Your AI Session Is No Longer Yours: How Providers Seal Reasoning, Search, and Subagent State

The original promise of an inference API was simple: send input, get output, and if you kept both sides of the exchange, you owned the conversation. You could archive it, replay it, or hand it to a different model. That contract is quietly being replaced. A detailed analysis from the engineering team behind the Pi agent harness, published July 30, documents how the major inference APIs are now returning provider-bound state that is deliberately non-portable: reasoning tokens you pay for but cannot read, search results the model saw but you did not, compactions only the original provider can decrypt, and subagent messages sealed in ciphertext.

The essay is worth reading in full because it is concrete rather than conspiratorial. Every claim names the API feature and how it behaves. And the response on the front page suggests this is the moment a lot of developers realized the transcript on their machine is no longer the session.

What the Source Actually Says#

The core claim: a transcript is no longer a transcript. The essay walks through five mechanisms, each with a "basic justification that's trivial for a provider to come up with":

Encrypted reasoning. Anthropic returns thinking blocks with an opaque signature field; the readable thinking text, when enabled, is a summary produced by another model, not the raw chain of thought. OpenAI's Responses API returns encrypted_content blobs for reasoning, which the client must preserve and replay. DeepSeek and other vendors ship similar arrangements. The essay's point: encryption here does not hide data from the provider, it hides it from you. The honest term is "provider-sealed state."

Stored conversations turn your transcript into a pointer. OpenAI's Responses API stores responses by default (the docs say at least 30 days; store: false is available). Google's newer Gemini Interactions API defaults to store: true, with 55-day retention on the paid tier and 1 day on free. When your app only records the user messages and the final text, previous_response_id is a foreign key into a database you do not control.

Opaque compaction. OpenAI's server-side compaction emits an encrypted item the docs describe as "opaque and not intended to be human-interpretable"; the standalone /responses/compact endpoint returns a "canonical next context window" you are instructed to pass on as-is. Anthropic's compaction, by contrast, returns a readable content block with custom summarization instructions. The sealed artifact may preserve more model-specific state and perform better on the original model, but it is lock-in dressed as an optimization.

Hidden searches. Hosted search runs a private tool loop: the provider decides the ranking and passages the model sees, and you get citations and source URLs back. A URL is not a replayable artifact - its contents change, and the snippet the model actually read is usually shorter than what you can fetch. The essay proposes hosted search should have a full-fidelity export mode: queries, result metadata, retrieved passages, timestamps.

Sealed subagent messages. OpenAI's hosted Responses multi-agent beta returns multi_agent_call and agent_message items with encrypted_content payloads, automatically enables server-side compaction for every agent, and injects root and subagent instructions the developer cannot edit. A June 2026 commit in the open-source Codex client, titled "Encrypt multi-agent v2 message payloads," shows the flow: the parent's tool call carries a <ciphertext> message argument, the child sees only encrypted content, and Codex's own inter-agent communication field is empty. An open Codex issue asks for a separate readable audit copy as the minimum acceptable design.

The essay's constructive half is a practical test and a rule set. The test: const transcript = session.export() should be enough for another provider to call continueFrom(transcript) - no dereferencing server IDs, no decrypting blobs. Five checks: inspection, export, replay, audit, deletion. Seven rules for what a portable inference API should promise: the local event log is canonical, storage is explicit, no opaque item is the sole carrier of meaning, hosted tools have full-fidelity logs, subagent communication is auditable, compaction is inspectable, and artifacts are exportable. The essay also makes the distillation argument in the open: if labs can learn from the public internet, and from their own models, refusing others the same flow is a policy choice, not a technical one.

What Developers Are Saying#

The strongest agreement in the discussion was about the direction of travel: several people said they had not realized how much session state was already sealed, and the "boiling frog" framing landed. A recurring practical note was the debugging value of a session: the idea of attaching a full agent session to git history alongside the ticket and the PR, so a future reader can reconstruct why a change happened, resonated widely. One developer said the article pushed them to reconsider a recent closed-model subscription over exactly this inauditability problem. Another is already archiving session data from their coding agents specifically to fine-tune open models later.

The skepticism was just as visible. Some commenters read the piece as a self-serving argument from a harness vendor that benefits from commoditizing providers - a fair charge, given the authors ship a competing tool. Others questioned whether portability is a battle worth fighting, or argued that the real lever is price: if open-weight models keep getting cheaper and better, users migrate and the lock-in question answers itself. There was also a sharp technical exchange about billing transparency: if reasoning tokens are billed but opaque, the operator has no incentive to keep their count low, and the counterpoint that replaying a long context is genuinely expensive under KV-cache economics, which is exactly why stored server-side sessions exist. The thread also debated what dark patterns win in the long run, with a minority arguing the market eventually rewards the respectful option.

Why This Matters More Than Model Quality#

Here is the shift worth internalizing: model lock-in has a well-known escape hatch - you can point the same client at a different endpoint. Session lock-in removes that hatch. Once your agent's accumulated state - compactions, search evidence, subagent delegations, reasoning context - lives as provider-sealed blobs, switching models means starting over. And agent sessions are getting long: a coding session can accumulate days of decisions, and a personal assistant's session log can run for years.

For most developers the practical answer is not to abandon hosted models. It is to use the escape hatches that still exist. Prefer store: false on the Responses API and keep a client-side transcript; the migration guide covers the store semantics in detail. Keep readable summaries alongside anything sealed - the context reduction playbook is the client-side alternative to opaque server compaction. Know what your cache actually does before you optimize for it: the KV-cache economics that make replay expensive are the same economics that make prompt caching the cheapest thing in your pipeline. And if you run multi-agent fleets, treat sealed inter-agent messages the way you treat unreadable logs - an audit failure waiting to happen.

The open-weights argument is part of this story too. The Anthropic open-weights positioning analysis and the broader agentic dev stack both cover why open models keep winning workflows on cost. Add session portability to that list: an open model served from your own stack is the one session you can always export. The essay's seven rules are a good checklist for any tool you build or buy - if a provider cannot say how you inspect, export, and delete a session, that is a feature gap, not a privacy footnote.

The good news is the direction is not settled. Anthropic's compaction returns readable content. store: false exists. The Codex audit-copy issue is open. Providers are still competing on trust as well as price. The essay's demand is modest: the local event log should be canonical, and sealed state should be an optimization with a readable handoff, never the only record. That is a bar every developer can hold their tools to.

Continue Reading#

• OpenAI Responses API Migration Guide - the store semantics, previous_response_id, and what changes when responses live server-side
• Agent Context Reduction: The Pattern That Replaces Server-Side Compaction - keeping your context inspectable and client-controlled
• Anthropic's Open-Weights Position: What the Community Thinks - the distillation debate, from the other side of the fence
• Prompt Caching for the Claude API: A Production Guide - cache hit economics, the real reason providers want server-side state
• The Agentic Dev Stack in 2026 - where open models, harnesses, and hosted APIs fit together

Sources#

• Earendil Engineering, 2026-07-30: The Session You Cannot Take With You
• Hacker News discussion (727 points, 211 comments): news.ycombinator.com/item?id=49118781
• OpenAI Codex commit, June 2026: Encrypt multi-agent v2 message payloads
• OpenAI Codex issue: Request for readable audit copy of encrypted agent delivery
• OpenAI API reference: Compact a response
• Google Gemini API docs: Interactions data storage and retention
• Anthropic, February 2026: Detecting and preventing distillation attacks
• OpenAI: API Model Distillation