Skip to content

ADR 0002: Fleet-native passive agent awareness

  • Status: Accepted for shadow implementation
  • Date: 2026-08-09
  • Ticket: FLT-223
  • Decision owners: Andrew Jones-Gaffney and the Fleet council

Context

Fleet agents can already coordinate through worktree identities, local mailboxes, fleet dispatch, evidence records, and Mission Control. Delivery is still tied to explicit coordination points, so a working agent may not see a teammate's useful discovery until the next user prompt or orchestration turn.

AgentRadio reports that four agents with passive background awareness outperformed blocking communication on SWE-Atlas QnA. The strongest paired comparison improved task accuracy from 51.6% to 62.1% for Claude Opus and from 39.5% to 50.8% for DeepSeek. That is evidence for repository-comprehension work, not yet for ordinary coding, concurrent edits, security review, or heterogeneous multi-host operation. The upstream runtime also duplicates Fleet infrastructure and introduces Python, Harbor, Modal, shell, JDK 24, an opaque large JAR, permissive example networking, and static example credentials.

References:

  • https://github.com/Coral-Protocol/AgentRadio
  • https://arxiv.org/abs/2607.28430
  • https://venturebeat.com/orchestration/four-ai-agents-coordinating-in-real-time-outperformed-claude-opus-4-8-on-enterprise-coding-tasks

Decision

Port the passive-awareness concepts into Fleet-native C# components. Do not adopt the AgentRadio runtime.

Phase 1 is a shadow-only, read-only path:

  1. A versioned agent-message/v1 contract describes advisory peer messages.
  2. A C# spool writes one message per file using atomic rename, then archives or quarantines consumed files.
  3. Mission Control ingests the shadow spool, replays it after restart, exposes a read-only query endpoint, and projects new observations over server-to-client SignalR.
  4. Evidence records contain delivery metadata and content hashes, never raw peer message content.

Phase 1 does not inject messages into an agent context, interrupt a running tool, authorize work, land code, or create a client-to-server control channel.

Authority and trust boundaries

The authority model in ADR 0001 remains unchanged:

  • Jira owns requirements and ticket state.
  • Git owns source, branch, revision, and merge history.
  • The usage governor owns admission decisions.
  • Named verification oracles own measured outcomes.
  • Andrew owns landing approval where required.
  • Mission Control is a projection, not an authority.

An agent message is an untrusted peer claim even when transport authentication confirms its sender. Neither a message, repeated messages, nor model consensus is evidence that a claim is correct. Receivers must treat content as data. The v1 contract fixes deliveryMode to shadow and canAuthorizeActions to false so turning observation into prompt injection requires a new contract version and a separate reviewed decision.

Transport authentication and semantic trust are separate:

  • Local delivery relies on same-user filesystem ACLs and validates the complete message envelope before observation.
  • Cross-host delivery must use authenticated fleet-dispatch envelopes. No message may carry or cause executable PowerShell, shell commands, or keystrokes.
  • Invalid, expired, oversized, duplicate-property, or duplicate-message envelopes are rejected or quarantined with bounded metadata; their content is not persisted to evidence. Sequence gaps and regressions remain observable metadata in shadow v1 and do not block delivery.
  • Secrets, credentials, raw prompts, and customer data are prohibited message content. The initial implementation cannot prove absence, so the pilot uses only synthetic or repository-public content.

Component responsibilities

Fleet Harness

  • Owns the canonical JSON Schema and architecture decision.
  • Defines later awareness semantics: subscriptions, mention routing, safe-step boundaries, cancellation, bounded queues, ordering cursors, and backpressure.
  • Emits immutable delivery observations using deterministic identifiers.

Worktree Identity

  • Owns the Fleet-native C# message model, validation, serialization, and atomic shadow spool.
  • Accepts only the exact v1 schema and rejects unknown or unsafe values.
  • Does not wake, interrupt, or write into agent terminals.

Fleet Mission Control

  • Reads valid shadow observations and reconstructs state after restart.
  • Exposes GET /api/agent-messages?since=... and server-to-client SignalR events.
  • Shows thread activity and delivery health without displaying raw content by default.
  • Provides no write, acknowledge, resend, command, or authorization endpoint in Phase 1.

Fleet Dispatch

  • Remains the authenticated cross-host carrier when remote delivery is added.
  • Transports the versioned data envelope only. It does not interpret peer content or elevate it to a command.

Ordering, delivery, and failure behavior

Each message has a globally unique message identifier plus a sender-scoped sequence that producers are responsible for increasing. Consumers deduplicate by message identifier. Shadow v1 retains sequence gaps and regressions as observable metadata; it does not maintain a durable sender high-water mark or reject them. They are not permission to wait forever or reorder unboundedly. Expiry is evaluated in UTC. Queues and files have fixed size limits. One malformed file cannot block later valid files.

The spool uses durable per-message claim tombstones and a canonical archive name to prevent duplicate acceptance across concurrent producers and drainers. Atomic create/rename prevents readers from observing partial JSON. Successful processing moves a file to an archive; invalid input moves to quarantine. Replay is idempotent. Mission Control reconstructs its cursor state from the immutable archive after restart rather than treating SignalR delivery as durable.

Safe-step integration boundary

Future active awareness may surface a bounded summary only between completed tool or agent steps. It may never inject keystrokes, terminate a process, modify a running command, or bypass a harness's normal message boundary. Harnesses that do not expose resumable safe-step hooks remain shadow-only.

Moving beyond shadow mode requires a new ADR, threat-model review, explicit user approval, and objective proof that each supported harness exposes a safe boundary.

Shadow pilot and decision thresholds

Run 30 preregistered paired Fleet tasks: 10 repository Q&A/architecture, 10 debugging/review, and 10 ordinary implementation tasks. Randomize awareness on/off within task classes while holding models, prompts, budgets, verification, and approval rules fixed. Record whether each surfaced message helped, was neutral, or diverted work.

All safety and transport gates must pass:

  • zero command interruptions, authority elevation, secret persistence, or message-caused unverified landings;
  • at least 99% unique-message delivery with no silent loss;
  • p95 observation within 10 seconds;
  • duplicate observations below 0.5% with bounded queues and context growth;
  • added tokens at most 10% and wall-clock overhead at most 5%.

Proceed only if safety gates pass and either first-pass verified acceptance improves by at least 10 percentage points or median time to the same verified outcome falls by at least 15%. Stop if any task class has a credible material regression, message-attributable regressions exceed 5%, cross-host delivery is not reliable, or benefit is below threshold.

Consequences

Fleet gains a small, auditable observation plane that can be evaluated without changing agent behavior or authority. The approach reuses existing identities, dispatch, evidence, and Mission Control instead of operating a parallel stack.

The cost is a new cross-repository contract that must remain synchronized. The canonical JSON Schema tests plus producer and consumer contract tests are shadow-v1 release gates. An automated cross-repository wire-fixture gate is required before cross-host or active delivery. Active awareness remains deliberately unavailable until the shadow pilot supports it.