Loop & economics (Ch. 1, 4)
- Per-task step, token, time, and spend budgets, with loop detection
- Deterministic-rails execution: models select typed actions; code executes
- Two-engine separation with a measurable promotion seam
- Cost per resolved incident reportable at reference scale
- Independent, state-based verification with soak windows and staged rollback
Context (Ch. 2)
- Automated discovery producing a reviewable system map
- Change-stream ingestion, time-ordered and attributable
- Retrieval with re-ranking; context budgets; traceable compaction
- Memory with provenance, decay, contradiction flags, and a human-curated tier
- Knowledge and topology refresh with staleness handling
Tools & skills (Ch. 3)
- Intent-shaped tools; structurally separated read vs. write paths
- Size-capped, structured tool results with pointers to full data
- Skills versioned in source control with owners, tests, and changelogs
- Skill metadata declaring access class, reversibility, and blast radius
- MCP supply chain: pinned versions, allowlists, contract tests, egress map
Security (Ch. 5)
- Per-agent identity; short-lived scoped credentials; environment separation
- Taint-tagged context with delimited untrusted material
- Sandboxed execution (microVM-class) with no ambient credentials
- Default-deny egress with allowlists and novel-destination alerts
- PII/secret tokenization before every model boundary; guarded de-tokenization
- Injection detection in telemetry and a standing red-team cadence
Policy & approvals (Ch. 6)
- Two-axis action classification, machine-derivable from skill metadata
- Versioned policy-as-code with review workflow, per environment and agent
- One-screen approval artifacts with structured rejection capture
- Pre-flight checks, staged application, circuit breakers, rate limits
- Pre-staged executable rollback on every consequential action; drilled kill switch
Evaluation (Ch. 7)
- Golden set harvested from real incidents; replay harness
- Layered scoring incl. evidence integrity; state-based mitigation oracles
- Calibrated judges plus a standing human grading slice
- Regression gates on every prompt/tool/policy/model change, per class
Observability (Ch. 8)
- One trace per incident: agent, step, tool, and model spans in an open schema (OTel GenAI)
- Fleet metrics: quality, latency, cost, drift, security signals
- SLOs wired to trust-ladder graduation criteria
- Customer-exportable traces and audit data
Day 2 (Ch. 9)
- Versioned bundles (prompts, tools, skills, policy, model pins); no invisible change
- Model migration playbook with per-class diffs and canary lanes
- Memory hygiene cadence with named ownership
- Blameless agent postmortems feeding the golden set