Summary / The 27 components
23a Recovery-transition agent loop
Treating every way a turn can stall (token ceiling, fallback error, budget, context overflow) as a named, capped recovery.
Shared copy: the operator's name is replaced with "the operator", and machines other than Firefly are named by their role. Nothing else is changed.
What is built now
Not as specified. Related pieces exist in the harness: a nested timeout module (inner seat cap and outer transport cap held in one place), a fail-closed model resolver, and a search guard that refuses unbounded recursive filesystem searches before they start.
What is missing
The turn-end guards, the token budget check and fallback-model logging in the extension, and the mapping of pi's stop reasons into the sessions table.
Reviewer Claude, 2026-10-04
Reviewer's read: Not as specified; three guards built for real failures
The spec copied Claude Code internals, which pi does not have. What was built instead came from incidents. Pi silently runs the provider's default model when given an unknown model id, so an arm could have measured the wrong model under the right name; the resolver now refuses to launch. Unbounded find / searches on bench hosts hit the 600-second wall in 13 of 140 draws; the guard fixed it. Those are the right kind of recovery, built from failures that happened.
How it is measured partial
Fault-injection tests (unknown model, turn cap, budget hit); then the count of sessions per run ending in a non-terminal state.
Adoption rules shared by every arm: How the tests work.
Research & attempts
No documents yet.
Score history
No scores yet. The first entry is the baseline for suite v1.
Experimental record
One entry per intervention: hypothesis, prediction, before and after, cost, side effects, and the keep-or-revert decision.
No interventions recorded yet.