# Architectural Evolution: From Monolithic LLM Agents to Specialized Multi-Agent Swarms > Source: > Published: 2026-10-19 05:45:54+00:00 **Abstract.** The single-process, single-context LLM agent is a prototyping artifact that has been mistaken for an architecture. This essay argues that its failure modes are not prompt-engineering defects but structural ones, and describes a four-tier topology that replaces one unbounded context with four bounded ones, adds always-on background cognition as a first-class subsystem, and splits control-plane orchestration on constrained edge hardware from data-plane inference on ephemeral cloud GPUs. A monolithic agent holds policy, perception, and verification in one process with one context window. Three pathologies follow, and they compound. **Context pollution.** Attention is a fixed budget. Every tool result, stack trace, and retrieved document competes for it, and recall on mid-context material degrades as the window fills. Worse than performance degradation is the *epistemic* consequence: the context is an append-only log in which a speculative inference at turn 3 is structurally indistinguishable from a verified fact at turn 30. The model re-reads its own earlier guesses as established premises. There is no mechanism by which the agent can tell what it knows from what it assumed. **Tool sprawl.** Tool selection is a classification problem over `N` labels with deliberately overlapping semantics. At roughly 120 tokens per JSON schema, forty tools impose ~4.8k tokens of permanent overhead on *every* turn, used or not. The failure is silent: faced with `read_file`, `grep_search`, and `read_file_range`, the agent picks one that is plausible and receives a plausible-looking wrong answer. **Non-deterministic loops.** The loop terminates on model self-assessment — "this should fix it" — rather than on a state predicate. Without a diff of world state between iterations, retry *N+1* is isomorphic to retry *N*. The signature is three different edits to the same failing test, each accompanied by a confident rationale. A unified diagnosis: **one process owns policy, perception, and verification at once, so no failure mode is independently observable.** Separation of concerns here is not aesthetic. It is the precondition for making failures attributable. The invariant across tiers: each has a distinct tool surface, a distinct context budget, and a distinct *termination predicate* — a machine-checkable condition, not a sentence. ``` ┌──────────────────────────────────────────────┐ Atom / web ──▶│ SCOUT read-only perception │ (anonymous) │ ctx ≤ 32k │ tools: fetch, parse, dedup │ └──────────────┬───────────────────────────────┘ │ Finding{claim, uri, quote, sha256} ┌──────────────▼───────────────────────────────┐ │ ARCHITECT frontier reasoning │ │ ctx ≤ 200k │ tools: DAG store, AST parser │ └──────────────┬───────────────────────────────┘ │ TaskNode{spec, acceptance_cmd, deps} ┌──────────────▼───────────────────────────────┐ │ ENGINEER surgical edits, TDD │ │ ctx ≤ 32k │ tools: aider, pytest, git │ └──────────────┬───────────────────────────────┘ │ Commit{sha, tests_passed, logs} ┌──────────────▼───────────────────────────────┐ │ SENTINEL always-on, ~200MB RSS │ │ rules + thresholds, no inference in hot path │ └───────────────────────────────────────────────┘ ``` **The Scout** is read-only and deliberately anonymous: Atom/RSS feeds and semantic-web retrieval over a rotating egress, no authenticated keys. It does not synthesize. It emits `Finding` records carrying a verbatim quote, a source URI, a retrieval timestamp, and a checksum over the quote. That checksum is the anchor the verification layer later re-checks. Deduplication uses embedding similarity with MinHash as a cheap prefilter, and the tier is hard-bounded on fetches per task, per-domain rate, and response bytes. **The Architect** runs the frontier model with almost no tools — only a DAG store and an AST parser. It decomposes work into typed nodes whose edges are data dependencies, and each node carries an `acceptance` command. AST verification happens at the boundary: any proposed source change is parsed and diffed at the syntax-tree level *before* a file is touched, so truncated or hallucinated-API diffs are rejected on entry rather than after a failed build. **The Engineer** executes one node in an isolated worktree, TDD-first: ``` NODE=task-7f21 git worktree add ../wt-$NODE -b task/$NODE origin/main cd ../wt-$NODE pytest -q tests/test_$NODE.py # red: the acceptance command, before any edit aider --model "$ENGINEER_MODEL" \ --read tests/test_$NODE.py \ --test-cmd "pytest -q tests/" \ --auto-test --yes --message "$(cat /run/node-$NODE/prompt.md)" git commit -am "task($NODE): $(cat /run/node-$NODE/summary)" git worktree remove ../wt-$NODE --force ``` Worktrees, not branch checkouts, because concurrent nodes must not contend for a single index. Aider's repo map substitutes for whole-file context, keeping the Engineer's window small enough to stay accurate. **The Sentinel** is the only process that never stops. It runs as an ultra-lightweight daemon (~200MB RSS) with zero LLM inference on its hot path. It monitors host telemetry (CPU thermal limits, memory pressure, container heartbeats) and executes deterministic remediation rules when thresholds are breached. *Note: I don't have Sections 1–2 in context, so I've matched the register and picked up the threads implied by the outline. Numeric thresholds below are representative defaults for an 8GB dual-core Haswell edge node, not measurements of your specific host — treat them as tunable constants.* Turn-taking is a scheduling policy, not a cognitive architecture. A system that only perceives the world when a human presses Enter is, by construction, blind for the entire interval between prompts — which is precisely the interval during which resources exhaust, containers die, and thermal envelopes get breached. Reactive perception therefore does not merely delay diagnosis; it guarantees that every incident is discovered post hoc, at the point where the blast radius is already maximal. Section 3 replaces the request-response cycle with a **prospective layer**: a set of always-on observers whose outputs are pushed into the agent's context as *events*, not pulled as *queries*. The design constraint is severe. The edge node is a dual-core Haswell with no GPU and finite RAM; a watchdog that costs 15% of the machine to supervise the other 85% is a net loss. Everything below is written against that budget. Observation is stratified by how fast the underlying quantity can kill you. *Fast tier (1–5 s)* — memory pressure, OOM proximity, container liveness, CPU package temperature. On Linux the authoritative signals are `MemAvailable` (not `MemFree`, which excludes reclaimable page cache and will make you panic-restart a healthy host), `memory.pressure` from PSI if `CONFIG_PSI` is enabled, and cgroup v2 `memory.events` for `oom_kill` counters. Thermal data comes from `/sys/class/thermal/thermal_zone*/temp` and, more usefully, the `coretemp` hwmon node, which exposes per-core and package critical thresholds. *Slow tier (30–60 s)* — disk consumption, log growth rate, swap-in rate, Docker image layer accumulation, GPU quota burn-down on the remote side. The split matters because the fast tier must fit in a single cheap read loop and the slow tier must not. Sampling the slow tier at fast cadence is the most common way a self-monitoring system becomes its own incident. A threshold trip is a hypothesis, not a fact. Two consecutive samples beyond the bound, or an EWMA crossing it, filters the single-sample spikes that otherwise generate pages at 3 a.m. and train the operator to ignore them. Hysteresis on the recovery side prevents the equally corrosive flapping. When a signal does trip, the response is a ladder, and each rung must be *strictly cheaper than the failure it prevents*: Escalation is a rung on the ladder, not the first rung. A watchdog whose only action is "notify" is a logging system with extra steps. `restart: always` is not self-healing. Against a crash loop it is an unbounded fork bomb with good intentions. The supervision loop must instead be a **circuit breaker**: exponential backoff (1 s → 2