Abstract. The single-process, single-context LLM agent is a prototyping artifact that has been mistaken for an architecture. This essay argues that its failure modes are not prompt-engineering defects but structural ones, and describes a four-tier topology that replaces one unbounded context with four bounded ones, adds always-on background cognition as a first-class subsystem, and splits control-plane orchestration on constrained edge hardware from data-plane inference on ephemeral cloud GPUs.
A monolithic agent holds policy, perception, and verification in one process with one context window. Three pathologies follow, and they compound.
Context pollution. Attention is a fixed budget. Every tool result, stack trace, and retrieved document competes for it, and recall on mid-context material degrades as the window fills. Worse than performance degradation is the epistemic consequence: the context is an append-only log in which a speculative inference at turn 3 is structurally indistinguishable from a verified fact at turn 30. The model re-reads its own earlier guesses as established premises. There is no mechanism by which the agent can tell what it knows from what it assumed.
Tool sprawl. Tool selection is a classification problem over N labels with deliberately overlapping semantics. At roughly 120 tokens per JSON schema, forty tools impose ~4.8k tokens of permanent overhead on every turn, used or not. The failure is silent: faced with read_file, grep_search, and read_file_range, the agent picks one that is plausible and receives a plausible-looking wrong answer.
Non-deterministic loops. The loop terminates on model self-assessment — "this should fix it" — rather than on a state predicate. Without a diff of world state between iterations, retry N+1 is isomorphic to retry N. The signature is three different edits to the same failing test, each accompanied by a confident rationale.
A unified diagnosis: one process owns policy, perception, and verification at once, so no failure mode is independently observable. Separation of concerns here is not aesthetic. It is the precondition for making failures attributable.
The invariant across tiers: each has a distinct tool surface, a distinct context budget, and a distinct termination predicate — a machine-checkable condition, not a sentence.
┌──────────────────────────────────────────────┐
Atom / web ──▶│ SCOUT read-only perception │
(anonymous) │ ctx ≤ 32k │ tools: fetch, parse, dedup │
└──────────────┬───────────────────────────────┘
│ Finding{claim, uri, quote, sha256}
┌──────────────▼───────────────────────────────┐
│ ARCHITECT frontier reasoning │
│ ctx ≤ 200k │ tools: DAG store, AST parser │
└──────────────┬───────────────────────────────┘
│ TaskNode{spec, acceptance_cmd, deps}
┌──────────────▼───────────────────────────────┐
│ ENGINEER surgical edits, TDD │
│ ctx ≤ 32k │ tools: aider, pytest, git │
└──────────────┬───────────────────────────────┘
│ Commit{sha, tests_passed, logs}
┌──────────────▼───────────────────────────────┐
│ SENTINEL always-on, ~200MB RSS │
│ rules + thresholds, no inference in hot path │
└───────────────────────────────────────────────┘
The Scout is read-only and deliberately anonymous: Atom/RSS feeds and semantic-web retrieval over a rotating egress, no authenticated keys. It does not synthesize. It emits Finding records carrying a verbatim quote, a source URI, a retrieval timestamp, and a checksum over the quote. That checksum is the anchor the verification layer later re-checks. Deduplication uses embedding similarity with MinHash as a cheap prefilter, and the tier is hard-bounded on fetches per task, per-domain rate, and response bytes.
The Architect runs the frontier model with almost no tools — only a DAG store and an AST parser. It decomposes work into typed nodes whose edges are data dependencies, and each node carries an acceptance command. AST verification happens at the boundary: any proposed source change is parsed and diffed at the syntax-tree level before a file is touched, so truncated or hallucinated-API diffs are rejected on entry rather than after a failed build.
The Engineer executes one node in an isolated worktree, TDD-first:
NODE=task-7f21
git worktree add ../wt-$NODE -b task/$NODE origin/main
cd ../wt-$NODE
pytest -q tests/test_$NODE.py # red: the acceptance command, before any edit
aider --model "$ENGINEER_MODEL" \
--read tests/test_$NODE.py \
--test-cmd "pytest -q tests/" \
--auto-test --yes --message "$(cat /run/node-$NODE/prompt.md)"
git commit -am "task($NODE): $(cat /run/node-$NODE/summary)"
git worktree remove ../wt-$NODE --force
Worktrees, not branch checkouts, because concurrent nodes must not contend for a single index. Aider's repo map substitutes for whole-file context, keeping the Engineer's window small enough to stay accurate.
The Sentinel is the only process that never stops. It runs as an ultra-lightweight daemon (~200MB RSS) with zero LLM inference on its hot path. It monitors host telemetry (CPU thermal limits, memory pressure, container heartbeats) and executes deterministic remediation rules when thresholds are breached.
Note: I don't have Sections 1–2 in context, so I've matched the register and picked up the threads implied by the outline. Numeric thresholds below are representative defaults for an 8GB dual-core Haswell edge node, not measurements of your specific host — treat them as tunable constants.
Turn-taking is a scheduling policy, not a cognitive architecture. A system that only perceives the world when a human presses Enter is, by construction, blind for the entire interval between prompts — which is precisely the interval during which resources exhaust, containers die, and thermal envelopes get breached. Reactive perception therefore does not merely delay diagnosis; it guarantees that every incident is discovered post hoc, at the point where the blast radius is already maximal.
Section 3 replaces the request-response cycle with a prospective layer: a set of always-on observers whose outputs are pushed into the agent's context as events, not pulled as queries. The design constraint is severe. The edge node is a dual-core Haswell with no GPU and finite RAM; a watchdog that costs 15% of the machine to supervise the other 85% is a net loss. Everything below is written against that budget.
Observation is stratified by how fast the underlying quantity can kill you.
Fast tier (1–5 s) — memory pressure, OOM proximity, container liveness, CPU package temperature. On Linux the authoritative signals are MemAvailable (not MemFree, which excludes reclaimable page cache and will make you panic-restart a healthy host), memory.pressure from PSI if CONFIG_PSI is enabled, and cgroup v2 memory.events for oom_kill counters. Thermal data comes from /sys/class/thermal/thermal_zone*/temp and, more usefully, the coretemp hwmon node, which exposes per-core and package critical thresholds.
Slow tier (30–60 s) — disk consumption, log growth rate, swap-in rate, Docker image layer accumulation, GPU quota burn-down on the remote side.
The split matters because the fast tier must fit in a single cheap read loop and the slow tier must not. Sampling the slow tier at fast cadence is the most common way a self-monitoring system becomes its own incident.
A threshold trip is a hypothesis, not a fact. Two consecutive samples beyond the bound, or an EWMA crossing it, filters the single-sample spikes that otherwise generate pages at 3 a.m. and train the operator to ignore them. Hysteresis on the recovery side prevents the equally corrosive flapping.
When a signal does trip, the response is a ladder, and each rung must be strictly cheaper than the failure it prevents:
Escalation is a rung on the ladder, not the first rung. A watchdog whose only action is "notify" is a logging system with extra steps.
restart: always is not self-healing. Against a crash loop it is an unbounded fork bomb with good intentions. The supervision loop must instead be a circuit breaker: exponential backoff (1 s → 2