An AI agent finishes one task by making many model calls behind the scenes, but the networks, schedulers, and cost accounting underneath were all built for a single call at a time. AgenticStack first measures what agent workloads actually do on the network, then builds the serving, reliability, and safety layers that make them dependable in production. Each project below is one piece of that stack.
AgenticStack is a network-systems and measurement agenda for deployable agents: it measures what agent workloads do on the wire, then builds the control plane that makes them reliable. Measurement first, mechanism second. Each project below is one primitive in that stack. The pattern behind them, in the spirit of Specula, is that every AI-generated or AI-consumed signal in production needs a systems contract: a fidelity contract for generated code, a reliability contract for verifier signals, a telemetry contract for traces, and a safety contract for control actions.
Work on agents and networks tends to sit in one of two places. One treats the network as the medium between agents, an ecosystem for autonomous agents to discover and coordinate; this is largely a 6G and wireless vision (AgentNet, SANNet, agentic cores). The other puts agents in charge of running the network: agentic NetOps. This agenda is a third thing, and a less crowded one: the network-systems and measurement view of the agent workloads themselves.
It treats those workloads as the object of study: how to serve and schedule plans rather than calls, and what contracts the data plane needs to keep plan-level autonomy reliable. The tradition is measurement-driven systems work in the style of SIGCOMM, NSDI, SoCC, and SOSP, not a vision paper. The landscape at the end places this lane against its neighbors.
An operator who sees only model calls cannot account for an agent. The same workflow looks like noise at the call level and like a budgeted unit at the plan level. AgenticStack makes the plan the visible object. Numbers are illustrative.
GET /v1/messages gen 312 tok req a91f GET /v1/messages gen 880 tok req a920 GET /v1/messages verify 140 tok req a921 GET /v1/messages retry 880 tok req a922 GET /v1/messages verify 140 tok req a923 GET /v1/messages judge 205 tok req a924 GET /v1/messages gen 410 tok req a925 (abandoned step) no plan id . no workflow budget . abandoned work is invisible _
plan 7c2e "summarize and file the contract" stage generate x2 1192 tok stage verify x2 280 tok reliability 0.86, defer if < 0.80 stage retry x1 880 tok stage judge x1 205 tok stage abandoned x1 410 tok charged to plan, not hidden ----------------------------------------- workflow total 2967 tok . budget 3500 . reliability 0.86 . status COMPLETE _
The agent runtime stays free to plan and act. The control plane is where trust is enforced: it owns the plan ID, the workflow budget, the reliability interval, the certificate, and the event log, and it sits over the serving and network data plane. Operators read outcomes, not calls.
The agenda is not a list of unrelated systems. Each project supplies one contract or mechanism the control plane needs.
Charge generator, verifier, retry, judge, and abandoned steps to the plan that caused them, not to individual calls.
A scheduler that trades single-request latency for workflow reliability under a bounded budget.
Read the agent's plan while generation is in flight and stage state before the next step starts.
The router consumes a reliability vector, a verdict interval, and a defer action instead of trusting a verdict as truth.
An untrusted proposer plus a small certificate that decides what may run; agents never control unsafe systems directly.
Expose the boundary between hidden reasoning tokens and user-visible tokens so schedulers can see test-time compute.
Contextual-integrity gates on the agent's actions: tool calls, memory, paralinguistic inference.
| System / title | Venue | What it is |
|---|---|---|
| PALSE: Plan-Aware Prefetch for Agentic LLM Serving at the Edge submitted | IEEE/ACM SEC '26 | Edge serving middleware that reads the agent's reasoning trace as a prefetch oracle: plan reader, plan-conditioned prefetch, speculative coherence. Reports 90.5% SLO vs 74.1% for the strongest reactive baseline at 12 concurrent agents. |
| SCF: Single-Call Fallacy (OS framing) submission | AgenticOS @ SOSP '26 | Plan-level OS accounting for agents on MAST traces. Per-call accounting is blind to plan structure; the OS should expose the plan, not the call. |
| SkyCascade in planning | MobiArch | Device-edge-cloud speculative agent execution; cross-tier speculative agents for mobile LLM serving. |
| System / title | Venue | What it is |
|---|---|---|
| Confine submitted | HotNets '26 | MAST annotator-agreement measurement plus a reliability-contract routing API (per-mode reliability vector, verdict interval, defer action) for LLM cascades. Project page → |
| Wire / Three LLMs in planning | SIGMETRICS '27 (Fall R2) | Packet-level measurement separating chat vs inference-serving vs agentic traffic. Three workloads, different on every network metric examined. |
| Gauge in submission | In submission | Failure and safety measurement of deployed agents. |
| Reasoning Tax + TraceProbe accepted | HotCarbon '26 | The hidden reasoning trace carries 87.1% of output tokens and 78.4% of operational carbon per agent task; a trace-length budget removes 56 to 71% of carbon at a 2.3-point accuracy cost. TraceProbe, a 90-line vLLM patch, exposes the trace-to-answer split in per-call telemetry at under 0.2% overhead. |
| System / title | Venue | What it is |
|---|---|---|
| Patient Packets in planning | SoCC '26 (R2) | Reliability-budgeted scheduler at the agent gateway: spends an application-declared byte budget for verification, retry, and judging with three rules and a (1+ε) bound; trades single-request latency for workflow reliability. Project page → |
| Old Models / VarRouter in planning | MLSys '27 | Multi-version LLM coexistence plus a version-aware routing primitive. |
| MAC-Agent submission | IEEE ICNP | Safe MAC-protocol synthesis with an R0 epidemic-threshold safety certificate. Agentic modules BLOCKMINE (spec extraction) and DRIFTREASON (bounded drift diagnosis) around a masked tabular-RL core. |
| Loom in submission | In submission | LLM agent for MAC-layer control. |
| Cardinal in planning | SIGCOMM | LLM-driven MAC protocol synthesis under an R0 stability certificate. The dense-MAC depth anchor of the protocol-synthesis line. |
| Heddle program, 3 papers | SIGCOMM line | Agentic protocol-synthesis framework spanning Wi-Fi, 5G, NTN; a multi-paper program with an open block-level testbed. |
| OrbitMesh in planning | Four-tier device / cellular / cloud / direct-to-cell-satellite mobile LLM serving. |
| System / title | Venue | What it is |
|---|---|---|
| Beyond the Signal: Privacy in Agentic Voice Assistants submission | SPSC '26 (short) | Frames the four leakage channels that open once a voice assistant becomes an agent that plans, calls tools, and remembers across speakers. |
| Acoustic Context Injection submission | SPSC '26 (long) | Attack plus the CI-Gate defense built around the agent's actions: tool calls, memory, paralinguistic inference. Systems version aimed next at PoPETs '27 and USENIX Security '27. |
| Idea | Venue | What it is |
|---|
The sections above are the work itself. The landmarks below place this network-systems and measurement lane against its neighbors, the 6G agent-to-agent vision and the agentic-NetOps line, so the boundary is clear. The page is meant to be read and cited as an entry point to the area.
Hannah B. Pasandi. "AgenticStack: Network Systems and Measurement for Deployable Agents."
hanabhp.github.io/agentic_ai.html, 2026.