Verified result capsules

Agents ask the same questions over and over. Not the same strings: the same questions. Two people point two different coding agents at the warehouse in the same afternoon and both want gross margin by product line. Without a shared layer, each agent plans its own SQL, runs its own scan, and hands back its own answer. That is slow, it is expensive, and worst of all it is inconsistent: two answers to one question, both delivered with confidence.

The obvious fix is a cache. The obvious cache is dangerous. Caching by question text misses almost everything (nobody phrases a question the same way twice), and caching by semantic similarity is worse: a near-match that resolves to different tables, a different metric definition, or a different time window returns a confidently wrong answer, and a cache multiplies whatever you put in it. A wrong answer computed once is a bug; a wrong answer served forty times is an incident.

Capsules, not cache entries

Our unit of reuse is a verified result capsule. A capsule is not a key-value entry; it is a small record of a completed run: the question as asked, the exact SQL that ran, and the result. The part that makes reuse safe is its grounding: which tables, columns, and semantic definitions the answer resolved against, at which versions. A capsule is only written after the run verifies, and it carries the identity the query executed as.

A hit is correspondingly strict. When a new question arrives, the layer resolves its grounding first, the same way it would to plan fresh SQL. Only if that resolution lands on the same grounding an existing capsule recorded does the capsule qualify, and the answer is served with its provenance attached: what it was computed from, when, and for whom. The asking agent, and the person behind it, can see exactly what they are trusting.

What we learned

We expected the win to be latency, and the latency is real: a capsule hit returns in milliseconds where the original run paid for a warehouse scan. But the benefit teams actually notice is consistency. When the second agent gets the first agent's verified answer, the two of them agree by construction. “Two agents, one answer” turned out to be the property people were missing, and no amount of prompt engineering buys it.

The other lesson is that grounding-first resolution is what makes everything else safe. Because a hit requires re-resolving context, a capsule quietly stops matching when the world changes underneath it (a definition is edited, a model is rebuilt) rather than serving a stale answer that merely sounds right.