Case packet
Neutral case identifier: case-1989c918c7946c
The possible directed relationship from Artifact A to Artifact B is under review.
Artifact A
Compiling a coordination strategy preserves primitive authority but expands aggregate authority
A prompt that drives a multi-step task does its coordination through repeated inference: the model selects agent A, reads the result, selects B as the next step, loops, and eventually returns. Each coordination step is paid for with a fresh inference pass, and the strategy that links them is inferred again at each turn. In the Claude Code case, the workflow is a [dynamic workflow], a sandboxed script-over-agents system. It is the compiled form of the same coordination: the call-A-then-B-then-loop logic is lifted out of repeated inference and written as an explicit external artifact that a runtime executes directly.
The entry intuition is the compiler analogy. A prompt-driven run is interpretation — the coordination plan is recomputed on every step. A workflow is compilation — the plan is fixed once in an artifact and then run. This is [codification] of the strategy for choosing the next agent or tool call in a [bounded-context orchestration model], a view of orchestration as repeated choices about the next context-limited agent or tool call: the coordination logic crosses from natural-language that each turn asks the model to infer into a symbolic artifact a runtime consumes.
What compilation preserves, and what it does not
The load-bearing distinction is between two things "authority" can mean, which the compiler move splits apart.
The primitive action alphabet is preserved. The script can compute, branch, loop, and coordinate, but it cannot itself touch the filesystem, the shell, the network, or external services. Every effectful operation must be delegated through agents and tools that the original prompt could already call. So the compiled form adds no new primitive effect channel: the set of operations that can touch the world is exactly the set the un-compiled strategy already had. This is the genuine guarantee, and it follows from the artifact being sandboxed and channel-less — every real-world effect is delegated to a pre-existing tool or agent. This is the same boundary the [different-tools forcing case] draws between an action alphabet — the authorized set of effectful operations agents and tools can perform — and bookkeeping. A workflow gets to compose calls and project state; the alphabet of any actual effect is still set by the agents and tools it dispatches to. It selects from the authorized surface; it does not construct a new action primitive.
Aggregate authority is not preserved — it expands, on the same axis as capacity. It is tempting to say compilation expands capacity (state, context window, agent count, duration) while leaving authority untouched, treating them as orthogonal axes with different sources. That separation does not hold. A single inference turn / single context window was bounding two things at once: how much the coordinator could compute and how many effectful calls it could emit before the turn ended. The context envelope was a security control as much as a compute limit. Compilation's entire value proposition is escaping that envelope — and every capacity gain it lists is also a magnitude-of-harm dimension:
- store state across steps and run long → sustained, low-and-slow effect sequences
- exceed a single context window → exfiltration volume the turn could not stage
- coordinate many agents (a documented 1,000-agent cap) → effect at machine scale
- run far longer than any single inference → dwell time and rate-based-detection evasion
"Delete one file when asked" and "delete files in a loop until the tree is empty" are the same primitive and wildly different authorities. A delegated channel governed by a permission model is almost always governed per call, not per aggregate — so the per-call gate that authorizes each delegated effect does nothing to bound their sum. The only thing that bounded the sum was the context envelope, and compilation removes it. So capacity and aggregate authority are not two axes; they are one axis, freed together. This is the same persistence dividend the [host-language scheduler] collects — except that the dividend is paid in reachable effect, not only in reachable compute.
Where a preservation claim still holds
A preservation result survives, but a narrower one. Authority in the sense that matters to security is the practically reachable set of world effects, and by that measure the compiled form reaches combinations and volumes the prompt never practically could — that is exactly what the capacity gains above amount to. So "channels the un-compiled strategy already had" is true only as a claim about the primitive alphabet, not about reachable effect.
The aggregate boundary is preserved only for a specific channel class: non-composable, per-call-saturating channels — those whose own per-call authorization already bounds their aggregate use (a delegate that rate-limits itself, enforces a quota, or is idempotent). For those, looping buys nothing. For everything else, compilation expands what the system can cause. The documented dynamic-workflows case is not in that class: delegates carry inherited session allowlists and per-call permission only, with no aggregate policy. The direct guarantee there is narrower than a whole-system safety claim: the script has no direct filesystem, shell, or network APIs, and delegated agents bring their own enforcement — but that enforcement is per-call, so the aggregate is exactly what stays unbounded.
Why the compiler analogy leaks on both axes
Calling a workflow a "compiled prompt" undersells it on capacity: a cached execution would only replay what one inference did, whereas persistence and externality give the workflow state, scale, multi-agent coordination, and duration a single inference cannot have. So the analogy understates what compilation gains.
The analogy is not exact on authority either. Real optimizing compilers change effective authority routinely — dead-store elimination removing a memset that zeroed a secret is a shipped security regression; reordering and vectorization produce machine-level effect sequences the source never expressed. "Compilation preserves semantics" fails precisely at the edges that matter for security. What compilation preserves here is the primitive alphabet; what it changes — like a real compiler — is the effect sequence the alphabet can be driven through.
General form
A workflow is a compiled coordination strategy — explicit, reusable, persistent. Compiling a coordination strategy into an external artifact preserves the primitive action alphabet: it adds no new effect channel and must delegate every effect through channels the un-compiled strategy already had. But it expands two things that turn out to be one — computational capacity and aggregate authority — because the single-context envelope it escapes was bounding both the compute and the effect-volume of a run. Authority in the primitive sense (what kinds of effect are reachable) is pinned by the sandbox; authority in the aggregate sense (what magnitude of effect is reachable) moves with capacity. The clean preservation result holds only for delegated channels whose per-call authorization already bounds their aggregate use; lift the sandbox entirely and even the primitive alphabet is gone.
This reframes the [system-definition artifact] view — artifacts the system consumes as binding instruction, configuration, or routing — from the authority side. Crystallizing reasoning into an artifact addresses context scarcity; crystallizing a coordination strategy additionally buys execution capacity — but that capacity is not authority-neutral. It pins the primitive alphabet while moving aggregate authority, because the same persistence that buys compute also buys effect-volume.
Open Questions
- Sequencing previously isolated calls is sometimes posed as composing individual authorities into an emergent one (read-secret then network-post = exfiltration). In this system the coordinator already bridges isolated agents — it reads one result and passes it to the next across turns — so the trajectory was already reachable in interpreted form; compilation makes it cheaper and repeatable, which is the aggregate-scale point above, not a separate composition primitive. Is there a system where inter-agent isolation is the boundary, so composition manufactures genuinely new primitive authority?
- Can the per-call-saturating channel class be characterized precisely enough to validate it — i.e. given a delegate, decide whether looping it expands reachable effect? That is what a real preservation theorem would need.
- The script is not strictly side-effect-free even before delegation: it spends a shared token
budget, schedules concurrent agents to a hard cap, and journals results — observable resource effects (denial-of-wallet, resource exhaustion) that are themselves a form of aggregate authority. How should these be folded into the boundary model?
Relevant Notes:
Artifact B
Any symbolic program with LLM calls is a select/call program
The decomposition lemma
Claim. Any program whose execution consists of:
- symbolic computation over explicit machine state
K - LLM calls
r = call(P)
can be mechanically converted into the [base loop]:
while (P := select(K)) is not None:
r = call(P)
K = K + r
with select a symbolic function that returns either the next prompt or None, and with the same LLM calls in the same order.
Here K must contain the full symbolic machine state needed to resume execution: original inputs, prior call results, control location, loop counters, phase tags, pending work items, and any other symbolic locals the program consults between calls.
K + r means incorporating the call result into explicit symbolic state. In the simplest event-sourced case this is append-only: K stores the full trace, and later symbolic steps recompute derived views from it. Implementations may also cache derived state, but those caches are still explicit parts of K.
Why. Define select(K) as: run the program's symbolic transition logic from the current machine state until either program halt or the next LLM call site is reached. If symbolic execution reaches halt first, return None. If it reaches an LLM call site first, emit that prompt P.
Because all inter-call computation is symbolic, this check is exact. The halt-or-next-prompt decision is therefore a function of the current symbolic state alone. Iterating this construction reproduces the original program's call order and prompt contents, so the transformed loop makes the same LLM calls in the same order.
This is not a special property of LLM programs. It is the standard move behind operational semantics and abstract machines: execution is represented as transitions over explicit configurations, and control state that was implicit in source structure is reified into data.
Consequence. Once a program is shown to satisfy the preconditions, the base model's three invariants — per-call context limits, explicit state in K, symbolic orchestration — hold by construction. No additional invariant proof is needed for each program beyond checking those preconditions.
The ergonomic direction
The practical value runs opposite to the conversion: write in whatever style is natural (sequential phases, map/filter pipelines, nested loops) and the lemma guarantees it's a valid select/call program. You never need to flatten into a monolithic select — you just need to know you could.
Scope
LLM-mediated scheduling. The lemma requires inter-call computation to be symbolic. When the program uses an LLM call to decide what to do next (an [LLM-mediated scheduler]), that symbolic-computation precondition is violated and the symbolic-orchestration invariant no longer holds by construction.
Concurrency. Independent fan-out, barriers, and merges still fit the model: pending tasks and partial results can be represented in K, and the scheduler can serialize the coordination logic without changing which LLM calls occur. The real boundary is not concurrency itself but interaction that cannot be reduced to symbolic state transitions between calls — for example, mid-call visibility into another in-flight call, or dependence on external mutable state that is not represented in K.
Known lineage
The basis for the construction is standard programming-languages machinery rather than a special theorem about LLM systems:
- Small-step / structural operational semantics represents execution as transitions over machine configurations.
- Abstract-machine compilation reifies control state explicitly so the next transition is a first-order function of the current state.
- CPS plus defunctionalization is the classic route when control flow needs to be turned into explicit symbolic state.
This note applies that generic compilation move to the specific case where the only non-symbolic steps are LLM calls.
Open questions
- The [decomposition heuristics] might be expressible as transformations that increase call count while decreasing per-call complexity — the lemma guarantees the transformed program is still a valid select/call program.
Relevant Notes:
Under-review context phrase
formalizes why a workflow script's JavaScript control flow and local variables instantiate the same select/call shape as the prompt-driven strategy