Blog

After Compression: Shaping and Relocation in Context Engineering

Jerome Louvel ·September 3, 2026

Table of contents

The published token-reduction figures are converging. Commercial tool-discovery engines report savings in the high seventies to low eighties; Anthropic’s tool search tool reports “over 85 percent” against a ~55k-token baseline. Convergence is what a technique looks like when it approaches its limit rather than its potential.

Part of that ceiling is obvious: you cannot compress below what the model must reason over. The larger part is not. A token is not billed once. It is billed again on every loop that follows it — an agent harness is a stateless reducer, so it re-sends the whole accumulated transcript on every iteration. Say each loop adds 5k tokens. A six-loop task does not cost 6 × 5k = 30k; it costs 5 + 10 + 15 + 20 + 25 + 30 = 105k.

That series is K(K+1)/2: cost grows with the square of the loop count, not linearly. Doubling a task from six loops to twelve does not double the bill — it multiplies it by 3.7. The two factors are not equal partners; one is linear in the payload, the other quadratic in the turns. Prompt caching blunts this without removing it, since the growing part — tool results and the model’s own reasoning — is the least cacheable.

So the real quantity is a product, not a size:

total tokens ≈ average context per loop × number of loops

Compression and selection attack the left factor, which is nearly exhausted. Almost nothing attacks the right one, and that is where the failures live. The most expensive tokens in an agent run are the ones you pay again because the previous loop did not succeed. Three techniques are emerging that do attack it: shaping decides what a response contains before it is produced, relocation moves work below the model so it never becomes a turn, and attestation makes the resulting surface inspectable before it runs.

Both have a floor. Compression’s is what the model must reason over, and the published figures say the industry is standing on it. The loop floor is one — the agent has to be asked, and it has to answer — but most tasks run six or ten above it, and the gap is quadratic.

Step	Operates on	Reduces	Ceiling
Compression	The payload, after it exists	Context per loop	What the model must reason over
Selection	The catalog, before disclosure	Context per loop — may add loops	The same corpus, re-ranked
Shaping	The schema, in and out	Context per loop, and retry loops	Needs a contract you own
Relocation	The work itself	Loops	One loop; task shape must be known
Attestation	The surface as an artifact	Build-time failures, not runtime ones	Staleness

1. Compression — the settled step

Summarise the history, truncate the transcript, shorten the payload. The mature end of the practice, and it works. Its limits are architectural, and Anthropic’s Applied AI team states them clearly: a finite attention budget grounded in the transformer’s n² attention, and context rot as recall degrades with token count — Chroma’s study of 18 models held task difficulty constant, varied only input length, and saw performance degrade on tasks as trivial as repeating a word back. A larger window moves the wall; it does not remove it.

Context rot also compounds the loop problem. The transcript grows with each loop, recall falls as it grows, and worse recall produces more loops. Compression damps that spiral but cannot break it, because it never touches the loop count.

2. Selection — choosing what is offered

The next step withholds tools rather than shortening them, and it is now commodity. Anthropic ships it twice over: progressive disclosure, where the model reads tool definitions from a filesystem on demand, and the tool search tool, where definitions marked defer_loading: true are retrieved by regex or BM25.

Selection matters because tools are context — usually the largest and least curated part of it. Anthropic names the failure mode precisely: bloated tool sets create “ambiguous decision points about which tool to use,” and if a human engineer cannot say which tool applies, “an AI agent can’t be expected to do better.” Ranking that ambiguity better does not resolve it — it picks a winner faster. Selection improves the odds of retrieving the right tool from a confused catalog; it cannot un-confuse a catalog it did not author.

And it is the one step that can make the product worse. A deferred tool is discovered by a search call — a turn the agent would not otherwise take — and a wrong retrieval costs a loop to discover plus a loop to recover. Anthropic mitigates exactly this by advising you keep “your 3–5 most frequently used tools non-deferred.” Per-turn savings get measured; loop effects usually do not.

3. Shaping — deciding the response before it exists

Compression shortens sixty fields to a summary. Shaping declares the five the task needs, and the other fifty-five are never projected. The difference is not degree: a summarised field was read, transported and processed, while a shaped-out field never traversed the boundary. It cannot leak, cannot be misread, and cannot appear in a transcript — and it removes loops, because a response shaped to the task needs no follow-up call for the missing field.

Shaping cuts both ways, and the inbound direction is the cheaper win. A declared input schema — enforced by constrained decoding or strict tool grammars — makes a malformed tool call unrepresentable rather than correctable. The retry it prevents is the worst kind of loop: an invalid argument, an error, a re-read of the whole transcript, two turns to arrive back where you started. Preventing one such retry beats compressing every payload in the run.

This requires something selection does not: a contract you own rather than inherit. If your tool surface mirrors an upstream API, the response shape is the upstream’s decision and you are back to compressing what arrives. Shaping and output parameter mapping arrive together — one is the mechanism of the other.

4. Relocation — changing what the work is

Every technique below this one accepts the work as the model’s and negotiates how much to show. Relocation asks whether the model should do it at all — and because the model’s work is what a loop is, moving the work moves the loop.

Take a request an agent gets constantly: “has this customer’s latest invoice been paid, and if not, who owns the account?” Three systems, and the model does the joining. It looks up the customer; takes the ID and fetches invoices — the whole list, because the API paginates and the filter it wanted is unsupported; scans the payment status; calls the CRM for the owner; composes the answer. Four loops, each re-sending everything before it, including two payload dumps it needed one field from.

Declared as a capability, the same request is one call: the upstream calls, the ID hand-off, the pagination and the status check run in the engine, and what returns is { invoice_id, status, amount_due, account_owner }. At 5k per loop that is 50k versus 5k — a 90% reduction, none of it from compression. Halving every payload instead would reach 25k and stop, because the loops are still there.

The cheapest token is the one you never put in the context window. The cheapest loop is the one the agent never has to take.

The pattern generalises: choosing among operations, sequencing calls, correlating responses, paginating, retrying. Each is model work today, each is a turn, and each can be declared once by an author instead of re-derived every run. And note where the scenario lands — one loop, the floor, reached in a single move. The remaining headroom is not in how small a context can get. It is in how few times you send it.

Relocation’s ceiling: it needs the task shape known in advance, and a novel task has no declared path waiting for it — the invoice question is worth declaring precisely because it gets asked a thousand times a day.

5. Attestation — the surface as an artifact

Every step so far makes the context smaller. None makes it answerable in advance. The question is not what this agent reached — logs answer that — but what it could reach, if it were confused, or manipulated, or unlucky.

That question needs a subject. If the surface was ranked by a retrieval index when the agent asked, there is nothing to read; if it was generated at runtime, there is not even a repository. Audit tells you what happened; it cannot tell you what could happen. We argued the longer version in Applied Capabilities: computed URLs, branching and dynamic dispatch defeat static analysis, and runtime shaping is worse, because the surface does not exist yet.

So attestation is not a security feature bolted on at the end. It is what becomes possible once shaping and relocation have produced a declared artifact — tools, fields, upstream operations, and a credential authorising exactly those and nothing else, in a file linted, diffed and reviewed before anything runs. An agent may well have written that file; what matters is that a human saw it in between. It pays a second time in loops: a surface linted at build time is one whose stale endpoints and broken schemas are caught by a pipeline rather than discovered by an agent mid-run, and a mid-run discovery costs a failed call, an error, and a re-plan.

What this is worth, and the headwind

Latency — loops are serial, so three round-trips collapsing into one is not a 3× token saving; it is three round-trips of wall-clock time replaced by one. Cost — the dominant term on any non-trivial task is the transcript re-sent every turn, so removing turns beats shortening them. Risk — undeclared fields cannot leak because they never project, the agent never holds the upstream credential, and every turn removed is one less opportunity for injected content to redirect the run.

Name the bill too. All three move work from the model back to the developer: someone writes the schema, declares the steps, maintains the spec. That is the shift-left trade — deterministic guarantees bought with engineering discipline, reliability bought by narrowing open-ended adaptability. A good trade for the thousand-times-a-day path, a bad one for genuinely novel work.

The honest headwind: Anthropic expects agentic design to trend toward “letting intelligent models act intelligently, with progressively less human curation.” If models navigate two hundred tools reliably, selection loses much of its argument. It probably will.

Relocation is largely exempt. A better model takes fewer wrong turns, shrinking the recovery loops — but it does not make three sequential calls into one, or a correlation across two responses free. Those loops are properties of the task decomposition, not of reasoning quality. Attestation is exempt for a different reason: trust is not a model-capability problem. No amount of intelligence tells a reviewer what an agent is able to reach — a property of the boundary, not of the thing reasoning inside it.

Compression got the practice started. Shaping, relocation and attestation are where it is going: the first two attack a quantity everyone has been treating as a sum when it is a square, and the last is the only one that produces something to sign.

Subscribe to the Naftiko Manifest

Want to learn more and stay up to date on the latest from Naftiko? Get new posts, releases, and signals from the capability fleet in your inbox.