Abstract

Multi-agent LLM pipelines tend to forward a growing transcript — the source document plus every prior agent's output — into each downstream prompt, so token cost grows with pipeline depth. The obvious fix is to pass a reference to shared content instead of re-sending it. This paper measures that fix honestly instead of advocating for it, and the results are more nuanced than the pitch.

In a controlled experiment (n=33 real Claude generations across Haiku, Sonnet, and Opus; three context strategies; accuracy scored by a deterministic, model-independent rubric checker), both reference-minimization (TOAP) and a competent summarizing orchestrator cut downstream tokens with no accuracy loss — all 33 samples scored 4/4. But the summarizing baseline saves more tokens than TOAP (~2.5x vs. ~1.9x over the naive baseline). So reference-minimization is not a token win over good prompt engineering.

What it offers instead — measured here rather than just asserted — is:

Losslessness. A reference can be re-expanded; a summary cannot. On a pre-registered task where a faithful summary necessarily drops detail, a downstream responder scores 8/8 with the reference vs. 6/8 with the summary, failing exactly on the dropped facts. The same direction replicates on two open, non-Claude models (Qwen2.5-7B and Mistral-7B).
Security. Provenance travels with the reference. Against an adversarial corpus of 40 attacks across nine categories, the capability lattice blocks all 40 attempts to drive a side-effecting operation from untrusted content, with zero false positives on 14 benign read/analysis requests — a guarantee that doesn't depend on how the injection is phrased. Two documented blind spots are reported as well.

On the compute side, a same-model KV-cache transfer is implemented and measured across seven open models: reusing a transferred prefix cache is a real, near-lossless prefill speedup (35/36 cells byte-identical; up to ~180x at long context) — but the cache is thousands of times larger than the text, so it only pays off when agents are co-located or use grouped-query attention. That result grounds TOAP's gating policy in measurement rather than assumption.

Wire bytes, model tokens, and compute are kept as separate cost planes throughout — symbolic "opcodes" save 50% of bytes but only 0–17% of tokens. The paper describes the protocol architecture (a two-plane wire format; a reference-materialization spectrum) and a Rust reference implementation. Threats to validity are first-class: a single model family/tokenizer for the token study, a same-family judge used only as a secondary check, and small n. The mechanism itself is not novel (blackboard systems, A2A artifacts, ADOL) — the contribution is the honest, reproducible accounting.