Agent Swarm

What it is

It is a small FastAPI service exposing a single `/v1/complete` endpoint with two modes: a fast lane that routes to Kimi and falls back to MiniMax, and a `consult` lane that returns both models' answers side by side. Every request first passes a refusal filter that blocks anything touching trading, positions, capital, or the operator's personal identity, then an atomic fcntl-locked budget reservation that enforces a $10/day cap in microcent precision with reserve/settle/release semantics. A `touch /tmp/agent_swarm_kill` file short-circuits all turns to 503 with no restart, and every turn is appended to a JSONL transcript log. It ships deliberately scoped as the "load-bearing 30%" of a larger swarm spec, deferring auto-routing and debate until measured.

Highlights

• ◆Trading firewall runs a 4-stage normalization stack (NFKD + combining-mark strip, leetspeak fold, letter-gap collapse, compact form) plus Greek/Cyrillic confusable folding and zero-width/bidi stripping before four match passes, closing common prompt-injection bypasses
• ◆Golden-set eval: 62/62 cases pass with 0 leaks across normal, trading, identity, bypass, and false-positive categories; p95 latency 2.06ms in heuristic mode
• ◆Budget guard is atomic under concurrency: fcntl.LOCK_EX with tmp-file + os.replace, tracked in microcents (1e-6 USD) to avoid a cent-floor rounding bug, with reserve-then-settle so failed upstream calls are released not charged
• ◆Instant reversibility by design: file-touch kill switch (503, no restart), systemd stop, idempotent deploy/uninstall scripts, append-only JSONL state safe to delete, and git-revert-clean (no DB migrations)
• ◆22 router tests plus a heuristic mode that returns deterministic stubs so the firewall and budget logic can be evaluated with zero API spend
• ◆Explicit written kill criteria (any firewall leak = immediate shutdown, budget desync, p95 > 2x target, both upstreams >50% error) tie the build to measurable failure conditions