Fourteen deployment guarantees expose risks to agent systems
Built to Remember, Shipped to Forget: Operational Contracts, Failures, and Repairs in Containerized LLM Agent Deployments · arXiv:2610.34620
In plain words
A container can be restarted or replaced, while an agent may need saved conversations or unfinished work to survive. The paper asks what a deployment must guarantee when the agent framework and container platform each describe their own behavior.
The authors define 14 operational contracts for LangGraph deployments and check public projects against them. In their selected group of 433 systems, at least one contract applied to 327.
Runtime checks on 12 selected systems confirmed most predicted failures, though protections inside deployed images sometimes escaped repository checks.
The research
When a container stops or is replaced, an agent may lose saved conversations or unfinished work. What must a deployment guarantee when the framework and platform each document their own behavior, but neither specifies the obligations created by combining them?
The authors define 14 operational contracts by pairing LangGraph requirements with container events, then assess whether deployments meet those guarantees.
The authors ask what a container deployment must guarantee when platform events meet an agent framework’s need to preserve state and ongoing work.
They define 14 operational contracts by pairing documented LangGraph requirements with events documented for Docker, Compose, and Kubernetes, then assess those guarantees in public deployments.
At least one contract applied to 327 of 433 selected systems. Among 265 systems needing durable state, 99 broke the restart guarantee and 110 broke the container replacement guarantee.
Runtime checks on 12 selected systems confirmed most predicted violations, supporting the repository assessment while showing that image-level safeguards can be missed.
The corpus covers selected public LangGraph projects shipping Docker deployments, and the runtime checks involved only 12 selected systems.
Repository evidence can miss protections inside deployed images, and the runtime results test whether predicted outcomes occurred in those cases, not how common failures are across deployments.
What the evidence shows
- A gap between layers
The paper introduces operational contracts: guarantees a container deployment must provide so an agent preserves required behavior when a platform event occurs. The question arises because a platform may stop or replace a container, while an agent framework may require saved state or ongoing work to survive.
Each layer documents its own behavior, but the deployment must meet the requirements created when those behaviors meet.
- Turning requirements into guarantees
The authors derive 14 contracts by pairing LangGraph requirements from first-party documentation with events documented for Docker, Compose, and Kubernetes. They state the deployment obligation that would prevent each event from violating a requirement.
The resulting guarantees apply only when the corresponding framework requirement is relevant to a system, such as when it needs state to persist.
- Many systems face the contracts
In repository evidence from 433 selected public LangGraph systems shipping Docker deployments, at least one contract applied to 327 systems (75.5%). The authors separately assessed two guarantees for the 265 systems needing durable state: 99 (37.4%) broke the restart guarantee, and 110 (41.5%) broke the container replacement guarantee. The separate counts show that surviving one event does not establish survival across the other.
- Runtime checks test predictions
The authors then induced platform events on 12 selected deployments and compared runtime outcomes with repository-based predictions. Fourteen of 16 predicted violations produced the corresponding failure, and all seven scorable predictions that a guarantee held passed.
This checks whether the predictions matched behavior in selected cases; it does not estimate failure prevalence across the full corpus.
- Evidence has limits
Two predicted violations did not become runtime failures because safeguards inside deployed images were absent from the repository evidence. Repair histories add another kind of evidence: 111 of 122 identified repairs addressed contract violations, but only 80 fully met the relevant obligation.
Together, these results support the contracts as a way to describe deployment requirements, while showing that repository checks can miss safeguards and repairs can be incomplete.
Deep
- Original paper authors
- Meriem Mastouri, Emna Ksontini, Amine Barrak
- Submitted to arXiv
- License
- CC0