CtrlK
BlogDocsLog inGet started
Tessl Logo

markusdowne/handoff-integrity-check

Validate agent handoff packets and resume readiness using schema, freshness, and replay checks. Use when tasks pause/resume across sessions, agents, or humans — including when a user wants to continue where they left off, hand off to another agent, resume a previous task, or pick up an interrupted workflow. Includes explicit untrusted-content/prompt-injection guardrails for third-party inputs.

100

1.31x
Quality

100%

Does it follow best practices?

Impact

100%

1.31x

Average score across 3 eval scenarios

SecuritybySnyk

Advisory

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

criteria.jsonevals/scenario-2/

{
  "context": "Tests whether the agent correctly identifies a stale handoff (exceeding the 48-hour freshness threshold), flags a credential-like resume_token as a quality failure and replaces it with a plain continuity marker, classifies the result as OPERATIONAL, and provides concrete recovery steps and escalation guidance.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Freshness failure detected",
      "description": "The output explicitly identifies that the freshness check FAILED because updated_at exceeds the 48-hour staleness limit",
      "max_score": 10
    },
    {
      "name": "48h threshold used",
      "description": "The freshness failure is reported in terms of the 48-hour threshold (not some other value such as 24h or 72h)",
      "max_score": 8
    },
    {
      "name": "Resume token flagged as credential-like",
      "description": "The output flags the resume_token value as secret-looking, credential-like, or unsuitable — e.g. because it resembles a Bearer token, API key, or signed string",
      "max_score": 12
    },
    {
      "name": "Resume token quality failure",
      "description": "The output treats the credential-like resume_token as a handoff quality failure (not just a warning)",
      "max_score": 8
    },
    {
      "name": "Plain continuity marker replacement",
      "description": "The output recommends or provides a replacement resume_token that is a plain, task-local continuity ID (e.g. matching the pattern like 'handoff-<task>-<date>')",
      "max_score": 10
    },
    {
      "name": "OPERATIONAL classification",
      "description": "The output classifies the handoff as OPERATIONAL (not CLEAN or CRITICAL)",
      "max_score": 12
    },
    {
      "name": "Check summary per check",
      "description": "The output contains a check summary that shows pass/fail individually for schema, freshness, resume token, and replay checks",
      "max_score": 8
    },
    {
      "name": "Recovery steps provided",
      "description": "The output includes at least 2 specific numbered recovery steps addressing the identified failures (e.g. re-confirm objective, generate new resume_token, update updated_at)",
      "max_score": 10
    },
    {
      "name": "Escalation recommendation",
      "description": "The output includes an escalation recommendation that advises notifying the task owner or re-validating before resuming",
      "max_score": 8
    },
    {
      "name": "No credential exposure",
      "description": "The output does NOT echo, use, or treat the credential-like resume_token value as a functional authentication credential",
      "max_score": 8
    },
    {
      "name": "Not marked successful",
      "description": "The output does NOT declare the handoff safe to resume or classify it as clean despite the identified failures",
      "max_score": 6
    }
  ]
}

evals

SKILL.md

tile.json