Girish Konda mapped three-worker subagent failures to distributed-systems failures in a talk credited to AI Engineer. He demoed an orchestrator splitting work across three subagents with shared context. Affected systems include shared memory, MCP servers, databases and pipelines, Konda said. No attacker is required. A half-finished worker returns fluent text that looks like success.
Before MCP tool results carried an isError flag, orchestrators read text as done. Konda proposed SAFE handoff instead. S means source feeds with version and time. A means at-most-once effects. F means fanout budgets. E means explicit outcomes.
Lamport defined happened-before in 1978, and Konda uses it for provenance, Konda said. Weighted voting followed in 1979 with read quorum plus write quorum greater than total votes, Konda said. Three subagents reading one guess do not meet that test. "Treat every handoff to a sub agent as a network call," Konda said.
The FLP paper showed in 1985 that one faulty process can block async agreement, Konda said. The 1995 critique of SQL isolation defined dirty reads, Konda said. Chandra and Toueg answered in 1996 with detectors that suspect but do not know, Konda said. Konda hit both sides in MCP Peacemaker, Konda said. A 30-second initialize timeout flagged slow as dead. A crash hid behind timeout and lost its exit code.
Pi pi-subagents takes a different path with parallel execution and a clarify scout worker fresh reviewers worker loop, per Pi docs. That pattern adds reviewers but still shares context. Konda argued shared guesses counted three times are not a quorum.
SAFE does not make facts true and does not give exactly-once delivery, Konda said. It refuses rather than guesses and needs one orchestrator. Draft-only helpers overseen by a person can skip most of it. No follow-up date was named.
