« Phase 00 README · Warmup · Hitchhiker's · Principal Deep Dive · Core Contributor · Staff Notes

Phase 00 — Deep Dive: Trust Boundaries, Reliability & Cost Math

This phase has no runtime and no framework. Its "mechanism" is four pieces of arithmetic and one architectural invariant. The point of a deep dive here is to show that these are not slogans — each is a derivation with load-bearing assumptions, and each fails in a specific, mechanistic way when you violate those assumptions.

The trust boundary as an invariant, not a feature

Start with the structural fact that everything else rests on: an LLM is a function from a token sequence to a probability distribution over the next token, sampled repeatedly. It emits text. It never opens a socket, writes a row, or moves money. When an agent "sends an email," the physical sequence is: the model emits a string that looks like {"tool":"send_email",...}, and then your code parses that string, decides whether to honor it, and calls the real API.

That decision point is the trust boundary, and the invariant is directional:

Everything on the model side is untrusted text. Every safety, authorization, and correctness property lives on the application side, in code that executes after a proposal crosses the boundary.

The invariant is worth stating formally because it is preserved under composition. Chain two agents, nest a sub-agent, add a tool that itself calls an LLM — the boundary reappears at each interface, and the same rule holds each time: the proposer is untrusted, the executor enforces. Prompt injection (Phase 10) is precisely the failure of engineers who imagined the boundary was somewhere else — inside the prompt, where it can never hold, because the model will faithfully follow instructions that arrive in its input, including instructions from a poisoned web page. There is no prompt that makes a stochastic text generator trustworthy. The boundary is architectural; the phases that follow (schema validation, allow-lists, sandboxing, authz, human gates) are all just the executor doing its job.

Compounding reliability: deriving p^n

Model one agent step — one reasoning turn plus one tool call — as a Bernoulli trial that succeeds with probability \(p\). Assume steps are independent: the success of step \(i\) tells you nothing about step \(j\). For the whole task to succeed, every step must succeed. Independent events combine by multiplication (the joint probability of independent events factors), so

$$P(\text{all } n \text{ steps succeed}) = \prod_{i=1}^{n} p = p^n.$$

The mechanism of failure is the multiplication itself. Each step multiplies the surviving probability mass by \(p<1\), so the survivor decays geometrically. At \(p=0.95\):

$$0.95^{10} = e^{10\ln 0.95} = e^{10(-0.0513)} = e^{-0.513} \approx 0.60.$$

Read that: ten steps that each work 95% of the time — which sounds excellent — complete the whole task correctly only ~60% of the time. At \(p=0.90\) it is a coin flip by step 7 (\(0.9^7\approx0.48\)). This is not pessimism or a claim about "flaky models"; it is what geometric decay is. The naive plan — "just let the agent run 30 steps" — fails at the mechanism level because \(p^{30}\) at \(p=0.95\) is \(\approx0.21\): four out of five runs are wrong somewhere. Independence is the pessimistic model (a good early plan can raise later \(p\); a bad early step can zero out everything after), but it is the correct first model and the one you defend in review.

The retry lever: 1 - (1-p)^{r+1}

The first way to fight the decay is to raise \(p\) per step. A step you can retry fails only if the original attempt and every retry fail. With \(r\) independent retries there are \(r+1\) total attempts, each failing with probability \((1-p)\):

$$P(\text{success within } r \text{ retries}) = 1 - (1-p)^{r+1}.$$

At \(p=0.8, r=2\): \(1 - 0.2^3 = 1 - 0.008 = 0.992\). One 80% step became a 99.2% step for the cost of two possible re-executions. The mechanistic caveat is idempotency: retrying "send the email" twice sends two emails. Retries only buy reliability on steps whose re-execution is safe, which is why making steps idempotent is a durability topic (Phase 08), not a free lever.

The step budget and the log-flip

Combine the decay with a required end-to-end target \(T\). The largest number of unverified autonomous steps you can afford is the largest \(n\) with \(p^n \ge T\). Take logs. The logarithm is monotonically increasing, so it preserves the direction of the inequality — until you divide by \(\ln p\). Because \(0<p<1\), \(\ln p < 0\), and dividing an inequality by a negative number flips it:

$$p^n \ge T ;\Longrightarrow; n\ln p \ge \ln T ;\xrightarrow{;\div,\ln p,<,0;}; n \le \frac{\ln T}{\ln p}.$$

The flip is the whole subtlety; get the sign wrong and your budget is inverted. Take the floor because \(n\) is a whole number of steps:

$$n_{\max} = \left\lfloor \frac{\ln T}{\ln p} \right\rfloor.$$

Worked trace at \(p=0.95, T=0.90\): \(\ln 0.90 = -0.1054\), \(\ln 0.95 = -0.0513\), ratio \(= 2.05\), floor \(= \mathbf{2}\). Beyond two unverified steps at 95% reliability you have already dropped below a 90% target and must add a lever — a checkpoint, a critic, a retry, or a human. (Edge case the lab encodes: \(p=1.0\) gives \(\ln p = 0\), a division by zero, so it is a sentinel — an infinitely reliable step imposes no budget.)

ReAct's quadratic: deriving the n(n-1)/2 term

Now cost, whose currency is tokens. ReAct interleaves thought, action, observation, and repeats — and critically, on every step it resends the entire scratchpad so far so the model can reason over full history. Let a fixed system prompt (with tool schemas) and task be resent every call; let each completed step contribute t generated thought/action tokens and o returned observation tokens. On call \(i\) (0-indexed) the scratchpad already holds \(i\) completed steps, so the input on that call is

$$\text{input}_i = \text{system} + \text{task} + i,(t+o).$$

Sum over \(i = 0 \dots n-1\). The constant part contributes \(n(\text{system}+\text{task})\); the growing part is

$$(t+o)\sum_{i=0}^{n-1} i = (t+o),\frac{n(n-1)}{2}.$$

That triangular-number term is the headline: ReAct input tokens grow as \(\Theta(n^2)\). The mechanism is the resend — the model re-reads its own history every step, so a 20-step research agent can spend the majority of its token budget re-processing its scratchpad. Double the steps and you more than double the bill. In code this is the (steps-1)*steps//2 term (integer division because tokens are whole). Output tokens, priced 3–5× input, ride on top.

ReWOO's linear structure

ReWOO — Reasoning WithOut Observation — attacks the quadratic at its root by removing the resend. It splits into a Planner (one LLM call writing the whole plan with variable substitution #E1, #E2, …), Workers (your code running the tools, no LLM in the loop), and a Solver (one LLM call reading task plus gathered evidence). The model is called exactly twice regardless of step count:

$$\text{total input} = \underbrace{(\text{system}+\text{task})}{\text{planner}} + \underbrace{(\text{system}+\text{task}+n,o)}{\text{solver}}.$$

The only growth is the \(n,o\) evidence term, so input is \(O(n)\). The quadratic scratchpad-resend is gone. The mechanistic price is adaptivity: ReWOO commits the whole plan before seeing any observation, so a surprising result at step 3 cannot re-route the plan the way interleaved ReAct would.

Nearest-rank percentile and cost per resolved task

Latency is judged at the tail, not the mean, because latency distributions are right-skewed. The lab uses the nearest-rank percentile: sort the \(N\) samples ascending, then the \(p\)-th percentile is the element at 1-indexed rank

$$\text{rank} = \left\lceil \frac{p}{100},N \right\rceil,$$

with \(p=0\) defined as the minimum. For \(N=20\) samples, p95 is rank \(\lceil 0.95\cdot20\rceil = \lceil 19\rceil = 19\) — the 19th smallest, i.e. only 1 in 20 is slower. Agent loops are sequential (step \(N\) needs step \(N-1\)'s observation), so end-to-end latency is the sum of per-step latencies, checked at the tail against the budget.

Finally, the number the business pays: an attempt costing unit_cost that succeeds only a fraction success_rate of the time costs, in expectation, per good result:

$$\text{cost/resolved} = \frac{\text{unit_cost}}{\text{success_rate}}.$$

A $0.05 agent at 40% success costs $0.125/result — worse than a $0.10 agent at 95% ($0.105). This is why cost and reliability are one conversation: the denominator is success_rate, and it is exactly the p^n-driven number this whole phase computes. Every mechanism here feeds one equation.