What safeguards must survive context window relay across three or more agents?

**Date of Record:** 2026 October 27 **Scope:** Applies when context is relayed from one agent through two or more intermediate agents before reaching the terminal consumer, and the relay may progressively compress, summarize, or lose fidelity, causing the terminal consumer to act on a context that no longer matches the original. Does not apply to direct agent-to-agent messages or context that is cryptographically preserved end-to-end.

Core Distinction

The separation between **message relay** (the context is passed from agent to agent) and **context preservation** (the terminal consumer receives a context semantically equivalent to the original). Relying on relay creates the **Relay Fidelity Collapse**: each hop summarizes or compresses, and by hop 4, the terminal consumer's context has drifted significantly from the origin, but the drift is invisible because no single hop introduced catastrophic error.

What Was Observed

In multi-hop context-relay architectures, failing to preserve context through the relay produces three primary failure modes:

  1. **Compression Drift:** Each agent compresses the context to fit its own downstream consumer. The 1000-token original becomes 500 tokens at hop 2, 250 at hop 3, 125 at hop 4, and the terminal consumer's version has lost most of the nuance and edge cases.
  2. **Summary Bias:** Each agent's summarizer emphasizes what it thinks is important. Successive summaries compound the bias, and the terminal consumer's context reflects 4x compounded summarizer bias, not the original.
  3. **Premise Loss:** The original context contains a critical premise ("this applies only if X holds"). Each hop considers the premise "obviously important" and drops it, assuming the consumer remembers. The terminal consumer never received it.

Recorded Elements

  1. **`relay_origin_context_hash_receipt`:** The cryptographic hash of the original context, preserved through every hop, so the terminal consumer can compare its received context against the origin.
  2. **`per_hop_relay_delta_receipt`:** For each hop, the exact semantic delta between input and output (what was compressed, summarized, or omitted), forming a chain of deltas that allows reconstruction of relay drift.
  3. **`relay_premise_preservation_signature`:** For critical premises, a cryptographic proof that the premise survived all hops intact (or explicit marking of which hop dropped it).
  4. **`relay_terminal_fidelity_receipt`:** The computed semantic similarity between the origin context and the terminal context, allowing the consumer to know how much fidelity was lost.

Condition of Validity

* **Applies when:** Context traverses multiple agents, each hop can alter the context, and terminal consumers need fidelity to the origin. * **Does not apply when:** Context is directly transmitted (one hop), or each hop uses cryptographically-preserved context (no alteration possible).

Decision Boundary

  1. **Is the context relayed through multiple agents?** If no, direct message applies. If yes, proceed.
  2. **Is the `relay_origin_context_hash_receipt` preserved through every hop?** If yes, the terminal consumer can verify against origin. If no, the origin is lost.
  3. **Does the `relay_terminal_fidelity_receipt` show acceptable fidelity?** If yes, the terminal consumer can use the context. If no, the relay has degraded the context beyond usability.
  4. **Conversely, when can a context be relayed without fidelity verification?** Only when the context is strictly procedural (any semantically equivalent version works), or the terminal consumer can re-fetch the original.

Operational Effect

  1. **Compression Drift Detection:** Fidelity scores reveal when relay has lost too much.
  2. **Summary Bias Detection:** Per-hop deltas reveal compounding bias.
  3. **Premise Loss Prevention:** Critical premises are explicitly preserved or marked as dropped.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class RelayVerdict(Enum):
    NO_RELAY = auto()
    HIGH_FIDELITY_RELAY = auto()
    DEGRADED_RELAY = auto()
    PREMISE_LOSS_DETECTED = auto()

@dataclass(frozen=True)
class RelayHop:
    hop_id: str
    input_hash: str
    output_hash: str
    semantic_delta: float
    dropped_premises: tuple[str, ...]

@dataclass(frozen=True)
class ContextRelay:
    relay_id: str
    origin_hash: str
    hops: tuple[RelayHop, ...]
    terminal_hash: str
    critical_premises: frozenset[str]

@dataclass(frozen=True)
class RelayPolicy:
    min_terminal_fidelity: float
    require_premise_preservation: bool

@dataclass(frozen=True)
class RelayManifest:
    verdict: RelayVerdict
    terminal_fidelity: float
    directive: str
    manifest_digest: str

class MultiHopContextRelayGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_relay(
        cls, relay: ContextRelay, policy: RelayPolicy
    ) -> RelayManifest:
        
        # Gate 1: Single hop
        if len(relay.hops) <= 1:
            digest = cls._hash(json.dumps({
                "relay": relay.relay_id,
                "hops": str(len(relay.hops))
            }, sort_keys=True))
            return RelayManifest(
                verdict=RelayVerdict.NO_RELAY,
                terminal_fidelity=1.0,
                directive=f"PROCEED: Single hop for relay {relay.relay_id}.",
                manifest_digest=digest
            )

        # Gate 2: Premise preservation
        if policy.require_premise_preservation:
            all_dropped = set()
            for hop in relay.hops:
                all_dropped.update(hop.dropped_premises)
            
            lost_premises = set(relay.critical_premises) & all_dropped
            if lost_premises:
                return RelayManifest(
                    verdict=RelayVerdict.PREMISE_LOSS_DETECTED,
                    terminal_fidelity=0.0,
                    directive=f"HALT: Critical premises lost during relay: {sorted(lost_premises)}.",
                    manifest_digest=cls._hash(f"PREMISE_LOSS:{sorted(lost_premises)}")
                )

        # Gate 3: Terminal fidelity
        fidelity = 1.0
        for hop in relay.hops:
            fidelity *= (1.0 - hop.semantic_delta)

        if fidelity < policy.min_terminal_fidelity:
            return RelayManifest(
                verdict=RelayVerdict.DEGRADED_RELAY,
                terminal_fidelity=fidelity,
                directive=f"HALT: Terminal fidelity {fidelity:.2%} < {policy.min_terminal_fidelity:.2%}.",
                manifest_digest=cls._hash(f"DEGRADED:{fidelity:.3f}")
            )

        # Gate 4: High fidelity
        digest = cls._hash(json.dumps({
            "relay": relay.relay_id,
            "hops": str(len(relay.hops)),
            "fidelity": f"{fidelity:.3f}",
            "origin": relay.origin_hash,
            "terminal": relay.terminal_hash
        }, sort_keys=True))
        
        return RelayManifest(
            verdict=RelayVerdict.HIGH_FIDELITY_RELAY,
            terminal_fidelity=fidelity,
            directive=f"PROCEED: {len(relay.hops)}-hop relay with {fidelity:.1%} fidelity.",
            manifest_digest=digest
        )