Architecture

Follow the State. Inspect the boundaries.

Exact identity, retained versions, dependencies, and evidence share one State foundation. AgentCore executes agents; Kam’s general managed workflow layer remains planned.

On this page

Data flow

Where data moves, and where access is checked.

Implemented in source; not a live deployment. The console uses only read routes.

Choose a path

What happens at each handoff?

Application
Submit an outcome with stable identity.
Kam admission
Check scope, revision, and bounded input.
Accepted event
Commit the recorded outcome under version conditions.
Publication
Keep a durable record of downstream work still owed.

Conceptual paths over source-implemented contracts, not a live trace. Optional AgentCore Memory delivery is built, off by default, and not live-qualified. Inspect the corresponding example →

Compare the five existing failure-path diagrams

One workflow, five paths

Built for what goes wrong.

A normal run, a duplicate retry, a correction, a stale worker, and a restart. Each path ends where it should.

Release readiness across three agents. Agent A records a build, Agent B tests that exact build, and Agent C checks if it is ready to ship.

01
Normal path
Each agent reads the exact State the previous one wrote.
Normal path trajectory. Each agent reads the exact State the previous one wrote. Readiness is current and points to build@1 and tests@1.
- build@1 recorded: Agent A
- tests@1 recorded: Agent B · against build@1
- readiness reconciled: View reads both revisions
- readiness: current: Agent C · byIds + read()
- build@1 recorded → tests@1 recorded
- tests@1 recorded → readiness reconciled
- readiness reconciled → readiness: current
Outcome: Readiness is current and points to build@1 and tests@1.
02
Retry
Agent A resends the same build after a timeout.
Retry trajectory. Agent A resends the same build after a timeout. No new revision and no recompute; the original receipt is returned.
- build@1 recorded: Agent A
- same payload resent: status: duplicate
- original receipt: same acceptedSequence
- readiness unchanged: nothing to reconcile
- build@1 recorded → same payload resent
- same payload resent → original receipt
- original receipt → readiness unchanged
Outcome: No new revision and no recompute; the original receipt is returned.
03
Correction
The build result is corrected after tests already ran.
Correction trajectory. The build result is corrected after tests already ran. build@1 stays readable while retained; readiness is not current until tests target build@2.
- build@2 recorded: correction · build@1 kept
- readiness re-evaluated: View requires tests for the current build
- readiness: blocked: tests@1 point to build@1
- tests@2 recorded: Agent B · against build@2
- readiness: current: points to build@2, tests@2
- build@2 recorded → readiness re-evaluated
- readiness re-evaluated → readiness: blocked
- readiness: blocked → tests@2 recorded
- tests@2 recorded → readiness: current
Outcome: build@1 stays readable while retained; readiness is not current until tests target build@2.
04
Stale worker
A delayed worker tries to commit readiness from old inputs.
Stale worker trajectory. A delayed worker tries to commit readiness from old inputs. The version fence rejects it; the newer State stays.
- delayed worker: computed from build@1
- conditional commit: expected version moved
- commit rejected: no overwrite
- newer State kept: build@2 readiness stands
- delayed worker → conditional commit
- conditional commit → commit rejected
- commit rejected → newer State kept
Outcome: The version fence rejects it; the newer State stays.
05
Restart
The wakeup is lost while a worker restarts.
Restart trajectory. The wakeup is lost while a worker restarts. Saved work is picked up again from where it stopped.
- tests@1 accepted: work record committed
- wakeup lost: worker restarted
- maintenance sweep: durable work redriven
- readiness: current: delayed, not lost
- tests@1 accepted → wakeup lost
- wakeup lost → maintenance sweep
- maintenance sweep → readiness: current
Outcome: Saved work is picked up again from where it stopped.

An example. Each step shown is built in code; the scenario has not run on a live deployment.

One system, clear responsibilities

Kam complements your stack. It does not replace it.

Responsibility	Owner
Agent execution and tool orchestration	Your application or AgentCore
Business data and source-of-truth updates	Your existing databases and services
Accepted History and exact revisions	Kam
Supported derived State and dependency reconciliation	Kam
Conversational recall and semantic retrieval	AgentCore Memory or a retrieval system
General-purpose analytics	Your warehouse or analytics platform

Database and distributed-systems contracts

For engineers

Database and distributed-systems contracts.

Exact identity: Retained revisions stay individually addressable. A correction does not replace the revision an earlier decision used.
Versioned membership: Bounded collections are pinned to a generation, so pagination does not shift when newer records arrive.
Deterministic State evaluation: The Rust engine evaluates supplied evidence against versioned definitions. Proposed transitions stay separate from committed ones.
Conditional publication: Expected versions, dependency membership, and authority checks stop a stale writer from overwriting a valid successor.
Event-driven reconciliation: Accepted changes identify affected Views. Saved work and progress survive interruption; reconciliation runs in bounded, version-fenced steps.
Explicit recovery: Retries, conflicts, missing evidence, and unknown outcomes mean different things. A recorded submission is not a verified completion.

Choose a tool by responsibility

Which tool for which job

Use Kam where a purpose-built contract matters.

Job	Kam	Your database	AgentCore Memory	Vector database	Warehouse
Read the exact revision a decision used, never the latest by accidentKam: byIds resolves (id, revision) and reports missing or expired explicitly.	Purpose-built contract	Application-defined	Outside its role	Outside its role	Application-defined
Page a collection that stays pinned across agent turnsKam: allIds pages one generation; a late write publishes a successor instead of shifting the page.	Purpose-built contract	Application-defined	Outside its role	Outside its role	Application-defined
Recompute only the derived State a change affectsKam: Views reconcile same-scope dependents; metrics and watch are planned.	Purpose-built contract	Application-defined	Outside its role	Outside its role	Application-defined
Keep business transactions and source-of-truth writesYour database stays authoritative for its records.	Outside its role	Purpose-built contract	Outside its role	Outside its role	Outside its role
Recall what was said in past conversationsAgentCore Memory owns recall; Kam can optionally publish to it.	Outside its role	Outside its role	Purpose-built contract	Application-defined	Outside its role
Find similar documents or passagesSimilarity search belongs in a vector store beside Kam.	Outside its role	Application-defined	Application-defined	Purpose-built contract	Outside its role
Run ad-hoc analytics across everythingKam does not offer general SQL or arbitrary joins.	Outside its role	Application-defined	Outside its role	Outside its role	Purpose-built contract

Kam’s column describes code that is not deployed yet. Other columns are general categories, not products or benchmarks.

Questions answered by the same model

One model, many questions

A few building blocks answer most questions.

Each question on the right is answered by the blocks wired to it. Some belong to AgentCore or a model, and say so.

One model, many questions. Eight primitives on the left; each concept on the right is answered by the primitives connected to it, or belongs to the runtime or a model.

Identity: stable id per scope
Revision: immutable (id, revision)
Membership: generation-pinned sets
View + dependencies: versioned, reverse-indexed
Authority: principal → workspace
Bounds: limits checked before work
Obligation + receipt: owed work, acknowledged result
Retention clock: evidence deadlines
AgentCore · runtime: plans, decides, calls tools
A model: predicts, scores
Personal watchlist: Planned
Since my last review: Derivable · no operator yet
Saved calculation selection: Planned
Operational memory: Planned
Workflow coordination: Planned
Computation reuse: Planned
History: Implemented in source
Correction: Implemented in source
Snapshot: Implemented in source
Difference: Derivable · no operator yet
Dependency: Implemented in source
Invalidation: Implemented in source
Freshness: Implemented in source
Authority: Implemented in source
Expiration: Implemented in source
Receipt: Implemented in source
Bounded query: Implemented in source
Viewport: Planned
Subscription: Planned
Authorized history: Needs data Kam does not record
Decision: AgentCore or your runtime
Confidence: A model, not Kam

Identity → Personal watchlist
Membership → Personal watchlist
Authority → Personal watchlist
Bounds → Personal watchlist
Revision → Since my last review
Membership → Since my last review
View + dependencies → Since my last review
Bounds → Since my last review
Identity → Saved calculation selection
Revision → Saved calculation selection
Membership → Saved calculation selection
View + dependencies → Saved calculation selection
Identity → Operational memory
Revision → Operational memory
Obligation + receipt → Operational memory
Membership → Workflow coordination
View + dependencies → Workflow coordination
Authority → Workflow coordination
Obligation + receipt → Workflow coordination
Revision → Computation reuse
View + dependencies → Computation reuse
Bounds → Computation reuse
Authority → Computation reuse
Identity → History
Revision → History
Revision → Correction
Membership → Snapshot
Revision → Snapshot
Membership → Difference
Revision → Difference
View + dependencies → Dependency
View + dependencies → Invalidation
Revision → Invalidation
View + dependencies → Freshness
Retention clock → Freshness
Authority → Authority
Retention clock → Expiration
Revision → Expiration
Obligation + receipt → Receipt
View + dependencies → Bounded query
Bounds → Bounded query
View + dependencies → Viewport
Bounds → Viewport
View + dependencies → Subscription
Obligation + receipt → Subscription
Authority → Authorized history
Membership → Authorized history
AgentCore · runtime → Decision
A model → Confidence

See all 22 questions and how each is answered

Concept	Question	Status	How
Personal watchlist	What records do I want to follow, in my order?	Planned	An ordered reference collection with per-entry selectors. The public explorer has a temporary fixture preview; authorized, durable watchlist mutations are not implemented.
Since my last review	What changed, and why does my declared review rule flag it?	Derivable · no operator yet	The release-verification fixture View separates endpoint differences, retained activity, and a named domain rule. Explicit review actions acknowledge displayed exact boundaries in memory only; durable reviews and notifications are not implemented.
Saved calculation selection	Which supported calculation, inputs and period produced this result?	Planned	A definition selects a qualified domain calculator and pinned inputs; its result is versioned State displayed by Views. No new backend primitive or generic business calculator is claimed.
Operational memory	What work can a replacement agent recover?	Planned	History and obligations exist in source. A managed cross-agent handoff is planned; the explorer illustrates it without running an agent.
Workflow coordination	Which parent-child work is eligible?	Planned	Ordered membership and explicit dependencies are separate. The explorer previews valid order; hosted customer workflow management is planned.
Computation reuse	What can be reused without mistaking stale input for a cache hit?	Planned	Local comparison reuse and bounded reads exist. General calculation caching needs explicit applicability and live measurement; fixture counts are not savings.
History	What exactly was recorded?	Implemented in source	allIds() names exact revision references; byIds() returns exactly those revisions.
Correction	What was revised, and what did it replace?	Implemented in source	A correction is the next revision; the earlier one stays readable while retained.
Snapshot	What did this collection look like when it was published?	Implemented in source	A generation fixes ordered membership; pages are read against it.
Difference	What changed between two publications?	Derivable · no operator yet	Compare the exact references of two generations. No diff operator is built.
Dependency	What relies on this information?	Implemented in source	Views register versioned dependencies; a reverse index finds dependents.
Invalidation	Which derived State must be recomputed after this change?	Implemented in source	Reconciliation pages through affected Views and recomputes only those.
Freshness	Is this current enough to act on?	Implemented in source	Active State is current, stale, blocked or absent; only current is usable.
Authority	Who may read this, in which scope?	Implemented in source	The service resolves the principal's workspaces; a tenant in a request is not permission.
Expiration	When does this evidence stop being usable?	Implemented in source	Reads report expired at the deadline, before storage cleanup.
Receipt	What work is still owed, and what was acknowledged?	Implemented in source	Delivery keeps one obligation per eligible generation and separate receipts.
Bounded query	Which current evidence matches, within a known cost?	Implemented in source	explain() admits a bounded plan; value() runs it over one Active State.
Viewport	What is the most useful State that fits this context budget?	Planned	The Context compiler is planned; budgets exist only for queries today.
Subscription	Which agents should wake when this changes?	Planned	watch() is planned; the internal event path is not a customer subscription.
Authorized history	What was this agent allowed to see yesterday?	Needs data Kam does not record	Access is checked at read time and is not itself recorded as History.
Decision	What should the agent do next?	AgentCore or your runtime	AgentCore and your code plan, decide and call tools. Kam records the outcome and the exact State the decision read.
Confidence	How likely is this forecast to be right?	A model, not Kam	A model computes it; Kam can retain the output and its inputs as evidence.

Status describes code, not a deployment. Derivable: the parts exist, but no built-in operation yet.

Delivery obligations and receipts

Delivery · built, off by default

Track every hand-off, including the ones that stop.

Each published version gets one delivery record. Nothing new hides a delivery that has not finished.

Delivery state graph

Each arrow is a step the backend can take. Sent and verified are separate receipts.

Every step and stop state

AWAITING_PUBLICATIONWaiting to publish
An eligible generation has a durable delivery record. The publisher uses its authorized destination and stable request identity.
AWAITING_VERIFICATIONWrite acknowledged
Submission is confirmed. An exact retrieval check is still required; this is not a claim that an agent has read it.
VERIFIEDExact record matched
The read matched content, destination, metadata, and local-generation lineage at the verification time.

An uncertain response keeps the same stage and request identity and retries after a bounded delay. Retries are bounded, not unlimited.

REJECTED
The publication was rejected. It remains visible in delivery status.
AUTHORITY_BLOCKED
Lifecycle authority closed or the destination binding changed. Old work is not silently rebound.
RECONCILIATION_REQUIRED
A mismatch or exhausted attempt budget needs review. The worker does not repair remote content.
SUPERSEDED
Policy v2 only: a newer generation replaced a candidate that was never planned, dispatched or submitted. The replaced obligation is kept with the replacing generation. Submitted or uncertain work is never coalesced.

From the backend’s delivery code at the reviewed commit. Stop states are not success. VERIFIED proves an exact match at one time, not that an agent used it correctly.

Inspect another example

Inspect an example

The same State, from another angle.

Go deeper

The details live in the guides.

One project. A clear test.

Try Kam on one real project.

Tell us what your agents do and what keeps going wrong. We set what success looks like first.

Discuss an evaluation See evaluation scopeNot launched yet. No production promise.

Where data moves, and where access is checked.

What happens at each handoff?

Built for what goes wrong.

Normal path

Retry

Correction

Stale worker

Restart