Posts

Self-reported completion is not evidence. Independent deterministic verifiers, feedback re-injection, and why an LLM judging itself is theatre.

At-least-once execution is the default everywhere. Checkpoints make resumption cheap; idempotency keys make it safe. Runnable code and the bug I hit.

Dropping the oldest messages is amnesia with a token budget. Compact by turn group, pin the goal and the denials, and never orphan a tool call.

Isolation comes from containers. What belongs in your agent's design is the policy layer: resolved-path containment, allowlists, network off by default.

A classic circuit breaker misses the agent-specific failure: retrying the same bad call against a healthy dependency. Thrash detection, with code.

A token counter is not a cost control. Reserve-then-reconcile budgets that halt before the expensive call, across per-run and per-tenant windows.