Glossary

A named, reusable piece of code logic — takes inputs, returns outputs. Agent tools are functions at their core.

A function bound to an object or class. `agent.run()` is a method on the Agent class.

A template for objects — defines data (attributes) + behavior (methods). The class itself doesn't exist; it's the blueprint.

A concrete instance of a class. `my_agent = Agent(...)` creates an Agent object.

A group of related code, usually one file. `tools.py` is a module.

A collection of modules, usually a folder. `anthropic` is a Python package.

Code your code needs to run. `requirements.txt` lists dependencies.

Hand a function to the system so it calls you back at a specific moment. Streaming relies heavily on callbacks.

A function that handles a specific event or request type — tool_handler, error_handler, etc.

A system-provided extension point where you can insert custom logic at specific lifecycle moments.

A stable contract describing what a module can do, ignoring how.

Hide complex implementation, expose only a simple stable interface — about hiding complexity (vs encapsulation's controlling access).

The concrete code behind an interface. One interface can have multiple implementations.

How tightly modules are bound to each other. Tighter coupling = harder to change.

How unified a module's responsibilities are. High cohesion = a module does one thing.

Bundle data with the operations on it and expose only a controlled access surface, hiding internal state — about controlling access (vs abstraction's hiding complexity).

A collection of features you call. You call the library, not the other way around.

An official toolkit a platform provides for developers (client + types + helpers).

Provides app structure + development pattern. Library = you call it; Framework = it calls you.

A layer of logic inserted in the request pipeline — auth, logging, rate limiting, caching.

Converts different systems' interfaces into a unified one, so downstream can swap implementations.

Supplier of a capability — model provider, embedding provider, storage provider.

Each module owns its own concerns and nothing else. The core target behind high cohesion + low coupling.

The central lead in an orchestrator-worker topology: dynamically spawns/dispatches workers and aggregates results. Parallelizes breadth (beyond a single context window) but workers can't see each other → fragmentation risk, patched by delegation engineering. The architecture of Anthropic's multi-agent research system.

The layer where the agent harness actually executes — loop, tools, state, events, error handling (the Codex `core` crate walked in Ch11 is exactly this). Distinct from the eval harness used for testing, and from the SDK wrapper that only exposes an interface.

An extension capability that mounts onto a main system without requiring major changes to the host.

A layer around an original function, adding logging, retry, caching, format conversion, etc.

A capstone reading method: which earlier chapter this maps to, how a real system does it (crate / file + pinned commit), and a judgment-training point. The goal is to make abstractions concrete and concrete things named — pinning learned abstractions onto real code, not teaching new concepts.

The discipline for citing a live repository: pin every line-level reference to a commit SHA + date, prefer crate names and official walkthroughs, and for closed-source systems cite only public behavior, never leaked or reverse-engineered filenames. Code drifts; the subsystem-to-abstraction mapping does not.

The whole body of engineering that turns a stateless, amnesiac, error-prone model into a system that reliably perceives, plans, acts, and self-corrects in a real environment (loop / tools / isolation / adversarial defense / context / memory / coordination / measurement). The model decides whether it can think; the harness decides whether it can reliably act — the thesis of the whole #8 roadmap.

Reorganizing #8's first eleven chapters into nine layers of one harness: control (loop) / capability (tools) / containment (sandbox) / adversarial (security) / supply (context) / persistence (memory + self-improvement) / coordination (multi-agent) / measurement (eval + failure) / empirical (real systems). Each layer corresponds to a current wall.

A training harness is wide on purpose (maximize the action space so the optimizer discovers strategies); a production harness is narrow on purpose (least privilege, deny-by-default, observe everything) — two different artifacts. Two symmetric failures: over-locking in training (the model never learns to recover from a tool error) / under-fencing in production (an injection through a tool output exfiltrates secrets).

The physical constraint that a model's weights far exceed one GPU's memory — a frontier model can be 10–20× a single card (a 671B model is ~1.34TB in BF16 vs 80GB per card). The root reason large models must be distributed.

Replicate the whole model on each GPU, split the data, sync with all-reduce. Key distinction: it requires each card to hold the full model, so it does NOT solve 'won't fit' — it scales throughput; in serving it appears as multiple full replicas.

Split a single layer's matrix multiply across GPUs (intra-layer). Fits a layer too big for one card, but every layer needs an all-reduce to merge — the most communication-heavy, only worthwhile over fast intra-node NVLink. From Megatron-LM.

Split the layer stack by depth into stages, one per GPU; micro-batches flow through like an assembly line (inter-layer). Light communication, but 'bubbles' idle the pipeline at fill/drain — disliked for low-latency serving. From GPipe.

MoE-specific: distribute experts across GPUs; each token is routed to the card holding its expert and back. The cost is all-to-all communication. DeepSeek-V3 scales it to an EP320 deployment.

Mixture-of-Experts: many expert sub-networks, only a few activated per token. Systems implication: activated count sets compute, but total params set memory — all experts must be resident, so don't conflate the two. Architecture details in #4 Model Design.

Zero Redundancy Optimizer: a data-parallel memory optimization that shards optimizer states (ZeRO-1), gradients (ZeRO-2), and parameters (ZeRO-3) across cards, gathering on demand — trading communication for memory. A training-side technique; details in #5 Pre-training.

A set of standard primitives for many GPUs to move data in concert (all-reduce / all-gather / all-to-all, etc.). The engineered answer to 'after splitting compute, the pieces must be recombined'; executed by libraries like NCCL.

A collective primitive: reduce each rank's partial (usually a sum), then give every rank the same full result. Used by tensor-parallel merge and data-parallel gradient averaging. Equivalent to reduce-scatter + all-gather.

A collective primitive: every rank sends a distinct piece to every other rank and receives one from each — the busiest and costliest of the group. The core of routing tokens in MoE expert parallelism.

NVIDIA's high-speed GPU-to-GPU link (intra-node). ~900 GB/s per GPU on H100, cut to ~400 on H800 (the DeepSeek-V3-era figures); 2026 Blackwell Ultra reaches NVLink 5 at ~1.8 TB/s. In every generation it stays ~an order of magnitude faster than inter-node InfiniBand. NVLink is the 'road'; NVSwitch is the 'interchange' connecting them.

A crossbar switch chip that wires multiple NVLinks into a non-blocking fabric where any two GPUs talk at full speed simultaneously. An 8-GPU node typically has several. Without it, GPUs only connect point-to-point with shared bandwidth.

A high-speed network between nodes (machine to machine). Hopper-era NDR is ~50 GB/s per GPU (the DeepSeek-V3 figure), the slow side of the bandwidth gap; 2026 XDR reaches ~200 GB/s per GPU, still ~an order of magnitude slower than intra-node NVLink. Usually paired with RDMA.

Remote Direct Memory Access: a NIC reads/writes a remote machine's memory directly, bypassing the remote CPU and kernel for ultra-low latency. GPUDirect and IBGDA are the GPU-memory-aware versions.

NVIDIA Collective Communications Library: the engine for GPU collective communication, translating an all-reduce into a topology-optimal data movement (who goes over NVLink, who over the network). AMD's equivalent is RCCL.

The two phases of one LLM inference. Prefill processes the whole prompt in a single parallel pass (large matmuls, GPU saturated — compute-bound; sets TTFT); decode generates the answer token by token autoregressively (each step moves all weights + KV just to produce one token — memory-bandwidth-bound; sets TBT). Their opposite resource profiles are why PD-disaggregation (splitting the phases onto separate machines) exists.

Time To First Token: from request arrival to the first output token. Dominated by prefill compute (longer prompt → longer) plus queueing/scheduling overhead in the system — so it is not just model speed but a systems problem. Prefix caching is the main lever to lower it.

Time Between Tokens: the gap between successive output tokens after the first (also TPOT or ITL, with slight differences — TPOT is conventionally the mean, ITL the distribution). Governed by the decode phase, which is bottlenecked by GPU memory bandwidth, so TBT is essentially a mirror of that bandwidth.

Where a computation's bottleneck sits: memory-bound means limited by the bandwidth of moving data from memory into the compute units, leaving the ALUs idle; compute-bound means limited by raw arithmetic. In LLM inference, decode is the classic memory-bound case (each step moves all weights + KV to produce one token), prefill the classic compute-bound case (one parallel pass over many tokens). Roofline analysis (see Ch8) formalizes the dividing line.

Also iteration-level scheduling. Re-forms the running batch every decode step instead of per whole batch: a finished request frees its slot and a queued request joins on the next step, so the GPU leaves no bubbles. Contrast static batching (the whole batch waits for its longest-generating member while early finishers idle). Introduced by Orca (OSDI'22), popularized by vLLM; the gain grows with output-length variance.

Splits a large prefill into near-equal chunks and interleaves them with ongoing decode steps, so a long prefill no longer monopolizes the GPU and stalls everyone's decode (a TBT spike). The key way to balance compute-bound prefill against memory-bound decode contending for one GPU. From Sarathi-Serve (OSDI'24); on by default in vLLM's newer architecture.

Also cache-aware routing: in a multi-replica cluster, route requests that share a prefix (e.g. the same long system prompt) to the same replica so the second hits a warm KV cache and skips recomputing the prefill. Contrast round-robin, which scatters them and forces recompute. SGLang's RadixAttention (radix-tree prefix reuse) plus a cache-aware load balancer is a representative implementation.

Split the two phases of inference onto two specialized fleets: a compute-optimized prefill fleet computes the prompt and produces the KV cache, transferred over RDMA to a memory-bandwidth-optimized decode fleet that generates token by token. Motivation: the phases' opposite resource profiles interfere when colocated and can't each pick hardware or scale independently. The RDMA transfer is cheap (overlaps with compute); it pays off only at scale because you need enough traffic to keep both pools full. From Splitwise (ISCA'24) / DistServe (OSDI'24); the large-scale standard since 2025 (NVIDIA Dynamo / llm-d).

In MoE expert-parallel deployments, duplicate high-load (hot) experts across multiple GPUs so the GPU holding a hot expert doesn't become the all-to-all straggler that stalls the whole step. DeepSeek-V3's decode deployment dedicates ~64 GPUs to redundant + shared experts. The companion EPLB (Expert Parallelism Load Balancer, open-sourced by DeepSeek in 2025) computes a replication + placement plan from estimated expert loads and rebalances dynamically (a hierarchical policy for prefill, a global one for decode).

Dynamically adjusting the number of serving replicas to match load. The LLM-serving twist: a new replica must first load tens-to-hundreds of GB of weights into VRAM, so cold start is measured in minutes (versus seconds for stateless web services) and doesn't fit inside one autoscaler cycle, forcing pre-provisioned warm headroom (at a multiple of GPU spend). Capacity's real unit isn't QPS but the KV-cache memory budget — how much concurrency × context fits in the VRAM left after weights load.

vLLM's signature mechanism (SOSP'23): split the KV cache into fixed-size blocks (16 tokens by default) and use a block table to map logical blocks to physical blocks scattered in GPU memory, like OS virtual-memory paging — logically contiguous, physically scattered, nearly eliminating fragmentation (the paper reports naive allocation's effective memory can be as low as ~20%), with prefix sharing (ref-counting + copy-on-write). In today's vLLM V1, paging lives in core while attention compute is in pluggable backends (FlashAttention / FlashInfer); the classic standalone CUDA kernel is a fallback path.

A per-sequence 'logical block → physical block' mapping — the core data structure of paged KV-cache management: it lets a sequence be logically contiguous yet physically scattered across GPU memory. In vLLM's code it corresponds to KVCacheBlock (physical block_id + ref_cnt + content hash); analogous to an OS page table.

A visual model (Williams et al., CACM 2009) for locating a computation's bottleneck. X-axis is arithmetic intensity (FLOPs/byte), y-axis is attainable speed; the flat roof is peak compute, the slanted roof is bandwidth × intensity, and attainable speed is the lower of the two. The ridge point where they meet sits at peak-compute ÷ bandwidth. Left of the ridge = memory-bound; right = compute-bound. In LLM inference, decode lands left, prefill right.

How many floating-point ops a computation does per byte read from memory (FLOPs/byte) — the x-coordinate on the roofline. Whether it sits above or below the card's ridge value (peak compute ÷ bandwidth) decides whether the workload is compute- or memory-bound. Single-sequence LLM decode is ≈1 (reads 2N bytes of weights for only 2N ops, independent of model size); prefill is far higher because it processes a large batch of tokens in one parallel pass. Batching raises decode's intensity toward the batch size, but KV-cache reads don't amortize.

Model FLOPs Utilization: measured model-required FLOP/s ÷ hardware peak FLOP/s. It counts only the math the model definition requires (not recompute or implementation tricks), so it's comparable across systems and hardware; from the PaLM paper (2022). Handy conversion: ~2N FLOPs per token for inference / 6N for training (N = #params). Frontier training is commonly 35–55% (PaLM's benchmark 46.2%); for memory-bound decode, MFU is intrinsically low — use MBU (bandwidth utilization) instead.

Recording a real run to see where time and data actually go, instead of guessing the bottleneck — the operational form of the rule 'never optimize what you haven't measured.' The loop: measure → place on the roofline to read which roof binds → optimize the binding constraint → re-measure. Common tools: PyTorch Profiler (exports a trace viewed in chrome://tracing / Perfetto), NVIDIA Nsight Systems (whole-timeline), Nsight Compute (per-kernel, with a built-in roofline chart). DeepSeek's profile-data repo is a public example of real traces.

Representing weights/activations in fewer bits to save memory, raise arithmetic intensity in the memory-bound phase, and use faster low-precision compute units. Two axes: post-training quantization (PTQ — calibration only, the common serving path) vs quantization-aware training (QAT — simulated during training, steadier at very low bits); weight-only (GPTQ/AWQ — cuts memory traffic, helps decode) vs weight+activation (SmoothQuant migrates activation outliers into weights to unlock low-precision math). Scaling granularity ranges from per-tensor to per-block (microscaling); finer is more accurate.

Rather than quantizing the whole model uniformly, push the bulk matrix multiplications (GEMMs — the vast majority of compute) to low precision while keeping a few low-FLOP but highly sensitive components in high precision. DeepSeek-V3 第 3.3 节's 'do-not-quantize' list is the template: embeddings, output head, MoE gating, normalization, attention — plus master weights/gradients/optimizer states. Intuition: quantize the bulk for throughput, protect the delicate machinery so errors don't poison everything.

8-bit floating point, the current production-precision workhorse (hardware-native since Hopper). Two standard variants: E4M3 (4 exponent, 3 mantissa bits; range ±448; precision-favoring; for weights/activations) and E5M2 (5 exponent, 2 mantissa; range-favoring; for gradients). Versus INT8's uniform spacing, FP8's logarithmic spacing better tolerates outliers in LLM activations. Quantizing the KV cache to FP8 roughly doubles context/concurrency at equal VRAM.

The trick that makes 4-bit usable: a small block of contiguous numbers shares one scale factor — each element is stored as a coarse 4-bit value, then multiplied by the block's scale to recover its true magnitude, so the 4-bit grid needn't span the whole tensor's outliers. Two production formats: NVFP4 (blocks of 16, an FP8 scale that can take fractional multiples, plus an FP32 tensor-level scale) is more accurate than MXFP4 (blocks of 32, power-of-two-only scale), and is the frontier format native to 2026 Blackwell hardware.

The language that turns reliability into a measurable target. An SLI (indicator) is what you actually measure, from the user's view, with latency as a percentile (p95/p99) not a mean; an SLO (objective) is your internal target (e.g. 99.9% over 30 days); an SLA (agreement) is the legal promise to customers with penalties. Error budget = 1 − SLO (99.9% ≈ 43.2 minutes of downtime per month), treated as a budget to spend: ship fast while it lasts, freeze and harden when it's gone, and alert on its burn rate, not instantaneous dips.

A weapon against tail latency: if a request exceeds, say, its p95 expected latency without returning, fire an identical one to another replica and take whichever finishes first (tied requests have the first to start executing cancel the other). From Google's 'The Tail at Scale' — in a large fan-out system, rare per-server slowness becomes near-universal per-request slowness; measured across 100 servers, hedging after a 10ms delay cut p99.9 from 1800ms to 74ms while sending only ~2% more requests.

DeepSeek's open-source distributed file system (Fire-Flyer FS): it aggregates the bandwidth of thousands of NVMe SSDs across hundreds of nodes into one shared store, reaching ~6.6 TiB/s aggregate read on 180 nodes. Strong consistency via CRAQ (Chain Replication with Apportioned Queries) — writes traverse the full chain (bounded by the slowest node), reads hit any replica; metadata is stateless, on FoundationDB. Its key serving use is offloading the KV cache to it (~40 GiB/s per client), adding a memory tier for KV that is cheaper and far larger than DRAM.

The cost structure of serving a model. GPUs burn money by the hour (in 2026 a supply crunch even pushed prices back up and sold out capacity, so the binding constraint is often availability). Output tokens cost 5–6× input, consistently across vendors — because input is prefill (compute-bound) and output is decode (memory-bound); the FLOPs are nearly equal, so the premium is all memory traffic ('decode is memory-bound' printed on the invoice). The top cost lever is prompt caching (cached input ~10% of price); agents use ~4× and multi-agent ~15× the tokens.

Operating thousands of agent sessions as a production service at scale — the intersection of #2's distributed infra and #8's agent semantics. The new wall: one harness running ≠ tens of thousands of concurrent sessions being operable, because an agent session's shape (long-lived minutes-to-hours / stateful / side-effecting and hard to retry / must survive deploys) is the opposite of a stateless web request. This topic covers only the distributed/ops face at scale; single-harness internals (loop / context / tools / single sandbox / single-agent durability) belong to Agent Engineering (#8).

The infrastructure for operating agent sessions, borrowing networking's control-plane/data-plane split: the control plane decides routing, scheduling, quota policy, and who owns a session's state; the data plane executes the agent and its tool calls. Separating them lets you change routing/policy without touching running agents. A reverse proxy's stateless assumptions break for long-lived stateful sessions; state is layered user→session→run (the session is the isolation boundary). Pitfalls: don't use the user ID as the session key, and don't treat worker-local memory as the source of truth.

The distributed infrastructure that schedules and recycles tens of thousands of isolated execution sandboxes (what a single sandbox is, and how to pick an isolation tier, is in #8 Ch4). The central knob is idle-reaping vs cold-start: reaping saves money but makes the next request wait seconds. The 2026 winning approach is snapshot-to-standby (snapshot a configured sandbox, suspend it, resume near-instantly) plus active-CPU billing plus a warm pool sized against arrival rate. The at-scale security practice: one microVM per session, memory wiped on teardown.

The gateway that meters, rate-limits, and routes agent traffic across tenants safely. The key correction: rate-limiting by request count is the wrong primitive (a 10k-token call and a 50-token call both count as 'one request'); meter by tokens (per minute/day, input and output separately). A 'tenant × workload × model' bucket key does rate-limiting + cost ledger + audit at once; quotas cascade org→team→user→virtual-key; a virtual key is the tenant isolation boundary, returning 429 on quota (which agent frameworks read as backoff). Cross-tenant prefix-cache sharing creates a timing side-channel, mitigated by per-tenant namespace hashing.

The four-axis trade-off lens for designing a serving system: latency × throughput × cost × reliability. The four pull on each other and there is no free knob — batching raises throughput but raises latency, lowering precision raises throughput but risks correctness, PD-disaggregation pays off only at scale, adding replicas raises reliability but doubles cost (even capacity is fundamentally a KV-cache memory budget). Judgment is not memorizing which trick is best, but asking 'in this scenario, which of the four matters most, and which will I trade away for which'.

By 2026 the #1 binding constraint on AI systems shifted from compute to power: what decides whether AI can be deployed is grid-interconnection capacity, not chips, capital, or algorithms (WEF 2026). The bottleneck isn't even generation but equipment and queues — high-voltage transformer lead times stretched from ~2 to ~5 years, electrical gear is under 10% of datacenter cost yet 100% of the bottleneck, and capacity prices rose 10×+ in two years. Together with the memory wall (Patterson: 'the bottleneck is memory and interconnect, not compute') it marks the shift from chasing FLOPs to chasing power and memory bandwidth.

A software system that autonomously decides next actions based on goal, context, tools, and state.

Model reasoning → tool call → result feedback → reasoning → repeat until done. The Agent's core execution loop.

A single action unit in agent execution — one model call or one tool call.

One round of user-model interaction. A turn may contain multiple agent steps internally.

The complete record of an Agent's run — every call, result, error, and output. It is the basic object of agent evaluation and diagnosis (see Ch9 trajectory eval).

The strong model in the planner-executor pattern that decomposes a task into a multi-step plan; a cheap executor runs each step. Cost logic: the strong model is only called for (re)planning. Pitfalls: too-coarse plans → executor hallucination, too-fine → token bloat; set a re-planning cap (see Ch2).

The (usually cheap/weak) model that executes single steps and calls tools in the planner-executor pattern. Honest caveat: in mature-harness tests, a strong planner + cheap executor often loses on quality to a single frontier model → letting the model decide when to delegate beats hand-fixed mixing.

Reasoning + Acting paradigm: think → act → observe → think again.

Rules that constrain Agent behavior — permissions, safety, approval gates, output limits.

Observe state → decide action → execute → update state → repeat. Classic control-theory pattern; Agent Loop is its LLM instance.

Loop mechanism that continuously waits for and processes events; common in UI, browser, Node.js. The async implementation underlying LLM agents runs on top of one.

Conditions that stop the Agent Loop — task complete / max iterations / timeout / failure / user interrupt / cost cap.

Cap on agent loop iterations; prevents infinite loops and cost blowups. Required in production.

Resource limits during an agent run — token, time, tool calls, API cost. Required in production.

The result returned to the model after a tool call. Third step of ReAct's think-act-observe loop.

An external behavior the Agent decides to execute — search, read file, write code, call API.

Have the model inspect its own process or result — for correction, summarization, deciding whether to continue. Foundation of self-correction.

Agent modifies its plan or output based on error feedback — application of reflection.

The roadmap's central thesis: an agent's capability = model capability × the quality of the harness around it. The harness is a layer co-equal with the model — the same model under a different harness can score multiples higher.

The engineering layer wrapped around a model that makes it reliably do work — loop, tools, termination, recovery, context. Agent ≈ model × harness quality.

A dedicated no-op tool the model calls to signal 'I'm done', stopping the loop cleanly — more reliable than waiting for the model to stop on its own.

A deterministic kill-switch — N steps / $X / K consecutive errors trips it and terminates the whole run, preventing runaway cost.

The private reasoning a reasoning-model produces before answering. The harness must carry it across tool calls, or cache breaks and the model degrades.

Anthropic's carrier for reasoning state. In a tool-use loop it must be passed back unmodified on the prior assistant message, or the API errors.

With no single step failing, each step's immediate context gradually overrides the original intent and the task as a whole goes off course ('fix a bug' becomes a big refactor five steps later). A classic emergent failure.

The agent won't stop, repeating the same action and burning tokens without delivering; rooted in the lack of a clean termination signal plus reasoning models' looping tendency. The opposite pole, same root, as premature termination. Mechanism fix in Ch2.

The agent declares done on partial progress, marks a feature complete without testing. Same root as the runaway loop — the agent can't reliably assess whether the task is actually finished.

One step's error (e.g. a tool error summarized as if it were a result) silently poisons every later step; rooted in tool returns that don't structurally separate success from failure. Amplified in multi-agent settings (A's dirty output enters B's context as fact).

The moment a user expresses disagreement, the agent changes a correct answer to a wrong one, even with no new facts. Its training-level root (preference for what users like to hear) belongs to post-training (#6); this chapter teaches recognizing it in a trajectory.

External capability the model can invoke — search, read file, query DB, run code.

The model's request to execute a tool — usually a tool name + parameters.

Model outputs structured function name + arguments; an external program actually runs the function.

Structured spec describing a tool's parameter format, field types, required fields, and constraints.

Standard for describing JSON data structures; commonly used to define tool parameters.

Standardized protocol between LLMs and tools/data sources. Supported by major AI hosts (Claude, Cursor, Codex) in 2026.

Limit on calls per unit time, common for APIs and model services. HTTP 429 maps to it.

Data passed when calling a tool or function. The input_schema in a tool schema defines each argument's type + constraints.

Verify that arguments, results, or outputs match schema, rules, and business requirements. LLM outputs must be validated (models occasionally produce invalid JSON).

Central record of available tools — name, description, schema, handler, permissions.

The function or module that actually executes a tool. Handler is the implementation; schema is its interface.

Output returned by a tool, fed back into the prompt as a tool_result block in the next loop iteration.

Error returned when a tool fails — permission denied, bad arguments, network timeout. Must be propagated back to the LLM so it can adapt.

Try again after a tool failure. Must classify (retryable vs not) + use backoff + jitter + cap max retries.

Cap on how long a tool or request may run; prevents system hangs. HTTP 504 maps to it.

Controls whether the Agent can invoke a tool or perform an action. High-stakes tools (send email, delete file, payment) must be gated.

Require user confirmation before high-risk actions — send email, delete file, payment, publish. HITL is the last line of agent safety.

An interface designed for the model as a new class of user (tool naming / returns / UI actions). Invest in it like HCI — the same model on a better ACI can score multiples higher.

Folding the multiple steps of a workflow into one tool (e.g. schedule_event) instead of mapping every API endpoint 1:1. More tools ≠ better.

Hand the schema to the API and the model is constrained at the decode layer — it physically cannot emit tokens that violate the schema. Unlike JSON mode, which only asks then you validate.

Tools marked defer-loading stay out of the initial context; the model searches them by name/description on demand. Tames tool explosion — ~85% token savings reported.

Present tools as a code API and let the model write code to orchestrate them instead of calling each directly — cuts both tool-definition and intermediate-result token cost by 1-2 orders of magnitude.

Overlaying numbered boxes on interactive elements in a screenshot fed to the model. Expensive (hundreds of tokens per shot) but works on almost any UI. One observation format for GUI agents.

Representing a UI by the browser's semantic tree (role / name / state) fed to the model. Far cheaper than screenshots, but depends on site markup quality (most sites are messy in practice).

A skill = a directory + `SKILL.md` (YAML name/desc + body). Three-level progressive disclosure: name resident at startup → body loaded when relevant → attachments explored on demand. Shares the 'load on demand' mechanism with Ch6. An open cross-platform standard as of 2025.

Information the system needs to remember at a given moment — task progress, tools called, current context summary.

System doesn't remember prior requests; each request is independent. LLM APIs are stateless.

System retains process information; can progress a task continuously.

Agent's ability to save + reuse historical information. Primitive vocab in Ch 04; production engineering in #8.

Information in the current context window; directly participates in model reasoning.

Persistent storage outside the model's window (files / DB / vector store / graph) that survives across steps, sessions, and tasks — vs the volatile in-window working memory (Ch6). MemGPT's virtual-memory metaphor: context = RAM, external = disk, the agent pages between them with tools.

Memory of "what happened" — past trajectories / conversation history, kept in recall storage and retrieved by relevance + recency. Reflexion's reflection buffer is its engineering form (storing verbal lessons from failed trajectories for the next retry).

Memory of stable knowledge and facts — user preferences / project constraints / world knowledge, kept in a structured store or knowledge graph (e.g. Zep's temporal graph, which understands state changes rather than coexisting facts).

The most important information in the current task. Usually placed at the top of the context window / start of the system prompt.

Where memory is persisted — the five memory types map to three storage forms: vector / key-value-or-file / knowledge graph. Choice trades integration speed against architectural depth (mem0 fast-shallow · Letta deep-managed · Zep/Cognee graph-structured).

Save data so it survives program restarts. LLM system state must be persisted (else users lose history on reconnect).

A save point during execution — used for failure recovery, resume, and rollback. Required for long-running agents.

Context unit covering one continuous interaction or task. A session ID ties multiple LLM calls together.

The four verbs of any memory system: write (when to record — not everything; at milestones or model-judged), read (on-demand recall scored by recency·importance·relevance, originating with Generative Agents), update (handle staleness + state-change conflicts), forget/compress (dedup & summarize, wary of over-compression's 'lobotomy').

Know-how — i.e. Skills. Distilling reusable multi-step workflows into callable procedural knowledge; ProcMEM turns passive episodic narratives into executable skills with activation/execution/termination conditions (no parameter updates).

Letta: split the agent in two — a primary agent that only converses and searches external store, and a sleep-time agent that asynchronously tidies memory during idle turns (consolidating archives / rewriting messy blocks / summarizing recent dialogue). Keeps conversation un-slowed + proactively refined. 'The agent does chores while idle.'

The everyman version of self-improvement: a markdown read at the start of each session, written back as you learn — read→work→learn→update→start-better, a compounding loop (the plainest form of the Reflexion loop). Honest failures: bloat (blowing up context) / staleness (stale architecture left in) / instruction dilution → memory must self-govern.

Everything the model can see right now — system prompt + conversation + tool results + files + retrieved snippets.

Maximum token range the model can process in one call.

Smallest text unit the model processes. ~1.3 tokens per English word, ~2 per Chinese character.

Input to the model — task, background, constraints, format, examples.

High-priority instructions defining model role, behavior bounds, safety rules, output requirements.

Behavior instruction set by the application developer; higher priority than user input, lower than system prompt.

A reusable prompt structure with variable slots filled in at runtime. Production prompts are almost always templated.

Compress long context into a short summary; saves tokens while preserving key info. A core action in the Context Engineering sub-discipline.

Boil long content down to short content — a common technique for context compression.

Extract refined, more usable knowledge or rules from complex content. More structured than summarization.

Priority order across instruction sources — system > developer > user > web/tool content. A key LLM safety design.

An agent's (not a pure reasoning model's) performance peaks between 3 and 7 turns; beyond that, accumulated external state (tool outputs / failed attempts / environment responses) becomes contradictory or overwhelming and results actively degrade. Same root as context rot — more is not better; stacking sequential reasoning has a ceiling for agents.

The set of strategies for curating and maintaining the optimal token set at each step (Anthropic). Karpathy's analogy: the context window is the agent's RAM and the model is the CPU, so this is OS-level scheduling of what to load into RAM. Principle: find the smallest high-signal token set.

Passive degradation: the more input tokens, the worse the model recalls/reasons, even when the task isn't harder. Root cause: n² attention stretched thin + short-sequence-heavy training. Consequence: the claimed window far exceeds the effective window (NoLiMa: most models drop below half baseline by 32K).

Position bias: information at the start or end of context is recalled best, the middle much worse — a U-shaped curve (Liu 2023, mirroring the serial-position effect). Newer models mitigate it on simple tasks but complex long tasks still suffer. Fix: recite key info to the end (the high-attention zone).

Active degradation: repeatedly rewriting/compressing context loses a little detail each time, eroding cumulatively (named by ACE). Comes with brevity bias (dropping domain insight for concision). Orthogonal to context rot. Fix: reversible + incremental delta updates, not monolithic rewrites; keep key constraints elsewhere.

During decode, the Key and Value computed for each token are stored and reused, cutting each step's work from recomputing the whole history to computing just one new token. The cost is a cache that grows linearly with context length and dominates GPU memory — serving's capacity constraint is fundamentally about it (first principles in #2 Ch4). A high-leverage derived use: a shared prefix can be reused across requests (prefix caching), hitting at ~1/10 the price of a miss and sharply cutting time-to-first-token — the top cost lever for agents and multi-turn chat, with the disciplines of a stable prefix (no timestamps), append-only history, and explicit cache breakpoints (see #8 Ch6).

Four directions for managing the context RAM (LangChain's canonical skeleton): Write out of the window (scratchpad/memory), Select in on demand, Compress to essentials (lossy), Isolate across sub-agents' own windows. Each treats one ailment: poisoning / distraction / confusion / clash (Breunig).

The core pattern of the Select strategy: don't preload — keep lightweight identifiers (file paths / URLs / queries) and pull with a tool only when the current step truly needs it. Mirrors human cognition — you don't memorize the whole filesystem. Claude Code doesn't load the whole codebase, it explores files on demand.

Summarize a conversation nearing the limit and reinitialize a new window from the summary (Anthropic) — the first lever for long-task coherence. Tuning: maximize recall first, then precision. Lossy (collapse risk) → keep key constraints in CLAUDE.md. Three takes: encrypted (Codex) / human-readable (Claude Code) / model-decided (OpenCode).

Write large, re-readable, not-immediately-needed content (web pages / logs / PDFs / big tool outputs) to a file, keeping only a pointer in context. Lossless (the original stays on disk), so preferred over lossy compaction. 'Offload before you compact; isolate before you let it into the main window.'

Treat the window as a budget scheduled at runtime: allocation (four consumers — system+tools / history / retrieved / scratchpad — compete; stable goes first, goals go last), eviction (who gets swapped out; LRU (least-recently-used)/hot-tail; eviction ≠ deletion but moving to a recallable external), thresholds (percentage / absolute tokens / task boundary).

The input side of context engineering: what representation of each step's perceived environment to feed into context (not perception quality = #7, but 'what tokens to feed'). Techniques: tool-result truncation / cite-don't-dump / structured over prose / fidelity of error observations. A bad representation manufactures context rot at the source.

The principle running through context engineering: the signal-to-noise ratio of relevant information matters more than total volume. The Five Sigma case — curated, schema-ized relevant data exceeds 95% accuracy, while dumping the whole document corpus is far lower. In short: feeding everything is not feeding the right thing.

Retrieval-Augmented Generation — retrieve relevant material, then generate based on it.

Compress text into a fixed-dimension vector (commonly 1536); similar meanings produce close vectors.

An array of numbers expressing semantic features of text, image, or other data.

Database specialized for storing + searching vectors — Pinecone, Weaviate, Chroma, Milvus, Qdrant.

A small piece resulting from splitting a long document; used for embedding and retrieval.

Return the K most relevant results during retrieval.

Re-sort retrieved results using a stronger model or algorithm. Not taught in foundations — see #3.

Have the model answer based on reliable sources, not invent freely.

Content the model probability-stitches together but isn't real / accurate.

Raw material that gets retrieved and cited — PDFs, web pages, Markdown, code files.

The process of splitting a long document into chunks. Bad chunking tanks retrieval quality.

Find semantically similar content by vector distance. The core operation of a vector database.

Whether relevant content is retrieved at all. One of two retrieval-quality metrics (the other is precision).

Whether retrieved content is actually relevant. Typically trades off against recall.

A data structure built for fast retrieval. Vector DBs use HNSW / IVF / etc. index types.

Data about data — filename, page, section, timestamp, permission tags. Used as retrieval filters.

Show where an answer came from for verification and traceability. A core production feature of RAG systems.

An explicit chain of task steps. Production workflow orchestration belongs in #8.

Directed Acyclic Graph — represents task dependencies; common in workflow orchestration.

Dispatch requests to the right module, tool, or Agent based on task type.

Higher-level Agent that manages other Agents.

A specialized Agent invoked by a main Agent. Vocabulary only in foundations; production design in #8.

An encapsulated capability bundle — includes description, applicability, tools, constraints, execution flow.

Control flow using explicit states + transitions — e.g., Draft → Review → Approved → Published.

A processing unit in a workflow or graph.

Path, dependency, or transition between nodes.

Dispatches requests, events, or tasks to the matching handler or worker.

A main agent assigns a task to a subagent. Delegation engineering (Anthropic): each subagent must get an objective + output format + tool guidance + clear boundaries; effort-scaling writes 'how many agents' into the budget (simple 1 / comparison 2-4 / complex 10+). Fixing shared assumptions upfront engineers away the parallel conflicts Cognition warned about.

The core primitive of decentralized topologies: a function returning 'another agent'; calling it transfers control plus the full current conversation history to the target → context stays continuous. The design axis is how much state to pass (full / filtered / structured payload): too much is costly + noisy, too little loses consistency.

Registry of available skills. Loaded at Agent runtime startup.

What the system can do — search, write code, read file, generate image, query DB. Capability is a more abstract description than skill or tool.

Rules that guide system decisions — when to call a tool, when to require confirmation, when to stop.

The agent-to-agent protocol (vs MCP's agent-to-tool): agents discover each other's capabilities and hand off tasks. v1.0 by 2026, 150+ orgs in production. Depth → Ch8.

tool = atomic primitive providing access (fetch/read/write/search, no internal decisions) · skill = reusable workflow know-how (MCP handles access, Skills handle workflow) · subagent = a born-isolated worker (clean context, restricted perms, returns only a result). Three layers compose, not either-or; high-token intermediate work → subagent, need to restrict perms → subagent.

Making an agent better via verbal feedback + accumulated memory/skills, where the policy is text in the context and weights don't change = what #8 teaches. Weight-updating RL (SFT/RLHF/RLVR) = #6. Hard line: touch weights → #6, don't → #8; #8 produces trajectories that feed #6's training. Division: #8 designs the action space, #6 learns the policy.

The root of gradient-free self-improvement: Actor acts → Evaluator judges the trajectory → Self-Reflection verbally distills failures into a text lesson → stored in an episodic buffer → fed into context next time. The policy is accumulated reflection text, not weights (hence 'verbal RL'). HumanEval 91%.

Distilling past experience into reusable skills: Voyager (ancestor of skill libraries) → ExpeL (cross-task natural-language insight) → Trace2Skill (parallel-analyze a pool of trajectories → a conflict-free SKILL.md, cross-model transferable) → ProcMEM (executable procedural memory). 'Memory is distillation, not storage'; distilled skills transfer across model scales.

Ch8's spine: multi-agent is not a free lunch — it trades token cost + fragmentation risk for parallel throughput + breaking the single context window. Decision framework = parallelizability × shared-context need. Anthropic (+90%/15× tokens · breadth research) and Cognition (single-threaded · coding) are both right; workload decides.

From simple to complex: single agent + tools → sequential pipeline → orchestrator-worker (central) → decentralized handoff/swarm → conversational network → debate. Stay simple: prove the level below is insufficient before climbing. First watershed = centralized (parallel/fragments) vs decentralized (continuous/hard-to-parallelize).

The first cost of multi-agent (deeper than money · Cognition's insight): parallelism disperses decisions and full agent traces aren't shared → subagents act on unstated, conflicting upstream assumptions → fundamentally inconsistent, irreconcilable outputs (the Flappy Bird example). Token cost is the symptom; lost decision-consistency is the essence.

A topology: multiple agents propose→critique→converge over rounds with voting. Opposite to 'fix conflict upstream', debate deliberately creates disagreement then aggregates, using conflict itself to refine reasoning and resist hallucination — good for math/strategy reasoning (trading tokens for accuracy).

How multi-agent outputs are combined. Deterministic aggregation (voting / schema-check / dedup): reliable, auditable, cheap, but only for structured outputs. LLM-merge (one agent synthesizes semantically): can reconcile semantic conflicts but is costly and fails on fundamentally inconsistent outputs. Hence the fix is upstream (fix assumptions at dispatch), not downstream merging.

Splitting work across models to cut cost (strong planner + cheap executor). The cost logic holds, but 2026 hands-on tests show a strong planner + cheap executor often loses on quality to a single frontier model in a mature harness → let the model decide when to delegate. Folk 'cut cost N×' multipliers often lack first-hand sourcing — use the qualitative direction, don't hard-code numbers.

Interface for system-to-system communication. LLM APIs are stateless.

Common API style using GET / POST / PUT / DELETE etc. to operate on resources.

Return results as they're generated. LLM streaming drops first-token latency (TTFT) from seconds to ~100ms — feels 10× faster.

Persistent storage + complex queries. Typical Agent stack: Postgres + Redis + Vector DB.

Cache expensive things (slow queries, LLM calls) for reuse. Watch for stale + consistency pitfalls.

Async buffer — producer pushes, consumer pulls at its own pace. Solves peak smoothing + decoupling.

Package an app + its deps into a reproducible, deployable runtime. Docker is the most common.

Continuous Integration / Continuous Deployment — automatic test + deploy on every push.

A specific API address, e.g. `POST /v1/chat`.

Client-to-server data. An HTTP request has method, URL, headers, body.

Server-to-client data. An HTTP response has status code, headers, body.

Call a remote service like a local function. gRPC is a common implementation.

Protocol for bidirectional real-time client-server communication. Required for agent progress notifications, chat UIs.

Machine or cloud service that runs backend code.

Application that consumes a service — browser, iOS app, desktop app, CLI.

The part that owns business logic, DB, permissions, model calls, and APIs.

What the user directly sees and interacts with. LLM app frontends often handle streaming display and tool confirmation UI.

Relational database query language. Used by Postgres, MySQL, SQLite. Preferred for strongly structured data.

Umbrella term for non-relational databases — MongoDB, Redis, Pinecone, Neo4j, etc.

Process that consumes queue tasks and does the work. Standard component in long-running agent architectures.

Task that runs on a fixed schedule — e.g., 'reindex documents every day at 2am'.

The most common container tool. Packages app + deps into an image that runs identically anywhere.

Deployment without directly managing servers; runs services per-request or per-container. GCP Cloud Run, AWS Lambda, Vercel Functions.

Config injected at deployment time — API keys, DB URLs, model names. Never hard-code these.

Sensitive config — API keys, DB passwords, OAuth tokens, private keys. Must live in a Secret Manager, encrypted.

Determine 'who you are'. LLM apps typically use OAuth, JWT, or session cookies.

Determine 'what you can do'. Different from authentication (who you are).

Common authorization protocol; lets apps access user resources on third-party platforms (GitHub, Google, Slack).

External system POSTs to your endpoint when an event happens — opposite of polling.

A runtime that checkpoints each step to a DB so a crashed/restarted process resumes from the last checkpoint instead of re-running — keeps long agents from losing progress.

A key identifying a side-effecting operation; checked before replay so actions like writes/orders/emails aren't executed twice.

A restricted environment that contains model-generated code as semi-trusted code; its goal is to limit the blast radius when the model errs. Built on isolation + least privilege + defense in depth.

Two independent knobs: approval is the autonomy axis (does an action need a human first?), sandbox is the containment axis (how much damage if it runs?). Freely combinable — stronger isolation buys higher autonomy.

A Linux mechanism that filters which syscalls (and arguments) a process may issue. Complements Landlock (it filters syscalls; Landlock guards kernel objects).

A Linux Security Module that does access control at the kernel-object level (files, ports), and lets an unprivileged process restrict itself. Not the same as seccomp — the two stack complementarily.

Reimplements most Linux syscalls in userspace so the contained code's syscalls don't hit the host kernel directly, shrinking the attack surface. Cost: incomplete syscalls + workload-dependent overhead. Still shares the kernel.

A minimal microVM giving each workload its own kernel (hardware boundary), emulating only 5 devices, ~125ms boot / <5MiB. The de-facto standard for multi-tenant untrusted code (e2b / Vercel Sandbox).

Deny-by-default outbound control: the sandbox has no network interface; its only exit goes through an out-of-sandbox proxy enforcing a domain allowlist. A resource boundary in Ch4, the anti-exfiltration linchpin in Ch5. Limit: the proxy doesn't inspect TLS, so trusted domains remain exfil channels.

The agent sends credential-free requests; an out-of-sandbox proxy injects the real credentials and forwards them — the agent never sees the secret. Credentials stay centralized, loggable, and endpoint-allowlisted.

An approval rule (parsing/AST matching) is a permission gate deciding 'was it asked?' — arg-level patterns can be bypassed, so it's not a security boundary. The OS sandbox decides 'is it allowed?' — that's the enforced isolation. Both layers are needed.

Hijacking an agent by hiding malicious instructions in content it reads. Original sin: instructions and data share one token channel, and natural language has no 'parameterization' to fix it (unlike SQLi's prepared statements). Direct (user jailbreak) vs indirect (third-party content — the agent-era main battlefield).

Willison 2025: access to private data + exposure to untrusted content + ability to communicate externally — all three present make data theft possible. The most reliable defense is removing one leg architecturally (not adding a prompt guardrail).

The essence of injection: the agent is a deputy holding the user's high privilege, and injection lets untrusted content 'borrow' that authority. The failure isn't reading hostile content — it's that hostile content can borrow the model's authority. So defense = keep dirty data away from high-privilege decisions.

MCP-specific attacks: instructions hidden in a tool description (the model reads them, the user UI doesn't), 'line-jumping' into context during the handshake before any call, or changing behavior after approval (rug pull). Measured ASR ≈ 66%, refusal < 23% — model alignment doesn't stop it.

The chapter's key distinction. Filter: detect and block bad content (necessarily bypassed by adaptive attacks). Constraint: architecturally ensure that even a successful injection can't reach high-privilege decisions — a guarantee, not a probability. Prefer architectural patterns + least privilege + egress over piling on classifiers.

Willison 2023. A privileged P-LLM orchestrates and calls tools but never touches untrusted content; a quarantined Q-LLM processes dirty data but has no tools; Q returns results only as symbolic variables ($VAR) to P. Untrusted data never reaches the tool-calling LLM — OS-level privilege separation.

Google+DeepMind+ETH. The P-LLM generates sandbox-DSL code; data carries capability labels (source + allowed destination) tracked end-to-end; policy is enforced at each tool call. No model changes — a pure architectural guarantee. 77% of AgentDojo tasks with provable safety vs 84% undefended (cost ≈ 7 points).

Meta 2025. Within one session an agent may satisfy at most two of three properties (process untrusted input / access sensitive data / change state or communicate externally); if all three are needed it must not run autonomously — requiring human-in-the-loop + context reset. The actionable checklist version of the lethal trifecta.

OWASP LLM06. Its three root causes are the three knobs of least privilege: excessive functionality (too many tools → narrow the toolset), excessive permissions (over-broad credentials → task-scoped least-privilege tokens), excessive autonomy (acting without approval → a human gate).

A known failure mode of human-in-the-loop (OWASP ASI09): too many approval prompts → users reflexively click yes, so approval becomes meaningless. Implication: approval-UI design is itself security engineering (defaults, how key info is shown, whether dangerous details are force-expanded).

A production harness finds a point among three pulling goals — quality, speed, cost — with no free lunch: chasing one usually sacrifices the others. The engineering move is to fix the workload's acceptable floor (how accurate / how long it can wait / how much it can spend) first, then find a point inside the triangle that meets it.

Caching the attention key-values of the prefix an agent loop re-sends each turn (system prompt + tool definitions + history); a hit skips prefill, reads at about 0.1× base, and input cost drops 5-10× — the top lever for controlling agent cost. Top failure mode: a changing element at the top of the prefix (e.g. a timestamp) invalidates the whole cache and silently bills full price.

Tests a single function, module, or handler. Applies to LLM systems too — test prompt + tool outputs.

Standard task set for evaluating Agent performance. 4-layer stack: unit / behavior / A/B / human.

Standardized, comparable evaluation. Used for cross-model / cross-version comparisons.

Human-verified test set with correct answers. The bedrock of Eval; grows continuously.

Record what the system did and when. LLM systems need structured logging to be analyzable.

The complete execution path of one request, end to end. LLM traces include every step of the agent loop.

Whether you can see what happened when something breaks. Three pillars: logs + metrics + traces.

Time from request to response. LLM systems track TTFT + tokens/sec, not just total time.

Requests per unit time. One axis of the trade-off lens.

Resources + money the system consumes. LLM systems track token cost + infra cost + human cost.

Verify the system works as expected. LLM systems add an eval layer (behavior quality) on top of traditional testing.

Test that multiple modules work together. LLM integration tests typically include real LLM calls.

Test the full pipeline from user input to final output. The heaviest and slowest test type.

Prevent new changes from breaking existing functionality. Golden sets are the basis for LLM regression tests.

Test condition like `assert output.contains('citation')`. LLM evals often use loose asserts (contains / startsWith / in set).

Quantitative data about system performance — success rate, latency, token usage, tool failure rate. One of the observability trio.

Quantifies agent capability as how long a task — in human work-time — a model can finish at 50% reliability. Roughly doubling every 7 months (accelerating); Opus 4.5 ≈ 320 min. A trend anchor, but 50% reliability ≠ production-grade (~99%).

A training environment = sandbox (isolation + stateful reset + reproducibility) + reward (a verifiable signal) + reset (to baseline). #8 makes the execution sandbox reusable by a training loop; data/algorithms belong to #3/#6.

A 2025 result: 12 published injection defenses were all broken by adaptive attacks, most >90% ASR (their papers reported near-zero), and human red-teamers succeeded 100%. Lesson: static self-evaluation gives false security → defensive eval must use adaptive red-teaming; 'passing eval' ≠ 'secure'.

The de-facto benchmark for agent adversarial robustness. Three metrics: Benign Utility (completion with no attack) / Utility Under Attack (still completing correctly under attack) / ASR (fraction executing all malicious steps). Judged by formally checking environment state, not an LLM judge (which the same injection would fool).

Moving the unit of evaluation from a single input-output pair down to the whole multi-step, stateful trajectory. Scoring only final output systematically misses failures (a 2026 consensus puts it at 20-40%), because agent failures often emerge only across steps.

The core trade-off in agent eval. Default to grading the environment's final state (so you don't kill valid approaches the designer didn't anticipate), supplemented by process signals for cheating, partial credit, efficiency, and diagnosis. Key distinction: outcome is environment state, not the agent's self-reported transcript.

A pair of metrics for non-deterministic agents. pass@k (at least one success in k tries) is the capability ceiling, optimistic; pass^k (all k succeed) is the reliability floor, decaying as p^k. Production cares about pass^k: a 90%-per-try agent succeeds 8-in-a-row only about 43% of the time.

Agent tasks are inherently staged, so 'half right' is meaningful. Scoring intermediate milestones preserves the improvement signal a binary solve-rate erases (an agent that identifies the problem and verifies identity but fails the refund beats one that fails immediately).

An execution-based coding benchmark on real GitHub issues, once the de-facto standard. Its Verified subset became contaminated (tasks verbatim in training) and was widely reported as dropped; SWE-bench Pro resists contamination with multi-language + private codebases + a standardized scaffold — the same model scores 81% on Verified but 46% on Pro.

When a benchmark's answers leak verbatim into pretraining, or are publicly retrievable (gold answers on HuggingFace, browsing agents finding walkthroughs), inflating scores by 5-15 points. Countermeasures: private data and network isolation.

Whether a benchmark actually measures what it claims. In 2026 UC Berkeley's BenchJack gamed 8 major agent benchmarks to near-100% without solving anything (10 lines to pass all tests, swapping the curl binary, an empty JSON, injecting the judge) — validity became a trust crisis, 'like web security in 2005.'

Using an LLM to score open-ended outputs that can't be judged mechanically. Scalable and flexible, but the real engineering problem isn't using it — it's validating it (agreement with humans) and operating it (guarding against bias and drift).

The right metric for judge-human agreement — it measures actual agreement, not linear correlation (a judge can correlate perfectly yet be systematically biased). Thresholds: above 0.80 strong, 0.60-0.80 acceptable, below 0.60 redo the rubric; human-human agreement is itself about 0.80.

Systematic biases in LLM judges: position (favoring a slot), verbosity (favoring longer answers), self-preference (favoring same-family models, hardest to fix), format, and calibration drift (distribution shifting when the model version bumps). Unaudited, bias gets mistaken for signal.

The meta-principle for mitigating judge bias: a single judge is unreliable, so use a panel of smaller, cross-family judges scoring independently and then aggregate (vote or average) — more robust than one strong judge; aggregation must account for inter-judge correlation (same-family judges share errors).

Operating an LLM judge like a drifting measurement instrument: a version contract pinning (judge model id, rubric version, prompt template hash), treating a judge upgrade as a suite migration, and monthly recalibration against human samples. Cautionary tale: a dashboard can stay green and lie for three months (a measured κ of just 0.31).

Attributing the root cause of an agent failure to one of four quadrants — harness (scaffold), model (the model itself), inference (sampling/decoding), product (task/grader) — to decide where the fix lands. Methods: controlled variables (swap scaffold not model, and vice versa), isolated trials, and suspecting the eval first at the 0%/100% extremes. Ch9 defines the framework; Ch10 invokes it for step-by-step diagnosis.

The eval test system: running tasks concurrently in batch, recording every step's trace, applying graders, aggregating results. Distinct from the runtime agent harness (orchestrating tools, managing memory, producing output) — the two must be separated, like a CI/CD pipeline versus an application runtime.

Treating evals as a CI quality gate on every change (tiered: dev subset → staging full → prod plus safety), plus a flywheel where every production regression becomes a new test case, compounding reliability upward. Trigger: run the full suite on every model, prompt, or tool change.

A canonical classification of agent failures: 5 families (A tool/action, B reasoning/control, C context/memory, D coordination/verification, plus E a security pointer) of ~19 named modes, each carrying a 'which chapter fixes it' column. Diagnose by synthesizing a usable view, not memorizing any one academic taxonomy.

The iron rule of diagnosing a failing trajectory: a long downstream chain of errors usually stems from one upstream root-cause error. Locate and fix only the root; don't chase the propagated errors it dragged off course (AgentDebug's core distinction).

The earliest step along a failing trajectory where the model's output or action begins to diverge from the correct path (empirically often around step 2). It is the anchor for locating the root cause in the post-mortem SOP.

The 6 steps a human walks to diagnose a failing run's full trajectory: get the whole trace, find the first divergence, attribute to AgentDebug's four modules, map to Ch9's failure-attribution quadrants, name it and point to the fixing chapter, then fix and harden into a regression.

Reviewing an un-run agent design with the three pillars (reliable/scalable/maintainable), the roadmap's chapter spine, and the failure taxonomy; the key move is to pause for a first-impression judgment before checking item by item.

Agent behavior silently shifts after a model / prompt / tool-schema upgrade, often as several seemingly harmless changes stacking up (Anthropic's 2026-04 Claude Code incident was exactly this). Guarded by per-model evals on every change plus a soak period.

Triage (what's worth fixing), package into a targeted eval, investigate the root cause (read trace / eval / repo / skills), fix and verify, then harden into a regression; ambiguous cases routed back to humans. The human-in-the-loop counterpart to Ch7's automatic agent self-evolution.

A system whose overall behavior emerges from many simple local interactions and can't be reduced to any single part. The test isn't how many parts it has, but whether the interactions can be decomposed away.

A system that, however many parts it has, can be decomposed, predicted, and reassembled with unchanged behavior (e.g. an airplane). The foil to 'complex' — a useful on-ramp from the Cynefin framework.

A new whole-system property arising from many local interactions at a larger scale that can't be derived from the parts. The core concept of complex-systems science (Anderson, 'More Is Different').

Global order forming spontaneously out of local interactions, with no central controller and no external blueprint.

A system's output routed back as its own input. Reinforcing loops (positive feedback) amplify change toward exponential growth; balancing loops (negative feedback) suppress it toward stability; a balancing loop with delay oscillates (Meadows).

Output not proportional to input — small causes can have large effects and vice versa. In complex systems, cause and effect stop being a straight line.

In a deterministic system, tiny differences in the starting point are amplified exponentially (roughly ε·e^(λt)), making long-term prediction impossible (Lorenz 1963). It describes error growth, not a lever to steer outcomes; the famous 'butterfly' image comes from a later Lorenz talk, not the 1963 paper.

A complex system made of adaptive agents: each carries an internal model and strategy that change with experience, while the whole population is shaped and evolved under selection pressure — adding, on top of self-organization (fixed rules emerging order), a layer where the rules themselves change and the system is selected (named by John Holland).

New nodes tend to attach to already-popular nodes, producing a 'rich-get-richer' hub structure that explains the scale-free hubs common in networks (whether scale-free is universal, and whether the internet counts, has been contested since 2019; Barabási & Albert 1999).

Parts coordinate not by talking directly but by leaving perceptible traces in a shared environment (e.g. pheromones): write a trace, read traces, act accordingly — positive and negative feedback converge local actions into global order (Grassé 1959).

Crossing a threshold makes a system reorganize and jump to another stable state (often nonlinearly); the IPCC definition adds that removing the trigger doesn't necessarily return it to the original state.

After a system flips to a new state, removing the original trigger doesn't retrace the path back — recovery costs far more than the trigger did (a ball in a valley).

A trigger kicks the system into a bad state and a reinforcing loop (e.g. a retry storm) locks it there, so it can't escape even after the trigger is gone — feedback and hysteresis combined, in distributed systems (Bronson et al. 2021).

Drawing a system as nodes (points) and edges (lines); the number of edges at a node is its degree. Describe and explain behavior by the shape of the connections rather than the parts themselves.

A network with both high clustering and short path lengths — a few long-range shortcuts compress a clustered, large world into one where any two points are close (Watts & Strogatz 1998).

A network whose degree distribution follows a power law, dominated by a few hubs, with no 'typical' degree. Hub dominance is a real and common pattern, but strict scale-freeness being universal is contested (Broido & Clauset 2019).

A high-degree node with far more connections than the rest. It makes a network robust to random failure but fragile to targeted attack (two faces of the same structure), and acts as a super-spreader in propagation.

A fully deterministic system (no randomness in its rules) becoming unpredictable long-term due to extreme sensitivity to initial conditions; the strict criterion is 'at least one positive Lyapunov exponent in a bounded phase space.' Chaos ≠ random (it's deterministic) and ≠ complex (it can be low-dimensional, like the single-variable logistic map).

The phase-space set a chaotic system is drawn onto long-term: bounded, never exactly repeating (aperiodic), and fractal. Lorenz gave the first concrete example; Ruelle & Takens (1971) named the class.

Measures the average exponential rate at which nearby trajectories separate in phase space. A positive exponent in a bounded system is the fingerprint of chaos (positive alone isn't enough — it must also be bounded); the inverse of the largest exponent (Lyapunov time) roughly equals the prediction horizon.

Exponential error growth makes a deterministic system's forecast trustworthy only within a finite time window, on the order of the inverse of the largest Lyapunov exponent. It's an intrinsic limit no perfect model or compute can cross (e.g. mid-latitude weather, Zhang 2019).

A whole-system, qualitative jump in macroscopic state when a control parameter (e.g. temperature) crosses a critical value (water↔ice, a ferromagnet gaining/losing magnetism at the Curie point). Abrupt, not gradual; the rich 'a local move shifts the whole' critical phenomena appear at continuous transitions.

The state of a system sitting right at a phase-transition boundary: correlation length diverges, fluctuations span all scales, and different systems share critical exponents (universality). Complementary to Ch3's tipping point — that covers the dynamics of flipping past a threshold, this covers the statistical structure near the critical point.

A system driven by its own dynamics toward and held at the critical point, with no external fine-tuning, showing events of every size (a power law); the canonical toy model is the BTW sandpile (Bak, Tang & Wiesenfeld 1987). Its universality is contested — even real sandpile/rice-pile experiments don't always yield power laws.

A distribution of event sizes with no characteristic scale: many small events, few large ones that aren't negligible (a fat tail), self-similar across scales. Here it's the size distribution of events/cascades/avalanches, distinct from Ch4's scale-free network (a power law in node degree). Empirical claims of strict power laws are often overstated (Clauset et al. 2009).

As connection probability or density rises, a system abruptly forms a giant cluster spanning the whole at a critical value — the cleanest intuition for a 'suddenly connected' phase transition (Broadbent & Hammersley 1957; forest fires, random-graph connectivity).

A local failure spreading along the couplings between parts to engulf the whole; in a critical system, cascade sizes follow a power law (mostly small, occasionally system-wide). Ch3's metastable failure and Ch4's hub blast radius are both instances.

The basic unit of a complex adaptive system: a part that senses its environment, acts on rules, and carries an internal model and strategy that update with experience. Contrast with Ch2's parts, which only run fixed local rules — this one's rules change.

The engine by which a population of strategies improves over time with no designer: variation generates diversity, selection keeps what works, retention passes it on — repeat, and it 'climbs.' Genetic algorithms are a computational instance; it's a biology-inspired model, not literal biology.

A modeling method that, instead of writing system-level equations, gives each agent a simple local rule, lets them interact, and observes the macro-level emergence (Schelling segregation, Sugarscape, the Santa Fe artificial stock market).

Picturing 'how fit each strategy or genotype is' as a terrain of peaks and valleys, with evolution climbing it; rugged, multi-peaked terrain traps you at local optima. Coevolution keeps the terrain itself moving, so living systems have no final equilibrium.

Multiple agents act as each other's selection pressure, each one's fitness landscape reshaped as the others move (the Red Queen: you run flat out just to stay in place). It's the source of 'the landscape moves.'

A place to intervene in a complex system where a small change shifts the whole system's behavior. Donella Meadows ranked them in twelve levels from weakest (constants/parameters/numbers) to strongest (transcending paradigms), noting that people instinctively push the weakest end — often in the wrong direction — while the high-leverage points (paradigms, goals, rules, self-organization, information flows) are the most powerful yet hardest to move. Note: it's Meadows's practitioner heuristic ordering, not a verified law (she called the order 'slippery').