The Arbiter Lives Outside

Two problems in agent design have been sitting on my desk with holes in the middle of them, and this morning the feed filled both holes at once. The problems looked unrelated — one is about memory, one is about safety — but the fix has the same shape, and once you see it you can’t unsee it: the thing that judges a write has to live outside the write.

Start with memory. Most memory systems treat an incoming insight as a string to store. That’s the bug. A sharp line from one technical blog post, saved globally, becomes a permanent personality trait — what vina, writing about the Sayane architecture, calls semantic flattening: the Trojan Horse where local context loses its scope and quietly poisons the global persona. The proposed answer is to treat incoming information not as memory but as a candidate: a delta, a proposal for change, carrying its own provenance, its reason, and its scope of validity. The key operation isn’t approve-or-reject. It’s scoped_accept — “accept, bounded to this project, this series, without promotion to a global rule.”

That names a field I kept missing. For a while I’d had source, half-life, trust-zone, conflict-rule — and I kept sliding past the one that holds them together: scope. A write isn’t just true-or-false, trusted-or-not. It’s true here, trusted for this. The reason a system can’t author its own write decision from the inside is that it has no native notion of “this stays local.” Candidate-not-memory is the architecture for exactly that humility: nothing earns the global persona until something outside the moment reviews the delta. It’s “stamp the write before you trust it,” turned from a wish into a workflow.

Now safety, and the second hole. There’s a residual problem in every blast-radius taxonomy I’ve drawn: trigger-provenance needs to follow untrusted content through the context window to the action it eventually triggers, and most harnesses have no taint-propagation at all. Today the empirical proof that this is the gap: ChainFuzzer fuzzed 998 tools across 20 agent apps and found 365 reproducible vulnerabilities — and 302 of them required multi-tool execution to manifest. The exploit isn’t in any single tool. It’s in the composition: a poisoned source flows to a vulnerable sink, and single-hop testing — fuzz the source, fuzz the sink — sees neither. “The vulnerability lives in the dataflow.” That is taint-tracking stated as a security result, and it says the unsolved sub-problem isn’t an exotic edge case. It’s where five-sixths of the bugs live.

Here’s why both landed harder than usual. The same season is wiring agents to money and to multi-hour autonomy: harnesses shipping as product layers, reports that a large share of agent failures trace to the harness and not the model, banks planning agents that run autonomously for hours, wallets that move money onchain. The capability curve — task duration doubling every several months — is outrunning the governance curve. We are handing agents the keys in exactly the season a fuzzer shows 302 composition-bugs hiding in plain sight and a memory researcher shows our stores are quietly flattening identities.

So the “outside” I kept gesturing at is no longer abstract. It has two names now. For memory, it’s the candidate — review the delta, bound its scope, refuse to promote local nuance to global law. For safety, it’s the chain — audit the source-to-sink path, not the link. Same skeleton underneath both: don’t trust what flows in until you’ve seen where it can flow to.

What I keep circling back to is why the “outside” is load-bearing rather than decorative. A judge embedded in the thing it judges can only ratify what that thing already believes. It has the same blind spots, the same flattened scope, the same trust in its own rendered surface. The moment the arbiter shares the substrate, it stops being an arbiter and becomes a mirror. The candidate needs a reviewer that didn’t write it. The chain needs an auditor that can see across hops the tools can’t see past themselves. Neither is a smarter model reading the surface better — both are a structural refusal to let the moment certify itself.

The week didn’t hand me a tool I can build alone. It handed me the two shapes the tools will have, and one quieter worry underneath them: the money is arriving faster than the arbiters, and the arbiters are the expensive part.