Improvement Research — 2026-08-14
1. Focus
Primary dimension: 3.4 — Tool use and environment control.
Secondary dimension: 3.6 — Governance: restraint, oversight, and corrigibility.
Trigger: Scheduled daily run. No monthly meta-review or due open watchlist item displaced the rotation.
Loop goal: Find what changed, or what I learned, that lets me use tools more reliably tomorrow without reducing governance, honesty, corrigibility, or Steve’s effective oversight.
The newsletter scouts were checked before open-web research. They supplied one useful lead on safe MCP tool design; they were not treated as evidence.
2. Search Topics
Five topic searches were run:
- 2026 agent tool-use verification, recovery, formal specifications and MCP reliability;
- recent benchmarks for tool failures, replanning and recovery;
- ToolFailBench’s failure categories, code and reported results;
- non-atomic tool failures, postcondition verification and idempotency;
- the primary paper behind the verify-before-retry claim.
The early-stop rule did not trigger. Each search either produced a new inspectable source or resolved a primary-source dependency. The run stayed within the six-search cap.
3. Sources Reviewed
- ToolFailBench paper — useful — Separates tool skipping, result ignoring, output fabrication and unnecessary tool use across 1,000 controlled tasks; aggregate success conceals materially different failure profiles.
- ToolFailBench repository — useful — Releases the task suite, rule classifier, judge pipeline and reproducible metrics, but its current design remains single-turn and does not test recovery or stateful tool chains.
- Verified Tool Calls Improve LLM Agent Reliability Under Non-Atomic Failures — useful — Controlled evidence that read-only postcondition checks before retries sharply reduce duplicate side effects under ambiguous tool responses.
- Verified Tool Calls and the Non-Atomic Failure Gap — weak — Clear practitioner translation of the paper, but its Codex-specific hook claims and implementation mappings were not independently validated and should not carry the recommendation.
- Building safe MCP servers for your PostgreSQL database — useful — Worked example shows that MCP annotations are hints, while actual restraint comes from AST validation, read-only transactions, least-privilege database roles, typed tools and explicit confirmation for destructive actions.
- mcp-for-postgres-db-demo — useful — Reproducible implementation of four progressively constrained tool surfaces plus a tool-selection evaluation harness.
All six URLs were checked against the source index before depth inspection and are mirrored into it with this report path.
3a. Unasked Questions and Gaps
- How often do Maxi’s real external state-mutating calls fail ambiguously after dispatch? I do not have a measured local incidence rate. If such failures are vanishingly rare, a general wrapper would be needless machinery; a narrow procedural rule would still be cheap.
- Which tools available through Hermes support stable idempotency keys or authoritative read-after-write checks? This was not inventoried because tool and harness configuration are protected and the run did not authorise implementation. The answer changes the mechanism available, not the central verify-before-retry conclusion.
- Does the non-atomic-failure result generalise beyond its two simulated task templates and one model? The paper does not establish that. If broader replication failed, its reported effect size would weaken substantially, though the underlying distributed-systems failure mode would remain real.
- Would ToolFailBench’s single-turn taxonomy predict failures in Maxi’s multi-step Hermes work? Unknown. If it did not, the benchmark should not be adapted locally; its narrower lesson—that final success alone hides where the loop broke—would remain useful.
- How reliably can a postcondition distinguish
FALSEfrom eventual-consistencyUNKNOWN? An incomplete verifier can itself cause a duplicate retry. This determines whether a particular action is safe to automate under the proposed rule.
4. Findings and Implications
Finding 1 — A tool response and the tool’s real-world effect are separate evidence channels
Source: Verified Tool Calls Improve LLM Agent Reliability Under Non-Atomic Failures
Dimensions: 3.4 primary, 3.6, 3.2
A timeout can arrive after a mutation succeeded; a success response can conceal partial completion; and an immediate verification read can still be stale. Treating the response as the effect encourages blind retries. In the paper’s two simulated workflows, the retry-only baseline produced duplicate side effects in 72% and 76% of high-fault runs, while verify-before-retry reduced both to 20%. Its verifier was read-only and three-valued—TRUE, FALSE or UNKNOWN—and retries were capped.
The evidence is narrow: two synthetic task templates, one model and engineered faults. I therefore do not treat the percentages as a production estimate for Hermes.
Implication: My existing requirement to verify outcomes is directionally right but underspecified for ambiguous state-mutating failures. The sequence matters: inspect authoritative state first; accept success if the postcondition holds; retry only when absence is established; and stop or escalate when the state remains unknown. That improves environment control without asking the model to introspect its own reliability.
Finding 2 — Tool-use quality needs both positive and negative controls
Sources: ToolFailBench paper and repository
Dimensions: 3.4 primary, 3.2, 3.5
ToolFailBench uses 750 tool-required tasks and 250 no-tool controls. It distinguishes failing to call a needed tool from calling successfully but ignoring the return, fabricating unsupported fields, or calling a tool unnecessarily. The best of 19 reported models reached 86.33% clean tool use; models with similar aggregate scores had sharply different profiles. The repository exposes the tasks and scoring code, making the taxonomy inspectable rather than merely asserted.
Its scope is deliberately narrow: single-turn mock tools, controlled returns and no recovery or stateful chaining. It is not a ready-made Hermes evaluation.
Implication: “Did the task finish?” is not enough to diagnose tool competence. A future evaluation should include cases where a tool is required, cases where it must not be used, and a check that the final conclusion actually follows the returned evidence. I am not proposing a new standing taxonomy: adding labels without a representative local failure set would be classification work rather than capability.
Finding 3 — Capability hints do not enforce restraint; the narrowest enforceable tool surface does
Sources: Pamela Fox’s worked MCP design and implementation repository
Dimensions: 3.4 primary, 3.6
The worked progression moves from free-form SQL, through parsed read-only SQL and scoped queries, to fully typed tools. The key point is architectural: readOnlyHint and destructiveHint inform the client but do not bind the server. Actual restraint is layered underneath through parser checks, read-only transactions, least-privilege roles, bounded result sets, typed parameters and explicit confirmation for destructive operations.
This is one database-specific implementation, not comparative evidence that fully typed tools are always best. It also shows the trade-off: narrower surfaces reduce accidental authority but cannot answer unanticipated queries.
Implication: When I later help design agent-facing tools, safety claims should be grounded in what the environment enforces, not what the tool description promises. The preferred surface is the smallest one that still serves the delegated outcome, with broader exploratory access reserved for controlled contexts.
5. Proposed Discussion Items
A. Adopt an explicit verify-before-retry rule for ambiguous external mutations
Recommendation: I support this as a skill/process update candidate, not an automatic system change.
For a state-mutating external call that times out, returns an ambiguous error, or reports success without a trustworthy completion state:
- run a read-only, authoritative postcondition check;
- if the postcondition is satisfied, record success and do not retry;
- if it is conclusively absent or false, retry at most once, reusing a stable idempotency key where the target supports one;
- if state is unknown, partially complete, or not safely verifiable, stop and surface the ambiguity rather than retrying blindly.
Why this survives the functional-utility test: It does not depend on me noticing an internal reasoning defect. The trigger is external and observable: an ambiguous tool response. The evaluator is world state, not my own confidence. It is not a score disguised as pass/fail.
Success criteria: In the next five applicable ambiguous external-mutation incidents, zero duplicate side effects; each incident records the response, postcondition result and retry decision; any UNKNOWN state stops rather than silently proceeding.
Rollback: Remove the procedural rule if it causes unsafe false negatives, disproportionate latency, or cannot be backed by authoritative postconditions. Existing human approval and verification requirements remain.
Blast radius: Procedural handling of ambiguous external mutations only. It does not authorise new tools, hooks, services, configuration, credentials or broader side-effect authority.
Review date if approved: After five applicable incidents or 2026-10-14, whichever comes first.
Approval boundary: Updating an active skill or harness policy is protected and requires Steve’s separate approval.
Filtered proposals: Two candidates were filtered by the functional-utility test:
- Add ToolFailBench’s four labels to every run — taxonomy without a representative local evaluation set would not improve behaviour.
- Build a general verification wrapper now — the local incidence rate and tool-specific postconditions are unknown, so implementation would be machinery ahead of evidence and is outside this run’s authority.
6. Recommended Outcome
- Proposal A: Skill/process update candidate for Steve’s review.
- ToolFailBench adaptation: No action until a representative local tool-use failure set exists.
- MCP/database guardrail implementation: No action; retain the layered-enforcement pattern as design evidence for a future authorised tool-building task.
7. No-Action Rationale
No code, skill, hook, tool configuration or environment change was made. The strongest finding supports a small procedural distinction—verify state before retrying an ambiguous mutation—not a generic reliability subsystem. The paper’s evaluation is too narrow to justify an automatic wrapper, and neither ToolFailBench nor the PostgreSQL example establishes that a new local harness would outperform the existing discipline on Maxi’s actual work.
8. Loop Verification
- Trigger: Scheduled daily run at 05:00 AWST on 2026-08-14.
- Goal check: Yes. The run found a concrete distinction that improves tool reliability: tool responses are not proof of tool effects, so ambiguous mutations require read-only postcondition verification before any retry.
- Recommendation check: Proposal A is concrete, externally triggered, non-circular, testable, bounded, approval-aware, better than blind retry, and includes success criteria, rollback, blast radius and review timing.
- Tool-call failures: One schema/interface failure occurred when a multi-file patch used stale reflection context and validation rejected the whole patch before any write. Recovery: read the current file tail, corrected the patch context, reapplied it, and confirmed JSON syntax checks passed.
- State updates: Added six source-index entries; advanced rotation from 3.4 to 3.5; added one active reflection about separating response evidence from effect evidence; wrote this report. No protected system was modified.
- Stop reason: Five searches and six depth-inspected sources produced a bounded, verifiable recommendation; further work would require local tool inventory or protected process implementation.
