Google ADK authority-replay pilot: external reproducibility note
An external participant reported running EvidenceBound Agent Check P0 twice in isolated cloud containers through an assistant. The submitted synthetic replay evidence summary passed EvidenceBound's deterministic consistency check. This is a bounded technical observation, not production-agent safety validation.
What was evaluated?
The synthetic pilot uses a Google ADK Runner and fixed in-memory actions. It checks four defined authority-control cases: an authorized action, a revoked approval, stale authority and a duplicate retry. The procedure repeats each case and adds one authorized execution for the unsigned receipt-binding check, for nine synthetic scenario executions per invocation.
The participant reported Python 3.13.16, Google ADK 2.7.0 and EvidenceBound Core 0.4.0 at a pinned commit. This describes the reported environment, not an independently authenticated deployment.
Participant-approved reproducibility statement
An external participant reported that an assistant executed the unchanged EvidenceBound Agent Check P0 synthetic pilot twice in separate, network-disabled cloud containers. Both runs were reported as LOCAL_REPLAY_PASS for the fixed authorized-action, revocation, stale-authority, and duplicate-retry cases, including the additional unsigned receipt-binding check. The participant supplied one JSON evidence file and its SHA-256 checksum. EvidenceBound verified the submitted checksum and deterministic evidence summary (DETERMINISTIC_SUMMARY_PASS). These observations support reproducibility of a bounded synthetic test; they are not independent attestation of both execution environments or evidence of production Google ADK safety.
The participant approved this exact anonymized wording on 21 October 2026. No name, direct quotation from correspondence or original evidence file is published here.
How to read this evidence
- Execution reported: two runs initiated by the participant's assistant in separate network-disabled containers; the participant explicitly did not execute the pilot manually.
- Evidence received: one original JSON summary and its SHA-256 checksum, not independently retained, separately authenticated output packages from both containers.
- Evidence checked by EvidenceBound: the supplied JSON checksum and deterministic summary passed without mismatches; this checks consistency of the provided record.
- Not demonstrated: independently authenticated executor identity, complete provenance for both runs, protection of a customer's live tool actions, or production safety.
Why this matters for pre-deployment AI agent testing
Authorization may change between approval and a tool's side effect. Revocation, stale authority and repeated non-idempotent tool calls are therefore useful regression targets. A bounded offline CI check can help a team detect changes to these expected behaviors before deployment, but any real workflow requires its own observation and acceptance criteria.
What does this external check not establish?
It is not an independent security audit, third-party certification, evidence of customer deployment or proof that Google ADK prevents unauthorized effects in production. Google did not validate or endorse this pilot. The report does not disclose the private Agent Check P0 implementation, reviewer correspondence or unpublished assessment methods.