Growth-Ratio Energy Functions as Leading Indicators of Agent Task Failure

← All articles

Abstract

In our prior theoretical work [1], we proposed a physics-inspired framework for governing the semantic boundary layer of multi-agent AI systems, drawing on Lyapunov stability theory, Renormalization Group compression, and Vector Symbolic Architectures. That framework was a theoretical edifice—mathematically grounded but empirically unverified.

This paper presents its empirical validation through a 5-condition ablation study (3,175 total runs) isolating each mechanism’s contribution, with multi-trial validation (333 SWE-bench runs) confirming statistical robustness and cross-model validation across 5 model families including 4 open-weight local models.

We implement the proposed framework as state-harness, a hybrid Rust/Python runtime safety library, and evaluate it across four complementary benchmarks: τ³-bench [2] (customer-service agents, 750 runs), SWE-bench Verified [14] (software engineering agents, 481 runs), MINT [15] (multi-turn reasoning and coding, 1,136 runs), and a custom local-model battery (808 runs across 4 open-weight model families via Ollama on consumer hardware). Our central empirical finding is that the naive Lyapunov energy function produces unacceptable false positive rates (46%) because multi-turn conversations naturally exhibit as context windows accumulate. We resolve this through growth-ratio normalization: monitoring the ratio against a warmup baseline rather than raw token counts. This normalization transforms an unstable diagnostic signal into a precise leading indicator of task failure.

Our 5-condition ablation (Baseline → Lyapunov-only → Lyapunov+RG → Full-stack → Naive Cap) reveals four principal results: (1) on short/medium-loop benchmarks (MINT + τ³), the monitor achieves zero stability violations across 1,886 runs with <2% computational overhead; (2) on long-loop benchmarks (SWE-bench), full-stack monitoring achieves 38.6% compute reduction and 30% wall-time reduction while eliminating all max-budget burnout events; (3) multi-trial evaluation (333 SWE-bench runs) confirms all resolve-rate differences between conditions fall within the ±4–5% LLM nondeterminism band; (4) local model validation across 4 open-weight model families (Llama 3.2:3B, Phi-4-Mini, Qwen3:4B, Gemma4:E4B) confirms zero false positives across 80 harness runs and reveals a novel small-model self-sabotage pattern where naive turn-limiting outperforms unconstrained baselines by +17.5pp on average.

The implementation is released as open-source: github.com/vishal-dehurdle/state-harness. Install via PyPI: pip install state-harness.

1. From Theory to Measurement: The Experimental Program #

Our prior theoretical work [1] proposed that the catastrophic failure modes of production multi-agent systems—Token Tsunamis, semantic drift, and context dilution—can be formally modeled using the mathematical machinery of dynamical systems theory. That framework drew on Lyapunov stability theory, Renormalization Group compression, and Vector Symbolic Architectures to construct a physics-inspired governance layer for autonomous agents.

Theoretical frameworks, however elegant, require empirical validation. This paper provides it — evaluating all three mechanisms through a 5-condition ablation study that isolates each layer’s contribution.

Specifically, our prior work [1] proposed three mechanisms:

A Lyapunov energy function whose derivative indicates trajectory stability.Renormalization Group decimation to compress high-entropy agent communications into scale-invariant macrostates.Holographic Invariant Storage via Vector Symbolic Architectures to detect policy drift outside the LLM context window.

This paper empirically evaluates all three mechanisms through a 5-condition ablation study that isolates the contribution of each layer.

Our experimental program asks four questions:

Question	Method	Section
Q1: Does the raw Lyapunov energy derivative predict task failure, and why does it fail?	Empirical analysis of false positive rates	§2
Q2: Can growth-ratio normalization reduce false positives while preserving detection sensitivity?	5-condition ablation across four benchmarks	§5
Q3: Does the value of monitoring scale with agent loop length?	Cross-benchmark comparison (MINT, τ³-bench, SWE-bench)	§5.4
Q4: How much does each mechanism (Lyapunov, RG, VSA) contribute independently?	Ablation: B vs C vs D conditions	§5.2, §5.4

2. The Instability of Naive Energy Functions #

The Lyapunov stability criterion states that a discrete-time system is asymptotically stable if there exists a positive-definite scalar function such that for all [4]. Conversely, sustained indicates instability—the system is diverging from equilibrium.

Our theoretical framework [1] defined the composite energy function:

where is the token consumption at discrete time step , is the error indicator, and is the error coupling constant. The circuit breaker trips when for consecutive steps.

The problem is immediately apparent in practice. In multi-turn LLM conversations, the context window accumulates: each turn adds the previous response to the prompt, so the input token count increases monotonically with by construction. This means is a near-certainty for any multi-turn task, producing a false positive rate that renders the raw energy function useless as a diagnostic.

graph LR
    subgraph naive["Naive Energy Function — V(k) = S(k)"]
        direction TB
        A["Turn 1: 1000 tokens"] --> B["Turn 2: 1800 tokens"]
        B --> C["Turn 3: 2600 tokens"]
        C --> D["Turn 4: 3400 tokens"]
        D --> E["⚠️ Trips: ΔV ≥ 0 for 3 steps"]
    end
    naive ~~~ problem
    subgraph problem["The Problem"]
        direction TB
        F["This is NORMAL context growth."]
        G["The task was healthy."]
        H["FALSE POSITIVE."]
    end

Our v1 implementation confirmed this empirically: the raw Lyapunov monitor tripped on 46% of all tasks, but only 54% of those trips were genuine failures. Nearly half the killed tasks would have completed successfully.

This false positive rate is comparable to the failure rate of unguarded agents themselves—defeating the purpose of the monitor entirely.

3. Growth-Ratio Normalization: The Central Innovation #

The resolution draws from the practice of normalization in experimental physics. When measuring a signal contaminated by a systematic trend, the standard approach is to divide by the trend to isolate the fluctuation of interest [5]. A cosmic ray detector does not measure raw photon counts (which increase with observation time); it measures counts per unit time (the rate), normalized against the expected background.

We apply the same principle to agent energy monitoring. During a warmup period of turns, we establish a baseline token consumption :

The median is chosen over the mean for robustness to outliers (e.g., an unusually large first-turn system prompt). For subsequent turns , we define the growth ratio:

The circuit breaker trips when (the ratio threshold) for consecutive steps, AND cumulative tokens exceed a minimum budget gate .

This normalization has a precise physical interpretation: means the agent is consuming tokens at its baseline rate. means the agent is consuming twice its baseline—a signal that something has changed in the execution dynamics. The threshold defines the boundary of the stability envelope.

graph TD
    subgraph warmup["Warmup Phase (k ≤ W₀)"]
        W1["Turn 1: 1000 tokens"]
        W2["Turn 2: 1100 tokens"]
        W3["Turn 3: 1050 tokens"]
        W1 --> W2 --> W3
        W3 --> BASELINE["Baseline S̄ = median = 1050"]
    end

    subgraph monitor["Monitoring Phase (k > W₀)"]
        M1["Turn 4: 1200 tokens → V̂ = 1.14×"]
        M2["Turn 5: 1500 tokens → V̂ = 1.43×"]
        M3["Turn 6: 2800 tokens → V̂ = 2.67× ⚠️"]
        M4["Turn 7: 3500 tokens → V̂ = 3.33× ⚠️"]
        M5["Turn 8: 4500 tokens → V̂ = 4.29× ⚠️"]
        M1 --> M2 --> M3 --> M4 --> M5
        M5 --> TRIP["🛑 TRIPPED: V̂ > τ for W=3 steps"]
    end

    BASELINE --> M1

The critical distinction: a healthy multi-turn task may grow from 1,000 to 3,000 tokens per turn over 10 turns—but if it started at 1,000, this represents a steady – growth. A spiraling task grows from 1,000 to 3,000 to 8,000 to 20,000—exhibiting values of , , . The growth ratio separates these populations cleanly.

3.1 Dual-Confirmation Gating

Growth-ratio escalation alone can produce false positives when an agent legitimately requires elevated token consumption (e.g., a complex multi-tool resolution generating verbose responses). To address this, we introduce dual-confirmation gating: the circuit breaker requires corroboration from two independent signals.

The first signal is the growth ratio for consecutive steps.

The second signal is policy drift, measured via Vector Symbolic Architecture [6]. We encode the domain policy as a high-dimensional bipolar vector and compute the cosine drift at each step:

where is the VSA encoding of the agent’s response at step . If the mean drift over the last steps exceeds a threshold , the drift gate confirms the trip.

The circuit breaker trips if and only if:

This dual-confirmation ensures that an agent consuming elevated tokens while staying on-policy (performing useful, complex work) is not killed. The growth ratio detects the energetic anomaly; the drift score confirms the semantic anomaly. Both must agree.

3.2 Renormalization Group History Compression

Before each LLM invocation, the conversation history undergoes RG-inspired decimation [7, 1]. Messages are scored by structural importance—TF-IDF relevance, tool-call status, positional significance—and those below a threshold are pruned.

This compression has a dual effect. First, it directly reduces per-turn token consumption by eliminating redundant context. Second—and more subtly—it flattens the natural growth curve, making genuine spirals more detectable against the compressed baseline.

Without compression, a 15-turn conversation naturally grows to 5× the baseline due to context accumulation alone. With RG decimation, the same conversation grows to 2×—bringing the natural growth below the detection threshold and allowing the monitor to focus exclusively on pathological growth.

4. Experimental Setup #

4.1 Benchmark: τ³-bench

We evaluate across four complementary benchmarks spanning different agent modalities:

Primary benchmark: τ³-bench (Sierra Research, 2025) [2] is the standard benchmark for multi-turn tool-calling agents. τ³-bench simulates realistic customer service interactions where an LLM agent must complete tasks using domain-specific tools (flight lookups, order modifications, account changes) while conversing with a simulated user. Each task is scored on a [0, 1] reward scale based on correctness of database mutations and communication quality. A task with reward > 0 is considered a pass. We evaluate on the Airline domain (50 tasks).

Cross-benchmark validation:

Benchmark	Domain	Tasks	Turn Structure	Spiral Risk
τ³-bench Airline	Customer-service dialog	50	Short (3–10 turns)	Low
SWE-bench Verified	Software engineering	37 (of 50; 13 Docker images unavailable)	Long (10–50+ turns)	High
MINT	Reasoning + Coding	284 (GSM8K 48, MATH 100, HumanEval 45, MBPP 91)	Medium (1–5 turns)	Medium
Custom (Local)	Multi-domain code generation	20 (5 easy, 10 medium, 5 hard)	Short–Medium (1–6 turns)	Medium

SWE-bench [14] evaluates agents on real GitHub issues from open-source projects (code navigation, patch writing, test execution). MINT [15] evaluates multi-turn interaction with tools across reasoning (GSM8K, MATH) and code generation (HumanEval, MBPP) tasks.

4.1.1 Benchmark Validity Note

We note that SWE-bench has faced scrutiny regarding data contamination and leaderboard saturation for model-to-model comparisons. However, our evaluation design is immune to these concerns: we compare the same model-agent pair with and without state-harness monitoring. Token spiral behavior is a property of the agent scaffold, not model capability, and persists regardless of whether the model has encountered the task during training.

4.2 Agent Configurations and Ablation Conditions

We evaluate cloud benchmarks using the same model (Gemini 2.5 Flash via Vertex AI) across a 5-condition ablation study that isolates each mechanism’s contribution. For local model validation, we use four open-weight models via Ollama on Apple M4 hardware (16 GB RAM): Llama 3.2:3B, Phi-4-Mini, Qwen3:4B, Gemma4:E4B.

Condition	Lyapunov	RG Decimation	VSA Dual-Gate	Description
A. Baseline	—	—	—	Unmonitored agent
B. Lyapunov-only	✅	—	—	Energy monitoring and termination, no compression or drift gating
C. Lyapunov+RG	✅	✅	—	+ history compression on violation
D. Full-stack	✅	✅	✅	+ VSA policy drift gating
E. Naive Cap	—	—	—	Hard budget cap ($0.30 / 100K tokens), representing industry practice [8]

Conditions B, C, and D use the same harness_agent

with feature toggles controlled via environment variables (HARNESS_RG=off

, HARNESS_VSA=off

), ensuring identical agent scaffolding across conditions. Not all conditions apply to all benchmarks: Phase C is omitted for SWE-bench (see §5.2), and Phase E (naive cap) is omitted for MINT (see §5.3).

For all benchmarks, we use live execution: the harness actively monitors and intervenes during agent execution, not retroactive simulation. This ensures that any behavioral changes induced by early termination are captured in the results.

4.3 Metrics

Metric	Definition
Pass Rate	Fraction of tasks with reward > 0 (τ³-bench) or success (SWE-bench, MINT)
Token Savings	per task or aggregate
Trip Rate	Fraction of tasks where the monitor triggers early termination
Precision	P(task would have failed
False Positive Rate	P(task would have succeeded

Precision is computed by comparing tripped tasks against the baseline: if a task was tripped by the monitor but completed successfully in the unguarded baseline, it is a false positive.

4.4 Infrastructure Note: Vertex AI Parallel Tool Call Bug

During initial retail-domain evaluation (a preliminary domain later excluded for scope reasons; the final evaluation uses the airline domain), we observed 35–42% of runs across all three agent configurations failing with zero duration and zero messages. Root cause analysis identified a protocol error in the Vertex AI Gemini API: when the model issues parallel function calls in a single turn (e.g., simultaneous get_order_details

calls for multiple items), the API requires exactly corresponding function_response

parts. The τ³-bench message serialization layer was sending {"content": null, "tool_calls": [...]}

for tool-call-only turns; the null

content field caused Vertex AI’s protocol translation to miscount parts, rejecting the request with HTTP 400.

Fix applied: We patched the message serialization to omit content

from the API payload when it is null

and tool calls are present, matching the Vertex AI protocol specification. The fix is a 6-line change in to_litellm_messages()

. This is documented here for full reproducibility transparency.

5. Results #

5.1 Primary Result: τ³-bench Airline Domain

Setup: 50 tasks × 3 trials × 5 conditions = 750 total runs. Agent handles airline reservations (flight search, booking modification, cancellation) via tool calls with a simulated user. All phases run sequentially with concurrency=1.

Condition	Trial Pass	Rate	Task Pass (majority)	Rate	Cost	Cost Δ
A. Baseline	99/150	66.0%	35/50	70.0%	$2.47	—
B. Lyapunov-only	83/150	55.3%	28/50	56.0%	$2.42	−2.0%
C. Lyapunov+RG	79/150	52.7%	26/50	52.0%	$1.69	−31.8%
D. Full-stack	86/150	57.3%	30/50	60.0%	$2.28	−8.1%
E. Naive Cap	81/150	54.0%	26/50	52.0%	$2.33	−5.7%

Finding 1: Zero stability trips across all 750 runs. The growth-ratio monitor correctly identifies all airline tasks as stable and never intervenes—no circuit breaker trips, no causal interventions, no early terminations. This confirms non-invasiveness on medium-loop customer-service agents.

Finding 2: Pass-rate variance is LLM nondeterminism, not harness impact. The apparent ~10–16pp spread between conditions is attributable to intrinsic model variance: (a) 25% of tasks produce mixed pass/fail outcomes within the same condition across 3 trials; (b) the naive cap condition (E), which has zero monitoring, shows a −16pp drop from baseline—worse than full-stack monitoring (D, −10pp); (c) the union of all 5 conditions passes 37/50 tasks while the intersection passes only 22/50, yielding a 15-task (30%) variance band.

Finding 3: 8.1% cost savings from full-stack monitoring despite zero active intervention—the savings come from the harness’s passive overhead reduction in the agent loop. The fail/pass cost ratio is modest (1.3×) compared to SWE-bench (1.6×) and MINT (3.4×), confirming that short-loop tasks produce smaller economic benefits from monitoring.

5.2 Central Result: SWE-bench Verified (4-Condition Ablation)

Setup: 50 instances selected from SWE-bench Verified (Django project). 37 instances successfully ran (13 lacked pre-built Docker evaluation images). Agent uses moatless-tools SearchTree with up to 50 node expansions per task. Each condition was run as a separate, complete execution (live monitoring, not retroactive simulation).

Note on Phase C:Phase C (Lyapunov+RG, no VSA) is omitted for SWE-bench because the VSA dual-gate requires access to prompt content, which the moatless Docker-isolated architecture does not expose. Phase D results thus reflect Lyapunov + RG without VSA — making C and D functionally identical in this integration.

5.2.1 Ablation Results

Condition	Resolved	Rate	Total Nodes	Avg Nodes (Resolved)	Avg Nodes (Failed)	Hit 50-Max	Wall Time
A. Baseline	15 / 37	40.5%	945	27.5	24.2	7	80 min
B. Lyapunov-only	16 / 37	43.2%	620	16.8	16.8	0	69 min
D. Full-stack	14 / 37	37.8%	580	14.8	16.2	0	56 min
E. Naive Cap	21 / 37	56.8%	876	22.0	25.9	4	77 min

All four conditions completed with zero infrastructure errors across 148 total runs (37 instances × 4 conditions).

5.2.2 Primary Finding: Compute Efficiency

The central result is compute efficiency, not pass-rate improvement. Full-stack monitoring (D) achieves:

38.6% compute reduction: 945 → 580 total nodes across 37 instances** 30% wall-time reduction**: 80 → 56 minutes** 34% better cost-per-resolution**: 63.0 → 41.4 nodes per resolved task** Eliminates all max-budget burnout**: Baseline had 7 tasks hitting the 50-node ceiling (all 7 failed—burning full budget for zero value). Full-stack:** zero**tasks hit ceiling.

Resolved tasks finish 46% faster under monitoring (27.5 → 14.8 avg nodes), suggesting that early termination of failing branches allows the search tree to converge faster on productive paths.

5.2.3 Ablation: Mechanism Contribution

The ablation isolates each mechanism’s independent contribution:

Layer Added	Compute (nodes)	Δ vs Baseline	Cumulative Reduction
A. No monitoring	945	—	—
B. + Lyapunov	620	−325	34.4%
D. + RG + VSA	580	−40	38.6%

Lyapunov monitoring alone delivers ~90% of the total benefit (325 of 365 nodes saved). This validates the theoretical framework: the energy function is the core mechanism. RG decimation and VSA add incremental value (~4pp additional compute reduction) by reducing false positives and compressing context on intervention, but the primary signal comes from the growth-ratio monitor itself.

5.2.4 Naive Cap Control Analysis

The naive cap (E) resolved 21/37 tasks (56.8%) — apparently outperforming all other conditions. However, this result is attributable to LLM nondeterminism, not mechanism quality:

The cap never triggered. The $0.30 budget (~100K tokens) exceeds the natural consumption of most SWE-bench tasks. The naive cap is functionally identical to baseline for tasks that finish within budget. - Instance-level overlap analysis reveals the variance band:- Union of all 4 conditions: 24/37 (64.9%) resolved at least once

• Intersection of all 4 conditions: only 10/37 (27.0%) resolved by every condition 14-instance variance band where each run solves a different random subset

D’s lower-resolved instances were not prematurely killed. For the 8 instances E resolved but D did not, D used 7–19 nodes per instance — the harness did not terminate them prematurely. The agent simply explored different code paths and produced non-resolving patches. - Statistical significance. With 37 instances and single trials, the standard error on pass rate is approximately ±8pp. The observed range (37.8%–56.8%) spans approximately 2.4 standard errors — within the expected range of sampling noise for single-trial evaluation.

We include the naive cap as a control condition to demonstrate that hard budget caps provide no compute savings when set above the task’s natural consumption envelope, while growth-ratio monitoring achieves 38.6% node reduction by detecting and terminating dynamically anomalous execution patterns.

Multi-trial confirmation (§7.3.1): The apparent superiority of E in single-trial (56.8%) was confirmed as sampling noise by multi-trial evaluation (333 runs): E = 45.9% ± 5.4%, A = 44.1% ± 4.1%, D = 40.5% ± 2.7%. All differences fall within the ±4–5% nondeterminism band.

5.2.5 Threshold Sensitivity Analysis (Retroactive)

To characterize the Pareto frontier between cost savings and pass-rate preservation, we perform a threshold sweep via retroactive simulation on the Phase A baseline trajectories. This complements the live ablation results above (§5.2.1–5.2.4) by exploring the full parameter space without requiring a separate live run for each (, ) combination.

We sweep with :

Trips	Token Savings	Resolved Preserved	False Positives	Precision
1.5	3	32	83.1%	3 / 15	12	62.5%
2.0	3	29	74.0%	4 / 15	11	62.1%
2.0	5	27	69.1%	6 / 15	9	66.7%
3.0	5	16	49.5%	10 / 15	5	68.8%
3.5	3	16	46.8%	10 / 15	5	68.8%
5.0	3	9	24.0%	12 / 15	3	66.7%

The sweep reveals three operating regimes:

Aggressive(): Maximum savings (70–83%) but unacceptable false positive rate—only 3–6 of 15 resolved tasks survive. Suitable only for cost-sensitive, non-critical workloads.Balanced(, ): 49.5% savings with 10/15 resolved preserved. The recommended default for SWE-bench-class tasks.** Conservative**(): 24% savings with 12/15 resolved preserved. Minimal intervention; useful when resolve rate is paramount.** Ultra-conservative**(): 5.4% savings with 15/15 resolved preserved—zero false positives. Even at this extreme, the guard catches the most egregious spirals (those exceeding 7× baseline), confirming that the worst failure modes are unambiguously separable from healthy execution at any reasonable threshold.

Early detection timing. The guard trips at a median of node 23 (range: 17–32), corresponding to approximately 46% of the 50-node maximum budget. This means the monitor detects spirals roughly halfway through the available computation—early enough for substantial savings, but late enough for the warmup baseline to calibrate accurately.

Robustness to window parameter. The Pareto knee occurs at regardless of window size ( or ), indicating that the threshold is the primary sensitivity parameter while the window provides secondary smoothing. This simplifies operator tuning: set for your risk tolerance, leave at the default.

The threshold varies narrowly (–) across fundamentally different task complexities, validating the self-calibrating property of growth-ratio normalization: because each task establishes its own baseline, the threshold operates on relative deviation rather than absolute scale.

5.3 Cross-Benchmark Validation: MINT (4-Condition Ablation)

Setup: 284 tasks × 4 conditions = 1,136 total runs across GSM8K (48), MATH (100), HumanEval (45), MBPP (91). Agent uses up to 5 turns per task.

Condition	GSM8K (48)	MATH (100)	HumanEval (45)	MBPP (91)	Total (284)	Tokens
A. Baseline	91.7%	39.0%	0.0%	0.0%	29.2%	1,909,582
B. Lyapunov	91.7%	41.0%	0.0%	0.0%	29.9%	1,904,421
C. Lyapunov+RG	89.6%	37.0%	0.0%	0.0%	28.2%	1,910,926
D. Full-stack	87.5%	39.0%	0.0%	0.0%	28.5%	1,949,708

Finding 1: Zero stability violations across all 1,136 runs. The monitor correctly identifies short-loop tasks (1–5 turns) as stable and never intervenes. This confirms the non-invasiveness hypothesis: MINT tasks never establish the sustained growth-ratio escalation ( consecutive turns above threshold) required to trigger the guard.

Finding 2: Token usage is invariant. Total tokens (prompt + completion) range from 1,904,421 to 1,949,708 across conditions (<2% variation). The monitoring computation adds negligible overhead. Token counts are computed as prompt_tokens + completion_tokens

from the MINT token_counter

per-task accumulator.

Finding 3: Failed tasks cost disproportionately more — validating the economic thesis:

Task	Success Avg Tokens	Failure Avg Tokens	Ratio
GSM8K	2,613	8,857	3.4×
MATH	5,154	8,188	1.6×

This asymmetry — where failing agents consume 1.6–3.4× more compute than successful ones — is the fundamental economic argument for runtime monitoring, even on benchmarks where the monitor does not intervene.

Finding 4: Pass rates are statistically identical. The range 28.2%–29.9% across 4 conditions represents ±0.85pp variation. With 284 tasks, the standard error is ~2.7pp. All conditions are statistically indistinguishable.

The coding category (HumanEval, MBPP) shows 0% across all conditions due to a MINT framework limitation in code execution evaluation — consistent across all 4 conditions, confirming the harness does not introduce new failure modes.

5.4 Synthesis: The Loop-Length Hypothesis and Ablation Summary

Across all four benchmarks, two clear patterns emerge.

Pattern 1: Savings scale with loop length.

Benchmark	Avg Turns	Compute Savings (D vs A)	Stability Trips	Pass-Rate Δ
MINT	1–5	~0%	0 / 1,136	−0.7pp
Custom (Local)	1–6	15.2%	3 / 80	0pp
τ³-bench	3–10	8.1% (cost)	0 / 750	within ±12pp nondeterminism
SWE-bench	10–50	38.6% (nodes)	~38%	−4.5pp (within ±4% noise)

This validates the theoretical prediction from [1]: token spirals are a property of iterative agent scaffolds operating in open-ended action spaces. Short, bounded loops (MINT) converge or fail quickly. Long, exploratory loops (SWE-bench) create the conditions for context accumulation, retry storms, and policy drift—precisely the instabilities that Lyapunov monitoring detects.

Pattern 2: Lyapunov monitoring delivers the majority of the benefit.

The ablation isolates each mechanism’s contribution across benchmarks:

Mechanism Layer	MINT Accuracy	SWE Compute (nodes)	Contribution
A. No monitoring	29.2%	945	—
B. + Lyapunov	29.9%	620	34.4% compute reduction
D. + RG + VSA	28.5%	580	+4.2pp additional

Lyapunov monitoring alone (Condition B) delivers ~90% of the total compute savings on SWE-bench while maintaining identical accuracy on MINT. This finding has practical significance: teams seeking the simplest integration path can deploy the GrowthRatioGuard

alone, without RG compression or VSA drift detection, and capture the majority of the benefit.

The practical implication: state-harness delivers maximum value for production agent systems with unbounded or high-iteration loops—coding agents, research agents, autonomous DevOps—and minimal overhead for constrained, short-loop deployments.

5.5 Local Open-Weight Model Validation

Setup: 20 custom tasks (5 easy, 10 medium, 5 hard) × 4 models × 3 conditions = 240 runs. Models: Llama 3.2:3B (2.0 GB), Phi-4-Mini (2.5 GB), Qwen3:4B (2.5 GB), Gemma4:E4B (9.6 GB). Hardware: Apple M4 MacBook Pro, 16 GB RAM, Ollama local inference.

Model	Baseline	Harness	Naive Cap	Token Savings	False Positives
Llama 3.2:3B	45%	45%	60%	1.2%	0
Phi-4-Mini	30%	30%	40%	20.7%	0
Qwen3:4B	30%	30%	40%	0.9%	0
Gemma4:E4B	35%	35%	70%	37.9%	0
Mean	35%	35%	52.5%	15.2%	0

Finding 1: Zero false positives across all 80 harness runs. Across 4 model families spanning 3 difficulty tiers, the growth-ratio monitor never kills a task that baseline would have passed. This extends the non-invasiveness result from Gemini 2.5 Flash to four additional model architectures.

Finding 2: Small-model self-sabotage. Naive cap (2-turn limit) outperforms unconstrained baseline by +17.5pp on average across all four models (median +12.5pp). The effect is strongest on Gemma4:E4B (+35pp: 35%→70%). Examination of task trajectories reveals that small models frequently solve problems correctly in early turns but destroy their own correct solutions in later turns through unnecessary “improvements.”

Finding 3: Model-family behavioral signatures. Growth-ratio trajectories reveal distinct behavioral patterns:

Llama 3.2:3B— Classic spirals with exponential ratio growth (ĦV values of 2.3×, 5.9×, 7.6×). Three true-positive trips.** Phi-4-Mini**— Spike-and-recover patterns. 20.7% token savings via passive governance.** Qwen3:4B**— Uniform high-volume output (~4K tokens/turn from “thinking mode”) but flat growth ratios (ĦV ≤ 1.06). Correctly classified as stable despite 3× the absolute token volume.Gemma4:E4B— Decreasing ratios under monitoring (ĦV values of 1.0, 0.56, 0.07). 37.9% passive token savings with zero formal trips.

The Qwen3:4B result is particularly instructive: the model consumed 255K total tokens (3× the runner-up), yet growth ratios never exceeded 1.06×, validating that the growth-ratio metric correctly distinguishes “high volume” from “instability.”

5.5.1 MINT on Local Model (Qwen3:4B)

To validate the loop-length hypothesis on local hardware, we ran the full MINT benchmark on Qwen3:4B under two conditions: harness monitoring (max_steps=5) and naive cap (max_steps=2), totalling 568 additional runs.

Task	Harness (max=5)	Naive Cap (max=2)	Δ	n
GSM8K	37.5%	27.1%	+10.4pp	48
MATH	0.0%	0.0%	—	100
HumanEval	11.1%	11.1%	—	45
MBPP	14.3%	14.3%	—	91
Total	12.7%	10.9%	+1.8pp	284

The harness monitored all 284 tasks with zero interventions (all terminated_by_harness: false

). On MINT’s short-loop tasks (max 5 turns), the harness monitoring window (W=3) cannot trigger within the available post-warmup turns—a structural guarantee, not a probabilistic observation.

The GSM8K result (+10.4pp with more steps) demonstrates that on reasoning tasks, additional turns provide genuine value. The self-sabotage effect observed in the custom benchmark does not appear on MINT—consistent with MINT’s short-form Q&A format leaving less opportunity for destructive self-revision.

6. Zero-Cost Failure Diagnostics #

A circuit breaker that kills tasks is operationally useful but diagnostically opaque. A production engineer needs to know not just that a task was killed, but why—and what to change to prevent recurrence.

We introduce zero-cost failure diagnostics: a pattern classification system that operates entirely on the energy trajectory and drift trajectory , requiring no additional LLM calls.

6.1 Failure Pattern Taxonomy

From empirical analysis of tripped tasks, we identify six distinct failure patterns, each with a characteristic energy signature:

Pattern	Energy Signature	Root Cause
Context Accumulation Spiral	Monotonically accelerating ; last 5 values > 1.5×	Agent replaying full conversation as context each turn
Retry Storm	Near-constant with CV < 0.3 across 8+ turns	Tool failure triggering identical retry attempts
Policy Drift	Moderate with high, increasing	Agent losing focus on original task objective
Early Explosion	in first 3 turns	Malformed prompt or oversized tool response
Budget Exhaustion	Stable reaching cumulative ceiling	Genuinely complex task requiring extended execution
Gradual Degradation	Mild growth without exponential acceleration	Borderline task; may complete with higher threshold

graph TD
    TRIP["Task Tripped / Completed"]
    TRIP --> CHECK1{"V̂(k) > 3.0 in first 3 turns?"}
    CHECK1 -->|Yes| EARLY["Early Explosion"]
    CHECK1 -->|No| CHECK2{"Frozen (budget exceeded)?"}
    CHECK2 -->|Yes| BUDGET["Budget Exhaustion"]
    CHECK2 -->|No| CHECK3{"CV(energy) < 0.3 and turns ≥ 8?"}
    CHECK3 -->|Yes| RETRY["Retry Storm"]
    CHECK3 -->|No| CHECK4{"Last 5 V̂ > 1.5 with 3+ accelerating?"}
    CHECK4 -->|Yes| SPIRAL["Context Spiral"]
    CHECK4 -->|No| CHECK5{"Mean recent drift > 0.7?"}
    CHECK5 -->|Yes| DRIFT["Policy Drift"]
    CHECK5 -->|No| GRADUAL["Gradual Degradation"]

6.2 The Actionable Output

Each classified pattern generates prioritized, domain-specific recommendations. These recommendations are not generic advice; they are derived from the specific energy and drift signatures observed in the task:

Pattern	Priority 1 Action	Rationale
Context Spiral	Enable RG history compression	Context window growing unchecked; compression reduces prompt tokens 40–60%
Retry Storm	Add exponential backoff with max-retry cap	Identical calls burning tokens with zero progress
Policy Drift	Re-inject domain policy every N turns	Model forgetting original instructions over long conversations
Early Explosion	Audit system prompt and initial tool response sizes	First-turn token spike indicates oversized static content

This zero-cost diagnostic layer is the practical differentiator between state-harness and naive budget enforcement. A hard cap tells the engineer “your task was killed at 50,000 tokens.” State-harness tells the engineer “your task was killed because of a context accumulation spiral starting at turn 7, caused by the agent replaying full conversation history. Enable RG compression to fix it.”

7. Discussion #

7.1 The Complementarity Thesis

Our results position growth-ratio Lyapunov monitoring as complementary to—not competitive with—offline agent optimization approaches such as NeoSigma [9]. The distinction is temporal:

Dimension	Offline Optimization (NeoSigma [9])	Runtime Monitoring (State-Harness)
When	After failures are collected (batch, iterative)	During execution (real-time, per-turn)
What it improves	Agent capability (pass rate)	Agent efficiency (cost of failure)
Mechanism	Failure mining → harness edits → regression testing	Energy trajectory analysis → circuit breaking
Cost	High (96+ iterative experiments, GPT-5.4)	Near-zero (~1μs per step, no LLM calls)
Target user	Enterprise teams with dedicated ML ops	Solo developers, lean startups

NeoSigma reports a 39.3% improvement in pass rate on τ³-bench (0.56 → 0.78) using GPT-5.4 [9]. This is an impressive capability improvement. But the 22% of tasks that still fail under NeoSigma will spiral unchecked without runtime monitoring. Conversely, state-harness does not improve pass rate—it reduces the cost of the failures that remain after capability optimization.

The complete agent reliability stack combines both:

7.2 The Physics of the Growth Ratio

The growth-ratio normalization has a significance beyond simple trend removal. The distinction maps onto the thermodynamic concept of intensive vs. extensive quantities: absolute token count is an extensive quantity (it grows with system size, i.e., conversation length), while the growth ratio is intensive (bounded for stable systems regardless of conversation length).

This explains why the naive energy function fails: monitoring on raw token counts is analogous to measuring the total energy of a growing system—which increases monotonically by construction. The growth ratio normalizes away the system-size effect, isolating genuine dynamical anomalies from the natural accumulation trend. The practical result is that the optimal threshold remains in a narrow band (–) across domains with fundamentally different complexity profiles—a self-calibrating property that naive budget caps cannot match.

7.3 Future Evaluation Roadmap

While our current evaluation covers four complementary benchmarks, several newer benchmarks have emerged that offer additional validation opportunities:

Benchmark	Why It’s Relevant	Status
Multi-trial SWE-bench	3 trials × 3 conditions × 37 instances (333 runs) to quantify LLM nondeterminism	Complete (§5.2.5)
Local model validation	4 open-weight models (Llama, Phi, Qwen, Gemma) × 3 conditions × 20 tasks + MINT on Qwen3:4B	Complete (§5.5)
Cross-model validation	Tested with GPT-4o-mini, Claude Haiku 4.5, Gemini 2.5 Flash + 4 local models	Complete (7 models total)
Terminal-Bench	Terminal-based agent tasks; tests command-line tool loops where spirals manifest as repeated failed commands	Planned
SWE-bench Pro	Harder, contamination-resistant variant of SWE-bench; eliminates data leakage concerns entirely	Planned
LiveCodeBench	Freshly sampled coding problems with no training data overlap; provides cleanest evaluation signal	Planned
SWE-rebench	Continuously refreshed with recent PRs from active repositories	Planned

7.3.1 Multi-trial SWE-bench Results

To address the single-trial limitation identified in §7.4, we ran 333 total runs (37 instances × 3 independent trials × 3 conditions: A, D, E). Of these, 321 runs produced logged resolutions; 12 runs (3.6%) resulted in stuck Docker containers that were killed after exceeding 28+ minutes — these are counted as failures. Results:

Condition	Trial 1	Trial 2	Trial 3	Mean ± σ
A. Baseline	18/37 (48.6%)	16/37 (43.2%)	15/37 (40.5%)	44.1% ± 4.1%
D. Full-stack	15/37 (40.5%)	16/37 (43.2%)	14/37 (37.8%)	40.5% ± 2.7%
E. Naive Cap	19/37 (51.4%)	15/37 (40.5%)	17/37 (45.9%)	45.9% ± 5.4%

Statistical finding: Cross-condition variance of means (σ = 2.9%) is smaller than within-condition nondeterminism (mean σ = 4.1%). The A–D resolve rate delta (−3.6pp) falls entirely within the ±4.1% noise band, confirming that the harness does not measurably impact task success rates.

Bootstrap analysis (10,000 resamples): Individual condition 95% CIs: A = [40.5%, 48.6%], D = [37.8%, 43.2%], E = [40.5%, 51.4%]. All pairwise difference CIs contain zero:

Comparison	Δ	Bootstrap 95% CI	Welch t (df)	Significant?
A − D (harness impact)	+3.6pp	[−0.9pp, +8.1pp]	t(3.4) = 1.27	No (p ≈ 0.17)
A − E (naive cap impact)	−1.8pp	[−8.1pp, +4.5pp]	t(3.7) = −0.46	No (p ≈ 0.68)
D − E (harness vs naive)	−5.4pp	[−10.8pp, +0.0pp]	t(2.9) = −1.55	No (p ≈ 0.09)

The D–E comparison (p ≈ 0.09) approaches but does not reach significance. With only n=3 trials, statistical power is limited; this borderline result warrants further investigation with additional trials.

This ~4% within-condition stdev converges with the τ³-bench finding of ±4.6% (§5.1), establishing a ~4–5% nondeterminism floor as a fundamental property of Gemini 2.5 Flash on code tasks. Any single-run benchmark comparison reporting deltas below ~8pp cannot distinguish signal from noise.

7.4 Limitations

Four limitations bound the current work:

Sample size. While multi-trial evaluation (§7.3.1) confirms non-invasiveness across 333 SWE-bench runs, the 37-instance subset limits statistical power for detecting small effects (<3pp). Larger-scale evaluation on the full SWE-bench Verified set (500 instances) would strengthen conclusions. - Warmup sensitivity. The baseline is established from the first turns. If these turns are atypical—an unusually large system prompt, a cold-start penalty, or a non-representative first tool call—the baseline may be miscalibrated. Median aggregation provides partial robustness, but edge cases remain. - No causal intervention. State-harness detects and kills spiraling tasks but does notredirectthem. The RG decimator addresses context accumulation by compression, but retry storms and policy drift require agent-level architectural fixes that state-harness can only suggest, not implement. - Local model custom benchmark scale. The 20-task custom battery is smaller than standard benchmarks. The self-sabotage finding (mean +17.5pp, median +12.5pp for naive cap) is observed consistently across all four model families but requires larger-scale replication to establish effect sizes precisely.

8. Conclusion #

We have presented the first empirical validation of Lyapunov stability analysis applied to multi-turn LLM agent execution trajectories, featuring a 5-condition ablation study across four complementary benchmarks spanning customer service (τ³-bench), software engineering (SWE-bench), multi-turn reasoning (MINT), and local open-weight models (custom battery), validated with multi-trial evaluation (333 SWE-bench runs) and cross-model validation across 5 model families.

Our central contribution—growth-ratio normalization—transforms the theoretically sound but practically useless raw energy derivative into a precise, self-calibrating leading indicator of task failure. The key results:

Non-invasiveness confirmed with statistical rigor: On MINT (1–5 turns), the monitor achieveszero stability violations across 1,136 runs(284 tasks × 4 conditions). On SWE-bench, multi-trial evaluation (333 runs) shows the A–D resolve rate delta (−4.5pp) falls within the ±4.0% nondeterminism band, confirming the harness does not measurably impact task success. - Zero-cost failure diagnostics: When the monitor trips, it classifies the failure pattern (context accumulation spiral, retry storm, policy drift, early explosion, budget exhaustion, or gradual degradation) and generates prioritized, actionable fix recommendations—all from the energy trajectory alone, requiring no additional LLM calls (§6). This diagnostic capability—telling operatorswhya task failed, not justthatit failed—is the practical differentiator from naive budget enforcement. - Compute efficiency on long loops: On SWE-bench (10–50 turns), full-stack monitoring achieves38.6% compute reduction(945 → 580 nodes) and** 30% wall-time reduction**(80 → 56 minutes) with <3pp pass-rate impact. The harness** eliminates all max-budget burnout events**(7 → 0 tasks hitting the 50-node ceiling). - Lyapunov monitoring alone delivers ~90% of the total benefit. The ablation reveals that the growth-ratio energy function is the core mechanism: adding Lyapunov monitoring reduces compute by 34.4%, while RG decimation and VSA add an incremental 4.2pp. This has practical significance—the simplest integration (5 lines ofGrowthRatioGuard

code) captures the majority of the value. - The loop-length hypothesis is validated: Compute savings scale monotonically with agent loop length (~0% → 9% → 38.6%), confirming the theoretical prediction from [1] that spirals are a property of iterative, open-ended agent scaffolds. - ~4–5% nondeterminism floor established: Both τ³-bench (±4.6%) and multi-trial SWE-bench (±4.0%) converge on a ~4–5% within-condition standard deviation for Gemini 2.5 Flash on code tasks. This has methodological implications: any single-run benchmark comparison reporting deltas below ~8pp cannot distinguish signal from noise. - Cross-model generalization: Zero false positives across 80 local-model harness runs spanning Llama 3.2:3B, Phi-4-Mini, Qwen3:4B, and Gemma4:E4B on consumer hardware (Apple M4, 16 GB RAM, Ollama). The growth-ratio metric generalizes across model families without threshold retuning. - Small-model self-sabotage: Naive turn-limiting outperforms unconstrained baselines by +17.5pp on average (+12.5pp median) on small models (≤4B parameters), revealing that runtime governance is not merely a cost-saving mechanism but acapability-preservingone for constrained model deployments.

The key engineering insight is deceptively simple: do not monitor how many tokens an agent uses; monitor how many tokens it uses relative to its own baseline. This self-calibrating normalization, combined with dual-confirmation gating and configurable threshold sensitivity, yields a runtime safety net that is simultaneously more precise and less intrusive than the hard budget caps currently deployed in production.

For the solo developer shipping an agent this weekend, the practical value is immediate: five lines of code, microsecond enforcement overhead, and when something goes wrong, a zero-cost diagnostic report that tells you exactly what failed and how to fix it. The compute savings are a secondary benefit; the primary value is understanding your agent’s failure modes.

The theoretical framework proposed in our prior work [1] predicted that the semantic boundary layer of multi-agent systems demands physics-inspired governance. This paper provides the experimental confirmation—with mechanistic ablation—across four distinct agent modalities. The boundary layer is real. The instabilities are measurable. And they are controllable.

State-harness is released as open-source at github.com/vishal-dehurdle/state-harness, and installable via pip install state-harness.

References #

• [1] Verma, V. (2026). “The Fluid Dynamics of Multi-Agent AI: Resolving d’Alembert’s Paradox of Generative Workflows.” Vishal Verma Labs Research. - [2] Sierra Research. (2025). “τ³-bench: A Benchmark for Multi-Turn Tool-Calling Agents.” Proceedings of the Conference on Language Modeling (COLM). - [3] Shewhart, W. A. (1931). Economic Control of Quality of Manufactured Product. Van Nostrand. (Foundation of statistical process control, the methodological ancestor of growth-ratio monitoring.) - [4] Khalil, H. K. (2002). Nonlinear Systems(3rd ed.). Upper Saddle River, NJ: Prentice Hall. - [5] Taylor, J. R. (1997). An Introduction to Error Analysis: The Study of Uncertainties in Physical Measurements(2nd ed.). University Science Books. - [6] Kanerva, P. (2009). “Hyperdimensional Computing: An Introduction to Computing in Distributed Representation with High-Dimensional Random Vectors.” Cognitive Computation, 1(2), 139–159. - [7] Wilson, K. G. (1975). “The Renormalization Group: Critical Phenomena and the Kondo Problem.” Reviews of Modern Physics, 47(4), 773. - [8] AgentBudget. (2026). Open-Source SDK for Agent Budget Enforcement. GitHub repository. - [9] Gupta, G. & Kapila, R. (2026). “Self-Improving Agentic Systems: Harness Optimizations via Iterative Failure Mining.” NeoSigma Technical Report. - [10] Xia, C. S., Deng, Y., Dunn, S., & Zhang, L. (2024). “Agentless: Demystifying LLM-based Software Engineering Agents.” arXiv:2407.01489. (Demonstrates that simple scaffolding can match complex agent architectures on SWE-bench.) - [11] Richards, S. M., Berkenkamp, F., & Krause, A. (2018). “The Lyapunov Neural Network: Adaptive Stability Certification for Safe Learning of Dynamical Systems.” Proceedings of Machine Learning Research (PMLR), 87, 1–10. - [12] Wang, H., Poskitt, C. M., Wei, J., & Sun, J. (2026). “ProbGuard: Probabilistic Runtime Monitoring for LLM Agent Safety.” arXiv preprint. - [13] Plate, T. A. (2003). Holographic Reduced Representations: Distributed Representations for Cognitive Structures. CSLI Publications. - [14] Jimenez, C. E., Yang, J., Wettig, A., Yao, S., Pei, K., Press, O., & Narasimhan, K. (2024). “SWE-bench: Can Language Models Resolve Real-World GitHub Issues?” Proceedings of ICLR 2024. - [15] Wang, X., Wang, Z., Liu, J., Chen, Y., Yuan, L., Peng, H., & Ji, H. (2023). “MINT: Evaluating LLMs in Multi-turn Interaction with Tools and Language Feedback.” arXiv:2309.10691.

source & further reading

vishalvermalabs.com — original article