A research agent's brief carries a claim planted on a page it fetched — which stage owns the finding?

## The situation A market-research assistant follows links off a search step, reads pages chosen at run time, and returns a cited brief. An analyst acts on a claim in that brief. The claim came from a page somebody published for the agent to find, and it arrived wearing the agent's phrasing and a citation to a real URL — indistinguishable, on the page, from what the agent read for itself. Now somebody has to file it, and the first three suggestions are the scraper, the converter, and nothing at all. ## Read the record before assigning blame The artefact that settles this is a per-stage record of one fetch: what each stage received and what it emitted. In this family it reads the same way every time. The parser re-represented the bytes. The boilerplate remover kept the main content region and dropped the furniture. The sanitiser removed the executable markup it is defined to remove and left text node contents untouched. The converter emitted prose byte-identical to those text nodes. The chunker split on its policy and the span landed whole inside one passage. That record is not evidence of a malfunction. It is evidence of the *opposite*, and that is precisely why it belongs in the report: it forecloses the three cheap resolutions before anyone spends a week on them. ## Why each candidate owner is the wrong one **The sanitiser.** Its contract is markup removal for a browser consumer. Asking it to notice a directive sentence is asking for a different component with a different threat model. A change here would also be unfalsifiable as a fix — the same span written slightly differently survives, because prose is what the stage is required to keep. **The converter or the scraper.** Both are defined as lossy transforms in the direction that preserves readable text. If they stopped preserving it, the agent would stop working. There is no version of `fix the converter` that is not `stop reading pages`. **Nothing at all.** This is the resolution that gets chosen most often and it is the one that costs the most later, because the fact that survives is real: an analyst made a decision on an assertion authored by whoever wanted to be found. Closing it as no-fault turns a design property into folklore that gets rediscovered every time somebody new sees it. ## What the finding actually asserts Strip the stages away and the claim is about *standing*. At the moment page text is placed into the context window, it acquires the same standing as the operator's own instruction, and nothing in the chain ever re-derived a trust decision about the source — the fetch step selected the page at run time, and every stage downstream was written to move text, not to adjudicate it. That is a property of how the pipeline was composed, not a bug inside any component of it, and it is the level at which the finding is both true and actionable by somebody. The second half of the finding concerns the payoff. The brief cites a URL. A citation establishes that the agent retrieved that page; it does not establish that the page is authoritative, that a second source agreed, or that a human looked. Readers of briefs read citations as vetting, and the laundering effect — a stranger's assertion re-voiced in the assistant's register — is what makes this worth filing at all, independent of the injection mechanics. ## Bug or design limit Both answers are defensible and the interviewer is scoring how you distinguish them, not which you pick. It is a design limit in the sense that no single component is behaving wrongly and no local change removes it. It is a bug in the sense that the system delivers attacker-authored assertions to a decision-maker under its own byline, which nobody chose and nobody documented. The productive write-up says both: name the property, name who could own a change to it, and be explicit that a change inside any text-cleaning stage does not touch it. Saying honestly what a proposed fix does not fix is the whole value of the report. ## Reproducibility, and the trap in it Expect the reproduction to be uneven. Which pages a run-time selection step reaches varies, and whether the model prefers the planted sentence on a given turn is probabilistic. A finding that fires two times in five is still a finding here, because the survival half — the stage record — is deterministic and demonstrable even when the obedience half is not. Separate the two claims in the report: *this text reaches the context unchanged, always* and *the model acted on it in N of M runs*. Merging them into one confident sentence is how these reports lose credibility with the team that has to act on them. ## How to say it in a loop Lead with the record, not the opinion. `Every stage met its spec, and here is the evidence` is a stronger opening than any ownership argument, and it forces the conversation up to the level where the finding is actually true — what standing fetched prose has when it lands in a context window, and what a citation in the delivered brief does and does not prove.