Reliable by Design · 05.02
The Recovery Ladder: Five Rungs From Reflex to Escalation
How a failed node recovers: deterministic rebind, capability-aware remedy, config-aware surfacing, certified structural repair, then honest escalation.
Cheapest and least invasive first
| Rung | Action |
|---|---|
| 1 · Deterministic | Runtime rebind / reroute to the healer — zero LLM tokens spent. |
| 2 · Capability-aware | A missing binary, provider, or tool is escalated with the exact remedy — never silently re-planned around. |
| 3 · Config-aware | A missing env var or working directory is surfaced as configuration to fix, not treated as a graph fault. |
| 4 · Structural | A certified graph patch, gated by recovery mode and — depending on impact — human approval. |
| 5 · Escalate | An honest stop with a concrete "send to the Agentis team" path; circuit breakers stop the ladder from cycling forever. |
Approval is decided by impact, not by mood
Whether a structural repair needs a human's OK isn't a vibe — it's computed. In guarded recovery mode, a proposed repair requires approval unless its assessed impact is internal; anything touching more than the graph's own internals stops for a human. The decision and the impact assessment are kept in one small pure function specifically so the "should a human see this" logic can never quietly drift out of sync between an approval-gated path and an autonomous one.
Repeated failures don't get repeated repair attempts
Two fingerprints keep the ladder from thrashing. A repair-plan fingerprint is a stable hash of a proposed plan, used to circuit-break on duplicate plans — proposing the same fix twice in a row is a sign the ladder is stuck, not making progress. A failure fingerprint normalizes volatile details out of an error message (ids, timestamps, raw numbers) so the same underlying root cause is recognized as "the same failure" across retries and restarts, even though the literal error text changes every time. The first model-proposed repair for a given failure is treated as a narrow minimal_patch; only later, genuinely distinct plans escalate to a full rebuild.
Continue
The SWIFT verdict engine probes the real world after a run settles instead of trusting a self-report, distinguishing accomplished from merely completed.
A proven, blessed workflow graph is never autonomously restructured — repair requires certification and a rollback path.