Same identity. Different state.

What defines
the agent state?

The manifest includes the agent identity, implementation and runtime versions, optional model version, instruction and policy digests, exact capability and tool sets, authoritative environment, security configuration, runtime constraints and protocol configuration.

A versioned canonical encoding produces the fingerprint. Current trusted attestation binds that fingerprint to its issuer, authority domain, agent identity, positive state revision, validity interval and status reference.

What stays outside DNA?

Conversation history, request IDs, scheduling state, token usage, attestation timestamps and signatures. Transient activity is not a new security identity.

Who establishes trust?

A trusted issuer isolated from the agent runtime. A trusted admission process or runtime observer must independently establish that the applied runtime corresponds to the attested manifest. A fingerprint alone does not prove that correspondence.