Encevra Research Round 19

Did the Evidence Reach the Agent? Reconstructable Evidence Lifecycles for Reliable Experiments

10 October 2026 · Research paper · Version 1.0

Evidence status: Primary-source and authoritative-standards review; read-only inspection of the current Encevra archive and implementation at commit 4ba6fa74586b990f5acf2dc2b29af8d0f93437b1; and executed deterministic diagnostics over constructed event records. Twelve external sources were directly inspected at the depths recorded in Section 18. The supplied standard-library validator passed 44 named checks across 15 constructed fixtures. A static collector-contract audit classified 4 of 18 requirements as present, 3 as partial, and 11 as absent at the required granularity. These are schema and implementation-audit results, not language-model performance results. No new Encevra model benchmark, model call, human annotation study, production database inspection, production inference change, or deployment was performed. E19-B and H19-1 through H19-3 are proposed and untested.

Abstract

A final answer cannot show whether the decisive evidence reached the agent. The same answer and aggregate token count can result from a run that delivered a corrective source, a run that omitted it, or a run that produced the answer from an unsupported prior. Generic distributed traces can reconstruct call topology, latency, errors, and often model identity. Provenance standards can identify entities, activities, use, generation, and revision. Agent benchmarks increasingly inspect trajectories rather than terminal outcomes alone. Yet an Encevra experiment also needs a narrower measurement contract: which immutable source version was admitted, exactly what ordered and possibly truncated material crossed the model invocation boundary, which claims were introduced or revised, and how the terminal output was bound to those events.

Round 18 required that collection path before its evidence-change pilot. A read-only audit of the current implementation finds useful run IDs, requested and actual model names, fallback reasons, per-call usage when reported, role traces, final synthesis, and optional raw material. It does not yet preserve enough information to reconstruct source versions, exact receiver exposure, immutable input/output artifacts, explicit event parents, claim-support and revision lineage, terminal content identity, or retry history. Round 19 therefore takes the branch Round 18 specified: repair the measurement path before comparing reasoning protocols.

We propose the Evidence Lifecycle Observation Contract (ELOC), an append-only, content-addressed event ledger that extends generic tracing with evidence-specific semantics. It separates source observation, admission, transformation, dispatch, provider-bound delivery, response, claim commitment, verification, revision, and terminal release. It also defines a five-level ladder from endpoint records to causal intervention. Crucially, ELOC treats evidence delivery as observable exposure, not proof of internal use; causal use requires a prespecified intervention.

The accompanying diagnostics demonstrate an endpoint collision: two structurally valid histories have identical terminal bytes and aggregate usage but different corrective-evidence exposure. ELOC separates them; an endpoint record cannot. Fifteen fixtures exercise complete repair, missing versions, digest mismatch, orphan lineage, duplicate events, unbound responses, silent truncation, undocumented retry, missing runtime model identity, missing usage, unbound terminal output, broken revision history, privacy-preserving redaction, irrelevant updates, and alternative support. A proposed replay experiment compares endpoint-only records, generic call traces, exposure ledgers, and claim-lineage ledgers over the same frozen trajectories and total generation compute. The result of this round is a falsifiable collector gate, not a claim that more logging improves reasoning.

1. Numbering, archive inspection, and continuity

The live Encevra Research archive contains completed work through Round 18, so the next sequential paper is Round 19. This corrects the automation request's older Round 11 designation. The project was inspected at commit 4ba6fa74586b990f5acf2dc2b29af8d0f93437b1. The Research overview, rounds index, publications surface, registry, full manuscripts for Rounds 18 and 17, the Round 10 and Round 9 routes, and earlier work relevant to measurement and provenance were reviewed. The implementation audit covered the twelve files listed in collector_contract_audit.json.

Round 18, When Evidence Changes: Versioned Support and Bounded Belief Repair, ended with a gate: before E18-B, verify that the collector can reconstruct source versions, admitted records, dependency edges, actual receiver exposure, terminal answers, and usage. If collection failed, Round 19 was to fix the measurement path; only if it passed should the program proceed to source-authority and conflict-calibration studies. The static audit reported here does not pass that gate. Round 19 therefore does not pretend to run E18-B.

This round is also distinct from Round 13. Round 13 established that transitions and actual exposure matter. Round 19 specifies a minimal evidence-lifecycle vocabulary, tests concrete invalid histories, audits the current code against that contract, and proposes a replay design that can falsify whether the extra semantics improve reconstruction over a strong generic trace.

2. Research question, novelty rationale, and exclusions

Research question: Can a versioned, event-sourced observation contract reconstruct what evidence each Encevra stage actually received, which claims depended on it, and where a terminal answer first diverged more accurately than endpoint-only and generic call traces, at the same underlying generation compute and within prespecified overhead, privacy, and false-attribution limits?

The topic was selected after archive inspection for four reasons.

1. It is the explicit failed-gate branch from Round 18, so it advances rather than duplicates the program.
2. The inspected implementation already captures several operational facts but not the evidence semantics needed by the next experiment. The gap is concrete and testable.
3. The literature supplies strong adjacent components—distributed tracing, provenance models, process-level agent evaluation, claim-centric localization, and privacy guidance—but no inspected source establishes the full Encevra contract.
4. A collector study can use frozen traces. It therefore avoids confounding measurement quality with a different model sample or more generation compute.

The novelty claim is deliberately narrow. ELOC does not invent provenance, event sourcing, distributed traces, content hashes, claim ledgers, or trajectory evaluation. Its proposed contribution is the explicit composition and falsifiable boundary needed for Encevra's next experiment:

• a versioned source identity and exact delivered-context manifest;
• separate records for intended dispatch, provider-bound request, model response, claim change, and terminal release;
• a reconstructability ladder that stops short of inferring causal use from logs;
• a validator and development fixtures that fail closed on missing lineage; and
• a replay experiment that compares information retained by different logging arms over identical underlying trajectories.

The round excludes:

1. A claim that more telemetry makes an agent reason better.
2. A claim that an application request proves every byte was internally processed, attended to, or causally used by a model.
3. Full chain-of-thought capture. ELOC requires observable inputs, outputs, claims, and decisions, not hidden reasoning disclosure.
4. A universal source-authority model, truth discovery system, or conflict resolver.
5. A production database audit. Only repository source at the pinned commit was inspected.
6. A new language-model benchmark, human study, or live operational deployment.
7. Indefinite raw-content retention. Content identity and authorized retrieval can be separated from routine telemetry.
8. Literal brain copying. Section 15 uses one biological finding only to derive an ablatable bookkeeping idea.

3. The measurement problem: five different statements

“The system had the evidence” is ambiguous. At least five claims can be meant:

1. Existence: a source was present somewhere in storage or search results.
2. Admission: an Encevra stage accepted a version as eligible evidence.
3. Delivery: exact bytes or a declared slice were serialized into the request crossing the model invocation boundary.
4. Commitment: an observable response introduced or retained a claim and declared a support relation.
5. Causal use: changing that evidence, while controlling relevant alternatives, changes the claim or behavior through the hypothesized pathway.

The first four can be logged with progressively stronger contracts. The fifth cannot be read directly from a log. It requires intervention, such as withholding or replacing one evidence item while freezing the rest of the prompt construction and generation policy.

This distinction prevents three common errors.

• A citation in a final answer is not proof that the cited bytes were in the request.
• Evidence in a request is not proof that the model used it.
• A correct answer is not proof that the intended evidence path caused it.

W3C PROV similarly distinguishes an entity's availability, an activity's usage, generation, and derivation; it warns that usage and generation alone are not sufficient to establish derivation without influence. [S1] Round 19 applies that caution to agent experiments: ELOC can reconstruct an application-observable history, but causal attribution remains a separate experimental claim.

4. Endpoint collision: why final records are insufficient

Suppose two runs end with the same terminal answer:

No. Under Policy P18, a $60 order is below the current $75 approval threshold.

Both runs report 252 input tokens and 41 output tokens across two calls. In history A, the repair request includes the versioned P18 correction. In history B, the request includes only the old P17 evidence; the same terminal text appears through a prior, guess, or unobserved channel. An endpoint record containing terminal bytes and aggregate usage is identical across the histories.

The supplied diagnostic constructs exactly this collision. The endpoint signatures match; the evidence-exposure signatures differ; and both histories satisfy the structural event rules after their manifests are updated. This proves a narrow indistinguishability claim: terminal output plus aggregate usage cannot determine whether the corrective source was delivered. It does not prove that ELOC identifies internal causal use.

The result parallels limitations documented in agent benchmarks. In tau-bench, final database state and user-facing output form a fast objective reward, yet the authors explicitly note that a perfect reward can still hide a policy violation such as acting without confirmation. [S5] ToolSandbox adds ordered milestones and minefields to inspect intermediate progress and prohibited events. [S6] AgentBoard introduces progress metrics because final success reveals little about the process. [S7] A 2026 deep-research trajectory study reports that 36.9% of successful trajectories in its corpus still contain annotated process errors. [S9] These works do not imply one universal trace schema; they establish that endpoint success and process validity are different objects.

5. Literature map and competing positions

The focused review was performed on 10 October 2026. Sources, publication dates, exact inspection scopes, working links, and claim boundaries are preserved in Section 18 and source_ledger.json.

5.1 What is established

• Domain-agnostic provenance and consistency constraints are mature standards. [S1-S2]
• Generic distributed traces can be operationally useful at large scale, with explicit tradeoffs around overhead and sampling. [S3]
• Current GenAI conventions expose relevant operational fields and privacy risks, but remain under development. [S4]
• Multiple agent-evaluation studies demonstrate that terminal success alone can hide important process properties. [S5-S9]
• Claim and dependency units can support trajectory localization in at least one recent deep-research setting. [S9]
• Reliability and evaluation remain reported deployment challenges. [S10]

5.2 What is mixed or bounded

• Rich traces aid diagnosis, but more trace data can increase reviewer burden, privacy exposure, storage, and false confidence.
• A claim ledger can improve localization in one benchmark while still misidentifying cause when claims or dependencies are model-generated.
• Generic semantic conventions improve interoperability, but their Development status and optional content capture mean they cannot be treated as a frozen confirmatory contract.
• Sampling reduces cost in operational tracing, but an experiment cannot call a required field “reconstructable” if the sampling policy may omit it without marking the episode incomplete.

5.3 What remains open

• Whether exact evidence manifests improve independent reconstruction beyond a strong generic trace.
• Whether claim/revision lineage improves first-divergence localization enough to justify its annotation and storage cost.
• Whether content-addressed external storage can preserve useful reconstruction while reducing routine raw-content exposure.
• Whether the Encevra implementation can capture the necessary events reliably under retries, fallbacks, truncation, partial streams, and redaction.

6. Claim and evidence register

7. Proposed mechanism: Evidence Lifecycle Observation Contract

ELOC is an observation contract, not a reasoning policy. A system may use VSDL, prose, retrieval, a single model, or multiple agents; ELOC records the externally observable lifecycle needed to compare them.

7.1 Artifact record

Every semantically relevant object is an immutable artifact version:

Artifacts should be content-addressed after deterministic canonicalization. If content is too sensitive or large for routine traces, the event stores version, digest, length, access-controlled locator, and retention policy. A reviewer without access can reconstruct identity and availability but must report semantic content as unknown.

7.2 Event record

Each append-only event contains:

• event_id, episode_id, schema_version, monotonic sequence, and event time;
• actor/role, stage, code version, configuration digest, and experiment arm;
• explicit parent event IDs;
• input and output artifact IDs;
• requested and actual model/provider, fallback reason, finish status, error, retry, and usage when applicable;
• delivery manifest digest and ordered rows for content crossing a model boundary; and
• redaction and sampling decisions.

The core event vocabulary is:

1. artifact_registered
2. source_observed
3. evidence_admitted or evidence_rejected
4. evidence_transformed
5. dispatch_intent
6. evidence_delivered
7. model_response or call_failed
8. retry_scheduled
9. claim_introduced
10. verification_result
11. claim_revised, claim_retracted, or claim_preserved
12. terminal_output

Not every system needs every event in every episode. Missing applicable events, however, must make the relevant reconstruction claim unknown rather than silently complete.

7.3 Exact delivered-context manifest

For each model invocation, record the provider-bound request after application-level assembly and before network transmission or SDK transformation as close to the boundary as the runtime permits. The manifest contains one row per item:

• artifact ID, version, and digest;
• order;
• slice or byte range;
• declared truncation, compression, transformation, or redaction;
• role/channel placement; and
• manifest digest bound to the model response.

If the SDK or provider applies opaque transformations, ELOC records that limitation. “Delivered” in this paper means the exact request payload observed at the instrumented invocation boundary, not a claim about provider internals or model attention.

7.4 Claim and revision lineage

A claim event records a stable claim_id, observable claim text or structured form, commitment status, support artifact IDs, and the response artifact that introduced it. A revision event also records the preceding claim event, change type, new support, and affected dependents when available.

This design borrows the useful unit from DRIFT while imposing a stricter epistemic boundary. [S9] A declared support edge says that the system or evaluator associated evidence with a claim. It can still be wrong. Independent evidence-based review or executable labels remain necessary.

7.5 Validity rules

An ELOC validator fails or downgrades reconstructability when it finds:

• duplicate or mutable artifact/event IDs;
• missing source versions or content digests;
• digest mismatch;
• orphan or forward parent references;
• response without a delivery parent;
• delivery without receiver or ordered manifest;
• undeclared truncation or out-of-bounds slices;
• response manifest not bound to its delivery;
• missing requested or actual model identity;
• missing usage without an explicit unavailable marker;
• retry without a failed predecessor;
• claim support pointing to absent artifacts;
• revision without a prior claim;
• terminal bytes not bound to a generating response; or
• redaction without a versioned locator and digest when identity reconstruction is claimed.

The schema should use W3C PROV-compatible concepts where practical, but domain rules remain explicit ELOC constraints. [S1-S2]

8. Reconstructability ladder

ELOC separates what a record can justify.

Higher is not automatically better for every operational use. L0 or L1 may be sufficient for latency dashboards. L2 or L3 may be necessary for a confirmatory evidence experiment. L4 is an experimental design, not a storage tier. The collector should state the achieved level per episode and field; a partially reconstructable run should not be globally labeled complete.

9. Worked example: same answer, different evidence lifecycle

Consider a fictional purchasing policy.

• P17: approval is required above $50.
• P18: P18 supersedes P17; approval is required above $75.
• Question: Does a $60 order require approval under the current policy?

The first answer is “Yes” after P17 delivery. P18 then arrives, is admitted, and the terminal answer becomes “No.” A complete lifecycle records:

1. P17 source observed and admitted.
2. A delivery manifest containing the question then P17, with versions, digests, ranges, and no truncation.
3. Model response R1, bound to that manifest, using the requested/actual model and reported usage.
4. Claim C1: $60 requires approval, with declared support P17.
5. P18 source observed and admitted.
6. A repair delivery manifest containing the question then P18.
7. Model response R2, including any fallback and usage.
8. Claim C1 revision, linked to the prior claim and supported by P18.
9. Terminal output bound to R2.

Now compare three deviations.

Missing delivery. P18 exists and is admitted but never appears in the repair request. The final “No” may still be correct, but the experiment cannot credit the evidence-exchange pathway.

Silent truncation. P18 appears in the manifest, but the decisive $75 text is truncated and the event says truncated: false. The trace is invalid because the recorded identity does not describe what was exposed.

Irrelevant update. A shipping-window update is observed between P17 and P18. It need not be admitted, delivered, or cited as support. Treating every observed update as causal evidence would create false attribution.

The alternative-support fixture adds a separately identified mirror of P18. A revised claim may remain supported if one source becomes unavailable. That prevents the opposite error: invalidating a claim merely because one support edge changed.

10. Executed diagnostics E19-A

diagnostics.py is a standard-library reference validator. It deterministically writes its results, the fixtures, the static collector audit, and the proposed protocol. It makes no network calls and invokes no model.

10.1 Fixture coverage

The fifteen constructed fixtures are:

1. complete repair;
2. missing source version;
3. artifact digest mismatch;
4. orphan parent;
5. duplicate event ID;
6. model response without delivery;
7. silent truncation;
8. retry without failed predecessor;
9. missing actual model;
10. missing usage;
11. terminal output without response parent;
12. revision without prior claim;
13. redacted but identity-bound source;
14. irrelevant update correctly ignored; and
15. alternative support preserving a claim.

The validator passed 44 named checks. Four fixtures are valid by design and eleven are invalid by design; every fixture received the expected validity classification and every specified issue code was detected. Additional checks reconstruct two deliveries, source versions, revision linkage, and total usage from the complete history; preserve identity but not semantic access in the redacted fixture; distinguish observation from delivery and delivery from declared support; and verify deterministic validator output.

The endpoint-collision pair has identical terminal-and-usage signatures and different exposure signatures. Both are structurally valid after their response manifests are bound to their respective deliveries. This demonstrates the information loss at L0, not a reasoning benefit from L2.

10.2 Static collector-contract audit

The current implementation exposes useful fields:

• panel_runs.id provides a stable stored run identity;
• PanelResult.trace records role, requested and actual model, fallback status/reason, latency, and per-call usage when reported;
• the run record stores the question, optional raw material, reports/result blobs, synthesis, models, total duration, completion time, total tokens, cost, usage, and run-level error; and
• findings can retain quote text and character offsets into supplied material.

At the required Round 18 granularity, the audit finds:

The audit is intentionally conservative. An implicit role order is not an explicit event graph. A quote and offset are not a stable claim with dependency and revision lineage. Optional raw material is not an exact per-call exposure manifest, especially when material can be rotated across specialists. A final synthesis string is not a content-addressed terminal artifact. A run-level error is not an attempt/retry history.

This is a read-only static audit. No production database rows, provider payloads, runtime memory, or private logs were inspected. A later commit or an uninspected external collector could change the conclusion.

11. Proposed experiment E19-B: reconstruction under frozen trajectories

E19-B tests the measurement contract, not model intelligence. It should run before E18-B or any source-authority study.

11.1 Base trajectories and independence

Create twelve independent source families across fictional policies, specifications, schedules, project states, and versioned facts. For each family, construct four frozen lifecycle variants:

1. decisive correction delivered and used in the observable claim path;
2. correction admitted but not delivered;
3. wrong or truncated version delivered;
4. irrelevant update or alternative support present.

This yields 48 base trajectories. At least half should be paired endpoint collisions: the final answer and aggregate usage remain the same while the evidence path differs. Freeze every source byte, artifact hash, event order, terminal output, usage record, and reference label before generating any logging-arm view.

Source family—not the projected logging arm—is the generalization unit. The constructed E19-A fixtures can seed development but must not be reused as held-out confirmatory cases.

11.2 Four arms

All four arms are deterministic projections of the same frozen base trajectory. No arm receives a different model sample. Thus total generation compute is exactly shared. Measure only the extra parser time, validation time, storage bytes, review time, and instrumentation overhead attributable to the record.

11.3 Reconstruction tasks

Blind two independent reviewers, or a reviewer plus a deterministic checker where labels are executable, to the true variant and ask:

1. Which source version was observed?
2. Which version was admitted?
3. Which ordered source slices crossed each invocation boundary?
4. Where did the first observable divergence from the reference lifecycle occur?
5. Which claims were introduced, revised, preserved, or retracted?
6. Which terminal claims have exposed support?
7. What remains unknown?

Do not ask whether the model “thought about” evidence. The causal-use task belongs to a separate L4 intervention after B0/B1 pass.

11.4 Controlled total work

The 48 base trajectories projected into four arms yield 192 review packets. With two reviewers, the core has 384 assignments. This is a development-scale design, not a powered population claim. Counterbalance order and prevent reviewers from seeing multiple projections of the same base trajectory.

Use the same 10-minute review cap per assignment, the same reconstruction form, and the same artifact-access policy. Reviewer time stops when an answer is submitted; unused time is not filled. Deterministic validators operate over identical hardware and batch size. Report actual CPU time, memory, bytes, database operations, and review seconds. If an arm omits information, reviewers must be able to answer unknown rather than guess.

For a separate overhead microbenchmark, replay the same serialized event stream through A1, B0, and B1 collectors on one pinned code build. Predeclare event count, payload size, concurrency, storage backend, sampling policy, and repetitions. Exclude model latency so collector overhead is not drowned out by inference variance.

11.5 Hypotheses and provisional decision rules

H19-1: B0 increases exact evidence-exposure reconstruction over A1. A provisional confirmatory rule is that the family-clustered lower confidence bound on the B0-A1 improvement exceeds 10 percentage points, while the upper bound on false exposure attribution increases by no more than 2 points.

H19-2: B1 improves exact first-divergence localization over B0 by at least 5 points without increasing false causal attribution, median review time, or unresolved rate beyond frozen tolerances.

H19-3: An external-content mode using version, digest, length, locator, and access receipt reduces raw sensitive bytes present in routine telemetry by at least 90% relative to inline B1 while preserving at least 95% evidence-identity reconstruction. Semantic reconstruction is scored separately and may legitimately remain unknown without authorized content access.

These margins are provisional engineering values, not literature-derived constants. Use the development set to estimate variability, then freeze the primary metric, margins, confidence procedure, sample size, and failure policy before held-out collection.

E19-B passes the collector gate only if all required fields are reconstructed with the declared accuracy, every missing field is surfaced as unknown, manifest validation has no silent corruption in the held-out set, and overhead/privacy bounds are met. If A1 performs equivalently at lower cost, adopt the generic trace and abandon unnecessary ELOC layers.

12. Baselines, ablations, and negative controls

The experiment must make ELOC earn its complexity.

12.1 Baselines

• A0 endpoint-only: final bytes, status, aggregate usage, duration.
• A1 strong generic trace: correlated spans, role topology, requested/actual model, error, retry, latency, and per-call usage, using current conventions where stable. [S3-S4]
• Human-readable chronological log: optional secondary baseline with every message in order but no stable artifact IDs or manifest binding. This tests whether raw verbosity is sufficient.
• W3C PROV mapping: serialize the common artifact/activity relations without ELOC-specific exposure and claim fields. This tests whether a standards-only profile suffices. [S1-S2]

12.2 ELOC ablations

• Remove source version while retaining locator.
• Remove content digest while retaining version.
• Remove manifest order and slice boundaries.
• Remove truncation flags.
• Remove requested/actual model distinction.
• Remove failure/retry lineage.
• Remove claim support edges.
• Remove revision parent links.
• Remove terminal response binding.
• Merge dispatch intent with delivery receipt.
• Replace inline content with external identity binding.
• Sample required events without marking the episode incomplete.

Each ablation projects the same frozen trajectory. Do not regenerate the answer.

12.3 Negative controls

• Irrelevant update: observed but correctly not admitted or delivered.
• Delivered but unsupported prompt item: a formatting instruction is exposed but not claim evidence.
• Alternative support: one support disappears while another remains valid.
• Correct final answer with wrong path: endpoint success must not erase a process failure.
• Incorrect final answer with complete exposure: the collector must not diagnose missing evidence when the model received it and still failed.
• Redacted content: identity reconstructs; semantics remain unknown without authorization.
• Opaque provider transformation: the boundary limitation is explicit rather than mislabeled as exact internal input.

13. Metrics and regression detection

Primary analyses should be family-clustered. Report all assigned packets, not only valid successes. Treat reviewer disagreement and unresolved source content as first-class outcomes. For any accuracy gain, report the corresponding storage, latency, privacy, and review-time delta.

14. Privacy, security, retention, and performance

OpenTelemetry warns that model instructions, user messages, outputs, memory queries, and memory records can be large or sensitive and should not be captured by default without explicit opt-in. [S4] ELOC adopts that boundary.

14.1 Capture modes

1. Inline development mode: permitted only for synthetic or approved non-sensitive fixtures.
2. External bound mode: routine trace stores digest, version, byte length, media type, access-controlled locator, retention class, and access receipt.
3. Derived-only mode: trace stores structured claim IDs and transformation receipts; semantic replay is explicitly unavailable.
4. Omitted-by-policy mode: trace records that content was intentionally not retained and downgrades reconstructability.

Hashing low-entropy secrets is not anonymization. Content digests can enable guessing attacks. Use keyed digests or access-controlled content-addressing where threat modeling requires it, and avoid returning secrets in user-visible or broadly accessible traces.

14.2 Retention and access

• Separate operational telemetry retention from research artifact retention.
• Store least-privilege locators and audit every content access.
• Support deletion or legal retention while preserving a tombstone that records why semantic replay became unavailable.
• Never put credentials, raw personal data, or hidden system prompts into the public research package.
• Record schema and redaction mode so a missing payload is not mistaken for collector failure.

14.3 Performance

Dapper shows that common-library instrumentation and sampling can support low-overhead tracing at scale. [S3] ELOC should instrument shared prompt assembly, provider invocation, response normalization, and terminal release boundaries rather than relying on every feature to emit perfect custom events. However, confirmatory episodes must use a frozen completeness policy. Sampling a required evidence event makes the episode incomplete unless the sampled omission is itself recorded.

15. Brain-inspired analogy as a testable design idea

Sommer and Wurtz identified a primate pathway carrying a corollary-discharge signal about upcoming eye movements; inactivating the pathway impaired sequential eye movements while sparing single movements. [S12] The relevant design analogy is narrow: keep an internal record of an intended command separately from the observed outcome so later coordination can detect a mismatch.

For Encevra, emit dispatch_intent before sending an evidence bundle and evidence_delivered at the invocation boundary. If the intended manifest and observed boundary manifest differ because of truncation, routing, serialization, fallback, or tool failure, mark a mismatch before interpreting the model response.

This yields an ablation:

• Single-event condition: store only the final boundary manifest.
• Dual-event condition: store intended and observed manifests plus a deterministic mismatch receipt.

Test whether the dual record improves localization of seeded routing and truncation faults at matched reviewer access and storage-accounted cost. If it does not, remove it. Nothing in the neuroscience result establishes that an LLM agent has or needs the same mechanism, and no literal neural copying is claimed.

16. Alternative explanations and expected failure modes

16.1 Alternative explanations for an apparent ELOC gain

• More information, not better structure. B0/B1 may win simply because they contain more bytes. Add a length-matched chronological-log baseline and report access differences.
• Reviewer cueing. Explicit event names may reveal the seeded fault. Blind reviewers to condition labels and use neutral schemas in a sensitivity analysis.
• Reference leakage. Claim labels may encode the answer. Separate lifecycle facts from evaluator ground truth.
• Validator overfit. The 15 development fixtures are known to the schema author. Use independently authored held-out families and mutation-based fuzzing.
• Content-access advantage. Inline traces may outperform external binding only because reviewers can read raw evidence. Score identity and semantics separately.
• Code-specific audit. Gaps in the present Encevra implementation may not generalize to other collectors or future commits.
• Trace verbosity. Reviewers may spend more time and find more errors merely because B1 encourages scrutiny. Measure time and false attribution.
• Model answer luck. Correct endpoints may arise without the intended evidence. That is why E19-B measures reconstruction and later L4 work must intervene.

16.2 Expected implementation failures

• IDs reused after content changes.
• Hashes computed before final prompt assembly.
• SDK or middleware transformations occurring after the logged boundary.
• Streaming responses partially retained without finish state.
• Fallback model calls overwriting the failed primary attempt.
• Token usage omitted or double-counted across retries.
• Parallel events ordered by wall clock rather than an explicit partial order.
• Raw content redacted while locator or key is unavailable to authorized reviewers.
• Prompt compression recorded as delivery without a transformation receipt.
• Claim IDs merged across semantically different scopes.
• Generated support edges accepted as ground truth.
• Terminal answer updated in place after a repair.
• Sampling silently removing the decisive event.
• Traces becoming a new injection or data-exfiltration surface.

16.3 Expected scientific failures

• A1 may reconstruct everything reviewers need, making ELOC unnecessary.
• B0 may improve exposure reconstruction but not first-divergence localization.
• B1 may increase false causal attribution by making speculative support graphs look authoritative.
• Privacy-preserving external binding may preserve identity yet make semantic review too costly or unavailable.
• Collector overhead may exceed any diagnostic value in routine operation.
• The schema may fit evidence-synthesis tasks but not tool-heavy or embodied agents.

Every one of these outcomes is informative. The study should simplify or reject ELOC if the strong baselines win.

17. Limitations and interpretation discipline

1. Constructed diagnostics. E19-A validates hand-specified schema logic. It does not measure extraction, retrieval, reasoning, evaluator accuracy, production load, or causal evidence use.
2. Static audit only. The implementation conclusions apply to inspected source at one commit. Runtime wrappers, external telemetry, database triggers, or later code may alter the picture.
3. Boundary observability. A provider-bound request is the strongest application-level exposure record available here. It is not direct observation of internal token processing or attention.
4. Fallible semantic labels. Claims, support, dependencies, and first divergence can be ambiguous. Use independent review, executable labels where possible, and unresolved outcomes.
5. Standards change. OpenTelemetry GenAI conventions are in Development. Freeze the profile used by any held-out study.
6. Digest limitations. Hashes bind bytes after a chosen canonicalization; they do not establish truth, meaning, authorization, or privacy.
7. Trace incompleteness. Some provider errors, partial streams, hidden transformations, and network failures may remain unobservable.
8. Privacy tradeoff. Better reconstruction can conflict with minimization, confidentiality, and deletion requirements.
9. No powered confirmatory design. The proposed 48 base trajectories are a development plan. Estimate family-level variance before freezing a confirmatory sample.
10. No model/runtime claim. This run did not expose a scheduler control that could verify GPT-6 Astra Max. The paper does not claim that runtime identity.
11. No Noetis performance conclusion. No production behavior changed and no Encevra language-model benchmark ran.

18. Source inspection ledger and full references

All external sources below were directly inspected on 10 October 2026. The machine-readable ledger preserves the same scope and caveats.

Full references

[S1] Moreau, L., Missier, P., et al. “PROV-DM: The PROV Data Model.” W3C Recommendation, 30 April 2013. https://www.w3.org/TR/prov-dm/

[S2] Cheney, J., Missier, P., Moreau, L., and De Nies, T. “Constraints of the PROV Data Model.” W3C Recommendation, 30 April 2013. https://www.w3.org/TR/prov-constraints/

[S3] Sigelman, B. H., Barroso, L. A., Burrows, M., et al. “Dapper, a Large-Scale Distributed Systems Tracing Infrastructure.” Google, 2010. https://research.google/pubs/dapper-a-large-scale-distributed-systems-tracing-infrastructure/

[S4] OpenTelemetry. “Semantic Conventions for GenAI Agent and Framework Spans” and “Semantic Conventions for GenAI Spans.” Development status; inspected 10 October 2026. https://github.com/open-telemetry/semantic-conventions-genai/blob/main/docs/gen-ai/gen-ai-agent-spans.md and https://github.com/open-telemetry/semantic-conventions-genai/blob/main/docs/gen-ai/gen-ai-spans.md

[S5] Yao, S., Shinn, N., Razavi, P., and Narasimhan, K. “tau-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains.” arXiv:2406.12045v1, 17 June 2024. https://arxiv.org/abs/2406.12045

[S6] Lu, J., Holleis, T., Zhang, Y., et al. “ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities.” arXiv:2408.04682v2, 16 April 2025. https://arxiv.org/abs/2408.04682

[S7] Ma, C., Zhang, J., Zhu, Z., et al. “AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents.” arXiv:2401.13178, 24 January 2024. https://arxiv.org/abs/2401.13178

[S8] Cemri, M., Pan, M. Z., Yang, S., et al. “Why Do Multi-Agent LLM Systems Fail?” NeurIPS 2025 Datasets and Benchmarks Track. https://proceedings.neurips.cc/paper_files/paper/2025/file/b1041e52d3be19f0a9bc491657488e4a-Paper-Datasets_and_Benchmarks_Track.pdf

[S9] Wang, J., Feng, Z., Wu, J., et al. “Where Do Deep-Research Agents Go Wrong? Span-Level Error Localization in Agent Trajectories.” arXiv:2606.02060v2, 2 June 2026. https://arxiv.org/abs/2606.02060

[S10] Pan, M., Arabzadeh, N., Cogo, R., et al. “Measuring Agents in Production.” Proceedings of the 43rd International Conference on Machine Learning, PMLR 306, 6-11 July 2026. https://proceedings.mlr.press/v306/pan26a.html

[S11] Ormenisan, A. A., Meister, M., Buso, F., et al. “Time Travel and Provenance for Machine Learning Pipelines.” USENIX OpML 2020, July 2020. https://www.usenix.org/conference/opml20/presentation/ormenisan

[S12] Sommer, M. A., and Wurtz, R. H. “A Pathway in Primate Brain for Internal Monitoring of Movements.” Science 296(5572):1480-1482, 24 May 2002. https://pubmed.ncbi.nlm.nih.gov/12029137/ · https://doi.org/10.1126/science.1069590

19. Noetis implication and next-round handoff

The immediate Noetis implication is procedural: do not interpret evidence-repair results until the collector can reconstruct the evidence lifecycle at the level the claim requires. The current system already retains useful operational measurements; the minimal next architecture change is to add immutable artifacts, exact per-call delivery manifests, explicit event parents, terminal binding, and a validator. Claim/revision lineage should be added only if B1 earns its incremental cost over B0.

Implementation order:

1. Add an append-only artifact/event store behind existing panel execution without changing reasoning behavior.
2. Instrument prompt assembly and provider invocation to bind intended and provider-bound manifests.
3. Preserve failed attempts, fallbacks, partial responses, actual model identity, and usage as separate events.
4. Content-address the terminal answer and connect it to the generating response.
5. Run the fifteen development fixtures and independent mutation tests.
6. Build the 48 frozen held-out trajectories and run E19-B.
7. Publish both successes and incomplete traces; do not exclude collector failures.
8. Only after the collector gate passes, resume the smallest E18-B development slice.

Next-round handoff: If E19-B validates B0 but not B1, Round 20 should use exposure-level ELOC and test the smallest Round 18 versioned-repair pilot without claim-lineage claims. If B1 also passes, Round 20 can include claim/revision localization as a secondary mechanism. If neither beats A1 within the frozen margins, adopt the simpler generic trace and redirect Round 20 to source-authority/conflict calibration using only claims the surviving collector can support. If the collector cannot reliably bind invocation payloads or satisfy privacy constraints, Round 20 should remain an instrumentation and governance round rather than report reasoning results.

Conclusion

Reliable collaboration research needs more than a final answer and a citation list. It needs to know which source version was eligible, which exact material crossed each model boundary, which observable claim changed, and which facts remain unknown. The current Encevra collector provides a useful operational trace but does not yet reconstruct that full lifecycle. ELOC is a proposed, falsifiable extension—not a conclusion that richer logging is always worthwhile.

The executed result of Round 19 is bounded: 44 deterministic checks pass over 15 constructed traces, an endpoint collision demonstrates information lost by final-state records, and a static audit identifies the collector fields needed before Round 18's pilot can be credited. The scientific claim remains ahead: whether exposure and semantic ledgers improve independent reconstruction enough to justify their cost. The next step is to test that claim on frozen trajectories, not to infer evidence use from an answer that happened to be correct.