This is a builder's log, not a launch. I'm in the middle of a problem and I want to think out loud about it, because the people who replied to my last post moved my thinking more than a month of solo work did.

The moment it clicked

Last week Copilot told me a match scheduled for June 12 was still going to happen. Confident, future tense. I was reading it on June 20. The match was over.

The data wasn't wrong when it was retrieved. It went stale in the gap between retrieval and the moment it reached me, and nothing in the pipeline noticed. The agent had no sense of "now." It treated a fact from eight days ago exactly like a fact from eight seconds ago.

That's the thing I keep running into. We've taught agents to retrieve and to reason. We haven't taught them what time it is.

Background: what I've been building

I work on FreshContext, a judgment layer that sits between retrieval and reasoning. Any retriever (vector DB, web search, RAG, a tool call) hands it candidate context. It returns a verdict: use this, refresh it, verify it, exclude it, before the context reaches the model. It doesn't fetch anything itself. That boundary is on purpose, and it matters later in this post.

For a while the verdict included a safe_for_agent_handoff boolean. Felt solid. It wasn't.

The comment that broke my assumption

A commenter, ANP2 Network, made a point I couldn't argue with:

"An annotation, however structured, is something the next agent is trusted to respect. Infrastructure is something the next agent cannot route around without leaving a trace."

A boolean is a field on an object. Any step downstream can flip needs_verification into safe_to_cite and leave no fingerprint. A structured verdict raises the cost of ignoring it, but it doesn't make tampering visible. ANP2 was describing the same disease as the Copilot match, from the other end: a judgment that was true once and gets trusted forever, with nothing recording when it was made or whether it still holds.

Two symptoms, one illness. The verdict has no sense of time and no proof of origin.

Where I've landed (and the part I'm least sure about)

I weighed two fixes.

One: let the judgment layer itself become the verifier. Every pipeline routes through it for a yes or no.

Two: keep the layer pure. It produces a verdict, signs it (HMAC, secret stays server-side), and stamps evaluated_at so the verdict carries its own age. A thin wrapper around the agent checks the signature and enforces. Any downstream agent can hit a verify endpoint to confirm the verdict really came from the layer and the content hasn't changed.

I went with two. The reasoning: the second the judgment layer starts adjudicating instead of judging, it becomes a gatekeeper every pipeline has to pass through. Bigger attack surface, harder to adopt, and honestly a worse product. The no-fetch, no-enforce boundary is what lets other people drop this into their own stack instead of handing control to mine.

Against the two failures that started this:

• The silent flip: rewriting the verdict breaks the signature. Verify says no. The omission stops being invisible.
• The stale match: evaluated_at means the verdict knows how old it is. A downstream step can refuse a verdict that's aged out instead of trusting it on faith.
• And the multi-agent case (someone raised this directly under the last post): Agent B stops trusting a verdict just because Agent A handed it over. B verifies the signature. One agent faking a score doesn't infect the next.

Here's what I'm still not sure about, and where I'd want a sharper eye than mine:

1. The wrapper is opt-in. Skip it and you're back to advisory. Is "provable, enforced only if you choose to" real enforcement, or annotation with a receipt?
2. Stateless verify is a network call at every real decision point. Cheap, not free. Where's the line where the latency isn't worth it?
3. Signing proves origin and integrity. It doesn't prove the verdict was right. A perfectly signed bad judgment is still bad. Am I solving the trust problem or just moving it somewhere quieter?

If you want to look

It's running. I'd rather you test it than believe me.

• Run locally: npx -y freshcontext-mcp@latest
• Live MCP endpoint: https://freshcontext-mcp.gimmanuel73.workers.dev/mcp
• The full approach, the boundary, and what's live vs roadmap: https://freshcontext-site.pages.dev/context-integrity
• Source and the verdict shape: https://github.com/PrinceGabriel-lgtm/freshcontext-mcp

Throw stale context at it. Try to make it bless something old. Tell me where it falls over.

Credit where it's due

ANP2 Network's comment is the reason this post exists. A good critique from a stranger is worth more than agreement from a hundred. If you've pushed on this in the threads and I haven't named you here, that's an oversight, not a snub, say so and I'll fix it. I read everything.

I'm building this from Grootfontein, Namibia, solo. Thinking in public is the only way I've found to think well. So: tell me where I'm wrong.