One team, several brains

Our tower runs about twenty agents. Eight of them spoke through the same provider, with the same key. The day that key was revoked, all eight went silent at once. Nobody screamed: missions failed, cleanly, in silence.

1. What we observed

First, the outage itself: one key, eight agents beheaded at once. The builder, the reviewer, the observer — all mute, though nothing in their code had changed.

Then, more interesting: the silent failure. A review circuit — an agent had to approve a page before publication — failed, and the page stayed in the staging area. We only found out days later, asking "where is that page?". The failure was recorded, clean, timestamped. But nobody was looking at it.

2. The contract that saved everything

Each agent speaks through an "engine": a small script, one per provider. The contract is four lines: the instruction arrives on standard input, the report leaves on standard output, the current directory is the workspace, exit code zero means success. Nothing else. The engine knows neither the database, nor the circuits, nor the rest of the tower.

Thanks to that contract, swapping an agent's brain is a one-file change. We verified it the same day: the new engine took an instruction on stdin, created the requested file in the workspace, returned its report, and exited zero. The same test bench as the old one.

3. Distribution by domain

The outage forced a question we should have asked earlier: why would all agents get the same brain? Models don't excel in the same places. The one that codes and reviews finely is not the one that sorts mail at the best price. So we distribute: a top-tier engine for demanding work, a free rate-limited engine for the everyday load.

And one category does not move: the control agents — security, tests, gatekeeping review — stay "read-only", with no artificial intelligence at all. A controller that can be sweet-talked is not a controller. That's not a saving; that's a design.

4. What we take away

🔭