---
title: Inter-Agent Lineage
url: https://www.emergentmind.com/topics/inter-agent-lineage
type: topic
---

# Inter-Agent Lineage

Inter-agent lineage is the explicit provenance structure that ties together what agents observed, produced, inherited, invoked, remembered, approved, or called across multi-agent execution, multi-session memory, policy iteration, or intergenerational population updates. In current work, the term does not denote a single formal object: it appears as a time-ordered semantic path in a hierarchical attributed graph, a maintained identifier-preserving mapping across a multi-agent pipeline, a content-addressed ancestry relation over cognitive memory blocks, a cryptographically verifiable multi-hop call chain, a typed lifecycle artifact graph, an append-only event log with deterministic replay, and, in population-based reinforcement learning, a scalar inherited credit signal [2605.06812] [2605.17535] [2604.19540] [2509.18415] [2010.14616].

## 1. Definitions and scope

In security-auditable agent systems, an inter-agent lineage path is a time-ordered path
$P=(v_0 \to_{e_1} v_1 \to_{e_2} \dots \to_{e_k} v_k)$
that crosses at least one cross-agent propagation edge and may include memory and tool-binding edges. The formulation requires temporal ordering by timestamp, session or trace coherence via `trace_id`, and, for persistent memory, versioned references [2605.06812]. In the Mesh Memory Protocol, lineage of a Cognitive Memory Block \(c\) is carried as `parents(c)` and `ancestors(c)=parents(c)\cup \bigcup_{p\in parents(c)} ancestors(p)`, with keys derived from content hashes; the purpose is to realize traceability of every claim to source across agents and session restarts [2604.19540]. In cryptographic A2A settings, inter-agent lineage is the verifiable history of interactions among non-human identities, binding who acted, what was invoked, when it occurred, and under which policy or version context into an append-only, tamper-evident trail [2509.18415].

Other formulations are pipeline-centric rather than message-centric. In AgentModernize, inter-agent lineage is the maintained mapping from legacy artifacts, extracted rule records, Behavioral Specification Graph nodes and edges, generated code units, and validator outcomes across iterations, realized through consistent identifiers such as `rule_id`, `node_id`, and `test_id` [2605.17535]. In OpenAgenet/OAN, lineage is the verifiable provenance chain spanning identity issuance, Root-governed authorization, accepted identity versions, package publication, discovery responses, and signed trusted invocation [2606.03163].

A different usage appears in evolutionary RL. In Lineage Evolution Reinforcement Learning, lineage is not a graph of artifacts or calls but a per-agent scalar \(\phi_i\) that is combined with normalized performance \(\rho_i\) through
\(\Gamma_i \gets w_{\rho}\rho_i + w_{\phi}\phi_i\),
updated by rank-based credit assignment, and inherited across mutation and crossover with decay [2010.14616]. The surveyed literature therefore treats inter-agent lineage as a family of provenance formalisms rather than a single ontology.

## 2. Representational substrates

Several systems make lineage first-class by embedding it directly into the execution substrate rather than reconstructing it after the fact. Representative formalisms include hierarchical attributed graphs, content-addressed DAGs, typed lifecycle artifact graphs, version graphs over registered resources, and append-only event logs with deterministic projections [2605.06812] [2604.15034] [2604.19540] [2603.14312] [2605.21997] [2606.22142].

| Work | Formal substrate | Lineage unit |
|---|---|---|
| Agent-BOM | Hierarchical attributed directed graph \(B_s=(A,V,E,a)\) | Semantic states, capabilities, memory, cross-agent edges |
| MMP | Content-hash CMB graph | Parents, ancestors, remix method |
| ActiveGraph | Event log \(L\) and projection \(G=P(L)\) | `caused_by`, objects, relations, model/tool I/O |
| RoboLineage | Typed, versioned artifact graph \(L_k=(V_k,P_k)\) | Rollouts, reviews, datasets, training, evaluation, governance |
| ScienceClaw + Infinite | Artifact DAG \(G=(V,E)\) | Derivation, synthesis, discourse relations |
| AGP/AGS | Version lineage over protocol-registered resources | Resource versions, commits, rollback targets |

Agent-BOM separates a static capability layer from a dynamic runtime semantic layer. Static nodes include `AgentNode`, `CodeNode`, `LLMNode`, `PromptNode`, `ToolNode`, `SkillNode`, and `LongTermMemoryNode`; dynamic nodes include `ExternalNode`, `GoalNode`, `ContextNode`, `ReasoningNode`, `DecisionNode`, `ActionNode`, and `ObservationNode`. Cross-agent propagation is encoded through `sends_to`, `delegates_to`, `responds_to`, `shares_context_with`, and `shares_memory_with`, while the attribute map records `trust_level`, `integrity_status`, `authentication_status`, `permission_scope`, `confirmation_status`, `environment_state_change`, `source_agent`, and `target_agent` [2605.06812].

Autogenesis promotes `Prompt`, `Agent`, `Tool`, `Environment`, and `Memory` to protocol-registered resources with explicit lifecycle and versioned interfaces. For a resource instance, versions are immutable snapshots; `update`, `copy`, and `restore` induce per-resource lineage graphs, while accepted changes form a system-level commit DAG over resource versions and traced execution artifacts [2604.15034]. ScienceClaw + Infinite uses immutable artifacts with `artifact_id`, `artifact_type`, `content_hash`, and `parentArtifactIds`; edges are partitioned into `Ecomp`, `Esynth`, and `Edisc`, which respectively encode computation, multi-parent synthesis, and discourse relations such as `cite`, `contradict`, `extend`, and `replicate` [2603.14312]. RoboLineage analogously represents policy iteration as a typed artifact graph \(L_k=(V_k,P_k)\) whose nodes include `rollout.record`, `snapshot.jsonl`, `annotation.final.json`, `dataset_decision.json`, `dataset.lock.json`, `train.run.json`, `policy.meta.json`, `eval.summary.json`, and `deploy.ticket.json` [2606.22142].

ActiveGraph makes the append-only event log the source of truth. The log is a totally ordered sequence \(L=[e_1,\dots,e_n]\), the working graph is the deterministic projection \(G=P(L)\), and each event carries an `actor/agent_id`, a typed payload, a timestamp, and an optional `caused_by` pointer to a prior event. Objects and relations then carry provenance blocks linking them back to producing behaviors and triggering events [2605.21997]. This is a stronger lineage substrate than a conventional observability layer because replay, fork, and provenance queries are defined over the same primary record.

## 3. Propagation across agents, sessions, and generations

In the security-auditing literature, inter-agent propagation is modeled as semantic transmission rather than simple message passing. Agent-BOM explicitly represents the cognitive-state chain `External → Goal → Context → Reasoning → Decision → Action → Observation`, and cross-agent lineage can cross both propagation edges and persistence edges such as `reads_from` and `writes_to`. This permits reconstruction of cross-session memory contamination, capability binding, privilege transfer, and trust-boundary crossings in one path [2605.06812].

The Mesh Memory Protocol focuses on cross-session agent-to-agent cognitive collaboration. Every accepted peer contribution is stored only as the receiver’s own remix, not as raw peer state. Echo detection is then reduced to ancestor containment:
\[
Echo(c_{in}) \Leftrightarrow (key(c_{in}) \in K_{self}) \vee (ancestors(c_{in}) \cap K_{self} \neq \varnothing).
\]
Because `lineage.ancestors` is shipped on wire, recognition of returning claims is a set-membership operation rather than a graph traversal at receipt time. The specification also bounds ancestor depth to at most 50, which caps lineage metadata growth [2604.19540].

Autogenesis addresses cross-entity lifecycle and hot-swapping. Agents retrieve prompts, tools, and memory through a shared registry; accepted changes become immediately available to all sub-agents through the Dynamic manager; and `plan.md`, tool code, memory schemas, and other resources can be versioned, restored, and audited through RSPL and SEPL interfaces [2604.15034]. In a different temporal direction, LERL propagates lineage across generations rather than sessions: mutation offspring inherit \(\phi_u \leftarrow \zeta_m \phi_j\), crossover offspring inherit \(\phi_w \leftarrow \zeta_c(\phi_{k_1}+\phi_{k_2})/2\), and the current lineage value is mixed with new rank-based credit using \(\zeta_o\) before normalization [2010.14616]. Inter-agent lineage thus spans at least three distinct transmission regimes in current research: cross-agent semantic propagation, cross-session memory persistence, and intergenerational inheritance.

## 4. Verification, auditing, and adjudication

One major line of work treats lineage as the basis for security adjudication. Agent-BOM standardizes audits as
\[
R=(V_{entry}, P_{back}, P_{fwd}, C),
\]
where \(V_{entry}\) are anomalous entry nodes or edges, \(P_{back}\) traces backward to origins, \(P_{fwd}\) traces forward to impacts, and \(C\) encodes adjudication conditions. The framework is instantiated against the OWASP Agentic Top 10 and supports graph queries for cases such as cross-session contamination leading to tool misuse, insecure inter-agent messages altering downstream goals, and privilege abuse via poisoned memory [2605.06812].

Cryptographic lineage systems make verification externalizable. Context Lineage Assurance models lineage events as leaves in CT-style append-only Merkle logs, publishes Signed Tree Heads
\[
STH_n = Sign_{sk_{LS}}(n \parallel root_n \parallel wallclock_t \parallel monotonic\_ctr \parallel log\_id),
\]
and relies on RFC 6962 inclusion and consistency proofs. Proof size and verification time are \(O(\log n)\). A federated proof server validates proofs across one or more logs and emits signed attestations, while multi-hop verification checks identity signatures, `prev` links or citations, and cross-time consistency across the chain [2509.18415].

OAN anchors lineage in Root-governed identity and discovery. A Root acceptance record
\(\langle did, v, H(M^v), status, t, \sigma_{root} \rangle\)
binds an accepted identity version to a canonical hash; discovery responses are signed and authorization-aware; trusted invocation envelopes bind caller DID, target DID, timestamp, nonce, path or method, and body hash; and a trust predicate can be evaluated over the lineage DAG connecting Root, Registrar, Discovery nodes, packages, credentials, and invocations [2606.03163].

ActiveGraph approaches verification through replay rather than signatures. Byte-identical logs must project to identical graphs; model and tool I/O are served from content-hashed recorded responses during replay; and strict replay raises a divergence error at the first non-matching event if a behavior violates the determinism contract by reading wall-clock time, randomness, or mutable global state [2605.21997]. A common misconception is that inter-agent lineage is equivalent to runtime logging or transport security. Several papers explicitly reject that equivalence: Agent-BOM argues that SBOMs and runtime logs do not capture runtime cognitive states or cross-layer bindings, while CT-style and OAN-style approaches extend A2A beyond point-to-point authentication to multi-hop provenance [2605.06812] [2509.18415] [2606.03163].

## 5. Operational roles and empirical evidence

Security auditing provides one of the clearest demonstrations of practical lineage use. Agent-BOM reconstructs cross-session memory poisoning followed by tool misuse, capability supply-chain hijacking followed by unexpected code execution, multi-agent ecosystem hijacking, and rogue-agent trust exploitation leading to privilege abuse. The paper reports accurate reconstruction over representative scenarios but does not publish numeric detection accuracy, coverage, average path lengths, or query latency [2605.06812].

In software modernization, lineage functions as a preservation and diagnosis mechanism. AgentModernize decomposes modernization into four agents—Legacy Analyzer, Specification Generator, Modernization Transformer, and Equivalence Validator—connected through a shared state and a Behavioral Specification Graph \(G=(V,E,Pre,Post,Inv)\). The full pipeline with feedback was the only configuration with non-zero mean BER under every backbone: \(9.4\%\) for GPT-4o-mini, \(8.1\%\) for GPT-4o, and \(19.4\%\) for GPT-5.3-codex. The BSG captured \(91.2\%\) of gold-standard rules on average, with \(89.7\%\) precision for S1–S7, which localized the main bottleneck to code generation rather than extraction or specification [2605.17535].

In robot policy iteration, lineage is used for governance rather than only for audit after failure. RoboLineage represents collection, review, admission, dataset freezing, training, evaluation, deployment, and next-collection planning as typed artifacts linked by explicit edges. On 194 expert-rejected rollouts, full RoboLineage achieved \(96.0\%\) outcome accuracy, \(88.0\%\) failure-phase accuracy, \(96.4\%\) admission accuracy, and \(2.1\%\) leakage. Under matched training budgets and evaluation protocols, trained policies remained within \(0.4\) percentage points of expert-managed workflow on average (\(92.7\%\) versus \(93.1\%\)), while routine pre-training labor dropped from \(130.2 \pm 10.7\) to \(54.3 \pm 5.9\) minutes per 30-rollout cycle [2606.22142].

Decentralized scientific discovery uses lineage to coordinate without a central planner. ScienceClaw + Infinite models computation as an artifact DAG with cross-agent synthesis edges, ranks open needs by a deterministic pressure score
\[
s(n_i)=2.0\cdot novelty(n_i)+1.0\cdot centrality(n_i)+0.5\cdot depth(n_i)+0.2\cdot age(n_i),
\]
and performs multi-parent synthesis when compatible peer artifacts exist. Across four investigations, reported synthesis density ranged from \(12\%\) to \(48\%\); in the SSTR2 peptide-design investigation the system involved 10 agents, 23 tools, 177 artifacts, 57 synthesis artifacts, and average DAG depth 2.15 [2603.14312].

Evolutionary RL provides a more indirect but still operational role for lineage. LERL was evaluated on Atari 2600 with DQN, C51, Rainbow, and IQN; LE_Rainbow substantially improved over Rainbow on Asterix and KungFuMaster across best, median, and average curves, while Assault and ChopperCommand were roughly on par with Rainbow [2010.14616]. This suggests that lineage can function either as explicit audit provenance or as an optimization signal that preserves “potential performance” across agent populations.

## 6. Limitations, governance, and open problems

Instrumentation completeness remains a pervasive limitation. Agent-BOM depends on hooks for prompt composition, context assembly, memory I/O, tool calls, and inter-agent messaging; missing hooks reduce completeness, while shared memory, asynchronous communication, and external service chains complicate attribution. AgentModernize similarly shows that strong lineage through extraction and specification does not guarantee successful preservation when the BSG-to-code mapping diverges architecturally; targeted fixes can also induce regressions [2605.06812] [2605.17535].

Cryptographic lineage systems expose different limits. Context Lineage Assurance leaves privacy-preserving lineage, redaction, right-to-forget, partial trace proofs, inter-organizational federation, and stronger timing trust as future work. OAN does not normatively define parent-child identity semantics, keeps SBOMs and build attestations optional, and leaves multi-root federation out of scope [2509.18415] [2606.03163].

Protocol and runtime substrates also remain incomplete. MMP does not yet specify per-CMB signatures, and mixed-model deployments and Byzantine or adaptive adversaries remain open. Autogenesis supports concurrent sub-agent execution but does not define CRDTs, locks, merge strategies, or a formal schema for commit messages and approver identities. ActiveGraph currently replays full logs, so replay cost grows with log length; storage grows with recorded model and tool responses; and external side effects remain external even when their outputs are replayable. RoboLineage, finally, was evaluated on routine, configured, visually grounded manipulation, and future work includes federated lineage, privacy-preserving sharing, standardized rollout identifiers, and broader multimodal evidence [2604.19540] [2604.15034] [2605.21997] [2606.22142].

Taken together, these results suggest that inter-agent lineage is becoming a systems primitive only when representation, verification, and governance are co-designed. Where lineage is reduced to logs without semantics, or to credentials without call-chain structure, or to memory without ancestry, the surveyed systems report loss of explainability, weaker auditability, or fragile coordination. Where lineage is explicit, typed, versioned, and queryable, it becomes not merely a forensic record but an active substrate for security adjudication, behavioral preservation, decentralized coordination, lifecycle governance, and controlled system evolution.

Source: https://www.emergentmind.com/topics/inter-agent-lineage