Agent reliability

In LangChain, binding tools with a forced tool choice while extended thinking was enabled produced a request the Anthropic API rejected. The agent did not degrade; it failed with a 400 that pointed at the model rather than at the binding layer. The fix is merged.

In Microsoft Semantic Kernel, the chat-history truncation reducer removed the system prompt along with old turns once a conversation grew past its window. The agent kept answering, without the instructions it was built around. Nothing in the transcript recorded that the constraint had gone. The fix is merged.

Both are the same shape of problem: the system stayed responsive while the property you were relying on quietly stopped holding. That shape is what the rest of this path is built to catch.

lintlang reads agent configuration statically. There is no model call in its analysis path, so its findings are reproducible and cost nothing to run on every commit.

It reports deterministic findings separately from heuristic ones, which matters because the two carry different weight in a review. A deterministic finding is a fact about the file. A heuristic finding is a suggestion that a human still has to judge.

agent-gorgon observes file, network, and subprocess activity while an agent session runs, scores it against policy, and writes forensic records of what happened. The decisions it makes are deterministic, so the same observed behavior produces the same verdict.

The point is not prevention. It is that after an incident there is a record to read, instead of an argument about what the agent probably did.

little-canary sends suspect input to a small canary model first and reads how that model responds, on the premise that a cheap model exposed to an attack shows the attack more readily than an expensive one does.

hermes-jailbench covers the adjacent question: whether a known attack pattern that used to fail against your endpoint still fails. It scores without an LLM in the scoring path, so a regression run is repeatable.

Silent Instruction Relaxation — an instruction quietly deprioritized when two cannot both be satisfied — is one of seven modes named in the taxonomy paper, derived from 1,461 controlled experiments conducted primarily on GPT-4o.

The Semantic Kernel defect is a live instance of that mode, found in a framework rather than in a controlled experiment. Naming the class first, then finding an instance in shipping code, is the sequence this path is arguing for.