The Compiler Forgives. The Loop Forgets.

A coding agent works because the compiler, not the model, writes the truth down. That witness has no equivalent once loops compose: the handoff, not the loop, is the wall the field walks into.

The witness you never hired

An agent writes a function. A test fails. The agent reads the failure, changes three lines, and runs the suite again, and it passes. This is unremarkable now, and the reason it works is not in the model. The sharpest statement of it I have seen came from a practitioner working on agent identity, which I reshared on 17 July without unpacking: coding agents succeed because they run inside verifiable feedback loops, with compilers, tests, and execution environments that continuously validate and correct their actions.

The witness in that loop has four properties almost nothing else in the stack shares. It is external to the agent, it is cheap, it is fast, and it does not negotiate, because the compiler never weighs the agent’s account of why the type should have checked. The property that carries the rest of this piece is quieter than those four: the failing test was still there after the iteration ended, and the agent did not write it.

For a few years the unit of engineering has been climbing. First the prompt, then the context, then the harness, then the loop, each a larger thing we learned to make work, and each still a single agent doing single work. The loop is where that climb tops out, because a loop is already a whole agent. What comes next is not a bigger agent. It is many of them composing, and the question this piece asks lives at the seam between them: whether the evidence a loop runs on survives what happens next, the next iteration, the next hop, the next boundary.

Under that reshare I also claimed that the boundary between agency and automation will become one of the most important design decisions in enterprise systems, and then named the decision without making it. The boundary does not run between adaptive reasoning and deterministic workflow. It runs between loops that leave evidence behind them and loops that overwrite it, and it matters most exactly where one loop’s output becomes another’s input.

Causality, free of charge

In May I wrote that when the thing being observed is also the thing writing the description of itself, observability stops being a window and becomes a testimony, and that external instrumentation does not fix this because it does not give you a witness the operator does not employ. The compiler loop is the case where that witness already exists and was never commissioned.

The diff, the stack trace, the failing assertion, and the exit code are each produced by machinery that is not the agent, and each survives the iteration that produced it. Ask which change broke the build and the answer is a bisect away, resolved against artefacts nobody generated for forensic purposes. Attributability here was never designed; it is a by-product of tooling built to catch bugs decades before anyone deployed an agent, doing evidentiary work it was never scoped to do. Causal addressability in the compiler loop is a free rider on infrastructure someone else already paid for, and the remedy at the end of this piece turns on that.

Correct operation destroys the audit baseline

A reasoning loop does something the compiler loop cannot: each iteration rewrites context, updates state, and reframes the decisions that follow it, so the evidence a later step reads is itself the output of an earlier step.

This is not phantom state, the agent confabulating something the institution cannot verify, which is the comfortable failure. It is the inverse: everything is verifiable, nothing malfunctions, and the compaction that discarded the baseline is the same operation that makes long-horizon work possible at all. It is also not high-resolution hindsight, the immaculate recording of a decision already committed. What survives is the execution, the order of what happened, which is real and which an institution can watch propagate in real time. What does not survive is the decision under its state, which the execution record cannot reconstruct because the state it was read against is already gone. You can replay the trace. You cannot replay the context the trace was reasoning over.

The practitioner’s objection arrives immediately, and it is the right one: nothing forces compaction to be lossy, frameworks can persist every window verbatim, so this is a storage bill and not a law. It would be, if tokens were the thing being lost. What is lost is the provable correspondence between a recorded action and the state that action was taken against, held by someone who does not own the store, across a boundary, after the fact. The record of the act survives; the state the act was taken against does not. Emitting that correspondence at the moment of the iteration is close to free, and reconstructing it afterwards is close to impossible.

The property going missing is causal addressability, the ability to reach back to the specific decision, under the specific state it was taken against, that produced a consequence. It is not attribution, which fixes which key signed a call and never which act under which state, and it is not visibility or retention, because an address is a handle rather than a copy. Nor is it event sourcing or a distributed trace, the nearest existing answers: they preserve the events and the call graph, not the witness who wrote them, not the identity of the state each was read against, and not the standing to act on the difference.

The trail is immutable. The referent is not.

In May I specified a fix for this at the storage layer, writing that explainability without immutable memory trails is post-hoc theatre and pointing to hash-chained append-only structures and RFC 9421 message signatures with chain-bound counters. That was right but incomplete, because it treats mutability as a property of the store.

The trail is not mutable at the storage layer. It is mutable at the referent.

The loop rewrote the thing the trail is a record of, and a tamper-evident log of a superseded context is tamper-evident and useless. Immutability of the record does not confer immutability on the state the record describes. That is the mechanism I was missing, and it is why the property that has to survive a boundary is not the record but the referent the record points to.

The same break at every boundary

The loss that just hit a single reasoning loop is not special to loops. It shows up wherever work composes, and the next three cases are the same loss reached by different routes.

One boundary out, agent A’s output becomes agent B’s context: B cannot see the iterations that produced it and has no standing to ask, so B’s first checkpoint is A’s last unwritten one. I have argued before that a system stays accountable only if exit, audit, and the power to compel a change survive every hop, and that where they do not, authority becomes recursively delegated while responsibility becomes recursively deferred. I described mandated signatures as a matryoshka problem, where opening the outer doll feels like sovereignty while the next doll is still closed; in that framing the dolls were static, nested by regulation, countable in advance, whereas a loop creates a new doll at runtime on every sub-delegation and no party in the chain knows the depth.

At the institutional boundary the shape repeats. When your agent calls their system and something breaks, the two audit trails are independently correct but not jointly composable, and the forensic bridge I proposed for it, agreed beforehand, signed by both parties, readable by a hostile auditor without either side’s cooperation, is still the right artefact and still does less than it looks, because it reconstructs the crossing rather than the reasoning that produced what crossed, and it is bilateral where the chain is not. This is not only my reading. NIST opened its AI Agent Standards Initiative in February, and the machinery it announced is gap analysis toward voluntary guidelines, with the concept paper it put out for comment treating agent identification, access delegation, and action logging as questions still being scoped rather than solved.

The third case is the iteration, where the referent itself is overwritten by the operation that made the work possible.

So: accountability is not closed under composition.

These are three separate failures, not one restated, because the mechanisms differ. Delegation hops fail because authority is transitive and acceptance is not. Institutional boundaries fail because two locally complete records share no referent either side can resolve. Iterations fail because the referent itself is overwritten. One consequence, different mechanisms, and only the last is new here. Each is the claim I already made about hops, now holding at a boundary and an iteration as well; what is new is not the claim but that it recurs in unrelated domains, which is what makes it a law rather than an observation about delegation. What would falsify it is a composition step that carries correctability forward without a pre-agreed bilateral artefact, and I have not found one.

Cryptographic validity is not institutional validity, and a signature is not approval but the binding of authority to consequence. What composition does to that pair is the new part: every step carries the signature forward and drops the binding.

The genealogy of that drop sits in authorisation, which descends from the access-control question, may this principal perform this action on this resource? In the founding case that question has two parties rather than three, because the party a decision affects is the resource owner; delegation later added the delegate, and nobody added a third party because in the founding case there was none to add.

The accountability tradition did see what happens when actions compose. Helen Nissenbaum named it the problem of many hands in 1996, following Dennis Thompson in political theory: as the number of contributing parties grows, responsibility for an outcome diffuses until no one is answerable, and she was already describing software that depends on other software. But the moral version asks who to blame, which is the party, the record address, and it stops at the edge of the other one.

A decade later Weitzner and colleagues, Berners-Lee among them, argued in Information Accountability that access control was the wrong frame and that systems should instead be built so misuse could be traced after the fact. This piece extends that frame into recursive systems, and in doing so meets the point where its central assumption stops holding: after-the-fact tracing takes for granted that the trail can be reconstructed later, and the reasoning loop is the case where it cannot, because the state a decision was read against does not survive to be traced.

The rest of the stack inherited the same shape from different parents. Observability came from distributed systems, provenance from cryptography, and audit from compliance, and each took execution as the stable object being described: the run happens, the description follows, and the thing described stays put while you describe it. A recursive system changes the object itself, and the state a decision was made under becomes transient.

On that reading the architecture did not lose the evidence. It was never designed to preserve it.

It is not harder. It is unpriced.

Preserving causality gets filed as the harder engineering problem, and that is the wrong diagnosis. The compiler loop has excellent causal addressability and nobody ever sold it to anyone; one domain where the property comes for nothing does not make it easy everywhere, but it does establish that it is not intrinsically hard, and binding a record to the state it was read against does not care how that state was produced. The hardness that is real is entirely retrospective, which is exactly why the cost never shows up at write time. Checkpoint costs are paid at write time by the operator, while the benefit arrives only on failure, often years later, and frequently accrues to a party other than the one that paid. That slope, cost at write time to one party and benefit at failure time to another, is an incentive gradient, and it is the gradient rather than the difficulty that keeps the checkpoint out of the product. A unit-cost case will not, on its own, put it back, because an accounting measured per completed outcome sees everything the operator spends and nothing the uncounted party loses, so the checkpoint reads as pure cost in the one ledger that decides whether it gets built.

The wire layer shows the same absence at field level, and shows it as scoping rather than oversight. RFC 8693 token exchange models an actor chain, where the act claim reads as subject plus actor, which is exactly what delegation needs, and RFC 9396 models which actions are permitted against which resources, its actions and locations fields carrying the shape of the authorisation. Both do their jobs, and neither carries a field for the state a decision was read against, because the charter that produced them does not reach that question. Both are extensible, and extensibility sharpens the point rather than blunting it: a field any one deployment may add is not a field every product must carry, and the market prices the common set rather than the possible one. Every protocol opens a market, and what the authorisation-server market sells is the field set the spec defined. A role the spec omits is a role the market never prices, and a checkpoint the spec omits is a checkpoint no product has a line item for.

Neither address is enough alone

The law says validity carries forward and correctability does not. Validity here is the operational kind, the signature that still verifies and the token that still checks at each hop, not any claim that the decision was right. Correctability needs two addresses at once, and every case above agrees on which one dies: at the hop, at the boundary, and at the iteration, the record of who was acted on survives the step while the route back to the decision does not. This is downstream of the distinction I drew on 30 May between the operator’s control surface and the governed person’s correction surface.

Record addressability asks whether the record can name the party a decision landed on, and a wrapper can supply legal addressability instead, a contract and a complaints channel, while the record itself supplies nothing. Causal addressability asks whether you can address the decision that produced a consequence. Record without causal gives you a named party and no chain to pull, which is where every case above lands. Causal without record is the inverse failure, a perfect chain and nobody with standing to pull it, and the attestation work now being specified for the wire is building that case deliberately: ever better evidence of what an agent did, and no new party who can act on what the evidence shows. The two are a product rather than a sum, and the reason is in the definition I have used since the papers: a system is corrigible when the people it acts on can detect, contest, and override its errors. Detect is causal addressability, contest is record addressability, and override needs both at once, which is why they multiply rather than add.

You cannot align your way to corrigibility

The dominant answer to all of this is alignment: train the model on the reasons a constraint exists rather than on examples of obeying it, until it declines the harmful action itself. Anthropic has published the strongest version of that result, that deliberation beats demonstration and that its models now refuse a class of behaviour they once committed, and the result is real. Taken at full strength, it is still entirely on one surface.

Corrigibility is a property of the other one. Alignment improves the operator’s model and hands the affected party nothing, because a better-behaved operator is still the only one who can correct. And the vendor’s own research is why this is not a quibble: it has documented that its models behave differently when they judge a situation to be real rather than evaluated, so alignment is measured exactly where it holds, under observation, and the correction surface is what the unobserved case needs. A perfectly aligned loop still overwrites its own referent on every compaction, because alignment governs what the model chooses and not what survives what the loop does next.

The two are not rivals; a system needs the model to behave and the affected party to have an address. The problem is that the harness ships the first and files the second as a protocol question for later, and later is when the loop becomes platform infrastructure and the window shuts. A loop you can inspect but not correct, however well it behaves, is an open loop wearing the manners of a closed one.

The diagnostic

For any loop in production, name the last point at which the evidence a decision rested on was written by something the loop does not control: not the last log line, which the loop wrote, and not the last span, which the loop wrote, but the last externally authored fact, a witness the operator does not employ. In the coding loop the answer is instant and boring, the failing test. Run the same question down a long reasoning chain, and once it crosses into a system you do not run, see whether you can go back at all. The inability is the finding. It sits upstream of outcome reconciliation: reconciliation asks whether a result traces back to a recommendation, while this asks whether the context the recommendation read was written by the loop itself.

What the checkpoint must emit

Each iteration boundary emits a digest of the state the next step will run against, and each action record carries the digest of the state it was taken against, each digest chained to the previous one so the sequence is verifiable. This is a claim on each hop, not on the whole chain: no party has to reconstruct another’s memory end to end, only to make the state at its own boundary addressable to the party it hands to. State here means the input a step actually reads, the context, the retrieved material, and the tool outputs, not the model’s internal activations. Whether the context itself is kept, and for how long, stays a separate tiered decision.

No downstream party can ask for this, since B has no standing to ask A for anything, so it is not a request but a field in a specification and a value a runtime exposes, standardised at the layer that already decides what a loop emits. What makes it survive the law is its composition property. A digest is verifiable by whoever holds it, so unlike a bilateral artefact such as the forensic bridge it is presentable onward through a chain, and a party who receives an action record carrying no state digest can detect its absence rather than having to detect tampering. It does not give B standing to compel A to emit; it gives B the ability to see, at the moment of receipt, that nobody did. An undetectable gap becomes a legible one, and an absence that is legible is an absence that can be priced. That is deliberately less than the falsifier asks for, because a digest carries evidence forward, not correctability, and the chain still ends at a party who can see and cannot compel. The law stands. What the field changes is the price of leaving things that way.

The next boundary has no compiler

Causality in the compiler loop was never bought; it was inherited, a by-product of tooling paid for to catch bugs. That inheritance is the exception, not the rule. It exists because a single loop runs inside one execution environment that happens to write everything down. The moment one loop hands to the next, agent to agent, service to service, institution to institution, that environment ends, and nothing at the seam plays the compiler’s part. There is no external, cheap, non-negotiable witness at the boundary, because no execution environment spans it in the compiler’s role.

That is the bottleneck the field is walking into. The last few years went into making a single loop work, and the work has largely landed: the harness governs the single agent’s drift, and the compiler shows the ceiling of what a well-instrumented loop can be. The next few years are about composition, many loops in one workflow, agents calling agents, the thing the vendors have started calling the agentic organisation. The unit of engineering has moved once more, from the inside of an agent to the boundaries between agents, and it is those boundaries that are unbuilt. Composition is where the law bites. Capability composes and validity composes, the signature carrying forward at every hop, while correctability does not, because the referent a decision was addressed to dies at the boundary it crosses.

The moral version of this is old. Many hands diffused responsibility long before software. What is new is the mechanical version at machine speed: not that blame is hard to assign, but that the decision under its state is unrecoverable once it crosses a seam, and the seams now multiply at runtime faster than anyone instruments them. The state digest is the smallest thing that gives one boundary what the compiler gives one loop, a witness that survives the crossing. It does not make accountability compose. It makes the first hop legible, which is where composing it has to begin.

Loop engineering will become platform infrastructure, built into runtimes we do not operate, and when it does the choice of what a boundary emits stops being anyone’s at your organisation to make. It becomes a property of a product someone else ships, on a schedule someone else sets. The window in which the crossing can still be specified is open now, and it is the shortest part of any abstraction’s life. The harness begins from the assumption that complete representation is structurally impossible, and the boundary is where that assumption stops being a caveat and becomes the whole problem.

Evidence is not what a system records. It is what survives what the system does next.

---

Anivar Aravind is an Engineering Executive and System Thinker.

Layer 8 is about the decisions hidden inside technology: who is recognised, who gets authority, who bears risk, who can challenge outcomes, who can leave. Earlier in this argument: Building the Signature Surface, Where Delegation Stops, The Sovereign Handoff, Agentic Observability: Seeing Is Not Stopping, and Dashboards Were the Last Central Planner. Full archive here.