The Session You Cannot Take With You | EARENDIL

• The original promise of inference APIs was simple: send input, get output, keep both—you owned the conversation. Now providers return encrypted blobs, hidden web searches, and opaque compaction that only they can decrypt.
• OpenAI's encrypted reasoning tokens, Anthropic's sealed thinking blocks, and Google's stored interactions mean your local transcript is just a partial view of a session whose operational state belongs to the provider.
• The practical test: can you export a transcript, revoke credentials, and continue with a different provider? Increasingly, no—response IDs aren't transcripts, ciphertext you can't decrypt isn't user-controlled state.
• Multi-agent systems compound this: encrypted inter-agent messages mean you can't audit what agents were asked to do, and automatic server-side compaction happens without your control.
• The same labs that claim training on public internet content is fair use now call distillation from their outputs "attacks"—learning flows into closed models but not back out.

The fundamental architecture of AI inference APIs is shifting from portable, user-owned transcripts to provider-bound state. The original model was elegant: you send input, receive output, and if you keep both, you have the conversation. You could inspect it, archive it, or give it to a different model. That abstraction was never perfect—prompt caches lived on provider GPUs, tokenization differed between models—but the semantic record still belonged to you.

Now providers are returning encrypted reasoning tokens billed to users but returned as opaque blobs, web searches where the model sees source material the client never sees, compacted context only the original provider can decrypt, and encrypted subagent instructions hidden from the application. OpenAI's responses API stores conversations by default and returns encrypted_content that only they can decrypt. Anthropic's thinking blocks are tied to the model that produced them and must be stripped when switching models. Google's Interactions API defaults to store: true with 55-day retention. Each feature has a justification—better performance, privacy, efficiency—but together they mean your local transcript is no longer your session, just a partial view of state controlled by the provider.

The author proposes a practical test: can you export a transcript, revoke credentials, and continue with another provider? This requires five properties: Inspection (can you see what the model saw?), Export (is the session self-contained?), Replay (can another implementation reconstruct equivalent context?), Audit (can a human explain why the system took an action?), and Deletion (can you remove every server-side copy?). They argue for seven specific rules: local event logs should be canonical, storage should be explicit and opt-in, no opaque item should be the sole carrier of meaning, hosted tools need full-fidelity logs, subagent communication must be auditable, compaction must be inspectable, and artifacts must be exportable. The stakes are high for long-running agent sessions that accumulate days or years of context—if that context is locked to one provider, you've lost the ability to switch, debug, audit, or maintain control of your own application's state.