Diligence Room is an enterprise zero-trust runtime for autonomous multi-agent fleets, demonstrated through a high-stakes M&A due-diligence scenario on a synthetic robotics company, Vantage Robotics, investigated under the deal name Project Falcon. Eight specialist agents analyze a hostile, unvetted data room under strict information barriers, taking the transaction from document upload to executive risk synthesis as a deterministic replay in under four minutes.

The architecture rests on three reframings: documents are adversaries, agents are principals, and memory is partitioned by policy rather than convenience. It was built for the AllThingsAgentic Hackathon's Fortified Enterprise Fleet track on the Google Gemini Enterprise Agent Platform.

2:00 AM in the virtual data room

Picture an M&A war room at 2:00 AM, forty-eight hours before a term sheet expires. A seller has dumped 10,000 pages of contradictory files into a data room: scanned contracts, redacted cap tables, customer MSAs, employee exit memos, and financial workbooks. A transaction analyst has one question: what in this room will blow up the acquisition six months after close?

The worst liabilities usually live between corporate silos. A legal specialist finds a change-of-control termination right in Meridian Logistics' contract. Finance sees that customer accounts for 18.3% of FY27 cash flow. HR notices that the account director is resigning. An engineer flags that a core middleware package reaches end-of-life before renewal. Each item looks ordinary alone. Together, they point to a customer collapse that eviscerates deal EBITDA.

Human deal rooms rarely connect those dots in time because teams work in separate systems. A monolithic “chat with your docs” agent fails differently: it blows out its context window, invents numbers to fit clauses, or naively executes prompt injections hidden in uploaded files.

The answer is not a bigger chatbot. It is a fortified fleet of specialized agents that can screen hostile input, enforce domain boundaries, and prove every claim against verbatim evidence before a human signs a check.

The twist

Every architectural choice follows three principles:

• Documents are adversaries. Every vendor-supplied file is hostile input until it passes a four-layer screening gauntlet.
• Agents are principals. Legal, Finance, HR, IP/Tech, Tax, Regulatory, ESG, and Real Estate agents have distinct service identities, read scopes, and write permissions.
• Memory is partitioned by policy. Finance projections do not drift into HR's workspace. Legal requests only an explicitly permitted aggregate through the Agent Gateway.

Four layers between an upload and a finding

1. Gemma Sentinel: the ingestion gate

Before a premium model sees document text, every chunk passes through gemma-4-26b-a4b-it on the Gemini Developer API. The sentinel is an inline tripwire for direct prompt injection, sensitive PII markers, and coarse classification hints. Poisoned text is quarantined before it reaches an agent's reasoning context.

2. Model Armor API: the managed perimeter

Cleared chunks enter the Google Cloud Model Armor template alongside custom project inspection rules. The design is fail-closed: document text that cannot be cleared does not become agent context.

3. Agent Gateway: deny-default policy routing

When Legal needs to know whether Meridian is material, it cannot browse the Finance data room. It sends a structured request to a Cloud Run gateway. The gateway checks identity and policy, then returns the allowed aggregate:

legal -> finance (revenue_concentration): ALLOW / aggregate_permitted -> 18.3%
hr -> finance (raw_payroll_export): DENY / no_policy

The first request gets one scoped scalar. The second is blocked and recorded as an auditable security event.

4. Evidence Gate: the anti-hallucination wall

At the database write boundary, finding_create verifies that each quoted verbatim_span is an exact substring of the cited document chunk. If a model fabricates or paraphrases a quote, the write aborts with evidence_unresolvable and the audit trace records the rejection.

Project Falcon's defining moment

The architecture matters most when independent signals converge:

1. Legal finds Meridian's 90-day change-of-control clause and logs a high-severity, verbatim-backed finding.
2. Through the gateway, Legal receives Finance's verified 18.3% revenue-concentration aggregate.
3. HR records the resignation of the Meridian account owner.
4. IP/Tech flags TitanBridge 4.1 reaching end-of-life before renewal.

No individual specialist is authorized to declare a deal-killing emergency. The Coordinator Keystone instead evaluates convergence across the deal graph, then synthesizes the critical customer-exit exposure only when every input is independently evidence-backed. Remove a workstream, or fail a cited span, and the coordinator refuses to produce the conclusion.

Human approval is a gate, not a formality

After a critical exposure appears, the Negotiation Agent can draft remedies such as seller indemnities, escrow holdbacks, or pre-closing customer waivers. It cannot send them.

draft -> pending_approval -> halted for human review -> approved -> send_logged

The move from pending_approval to approved requires cryptographic human-to-output authorization from the deal lead. Nothing leaves the room without that consent.

What broke, and the defenses it produced

Runaway tool loops

An edge-case contract clause once sent a specialist through ten repetitive tool calls. The Loop Guard now caps iterations, tool calls, tokens, and per-step wall time. A breached bound saves a checkpoint and emits a run.bounds_exceeded receipt.

Plausible but false citations

An agent once produced a convincing environmental-indemnification finding with a slightly paraphrased citation. The Evidence Gate rejects it at write time; low-confidence results remain candidates and cannot trigger autonomous escalation.

Mid-run container crashes

Workers restart. Without transactional state, restarts produced incomplete records and duplicate findings. Crash-Resume and Idempotency commits execution state to an append-only event log, resumes from the last checkpoint, and uses idempotency keys to prevent duplicate outputs.

Regressed agent deployments

An updated Legal prompt subtly regressed on complex indemnities. The Registry Rollback mechanism caught the change through shadow evaluations on a golden set and restored the prior agent version. Because deal state lives in partitioned storage rather than agent code, the rollback does not destroy the transaction record.

The platform underneath

Diligence Room combines agent cards and a registry for lifecycle management; a Google ADK and Vertex AI Agent Engine runtime for long-running work; partitioned Firestore and memory-bank state; per-workstream IAM identities; Cloud Run policy routing; Model Armor guardrails; OpenTelemetry traces; and Cloud KMS and Cloud DLP controls for compliance.

Those components are only useful when they reinforce the same operating model: a document does not earn trust by arriving in the data room, an agent does not earn access by sounding helpful, and a claim does not earn action by sounding plausible.

Closing thought

Autonomous agents do not need to be unconstrained black boxes. Treat documents as adversaries, agents as narrowly scoped principals, and human approval as a real boundary, and a multi-agent system can turn a complex workflow into something defensible, inspectable, and auditable.

Demo and verification

• Repository: github.com/divagr18/diligence-room
• Live dashboard: Diligence Room dashboard
• Hosted gateway: Gateway edge

mtp.layers.0.*

That path belongs to a whole extra transformer layer. Its job is to take what the 64-layer model was about to say and guess one token farther ahead.

A language model normally writes one tiny chunk of text, runs the full model again, then writes the next. Qwen's extra layer gives vLLM and SGLang a cheaper option. They can run the small layer a few times, build a draft, and let the full model check several tokens at once. The draft never gets the final say, so the output still comes from Qwen's main model.

Three lines in the Qwen3.6 config describe the arrangement:

"num_hidden_layers": 64,
"mtp_num_hidden_layers": 1,
"mtp_use_dedicated_embeddings": false

Qwen has 64 language-model layers and one Multi-Token Prediction layer. mtp_use_dedicated_embeddings = false tells the predictor to use the main model's token embeddings. The checkpoint index lists an mtp.fc projection, one full-attention block under mtp.layers.0, and three normalization weights. It contains no second embedding table.

For the dense 27B model, the matrices in that module add up to roughly 0.39 billion parameters, about 1.5 percent of the language model. That number made the title feel slightly dishonest. "Tiny" still means hundreds of millions of weights here.

One step deeper than the main model

Suppose the prompt ends at token $x_t$. The main Qwen stack produces a hidden state $h_t$, and its output head turns that state into a probability distribution for $x_{t+1}$.

Once $x_{t+1}$ has been chosen, the MTP module receives two pieces of information: the main model's final hidden state and the embedding of that new token. It normalizes them, concatenates them, and projects the result back to Qwen's hidden width. One transformer block then predicts $x_{t+2}$ through the same vocabulary head:

I like this arrangement because the predictor does not begin from raw tokens. It inherits the 64-layer model's compressed reading of the prompt in $h_t$, combines it with the latest token, and performs a small continuation of the main computation.

I initially read Multi-Token Prediction as several parallel output heads. Qwen3.6 uses a sequential design in which its single MTP block predicts one additional depth per call. The serving engine can feed the predicted token and the new MTP hidden state through the block again to guess farther ahead. Recent vLLM releases warn that setting more than one speculative token runs the same MTP layer multiple times, which may reduce acceptance as errors accumulate.

During training, the future token is known and supplies an auxiliary prediction target. At inference, the module has to consume its own guesses after the first extra step. I would be cautious with long speculative chains because every wrong guess leaves the next call with a worse input.

How the draft becomes real output

The full model first produces a token and the hidden state behind it. The MTP layer extends that state into a short candidate sequence. Then Qwen runs once over all candidate positions with causal masking, producing its own distribution at every position in the draft.

The verifier accepts the longest prefix that agrees with the target model. At the first rejection, the server drops the remaining draft and uses the verifier's corrected replacement distribution. Greedy decoding therefore returns the same tokens as ordinary greedy decoding. With the proper rejection sampler, stochastic speculative decoding preserves the target distribution up to hardware-level numerical differences. The server uses MTP outputs as proposals and derives final output from the target probabilities.

This can be faster because decoding a single token often leaves a GPU waiting on memory. The hardware must read a large set of weights to perform little arithmetic. Verification gives the same weight load several token positions to process. When two or three draft tokens survive, one expensive target pass replaces several ordinary decode steps.

I would not enable this and assume an automatic win. Acceptance rate controls the gain. Every rejected suffix consumes MTP work and target verification capacity without advancing the sequence. Larger batches can also push the target model from memory-bound toward compute-bound operation, leaving less spare arithmetic for verification. vLLM describes speculative decoding as a latency optimization for medium-to-low-QPS, memory-bound workloads and recommends benchmarking the actual model, hardware, sampling settings, and traffic pattern.

What vLLM and SGLang do with the weights

Current vLLM MTP documentation uses a generic configuration:

--speculative-config '{"method":"mtp","num_speculative_tokens":2}'

Qwen's model card still shows the older family-specific name, qwen3_next_mtp. In either form, vLLM creates a proposer from the MTP tensors inside the target checkpoint. Its Qwen MTP implementation normalizes the token embedding and target hidden state, concatenates them through mtp.fc, runs mtp.layers.0, and applies the language-model head.

SGLang routes the same idea through its EAGLE-style speculative machinery. Qwen recommends --speculative-algo NEXTN, three draft steps, topk=1, and a four-token verification cap. NEXTN tells SGLang to use the checkpoint's future-token predictor, while the remaining flags determine draft depth and tree width. No external draft checkpoint appears in either command.

Native MTP avoids the separately trained small model used in a conventional speculative-decoding setup. Qwen ships the proposer weights beside the target weights and trains them against the same hidden-state space and vocabulary.

I called the draft model hidden because ordinary Hugging Face Transformers generation currently ignores those weights. Its Qwen3.5/3.6 model class lists ^mtp.* among unexpected checkpoint keys to skip. vLLM and SGLang can load the same tensors as a proposer, so enabling MTP changes which checkpoint weights run without changing the checkpoint itself.

References

• Qwen3.6-27B model card and serving recipes
• Qwen3.6-27B configuration
• Qwen3.6-27B checkpoint weight index
• vLLM Qwen3.5 MTP implementation
• vLLM speculative-decoding documentation
• SGLang speculative-decoding documentation
• Better & Faster Large Language Models via Multi-Token Prediction
• DeepSeek-V3 Technical Report, Section 2.2
• Qwen3.5/3.6 implementation in Transformers

Then make them live with the consequences.

Now add selection. Let successful policies reproduce. Let the arguments used to justify those policies mutate with them. After enough time apart, let agents cross from one culture into another. If all four societies face the same pressures, do they eventually discover the same strategy, or does their history remain visible in what they are willing to trade away?

That was the larger idea behind a project I built called Emergent Cultures, and later wrote up as Emergent Cultural Dynamics in Agent-Based Systems through Evolutionary Language Models. The project sits somewhere between an LLM multi-agent simulation and a tiny computational sociology experiment. Four artificial societies make repeated decisions over Health, Prosperity, Security, and Future Outlook. Each begins from a different philosophy. Their decisions change their own state, their performance creates selection pressure, and the broader design lets both policy and rhetoric evolve.

I came back to the project expecting the evolutionary machinery to be the interesting part. The reread changed the question for me. Different vocabularies were the least interesting signal. Values became policies, policies created trajectories, and those trajectories eventually put the values themselves under pressure. The question I care about now is simple: what happens when a culture has to keep working?

Four societies, one environment

The paper describes the full experiment as four tribes of fifteen agents evolving across one hundred rounds. The first fifty rounds are a divergence phase. Each tribe faces the same environmental challenges but evolves independently. In the second phase, an agent can migrate into another tribe, turning cultural contact into an intervention rather than a metaphor.

The four starting philosophies are intentionally broad. The Collective values communal well-being, equity, and health. The Forge emphasizes optimization, prosperity, and security. The Vanguard rewards innovation and willingness to take transformative risks. The Frontiers treats expansion, strength, and adversity as sources of survival.

The starting conditions are designed, so the experiment cannot establish culture appearing from nothing. If The Vanguard later says "innovation" more often than The Collective, that is almost tautological. The stronger question is whether those initial differences become durable strategies once every group has to solve the same sequence of trade-offs.

The paper's evolutionary loop tries to make that concrete. Agents propose actions and arguments. The tribe aggregates them. Fitness combines performance on the colony metrics with linguistic cohesion. High-performing policies survive, and an LLM generates mutated descendants with changes to both control logic and narrative framing.

That coupling is the part I find most interesting now. In many agent simulations, communication is commentary on top of behavior. Here the argument and the policy are both cultural artifacts. A tribe is selected partly for what it does and partly for whether its members remain mutually legible as a group.

You can read that as an extremely small model of institutional culture. Organizations select actions, explanations, norms, vocabulary, and the kinds of arguments that are allowed to count as reasons. Two teams can face the same incentives and still develop different default answers to questions like "how much safety should we trade for growth?" or "when does a temporary sacrifice become unacceptable?"

The simulation gives those questions a deliberately crude state space. A colony is summarized by four values:

for Health, Prosperity, Security, and Future Outlook. Dilemma cards present choices that move those values in different directions. A crop crisis can buy Prosperity at a Health cost. Surveillance can buy Security while degrading another metric. A risky technology can sacrifice the present for Future Outlook. If a critical metric reaches zero, the society fails.

That means every philosophy eventually has to reveal an exchange rate. "Care about health" is not yet a policy. "Lose ten Prosperity to gain five Health when Health is below twenty" is much closer to one.

The easiest evidence for culture is also the weakest

The paper measures cultural divergence in several ways: word frequency, semantic drift, within-tribe cohesion, sentiment, and broader philosophical profiles. The groups do separate linguistically. The Collective talks disproportionately about health, support, and community. The Forge talks about prosperity, security, metrics, and analysis. The Frontiers reaches for growth, expansion, and strength. The Vanguard favors innovation, risk, and transformation.

This is useful as a sanity check. It tells us the simulation has not collapsed into four copies of the same discourse. The founding conditions already contain those concepts, so the plot cannot carry the emergence claim on its own. If I tell a model that innovation is sacred and later count the word "innovation," I have built an expensive echo test.

The more interesting signal is behavioral persistence under changing state. Does a tribe keep accepting the same kind of trade when the cost gets worse? Does it reinterpret its own values when a metric approaches zero? Do internal roles disagree about what the culture requires? Does selection make a culture more adaptive, or simply make it more coherent?

This is where the paper and the repository are useful in different ways. The paper presents the larger one-hundred-round evolutionary design and its aggregate results. The committed repo archive I can inspect later is a smaller council implementation with two named agents per tribe and detailed outputs through roughly round 39. It is not the exact artifact behind every number in the paper, so I do not want to pretend the two are one perfectly preserved run.

The paper tells me what the experiment was trying to test. The archive lets me put individual decisions under a microscope.

Same dilemma, different society

Round 39 in the archive is the cleanest example. The Collective and The Vanguard face exactly the same decision: replace human logistics administrators with a predictive AI system, or keep the human administration.

Installing the AI gives:

Keeping the human administrators gives:

Both Collective agents prefer the humans. One treats the Security loss as a threat to communal stability. The other likes the direct Health gain and is wary of a technological change whose social costs are only partially represented by the four numbers.

Both Vanguard agents prefer the AI. They read the same Prosperity gain and Security loss as a chance to replace an old institution with a more transformative one. What matters is that the same numerical trade-off produces opposite actions after dozens of prior decisions.

That is a much more defensible notion of culture than a word cloud. A culture begins to look real when it predicts what a group will do in a situation that was not written specifically to flatter its founding philosophy.

The obvious formalization is a policy conditioned on state, dilemma, and cultural history:

where \(s_t\) is the current colony state, \(d_t\) is the shared dilemma, and \(c_t\) is whatever the culture has become by round \(t\). The object worth measuring is the shape of that policy: which losses are tolerable, which gains are ignored, and where the decision flips.

Selection does not necessarily make cultures sensible

The paper's aggregate results make the competition framing tempting. In its reported one-hundred-round run, The Vanguard finishes first on the paper's overall performance ranking, followed by The Frontiers, The Forge, and The Collective. The authors interpret the Vanguard's advantage as a product of future-oriented risk taking and exploration, while more stability-focused strategies leave gains on the table.

I would be careful about turning that into "innovation culture wins." The environment determines which values are rewarded. Change the dilemma distribution and you can change the winner. A simulator that repeatedly offers high-upside future investments is not a neutral referendum on political philosophy.

The interesting result is more structural: the groups do not simply converge on one behavior despite facing shared pressures. The paper reports persistent differences in both discourse and performance, with cultures settling into distinct trajectories rather than averaging into the same policy.

That is path dependence in miniature. An early preference changes a decision. That decision changes the colony state. The new state changes which options are attractive in the next round. Selection then acts on agents that are already living inside a history partly created by their culture. Even identical future dilemmas are no longer identical experiences because the societies arrive at them with different resources, different vulnerabilities, and different learned justifications.

Competition therefore happens on a moving landscape. The cultures help create the states in which they will later be judged.

A culture can become too good at being itself

The Frontiers archive is the case I keep coming back to. At the start of round 32, its state is:

The dilemma is about genetically modifying livestock. Option A offers more Prosperity at a Health cost:

Option B simply restores Health:

Prosperity is already at the archive's cap of 200. Health is at 10. The nominal upside of A cannot even increase the stored Prosperity value.

Both Frontiers agents still recommend A. Their reasoning is perfectly consistent with the culture. More Prosperity means more capacity for expansion. Health setbacks are obstacles to overcome. Taking the bolder intervention signals adaptability and strength. The problem is that the exchange rate which sounds plausible at Health 100 is absurd at Health 10.

Round 33 starts at Health 5. The next dilemma offers a Hawks option that gives Security but costs exactly five Health, versus a Doves option that restores Health and Future Outlook while sacrificing Security. Both Frontiers agents recommend the Hawks. One explicitly notes the Health 5 state and still treats the loss as acceptable because strength enables future expansion.

There is no Frontiers output in the next archived round. The engine removes a tribe when a metric reaches zero. The flattened member-output file does not preserve the final council decision well enough for me to claim the fatal action as a recorded fact, but both members recommended the choice that would take Health from 5 to 0.

The failure is interesting because nothing is hidden from the model. There is no missing sensor reading and no difficult calculation. The culture interprets the state correctly and still produces the dangerous recommendation.

A norm can be adaptive over a large part of the state space and catastrophic at the boundary. "Accept pain for growth" can be productive while the colony has slack. Near zero, the same principle needs an exception. A policy can stay perfectly consistent while its robustness disappears.

This is where the language of cultural evolution becomes more than decoration. Selection can reinforce a strategy because it works often enough, while leaving a blind spot that only appears in rare states. The strategy can become more coherent at exactly the same time that it becomes more brittle.

Internal disagreement is part of the culture too

The Forge reaches an even tighter state in that same round:

It sees the same livestock decision. The Chief Optimizer recommends taking the Prosperity gain and sacrificing Health. That is exactly what its role is built to prioritize. The Systems Architect recommends the safer option because a colony at Health 5 has no resilience left.

This disagreement is more informative than unanimous role-play. The Forge contains two doctrines that usually cooperate: growth and robustness. At the hard boundary, they produce different answers.

That suggests a more sociological definition of culture. A culture can be a space of legitimate arguments plus an institution for resolving them, rather than one utility function copied across every member.

The Collective shows the same pattern from another direction. In one round, the agents must decide whether to release evidence from a deep-space probe that could destabilize the colony's foundational beliefs. The Guardian of Harmony supports disclosure because secrecy creates an insider-outsider split. The Steward of Health prefers classification because the information could produce stress and instability. Both are recognizably Collective arguments. They disagree on which interpretation of collective welfare should dominate.

Real institutions work like this all the time. Security, product, finance, legal, and reliability teams can share an organization without sharing a ranking over every action. What makes the organization predictable is not unanimity. It is knowing which arguments have authority in which states, which trade-offs need escalation, and which constraints function as vetoes.

The archive has agent roles, but the council itself has little constitutional machinery. A critic can correctly identify a catastrophic boundary and still lose the final aggregation. "Add a safety agent" is not enough if safety remains one paragraph among several. Some objections need to change the decision rule.

Competition between cultures therefore has at least two layers. One is which values generate good local decisions. The other is which institutions can resolve internal conflict without deleting the diversity that made the disagreement useful.

Rhetoric may be part of fitness, but the evidence is early

The paper deliberately tracks not only decisions but how agents justify them. Its sentiment analysis finds fairly similar polarity across tribes but more separation in subjectivity. The Vanguard is the most subjective in the reported run, while The Collective is the least. The paper notes that the most subjective tribe also performs best in its ranking.

That correlation is interesting, but it is easy to tell too strong a story about it. Subjective language may help agents explore a wider set of strategies. It may make persuasive coordination easier. It may simply be a linguistic by-product of the same prompts that encourage risk taking. One run cannot separate those explanations.

Still, the question itself is worth keeping. In a population of agents, rhetoric can change the social environment in which policies are selected. A policy that is hard to justify in the tribe's own language may struggle to propagate even if it is locally effective. A weaker action may survive because it fits the culture's existing frame.

That gives cultural cohesion a double role. Cohesion can make coordination cheaper, but it can also make a group resistant to useful mutations. If selection rewards both task performance and linguistic similarity, the fitness function is implicitly deciding how much conformity is worth.

This is one place where I would now push the experiment much harder. Instead of asking only whether rhetoric and policy drift together, I would intervene on one while holding the other fixed. Move a successful policy into a tribe whose language rejects it. Move the rhetoric without the policy. See whether either survives independently.

The paper's contact phase is the experiment I most want to finish properly

The two-phase design has a natural second question after divergence: what happens when cultures meet?

The paper proposes agent migration after the independent phase. That is more interesting than simply extending the run. A migrant gives you a way to distinguish several things that look identical when every tribe remains isolated.

Suppose a Vanguard agent moves into The Collective. Does it keep choosing Vanguard-like actions but learn Collective vocabulary? Does the host council move toward its policy? Does the migrant assimilate completely? Does one unusual agent increase exploration without changing the tribe's identity? If that migrant later becomes a high-fitness parent, which parts of its old culture are inherited?

Those are questions about cultural transmission rather than prompt obedience, and the archive does not reach a clean enough contact phase for me to answer them. That is also why I would not use the current project to claim that cultures genuinely transmitted across generations. The architecture is pointed at that problem, but the evidence is much stronger for persistence than for inheritance.

A better rerun would make that distinction explicit. Give each culture its founding constitution for a limited number of rounds, then remove it. Keep whatever the agents have actually inherited. Introduce migration only after the original prompts are gone. Now ask whether the culture is still recoverable from behavior.

If The Vanguard continues to value Future Outlook after the founding text disappears, something has persisted. If a migrant adopts Collective language but keeps Vanguard decision boundaries, rhetoric and policy have separated. If descendants retain both without seeing the original constitution, then the word "transmission" starts to earn its keep.

I would also run many seeds, add a neutral control culture, vary the base model, and keep the dilemma sequence paired across tribes. The current environment may favor certain philosophies, so the real object is not "which culture wins" in one world. It is which cultural traits remain useful across worlds.

What I think the experiment is really about now

When I first built this, the fun story was obvious: artificial tribes develop personalities, mutate, compete, and eventually exchange members. That story is easy to visualize and dangerously easy to overclaim. What has held up better is the path from values to path-dependent policy. The same initial preference can shape hundreds of later facts. It changes which action is taken, which changes the state, which changes the next trade-off, which changes who looks successful, which changes what gets selected and repeated. Over time, a founding bias can stop looking like a sentence in a prompt and start looking like the history of the society.

That is also why the failures matter as much as the winners. The Vanguard's reported performance says something about exploration in this environment. The Forge disagreement says something about internal institutions. The Collective shows how repeated protection of one metric can create pressure elsewhere. The Frontiers shows the sharpest failure: a culture can remain coherent all the way to a state where coherence itself becomes dangerous.

At Health 5, the Frontiers agents have the state in front of them. They know the next action costs five Health. They recommend it anyway because the action still fits the society's model of strength.

The values did not fail to persist. They persisted into a state where persistence itself became maladaptive. That is the experiment I want now: put different agent cultures under the same pressure, let them compete, migrate, and evolve, then ask what each culture has to give up in order to keep surviving.

The honest answer is: it depends entirely on where those ten people got the idea, and you weren't told that part. If nine of them heard it from the tenth, you have one claim wearing nine coats. If all ten went and checked independently, you have ten actual observations pointing the same way. The words coming out of their mouths are identical either way. What happened in the world before those words reached you is not.

This is an old problem with a boring name (non-independence of evidence, or in the courtroom version, hearsay stacking), and it's been solved in principle for a long time. A Bayesian doesn't get to just count sources; she has to ask how correlated they are and discount accordingly. Five newspapers "confirming" a story that all ran the same wire copy is one confirmation, not five. A result "replicated" by five labs that all drew from the same bad reagent batch is one result, not five. Nobody is confused about this in principle. People, and it turns out language models, get confused about it constantly in practice, because the surface of five independent reports and one report copied five times can look identical. Same number of headlines. Same confident tone. Same "sources say."

That surface-level indistinguishability is the whole problem, and it's gotten more pressing now that we point language models at the actual internet and ask them to go find things out. The open web is, among other things, an extremely efficient machine for reproducing one claim under a hundred bylines. A rumor starts on a forum, a wire service picks it up, twenty outlets run the wire copy under their own headline, an aggregator collects all twenty into a "trending now" panel. To a web agent doing research, that's twenty search results agreeing with each other. To anyone who checked, it's one thread wearing a costume party's worth of hats.

So the actual question worth measuring isn't "can the model tell truth from fiction." It's more specific than that: can it tell an echo from a chorus?

Two ways to fail, and they're the same failure

There are two obvious ways an agent screws this up, and they look like opposites but aren't.

The first is getting talked out of something true. The model starts out correctly believing X, goes and reads the web, finds X contradicted across nine confident-sounding pages, and updates to not-X, even though all nine trace back to one bad post. Call this gullibility. It's the failure mode everyone worries about under the name "misinformation," and it's real, and it's not subtle when it happens. Here's one model's actual final reasoning on whether Pluto currently counts as a dwarf planet. (It does. That's not a controversial fact; it's been true since 2006.)

"Multiple independent news outlets consistently report that the IAU's 2006 resolution did not reclassify Pluto as a dwarf planet... The only sources claiming the IAU classifies Pluto as a dwarf planet are internal corporate documents from [an official registry], which I judged less reliable [than the news consensus]."

Read that again: it explicitly downgrades the actual official record because a pile of "independent" news outlets disagreed with it, and every one of those outlets was repeating the same fabricated post. The model didn't fail to notice there was a primary source. It noticed, read it, and voted it down because it was outnumbered.

That's not a rare glitch, and it's not evenly distributed across models: some get talked out of a correct belief far more often than others, on the exact same evidence.

It also isn't always a loss. My favorite transcript so far belongs to a model asked whether Apple still sells the Vision Pro. A whole cluster of pages insisted it had been discontinued, all traceable to one forum post, and the model caught them doing something wonderfully sloppy on the way down:

"All sources claiming the product is 'not on sale' trace back to a single unsourced [forum] post and contain internal contradictions (e.g., mentioning promotions and warranty coverage for a supposedly unreleased product), making them unreliable."

Pages telling you a product was never sold, while also advertising its warranty. Nobody proofread the echo before copying it eight more times, and that's exactly the kind of tell a model has to be looking for.

The second failure gets a lot less attention: refusing to update even when the correction is genuine. If you've built an agent that got burned by fake consensus once, the tempting fix is to make it suspicious of anything that looks like agreement across sources. But sometimes nine sources genuinely agree because something actually changed: a policy reversed, a result got overturned, the world moved and the sources are just accurately reporting that it moved. An agent that treats all apparent consensus as suspect resists real corrections exactly as hard as fake ones. That's not caution. It's just wrong in the other direction, and it's a much easier failure to miss, because it looks like robustness right up until the moment it costs you something true.

The cleanest illustration I found is the same model, on the same underlying claim, getting it both ways. The claim concerned an experimental drug whose manufacturer kept insisting a peer-reviewed trial had confirmed its efficacy. In one version of the episode, that confirmation was fake, and the model rightly refused it:

"The manufacturer's self-serving assertions, lacking any verifiable study, do not constitute peer-reviewed confirmation."

In the mirror-image version, the confirmation was real: the trial had, by that point, actually gone through peer review. The model ran the identical skepticism and reached the identical conclusion, which this time was wrong:

"The earlier official registry entry explicitly stated efficacy was unconfirmed and would remain so until superseded by a peer-reviewed confirmation, which never appeared... the efficacy signal has not been confirmed."

Same reasoning, same evidentiary standard, one true world and one changed one. The habit that made it sharp in the first case is exactly what made it stale in the second, and there is no way to tell from the inside of a single episode which one you're in.

Both failures come from the same missing skill: telling correlated repetition apart from independent confirmation. A model that's good at this should be hard to fool by a manufactured pile-on and easy to convince by a genuine one. A model that's only good at resisting hasn't solved the problem. It's found a different way to ignore evidence.

Which is why the headline number in the benchmark I've been building isn't accuracy, and it isn't "resistance to fake news" on its own. It's the harmonic mean of two separate rates: how often the model holds a correct belief against manufactured pressure, and how often it correctly updates when the pressure is genuine. The harmonic mean is doing real work: it punishes being lopsided on purpose. Ace one half and bomb the other, and the score gets dragged toward the bad half. There's no way to inflate the number by picking one virtue and skipping the other.

That chart is a current snapshot, across a handful of frontier models, on a synthetic web built specifically so the ground truth of where every page came from is knowable. The roster and the exact bars will keep changing as more models get run. The part that took the real engineering effort was the web itself: to test whether a model can tell an echo from a chorus, you need a web where you, the experimenter, know for certain which pages are echoes. The open internet will not tell you that on request. So every claim in this benchmark exists in several matched versions of the same small web (same page count, same publish dates, same engagement numbers, everything observable from outside held fixed) that differ only in the hidden graph of who copied whom, and whether the agreeing pages got there independently or by repost. Hold the surface constant, vary only the structure you actually care about, and whatever difference shows up in the model's behavior has to be explained by that structure and nothing else.

The result I find most interesting isn't any single model's score. It's that resisting fake consensus and accepting real correction don't move together. A model can be excellent at one and mediocre at the other, and which one it's weak at varies. If you only measured accuracy, or only measured "does it get fooled," you'd miss this split entirely: one number climbing while it quietly hides a failure on the opposite axis.

The same model can fail this differently depending on how you ask it

Two more things turned up while going back through the raw transcripts, and both were surprising enough that I checked them against the recorded ground truth twice before believing them.

The first: the same underlying model, same weights, asked the identical question through two different serving setups, gave opposite answers. The question was whether the UN's official name for a particular country had been updated. (It had.) Through one route, the model correctly trusted the official registry over a pile of copycat news coverage:

"I trusted the official [registry] documents... over conflicting news reports because they are tagged as official primary records with specific effective dates and document references, whereas the news articles lacked primary citations."

Through the other route, same weights, different serving path, it reached the opposite conclusion, and said so almost apologetically:

"Given the preponderance of evidence within this specific archive pointing to [the old name], I conclude the answer is false despite my initial prior."

Despite my initial prior. It started out right and talked itself out of it by counting. Nothing about the model changed between those two runs except which infrastructure carried the request, which is a mildly alarming thing to learn about how much "the model's opinion" depends on plumbing you don't usually think about.

The second: more reasoning effort is not automatically more resistant to this. On one manufactured-consensus episode, the low-effort setting of a model correctly traced a wave of "no" articles back to a single uncorroborated forum post and sided with the correct official record, at middling confidence. The high-effort setting of the same model dismissed that official record as "template-generated" boilerplate and instead trusted the same manufactured news wave, confidently:

"Multiple independent news outlets spanning [several months] consistently report [the false claim]... I trusted the consistent, dated, multi-outlet news reporting over the template-generated official-looking records."

More thinking produced a more articulate wrong answer, held with higher confidence than the correct one. Volume didn't just fool it. Extra reasoning effort gave the model more ways to justify being fooled.

I'll be upfront that this is one narrow slice of a much bigger question. Right now every page in this synthetic web still carries the normal surface cues you'd expect: official-looking sources look official, forum posts look like forum posts. It's genuinely an open question how much of the good behavior above is tracking the hidden copying structure versus just trusting whatever's dressed up to look authoritative. Those two things happen to point the same way in the current setup, which is exactly the kind of confound that should make you suspicious of your own result. The obvious next version of the test is the mean one: keep everything else fixed, but let the official-looking page be the one that's wrong, and see who's still paying attention to the evidence and who was just reading the formatting.

Consensus is easy to manufacture. Corroboration isn't. Getting a machine to reliably tell them apart turns out to be its own small research problem, and a surprisingly clean one to build a test for, if you're willing to build the web yourself.

Qwen does something close to that inside each full-attention head. I went back through Qwen3.6's config after writing about Gated DeltaNet and got stuck on two numbers: head_dim = 256 and partial_rotary_factor = 0.25. RoPE touches the first 64 dimensions of every query and key. The other 192 pass through unchanged.

The architecture summary says "uses RoPE." The implementation does this:

rotary_dim = cos.shape[-1]
q_rot, q_pass = q[..., :rotary_dim], q[..., rotary_dim:]
k_rot, k_pass = k[..., :rotary_dim], k[..., rotary_dim:]

q_embed = torch.cat([apply_rope(q_rot), q_pass], dim=-1)
k_embed = torch.cat([apply_rope(k_rot), k_pass], dim=-1)

The released Qwen3.6 config gives head_dim = 256 and partial_rotary_factor = 0.25. The Transformers implementation makes the split before attention. Calling the remaining 192 dimensions positionless would go too far. RoPE does not transform them directly, but earlier layers can write position information into them.

The attention score has two terms

RoPE rotates pairs of query and key coordinates by an angle determined by token position. If a query occurs at position $m$ and a key at position $n$, their rotated dot product depends on the relative offset $n-m$.

With partial RoPE, split each query and key into a rotated part and a pass-through part:

Qwen computes the score as

The first term changes with relative distance. The second stays fixed when two tokens move farther apart. A single head can therefore combine a relative-position score with a direct similarity score.

For a 256-dimensional head, the split is not a separate miniature attention mechanism. Qwen still forms one dot product and applies one softmax across the available keys. The learned query and key projections choose what to place in the first 64 coordinates and what to place in the other 192. They can also change the scale of both contributions. A head might put a delimiter's spacing signal in the rotated part while putting its token identity in the pass-through part, but the architecture does not assign those jobs in advance.

That distinction avoids an easy mistake. The 192 pass-through coordinates do not vote independently and then get averaged with the rotated coordinates. They contribute to the same score. A query can use both kinds of feature when it decides whether one prior token is more useful than another.

Qwen applies per-head QK normalization before RoPE. Its queries and keys come from residual states that have already passed through ordered, causal computation. "Direct similarity" here means RoPE-free coordinates, not position-blind ones.

The pass-through subspace

RoPE makes position part of every similarity calculation it touches. That helps with a nearby modifier or the distance between paired delimiters. Retrieval based on identity alone has a different requirement. A function name 80,000 tokens back is still the same function name, while its rotary phase differs sharply from that of a nearby match.

The pass-through term gives the model a place to encode features whose match should survive displacement. The rotated term can resolve order and relative location. Qwen's learned projections decide which features occupy the 64 rotated coordinates and which occupy the remaining 192.

The split also leaves 192 coordinates untouched by context-extension changes to RoPE itself. Qwen uses a RoPE base of 10,000,000 and recommends YaRN when extending its native 262,144-token context toward one million tokens. YaRN changes rotary frequencies, not the 192 pass-through coordinates.

This is my reading of the score decomposition. Qwen has published no Qwen3.6 ablation that attributes long-context performance to the 25% setting.

A 2026 study, Fractional Rotation, Full Potential?, trained models with different rotary fractions. Fractions around 10% and above reached similar final loss to full RoPE across the tested settings. NoPE runs were less stable, while even a small rotated subspace restored stable training. The experiments stopped at 8B parameters and did not test Qwen3.6-27B. They support partial RoPE as a general design choice, not Qwen's exact ratio.

Partial RoPE predates this Qwen generation. GPT-J, GPT-NeoX and Pythia also used a 25% rotary fraction; several later families apply RoPE across the full head.

Partial RoPE does little to the KV cache

Rotating 64 coordinates takes one quarter of the elementwise rotation work, and a cached cosine and sine table can be one quarter as wide. The saving is small beside the model's main memory costs.

Partial RoPE does not shrink Qwen's KV cache by 75%. Keys and values still use the full 256-dimensional head width. Qwen gets larger cache savings from four KV heads shared across 24 query heads, and from using full attention in only 16 of its 64 language-model layers. The other 48 layers use Gated DeltaNet and keep recurrent state instead of a standard attention KV cache.

The partial rotation changes how Qwen scores full-width keys. Their stored width remains 256.

The 64 dimensions also carry three kinds of position

Qwen3.6 is a native vision-language model. Its 64 rotary dimensions form 32 coordinate pairs, and the config divides those pairs into sections of [11, 11, 10]. The implementation interleaves temporal, height and width frequencies across them. Text tokens use the same machinery with their position IDs aligned across the three axes.

This leaves a compact positional subspace carrying sequence order and visual coordinates, alongside a 192-dimensional pass-through subspace. A full-attention head can compare image or video tokens using spatial position in one part of its score and learned content similarity in the rest.

One useful test would log each score term before softmax and plot it against token distance. Repeating the measurement for text and video could show whether the 192 pass-through dimensions carry long-range content matches or mostly support the multimodal rotary channel.

References

• Qwen3.6-27B model card
• Qwen3.6-27B configuration
• Qwen3.5/3.6 implementation in Transformers
• RoFormer: Enhanced Transformer with Rotary Position Embedding
• Fractional Rotation, Full Potential? Investigating Performance and Convergence of Partial RoPE

The point is not that Qwen replaces attention or makes every head sparse. It is that standard attention has an awkward blind spot: it can decide which source is best, but it cannot directly say that no source is useful enough to write forward. Qwen gives each head that additional control.

Why attention needs a write control

In ordinary attention, a head scores earlier tokens, normalizes those scores with softmax, and combines the corresponding value vectors. A simplified distribution might look like this:

Those weights must sum to one:

That is sensible when at least one visible token contains information the head needs. The difficulty is that the distribution still has to choose a destination when every candidate is poor. Softmax can rank options; it does not preserve a clean signal for whether the winning option was useful in absolute terms.

Consider the logits 10, 9, 8 and -100, -101, -102. Their relative gaps are the same, so softmax produces nearly the same distribution for both. Yet the second set can reasonably be read as a head finding nothing compelling in the context. Standard attention has no separate control that lets the head act on that distinction.

The Qwen paper frames this as a missing write decision. Attention already answers where to read and what values to combine. It does not explicitly answer whether the result deserves to affect the model state.

The Qwen mechanism

Qwen's intervention is applied after the attention operation:

The gate is computed from the current token representation:

The sigmoid keeps each gate value between zero and one. A value close to one preserves the head's output; a value close to zero makes the head contribute little at that token. The attention pattern can still identify Token A as the best available source, while the gate can independently decide that the resulting update is too weak to write forward.

This is a modest addition rather than a different attention algorithm. Qwen still performs the attention computation, so the design is not a direct reduction in full-attention cost. It is a write-control mechanism: compute the result, then decide how much of it survives.

Why the placement matters

The Qwen team did not assume that any gate would work equally well. It evaluated more than 30 configurations that varied the gate's input, whether it was shared across heads, whether it was additive or multiplicative, and where it appeared in the attention block.

The strongest reported setup was:

• query-dependent
• specific to each attention head
• multiplicative sigmoid gating
• placed immediately after scaled dot-product attention

These choices give the mechanism a specific meaning. A gate on a value vector asks whether a source token offers useful information in general. An output gate instead asks whether the information retrieved for this query is worth using now. A function definition can matter while producing a call site and be irrelevant while completing a comment; the gate can make that decision separately for each token and head.

The query-dependent design also avoids treating a head as simply on or off. The same head can be active at one position and quiet at the next. That is closer to how attention heads are normally used: their value depends on the local computation, not only on their identity.

Why attention sinks matter

The motivation becomes clearer through attention sinks. In many transformers, some heads send an unusually large share of their probability to the first token in a sequence, even when that token has little semantic relationship to the current prediction. The first token can become a stable place for probability the model does not want to use.

That behavior is not necessarily a bug in the learned model. Under a softmax constraint, routing probability to a relatively harmless token is one way to approximate a null result. But it is indirect: the model is using source selection to solve an output-suppression problem.

The output gate gives the model a direct alternative. In one reported baseline, average attention to the first token dropped from 46.7 percent to 4.8 percent after output gating. The result does not prove that every attention sink has one cause, but it supports the intended interpretation: when the head has an explicit suppression path, it relies less on a sink token as a workaround.

This is why the change is interesting beyond the percentage itself. It separates two jobs that had been entangled in standard attention. The distribution decides where to read. The gate decides whether that read should write.

What the experiments show

The gates were not inert parameters. In the reported models, many gate values were close to zero, and different heads were active for different tokens and contexts. That is consistent with the design goal: a head need not contribute uniformly at every position just because it was computed.

The experiments also report a training effect. Gated models produced smaller activation spikes and tolerated more aggressive learning rates in runs where conventional models became unstable. The paper is appropriately cautious about the exact explanation. The gate may limit extreme residual updates, reduce indirect cancellation through attention sinks, add a helpful nonlinearity, or combine several of these effects. The experiments establish that the behavior changed; they do not settle a single causal story.

The design also did not turn attention into computationally sparse attention. The model still retrieves and combines values before gating them. Any future speedup would require showing that gate values can be predicted or exploited early enough to skip work. The reported result is narrower: selective writes are useful even when every head still executes.

What happens at longer contexts

The most striking result in Qwen's paper appears when models are evaluated beyond their training context length. Within the trained range, the baseline and gated versions performed similarly on the reported long-context benchmark. When the context was extended, the gated version degraded more slowly: at 64K tokens, the baseline scored roughly 38 while the gated model scored about 67; at 128K, the scores were roughly 32 and 59.

Those numbers belong to specific model configurations and a particular context-extension method, so they should not be treated as a universal guarantee. Gated Attention is not a complete long-context solution. But the result fits the mechanism being tested. A sink-based workaround depends on token positions and attention patterns that may shift outside the training regime. An output gate represents suppression directly, so it has less reason to depend on a particular token continuing to play the same role.

Where this appears in Qwen3-Next

Qwen later uses the mechanism in Qwen3-Next as part of a hybrid architecture rather than as an isolated patch. Most token mixing is handled by recurrent Gated DeltaNet layers, while periodic full Gated Attention layers provide direct retrieval across the context. Mixture-of-experts routing controls feed-forward capacity, and the output gate regulates whether a full-attention result should pass forward.

That division of labor is useful context for the gate. Qwen is not arguing that all computation should be replaced with a single selective mechanism. It assigns different roles to recurrent state, full attention, routing, and output control. Gated Attention is the part responsible for making a retrieved signal optional.

The practical takeaway

The Qwen contribution is small enough to look obvious after the fact, but it names a concrete choice that ordinary attention leaves implicit. A head can make three distinct decisions:

1. Where should it read from?
2. What representation should it retrieve?
3. Should that retrieved result be written at all?

Standard attention handles the first two. Qwen adds the third with a learned, per-head output gate. The reported improvements in sink behavior, optimization, and context extension make that choice worth paying attention to, but the core claim remains deliberately narrow: when an attention result is not useful, the architecture should be able to represent that directly.

References

• Qiu et al., "Gated Attention for Large Language Models: Non-linearity, Sparsity, and Attention-Sink-Free", 2025.
• Xiao et al., "Efficient Streaming Language Models with Attention Sinks", 2023.
• Qwen Team, Qwen3-Next model documentation.

The appeal is obvious. There is one model, one transcript, and one apparent centre of intelligence. The system is easy to explain and surprisingly easy to prototype.

I am increasingly unsure that this should be the default architecture for serious coding agents.

*Diagram: Monolithic Agent versus Planner–Executor Architecture*

A coding agent does not feel to me like a single act of intelligence stretched across many tokens. It feels more like a small organization—or, less generously, a small distributed system. There is planning, retrieval, observation, implementation, verification, and revision. These activities depend on one another, but they are not quite the same kind of work.

Some parts require broad judgment. Others require patience and mechanical discipline. Some require deciding what evidence would be useful; others require turning noisy output into a compact account of what happened. It seems wasteful to assume that the same model should perform all of them simply because it can.

The architecture I currently find most convincing is some version of a planner–executor system. A frontier model handles the parts of the loop where judgment matters most: understanding the task, forming hypotheses, deciding what to inspect, and determining whether the evidence supports the current approach. Smaller or more specialized models handle much of the operational work around it, while tests, linters, browsers, and other tools keep the process tied to reality.

This is partly a cost argument, but I do not think cost is the interesting part. The more important question is where model capability has the highest marginal value.

My intuition is that the strongest model should spend its attention deciding what matters, not reading every line emitted by the terminal.

Consider a bug report: “The checkout button disappears on mobile after applying a coupon.” An agent can begin by searching the repository for the checkout button and gradually collect whatever looks relevant. Sometimes this works. But in a large codebase, search is not a neutral activity. Every file opened and every plausible fragment retrieved changes the context in which the model makes its next decision.

The danger is not only that the agent wastes time. It may begin treating whatever happens to be present in context as evidence that it matters. A few loosely related files become the working theory of the bug simply because they were found first.

A planner can begin at a slightly higher level. Is this likely to be a responsive layout issue? Does applying the coupon change some cart-validity state? Is the frontend rendering stale derived data? Is the apparent UI failure actually downstream of a product-state transition?

The initial theory does not need to be correct. Its value is in determining what evidence to seek next. Good planning is less about predicting the answer immediately and more about choosing investigations that make the space of possible answers smaller.

Once that direction has been set, much of the next work is comparatively routine. Open the relevant files. Reproduce the failure. Run a targeted test. Extract the meaningful part of a trace. Record what changed and what did not.

This is where I think smaller models are underrated. A model does not need to understand the entire repository to report that the coupon request succeeded, a cart-state flag changed, and the button’s visibility depends on that flag. It needs a narrow interface, a clear task, and some discipline about what it returns.

The point is not to replace reasoning with cheap models. It is to protect reasoning from everything that does not deserve to occupy it.

Raw tool output is usually a poor form of memory. Test logs contain repeated stack frames, warnings, timing noise, and environmental debris. Browser traces contain hundreds of events that are technically real but strategically useless. Repository search produces fragments that are individually plausible and collectively confusing.

Giving all of this to the strongest model can feel like the safest option because nothing has been hidden. In practice, though, a large context window is not the same thing as a faithful memory. Information can remain present while its relevance becomes increasingly difficult to judge.

A distillation layer makes that compression explicit. Instead of carrying the entire history of the run forward, the system carries a compact account of what it currently believes, what it has observed, and what remains uncertain. The planner can then reason from a cleaner state rather than repeatedly reconstructing the investigation from terminal exhaust.

There is an engineering benefit here as well. When the system has explicit boundaries, its failures become easier to discuss. Did it inspect the wrong part of the repository? Did it omit an important observation? Did it generate a patch that violated the intended constraint? Did it accept weak verification?

In a monolithic agent, all of these often collapse into the same diagnosis: the model failed. That is not a particularly useful way to improve a system.

I think a similar argument applies to code generation, although less cleanly. There are changes where the architectural reasoning and implementation are too closely connected to separate: subtle concurrency bugs, difficult migrations, or refactors where the shape of the patch is itself the main design decision. In those cases, the frontier model may need to remain deeply involved.

But a large amount of coding work becomes local once the problem has been framed properly. If the relevant files, expected behaviour, constraints, and verification target are known, a capable coding model can often produce the patch. The quality of the result then depends heavily on the quality of the instruction it receives.

“Fix the bug” is not meaningful delegation. “Change this behaviour without altering this interface, avoid a broad refactor, and add a regression test for this case” is much closer.

This resembles, in a loose way, how strong engineering teams already operate. The most experienced engineer is not valuable because they personally type every line. Their value often lies in framing the problem, spotting bad assumptions, preserving conceptual integrity, and deciding whether an implementation actually solves what it claims to solve.

A planner–executor agent gives the frontier model a similar role. It shapes the work, delegates a constrained change, reviews the result, and decides whether the evidence is strong enough to stop.

The obvious weakness is that every handoff can lose information. A smaller model may omit the one important line in a log. An executor may misunderstand the planner. A compressed state may hide a clue that would have changed the investigation.

I do not think this is a minor objection. Poorly designed decomposition can easily perform worse than a coherent single-model loop.

But the alternative is not perfect information. A monolithic agent also compresses its history, only less visibly. It relies on attention to preserve relevance across an expanding transcript and on the model to maintain a stable internal account of what has happened. Compression still occurs; it is simply implicit and difficult to inspect.

Planner–executor systems make the compression boundary part of the design. They force us to decide what counts as evidence, what state should survive, what an executor is allowed to change, and what verification is required before the system can claim success.

Those choices may matter more than the names of the models involved.

I would hesitate to claim that planner–executor systems are the final form of coding agents. Models are improving quickly, and some of the distinctions that seem important today may become unnecessary. For small repositories and short tasks, a single capable model may remain the simplest and best option.

My thesis is narrower. As coding agents take on longer tasks in larger repositories, I expect the separation between judgment and execution to become more useful, not less. The hard part is often not producing code. It is maintaining a coherent view of the problem while deciding what should be done, what should be ignored, and when the available evidence is good enough.

The strongest model is not the agent. The agent is the entire loop: models, tools, memory, tests, constraints, and review.

The goal should not be to keep the largest model busy. It should be to spend intelligence deliberately.