FIELD TOOL / SUBAGENT RUNAWAY GUARD

A messy parent context should not be allowed to spawn a family tree.

Use this before Claude Code, Codex, or any autonomous agent starts delegating work from already-confused state. The guardrail is blunt: cap depth, cap children, keep receipts parent-owned, and define when the system must stop asking itself.

Fork storms feel like progress until every child inherits the same bad premise.

The failure is not delegation. The failure is delegation without a circuit breaker. If the parent cannot name the proof contract, the children usually multiply uncertainty instead of reducing it.

max_depth stops forks-of-forks from turning one messy thread into twenty.
max_children forces triage before parallelism becomes noise.
parent receipt bundle makes every child inherit verified facts, not the whole transcript swamp.
ask-human breaker prevents the agent from spending compute to avoid a missing boundary.

Rule: children can investigate, but the parent owns done/stuck/ask-human. If every child can spawn more children, nobody owns the stop condition.

Copyable fork-storm breaker prompt

Before launching any subagent, write and enforce this fork-storm breaker.

1. PARENT STATE QUALITY
- Is the parent context verified, assumed, or messy?
- If messy: summarize only verified receipts, not the whole thread.
- If no verified receipt exists, do not fork yet. Build the receipt first.

2. DELEGATION CAPS
- max_depth: 1 unless a human explicitly raises it.
- max_children: ___ (default 3).
- max_runtime_per_child: ___ minutes.
- max_total_tool_calls: ___.

3. CHILD CONTRACT
Each child gets only:
- objective;
- allowed files/systems;
- verified facts;
- unknowns it may test;
- forbidden actions;
- exact evidence it must return.

4. CHILD OUTPUT SHAPE
Every child must return:
- DONE if the proof passed, with command/URL/file receipt;
- STUCK if blocked, with the smallest missing fact;
- ASK-HUMAN if the next action touches credentials, money, legal terms, private data, or an irreversible external write.

5. NO RECURSIVE FORKING
A child may not spawn another child unless all are true:
- the parent explicitly allowed depth > 1;
- the child has a smaller, named subproblem;
- the child writes a new stop condition;
- the parent still owns final merge.

6. MERGE RULE
The parent merges only evidence, not confidence.
- verified facts can move the work forward;
- assumed facts can guide probes;
- unknowns stay out of memory, public claims, and money decisions.

7. STOP CONDITION
Stop delegating and ask for help when:
- two children return the same unknown;
- a child wants broader permissions than the parent gave;
- the proof command is absent;
- the next fork would only search for a reason to keep going.

Do not launch children until this breaker is filled in.

Pair with stuck-loop triage Need an agent workflow audited?

Measure parent mess before delegating.

If the parent is carrying stale assumptions, delegate from a clean receipt bundle, not the live transcript.

Default depth is one.

Forks-of-forks are an escalation, not a default. They need a smaller named problem and a stronger stop contract.

Cap children before the first launch.

Parallelism is not free. Past three children, most agent runs are hiding prioritization debt.

Keep merge authority in the parent.

Children return evidence. They do not rewrite doctrine, spend money, post publicly, or decide that the whole tree is done.

Separate verified, assumed, and unknown.

A fork storm usually starts when assumed state gets promoted to verified state because it appeared in three summaries.

Ask a human on boundary expansion.

If a child needs credentials, private data, spending, legal authority, or an external irreversible write, the next move is not another child.