The problem we left open
In the last post I used illegal conditioning to name a failure mode that survives tidy as-of dashboards.
A mark at 14:00 is a claim about the 14:00 information room. Models and agents still sneak into bigger rooms through batch aggregates, scoped-looking joins, human labels born after revisions, agent memory, and latest tool defaults. On CEH-001, a notebook can look reconciled near 1.80 while production still sees 1.50 versus 2.10, and both sides call it model disagreement.
That creates three real headaches in production:
- The illusion of parity: green stickers on tables that still encode illegal rooms.
- The arbitrage trap: research and service disagree because they are not taking the same exam.
- Confident cheating: agents that fetch latest and narrate a peace number with clean grammar.
So the question for this post is simple. If that is the failure mode, what does a real AI solution look like?
The solution, as one stack
The core idea: make the allowed information room an executable contract, then test that every path that can influence a decision stays inside it. Five moves, one stack.
I am not trying to make research slow. I am trying to stop research from silently becoming a different product than the capital job. Wider rooms are allowed. They just need different names, different cards, and no allow tokens under the narrower story.
1. Write an information contract per job family
Name the decision time, the allowed sources, the forbidden sources, whether human marks are in or out, how aggregates may be fit, and what agent memory may retain across calls. For CEH-001 at 14:00, latest is forbidden unless the contract explicitly widens the room and renames the job.
If two rooms are both useful, they become two job names. Do not smuggle a wider room into a narrower job because the notebook looked prettier.
2. Tag every field and tool output with room membership
Features carry as-of stamps and legality tags. Tool outputs carry the same. Untagged fields cannot enter capital recipes. This is dull. Dull is how filtration becomes engineering instead of a slide.
3. Put canaries and tower tests in CI
Poison tests: inject a future field into training and assert the pipeline refuses, or that a canary detects predictive power from illegal fields on a locked recipe. Tower-style checks: predictions made with a wider room should not retain illegal advantage when restated under the narrower contract. If they do, something leaked.
Parity tests: research and service must agree when both are forced into the same room. If research only wins with a bigger room, that win is void.
4. Scope memory and batch fits like dangerous tools
Agent memory for a 14:00 job cannot freely retain 14:20 facts from earlier calls. Batch normalization and peer stats fit only on contract-legal windows. If a fit needs a wider window, it becomes a different recipe with a different contract id.
Distilled scores from wider research jobs are treated as forbidden sources unless the capital contract lists them explicitly. Distillation is not a cleansing ritual.
5. Bind allows to the information-set id
An allow token carries the information contract hash, not only a feature snapshot hash that might still be illegal in content. Change the room, invalidate the token. That is how you stop a latest-fetch agent path from spending under a 14:00 story.
Put together: information contract, tagged fields, canaries and tower tests, scoped memory and fits, contract-bound allows. Learning still happens. It just cannot peek and call the peek intelligence.
The example: CEH-001 at 14:00 versus the 14:20 notebook
Without the stack, the notebook trains on afternoon softening, production marks dual frames at 14:00, an agent fetches latest, and someone averages toward 1.80 under time pressure.
Now run the same case through the solution.
First the contract says 14:00 room only for the capital job. Afternoon revisions are a different job name if the desk truly wants them.
Second, tags refuse unstamped vendor fields. The helpful latest tool output cannot enter without a wider contract.
Third, canaries catch a poisoned future column in CI. Parity forces the notebook onto the 14:00 room. The heroic reconciliation disappears. The honest 0.60 gap returns.
Fourth, agent memory for this job is scoped empty of later prints. The midpoint narration loses its illegal fuel.
Fifth, allows bind to the contract id. End state: dual-frame disagreement stays visible, and nobody gets to call a bigger room a better model.
After this stack, the useful argument changes. People stop debating whether the agent sounded careful. They debate whether the room was legal. That is the systems shift I want.
The flow in one breath
Problem: tidy tables can still condition illegally. Solution: contract the room, tag fields, canary and tower-test, scope memory and fits, bind allows to the contract. Example: 14:00 CEH-001 keeps 1.50 versus 2.10 instead of laundering 14:20 hindsight into a 1.80 story.
Once contracts are executable, a second benefit shows up in agent design. Tool defaults stop being product decisions made by whoever wrote the SDK. They become policy. Latest is not a convenience. It is a room change. If the desk wants that room, it renames the job and accepts the audit consequences. If it does not, the tool call fails closed.
I have found that fail-closed tooling feels harsh for a week and then becomes relief. People stop debating vibes in the war room and start asking which contract id the draft carried. That is a better argument. It is also how 14:00 CEH-001 keeps its honest 1.50 versus 2.10 instead of inheriting someone else's afternoon.
Curious how others make information rooms executable in agent stacks without slowing research to a halt.