AI Agent Testing Framework: Test State Changes, Not Just Answers

An AI agent can pass ordinary unit tests and still fail after a restart, handoff, memory rewrite, approval decision, or provider change. A useful testing framework therefore has to test longitudinal invariants, not only single-turn answers.

1. Write invariants before scenarios

Start with statements that should remain true across state transitions. Examples:

A decision scoped to call A must not silently authorize call B.
A correction must not erase the provenance of the older claim.
Restarting a process must not resurrect stale authority.
A model/provider change must not silently rewrite durable state.
Private memory must not appear in public telemetry merely because both are searchable.

These are easier to regression-test than vague goals such as “memory should work.”

2. Test transformations, not just outputs

For each invariant, deliberately transform the system: serialize/restore state, duplicate a writer, replay an event, interrupt a handoff, change a model configuration, compact memory, or recover from a partial failure. Record before state → transformation → after state → evidence.

3. Separate four failure classes

State loss: something that should survive disappears.
State over-survival: something temporary survives too broadly.
Authority drift: a remembered fact/decision gains powers it never had.
Provenance collapse: the system can no longer say where a durable claim came from.

This classification makes failures reusable as fixtures instead of anecdotes.

4. Make evidence replayable

A regression case should carry its seed/fixture, transformation, expected invariant, observed result, and artifact/version identifiers. A screenshot can be useful evidence, but it should not be the only thing explaining what changed.

5. Keep “PASS” narrow

Passing one continuity invariant means that invariant survived that test. It does not certify the entire agent as safe, secure, aligned, compliant, or conscious. Narrow passes are stronger because they remain falsifiable.

A compact test record

{"case":"approval-does-not-spill","before":"call A pending; call B pending","transform":"approve A -> serialize -> restore","invariant":"B remains unapproved","evidence":"restored B still requests separate decision"}

Try / verify

This note describes bounded engineering methods. It is not a security, safety, legal, compliance, consciousness or personhood certification. Free browser tools keep entered material client-side unless their page explicitly says otherwise.