A twenty-chapter engineering monograph argues that most coding-agent failures start outside the model — in measurement, grading, recovery, retrieval, review, and scheduling — and supplies 193 vetted practices, six system contracts, and a six-step audit to find the weakest layer in your own agent system.
An agent finishes a change. The tests pass. A reviewer approves a compact diff. The run looks successful. The record still cannot answer three questions. Would a second run produce the same result? Did the tests exercise the behavior that mattered? Did the reviewer see the decisions that carried the most risk?
Jarmak's monograph starts from this gap. Teams evaluate coding agents as models — one benchmark score. Teams deploy them as systems: a harness (the runtime that mediates tools, observations, and actions), execution state, retrieval, memory, permissions, review interfaces, and compute budgets. The central claim: many apparent model failures originate elsewhere in that system, and an improvement at one layer often does not improve end-to-end outcomes. The assumed setting is a large organizational codebase — many repositories, several toolchains, builds too slow to run in full, and review capacity that was scarce before agents multiplied the candidate changes.
The book organizes the whole field as six layers. Each layer decides what the next layer may trust. Measurement decides whether a difference between two configurations is credible. Grading turns observations into accept/reject verdicts. Containment and recovery decide whether the execution record survives a failure. Retrieval and context decide which evidence reaches the model. Human review decides who can challenge a result. Allocation and cost decide which configuration receives future work — and that decision feeds back into measurement.
The chain produces what Jarmak calls a repair asymmetry: it is cheap to add machinery downstream, and expensive to fix an instrument upstream — yet the new machinery is evaluated through the broken instrument. More samples cannot repair a task set that excludes production work. More LLM judges cannot repair a rubric that human experts apply inconsistently. More agents cannot repair a retrieval layer that treats an empty search result as proof of absence. More observability cannot repair an external effect whose identity was never recorded.
The most concrete contribution treats an agent fleet as a distributed system — a "software factory" — and states the contracts it must enforce. Work has a durable identity, and a retry is a new attempt under the same work item, never a duplicate item. Write authority is scoped to an ownership epoch: when work is reassigned, the boundary rejects writes from the superseded worker even if that worker is still running. (This is fencing — the same mechanism Google's Chubby lock service uses via lock generations.)
The remaining contracts cover what fencing cannot. External effects must be safe under redelivery — through an idempotency key (a key that lets the receiver detect and discard a repeated request), natural convergence, or an explicit "unknown external state" — because the interval between an external commit and its durable acknowledgement cannot be closed. Evidence is version-bound: a test verdict is valid only for the exact artifact version it observed. And a worker's claim that it finished is only a scheduling signal; work completes when the system independently verifies the workspace.
None of these contracts mention model quality. A factory that enforces them with a weak model reliably reports mediocre candidates. A factory that violates them with an excellent model loses, duplicates, or misreports excellent candidates.
This is a synthesis, not one experiment: 164 scholarly works, 100 practitioner records, 29 benchmark records, and 17 case records from the author's own operated systems, graded into strong, directional, corroborating, and null evidence. Some numbers show the scale. In one cited study, a model submitted work in 100% of its trials but resolved only 44% of tasks under an external oracle (an independent checker) — agent self-reports and reality diverge that far. In another, the best automated failure-attribution method located the decisive error step in only 14.2% of expert-labeled multi-agent failures. A third found that simple model retries matched elaborate agent architectures on a coding benchmark at a fraction of the cost. And the incident behind the containment chapters: an agent deleted a production database and then its backups, because one credential reached both — the recovery path sat inside the failure domain, and a warning in the prompt removes no capability.
The caveats are unusually explicit. The evidence is uneven where it matters most: 56% of Part I's evidence items (statistics) are strong-graded, against 10% in Part III (containment and recovery); the isolation chapter contains no strong-graded item at all. Across a 52-practice subset, the correlation between a practice's operational urgency and the presence of strong evidence is −0.004 — effectively zero. Jarmak's response is a five-part test for adopting a control on mechanism grounds before prevalence data exists. Also disclosed: three publisher searches (ACM, IEEE, Scopus) were not executed, and a single author performed the final evidence grading, with a blinded packet published for external re-grading. Treat individual claims accordingly.
The book ships a six-step "minimum pass" for an existing agent system: rerun one score-based decision as a paired comparison (both configurations run on the same task set), three runs per item, against the cheapest credible baseline; record success, cost, and configuration separately; exercise one permitted and one prohibited action with the agent's real identity; independently verify one recent completion claim; read twenty failed runs and label the first upstream failure; and fix the success floor and cost ceiling before the next promotion decision — the decision to adopt a change — not after the result is known.
The author states concrete starting defaults: three paired runs per item for screening; report both pass@k (at least one of k runs succeeds) and pass-all-k (all k runs succeed); treat grader agreement (kappa) below 0.60 as a broken rubric; require a three-percentage-point success gain or a ten-percent cost reduction before promoting a change; restart an agent, or compact its context (summarize it to reclaim space), at 60% of the context length where its weakest task degrades; and reject any code index that cannot name the repository revision it was built from.
And when budgets shrink, remove the added machinery first and keep a small core last. Four controls stay to the end: an executable acceptance check, separation between ordinary and recovery authority, versioned identity for task, state, attempt, and artifact, and a paired comparison against the cheapest baseline. Each control added back beyond those four must show a measured effect on outcomes. The practice catalog (206 records with stable IDs), runnable protocols, and five packaged agent skills are in the companion repository.