Empty Text, Normed Acts: Sun Tzu's Adversary, Nagarjuna's Object, and the Act-Disvalue Norm in LLM Agent Governance

Three findings keep recurring in one governance program for LLM agents: pattern enumeration loses to attack variation; guards that are trusted as defenses degrade silently and report health while failing; and the mediation point that survives as a locus of judgment is not the text at all but the typed act at the boundary, checked against an explicit authorization norm. This paper argues that these are not three lessons but one structure seen from three sides, articulated by an unusual triad of classical sources. Sun Tzu supplies the adversary ontology: warfare is the way of deception, so any defense whose last line lives in form-space fights on ground the deceiver chooses; invincibility must be built in what the defender alone controls. Nagarjuna supplies the object ontology: text has no intrinsic attack-nature — maliciousness arises dependently from provenance, trust, and composition — so per-segment essence-seeking detection has a structural ceiling, and detection can only ever be conventional truth: a floor, useful precisely so long as it is not reified into a defense. Act-disvalue theory from criminal law supplies the norm locus: judgment attaches to the concrete act at the boundary, where an unauthorized attempt is disvalued as an act, before and regardless of harm — fail-closed mediation is act-disvalue mechanized. The synthesis is a one-sidedness claim with a Mobius shape: every effect-bearing path through the governed runtime crosses an act locus, where infinite, un-stakeable text collapses into finite acts decidable by stipulation. Classic security principles — complete mediation, fail-safe defaults — are the engineering shadow of this triad, and the program's machine-enforced preregistration is the same doctrine applied reflexively to the researchers' own future selves. Reverse-derived from public findings; no new measurements, no efficacy claims.

Release type: theory paper. AI co-observer: Claude Fable 5 (Anthropic), drafting and synthesis working method, with pre-deposit metacognitive verification by three independent Claude refuter passes; the registered author is the human author alone.