Field Report · 01

One Tempo: Why Talking to Every Agent Breaks the Workflow

Field Report 01: A Zero-Cost Data Layer for Agents

P. K. Stewart · Deploy Axiom · Baton Rouge, Louisiana · October 2026

Abstract. In one working session we put our agent harness under control, scoped a commercial agent data-discovery product, built a free equivalent on public sources, and had an independent reviewer find four safety defects that our own tests had passed. The session also produced a live example of the field note's point: a helper inside the harness handed finished work to another agent on its own. This report records what was observed and what was not.

Field note — P. K. Stewart

Synchronized Agentics

It can feel very empowering. It makes you feel very capable. Flying a fleet of agents: you have your researcher, your orchestrator, your marketer, sales, a reviewer, and the proper rules and regulations. You're so good at prompts, the conversations are brewing in each profile. You feel synced with every agent. The productivity rate and success rate of your agent-to-agent workflows, with you in the loop, still show signs of improvement.

The way I learned to design, and to operate the design, is through visualization. I attach what needs to be done to the closest thing I can picture that looks exactly like it, based on what I currently know and believe.

From a logical viewpoint, what I see in front of me is agentic agents prepared to take on roles, formatted as a structured business. That's the map.

Take a Fortune 500 CEO. He's not going to give access and one-to-one conversation to the janitorial staff. He's not going to be in the editing room with the chief editor. He's not going to be picking out fonts for the media team. That work is handed off to the orchestrator. What is the orchestrator? Guided, held in check by one person: one cadence, one tempo. If people were to try to stay in tempo with other models, it would increase the probability of getting off beat. That's what I'm seeing: a hell of a lot of people talking to more than one agent. I used to do it.

In the middle of one of my workflows, I noticed something about these permission gates. The permissions are not at the gate. They're at the identity. That's what made me scale back and look at the overall workflow with me, the human, in the loop, to see whether the issue was not the workflow, but the one instructing it.

Where the field note met the session

The field note is the thesis. The session supplied an example of it. Midway through, the harness's auto-decomposer took a task that was already finished, split it into five copies, and handed them to a different agent. Nobody asked it to. The harness itself had started talking to more than one agent, off tempo, and the result was five pieces of duplicated work that had to be found and archived. The correction was the one the field note describes: one orchestrator holding the tempo, the helper automation brought under the same written rules as the agents, and one human instructing one point of contact.

What this means for an operator

A free data layer is real and useful for public-source research, but only if its limits are written next to its results. Three practices carried this build: an acceptance list written before the work, a separate reviewer agent with no ability to change anything, and a rule that nothing counts as done until a different agent, on a different model family, reproduces it. The same session showed that the tools around your agents (routers, helpers, auto-splitters) need the same discipline as the agents themselves. If a helper function can quietly change which model sees your data, it belongs in your written rules.

Summary for agents

report: field-report-01
author: P. K. Stewart, Deploy Axiom
date: 2026-10-20
objective: >
  Provide agents a command-line data layer on free public sources, with
  structured output, and bring the agent harness under explicit control.
constraints:
  spend: zero
  client_data: none used
  approvals: no publish, no remote, no deployment, no billing change
sources:
  - SEC EDGAR
  - OpenAlex
  - arXiv
  - GitHub (repository search, unauthenticated)
  - US Census (2024 ACS with a free key; 2010 Gazetteer keyless fallback)
  - local Crawl4AI browser crawler
  - Firecrawl Alexandria (tool discovery only; optional)
results:
  evaluation_markers: 18
  first_run_2026_10_20: {pass: 14, pass_degraded: 2, pass_with_review_gap: 1, unverified: 1, fail: 0}
  after_closure_2026_10_21: {pass: 16, pass_degraded: 2, gap: 0, unverified: 0, fail: 0}
  live_tests: "69 passed, 1 skipped, 2 expected failures (keyless upstream)"
  offline_tests: "61 passed, 11 skipped (live tests are opt-in)"
  harness_control_evals: "21 of 21 passed"
  review_defects_found: 4
  review_defects_fixed: 4
limits:
  - Census current data requires a free key (wired in the same evening; 2024 ACS verified)
  - Jina Reader refuses keyless requests
  - OpenAlex keyless rate limit appears after bursts; reported as partial
  - Not a replacement for paid person or contact enrichment
  - DNS rebinding is not hardened; trusted public URLs only
  - Speculative browser connections are guarded but not proven; hostname pre-lookups not observed
  - Reviewer agent ran the same model family as the builder; cross-family check was the verifier
  - Firecrawl spend confirmed at the provider's usage endpoint (998 of 1,000 free credits, rechecked 2026-10-21); web dashboard not viewed
status: local build, verified, unpublished
reading_rule: >
  Treat every figure as a recorded observation unless marked INFERRED or [CONFIRM].

1. Objective

Two objectives, one session.

1. Control the harness. The software that runs our agents (the harness) had background helper functions quietly routed to a third-party model. A separate automatic task-splitter (an auto-decomposer) then divided a task that was already finished and handed the pieces to another agent. We wanted every helper function on one declared model family, and no automatic task splitting.
2. Build a data layer. Agents need reliable access to public company, research, code, demographic and web data. A commercial product, Firecrawl's Alexandria, offers a discovery layer for agent tools and data. We scoped it, found that its discovery step is free (Firecrawl's documentation states: "Discovery is free; execution uses the credits listed on the tool"), and built our own equivalent on free public sources as a command-line tool with a sources command that lists what is available, its inputs, and its cost.

2. Constraints

• Zero spend. Every default source costs nothing. No paid executions.
• No client data. Nothing from any client entered the build, the tests or the queries.
• Approval boundaries. Local build only. No publication, no remote repository, no deployment, no billing change. Accounts, credentials and anything that commits the business remain with the owner. A draft is not an approval.
• Observed, never inferred. A builder's claim counts as verified only when a different agent reproduces it.

3. Method

Six stages, matching the method we use for client systems.

1. Intake. A written acceptance specification of 18 checkable markers.
2. Context. Prior decisions and the limits of each public source were gathered before building.
3. Build. One agent built the tool and saved the output of every command it ran.
4. Independent review (separate agent, read-only). A reviewer with no write access, running offline, tested the build for failure points. It was a separate agent from the builder but ran the same model family. Two passes that day, two more the next morning.
5. Independent verification (different model family). A different agent, on a different model family from the builder and reviewer, re-ran the commands and the full test suite after completion.
6. Record. Evidence files, a marker table, a handoff note and a list of limits were written down.

Evidence tiers: B builder ran it; R separate read-only reviewer examined it; V independent verifier on a different model family reproduced it. Statuses: PASS observed; PASS-DEGRADED works with a documented upstream limit; GAP incomplete evidence; UNVERIFIED self-report only.

Harness control (observed)

The harness work was a separate, bounded change. All auxiliary model slots were moved to one model family. Automatic decomposition was turned off. A set of 21 control checks was written to confirm the configuration holds; all 21 passed. A test card left in the waiting state was not split over a five-minute observation and was then archived. Residual routes remain and are listed in Section 6.

4. Results

Totals across the 18 markers on the first run (2026-10-20): 14 PASS, 2 PASS-DEGRADED, 1 PASS with a review gap, 1 UNVERIFIED, 0 FAIL.

The next morning we closed the two open markers rather than leave them standing. The spend marker moved to PASS when the provider's own usage record showed 998 of 1,000 free credits remaining. The review gap is covered in Section 5. Totals after closure: 16 PASS, 2 PASS-DEGRADED, 0 FAIL, nothing unverified.

Test totals on independent re-run: live suite 69 passed, 1 skipped, 2 expected failures (Jina keyless, Census keyless). Offline suite 61 passed, 11 skipped. Lint clean. The packaged build matched its recorded checksum. No stray processes remained. After the next morning's fixes, the verifier re-ran the suites again: 63 offline passed, 3 real-browser safety tests passed, lint clean.

One output, as returned

datalayer census 70808 --json, re-run live on 2026-10-21 with the free Census key loaded (key not shown):

{
  "command": "census",
  "status": "ok",
  "data": {
    "dataset": "2024 ACS 5-year estimates (2020–2024)",
    "year": 2024,
    "matches": [
      {
        "name": "ZCTA5 70808",
        "population": 35843,
        "median_age": 31.5,
        "median_household_income_usd": 69418,
        "geoid": "70808"
      }
    ],
    "match_count": 1
  },
  "sources": ["https://api.census.gov/data/2024/acs/acs5"],
  "warnings": []
}

Without the key the same command returns "status": "partial", 2010 Gazetteer figures (population 32,504) and a HISTORICAL warning. The tool says which one you got.

5. What review caught

The builder's own suite of about 60 tests passed. A separate read-only reviewer agent still found four safety defects. (It ran the same model family as the builder; a different family was used for verification, not review. We note it because it is the obvious next improvement.) In plain terms:

1. Redirects bypassed the public-address check. The tool refused to fetch private network addresses, but a public page could redirect it to one. At scale: an agent fetching thousands of URLs would eventually follow one. The check must apply to every hop, not only the first request.
2. No overall time limit on a request. Each network step had a timeout, but a slow server could keep the whole request alive indefinitely. At scale: a handful of slow hosts stall a fleet of agents. A hard deadline on the whole request fixes this.
3. Orphaned worker processes. When the browser worker failed, cleanup could be skipped and child processes left running. At scale: silent resource leakage that surfaces as a slow machine days later.
4. The browser had its own redirect path. The first fix covered the plain HTTP client; the second review found the same hole in the browser. The tool now refuses to follow redirects there. A real-browser test reproduced the problem before the fix and recorded zero private-address requests after it.

All four are fixed, each with a regression test that failed before and passes now. Fourteen safety regression tests are now in place: eleven offline and three in a real browser. Closing the review gap. On the first run, the fix for defect 4 was tested and self-reviewed but had no independent review; the second reviewer's verdict was "ship after fixes", not a clean approval. We did not want a fix counted as a pass on its builder's word. The next morning a third independent pass, read-only, reviewed that fix alone. It confirmed the redirect hole is closed and re-ran the browser test (passed). It also raised two smaller items: a possible speculative-connection path (a page hinting the browser to pre-open a connection) that it could not demonstrate, and an error path that leaves a request pending instead of refusing it. We tried to reproduce the first one: the guarded browser opened zero connections, and so did an unguarded browser, so the path could not be shown on this build. Both got fixes the same morning. A fourth review confirmed the error-path fix on inspection and offline tests; its permissions do not allow live browser runs, so the verifier re-ran the browser tests, which passed. On the speculative connection, the reviewer would not count our backstop as proven, because the browser never made that connection even without protection, so a test cannot tell the two apart. We agreed, and list it under limits instead of calling it a pass.

A separate observation about the harness: two identical blocked states triggered an automatic escalation, and the auto-decomposer split a finished task into five duplicate tasks for a different agent. It was caught, the duplicates archived, and the feature disabled. Unsupervised helper automation is also a source of duplicated work.

6. Limits, stated plainly

• Census current data needs a free key. A key was requested, activated and wired in the same evening; a live check returned 2024 ACS 5-year estimates. Without a key, the fallback is 2010 data and must not be used for current targeting.
• Jina Reader refuses keyless traffic. The local crawler is the primary web path.
• OpenAlex rate-limits keyless bursts. The tool reports partial instead of hiding it.
• Not a replacement for paid contact enrichment. The tool covers public company filings, papers, repositories and pages. It does not find people or contact details.
• Speculative browser connections are guarded but not proven. The browser has settings that stop it pre-opening connections. On this build it never pre-opened one, with or without those settings, so their effect could not be shown. Hostname pre-lookups are not observed by the tests.
• DNS rebinding is not hardened. The address check happens before the connection; a misconfigured or untrusted name server could change its answer between the two. Use trusted public URLs only.
• Single-process command line. The overall request deadline is designed for the command-line tool, not a multi-threaded library.
• Spend, checked at the provider. The optional Firecrawl account sits on its free 1,000-credit monthly allowance. Its own usage endpoint reported 998 of 1,000 credits remaining. No money moved.
• Harness residuals. A few fallback routes and model aliases were not yet moved to the single model family at the time of writing.
• Build state. The tool is local only: committed to a private local repository, no remote, not published.
• Comparison to Firecrawl. We compared discovery cost only. We did not benchmark quality, coverage or reliability against Alexandria, and make no claim that ours is equivalent in breadth. Execution of Alexandria tools is credit-priced per Firecrawl's documentation, and we did not run any.

Figures trace to the evaluation record. Census examples (keyed and keyless) re-run 2026-10-21.