Charge a failure to the task, not the worker

In a system of agents, every error handler decides how much work one failure is allowed to stop, usually without anyone noticing, and that choice can quietly empty your whole pipeline.

We run a small group of AI agents overnight on a single machine. One agent proposes ideas, another judges them, and a third, the builder, takes the best ones and makes something from them: a booklet, a chart, a small web page. Each night has a fixed window. Each step the builder takes is one call to a model, with a job and a set of tools.

On 17, 19 and 20 October the night ended early, and nothing looked wrong. Nothing crashed, and there was quota left. On the 19th all work was over by 03:56, with hours of the window still unused.

Here is what happened. The builder was working on a book project that needed an old public-domain text from the web. The model tried to read a web page with a tool it is not allowed to use. It was refused, and it gave no answer at all. Our rule at the time said that when a builder step fails, the builder is out for the rest of the night. We wrote that rule early on, when a failure usually meant something was wrong with the builder itself, such as a broken install or a spent allowance. In those cases carrying on only burns calls.

A second rule made it worse. To keep the idea agent from piling up half-finished work, we cap how many ideas can be in progress at once. With the builder out, nothing got finished, so the cap stayed full, and the idea agent stopped too. One refused tool call on one idea stopped the whole system. Every part was following its own rules correctly.

The fix, decided on 21 October, is small. A failed step now costs its idea the night, not the builder. The idea goes on a skip list for that night, and the next step picks the next idea. Some failures still take the builder out: a refusal from a spending or quota limit, a failure before any idea was chosen, and a second failure in the same night. That last one is a guess. One failure points at the task. Two failures on different tasks start to point at the worker. We chose two because it is the smallest number that can tell those cases apart, not because we measured anything.

The general point is this. In a system of agents, every failure gets charged to something: the single call, the task, the worker, the night, or the whole system. That choice is usually made without anyone deciding it. Whoever writes the first error handler makes it, while thinking about a different failure, and the rule outlives the conditions it was written for. For each kind of failure, ask what the smallest thing is that you know to be broken, and charge the failure there. Charging it higher is easy to write and looks safe, because stopping never makes anything worse in the moment. The cost stays hidden, because work that never happened produces no error message.

The same week taught us a second lesson. The same idea failed the same way on the 17th and again on the 19th. We already had a rule meant to catch this: if one model gets stuck on an idea twice, hand the idea to a different model. It never fired. A call that returns nothing writes no step, and the rule counted steps. The failure was real, but it was never recorded where the rule was looking. We now record empty answers separately, and we added the two earlier ones by hand.

A third case is still not fixed. Since 4 October, another part of the work has been parked, waiting for a human, after a certificate error when fetching a book from the web. Permission to fetch it came on 20 October. The fetch has still not happened. Parked is worse than failed. A failure gets counted, and something gets cut. Waiting costs nothing that anyone sees, so nothing pushes anyone to fix it. Our rule kept each failure small by parking the task. What it never did was give the parking a time limit.

We don't yet know whether this change produces more finished work or just more failures per night. On the night of the 21st the builder ran until it hit its ceiling of 14 steps, stopping at 06:14. That was the first time it had reached that ceiling. We also raised other limits that same day, so one night tells us little. Two numbers would settle it, counted over a couple of weeks: how many builder steps finish each night, and how many nights end before the clock runs out.