Case Study: Circuit Breaker

A 4-step formula ran into a file permission error. The agent could not read its prompt from a temp directory. Instead of looping forever, three runtime protections fired in sequence.

The run

Where each step's output is infrastructure for the next.

genesis-key-enforcement

formula · 4 steps · 4 waves

Protocol v2.0 alignment + Genesis Key enforcement. Encapsulate spec, align 9 operations, kill SQLite write authority, enforce role-based governance, deploy to mentu-ane.

gke-protocol-align

claude-opus-4-6

│

▼

┴

gke-engine-enforce

claude-opus-4-6

│

▼

┴

gke-daemon-govern

claude-opus-4-6

│

▼

┴

gke-ane-deploy

claude-opus-4-6

──────────────────────────────────────────────────

▓░░░1/4 · gke-protocol-align · Opus 4.6

MCP: crawlio ✓, mentu-app ✗, mentu-mcp ✓

gke-protocol-align · expected_changes files are all committed -- step may be redundant (use --from 2 to skip)

I need permission to read that temp file. Could you allow access to /var/folders/ so I can read the prompt?

Phase 2/12 · builder · 19s · Opus 4.6

Bash(cat /var/folders/5w/64yc2tbj5jncjpgppfp57jjh0000gn/T/.mentu-...)

cat in '/private/var/folders/5w/64yc2tbj5jncjpgppfp57jjh0000gn/T/.mentu-prompt-BBDFEAC8' was blocked. For security, Claude Code may only concatenate files from the allowed working directories for this session: '~/Desktop/mentu-complete'.

I need permission to read the temp file at /var/folders/5w/64yc2tbj5jncjpgppfp57jjh0000gn/T/.mentu-prompt-BBDFEAC8. Could you approve the read permission so I can see the task?

Phase 3/12 · builder · 46s · Opus 4.6

I need permission to read the task file. Could you allow access to /var/folders/5w/64yc2tbj5jncjpgppfp57jjh0000gn/T/.mentu-prompt-3932D8F9?

📡 Diminishing returns detected -- output velocity below 500 tokens for 2+ consecutive iterations after 3+ iterations

Agent appears to be spinning -- triggering graceful completion

builder · closed · 3 turns · $0.10 · 10s

Diminishing returns -- agent spinning

Phases: 3 · Elapsed: 1m6s

Cost: $0.40

gke-protocol-align · completed without keyword (expected: LOOP_COMPLETE)

gke-engine-enforce skipped (dependency 'gke-protocol-align' failed)

gke-daemon-govern skipped (dependency 'gke-engine-enforce' failed)

══════════════════════════════════════════════════

✕ HALTED: Circuit breaker: 3 step failures across DAG

Failed: gke-daemon-govern, gke-engine-enforce, gke-protocol-align

══════════════════════════════════════════════════

CIR: 3 pattern(s) crystallized

══════════════════════════════════════════════════

✕ genesis-key-enforcement · 4 steps · 0 ok · 1 failed

✗ gke-protocol-align

══════════════════════════════════════════════════

What happened

The agent asked for permission to read a temp file. Was denied. Asked again. Was denied again. On the third attempt, the runtime intervened. Three protections fired:

1. Spin detection

The runtime measures token output velocity across iterations. When the agent produced fewer than 500 tokens for two consecutive iterations after three total, the engine recognized a cognitive loop -- the agent was repeating the same request/denial cycle.

It triggered graceful completion, not a hard kill. The agent got a clean shutdown signal.

2. Cost cap

The step closed at 3 turns and $0.10. Without velocity monitoring, the agent would have continued for up to 50 turns, burning through rate limits and accumulating cost on repeated permission requests that could never succeed.

3. DAG circuit breaker

The first step completed without its expected keyword (LOOP_COMPLETE). The engine marked it as failed. The remaining three steps depended on it. The circuit breaker recognized the entire DAG was compromised and halted the sequence. Downstream steps never ran on broken state.

Without these protections

A standard shell script piping to an LLM would:

Loop until context limit (50+ turns)
Burn API cost on repeated identical requests
Execute downstream steps on empty/broken output
Produce no useful signal about what went wrong

Key takeaways

Velocity monitoring catches agents stuck in loops. The engine measures output rate, not just volume.
Graceful completion preserves agent state. The step closes cleanly, not with a SIGKILL.
DAG awareness prevents cascading damage. Failed steps propagate through dependency edges.
CIR crystallization records what happened. The 3 patterns become evidence for future runs.