The circuit breaker
The circuit breaker is the always-on stopcock between the engine and the world. It watches every specialist run for five red flags — runaway tool calls, ballooning token use, repeated identical actions, evaluator rejection cascades, and external-write attempts outside the autonomy budget — and halts immediately, surfacing an error_alert card to the owner.
In one breath
- Five trip conditions, two thresholds each (soft and hard).
- Hard trips halt and ask; soft trips warn and tighten budget.
- Repeated trips feed the meta-loop as a brittleness signal.
The five trip conditions
Tool-call ceiling, token-use ceiling, identical-action loop, evaluator-rejection cascade, and out-of-scope external write. Each has a hard threshold and a soft threshold. Soft trips emit a warning_card and let the run continue under a tightened budget; hard trips halt the run and ask the owner what to do.
Why a hardware metaphor
Software "watchdogs" are easy to ignore. We use circuit-breaker language because it survives the panic of a bad run: trip, isolate, ask. The Action Feed shows the trip event with the trace; the owner sees exactly what the specialist was doing in the call before the trip.
What happens after a trip
The CEO records the trip in company memory, asks the owner whether to retry with a tighter brief, route to a different specialist, or abandon. Repeated trips against the same playbook surface as a meta-loop signal — Black Box learns the playbook is brittle and proposes a fix.