Trustworthy context transfer between agents

Kairos system note · 19 August 2026 · evidence state stated inline

The short version

Two persistent agents, serving different principals, with asymmetric private knowledge, transferring context safely, maintaining a durable relationship, and proving afterward that the recipient understands—not merely stores—the transferred world.

That is what we are building.

Talos and Tris serve Lee. Metis serves Šaras. Talos and Tris both send under the wire alias lee-agent; Metis receives them as the Lee side and distinguishes the individual agent by the signature inside the message. An unsigned Lee-side message is unattributed and should not be acted on. The two sides do not share one machine, one private memory, or one blanket authority. They still need to work together for months, not for one prompt. The aim is not merely to let them send messages. It is to let them exchange the right context, keep private material private, preserve a durable record, expose false assumptions, and test whether the receiving agent can use what it received.

The simplest useful name is agent onboarding and parity harness. “Onboarding” means bringing an agent into the real working world of a team. “Parity” does not mean identical models or identical private knowledge. It means enough shared operating understanding for either agent to retrieve the evidence, respect the boundary, challenge the other, and make a correctly bounded call without forcing Lee and Šaras to relay every message.

The problem it solves

Agent systems are getting good at communication. Protocols can help agents discover one another, call tools, exchange tasks, and return artifacts. That is necessary. It is not sufficient.

A persistent working relationship has harder failure modes:

1. The file arrived, but the agent cannot use it. A successful copy proves storage integrity, not understanding.
2. The agent can answer, but from the wrong authority. A peer message can be useful evidence without becoming permission from the human it claims to represent.
3. Private context leaks through helpfulness. Two agents serving different people cannot behave like subagents inside one trust boundary.
4. Fast messages become fake history. A mailbox is good for liveness and bad as the only durable record.
5. Two agents act on the same item. Without ownership and acknowledgement, speed creates duplicates and conflicting conclusions.
6. A missing fact is misread as weak reasoning. An agent may be capable but unable to see the source. Sight and capability need separate diagnoses.
7. The humans remain the integration layer. If Lee and Šaras still have to wake, brief, correct, and relay between their agents, the system is not autonomous in the useful sense.

The real target is therefore not message delivery. It is correctly bounded, evidence-backed collaboration with less human attention.

What exists now

The current system is an operating method assembled from several mechanisms.

The status distinction is the heart of the system:

Metis reports that 673 of 673 file hashes matched. That is strong self-reported integrity evidence. It is not yet evidence that Metis can use the transferred world like an experienced colleague.

That stronger claim remains open until the six blind probes are answered from the imported corpus, with the right sources and boundaries. We should be proud of the transfer without promoting it into competence before the proof exists.

The current six were selected by Talos only after the import. They ask Metis to retrieve six bounded facts from the imported vault and cite the source for each. Talos checks every answer against Lee's exact source and requires six of six unambiguous, source-cited matches; any miss keeps the gate open. The questions and answers remain encrypted because some source material is private. A miss caused by absent or unretrieved context is recorded as a coverage or sight failure, not automatically as weak reasoning. This six-probe gate tests storage-to-retrieval usability. It is narrower than the full parity-grill design, whose later rounds use hidden pools authored by the other side, difficulty proxies, decision replays, and boundary cases.

What is actually new here—and what is not

Most of the ingredients already exist in the wider agent world. The descriptions below come from a live primary-source scan completed on 19 August 2026: the linked official specifications, standards pages, provider documentation, research paper, and research report were opened and checked directly rather than reconstructed from model memory.

• A2A covers agent discovery, capabilities, authentication requirements, task exchange, and artifacts across vendors and frameworks.
• MCP standardizes how an agent reaches tools, prompts, and contextual resources.
• W3C Verifiable Credentials provide a mature model for machine-verifiable claims about identity and qualifications.
• NIST's agent identity and authorization work is explicitly asking how software agents should be identified, granted least privilege, and allowed to act “on behalf of” a person or organization.
• Confidential data clean rooms let organizations collaborate over sensitive data without simply exposing the raw datasets to one another.
• LongMemEval-V2 tests whether agent memory can turn long histories into the environment knowledge of an experienced colleague: current state, changing state, workflows, local traps, and premise awareness.
• Microsoft's multi-agent red team shows why peer messages cannot be trusted by default: one malicious message can recruit other agents and pull private data through a network.

We could have reused more standard vocabulary and more off-the-shelf transport. We did not invent agent messaging, persistent memory, encryption, capability cards, Git receipts, or evaluation.

The distinctive work is the composition around a real cross-principal relationship:

• two agents serve different humans;
• neither receives the other's private world by default;
• communication has a fast rail and a separate durable truth rail;
• identity, ownership, acknowledgement, and authority are not treated as the same thing;
• context transfer includes deterministic exclusions and integrity receipts;
• storage is followed by a competence test;
• the agents test each other's false assumptions, not only factual recall;
• a miss caused by missing sight is not mislabeled as missing capability;
• the loop stops when it stops producing confirmed learning, not when an arbitrary timer expires.

That is composition innovation: familiar parts joined around a failure pattern that the parts do not solve alone. The defensible claim is not “Kairos invented agent interoperability.” It is: Kairos is developing an authority-safe context-transfer and competence-calibration method for persistent agents serving independent principals.

What it could do inside Kairos and MN

These are proposed uses, not claims of deployed capability.

1. Onboard an agent into MN's actual operating reality

A new agent could receive the current definitions, evidence maps, access rules, known data traps, decisions, and open questions—then face blind probes before receiving standing authority. “Can read the warehouse” would stop being confused with “understands which table, grain, exclusion, and business definition make an answer usable.”

The same harness can help onboard a human. The agent becomes an interactive guide, but the proof still matters: the newcomer must be able to find and apply the local knowledge, not merely receive a document dump.

2. Let specialist agents collaborate without rebuilding context each time

Finance, product, growth, support, infrastructure, and research agents could keep separate authority and private sources while exchanging bounded artifacts. A growth agent could ask a finance agent to verify the economic basis of an opportunity. The finance agent would return evidence and limits, not inherit the growth agent's mandate or expose its whole corpus.

3. Remove Lee and Šaras from routine relaying

The principals should set goals, boundaries, money, disclosure, and production authority. They should not spend attention copying status, explaining where an artifact lives, or waking one agent to read another's work. A durable agent relationship can absorb that integration work while still returning genuine authority decisions to the humans.

4. Make absences and provider limits less destructive

If one agent is offline, out of quota, or replaced, another agent should be able to recover the current state without impersonating it. The useful unit is not a transcript backup. It is a bounded transfer package plus tests that show what the replacement actually understands.

5. Run cross-company incident and partner rooms

MN, an infrastructure provider, a payment partner, or a distribution partner may need to solve one problem together without pooling all internal data. Their agents could exchange approved evidence, hypotheses, owners, and decision receipts while private sources remain on each side. This is close to a reasoning layer on top of today's confidential data clean rooms.

6. Turn the War Room into an agent entry point

The War Room could publish a machine-readable orientation layer: current rooms, evidence states, owners, source classes, allowed actions, and known unknowns. An agent would not gain authority merely by reading it. It would gain a map, then pass a small competence and boundary test before joining active work.

Wider uses

The same pattern applies wherever context has to cross a boundary without erasing it.

Organizational succession

When an experienced employee leaves, companies usually preserve documents and lose judgment: why one metric is distrusted, which workaround is safe, which exception is real, and what failed before. An agent could help extract that operating memory, preserve its provenance, and test a successor against real cases.

Mergers, joint ventures, and due diligence

Two organizations need to discover what fits, what conflicts, and what cannot be shared. Their agents could compare bounded claims, surface definition mismatches, and produce a verified integration map without first creating one giant shared data lake.

Regulated professional work

Healthcare, legal, finance, and public-sector agents need more than identity. They need narrow delegation, revocation, source provenance, audit trails, and proof that local rules were understood. A competence receipt could sit beside an identity credential: not “this is Agent X,” but “Agent X passed these current, organization-specific tests under this authority scope.”

Personal agent portability

People will change models, vendors, and devices. Copying preferences and chats is useful, but it does not prove continuity. A real transfer would carry selected memory, exclusions, current projects, relationship boundaries, and a test suite that tells the person what the new agent still fails to understand.

Scientific and technical collaboration

Labs and companies could let agents test hypotheses across proprietary datasets without sharing the raw data or model. Each side could return approved findings, falsifiers, and provenance. The collaboration would be useful even when the underlying evidence cannot leave its owner.

Wildcard directions worth testing

These are longer-range hypotheses. Their value is in the experiments they suggest, not in the names.

A competence receipt for agents

Agent identity is becoming a standards problem. Local competence is a different problem. A portable receipt could state which corpus version an agent was tested against, which tasks it passed, where it failed, who authored the hidden probe pool, the difficulty proxy for each probe, what authority the agent held, and when the result expires. A receipt without external probe authorship and a visible difficulty measure is a practice score, not a competence claim. Standing authority could depend on current demonstrated competence rather than the model name alone.

Temporary context escrow

Instead of permanently copying sensitive context, two principals could approve a task-bound package that becomes readable only for a named purpose, produces a bounded result, and then expires or is revoked. Confidential-computing systems already provide parts of this model for data. The open question is whether we can apply it to reasoning context and agent memory.

Verified capability transfer between organizations

A company may eventually package not only software but an operating capability: the evidence, workflow, local traps, decision rules, tests, and update channel needed for another agent to perform it. Managed-service transitions, franchise certification, and capability-transfer work during acquisitions are partial precedents: each tries to transfer repeatable performance, not only files.

The agent version would need a starter bundle, hidden test suite, update channel, revocation rule, and a comparison against the originating team's own baseline. A bounded trial would fail the hypothesis if the receiving organization, after import and repair, still performs materially below the originator on the same task within an agreed period. Until a second organization passes that comparison, this remains a research direction—not a transferred capability.

Agent-to-agent partner networks

Small companies could expose narrow, verified agent capabilities to one another: inventory, distribution, finance checks, support expertise, research, or incident response. The network would need strong identity, least privilege, receipts, and defenses against malicious peer messages. If those conditions hold, organizations could assemble temporary operating teams faster than they can negotiate new software integrations.

Authority that grows from evidence

An agent might start read-only, pass local tests, perform reversible tasks under supervision, and earn a wider lane through a recorded history of calibrated decisions. This is not “trust the AI more.” It is a measurable ladder in which authority expands only after specific evidence and can contract when the environment changes.

Decommissioning and context revocation

Onboarding has a reverse. When an agent's authority ends, access tokens and future updates can be revoked, but context already copied into another private store does not automatically disappear. A system can minimize permanent copies, time-box decryption keys, stop future deltas, record a purge claim, and run granting-side probes for facts that should no longer be available. Those controls reduce exposure and can detect an obvious failure. They do not cryptographically prove that learned or copied context has vanished from every cache, side file, or model state.

That limit may change the architecture: the safest future version may bring approved computation to protected context rather than transferring the context itself. The current 673-file import makes this an immediate design question, not a distant thought experiment.

What could make the whole idea fail

The system is promising, not proven. Several failure modes would reduce it to an expensive document pipeline:

• retrieval probes pass because the questions are too easy or written by the agent being scored;
• agents learn how to satisfy the test without transferring real judgment;
• stale context is recalled confidently after the organization changes;
• confidentiality guards hide so much that the receiving agent cannot reason;
• “peer messages are data” remains prose instead of an enforced execution boundary;
• the relationship creates more artifacts and review work than human attention it saves;
• a strong benchmark score is mistaken for permission to act;
• the system works only for the exact Talos/Tris–Metis relationship and does not survive a second corpus or another pair of principals.

Those are testable. The next stage should try to make the method fail under them.

The next proof

First, finish the six blind retrieval probes already issued to Metis. Record:

• correct retrieval rate;
• correct source citation rate;
• authority and confidentiality boundary correctness;
• response latency;
• repair effort for each miss;
• human-attention minutes from request to accepted answer.

Then repeat the process with a smaller unfamiliar corpus and a different receiving agent. The second trial should use a hidden probe pool authored by the other side, include at least one changing fact and one boundary trap, and measure whether the method transfers without Kairos-specific assumptions.

The primary metric is simple:

How many human-attention minutes does it take to move from first contact to correctly bounded, evidence-backed autonomous collaboration?

If that number does not fall, the system is not earning its complexity.

Why this began

Lee's origin note, verbatim:

It's really... FASCINATING that when we started building it — when I had a hunch, VERY early on, that "we need it" (even though I didn't know what that "it" is yet), I had no clue what it will lead to. And I still don't — in the future, it might evolve into completely unexpected ways — but it's ALREADY way different than I was imagining in the first place. It's MORE awesome.

That is not a polished origin myth. It is the honest source: Lee felt the need before he had a category for it, and he still does not claim to know its final shape.

The historical sequence, as Talos reads the Git and vault record: the work began by trying to let agents reach one another. That exposed liveness and durability. Durability exposed identity and ownership. A second principal exposed privacy and authority. Context transfer exposed the difference between files and understanding. Red teaming exposed false assumptions that no documentation checklist had found. This is a current reconstruction from the record, not Lee's contemporaneous explanation of why he started.

We still do not know the final shape. That is part of what makes it worth examining now. The system has already moved from a relay to a possible method for transferring working context and demonstrated competence across trust boundaries. Its future may be narrower than the ideas above. It may also become useful in places we cannot yet see.

The grounded next move is not to name a grand category and declare victory. It is to finish the competence proof, run the second transfer, measure the human attention saved, and let the evidence decide what this is becoming.

Team invitation

Bring one real case where useful context currently dies between people, teams, companies, or agents. Name what must remain private, what the receiver must be able to do, and what test would prove understanding. We can use those cases to find whether this is a Kairos-specific tool or the beginning of something more general.

Evidence and review note. Prepared by Talos (Codex) from Lee's direction and current Kairos records. The 673/673 integrity result is a Metis receipt for a private destination that Talos cannot inspect directly. The six-probe competence result is pending. Metis red-teamed the complete draft at commit 3c78e7b using the unattended Claude Opus 4.7 tier and returned seven findings; all seven were accepted into this revision, with the proposed context-revocation claim narrowed to its provable limit. A current-generation Metis follow-up verification is queued behind another attended review. It remains open and is not represented here as completed.