Girish Konda, a Microsoft engineer speaking for himself, draws on his open-source MCP Pacemaker bridge to explain why concurrent sub-agents inherit distributed-systems failures.
A fluent answer can hide partial failure
- A worker may return a convincing conclusion after skipping the actual check. A timeout can mean slow work, a crash or a lost reply.
- Return a structured state such as completed, partial, failed or unknown, with evidence and known side effects. A negative finding differs from a check that never ran.
- Konda’s bridge gave slow first-time initialization a separate timeout and stopped a timeout from obscuring a server crash.
Keep shared context from laundering guesses
- Three workers repeating one unverified claim from shared memory are one source, not three independent confirmations.
- Record each claim’s source, version, scope and observation time. Recheck freshness when the decision uses it.
- A timeout after a write leaves the outcome unknown. Give effects stable identities, bind approval to one exact action, and read the target back before retrying.
Bound concurrency and verify the boundary
- Limit parallel starts and downstream load; make refused work visible to the orchestrator. Konda describes a two-at-a-time package-manager startup gate in his bridge.
- Orchestrator code should check schemas, evidence, freshness and arithmetic rather than accepting a worker’s self-reported success.
- His proposed SAFE handoff groups source facts, at-most-once effects, fanout budgets and explicit outcomes.
- Caveat: this is Konda’s proposed design for agents that write to real systems, not a universal protocol or an exactly-once guarantee. Simple drafts a person reviews may not need this machinery.
“Treat every handoff to a sub agent as a network call.” — Girish Konda, 22:00