Composition Is Not a List.

01 · The capability moment

Four ecosystems, one word, four different meanings.

The convergence is real and it is recent. It is worth being precise about who did what, because the argument on this page depends on the difference between having capabilities and composing them.

The protocols are converging institutionally. Their composition semantics are not. — A2A joined the Agentic AI Foundation on 17 August 2026, alongside MCP, AGENTS.md, goose and agentgateway. This page was written the same day.

02 · Composition is not aggregation

A list tells you what is present. An algebra tells you what happens when things meet.

Here is the concrete test. Given capabilities=[A, B, C], answer these six questions using only the list. You cannot answer any of them.

Every one of those six is a question about what the combination means, and each has a standard mathematical answer. The rest of this page is those answers, in the order you would need them.

03 · Two operators

Two ways things meet: side by side, and one after another.

[&] has had exactly these two operators since draft v0.1.0, before either had laws attached. Look at the shapes before the terminology — the terminology is only a name for what you can already see.

04 · What laws buy you

Every algebraic law is an engineering question in disguise.

Two things are worth noting about that last row. First, it is the only law of the five that is about refusal rather than rearrangement. Second, it is the one most composition systems don't have — which is the subject of the next section.

05 · Zero is an answer

An incompatible composition is not an error. It's a value.

Four things collapse a composite to 0̲, and they are checked in this order, before any scoring happens at all.

The certificate a composite carries

Because refusal is a value rather than an exception, it can carry an explanation. Every composite — surviving or annihilated — ships a certificate saying which gate decided and why.

// (retrieve |> act) |> consolidate  — with a backward step introduced
{
  "subject":  { "kind": "weave-composite", "parts": ["a1c4…", "7f20…"] },
  "analyzer": { "name": "compose", "version": "0.1.0" },
  "verdict":  {
    "certified": false,
    "costClass": "unknown"
  },
  "policy": {
    "resourceDecision": "annihilate",
    "reason": "π-violation: cannot chain 'act' after 'consolidate'"
  }
}
// result: 0̲  — and no amount of utility on the surviving steps changes it.

06 · Composition creates new failures

Correct components do not imply a correct composition.

Measured: 30 failures that appear only when protocols are composed

Formal Security Analysis of Agent Protocol Composition (AgentThread) analysed five protocols — MCP, A2A, ANP, ACP-Cap and ACP-Client. It reports 35 specification-level findings, supports them with 80 implementation tests against production SDKs and MCP reference servers, and then finds 30 additional failures that emerge only under protocol composition — failures invisible to any analysis of a single protocol.

No protocol assigns enforcement for cross-protocol behavior. — AgentThread. The paper's conclusion is that insecurity here is "not only a specification or implementation problem, but also a responsibility gap across protocols, SDKs, and deployments."

Proven: safety does not compose, and the dependencies are not pairwise

Safety is Non-Compositional: A Formal Framework for Capability-Based AI Systems (Spera) contains what it describes as the first formal proof that safety is non-compositional in the presence of conjunctive capability dependencies — cases where a capability requires several others simultaneously. The paper argues these need hyperedges with multi-element tails, because a pairwise graph can only encode single preconditions and so cannot express "A and B together unlock C" without inventing intermediate nodes that do not exist.

Roughly two in five real agent trajectories already contain the structure that makes safety non-compositional. That is the empirical case for treating composition as its own layer with its own refusal semantics, rather than as a property you can infer from well-behaved parts.

07 · Hand-offs are compositions

Where multi-agent systems actually break, measured on 824 hand-offs.

Each of those four is refused by a different part of the composition machinery — and each is refused at compose time, before the pipeline runs, rather than diagnosed afterwards from a transcript.

08 · Reliability composes too

The "three agents is the ceiling" rule is not folklore. It's arithmetic.

Move the sliders. The curve is cn, and the threshold line is whatever the consuming step demands before it will accept the input.

09 · Communication is not governance

Six things a group of agents needs. The protocols express one and a half.

That conclusion — governance belongs in a layer above interoperability, not inside it — is independent confirmation of a design decision [&] made for its own reasons: it does not replace MCP or A2A, it compiles into them, and it keeps the verdict layer separate from the transport. The State column below is ours, and it is deliberately unkind.

10 · Capability → coalition

One agent holding capabilities is the easy case.

{
  "coalition": "ship_it",
  "agents": ["dev", "qa", "ops"],
  "ensure": "deployed AND tests_pass",      // can the group FORCE this?
  "common_knowledge": ["release_plan",       // not just known — commonly known
                       "rollback_ready"],
  "owns": { "dev": "build",                  // every task has exactly one owner
             "qa": "verify",
             "ops": "release" },
  "shield": ["NEVER secrets_leaked"],       // safety over the JOINT trajectory
  "floor":  ["entrench: no_prod_without_qa"], // un-weakenable, even by learning
  "compose": "build |> verify |> release"
}

The interesting clause is ensure, because it is the one that can refuse a plan that is otherwise perfectly well-typed. In the worked example, the full coalition can force the goal — but dev alone cannot. So a dev-only coalition is inadmissible and escalates to recruit QA and ops, rather than starting work it cannot finish. That is the Capability Gap from §07, caught before the hand-off instead of after it.

And floor is the clause that survives learning. A coalition may revise anything it likes as it gets better at its job — except the entrenched floor. If it later discovers a faster path that skips QA, the floor refuses the improvement. That refusal is the feature.

11 · Compose it yourself

Don't trust the diagram. Snap two bricks together.

12 · Break it

Three of our laws do not hold. Here is the one you can feel.

A page arguing that composition needs laws would be worthless if it hid the laws it fails. The compose suite runs 2000 trials per law and prints three lines in red on every single run, by design — the build breaks if one of them ever starts passing, because that is the signal the fix landed and the law should be promoted into the real suite.

Why this is not simply "our commutativity law is wrong"

It would be easier to report if it were. The precise situation is more specific, and worth stating exactly:

The root cause, which is one bug wearing three hats

"The pipeline is non-associative" is a symptom, not the disease. The disease is that the phase carrier is a single slot. The merge sets it with a first-non-null rule, which is order-dependent, and the pipeline's floor reads it. So merge order writes a value that pipeline safety later depends on — and the three failing laws are three routes to that same leak. A left-fold-only pipeline would close CP5 and CP6 and not CP7, because there is no re-grouping to outlaw in CP7. Only carrying an [entry, exit] phase interval instead of one slot closes all three.

13 · The broader formal landscape

The field is independently reinventing this problem.

Look at where these independent lines of work are pointing. That is the layer. — The claim is not that others missed it. It is that everyone is arriving at the same place, and the place needs a runtime.

14 · Compile outward

This does not replace MCP or A2A. It compiles into them.

Concretely, the reference implementation takes a declaration and emits both wire formats:

# the reference CLI lives in the Elixir implementation; example paths are relative to it
$ cd AmpersandBoxDesign/reference/elixir/ampersand_core
$ mix deps.get && mix escript.build
$ ./ampersand validate ../../../examples/infra-operator.ampersand.json
$ ./ampersand compose  ../../../examples/infra-operator.ampersand.json
$ ./ampersand generate mcp ../../../examples/infra-operator.ampersand.json
$ ./ampersand generate a2a ../../../examples/infra-operator.ampersand.json

# the law suites live in the kernel package — a DIFFERENT directory
$ cd AmpersandBoxDesign/box-and-box
$ node test/laws.mjs           // 109 enforced kernel laws
$ node test/compose-laws.mjs   // 101 enforced + 3 declared-open

15 · The ending this page has to have

Here is precisely how to prove us wrong.

Every row names a claim, its honest status, the command that exercises it, what you should see, and the specific observation that would falsify it. If you produce something in the last column, the claim is dead and we want the counterexample.

Absence of evidence must remain distinguishable from evidence of absence, and every consequential transformation must expose why it occurred. — the [&] doctrine. It is why 0̲ is a value that carries a reason rather than an exception that carries a stack trace.