Guarded Agentic Compaction / Method

Two certificates, and what each one licenses.

A guarded program ships only when provenance reconstructs it and finite-sample evidence certifies it. Both certificates are numbers with closed forms, so this page states them, instantiates them on the artifacts that shipped, and names the risk level each result is actually licensed at.

Compile time

Five checks, and refusal is the default.

Recurrence in a trace is a clue that a region might be compilable. It is not a license. Each check below can retire the family on its own, and no check can be traded against another.

Compile-time admission pipeline Agent episodes become a typed trace representation and a candidate region, which must pass five independent admission checks. If all five agree the compiler emits a guarded program; any single refusal retires the family. Recurrent agent episodes real records, live provider Typed trace IR value provenance retained Candidate region longest groundable prefix Admission gate every check can refuse on its own Value provenance derivable arguments Effect barriers read-only region Compatibility and partition bounded lookup Replay equivalence observation parity Finite-sample evidence grouped calibration all five agree any refusal Emit guarded program inspectable, replayable, revocable Retire the family the default, and the first optimization
Compile-time admission. The compiler emits the longest groundable prefix, not the whole recurrent region — a dynamic argument that cannot be derived from entry state or prior results truncates the program.

Run time

Dispatch is bounded; fallback is exact.

An admitted artifact does not take over the workflow. It is looked up at the entry boundary, re-checked against live effects, and abandoned in favour of the unchanged agent whenever a stage refuses.

Runtime dispatch and fallback A bounded registry lookup at the entry boundary selects a path. Ordinary guarded region compilation runs guard, gate, stage, interpret, verify, and commit, and can fall back to the unchanged agent. An eligible guarded composite artifact verifies its continuation pin and projects the task result before the first provider request. Entry observation bounded registry lookup by compatibility + partition Ordinary guarded region compilation Guard Gate Stage Interpret Verify Commit any stage may refuse Exact fallback: the unchanged agent runs requires a staging owner at the commit boundary Eligible guarded composite artifact Verify continuation pin program + task projection Project the result before provider request one no provider request is emitted at all
Runtime dispatch. Exact fallback still requires a staging owner that holds the commit boundary; the composite path avoids post-emission rollback by verifying and projecting before the provider sees the observation.

The certificates, written out

Each closed form below is checked against the value the study recorded when this page is built. A formula that stops reproducing its own published number fails the build rather than rendering.

Selective-risk certificate

With zero observed violations, split δ across the fixed threshold grid and invert the one-sided exact binomial bound.

rbound=1− (δK) 1/n

Prescribed-prefix ablation: δ=0.1, K=11, n=92 → 0.0498, inside the registered α=.05. The composite artifact refuses four groups, so n falls to 88 and the same formula gives 0.0520 — which only clears α=.10.

Coverage is what pays for it

Risk and coverage trade off exactly as the finite-sample calculation requires; refusing groups is what pushes the bound out.

c= nadmitted ngroups

The composite gate is the only one that refuses any calibration group: 88/92 admitted, 95.7% coverage. Dropping below 92 zero-violation groups is precisely why a 5% bound is no longer available to it.

Preservation is bounded, not proven

No compiled-only failure across the pooled held-out records still leaves a one-sided upper bound on the discordance rate.

dbound=1− α1/n

Pooling all 90 paired records bounds compiled-only degradation at 3.3%. Any single 30-record family bounds it only at 9.5%. Zero observed failures is not an equivalence result.

Discovery has to amortize

Learning the program costs paid provider episodes, repaid only out of the per-episode saving it later produces.

E∗= Cdiscovery cbaseline− ccompiled

Issue-type routing spent $0.1146 over 132 discovery episodes and saves $0.000279 per episode → 411 episodes, more than three times its own discovery cohort.

Risk is per artifact, not per paper

4 of the 7 admitted artifacts sit at the registered α=.05. The guarded composite artifact does not: it is the only gate that refuses any calibration group, and refusing four drops n below what a zero-violation 5% bound needs. Every result that rests on it — the composite study and the fair-placement comparator — is a 10%-selective-risk result and is reported as one.

Selective-risk configuration each admitted artifact actually used. Bounds split δ=0.10 across an 11-threshold grid for one fixed candidate and assume the zero observed violations every row records.
Admitted artifactαGroups admittedCoverageRisk boundAgainst registered α=.05
Prescribed-prefix ablation0.0592 / 92100.0%0.0498meets .05
Natural-order, three-read0.1045 / 45100.0%0.0992licensed at .10
Expanded replication (issue type)0.0592 / 92100.0%0.0498meets .05
PR-outcome audit0.0592 / 92100.0%0.0498meets .05
Backlog-attention routing0.0592 / 92100.0%0.0498meets .05
Guarded composite synthesis0.1088 / 9295.7%0.0520licensed at .10
Comparator deployment (same GCS artifact)0.1088 / 9295.7%0.0520licensed at .10

Read this before quoting a number. Three risk levels appear in this work and each licenses a different result set. The three primary workflow families are licensed at .05; the composite and comparator results are licensed at .10 and would retire at .05.

What the primary result establishes

Compiled programs preserve exact outcomes across three distinct decisions and tool vocabularies while removing model turns. Hand-written programs reach the same exact score, so the claim is automatic discovery and lifecycle — not runtime dominance.

Three real-record workflow families, 30 pairwise-disjoint held-out records each, live provider calls on one revision-pinned public snapshot.
Workflow familyExact: baseline → compiledManualRequestsTokensCost
Issue-type routing30/30 → 30/3030/30−50.0%−39.5%−32.0%
PR-outcome audit30/30 → 30/3030/30−75.0%−80.8%−75.3%
Backlog-attention routing29/30 → 30/3030/30−74.8%−81.4%−75.1%
Weighted total89/90 → 90/9090/90−66.6%−63.1%−58.7%

All records come from one revision-pinned repository snapshot; this is workflow-family, not cross-repository or time-forward, generalization. With no compiled-only failure in 90 paired records, the pooled discordance bound is 3.3%; exact McNemar gives p=1. See the full experimental design for denominators and counterbalancing.

Where the cost numbers come from

Token savings and dollar savings diverge, and the reason was recorded all along. Collapsing three reads into one call shortens the prompt and simultaneously destroys the repeated prefix that made the remaining input cheap.

Prompt-cache structure of the primary runs, recovered provider-free from retained data. “Cached” is the share of input served as cache reads; break-even counts future episodes needed to repay 132 paid discovery episodes in provider spend alone.
FamilyArmTokens / episodeCachedCost / episodeBreak-even
Issue-type routingUnchanged4,25932.3%$0.000872411
Compiled2,57627.8%$0.000593
Manual macro1,7810.0%$0.000545
PR-outcome auditUnchanged2,7180.0%$0.000679182
Compiled5220.0%$0.000168
Manual macro5220.0%$0.000169
Backlog-attention routingUnchanged2,8450.0%$0.000729181
Compiled5300.0%$0.000182
Manual macro5350.0%$0.000188

In the issue-type family the hand-written macro uses 30.9% fewer total tokens than the compiled condition but is only 8.0% cheaper, because it retains no cache reads at all. The two newer families are cache-cold in every arm, so part of the width of the reported cost range is a property of cache warmth rather than of the compiled programs. Provider-side break-even runs 181–411 episodes. A cache-controlled replication is the correct fix, and this work does not have one.

Generated, not transcribed. Every figure on this page is read from paper/results/ at build time by scripts/build_paper_page.py, which re-derives each bound from its closed form and fails the build on a mismatch. Full derivations, related work, and threat analysis are in the paper; the boundaries are enumerated under limits.