Lion Cipher Lab

Build a subagent harness from scratch — context isolation, per-child tool allowlists and result contracts — then measure what a 50-file security code review costs with and without it

• AI Security
• Advanced
• ~110 min
• Free · no account required

Why it matters

Ask an AI agent to security-review a fifty-file service and something quietly awful happens. It reads file one, file two, file three, and somewhere around file eighteen its CONTEXT WINDOW — the fixed amount of text it can hold at once — is full. Everything after that is truncated away. The agent does not tell you. It does not error. It writes you a confident report about the whole repository having read a third of it, and the report is short because it also got worse at noticing things as its window filled. In the measured run below, a single agent given all fifty files found 3 of the 29…

What you'll learn

• defining SUBAGENT precisely and building one: a parent process that dispatches a child with a CONSTRUCTED BRIEF (not a copy of the parent's transcript), lets the child run in its own private context, and accepts back only a small validated result
• writing a CONTEXT LEDGER that accounts for every token entering every actor's window, tagged by who received it and what kind of thing it was, so the saving you claim is a number you can read off a table rather than an assertion in a design doc
• enforcing a PER-CHILD TOOL ALLOWLIST in the harness — a named tool with named arguments, checked by a broker that RECORDS every denial instead of silently dropping it — and reading the denial log as a design signal rather than as noise
• declaring a RESULT CONTRACT (a schema the child's return value must satisfy) and implementing the three-tier response to a violation: repair what is unambiguous, re-ask once with the contract repeated, reject loudly after that — then measuring the malformed-result rate before and after
• measuring PEAK CONTEXT against TOTAL TOKENS and understanding that they move in opposite directions: delegation on this workload cut the parent's peak window 7.3x while spending 1.62x more tokens overall, and both facts belong in the same sentence
• computing recall and precision against a seeded repository with KNOWN planted defects, so a review strategy can be graded instead of admired
• finding the CROSSOVER with data — the file count below which the harness is pure overhead and the single agent is strictly better — instead of assuming delegation always wins
• seeing exactly what ISOLATION COSTS: a class of cross-file vulnerability that no single-file child can see, the partial fix (a parser-built shared index plus a targeted second pass), and the flow that partial fix still cannot reach
• the judgment to say when NOT to delegate, and to distinguish a subagent from the two cheaper things people confuse it with — summarising, and chunking one agent's input

Steps in this lab

1. The words first: subagent, context window, token, isolation, allowlist, result contract
2. Open a terminal and make a scratch folder (all three operating systems)
3. Generate the review target: 50 files with defects whose locations you already know
4. The context ledger: double-entry bookkeeping for tokens
5. The reviewer is a DETERMINISTIC STUB — read this before you paste it
6. The scorer: recall, precision and F1 against the planted truth
7. The baseline: one agent, one window, fifty files — and it finds 3 of 29
8. Build the harness: a constructed brief, an enforced allowlist, a declared contract
9. Run the delegated review: 7.3x less peak context, 1.62x more tokens, and say both
10. What LEAKS if you get isolation wrong — four returns, one job, measured
11. Find the crossover: below ten files your harness is pure overhead
12. The findings isolation destroys — and a partial fix that stays partial
13. When NOT to use a subagent — and why this, not that
14. The way a pro does it
15. OPTIONAL appendix: swap the stub for a real local model

Open the full interactive lab →