This corpus has already established what the ring does not keep.
The policy event carries a tool name, its arguments, and a running scalar of what the session accumulated, and returns allow, ask, or deny [06][15]. In Databricks’ own demonstration the gate stops a real exfiltration and retains reads-before-send equals sixty while discarding the instruction that made the send malicious [09][16]. It enforces, and it does not attest.
That is a claim about the record. This dispatch makes a different one, about the rule.
A governing layer that swaps model and harness mid-loop is not only unable to reconstruct what happened. It is enforcing a constraint whose validity was established against a model that is no longer the one executing. The trace problem is about evidence after the fact [12]. This is about whether the control was ever in force.
The router now chooses
The architecture is not static, and the direction is documented in the project’s own release notes.
In v0.4.0, released July 3, the intelligent model router began picking the best harness and model for each turn via a server-side judge, reading a live per-runner model catalog [03]. In v0.5.0, released July 10, routing was fixed so that it overrides a model an orchestrator explicitly specified when the parent toggle is on [17]. In v0.6.0, released July 21, harness CLI path overrides were standardized and the legacy variables deprecated and slated for removal in v0.8.0 [02]. In v0.7.0, published today, a new “Auto · smart routing” harness option lets the router pick both harness and model from the task, smart routing activates automatically from configuration rather than requiring an environment variable, and a composer modal tunes model, effort, and routing mid-chat [01].
Read the trajectory across twenty-four days. Mid-loop substitution moved from an operator action, to a per-turn judge, to a layer that overrides an explicitly named model, to a default activated from config with mid-conversation adjustment. The architecture no longer requires anyone to decide to swap. It swaps.
The seam was always the design. What v0.7 changes is that crossing it is now the default path rather than an available one.
Federation manufactures the tiers
Instruction conflict is not an incidental property of multiplexing harnesses. It is a manufactured one.
Many-Tier Instruction Hierarchy in LLM Agents builds the first benchmark for conflict across arbitrarily many privilege levels — 853 agentic tasks spanning up to twelve tiers against the two or three of prior work — and reports that the best of ten frontier models reaches 42.7 percent accuracy [04]. The authors name the sources plainly: instructions arrive from system messages, user prompts, tool outputs, and other agents, each carrying different trust and authority, and a sub-agent’s feedback contradicting a system-level requirement is their own worked example [04].
That is a description of a federated harness estate [14].
The decisive result is the controlled one. Holding the number of style groups and winning instructions fixed so that instruction-following difficulty stays constant, accuracy declines consistently as privilege tiers increase — eleven of twelve model-transition pairs strictly decrease, with drops from 6.8 percent to 24.1 percent between the easiest and hardest configurations [04]. The tiers themselves cost the accuracy. Not the task, not the model, the tiers.
So the architecture generates the conflict load it then governs. Every additional wrapped harness, every sub-agent fanned out behind the uniform API, adds an authority source to a resolution problem that measurably degrades as sources accumulate. The ring is not neutral with respect to the failure it exists to catch. It is upstream of it.
The instruction does not travel
Here is the part neither the manifesto nor the product accounts for.
Prompt-level guidance is calibrated against a model generation, and the vendor with the deepest view of its own models documents the recalibration explicitly. Anthropic’s prompting guidance is organized model-specific first, general technique second, migration considerations last, with a separate prompting page per current model [07]. Beneath that structure sit corrections that are not stylistic. Prompts written to stop earlier models from undertriggering on tools now cause overtriggering, and the remedy is to soften the language [07]. Verification instructions carried forward from prompts tuned for earlier models cause over-verification on Claude Opus 5, and the instruction is to remove them rather than rewrite them [07].
Remove rather than rewrite. An instruction that was correct for one generation is a defect in the next.
The empirical warrant for transfer is thin independently of any vendor’s guidance. Semantics-preserving rewording degrades performance by as much as 12 percent and alters the relative ranking of models in 63 percent of cases, accounting for up to half the performance variance of a given model [08]. And the sensitivity reaches the privilege encoding itself: changing how privilege is represented while preserving identical ordering costs Claude Opus 4.6 8 percent of its accuracy, and perturbing privilege values while strictly preserving their order flips the pass-or-fail outcome on 8 percent or more of individual cases for five of six models tested, while aggregate accuracy moves by under 5 percent [04].
Now compose that with routing. A layer that multiplexes heterogeneous harnesses has no common privilege encoding across them — each harness renders authority in its own idiom. Swap the model mid-loop and the instruction crosses into a generation it was not calibrated for, expressed in a representation the receiving model weights differently, inside a composite validated as neither. Aggregate metrics hold steady while per-case behavior churns underneath.
What the gate cannot check
The gate reads an action. That is sufficient for enforcement and insufficient for assurance, and the reason is measurable.
On the many-tier benchmark, every frontier model holds functional correctness above 86 percent while style compliance — the dimension where the privilege conflict actually has to be resolved — remains the primary bottleneck on overall accuracy [04]. The model completes the task correctly and drops the governing instruction. The tool call is well-formed. The arguments are unremarkable. The scalar increments as expected. Allow.
This is the failure mode a read-path ring is structurally unable to see, and it is worse than the trace gap this corpus has already named. A missing trace means you cannot prove, after the fact, that the control held. This means you cannot establish that it was in force at all — and nothing in the enforcement path would register the difference. Output review will not find it either, because the output is correct.
Enforcement asks whether the action may proceed. Assurance asks whether the rule that permitted it was in force. A ring above opaque harnesses can answer the first and has no access to the second.
The honest accounting
The open version earns credit that the argument should not withhold.
Policy checks fail closed when turn context is missing, a design decision taken in v0.3.0 [10]. An intent_gate shipped in v0.4.0 to keep an agent on its original task — a real instruction-integrity mechanism, at the right layer [03]. A credential proxy injects authentication for allow-listed hosts so secrets never enter the sandbox [11]. Sandboxed agents run under seatbelt and container providers with policy gating on native tools. And the seam is inspectable: an open-source enforcement point can be read, audited, and argued with, which is more than most governance layers offer. Databricks published the policy schema rather than asserting a capability.
Two things sit against that. The control surface is revising itself weekly — seven tags in thirty-eight days, v0.2.0 on June 19 through v0.7.0 today, six of them after v0.2.0, with documented breaking changes in each of the two most recent and the legacy harness path variables slated for removal in v0.8.0 [01][02][03][17][18]. No assurance case can be written against a control that changes on a seven-day cycle, which is the versioning argument turned on the governor. And from v0.6.0 the server collects anonymized usage telemetry by default, opt-out only [02].
The concession that carries the most weight is Databricks’ own. Their manifesto argues that governance belongs inside the system that produces quality, and that an organization unable to trace which data the AI used is not secure [05][13]. That is the correct locus, named by the vendor. The product is not wrong about the problem. It is placed wrong relative to their own answer — and it is placed there because the layer beneath belongs to someone else.
A meta-harness that swaps model and harness mid-loop does not merely fragment provenance. It voids the validation the control rested on.
An instruction is in force only against the model it was calibrated for. Anthropic documents that carried-forward instructions actively degrade behavior on the next generation and should be removed rather than rewritten; independent measurement puts semantics-preserving rewording at 63 percent relative-ranking instability; and privilege representation alone moves frontier accuracy by 8 percent. Substitute the model mid-loop and the constraint is running against something it was never validated against, in an encoding the receiving model weights differently.
Governance that lives in instruction text inherits the version volatility of the text. A ring that treats the model as an interchangeable field is, by construction, a ring whose rules expire without notice and without a signal. Govern where the state is written, or accept that what you are running is coordination.
