← Back

Context Architecture

The payload my agent sessions load before they open a source file. I scored it against five published criteria. Three failed.

The resident payload

Every session I start reads a fixed payload first. The payload holds an index of about sixty memories and eight rule files. It also holds the working agreement for the repository it landed in, and a list of skill descriptions. The session opens a source file only after all of that.

The payload accreted, one “remember this” at a time. It grew over months and across five agent vendors. Nothing crashed. The payload just got bigger, and a bigger payload is not free in three currencies.

Plate 01 A bigger payload is not free: money, attention, and trust. Money re-sent on every turn Attention each fact weighted less Trust a fact has no date a bigger payload is not free
A bigger payload is not free in three currencies. Money, because every resident token is re-sent on every turn. Attention, because a model that reads sixty facts weights each one less than a model that reads six. Trust, because a fact carries no date. The plate holds no count; the counts stay in the prose. It does not show what a stale fact costs. That argument stays in the paragraph below, because a shape cannot carry it.

Trust is the third cost. A session cannot tell a fact with no date apart from a fact that used to be true. A stale instruction still reads as an instruction.

A paper I read in August 2026 gave me the criteria for the audit. It is Context Engineering: From Prompts to Corporate Multi-Agent Architecture (arXiv:2603.09619). It states five quality criteria for an agent’s context: relevance, sufficiency, isolation, economy, and provenance. It also frames context as the agent’s operating system.

Contents

What was already there

Four structures already existed, and all four predate those words. I describe them in the paper’s terms after the fact.

Economy, traded against sufficiency

A resident index, with bodies on demand

Only the index is resident. Each line is a pointer. It carries a name and one clause of what that memory settles. Where a trigger phrase is load-bearing, the line carries that too: “read before any font subsetting”, “never re-queue this”. The body is a separate file, and it loads when the pointer fires.

The tradeoff: a session does not know the fact. It knows that the fact exists, and where to get it. That is strictly worse for sufficiency and much better for economy. It is the right side of the trade only as long as the pointers are good enough to fire. A pointer that does not trigger is a fact I paid to store and never read.

Plate 02 The index is resident. The body loads on demand, and a pointer that never fires leaves it unread. RESIDENT the index a name, a clause, a trigger the pointer fires it never fires the body loads on demand the body stays unread
Only the index is resident. Each line is a pointer, and the body is a separate file that loads when the pointer fires. The right half is the same structure when the pointer never fires: the file exists, and nothing reads it. Skills repeat this shape one level up. The plate does not show what the trade costs. It is strictly worse for sufficiency and much better for economy, and both halves of that sentence stay in the prose beside it. The plate shows no trigger phrase either, because a trigger is words and not a shape.

Provenance, at the rule layer

Dated rules, each with its founding case

A rule in my setup is not a bare claim. It is a claim, plus the incident that produced it, plus a date.

One rule states that a finding becomes a deferred prompt, never a mid-session question. Its founding case runs like this. A scheduled audit finished in one paragraph. Then a stale lock file, noticed in passing, became a three-hour project across three repositories, with two pull requests and a postmortem. I consented to every step. Every consent came at the moment I was least able to refuse.

Why the case travels with the rule: a bare rule invites an agent to reason about whether it applies. A rule with its founding case hands over the shape of the failure. That shape is what the recognition of the next instance actually takes. The case also keeps the rule falsifiable by me. If I cannot remember why a constraint exists, I cannot tell whether it expired.

Isolation

Deferred work is a self-contained prompt, not a conversation

When a session finds a real problem outside its scope, it does not raise it. It files a prompt for a fresh session. That prompt must lead with its blast radius: the repository, and the files it expects to touch. It must close with an origin line: the date I filed it, the repository at a specific commit, and the evidence.

What each half buys: the blast radius lets the next session check for a duplicate before it files another one. Two queued sessions therefore cannot collide silently on the same file. The origin line is provenance for work picked up cold, weeks later, and possibly on another machine. A deferred task whose evidence went stale should be discoverable as stale, and not re-executed on faith.

The same shape, one level up

Skills: description resident, body on demand

A skill is a packaged procedure. Only its one-line description sits in context. The procedure loads when the description matches the work. It is the memory-index trade above, repeated at the level of behaviour rather than fact. That is why a skill holds the reference material that a session needs only to reason about a rule, while the rule itself stays resident. The figure above shows the same trade: a pointer that does not trigger is a fact I paid to store and never read.

Contents

The audit, and the three it failed

I scored each surface against all five criteria. Isolation and sufficiency held. The other three did not.

Criterion Verdict The finding
Relevance Failed Every rule file loads into every session, unconditionally
Sufficiency Held Pointers fired; bodies carried the detail
Isolation Held Deferred prompts stand alone; one concern per session
Economy Failed Three index lines grew into changelogs. The worst ran to roughly 230 words
Provenance Failed Not one index line carried a date. The failure was total

Provenance was the worst of the three. No index line said when I wrote it, or when I last touched it. So a session that reads the index cannot tell yesterday’s fact from a June fact that July quietly superseded. Every line makes its claim with exactly the same confidence.

Economy failed in a way that fed the first. The file’s whole job is to hold pointers. Those three lines pointed at nothing, and carried the body file’s own detail instead. An index line that reads like a changelog is no longer a pointer. It is the shape most likely to go stale, because an append to it is easier than an edit to the body.

Relevance failed too, and I did not fix it. None of the rule files are path-scoped, so a session renaming a CSS token still reads the multi-vendor routing doctrine in full. I left it alone because the alternative failure is silent and worse: scope a rule to a path, guess the path wrong, and the session that most needed the rule is the one that never loaded it. A rule that fails to load looks exactly like a rule that was followed. I would rather pay tokens than take that trade before I can measure it.

Contents

What shipped in August 2026

A doubled rule marks a decision that was reversed.

Three conventions and one hook.

Every index line now ends with a compact date stamp. Where no date is determinable, the line says so and never guesses. A cap holds every line to 25 words. Displaced text merges down into the body file, and I delete none of it. The cap carries one explicit carve-out: compression removes detail, never a verdict and never a trigger.

“Read before touching X” is the load-bearing part of a line, and a shorter line that dropped it is worse than the long one. Deferred prompts now close with the origin line above.

All three of those are prose. The fourth is a hook.

Reversed. A prose rule promoted to a mechanism

The guard that covered the surface its author enumerated

One of my oldest rules is that an agent stages explicit paths and never runs git add -A. Parallel sessions leave dirty working trees, and a wildcard stage scoops up another session’s in-flight work. Prose is a weak place for that rule to live. So I promoted it to a hook before this audit, and the hook inspects the command before it runs.

I audited the hook and found two commands that walked straight past it. Both stage the entire tree. I drove both through the guard on standard input, and the guard allowed both.

Plate 03 Two branches of one guard. Only one of them scans a flag letter by letter. ONE GUARD, TWO BRANCHES commit branch scans a flag letter by letter add branch compares whole tokens git stage -A a synonym git add -Au one whole token
The same guard has two branches, and only one of them scans a flag letter by letter. The add branch compares whole tokens, so two commands walked out through the gap. I wrote both branches on the same day. The plate shows the gap, not the fix: not the letter match that closed the two bypasses, and not the near-miss cases that bound it. Both stay in the prose below. The plate also holds no count, so the test-suite figures stay there too.

The sharp part: the same guard’s commit branch already solved the combined-flag problem. It scans the letters of a flag like -am one at a time. The second branch never got the treatment the first one got. A matcher covers the surface its author enumerated, not the surface that exists.

The fix matches the operation rather than the spelling. The widening is bounded rather than guessed: no other git add short option uses those letters, so a letter match cannot collide. The test suite went from 24 cases to 32. I split the added cases deliberately between the two closed bypasses and the near misses that prove the fix did not widen too far. The change is public.

A mechanism that cannot be persuaded now enforces the staging rule. The three conventions that shipped alongside it have no such mechanism. Nothing fails if a date stamp is wrong, or absent, or invented. The context is legible. It is not yet checkable.

Contents

The same gaps in production surveys

LangChain’s State of Agent Engineering survey puts numbers on where teams that run agents in production are actually stuck. 32% name quality as their top barrier: accuracy, consistency, and hallucination. Among organisations over 2,000 people, security is second at 24.9%. The adoption gap in the same report is the one I recognise most. Around 89% have implemented observability, and 52% have implemented evaluations.

Those figures map onto this architecture. Quality is what provenance and economy are for. An agent that acts on a fact that expired in July produces a confident, well-formed, wrong answer. No amount of model capability fixes an input that is no longer true.

Security is what isolation is for. I enforce the redlines in my setup per vendor, mechanically, at tool-call time. A constraint written in a document is a request, and five vendors with different harnesses will honour a request differently.

The observability-versus-evaluation gap is the same weakness in my own work. I can read my context. I cannot yet fail a build over it.