Budgets, termination, idempotency, and recovery

An agent loop without enforceable budgets is an unbounded distributed job. Natural-language requests such as “be efficient” are preferences, not controls. The harness must track and enforce limits outside the model for elapsed time, planner calls, input and output tokens, tool invocations, CPU, memory, processes, storage, network bytes, external API spend, and consequential actions. Different resources fail differently, so one aggregate budget is not enough.

Represent a budget as a ledger. Each reservation identifies the run, resource, amount, purpose, and expiration. Reserve before starting an operation that could exceed the remaining balance; charge the actual amount afterward and release unused capacity. For uncertain external spend, reserve a conservative upper bound. If reservation fails, the operation does not begin. This prevents concurrent tool calls from each seeing the same remaining allowance.

Deadlines propagate. The run has an absolute deadline. Each model or tool call receives a shorter child deadline that leaves time for observation capture, evaluation, and cleanup. A library timeout that merely stops waiting is insufficient if the remote request or subprocess continues. Cancellation must reach the execution boundary, and the harness must reconcile whether an effect completed. Record timeout, cancellation, and budget exhaustion as distinct result classes.

Termination predicates should be explicit and ordered. Verified success requires evaluator evidence. Hard policy denial terminates or pauses according to policy. Budget exhaustion stops new work and enters evaluation or cleanup. User cancellation stops new effects. No-progress detection identifies repeated state, repeated equivalent calls, or lack of measurable improvement over a bounded window. A maximum-step count remains necessary even with no-progress logic because novelty can still be useless.

No-progress detection should operate on normalized state, not raw prose. Hash the relevant task state, artifact manifest, open obligations, and last observations. Track whether evaluations or acceptance-test deltas improve. A planner that changes wording while repeating the same failed action has made no progress. Conversely, a long compilation step may have no intermediate artifact change but remains useful; task-specific phase models reduce false trips.

Retries need a taxonomy. Validation and policy denials are deterministic until input or policy changes; do not retry unchanged. Rate limits and transient dependency failures may be retryable with bounded exponential backoff and jitter. Timeouts and transport failures around side effects are ambiguous; reconcile first. Internal harness bugs should trip a circuit breaker rather than consume the entire task budget. The retry budget itself is explicit.

Idempotency keys should represent intended logical effects, not attempts. The same logical write retried after transport loss uses the same key. A changed payload or target uses a new key. Store the key and committed result in a durable scope controlled by the adapter. If the downstream service supports idempotency, propagate it; otherwise maintain a local outbox or reconcile through a read interface. Never derive a key from volatile sequence alone if a recovered run could assign a different number.

Recovery begins from checkpoints that include control state: fixture identity, policy and adapter versions, remaining budget, planner-visible observations, idempotency records, pending approvals, leases, and artifact manifest. Checkpoint before and after consequential effects. A checkpoint cannot prove an external effect did not occur if the worker died between effect and commit, which is why idempotency and reconciliation remain necessary.

Budget tuning is empirical. Too-small limits cause systematic task failure; too-large limits expand cost and blast radius. Analyze distributions by task class, outcome, and failure mode. Set defaults from successful percentiles plus justified headroom, then define exception policies. High-consequence action counts should remain low even when token or time budgets are generous.

Expose remaining budgets to the planner as observations so it can adapt, but never delegate enforcement. The planner may choose a cheaper approach; it cannot grant itself more resources. Approval can amend a budget through a durable policy event with identity and reason. Silent automatic expansion turns a limit into a suggestion and makes incident costs unpredictable.