Coverage reviewed October 25, 2026. Source-event dates below are distinct from this article's publication date. Engineering examples and acceptance checks are proposals, not executed experiments.
The October 24 source changes
Google ADK Python recorded two source changes on October 24. AgentTool now passes caller temp: keys into a wrapped invocation, excludes internal temp:_adk keys and keeps child temporary writes from propagating back. Top-level dictionaries, lists and sets are copied. A separate change converts failed A2A tasks into error-bearing events, including failure without an accompanying message. The failed-task conversion commit documents the second boundary. These are repository changes; this review has not verified a published package containing them. Primary source.
The common issue is information loss at an agent boundary. Delegation often looks like an ordinary function call in application code, but the wrapper may construct another session, trim state and convert a remote protocol into local events. Each transformation needs an explicit contract. A system can retain the user's visible request while silently dropping a temporary constraint, or preserve the remote agent's prose while losing the fact that its task failed.
Context is part of the delegation contract
Consider a synthetic incident workflow at the first boundary. The parent investigator holds a temporary request budget and asks a diagnostic sub-agent to inspect a service. A useful regression test checks that the child can read the budget, that internal framework bookkeeping is absent and that child-local temporary changes do not become parent state. Do not turn this into a recommendation to put secrets or authorization into temporary state. Availability of context and authority to act are separate contracts.
Test the state boundary deliberately
The source uses shallow copies. That is not evidence of deep isolation for nested mutable objects or arbitrary custom values. A proposed additional test should mutate an inner list inside a copied dictionary and document the observed behavior for the pinned revision. No such test was executed in this research task; do not claim a vulnerability from the abstract possibility alone.
For the second boundary, distinguish a failed remote business task from a successful transport exchange. An HTTP request can complete while the remote task reports failure. An orchestrator that only checks whether it received text may record the failed delegation as a successful step. A useful acceptance fixture covers failures with explanatory text, failures with no message and streaming failure updates. Assert both the resulting error fields and the coordinator's chosen recovery branch.
Transport success can hide task failure
The rollout lesson is to pin the exact framework version under test, inspect adapter behavior and keep task-state metrics separate from model-response metrics. A source commit is evidence of changed implementation, not proof that every deployed environment already contains it. If a published package is later confirmed to contain these commits, update the availability sentence with the actual release, rather than assuming the newest-looking version includes every recent fix.
Consider an original acceptance matrix for a diagnostic coordinator. One axis is whether the child receives a request budget; another is whether the remote task finishes, fails or stops without a useful explanation. Add a third axis for retry eligibility. The expected outcome belongs in the fixture before the model runs. A task that failed because access was denied should not automatically receive another attempt with wider access.
Build a recovery decision table
Use separate records for invocation identity, remote task identity and the coordinator decision. This makes it possible to inspect a conversion bug without guessing from the final answer. Keep payload logging selective: the useful evidence is often a field's presence, revision and classification rather than its full contents. A test harness can compare sanitized records while retaining confidential application data in its normal protected store.
Roll out a pinned adapter contract
A hypothetical release gate might require every explicit remote failure fixture to enter the failure branch, no child-local temporary value to be committed as parent state, and no internal bookkeeping key to be exposed through the application fixture. Those are proposed checks, not reported test results. Add nested-container cases separately and record behavior rather than assuming a shallow copy means complete isolation.
The operational rollback unit should include adapter code and its tests. Rolling back only a prompt cannot restore a lost error flag or fix state passed at the wrong scope. Before enabling a new framework version, compare the structured events emitted by the old and new adapter against the same synthetic remote responses. Promote only after application recovery decisions still match the contract.
Sources and evidence
October 24 source changes preserve temporary caller context and explicit remote failure; package availability remains unverified.