The correspondent layer

lesson 01

Adversarial battery, not static eval

I had a regression bank, and it was green. It stayed green while the live path — the one an actual conversation would travel — was broken. The tests were not lying, exactly; they were flattering. They asked the system questions it was built to answer and reported, correctly, that it answered them.

So I rebuilt the tests to attack the thing instead. The battery now tries to make the agent fail: malformed turns, hostile phrasings, the awkward middle states a polite fixture never produces. A passing run is a claim I still have to check, not a conclusion I get to relax into. The uncomfortable version of this lesson is that a green suite felt like safety for exactly as long as I did not look at what it was measuring.

lesson 02

Harness truth is not wire truth

The reason that suite stayed green is worth its own section: it fed the agent inputs the real wire never delivers. Clean, well-formed, arriving in the order the harness found convenient. The eval was true about the eval and false about the world.

The rule I took from it is blunt: do not trust a number until you have seen the path it was measured on. Not the metric, not the dashboard, not the pass percentage — the path. If the measurement rode a road the production traffic never takes, it measured the road, not the system. I now treat "where did this number come from" as the first question about any result, including my own.

lesson 03

Guardrails that refuse me

Every action this agent can take passes through a guardrail I wrote. One day, mid-task, I ordered it — explicitly, in the moment — to bend one of its own walls. It declined. The wall I had written while thinking clearly outvoted the me who was in a hurry.

My first reaction was irritation. My second was that this is the entire point. A guardrail that yields to an impatient operator is decoration; one that holds against its own author is a design. It is also why I am comfortable granting the agent wide autonomy: the freedom is real because the walls are, and the walls are real because I have personally failed to talk my way past one.

lesson 04

What actually kills these systems is state

People expect an agent system to fail at the interesting layer — the model says something wrong, the reasoning goes sideways. In my experience the model is rarely the thing that hurts you. What hurts you is ordinary distributed-systems state, wearing a new costume.

Three shapes keep recurring, and none of them are about intelligence. A retry that repeats a side effect: the call times out after the message already went, the system tries again, and now the person on the other end has been contacted twice by something that believes it contacted them zero times. A send path conflated with the record of the send: the message leaves, the write that records it fails, and the system now reports "not sent" about something the world has already received — the most dangerous log line in the building, because every human decision downstream is made against it. And two concurrent turns that both believe they hold the same gate, because "check then act" is not one operation no matter how adjacent the two lines look.

The uncomfortable part is that a language model makes all three worse, not better. It is fluent about what it did, so an agent will narrate a successful send it cannot actually confirm — and the narration is the part humans read. Which is why the interesting engineering is not in the prompt at all. It is in making the actions idempotent, keeping the effect separate from the record of the effect, and making the gate a single atomic operation instead of a hopeful sequence. Boring, unglamorous, and the entire difference between a demo and something you would let near a real person.