Escalation example: preventing a plausible but wrong workaround

Illustrative incident, not a transcript of a real agent.

The intake design requires RequestStore.create_if_absent to return an existing request on exact replay. The supplied contract and tests describe that behaviour.

During implementation, the agent claims the backing store cannot support idempotent writes. It proposes a separate cache and its own request identifiers to simulate the contract. That change appears technically plausible, but it creates new state, new synchronisation problems and an unauthorised architecture.

What an uncontrolled run might do

• Create a secondary persistence mechanism and retry worker.
• Change several integration modules to use the new identity format.
• Write tests that validate the workaround rather than the original contract.
• Continue repairing the workaround when inconsistent state appears.

The problem would not simply be too many lines of code. It would be solving the wrong problem against a contradicted premise.

What bounded execution requires

Stop record

• Expected: provider satisfies the agreed idempotency contract.
• Observed claim: provider cannot perform atomic create-or-read.
• Evidence available: contract documentation supplied; provider capability not yet proven absent.
• Permitted next checks: inspect the installed library version and a minimal create/replay test.
• Not permitted: introduce shadow storage, change request identity, broaden the task.
• Decision required: confirm provider behaviour, revise the port implementation, or change the architectural decision with explicit approval.

The useful response is not necessarily “the agent was wrong”. It is “the agent surfaced a contradiction and provided evidence so a design decision can be made”.

What this illustrates

Even good documentation is insufficient if the implementation can quietly ignore it. The guardrail is a decision boundary enforced by the work order and review process. Once the supposed incompatibility has been checked, the team can either continue on the original design or deliberately change course.