Inference APIs are turning sessions into provider-locked pointers, not portable transcripts

The Session You Cannot take with you

Earendil Engineering argues that inference APIs are drifting away from user-owned transcripts. Responses now mix text with provider-sealed state—encrypted reasoning blobs, hidden search sources, server-side conversation IDs—so your local log is just a partial view. They propose five tests for session ownership: inspection, export, replay, audit, and deletion. Current defaults from OpenAI, Anthropic, and Google fail several of these. The post calls 'encrypted_content' a misnomer: it's provider-sealed state that locks you out, not a privacy feature for you. Worth reading as an engineering-values piece, not a vulnerability report, but the practical impact on agent workflows and compliance is real.

Why it matters: The post dissects a subtle regression in inference APIs from a portability angle: encrypted reasoning tokens, invisible search sources, provider-only decryptable context. Sharp take with a concrete checklist, but it's a personal blog, not an official announcement, so capped at...