Context is part of the system

An agent can have a capable model and still make a bad call because the system gave it the wrong slice of reality. The calibration changed yesterday. The file belongs to a different experiment. The derived quantity has no provenance. The tool named compare deletes. The requested action exceeds the user’s authority.

None of those are prompt-writing failures. They are systems failures, and I have spent the last two years building around that observation.

The thesis

CLIO gives agents what databases give applications: structured, reliable, queryable state. A model on its own has a context window. A scientist has terabytes on a parallel file system, a Slurm queue, instrument metadata, a decade of provenance, and tools with side effects. Something has to select from that world, shape it for one decision, and record what it chose. If that something is invisible, the agent’s answer is unauditable no matter how good the model is.

So “context” in CLIO is not a paragraph pasted before a question. It is a runtime product: content, metadata, current state, provenance, tool contracts, policy, and the boundary of human approval, assembled for a particular action and written down.

What that looks like in code

Clio Coder is the component where I have pushed this the furthest, because I write all of it.

Selection is bounded. Every observation tool returns through a truncation envelope with offload paths and next hints, so a large result is bounded rather than silently cut. One grep cannot blow the window. The compiled prompt and tool schemas stay byte-stable across turns so a local model’s prefix cache stays hot, and the ledger records a cache verdict per call.

Authority is typed. Twenty tools sit in seven policy planes. Bash is default-deny. The autonomy dial decides what runs immediately and what parks for approval; it never widens the tool surface. A worker can only narrow the orchestrator’s authority, never exceed it. Reviewers and judges run read-only. Since v0.3.7 a dispatch carries typed intent: read roots, write roots, expected outputs, and the verification checks the host runs afterwards with no shell.

Everything leaves a receipt. A run seals tokens, priced cost, tool activity, safety decisions, routing, worker attestation, and result conformance. clio-coder evidence inspect reads it back. Nothing in the audit trail is reconstructed from prose, because prose is exactly the thing you cannot trust an agent about.

That is the shape I want across CLIO, not only in the coder: selection, rejection, authority, and action, with a receipt another person can check.

More context is not the goal

Context windows invite an easy metric: fit more tokens. Scientific context does not become correct when it becomes large. A smaller, well-scoped package with provenance beats a giant retrieval dump. A refusal caused by missing authority beats a plausible action. An explicit conflict between two measurements beats a smooth synthesis that hides the disagreement.

The objective is the smallest sufficient context for a bounded action, with enough provenance and state to make the result inspectable.

Context is a data-movement problem

At scientific scale the right evidence lives in object storage, a parallel file system, an instrument buffer, or another site. Moving all of it toward a model wastes bandwidth; summarizing too early erases the feature the agent needs. Where filtering happens, which representation moves, what gets cached, when a derived object is safer than the source: these are the questions Hermes and LABIOS asked about I/O, and IOWarp’s transfer and assimilation engines ask them again with an agent on the other end.

What is unresolved

I do not have a universal schema for context and I doubt one exists across instruments, simulations, and organizations. Provenance describes a chain without proving its inputs were right. A perfect receipt does not repair a biased selection policy. Retrieval quality, adversarial content in retrieved text, changing permissions, and the cost of keeping history are all open. And context can expose the thing a system is meant to protect, so minimization and redaction have to happen before data reaches a model, not after generation.

The model matters. But the model acts inside the reality the surrounding system constructs. Design, test, and audit that layer like any other component.