The certificate is the subagent boundary

The agent-era Mythical Man-Month: a subagent parallelizes execution, not the main agent's judgment bandwidth. So delegation looks like a dilemma — trust the subagent's "done" (a gamble; the reported-done vs actually-done gap is the top error class in agent systems), or read its full output (pay the tokens, and lose the context isolation that was the whole point). Both cost.

The dilemma is false. The escape is one object: a certificate — a small, checkable attestation of "it worked" that crosses the boundary in place of the raw output.

Why a certificate is cheap: verification far under-costs execution. Generating a correct output is a search over a large space (rule out every wrong answer, navigate to the needle). Verifying a given output is a point evaluation (check one candidate against the criterion). Searching a space costs far more than evaluating one point. This is the P-vs-NP asymmetry: finding a satisfying assignment is 2^n search, checking one is O(clauses); finding factors is hard, checking p*q = N is one multiply; finding a proof is an undecidable search, checking a proof is linear.

When it holds, when it fails. The asymmetry is real only for witnessable (existential) claims — "these tests pass", "the spec is met", "here is a valid solution". For universal claims — "correct on all inputs", "no bug anywhere", "this is optimal" — there is no finite certificate (co-NP and up); verification is not cheap. So "done" is cheaply checkable exactly to the degree you can reduce it to a witnessable claim. (Same existential-vs-universal split as reaches-1 vs all-reach-1 in the Collatz notes: a witness is checkable, a universal is not.)

The certificate is also the eviction boundary. Context isolation — keeping the main agent's context clean so its judgment does not rot (see context-rot) — is not in tension with verification; it is the same move. What crosses the subagent boundary is the certificate, not the raw output: small to check (cheap verification) and small in tokens (preserved isolation). One object, two payoffs: the subagent boundary is a context-eviction boundary and a verification interface at once.

The residual — nothing is free. A certificate is a lossy compression, so there is a real gradient: too thin (done ok) reopens the trust gap; too rich re-pollutes the context. But a gradient beats the binary. Design goal: certificates with the highest verification-value-per-token — tests, types, structured diffs, invariants, proof obligations. The sharp corollary: a prose "here is what I did" summary is the worst certificate — many tokens, low attestation, and self-generated, so it can lie (that is precisely the reported-vs-actual gap). Delegation approaches free only when the subtask returns a dense, machine-checkable certificate — never raw output, never self-narration.

And the verifier itself can be wrong: a cheaper verifier is a weaker one (a passing test suite is an existential sample, not a universal proof), so it bottoms out in the weak / decorrelated auditor and who verifies the verifier — audit-as-membrane, and recognizer-not-generator (trajectories must carry certificates, forcing an adversarial recognizer), the proof-theory side being lcf-for-labor.

Up: recognizer-not-generator · kin: audit-as-membrane · gatekeeper-not-driver · tdd-net-popper-mechanized · prosthetic-vs-constitutive-scaffolding