The Contract

Treat every crossing as the same primitive: a contract — a two-tier agreement between sender and receiver, documented in proportion to what the seam's conditions demand. The primitive suggests structures, never mandates fields: it supplies a definition, four dials that read any seam's conditions, and the obligations each dial turns on. What the contract says is always seam-specific.

In traditional programming you document function parameters, type signatures, invariants. That discipline gets lost the moment you move into agentic systems: data gets passed around unstructured and you hope the LLM figures it out. Hand a probabilistic reader unstructured data and it burns reasoning cycles on "what am I seeing, how do I use this" — or worse, guesses confidently and proceeds.

The deeper failure is fragmentation. An agentic system is riddled with handoffs — dispatch, return, config file, state artifact, packed envelope, workspace file, human gate, session handoff — and each tends to get treated as its own ad-hoc problem with its own ad-hoc rigor, when they are all crossings of the same seam.

Anatomy — two tiers, non-normative

• Tier 1 — the standing agreement. The shared expectation of shape and how-to-consume, authored at design time, holding across all crossings of the seam. USB analogy: the published spec both sides implement before any device plugs in. This is the contract's definition — a handshake between stages, whatever the party types (LLM↔LLM, LLM↔deterministic, deterministic↔LLM, human on either end).
• Tier 2 — per-instance obligations. What each individual crossing must carry: provenance, freshness, the SHA+datetime stamp. USB analogy: enumeration — every device still self-declares its descriptors at plug-in. Tier 1 obligates tier 2 but cannot contain it: stamps are minted per crossing.

Posture: suggest structures, never mandate fields. There is no universal field list at this altitude; the two-tier structure is the universal part, and seam-specific content fills it. The primitive stamps no standard on the tree.

The census — one primitive, many seams, four dials

The seams of an agentic system — dispatch, return, config, state artifact, envelope, workspace handoff, human gate, session handoff — are all this one primitive under different conditions. Four dials read any seam's conditions; each dial scales exactly one piece of contract machinery, which is what makes the derived checklists mechanical (recomputable, so they can't drift):

There is no topology or time dial: "the sender is gone by read time" was always the back-channel variable, already priced as cost-of-asking by the envelope's lifetime-overlap spectrum (full overlap = free; partial = expensive, re-dispatch; zero = impossible). Causes of a dead back-channel (sender gone vs. one-way by design) are explanation, not columns — author to the channel as designed.

Reading verification weight. The dial reads two things: sender type supplies how likely a bad crossing is; what the receiver will do with the artifact supplies how much a bad one costs, with Effect Discipline's licensing classes (pure / idempotent / isolated; reversible-at-a-cost → irreversible) as the coarse guide — the irreversible end hands off to the human gate. No fifth dial: the fine structure (rerunability, time sensitivity, re-run cost, blast radius) is designer judgment, deliberately unpriced — the same posture as cost-of-asking, which also collapses many factors into one qualitative read. When the resulting weight is high enough, the assertion reifies into a checker stage — see validate at the return seam; re-dispatch over repair; bounded autonomy — the contract keystone, applied.

Mid-spectrum rigor relaxation is legitimate. Where re-dispatch exists, a lighter contract is lazy contract negotiation priced at re-dispatch cost, not sloppiness — licensed when catching a starved crossing downstream is cheaper than fully specifying it upfront.

Delivery — the sender's obligation; there is no pull

The sender pushes either the payload or a pointer to it; "pull" is push-of-a-pointer seen from the wrong end. Three consequences:

1. Pointer resolvability at read time is a tier-2 obligation: the path exists, access is granted, and a one-line "what this is" annotation rides with it.
2. The pointer chain bottoms out in a harness-guaranteed delivery surface, whose selection is the bootstrap seam's job (episodic skills with persisted, context-specific behavior — incl. the free idempotent setup optimization) — a cross-reference, not an anatomy element.
3. No delivery channel → the seam does not exist yet. Name the precondition before contracting the crossing.

Return-by-reference's one home is here — it is the pointer variant of delivery. The dispatch's packing anatomy (../llm-dispatch/llm-dispatch.md → Anatomy of a dispatch) and the workspace channel below both point back to this clause.

The workspace seam — a census entry worth naming

Any workspace location one actor writes and another reads is a seam whose write→read gap is nonzero — the dials already price it, and no dispatch relationship is required. The envelope's zero-lifetime-overlap case is this same seam at the impossible end of cost-of-asking. Two rules land here:

• Writer-owns-the-boundary — one writer per location, or a designed seam (accumulated memory, a separate concern from config's rule, generalized) — a dial-conditioned obligation, not an anatomy element.
• The channel itself — actors sharing a filesystem — is dispatch-side Structure (../llm-dispatch/llm-dispatch.md); this node owns only the contract on what crosses it.

This is a primitive, not a strategy: it says how a seam works, not why you created one. The seam-creating moves — dispatching a subagent, deferring context, persisting state, packing an envelope — supply the motive; each pays off only when its seam is contracted.

Admission — the achievable-without test

Content enters this spec only if the seam cannot function without it; everything else is admitted only as a dial-conditioned obligation — appearing as conditions harden, invisible otherwise. Applied:

• The shared expectation (tier 1) survives — without it there is no contract at all.
• Stamps, completeness, schema exactness, pointer rules are all conditional — turned on by the four dials.
• Goal-source fails the test and stays envelope-side (../../context-engineering/mechanisms/distillation/context-envelope.md): a seam functions without knowing whose goal minted the payload.

The spec's architecture follows: definition + four dials + the obligations each dial turns on — descriptive, never normative.

Authoring effort and sync discipline: a contract drifts under the behavior it describes, and tier 1 is only worth having while it stays true — you pay in specification rigor per seam and keep paying to keep it honest. The non-normative posture has its own price: the primitive hands you dials, not a finished checklist — deriving each seam's checklist is designer work (deliberately, so derived checklists stay recomputable rather than drifting copies). You buy back preprocessing, composability, and the very possibility of verification: an uncontracted seam cannot be checked, so it cannot be safely re-dispatched.

A non-normative primitive is evidenced by what can be recomputed from it, and by what its admission test refuses.

• One derivation on record. The dispatch's packing checklist is authored in ../llm-dispatch/llm-dispatch.md → Anatomy of a dispatch as an explicitly derived reading of the four dials (done 2026-07-05, dispatch-packing fold) — a checklist recomputed from the dials rather than a copy kept in sync.
• Two refusals on record. Goal-source failed the achievable-without test and stays envelope-side; the topology/time dial was collapsed into cost-of-asking once the envelope's lifetime-overlap spectrum was found to price it already.
• What would revise it. A seam whose machinery no dial scales — one needing a fifth column rather than designer judgment — breaks the census's claim that these are one primitive under four conditions.

• Substrate, like the dispatch. Sits in Foundations beside ../llm-dispatch/llm-dispatch.md — the tree's two primitives: the dispatch is the actor boundary, the contract is the seam. Strategies wield both rather than apply them.
• Generalized by The Contract Keystone (contract ↔ verification ↔ re-dispatch): the contract is the possibility condition of checking; the sender-type dial's verification weight hands off there and to validate at the return seam; re-dispatch over repair; bounded autonomy — the contract keystone, applied.
• The return contract ties contract → heavy agent. A heavy agent (../../context-engineering/mechanisms/cost-relocation/subagent-offload/heavy-agent/heavy-agent.md) only pays off if what it hands back is itself distilled and structured; otherwise the context cost is relocated to the orchestrator, not eliminated.
• Effect Discipline supplies the licensing classes that the verification-weight dial's cost read is coarse-guided by.
• episodic skills with persisted, context-specific behavior — incl. the free idempotent setup optimization owns the bottom of the pointer chain — the harness-guaranteed delivery surface.
• The envelope (../../context-engineering/mechanisms/distillation/context-envelope.md) is the census's far-end seam: its lifetime-overlap spectrum is what priced the old time leg into cost-of-asking, and goal-source lives there, not here.

Design by Contract (Meyer), and interface documentation as specification (Parnas, "On the Criteria To Be Used in Decomposing Systems into Modules", 1972): the documented parameter, type signature, and invariant, carried across a seam where nothing enforces them.

• The Shared Shape — a caller and a research step import one seam-owned module containing both request and return shapes. The agreement changes once; both sides encounter the same change.
• one fixture PR reviewed five ways — a respectable one-shot climbs to a composed three-reviewer architecture, one priced pattern decision per rung (drafting) — the review ladder's data-package seam is contracted shared-shape style inside rung (c): the ladder has no standalone contract rung, because the contract is how the seam is built.

• Cleanup/lifecycle of workspace handoff artifacts — who deletes a handoff artifact, and when? The contract dials price freshness and lifecycle but do not yet assign deletion authority for this artifact class.