AgentCore runtime snapshots need a startup-state acceptance test

Declare what startup state may survive

Inventory every action between process launch and the health signal that permits capture. Classify code and model artifacts, static configuration, feature flags, trust stores, certificates, DNS answers, service discovery, credentials, tokens, customer or tenant context, caches, temporary files, random seeds, clocks, connection pools, telemetry state, and dependency probes as snapshot-safe, restore-sensitive, or prohibited. For each item, name its source, owner, expected lifetime, retrieval point, permitted tenants, and invalidation event. A green health endpoint proves only the condition it actually checks. It does not prove that configuration is current, a secret was retrieved safely, the right tenant is absent, or a restored instance can reach every dependency. Keep the contract in version control beside the container and runtime configuration.

Exercise capture, restore, and invalidation separately

Build a synthetic acceptance matrix with a clean create, an update, multiple concurrent restores, and forced changes between capture and restore. Rotate a credential; revoke a certificate; change a feature flag and static endpoint; replace a model artifact; expire a DNS or discovery record; make a dependency unhealthy; and introduce a tenant-specific value that must never enter shared startup state. Record the image digest, runtime and snapshot identifiers, initialization and health events, configuration versions, secret versions without values, restore timestamp, first-request trace, dependency results, and disposition. Require a documented event that creates a new snapshot when inherited state is no longer valid. If the platform does not expose enough state to reconcile the capture, use application-level version assertions and fail the restored instance before it accepts work.

Test the first real request, not only the health check

Run the same representative request against a newly initialized instance and several restored instances at low and high concurrency. Include an ordinary case, a missing dependency, a revoked identity, a changed configuration, an oversized artifact, an idle period, and a request that allocates then releases memory. Compare output, authorization, traces, memory profile, error path, retry behavior, and time to the first correct response—not merely container readiness. Separate AWS's general claim of consistent cold starts from the buyer's workload result, and separate memory-use billing from total service cost. Capture baseline and enhanced-runtime measures using the same Regions, network path, image, traffic mix, observation window, and exclusions. Stop rollout when a restored instance behaves differently in a decision-relevant way that the evidence cannot explain.

Make snapshot state an architecture release gate

Before production use, require the application owner, platform owner, security and identity owners, and service operator to sign a startup-state record: approved snapshot contents; prohibited state; health definition; artifact and configuration versions; secret and identity retrieval pattern; invalidation and rollback triggers; observability coverage; recovery path; capacity and cost assumptions; and the evidence from the acceptance matrix. Re-run it after changes to the container, initialization code, artifacts, configuration source, identity method, dependency contract, runtime, Region, lifecycle hooks, or platform behavior. AWS's preview of future suspend-and-resume hooks and scoped session identity should remain outside the current control claim until those capabilities are available, configured, and tested. The decision is whether the current restored startup state is controlled; it is not a blanket approval of AgentCore tools, agent actions, or unattended authority.

Turn this source into a reviewable decision

For AI for CIOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve The new AgentCore Runtime: Elastic, optimized, and consistently fast starts, the exact URL, the September 20, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Enterprise AI platform architecture; Operations and incident intelligence; Identity and agent access; Software delivery and modernization. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

AWS is the provider and architecture source. Its September 18, 2026 announcement supports the described enhanced runtime, post-cutoff publication time, health-then-snapshot sequence, inclusion of completed initialization work such as model-artifact loading and static-configuration retrieval, restore-based instance startup, stripping of excess caches and transient memory, memory paging and reclamation, usage-oriented billing description, and previewed lifecycle and identity direction. It does not independently establish a buyer's captured state, health completeness, configuration or secret freshness, tenant isolation, artifact integrity, invalidation timing, restore determinism, dependency behavior, first-request correctness, latency, concurrency, memory reduction, bill, lifecycle controls, scoped identity, security, resilience, compliance, or production fitness. Current AgentCore and application documentation, container and configuration records, image and artifact digests, secret and identity design, runtime and snapshot identifiers where available, traces and metrics, controlled change and fault tests, representative cost observations, rollback evidence, and qualified architecture, application, platform, operations, identity, security, privacy, records, procurement, accessibility, regulatory, and legal review control.