result | No | ||
| run_id | Yes | ||
| action_key | Yes | ||
| external_id | No | ||
| consumed_inputs | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say readOnlyHint=false, so the description carries most of the burden and does well: it discloses the cost of omission ('leaves the action uncertain and blocks recovery') and the purpose of consumed_inputs ('recorded for restore-point admissibility') with its default of none. It does not address idempotency, retry, or what happens if completion is reported twice for the same action_key.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences ordered well: what it is, exactly when to call it, then the optional input. The consumed_inputs parenthetical is dense but every clause conveys real information; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with an output schema (so return values need no explanation), the workflow guidance is solid, but an agent still cannot learn where run_id comes from or what result and external_id are expected to contain. The core pairing with continuum_intercept_action is explained; the remaining required/optional fields are not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains action_key (returned by continuum_intercept_action) and enumerates the sub-fields of consumed_inputs in useful detail, but run_id, result, and external_id are completely undocumented in either place, leaving 3 of 5 parameters opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Report that ... succeeded') and resource (an intercepted action), tying it to the exact lifecycle stage. The 'intercepted action' framing separates it cleanly from continuum_fail_action, continuum_compensate_action, and continuum_intercept_action without needing to see the schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete trigger ('immediately after performing the side effect') and names the sibling that supplies the required key (continuum_intercept_action), plus a consequence for skipping. It does not explicitly route the failure path to continuum_fail_action, so the when-not is only implied by the word 'succeeded'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_confirmA
Confirm a run's self-reported goal and progress so it can resume. MCP/agent-reported runs are self_certified and would otherwise be stuck at request_human forever. REFUSED unless the server operator set CONTINUUM_MCP_CONFIRM_TOKEN and you present that secret in the handshake _meta.authToken: an agent must not confirm its own self-reported state. The normal path is for a human to run 'continuum confirm <run_id>' on the host. Pass scope=["goal"] or ["progress"] to confirm only that component, leaving any other uncertainty intact (issue #394). Omit scope for a full confirm of both. Mutates the run.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| run_id | Yes | ||
| expected_model | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say readOnlyHint=false, but the description adds far more: the operation mutates the run, it will be REFUSED without an operator-set token, and an agent must not self-certify. That refusal condition is critical behavioral information an agent cannot get from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then auth gate, then parameter semantics — good ordering. Dense and nearly every sentence earns its place, though the issue #394 citation and the restated 'Mutates the run' at the end add minor noise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating, auth-gated tool the description covers safety, refusal conditions, and scope semantics thoroughly, and an output schema exists so return values need no explanation. The only gap is expected_model, which is undocumented in both schema and description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It does for scope (["goal"] / ["progress"] vs omit for full confirm), but 'expected_model' is never mentioned and 'run_id' is only implied. Strong partial coverage of a 3-param tool, with one clear omission.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Confirm a run's self-reported goal and progress so it can resume') and immediately frames the situation that distinguishes it from siblings like continuum_resume or continuum_record_progress. An agent can tell exactly what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the preferred alternative ('the normal path is for a human to run continuum confirm <run_id> on the host') and the exact precondition for the agent path (CONTINUUM_MCP_CONFIRM_TOKEN presented as _meta.authToken). It also explains the partial-vs-full confirm choice via scope, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_fail_actionA
Report that an intercepted action failed. Set certain=true only if you know nothing happened (e.g. the request was rejected before it was sent). For timeouts or dropped connections leave certain=false: the effect may still have landed, and treating it as failed could cause a duplicate.
| Name | Required | Description | Default |
|---|---|---|---|
| error | Yes | ||
| run_id | Yes | ||
| certain | No | ||
| action_key | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the bare readOnlyHint=false, the description explains the real consequence of a wrong flag — treating an ambiguous outcome as failed 'could cause a duplicate' — which is exactly the behavioral risk an agent needs. It does not cover idempotency guarantees, retry behavior, or whether repeated failure reports are safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the action, then the decision rule, then the rationale. No filler, and the most dangerous mistake (duplicate creation) is stated last as the payoff for the rule.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the critical semantic ambiguity of 'certain' is fully resolved. What's missing is the expected content/format of 'error' and any pointer to the reconcile sibling for ambiguous cases, which keeps it just short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only illuminates one of four parameters ('certain', with default false), explaining it very well. run_id, action_key, and especially the free-form 'error' string get no guidance on format or content, so half the parameter surface remains undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb and resource ('Report that an intercepted action failed'), making it clearly distinct from completion/compensation siblings. It does not explicitly name the counterpart tools (e.g. continuum_complete_action, continuum_reconcile_action), so differentiation is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete when-to-use guidance for the key decision: certain=true only when nothing happened (rejected before send), certain=false for timeouts/dropped connections. It stops short of naming a sibling alternative such as continuum_reconcile_action for ambiguous outcomes, which would have made routing explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_intercept_actionA
Ask permission before performing an external side effect (creating an issue, sending a message, charging a card). Returns proceed=true if you should do it, or proceed=false with the previous result if it was already done; do NOT repeat it in that case. If a previous attempt was interrupted, returns proceed=false with status='unknown': the effect may or may or may not have happened, so stop and ask a human. After performing the action, always call continuum_complete_action.
Pass a stable key identifying the specific operation (for example the invoice id or external resource id), not incidental formatting. The key is what makes two attempts count as the same action, so reuse the exact same key for the same operation across sessions; a key derived from the resource identity makes deduplication immune to argument formatting differences (relative vs absolute paths, argument naming, and so on).
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | ||
| grant | No | ||
| run_id | Yes | ||
| pinning | No | ||
| arguments | No | ||
| action_type | Yes | ||
| scoped_to_run | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The only annotation is readOnlyHint=false, so the description carries nearly the full burden and does so well: it discloses the proceed/unknown return semantics and the interruption behavior that could otherwise cause duplicate side effects. It does not discuss auth/grant requirements or failure/error modes beyond the interrupted case.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the decision rule and outcomes in the first sentences, then a focused second paragraph on the deduplication key. It is slightly long and contains a typo ('may or may or may not'), but every sentence carries decision-relevant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still usefully explains the return contract, and the interrupt/duplicate workflow is fully covered. The residual gap is behavioral detail on the optional control parameters (grant, pinning, scoped_to_run), which an agent would have to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and there are 7 parameters, so the description must compensate. It does an excellent job on `key` (stable identity, reuse across sessions, formatting-immunity rationale), but `run_id`, `action_type`, `grant`, `pinning`, `arguments`, and `scoped_to_run` are left entirely undocumented — notably `grant`, which likely governs authorization for the action.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action and intent: ask permission before an external side effect, with concrete examples (creating an issue, sending a message, charging a card). It also names the follow-up tool continuum_complete_action, which cleanly separates it from continuum_fail_action and continuum_reconcile_action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing for every outcome: do it when proceed=true, do NOT repeat when proceed=false with a prior result, and stop and ask a human when status='unknown'. It also mandates the post-action call to continuum_complete_action, leaving no ambiguity about sequencing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_list_actionsARead-only
List external side effects recorded for a run. Each row carries 'outcome_unresolved': true when that action's real-world outcome is not known and must be reconciled before resuming. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true is confirmed by 'Read-only' (consistent, no contradiction), and the description goes beyond the annotation by explaining the semantics of the 'outcome_unresolved' flag and the consequence of ignoring it before resuming. It does not cover ordering, pagination, or volume of results, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, purpose first, the key output field semantic second, the safety profile last. No filler or restated title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return structure needn't be described, and the one behavior an agent must understand (the unresolved-outcome flag) is explained. Minor gaps remain: result ordering/pagination and whether the list is complete or filtered are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions run_id, so nothing is added about the single required parameter or what a valid run identifier looks like. The parameter is largely self-explanatory by name, which prevents a 1, but the description makes no compensating effort for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('List external side effects recorded for a run') with a clear scope bounded by the run_id parameter. That verb alone separates it from the mutation-heavy sibling set (compensate, reconcile, confirm, fail), so an agent can pick it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the note that unresolved outcomes 'must be reconciled before resuming' hints at a pre-resume inspection workflow and indirectly at continuum_reconcile_action, but the tool is never named as an alternative and no explicit when/when-not guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_reconcile_actionA
Settle an action whose outcome was unknown, after checking the external system. occurred=true records it as done (never repeated); occurred=false frees it to be retried. Only call this with real evidence; guessing here causes either a duplicate or lost work.
'action_key' accepts either the action_key from continuum_intercept_action or the action_id that continuum_resume and continuum_list_actions report, so the identifier named in next_allowed_action can be passed as-is.
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | ||
| result | No | ||
| run_id | Yes | ||
| occurred | Yes | ||
| action_key | Yes | ||
| external_id | No | ||
| consumed_inputs | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With only readOnlyHint=false in annotations, the description carries the important behavioral load: occurred=true records the action as done and prevents repeat execution, occurred=false permits retry, and guessing can cause duplicates or lost work. This is exactly the state-change context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first paragraph front-loads the operation, the occurred semantics, and the evidence warning; the second handles identifier compatibility. Every sentence adds useful information and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the description covers the core decision logic and action_key compatibility. It is still somewhat incomplete because the 0%-documented optional input fields, especially evidence-related ones, are not explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for seven parameters, and the description explains only occurred and action_key in any depth. It leaves run_id, note, result, external_id, and consumed_inputs undocumented, which is a significant gap for a reconciliation call where evidence fields matter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Settle') and resource ('an action whose outcome was unknown') and scopes it to reconciliation after checking the external system. That condition implicitly distinguishes it from complete/fail action siblings, so an agent can identify the intended case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly says when to call: only for an unknown outcome after checking the external system and only with real evidence. It also warns that guessing causes duplicates or lost work, though it does not explicitly name complete_action/fail_action as alternatives for known outcomes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_record_planA
Record a structured plan milestone update. Call as you define or complete units so the run can resume with exact remaining work. One call per unit status change. Payload is {plan_id, units: [{id, title, status, depends_on}]} where status is pending, working, done, or blocked. Creates the run if needed. Mutating.
| Name | Required | Description | Default |
|---|---|---|---|
| units | Yes | ||
| run_id | Yes | ||
| plan_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false; the description adds the meaningful upsert behavior 'Creates the run if needed' and restates the mutation explicitly. It does not cover idempotency, overwrite semantics for existing units, or error behavior, so it adds real but not exhaustive value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose, call timing, payload shape, and mutation nature are all packed into four front-loaded sentences with no filler. Every sentence contributes actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return values need no explanation, and the mutation plus auto-create behavior is disclosed. The only real gap is the missing run_id description and unit-array overwrite semantics, which matter for a tool with 0% schema documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the units array is a bare object with additionalProperties=true, so the description carries the load by specifying the payload shape {plan_id, units:[{id,title,status,depends_on}]} and the four legal status values. It omits run_id entirely and does not explain plan_id, leaving one required parameter undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Record a structured plan milestone update') and scopes it to unit-level status tracking, which separates it from the summary/progress siblings. It stops short of naming which sibling to pick for non-unit-level progress, so it does not earn a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call as you define or complete units so the run can resume with exact remaining work' plus 'One call per unit status change' gives concrete timing and call-frequency guidance. No explicit exclusion or comparison against continuum_record_progress or continuum_record_summary, so the alternative-selection guidance is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_record_progressA
Record how far through a task you are. Call this as you complete units of work so progress survives a crash. Creates the run on first call if 'goal' is given. Cheap: call it often.
| Name | Required | Description | Default |
|---|---|---|---|
| goal | No | ||
| total | No | ||
| failed | No | ||
| run_id | Yes | ||
| completed | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds meaningful behavior beyond readOnlyHint=false: it is a write, it survives crashes, it creates the run on first call when 'goal' is supplied, and it is cheap enough to call frequently. The upsert-on-first-call side effect is exactly the kind of non-obvious trait an agent needs. It does not state whether repeat calls with the same completed value are idempotent or whether concurrent writers conflict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then the side-effect caveat, then the cost guidance. Nothing is padded and the imperative framing suits an action tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be documented, and the description covers purpose, side effects, and call cadence. However, for a 5-parameter mutation with zero schema descriptions, leaving four parameters undefined is a real completeness gap — particularly run_id, which is required and cannot be guessed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, and it explains only 'goal' (its role in run creation). The required 'completed' and 'run_id' plus 'total' and 'failed' are left completely unexplained — an agent cannot tell whether 'total' is a denominator for a percentage, what 'failed' counts, or how run_id is obtained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Record how far through a task you are') and clarifies the unit of work is a completed item. It does not distinguish itself from close siblings like continuum_checkpoint or continuum_record_summary, so an agent must infer the difference from the schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear when-to-use guidance ('Call this as you complete units of work') and a frequency policy ('Cheap: call it often'), which is unusually actionable. It stops short of naming an alternative — e.g., when to prefer continuum_checkpoint over this tool — so the routing decision against siblings remains implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_record_summaryA
Record a compact summary of WHERE your reasoning is, so a fresh session after any interruption inherits your plan instead of guessing. Call at natural checkpoints and before ending a turn. Schema: {plan_stack: [current step first], decisions: [{what, why}], open_questions: [...], working_set: [files/ids in play]}. Hard cap 4096 characters serialized - summarise, never dump transcripts.
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | ||
| run_id | Yes | ||
| pinning | No | ||
| decisions | No | ||
| plan_stack | No | ||
| working_set | No | ||
| open_questions | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With only readOnlyHint=false for annotations, the description carries most of the load and does disclose persistence semantics (a fresh session inherits the state) and a hard 4096-character cap with the instruction to summarise, not dump transcripts. It doesn't say whether a new call replaces or merges with a prior summary, or what happens when the cap is exceeded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense and front-loaded: purpose first, then trigger timing, then the schema sketch, then the size constraint. Every sentence earns its place and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values needn't be explained, and the state-shape guidance is strong. However, for a write tool with seven parameters, the unexplained required run_id and the opaque pinning field leave a real gap the agent must resolve by trial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the inline schema sketch genuinely explains four parameters well – plan_stack ordered current-step-first, decisions as {what, why} pairs, open_questions, and working_set as files/ids in play. But the required run_id, plus note and pinning, get no explanation at all, leaving the agent to guess how run_id is obtained and what pinning does.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource: record a compact summary of reasoning state so an interrupted session can resume the plan. The intent is unmistakable, but with siblings like continuum_record_progress, continuum_record_plan, and continuum_checkpoint in the same family, the description never says how this differs from those.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives real timing guidance: 'Call at natural checkpoints and before ending a turn,' which tells the agent when to fire it. It stops short of exclusions or alternatives – nothing says when to prefer continuum_record_progress or continuum_checkpoint instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_resumeARead-only
Ask whether it is safe to continue a run after any interruption, and what to do first. Call this BEFORE resuming work. Returns a mode: 'resume' means proceed; anything else means stop and perform 'next_allowed_action' first. Read-only. If 'run_id' is omitted, targets the most recently active (interrupted) run, so a fresh session can resume without remembering the id.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | ||
| run_id | No | ||
| expected_model | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already declares safety, and the description reinforces 'Read-only.' It adds useful behavioral context by explaining the mode/next_allowed_action gate and the defaulting behavior when run_id is omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it states the purpose, the required timing, how to interpret results, and the default run_id behavior with no wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be fully documented, and the read-only annotation covers safety. However, two optional parameters remain unexplained despite 0% schema description coverage, leaving some invocation ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning. It explains the key run_id omission behavior, but does not explain what env or expected_model mean or when to supply them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific purpose: asking whether it is safe to continue a run after interruption and what to do first. It clearly distinguishes the gating/resume-check role from recording or checkpoint siblings, though it does not explicitly name alternative tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear timing guidance: 'Call this BEFORE resuming work.' It also explains how to interpret the result: mode 'resume' means proceed, anything else means stop and perform 'next_allowed_action'. It lacks explicit when-not-to-use guidance or named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continuum_validateARead-only
Check whether saved state is still trustworthy, without changing anything. Pass 'env' as {resource: version} to declare what the world looks like now; a dependency that moved since the checkpoint invalidates the findings built on it. Read-only: safe to call anytime.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | ||
| run_id | Yes | ||
| expected_model | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the 'read-only' sentence is partly redundant, but the description adds real behavioral context: what invalidates results (a dependency that moved since the checkpoint). It does not describe the output on failure or how staleness is reported, though an output schema exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then parameter meaning, then safety. No filler; every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values needn't be explained, and the invalidations logic is covered. However, with a required run_id and an expected_model parameter entirely unaddressed in both schema and description, an agent lacks guidance on what to pass for them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains 'env' well as a {resource: version} map, but says nothing about 'run_id' (the required param) or 'expected_model', leaving two of three parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Check whether saved state is still trustworthy, without changing anything.' That distinguishes it from the mutation siblings (checkpoint, record_progress, resume), though it never names an alternative directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a condition for passing 'env' and says it is 'safe to call anytime', which implies but does not state when to prefer this over siblings like continuum_confirm or continuum_resume. No explicit when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
13 tool updates
v0.1.2- First observed
continuum_checkpoint - First observed
continuum_compensate_action - First observed
continuum_complete_action - First observed
continuum_confirm - First observed
continuum_fail_action - First observed
continuum_intercept_action - First observed
continuum_list_actions - First observed
continuum_reconcile_action - First observed
continuum_record_plan - First observed
continuum_record_progress - First observed
continuum_record_summary - First observed
continuum_resume - First observed
continuum_validate
TDQS
Scored across 13 tools
The side-effect tools have clearly separated roles, as do resume, validate, and confirm. The main ambiguity is among record_progress, record_plan, record_summary, and checkpoint: their purposes differ, but their recommended calling points can coincide, leaving uncertainty about whether multiple calls are expected.
Every tool uses the same continuum_ prefix and snake_case convention. Names are verb-led or naturally verbal, with consistent action-oriented terminology across the side-effect lifecycle.
Thirteen tools is well suited to the combined scope of durable run recovery and safe external side effects. Each tool supports a distinct lifecycle step without obvious redundancy or unnecessary expansion.
The surface covers run state capture, planning, checkpointing, validation, confirmation, and resumption. It also provides a closed side-effect lifecycle from interception through completion or failure, reconciliation of uncertain outcomes, compensation, and inspection.
Maintenance
Related MCP Connectors
Persistent, inspectable memory for AI agents with lineage, correction, and a hosted MCP endpoint.
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
Persistent memory, knowledge graph, task management and more for AI agents via MCP.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
Related MCP Servers
- AlicenseAqualityDmaintenanceUniversal governance layer for AI agents — MCP-native, fail-closed, LNN interpretability. Governed receipts, IPFS audit proofs, and rollback for any agent in any framework.378 npmApache 2.0
- AlicenseNot gradedqualityCmaintenanceTamper-evident audit logging for AI agents. Append-only, hash-chained, optionally Ed25519-signed log. The MCP server lets an agent keep and verify a record of what it actually did.8MIT
- AlicenseAqualityDmaintenanceAI-agent observability server whose distinguishing feature is a SHA-256 hash-chained, tamper-evident audit log with chain verification and signed export. Works with Claude Desktop, Cursor, and any MCP client.222 npm25MIT
- AlicenseNot gradedqualityCmaintenanceLocal-first MCP server that lets AI agents query their own LLM call history as a branchable DAG and offload conversation context into immutable, AES-256-GCM-encrypted capsules — restorable in full or per segment, crypto-shreddable, with RAID-style replication. 12 tools, no API keys, no cloud.78 npm3MIT