The handoffs
A stage can be held by an agent when two things are true of it: what it is given is an artifact, and what it hands back is an artifact. Not a conversation, not a shared understanding, not a person who knows. Something with a name, that can be read by whoever comes next and checked by somebody who was not there.
This sounds like a low bar and it is not. It is the whole difference between the stages that have moved and the stages that have not.
The chain
Following one piece of work from somebody wanting it to the address being retired, here is what is actually handed over. The links that exist are solid. The links that are missing are marked.
Requirements → a statement of the job, and the questions it could not settle Design → the shape: steps, and program or judgment on each Test → the suite, written from the statement before any program Code → the programs, passing the suite, with an account and a run record Review → ??? Security rev. → ??? Build → a package: declaration, parts, manifest, digest Release → a signed build record, and an address Deploy → a running agent: identity, address, inbox Configure → credentials by name, settings, ceilings Conformance → a signed verdict against the declaration Docs → a document assembled from the declaration Publish → an address a person can open, and the digest of what is there Retract → ??? Monitor → liveness, measured by an answer Eval → ??? Incident → ??? Cost → ??? Update → the same agent, new version, difference recorded Rollback → ??? Decommission → nothing running, records kept, address retired
Test comes before Code, here and on the map. The suite is written from the statement, before any program exists, and the program is written to it. A solid link says the artifact exists, not that an agent holds the stage: Docs and Monitor have the artifact, made by tools, and no agent yet.
Why the middle joined up first
Nobody designed the middle of this lifecycle to be agentic. It became agentic because packaging, release and deployment had already been forced into artifacts for other reasons, decades ago, by people who wanted repeatable builds. A package with a manifest and a digest is an artifact whether or not an agent reads it.
So when agents arrived, four stages were already waiting with a defined input and a defined output, and moving them took an agent that could read what was there. That is why Build through Conformance moved quickly and nothing else did at first. It was not the easiest work. It was the work that already had a shape.
What unstuck the front
Code and Test were stuck together, and they were stuck for one reason: nothing was handed in and nothing checkable came out. A model given a design wrote a program. Another model given the same design wrote a different program. Neither could be compared to anything, because the design was prose and the program was the first artifact in the chain. Then the same hand wrote the tests, so the tests encoded whatever the program already did, including its mistakes.
The missing piece was never a better model. It was a statement of what the program must be true of, written before the program and by something that was not going to write the program. That is what the Test stage now hands over: a suite written from the statement of the job, naming the functions the program will have to export, run against nothing before it is handed on so that it is known to assert something. With that in hand, Code has an input, an output, and a check its writer does not control, and it can be held by a coding harness working the way a coding session works, for as many rounds as it takes, inside a fence that keeps the tests and the statement out of its reach.
One more artifact was needed to make the front hold, and it is not on the chain because nothing hands it from one stage to the next. A person's own work, in any tool and any language, is a prototype, and making one is agentic prototyping. It goes in to the Code stage, which reads it as the most exact statement of what was wanted and writes the programs again against the suite, which is agentic transpiling. Nothing comes out of the Code stage but what the Code stage delivers under its own signature, and the Build stage refuses everything else. That rule is what lets people prototype freely without the prototype becoming the product.
Why review is still stuck
Review and Security review are the two gaps left at the front, and they share the same missing thing. A review is already an artifact in every other setting: a list of findings, each naming a place and a claim, each one answerable. What nobody has agreed is what a finding is and what answering one means. The Code stage now hands over more for a reviewer to read than it used to, the account of what was written and the record of how many rounds it took, and a program that took twenty-eight rounds is something a reviewer should know. The format for saying so is the gap.
Why the back end is stuck
Retract, Eval, Cost, Incident response and Rollback look like five unrelated problems and share one shape: each needs something written down that nobody has written down.
Eval needs a standard that predates the work. Retract needs the authority that published to be the only one that takes down, and a record of every name it published, so that it knows what it may remove. Cost needs every spend attributable to a job. Incident response needs a way to stop an agent that is still answering. Rollback needs a rule about who may decide and on what evidence. In each case the machinery is easy and the missing thing is an agreement.
That is a more hopeful diagnosis than it sounds. Agreements can be written. This site is a place to write them, and Publish moved off this list by having its agreement written: an authority bound to one folder, a record of every name placed, and a read-back of every address before it is called published.
The loops the chain does not draw
The chain above runs one way and real work does not. A finding sends the program back to be written again. A failed test does the same, and inside the Code stage that loop runs many times before anything is handed on. A refused conformance check or a poor eval can send the whole thing back to design, and rollback is a reversal by definition. Most of the time anybody spends on software is spent going round one of those loops rather than moving forward along the chain.
The chain is drawn straight anyway, because the question here is what passes between two stages, and that is the same artifact whether it is passing for the first time or the fourth. A loop is the same handoff happening again. Where it changes something is in the record: a stage that has run four times has four results, and "which one is current" is a question a straight line never has to answer.
The test for a stage
When considering whether a stage is ready to be held by an agent, three questions settle it, and all three have to be yes.
- Is the input an artifact? Something with a name that the previous stage actually produces, not a thing the agent would have to go and ask about.
- Is the output an artifact? Something the next stage can read without the agent being present to explain it.
- Is there a check the agent does not control? Written before the work, by something other than the thing doing the work.
The third is the one most often skipped, and it is the one that matters. An agent that writes the program, writes the test and runs the test has produced a closed loop, and a closed loop always passes. Splitting the second from the first is what opened the loop at the front of this lifecycle.
Passing all three makes a stage safe to hold on its own. It does not make an approval wrong. Deploying, configuring and decommissioning change the world in ways that are awkward to undo, and a person saying yes to one of those is a record that a person decided, not a check on whether the agent was competent. That record is worth keeping whatever the agent is capable of.
What this is built on
The Build and Release entries describe a manifest, a digest and a signed build record, which is the provenance chain that SLSA and in-toto already specify and Sigstore already implements. Nothing here replaces that work and a serious implementation should use it. What is added is the other end: the same expectation of a named artifact and an outside check applied to the stages where neither existed, and the same provenance chain reaching one stage further back, to the programs themselves.