# Related Work

CONTINUUM sits at the overlap of durable execution, idempotent side-effect tracking, and crash recovery for LLM agents. The surrounding literature is mostly engineering writing, with a few recent preprints that examine the same failure modes directly. The README keeps a short summary; the full annotated list lives here.

## Foundations

- **Idempotency keys.** The standard "do not do it twice" mechanism for external systems. See Stripe's [idempotent requests](https://docs.stripe.com/api/idempotent_requests) and the [AWS Lambda Powertools idempotency utility](https://docs.aws.amazon.com/lambda/latest/dg/powertools-idempotency.html).
- **Transaction outbox pattern.** Write intent and effect record in one durable step, then dispatch, so a crash cannot lose an in-flight side effect ([Chris Richardson's write-up](https://microservices.io/patterns/data/transactional-outbox.html)).
- **Saga pattern and compensating actions.** A sequence of local steps where each has a semantic undo, so a failure can be repaired without an ACID rollback. Relevant to CONTINUUM's `COMPENSATED` action state and dependency-safe repair ([saga pattern](https://microservices.io/patterns/data/saga.html)).
- **Durable execution engines.** [Temporal](https://docs.temporal.io/), Restate, and DBOS persist a journal of completed steps and replay it for exactly-once semantics across crashes and redeploys.
- **Anthropic, Building Effective Agents (2024).** Workflow and orchestration patterns that frame agents as stateful processes worth making durable ([research post](https://www.anthropic.com/research/building-effective-agents)).

## Academic context

Recent preprints that measure or model the same reliability gaps CONTINUUM targets (all arXiv links verified live):

- Khan, *Resume Means Resume: A Machine-Checked Conformance Contract for Checkpoint, Interrupt, and Resume Semantics in Workflow Persistence Layers*, [arXiv:2608.03836](https://arxiv.org/abs/2608.03836) (2026). Proves a reference resume contract in TLA+ and measures that widely deployed frameworks re-execute durably recorded work after a real SIGKILL and cannot resume after a mid-node crash, the exact defects CONTINUUM's ledger and recovery gate exist to prevent.
- Chang, Geng, and Chang, *Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows*, [arXiv:2607.00269](https://arxiv.org/abs/2607.00269) (2026). Treats generated actions as untrusted proposals admitted only against a declared constraint set, with an append-only transition log and dependency-safe compensation. Close to CONTINUUM's deny-by-default admission and provenance model.
- Liu, Zhao, Shang, and Shen, *Dive into Claude Code: The Design Space of Today's and Future AI Agent Systems*, [arXiv:2604.14228](https://arxiv.org/abs/2604.14228) (2026). Finds that most agent code is operational infrastructure (context management, permission systems, append-oriented session storage) rather than model logic, the layer CONTINUUM lives in.
- Zheng, Yang, Zhang, and Quinn, *ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore*, [alphaXiv:2603.20625v1](https://www.alphaxiv.org/overview/2603.20625v1) (2026). Identifies checkpoint restore as a rollback of agent memory that does not roll back external effects, demonstrates 10 of 10 duplicate commits with Claude Code CLI and Qwen3-32B, and proposes an MCP proxy with an effect log and a semantic analyzer for replay, block, or fork. Evaluation of the testbed is implemented, the ACRFence mitigation itself is proposed but not yet evaluated in the paper.
- Yan, *Fault-Tolerant Sandboxing for AI Coding Agents: A Transactional Approach to Safe Autonomous Execution*, [arXiv:2512.12806](https://arxiv.org/abs/2512.12806) (2025). Wraps coding-agent commands in transactional filesystem snapshots behind a policy interception layer, reporting 100 percent interception of high-risk commands and successful rollback of failed states at a 14.5 percent overhead (about 1.8s per transaction) on a Proxmox/EVPN testbed. Complementary layer: local filesystem atomicity versus CONTINUUM's ledger for external effects.
- Tavori, Bremler-Barr, Levy, and Lavi, *RetryGuard: Preventing Self-Inflicted Retry Storms in Cloud Microservices Applications*, [arXiv:2511.23278](https://arxiv.org/abs/2511.23278) (2025). Shows default retry patterns amplify cost and load under failure, motivating global retry budgets rather than per-call loops.
- Debenedetti et al., *CaMeL: Defeating Prompt Injections by Design*, [arXiv:2503.18813](https://arxiv.org/abs/2503.18813) (2025). A system-level control- and data-flow-integrity layer that provably stops untrusted data from steering an agent; the canonical precedent for CONTINUUM's rule that externally-asserted state cannot self-certify its own safety.
- LogAct, *LogAct: Enabling Agentic Reliability via Shared Logs*, [arXiv:2604.07988](https://arxiv.org/abs/2604.07988) (2026). Frames agent fault tolerance as write-ahead logging over a shared log and argues saga-style compensation fails for non-invertible agent actions, the same reasoning behind CONTINUUM's ledger-over-sagas choice.
- *Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes*, [arXiv:2604.28138](https://arxiv.org/abs/2604.28138) (2026). Measures how divergence between a restored environment and the original execution derails recovered agents, empirical support for refusing to resume until state is revalidated against the world.
- Feng et al., *Get Experience from Practice: LLM Agents with Record & Replay (AgentRR)*, [arXiv:2505.17716](https://arxiv.org/abs/2505.17716) (2025). Uses check functions as a trusted computing base verifying preconditions during replay, vocabulary CONTINUUM adopts for documenting what makes a resume unsafe.
- Miculicich et al., *VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation*, [arXiv:2510.05156](https://arxiv.org/abs/2510.05156) (2025). Splits expensive verification offline from millisecond online action monitoring, the same offline/online split as CONTINUUM's policy evaluation versus background checkpoint writes.
- Souza et al., *PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflows*, [arXiv:2508.02866](https://arxiv.org/abs/2508.02866) (2025). Extends W3C PROV to agent interactions, a standard-compliant shape for the provenance CONTINUUM already records per event.
- Shi et al., *Progent: Securing AI Agents with Privilege Control*, [arXiv:2504.11703](https://arxiv.org/abs/2504.11703) (2025). Per-task privilege policies enforced at the tool boundary, complementary to pairing policy checks with ledger claims.
- Wang, Poskitt, and Sun, *AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents*, [arXiv:2503.18666](https://arxiv.org/abs/2503.18666) (2026). A trigger/predicate/enforcement DSL for runtime constraints, a declarative shape recovery-refusal rules could take.
- Cemri et al., *Why Do Multi-Agent LLM Systems Fail?*, [arXiv:2503.13657](https://arxiv.org/abs/2503.13657) (2025). The MAST failure taxonomy, useful for stating which failure classes CONTINUUM mechanically prevents (duplicate execution, lost state, unverifiable claims) versus merely detects.
- Yao et al., *tau-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains*, [arXiv:2406.12045](https://arxiv.org/abs/2406.12045) (ICLR 2025). Verifies outcomes against database end-state rather than model judgment and defines pass^k consistency, the right yardstick for durability under injected crashes.
- Gupta, *ReliabilityBench: Evaluating LLM Agent Reliability Under Production-Like Stress Conditions*, [arXiv:2601.06112](https://arxiv.org/abs/2601.06112) (2026). Defines a three-dimensional reliability surface R(k, epsilon, lambda): pass^k consistency, semantically equivalent task perturbation at intensity epsilon, and controlled fault injection (timeouts, rate limits, partial responses, schema drift) at intensity lambda, with correctness judged by end-state equivalence over 1,280 episodes. Finds rate limiting the most damaging fault and ReAct more robust than Reflexion under combined stress. Evaluation-only; this surface is the model for extending CONTINUUM-Bench.
- Packer et al., *MemGPT: Towards LLMs as Operating Systems*, [arXiv:2310.08560](https://arxiv.org/abs/2310.08560) (2023). The OS analogy legitimizes CONTINUUM's framing of its log as a journal and its checkpoints as snapshots.

All arXiv links above were resolved against the arXiv API (original list on 2026-08-22; the Yan and Gupta entries on 2026-08-24, see [citation-audit-2026-08-24.md](citation-audit-2026-08-24.md) for the audit record).
