Context (worked pattern + example, not a core code feature). A compiled "subterranean" agent runs with no runtime orchestrator and learns routing probabilistically — fine for fluency, unacceptable for invariants that must never be probabilistic ("never disclose before identity verification"). Fathom is the missing deterministic layer: persistent compliance structure stays in signed rules + attested audit; transient dialogue lives in the weights. Reframes "orchestration is a cost" → "orchestration is optional, deterministic policy is not."
Proposal. Document + ship an example of the guardrail-sidecar pattern.
- Author the compliance-critical subset of a procedure (e.g. travel/insurance) as a Fathom pack.
- Run it as an MCP/REST/gRPC sidecar; the compiled agent calls
fathom.evaluate before any irreversible/regulated action; deny/escalate hard-blocks regardless of what the weights learned.
- The signed attestation token = proof-of-adherence the weights cannot produce. Persistent cross-session invariants live in
scope='fleet' facts (fleet.py:129); per-turn state stays session-scoped.
Where (existing primitives — value is in packaging).
- Sidecar surfaces:
integrations/mcp_server.py (FathomMCPServer.evaluate :39), integrations/rest.py (POST /v1/evaluate), integrations/grpc_server.py (FathomServicer.Evaluate :173).
- In-loop variant: the
langchain.py/openai_agents.py PolicyViolation + _evaluate_tool_call pattern (langchain.py:87-119, openai_agents.py:84-116).
Acceptance criteria.
Caveats. Adds a network hop the compiled architecture intentionally removed (latency). Guards tool/API boundaries, not the model's words — the agent could act before consulting the sidecar. The compliance pack is hand-authored; Fathom does not extract it from the weights.
Source: arXiv:2605.22502v1 — "Compiling Agentic Workflows into LLM Weights" (subterranean agents). Distilled from arXiv-research/2605.22502v1/analysis.md; file refs verified against current main by the analysis pass.
Context (worked pattern + example, not a core code feature). A compiled "subterranean" agent runs with no runtime orchestrator and learns routing probabilistically — fine for fluency, unacceptable for invariants that must never be probabilistic ("never disclose before identity verification"). Fathom is the missing deterministic layer: persistent compliance structure stays in signed rules + attested audit; transient dialogue lives in the weights. Reframes "orchestration is a cost" → "orchestration is optional, deterministic policy is not."
Proposal. Document + ship an example of the guardrail-sidecar pattern.
fathom.evaluatebefore any irreversible/regulated action; deny/escalate hard-blocks regardless of what the weights learned.scope='fleet'facts (fleet.py:129); per-turn state stays session-scoped.Where (existing primitives — value is in packaging).
integrations/mcp_server.py(FathomMCPServer.evaluate:39),integrations/rest.py(POST /v1/evaluate),integrations/grpc_server.py(FathomServicer.Evaluate:173).langchain.py/openai_agents.pyPolicyViolation+_evaluate_tool_callpattern (langchain.py:87-119,openai_agents.py:84-116).Acceptance criteria.
Caveats. Adds a network hop the compiled architecture intentionally removed (latency). Guards tool/API boundaries, not the model's words — the agent could act before consulting the sidecar. The compliance pack is hand-authored; Fathom does not extract it from the weights.
Source: arXiv:2605.22502v1 — "Compiling Agentic Workflows into LLM Weights" (subterranean agents). Distilled from
arXiv-research/2605.22502v1/analysis.md; file refs verified against currentmainby the analysis pass.