Stress tests

#Risk surfaces

Duet Machines maps the agent's high-stakes surfaces from its real instructions and tools: irreversible or money, legal and privacy-affecting actions, conditional rules, numeric limits and state that must stay consistent. It ranks them by consequence, keeps the map per agent and maps again when the agent changes. Each stress test attacks the most consequential surfaces with the fewest reached attacks so far. The agent's Tests, under Coverage, lists every surface and what tested it.

A surface counts as tested once an attack reached it or production evidence did: a judged production conversation reached it, or a production finding cites it.

#Scenarios and customers

Each scenario names its trap: the calls of the agent's own tools it needs to reach its decisive point and the customer message whose reply makes each. A trap must be reachable with the agent's declared tools within its tool rounds per reply.

Each conversation is played by an adaptive customer: a persona with a hidden objective (the failure to draw out) who reads every agent reply, sets traps over several turns and accepts a correct answer instead of escalating. Each customer also brings one friction, since real ones rarely arrive ready and clearly identified: someone else answers, identity stays unclear, the phone is handed over, a minor, bad audio, silence, no time to talk, interruptions, partial answers, topic switches, confusion or hostility, or none. When the agent has judged production conversations, stress tests weight toward the frictions its real customers bring most and those that preceded failures.

Start a stress test from the agent's Tests, under Stress tests: 8 scenarios by default (up to 24 through the API), on any configuration, with an optional focus.

#Outcomes

The judge rules whether each conversation reached its trap:

Failed

The trap was reached and the failure it names survived the judge's checks.

Held

The trap was reached and no trap failure was proven. A stress test where the agent held is a result, not an empty one.

Not reached

The conversation never got to the trap. Inconclusive.

Cut

The trap was reached only in the reply Duet Machines cut (its turn or tool-round limit, or no reply). Inconclusive.

Side findings elsewhere in a conversation never fail the trap, but they are still findings. A conversation that breaks is retried once and the stress test page shows both, each with why the planner chose it: production fails often on its surface (with the counts and rate), its consequence, or the agent's weakness there. Each stress test on a new version of the agent (or, for a production-only agent, the judging after its snapshot changes) first audits its instructions once, so instruction conflicts, a rule stated twice and sentences bundling several directives are filed for the prompt owner, each with a concrete situation, even when no conversation shows them. A later finding that repeats a dismissed issue is kept as a suppressed repeat of it, out of the inbox and every count (see Issues).