Agents and token economics

Every agent fleet eventually meets the same bill: dozens of LLM sessions, each re-reading the same repo, the same docs, the same instructions, at full price. Supernova’s agent substrate is built around one observation — most of what a fleet sends to a model is a prefix it has sent before, and providers serve a cached prefix at a small fraction of the cost. So the substrate treats spawning an agent as something that should be nearly free in tokens, and treats the token bill as a design input rather than an operating surprise.

The candor about why is on record: Matt has said plainly (2026-06-04) that much of the predecessor platform’s design was driven by keeping model costs sane rather than by any grand infrastructure theory. The agent system is the disciplined version of that instinct.

Where agents run

The load-bearing ruling from the substrate design dive (2026-06-21/22, recorded in decisions as case-law): own the agent loop rather than wrap a vendor CLI, because “the cache-economics primitives (prefork/warm-fork + prompt-cache lifecycle) must live INSIDE the loop — you cannot own cache/fork economics inside a vendor harness.” The rebuild is surgical, not from scratch: from the Apache-2.0 codex codebase it grabs three proven tools (the fuzzy-match patch applier, file search, shell command), reimplements the loop, tool dispatch, and a focused OAuth transport (~1–3K lines), and skips the 205K-line TUI, the ~140K-line app server, and the ~37K-line sandbox stack. Measured, then declined.

The hard constraint underneath: flat-rate subscription plans instead of metered API pricing. Per-token pricing blows the economics of a fleet pushing twenty-plus tasks overnight, and since Anthropic restricts its subscription to Claude Code, the owned runtime targets the OpenAI lane; Claude rides along via Claude Code or metered calls as the exception.

Three runtime backends sit behind one runner contract:

Any runner plugs in at a statically declared capability tier — baseline is “a chat target”; session, turn, fork, warm-fork, and mid-turn-interrupt are higher tiers — and an unsupported capability downgrades to baseline with a loud warning. The invariant: “Tiers differ in control/economics, never in isolation or the message set.” Model routing follows a clever↔diligent spectrum: autonomous, repeatable, convergent work goes to the diligent fleet (Codex: rigorous, order-following, token-generous); judgment-heavy, novel, divergent work goes to the clever specialist (Claude), with guardrail strength scaled to the model’s initiative profile. Confinement itself belongs to the permission stack.

The zygote: warm-parent forks

The centerpiece primitive, the zygote — deliberately named after Unix prefork servers: a warm parent session holds a large corpus fully prompt-cached — the preforked process image — and every spawn forks it, so each child inherits the cached prefix the way a forked process shares pages. Fork is the default spawn for all fan-out: review-per-file, workflow stages, oracle-per-question, repo-warm coders. Cold boot is the permitted exception, and it requires typed paperwork — a permit with a stated reason and requester, rejected outright if a suitable warm parent already exists. Architecture violations become type errors; operator overrides become auditable evidence.

The core invariant (AGENT-I20, verbatim from the agent requirements doc):

“A fork never mutates its warm parent. The warm parent is the pristine ‘library’; forks are disposable ‘readers’. Cache maintenance is append-then-refork (R26), never in-place mutation of a shared warm base.”

The oracle pattern is the purest expression: a corpus sits warm in a parent; each question forks the base, answers through the disposable child, and the fork is discarded — so the parent never grows past its cached prefix and never compacts. The fork id is a hash of the normalized question, so replaying a question is idempotent: a cache key for the cache primitive. When the corpus changes, delta-sync appends the diff to the warm session and reforks the session that ate the diff as the new warm base — never reloading, because a prefix change invalidates the whole cache — with a periodic hard reload to reset the accumulated diff tail.

flowchart TD
    CB["cold boot: typed permit required"] -->|"pays full price once"| WP["warm parent v1: corpus fully prompt-cached"]
    WP -->|"fork: ~99.7% cache read"| R1["review child: file A"]
    WP -->|"fork: ~99.7% cache read"| R2["review child: file B"]
    WP -->|"fork per question"| O1["oracle child: disposable"]
    O1 -->|"answer, then discard"| D["fork disposed: parent never compacts"]
    WP -->|"append diff, then refork"| WP2["warm parent v2: cached prefix preserved"]

The field numbers: ~99.7% cache read, a fraction of a cent per query — measured in the live builder platform, where warm-session forking works today [live in automatt]. Fresh-agent spawn cost drops to nearly nothing, which is what makes review swarms, per-stage workflow fan-out, and repo-warm coding agents affordable at fleet scale.

Two notes the wiki insists on. First, in the Supernova tree the fork machinery is built and unit-proven — the fork engine, the fail-closed cold-boot contract, delta-sync, durable-run-bound forks — but the cache-economics requirement itself is deliberately still draft: its closure evidence is a planned production field metric, and a dedicated fail-closed classifier exists solely to reject local, mock, synthetic, or test-prefixed proof so the requirement cannot close on fake numbers (see evidence kinds). The project’s own hype-number is quarantined behind a parser. Second, the gates earned their keep: a 2026-07-02 audit found the implementation inverted — running 100% cold boots with the fork engine unused. Matt: “that’s a huge huge issue, I am surprised there is even a clear cold boot mechanism because there isn’t supposed to be, except literally for warming up sessions for forking.” Corrective work landed (thread resume, a warm-fork branch seam); the live branch round-trip measurement is a named follow-up, and the wiki records plainly that true provider-side thread fork — as opposed to proven thread resume — may not be exposed at all, with a weaker fallback of maximally stable shared prefixes plus provider prefix caching.

The 24-hour cache patch

A private patch extending a 24-hour prompt-cache window has been built and verified but is not deployed — [engineered, not deployed]. The related prompt-cache configuration path crashes on the current SDK, so production uses auto-cache instead. It is easy to imagine this paragraph quietly claiming a deployed 24-hour cache; it doesn’t, because the difference between “verified code exists” and “runs in production” is exactly the distinction the whole project is organized around.

Token thrift as a discipline

The fork primitive is the headline, but the same economics run through everything as smaller habits:

• Mechanical checks before agents (D7). Deterministic checks run once and agents judge over their artifacts, instead of N agents independently re-reading the whole repo. The monitor rebuild exists partly to make adversarial review cheaper, not just stricter.
• Cheap-model triage ladders. Investigation escalates checks-first (free), then a small model for triage, then a frontier model only for genuinely complex cases — the monitor system’s layered-triage invariant, applied wherever classification precedes judgment.
• React, don’t poll. Goal loops park — alive, zero compute — on reactor wakeups and never busy-check; an idle remote agent costs zero tokens because its mailbox accumulates centrally and the LLM wakes only on gated wake-mode messages, then batch-drains. The parking machinery itself belongs to workflows.
• Resume over respawn (2026-07-01/02). Rework returns to the same session, which is probably still warm in the provider cache — but the ruling is not only about money: the thread history carries why the code was structured as it was, preventing guesswork-rework. Even cache-cold, resume; never fresh-spawn on cache expiry.
• Lookup before fork. Cheap structured search and the agent memory graph are tried before any research spawn; only big-context questions earn an oracle fork.

What this costs

• The economics rest on semi-supported ground. Subscription-OAuth lanes can drift or change terms — the design’s own words: “you find out in CI, not prod at 2am” — and one vendor’s restriction already forced the choice of primary lane. A pricing or ToS change upstream reprices the whole architecture.
• The proof comes from the predecessor platform, not from Supernova. No cached-fraction measurement exists in the Supernova tree, and the requirement gates refuse to pretend otherwise.
• The primitive proved easy to bypass. The fork-only architecture shipped inverted once already. The gates caught it, which is the system working — but it shows the default-spawn discipline needs enforcement, not just intent.
• The provider may not cooperate. If true thread forking isn’t exposed, the fallback (each child re-sends a shared cached prefix) is real but strictly weaker than one warm session branching into N children.
• The heavy lift is still ahead. The owned OAuth transport, streaming, compaction, and retry machinery do not exist yet; the native seam fails closed by design, but a fail-closed stub is still a stub.
• Complexity budget. Warm-pool GC, corpus-generation tracking, hard-reload thresholds, per-provider cache semantics, and a fail-closed evidence-URI grammar are substantial machinery whose payoff depends on fleet scale and on providers keeping prefix caching cheap.
• The 24h patch is a private fork of vendor behavior that must track upstream indefinitely — and the adjacent config path already crashes on the current SDK.