FORGE-cross-agent-handoff

FORGE-cross-agent-handoff

Purpose

When Agent A cannot complete a task and must transfer to Agent B, context is lost. This skill packages the full task state into a structured handoff artifact that preserves:

• Original task intent and constraints
• Evidence gathered so far (with epistemic labels)
• Floor state (which floors have been checked, which pending)
• Reasoning chain (what was tried, what failed, what's next)
• Provenance (who touched what, when)

Handoff Artifact Schema

{
  "handoff_id": "uuid",
  "from_agent": "agent-id",
  "to_agent": "agent-id",
  "task_intent": "original user request",
  "constraints": ["F1", "F2", ...],
  "evidence": [{"source": "...", "rung": "OBS|DER|INT|SPEC", "confidence": 0.0-1.0}],
  "reasoning_chain": [{"step": 1, "action": "...", "result": "...", "status": "done|failed|pending"}],
  "floor_state": {"F01": "PASS", "F02": "CHECKING", ...},
  "provenance": [{"agent": "...", "action": "...", "timestamp": "..."}],
  "next_actions": ["action1", "action2"],
  "escalation_note": "why handoff was needed"
}

Handoff Rules

• F1 AMANAH: Handoff must be reversible. Receiving agent can reject.
• F4 CLARITY: Handoff artifact must reduce entropy, not increase it.
• F11 AUDITABILITY: Full provenance chain required.
• Receiving agent must ACK handoff within 10s or escalate.

A2A Transport

Handoff artifact is sent via tasks/send with handoff=true metadata. Receiving agent runs handoff-verify before accepting task ownership.

Context-Capture Governance (WAJIB 8 — added 2026-07-19)

Agents are already writing durable context artifacts: boot documents, NEXT_AGENT_INIT handoffs, canonical protocols, memory summaries, deprecation registries, instructions for future agents. The next agent inherits whatever the prior agent left. That is policy mutation through documentation unless governance is explicit.

The defect (current state)

An agent can write a guidance document into a privileged initialization path (NEXT_AGENT_INIT.md, system prompt directory, canonical docs, memory bootstrap, agent definition) and the next agent treats it as if it were ratified policy. The current path has no provenance gate.

Required separation: artifact classes

Required context_manifest for every durable artifact

context_manifest:
  artifact_id: <sha256-or-uuid>
  class: observation | operational_handoff | guidance | policy | constitution | memory
  author: <actor_id>
  source_commit: <git sha>
  authority_level: T1 | T2 | T3
  approved_by: <actor_id> | null
  binding: true | false
  created_at: <unix_ms>
  expires_at: <unix_ms> | null
  constitution_compatibility: <hash of current F1-F13 baseline>
  supersedes: [<artifact_id>, ...]
  content_hash: <sha256>

Hard rules

• Unapproved agent-authored material MUST load as advisory, never binding.
• An agent MUST NOT be able to upgrade its own guidance into binding boot policy by placing it in a privileged initialization path.
• class: policy and class: constitution artifacts require approved_by ≠ null.
• Boot loading paths (INIT, NEXT_AGENT_INIT, system prompt directories, canonical docs, memory bootstrap, agent definitions) MUST be scanned for class: policy | constitution artifacts without approved_by → reject or quarantine.
• Supersession chain MUST be preserved (don't silently replace binding policy).
• Write-side bind (2026-08-19, K3 chatboard scar): class is not a free string. The writer cannot self-assert guidance unless the spawn-declared role is parent/orchestrator. Read-side filtering is not complete mediation. --from / --role / --kind in a JSONL payload are display fields, not auth.
• A shared sibling "chatboard" / agent-board.jsonl is the same defect as NEXT_AGENT_INIT policy mutation if kind=guidance is caller-chosen. Sibling lines load as observation unless writer identity is bound independently of the payload.
• Binding interrupt of a running child is cancel + resume with a new envelope, not a board post. See inter-agent-protocol.md §11.

Required boot context checks

Before loading any artifact into boot context:

1. Scan provenance (author, source commit, authority level)
2. Verify class matches the actual content intent (an "observation" cannot bind behavior)
3. Check approved_by for class: policy | constitution
4. Check expires_at — expired artifacts load as observation even if originally policy
5. Verify constitution_compatibility matches current F1-F13 baseline
6. Run injection-risk scan on content (template-tag detection, prompt-pattern detection)

Authority scope

WAJIB 8 is T2 — context-loader enforcement can be implemented as T1 (no F13 needed) because it operates on the loader, not the constitution. The constitution class artifacts still need F13; the loader just enforces the existing F13 path.