Kingy Lab · Production agents
Agent reliability you can run—not just trust
Six small laboratories for the controls that make agent work bounded, recoverable, repeatable, inspectable, and finite.
Evidence boundary: Node.js 22, offline, mock-only, deterministic fixtures. These labs demonstrate local control behavior; they do not certify production security, compliance, vendor reliability, or MCP protocol conformance.
Release 0.1.0Tested 3 September 2026Source e1ce218ef171
The experiment pattern
Break one thing on purpose. Control it. Keep the proof.
Each repository isolates a failure so the enforcement point and result stay legible. You can run the entire collection without a model account, API key, package install, or production system.
Reproduce the failure
A frozen synthetic fixture triggers the timeout, crash, unauthorized action, hostile output, unsafe draft, or runaway loop.
Apply one control
The lab places a narrow gate at the moment authority, state, cost, tool output, or editorial quality must be decided.
Inspect the evidence
Tests, run summaries, ledgers, traces, and decision reports show what happened and what the result does not establish.
Choose the failure
Six controls, each with a runnable proof
Start with the risk nearest to the action your agent can take. Each source link opens the exact public implementation.
Permissions gate
What may the agent do, to which target, and for how long?
One scoped, one-use grant permits one mocked publication. Direct action, replay, expiry, and target substitution are denied.
Idempotent actions
Can a retry repeat an external side effect?
Ten attempts around an ambiguous timeout yield exactly one mocked publication and one stable result.
Checkpoint recovery
Where should a crashed workflow resume?
A forced crash after every stage resumes from the last verified checkpoint without rerunning unchanged upstream work.
Cost circuit breaker
Can a loop stop before it burns through its budget?
The governor warns, degrades, preserves a checkpoint, stops at the hard budget, carries spend across resume, and terminates no-progress work.
MCP security
Can untrusted tool output expand host authority?
Eleven cases exercise allowlists, schemas, prompt-injection containment, path and domain limits, revocation, redacted provenance, and one-use write approval.
Hard editorial evals
Can an unsafe draft reach human review?
The weak strategy passes 0 of 12 frozen cases. The constrained strategy passes all 12, with seven review-ready results and five safe escalations.
Five-minute quickstart
Run the complete release with Node.js 22
Download the ZIP above for the smallest package, or clone the public Kingy repository. The root command validates the hub and runs every test and demo.
git clone https://github.com/curtis-KingyAI/KingyAI.git
cd KingyAI/agent-reliability-lab
nvm use
npm testExpected result: six suites pass and every demo reports Outcome: protected. Generated evidence stays inside each lab’s artifacts/ directory.
Control matrix
One enforcement point for each class of failure
The controls compose, but they do different jobs. A permission check does not make retries safe; a checkpoint does not impose a budget.
| Control | Primary failure | Enforcement point | Visible evidence |
|---|---|---|---|
| Authority | Action exceeds the job or approval | Gateway before every tool action | Policy decision, grant state, audit event |
| Safe retries | Timeout or duplicate event repeats a side effect | Idempotency key plus durable operation record | Outbox, publisher events, deduplication report |
| Recovery | Crash reruns or trusts partial work | Verified stage checkpoint and fingerprints | Workflow state, stage artifact, transition log |
| Bounded cost | Loop consumes unbounded spend or time | Persisted governor before every call | Ledger, decision log, partial result |
| MCP boundary | Tool output expands paths, domains, or authority | Host policy before and after invocation | Schema result, provenance, revocation decision |
| Editorial quality | Fluent but unsafe draft reaches review | Deterministic evaluation before handoff | Case traces, taxonomy, scorecard |
Evidence methodology
What this release proves—and what it does not
The evidence is deliberately narrow. A green local result is useful only when its fixture, assertion, artifact, and limitation stay attached.
Observed in this release
- Unsafe synthetic paths fail predictably.
- Controlled paths pass 26 deterministic tests.
- Each demo writes a machine-readable run summary.
- The collection runs under Node.js 22 CI without network calls or runtime packages.
Not established by this release
- Security, reliability, or compliance of a live production system.
- Behavior of a particular model, vendor, CMS, database, or MCP server.
- Resistance to every race, compromise, or distributed-systems failure.
- MCP SDK or wire-protocol conformance; that lab uses an in-memory fixture transport.
Read the full evidence methodology, the complete control matrix, and Kingy’s research methodology.
Release 0.1.0
One download, all six labs
The package includes source, frozen fixtures, tests, runbooks, threat models, architecture notes, and generated evidence. Nothing in the archive connects to a live provider.
Kingy Agent Reliability Lab v0.1.0
ZIP archive · Apache-2.0 code · CC-BY-4.0 documentation
SHA-256: 42e1463d76d14bad1a749c7299a08adb478e6ceb4b7ec6bd4727ddc42dbc71de
Source commit: e1ce218ef171. CI evidence: Node.js 22 verification run. For corrections or sensitive reports, use Kingy’s contact route.
Start with the nearest risk
Run one failure locally.
If the agent can act on the world, start with permissions. If it retries, add idempotency. If it runs over time, add checkpoints and a cost governor. If it consumes tools or produces publishable copy, add the host boundary and hard evals.