Why continuing work across a model switch usually fails
The standard advice for switching models is "summarize your context and paste it into the new chat." That preserves words, not work. The new model receives the old model's testimony about what it did: a summary that can be confident, incomplete, and wrong in ways no summary can detect. Anything the old model misremembered becomes the new model's starting point, and the error compounds from there.
The rebuild tax is the other half. Because the new model cannot verify the summary, careful builders re-run the critical steps anyway, which means the switch costs as much as starting over. Continuing work should not require redoing it. The failure is not the models, it is the handoff format: testimony instead of evidence.
The handoff packet that actually works
A portable handoff has two parts. First, the working state: the goal, the current plan, decisions already made, approaches that failed, and the concrete next step. This is the part most handoff advice already covers, and it is the part that tells the new model what to do.
Second, the verifiable execution receipt chain: one receipt per completed tool call, each carrying canonical input and output bytes, a SHA-256 commitment, a timestamp, and a sequence position. This is the part that lets the new model check what is true. The new model reads the state for direction and verifies the receipts for truth. State without receipts is testimony. Receipts without state are facts with no plan. The pair is the whole handoff.
Why receipts make context portable
Receipts are verified mechanically, which is what makes them model-agnostic. The new model recomputes each commitment from the canonical bytes; a match means the recorded input and output are exactly what ran. A missing call shows up as a visible gap in the sequence, so nothing can vanish silently between models.
This works across vendors, not just across models from one provider, because verification depends on no model's judgment. The same receipt chain can be checked by any implementation of the open format. When the context that crosses the boundary is checkable, the new model does not need to trust the old one at all.
Proven across independent implementations, not just models
The mechanism is not theoretical. An independent AER-1 interop run checked a receipt chain end to end on an independent implementation against real external values, and the full chain was double-verified. If receipts survive a jump between fully independent implementations with no shared platform and no mutual trust, a jump between two models is the easy case. Independent implementations are tracked in the public AER-1 registry.
The honest boundary
A receipt-based handoff guarantees the new model starts from verified facts about what ran. It does not guarantee the old model's plan was good, its tool choices were right, or its outputs were correct. Receipts prove execution, not judgment. A model can faithfully execute a bad plan and mint perfect receipts for it.
Verify execution with the receipt, and keep checking correctness the way you always have. The handoff guarantees continuity of evidence. The quality of the plan is still yours to judge.
Check one yourself
The live demo runs one real tool call and mints a real verifiable receipt, free, no signup. That receipt is the same object a handoff packet is built from. Inspect it, recompute the commitment, and you will have run the verification step any new model performs before continuing.