A few weeks back I posted about FreshContext, a judgment layer that sits between retrieval and reasoning. It looks at candidate context (from any retriever) and returns a verdict: use this, refresh it, verify it, exclude it, before it reaches the model.
A commenter, ANP2 Network, pushed on something I couldn't stop thinking about.
My verdict included a safe_for_agent_handoff boolean. ANP2's point: a boolean is still just a field on an object. Anything downstream can flip it and leave no trace. Their words:
"An annotation, however structured, is something the next agent is trusted to respect. Infrastructure is something the next agent cannot route around without leaving a trace."
That landed hard. A structured JSON verdict raises the cost of ignoring it, but a downstream step can still rewrite needs_verification into safe_to_cite silently. Harder to drop than prose. Not impossible to forge.
Then a second thing happened. Copilot told me a match scheduled for June 12 was still going to happen, presented in confident future tense. I was reading it on June 20. The data had aged eight days between retrieval and presentation and nothing flagged it. Same disease ANP2 was describing, just wearing a different coat: a verdict that was true once, trusted forever, with nothing recording when it was made or whether it still holds.
So I went looking for the fix, and here is where I landed. I want people to poke holes in it.
The two options I weighed
Option A: the judgment layer stays pure. It produces a verdict and signs it (HMAC, server-side secret). It also stamps evaluated_at on every verdict so the judgment carries its own age. A thin wrapper around the agent checks the signature and enforces. Any downstream agent can call a verify endpoint to confirm the verdict actually came from the layer and the content is unchanged. The layer makes the verdict provable. The wrapper does the enforcing.
Option B: the judgment layer itself verifies and re-evaluates. It becomes the thing every pipeline routes through to get a yes or no.
I went with A. Reasoning: the moment the layer adjudicates instead of judges, it becomes a gatekeeper every agent pipeline has to pass through. Bigger attack surface, harder to adopt, and a different product than the one I want to exist. Keeping the layer pure is what makes it infrastructure other people can drop into their own stack rather than middleware they have to surrender control to.
What this buys, against the two failures above:
- ANP2's silent flip: the rewrite breaks the signature. The verify endpoint says no. The omission stops being invisible.
- The stale verdict:
evaluated_at means the verdict carries when it was judged. A downstream step can decide a verdict is too old to trust instead of trusting it blindly.
- Multi-agent handoff (someone asked me about this case specifically): Agent B no longer trusts a verdict because Agent A passed it. B verifies the signature. One agent faking a score doesn't poison the next one.
Where I think A is still weak, and what I want torn apart
The wrapper is opt-in. If a team skips it, they are back to advisory. Is "provable but only enforced if you choose to" actually enforcement, or just better annotation with a receipt?
Stateless verify means a network call at each real decision point. Cheap, but not free. Where does that latency stop being worth it?
Signing proves origin and integrity. It does not prove the verdict was correct. A faithfully signed bad judgment is still a bad judgment. Is provenance solving the trust problem, or just relocating it?
I have a working version of the judgment layer running and I would genuinely rather you test it than take my word for it.
Throw bad context at it. Try to make it bless something stale. Tell me where the model breaks.
The honest summary: I think you can get most of the way to enforceable context integrity without turning your judgment layer into a gatekeeper. Signed, time-stamped verdicts plus a thin enforcing wrapper gets you there. I am not certain. That is why I am posting instead of just shipping.
