Platform team running agents for others — ADOPT

A small team that operates agent infrastructure their colleagues depend on. They pay the token bill, they get paged when it breaks, and they are the ones who have to explain an incident afterwards. One engineer-week of integration is a normal cost of doing business for them. They are the natural buyer for a management layer, because the thing they are missing is not intelligence, it is control and evidence.

• Next best option overall — an OpenAI-compatible proxy in front of a self-hosted vLLM/SGLang endpoint, plus an LLM tracing product, plus whatever policy the agent framework ships
• Tolerance — 40 engineer-hours of unfamiliarity before this buyer walks away. Every cell’s load is measured against it.
• Switch bar — +0.50: the w_eff one axis must clear before switching is rational.
• Verdict — ADOPT. observability clears the switch bar (+0.50)

facet	weight	w_eff	verdict	β	load	vs
Observability	0.15	+1.01	RELATIVISTIC	+0.67	-0.20	OpenTelemetry GenAI tracing (LangSmith, Langfuse, OTel)
Run integrity	0.10	+1.00	CRUISE	+1.00	+0.40	an agent loop that trusts its own completion report
Injection control	0.15	+0.87	CRUISE	+0.00	-0.70	formal-isolation defenses (CaMeL, MELON)
Session longevity	0.12	+0.69	CRUISE	+0.76	+0.30	no context management – run until the window fills
Token economy	0.18	+0.66	CRUISE	+0.75	+0.30	tuned warm per-agent KV cache
Raw speed	0.10	-0.56	DRAG	-0.25	+0.30	a raw SGLang endpoint, unmediated
Steady-state ops	0.10	-0.86	DRAG	-0.50	+0.30	a raw SGLang endpoint, unmediated
Portability	0.10	?	NEVER MEASURED	–	–	–

Observability — +1.01 (RELATIVISTIC)

After the fact, from one artifact, can you reconstruct why it did what it did?

• fak 0.8 — OBSERVED, the session journal records the consequential decision classes – model traffic, cache reuse, compaction fires, tool-policy verdicts, recovery – with every DENY stamped with a consequence class, reconstructable post-hoc with no live attach. Scored 4 of 5, not 5 of 5: all five classes are RECORDED, but not in one artifact – the session journal, docs/nightrun/cache-savings.jsonl, and the /metrics split are separate surfaces, so a full reconstruction means joining across them. Everything is captured; single-artifact reconstruction is not.
• next best 0.4 — OpenTelemetry GenAI tracing (LangSmith, Langfuse, OTel), OpenTelemetry GenAI semantic conventions instrument the model call and partially the cache; there is no span for a compaction event, a tool-policy verdict, or a recovery decision, because those are a wrapper’s decisions and there is no wrapper. 2 of the 5 classes = 0.4
• ceiling 1 (definitional)
• β +0.667 → w +0.805
• adoption 12 h fak vs 20 h alternative, of 40 h → load -0.20 → τ -0.203
• w_net +1.007 → capped at RELATIVISTIC (OBSERVED evidence) → w_eff +1.007
• cost basis fak: the journal is on by default once fak serve is configured; the cost is the same serve setup; alternative: deploying and retaining a tracing stack across a fleet, plus instrumenting the agent side
• Read The strongest cell for this buyer, and the one where the category comparison is genuinely lopsided: the alternative is not worse at the same job, it does not do three fifths of the job at all.
• Fence This is a capability decomposition, not a benchmark – neither side was scored by running a fixed set of post-hoc questions against both artifacts. Capped at RELATIVISTIC by the OBSERVED provenance rule. A finer decomposition than five classes would likely pull fak below 0.8 as well.

Run integrity — +1.00 (CRUISE)

When you are not watching, does the run end in a state you can trust and resume?

• fak 1 — MODELED, tools/loopgate verified-vs-naive-loop.report.json: the governed arm cuts false-done from 0.50 to 0.00, with one-holder leases and runaway/injection caps
• next best 0.5 — an agent loop that trusts its own completion report, the ungoverned arm of the same report: false-done 0.50
• ceiling 1 (definitional)
• β +1.000 → w +3.800
• adoption 16 h fak vs 0 h alternative, of 40 h → load +0.40 → τ +0.424
• w_net +3.377 → capped at CRUISE (MODELED evidence) → w_eff +0.999
• cost basis POLICY.md 1,726 w + docs/governed-agent-quickstart.md 1,361 w, plus wiring leases into an existing worker pool
• Fence The 0.50 baseline is an AUTHORED corpus, not a field measurement. Capped at CRUISE by the MODELED provenance rule.

Injection control — +0.87 (CRUISE)

Can hostile text inside the data the agent reads make it act for the attacker?

• fak 0 — MEASURED, BENCHMARK-AUTHORITY.md AgentDojo row: full-stack attack success 0/38 = 0.000, against 29/38 = 0.763 for the detection-only configuration
• next best 0 — formal-isolation defenses (CaMeL, MELON), published AgentDojo defenses: CaMeL ASR 0, MELON 0.0-2.4% – the tier already sits at the definitional floor
• ceiling 0 (definitional)
• β +0.000 → w +0.000 · mode parity_at_ceiling
• adoption 12 h fak vs 40 h alternative, of 40 h → load -0.70 → τ -0.867
• w_net +0.867
• cost basis fak: POLICY.md 1,726 w plus wiring the existing agent behind fak manage – no change to the agent’s data flow; alternative: a formal-isolation defense requires restructuring the agent so untrusted data cannot reach the control path; one engineer-week is a conservative floor for an existing production agent
• Read The sharpest and least intuitive cell on the board. fak does NOT beat the state of the art on attack success – it TIES it, at the definitional floor, so beta is 0 and the axis itself offers no reason to switch. The entire positive score here comes from the differential adoption cost: same result, one third the integration work, because fak is a wrapper and the alternative is a rewrite. That is a real reason to buy, and it is not a security claim.
• Fence Benign and under-attack UTILITY on the same suite is NEEDS_KEY – unmeasured. A system that refuses everything also scores ASR 0. Until utility is measured, 0/38 bounds the harm but does not establish that the agent still does its job.

Session longevity — +0.69 (CRUISE)

How long can one session keep going before context forces you to start over?

• fak 0.24 — OBSERVED, docs/nightrun/cache-savings.jsonl field compaction_budget=48000 – the resident context fak holds a session to – against a 200,000-token window = 0.24
• next best 1 — no context management – run until the window fills, definitional: a client that manages no context holds the whole history, so it needs the entire window and then stops
• ceiling 0 (definitional)
• β +0.760 → w +0.996
• adoption 12 h fak vs 0 h alternative, of 40 h → load +0.30 → τ +0.310
• w_net +0.687 → capped at RELATIVISTIC (OBSERVED evidence) → w_eff +0.687
• cost basis compaction is on by default once fak manage is running; no additional configuration beyond the serve setup
• Read The alternative here is a floor, not a peer: it is where a self-built harness sits until someone implements summarization. A team that rolls its own summarizer lands somewhere between the two poles, and nobody has measured where.
• Fence This scores the resident-context BUDGET, which is what fak enforces, not delivered task quality across a compaction boundary. Compaction that holds 24% of the window while losing the thread is not a win, and no committed artifact measures work-preserved across a fire.

Token economy — +0.66 (CRUISE)

For the same delivered work, how much of the input-token bill does it remove?

• fak 0.983 — MEASURED, BENCHMARK-AUTHORITY.md headline row, headline-qwen-50x5.json (50 turns x 5 agents, Qwen2.5-1.5B Q8_0): fak does 1 unit of prefill work where naive re-prefill does 60.3, so it eliminates 1 - 1/60.3 = 0.983 of the input-token cost
• next best 0.932 — tuned warm per-agent KV cache, the tuned arm of the same artifact does 4.1 units where naive does 60.3, eliminating 1 - 4.1/60.3 = 0.932
• ceiling 1 (definitional)
• β +0.750 → w +0.973
• adoption 12 h fak vs 0 h alternative, of 40 h → load +0.30 → τ +0.310
• w_net +0.663
• cost basis docs/serve-config.md 3,286 w + AGENTS.md 10,166 w – the read to a configured fak serve fronting an existing endpoint; the alternative is a warm per-agent cache the team already runs, so alt_hours = 0
• Read The honest framing of the headline number. Against a competent warm-cache setup fak closes 75% of the remaining gap to paying for each distinct token exactly once – a real win, and a much smaller one than the 60.3x figure suggests, because 60.3x is measured against a strawman nobody deploys.
• Fence Measured on Qwen2.5-1.5B Q8_0, 50 turns x 5 agents, single host. Cross-agent radix prefix reuse is scale-free in principle, but this ratio is not measured at frontier scale or against a production-tuned multi-tenant cache.

Raw speed — -0.56 (DRAG)

How fast do tokens actually come out, against the hardware’s physical limit?

• fak 0.75 — MEASURED, BENCHMARK-AUTHORITY.md gateway row, experiments/qwen36/gpu-server-r4-20260622/compare.json: fak-gateway 1085.6 tok/s vs raw-SGLang 1451.6 at C=64 = 0.75x
• next best 1 — a raw SGLang endpoint, unmediated, the raw-SGLang arm of the same comparison, normalized to 1.0
• ceiling 1 (physical)
• β -0.250 → w -0.255 · mode pure_tax
• adoption 12 h fak vs 0 h alternative, of 40 h → load +0.30 → τ +0.310
• w_net -0.565
• cost basis same fak serve configuration as the token-economy cell
• Read pure_tax is the correct shape: when fak fronts SGLang, SGLang IS the ceiling for that deployment, so mediation can only take a cut. Reported at the WORST measured point (peak throughput, C=64). The same row records the tax converging to ~3% at saturation (C=128, 0.97x), so a team running hot pays far less than this cell says – the conservative number is used because a buyer should plan against the worst measured point, not the best.

Steady-state ops — -0.86 (DRAG)

After you have adopted it, what does it cost every month to keep it running?

• fak 12 — MODELED, authored estimate from the measured adoption surface, 2026-08-10: 100 top-level fak verbs and 34 root operating documents, layered on the proxy and endpoint this team already runs – the layer’s own upgrades, config drift, and failure modes are additive, not substitutive
• next best 8 — a raw SGLang endpoint, unmediated, authored estimate: keeping a proxy plus a self-hosted serving endpoint healthy is already a real recurring bill
• ceiling 0 (definitional)
• β -0.500 → w -0.549
• adoption 12 h fak vs 0 h alternative, of 40 h → load +0.30 → τ +0.310
• w_net -0.859 → capped at CRUISE (MODELED evidence) → w_eff -0.859
• cost basis same serve configuration as the other cells in this segment
• Read Half again on top of an existing operational bill. Materially better than the solo-developer case, because a team already carrying infrastructure absorbs a proportionally smaller increment – the same absolute burden lands very differently depending on what you were already carrying.
• Fence Both endpoints are authored estimates grounded in the measured surface, not timing studies. The ratio is the claim.

Portability — never measured (weight 0.10)

this buyer’s portability question is provider and agent lock-in, not the model x backend grid; the committed support matrix answers a different question and there is no comparison against what a plain proxy locks in.

Next: score both against the same swap list (provider, model, agent, host) with a CI witness per swap point