Two 403s and a dead Slack escalation still closed the run as COMPLETED

COMPLETED is a claim about control flow. A 403 comes back as a response, so the HTTP tool hands it back, the model reads it, and the loop continues. The developer put it in one line: "A run status only knows whether an exception escaped." ^[12] Two refusals and one unconfigured integration all came back as answers, he wrote ^[13]. Half the four tool calls failed and the terminal state was the one a clean run gets ^[11][23].

What the agent did with those answers went in two directions at once. The customer draft said "I can see you were charged $29 USD twice on 3 October (Orders #A-4471 and #A-4472)" ^[14]. Both lookups had returned 403, so it was reading Marta's own email back to her in the voice of a system that had checked ^[15]. The note the same run wrote for the human, unprompted, was accurate: "Order lookup: Blocked by system (403); billing team will need to verify internally" ^[17].

The failure was recorded as free text inside an escalation note, while the status field said COMPLETED and the duration said 28.5 seconds ^[10]. The escalation recipient is redacted in the published record; it was the developer's own inbox. That is the only reason the dead Slack integration cost nothing ^[18].

The decision layer did what the prompt told it to. The system prompt routes refunds, angry customers and anything legal to a human ^[25], and the agent escalated without inventing a refund policy or promising money ^[16].

The cost figures are worth doing by hand, because there are two published runs. This one cost 2.0442 cents and ran 28.5 seconds ^[10]. A second run, published in full, cost $0.0144 and ran 8.4 seconds ^[19]. That is about 42 percent more money and about 3.4 times the wall clock ^[21][22]. The developer attributes the gap to the escalation path, more tools and more turns, and warns against quoting a single cost-per-run figure ^[20].

He ran it once ^[1], the ticket was one he wrote himself because he has no users yet ^[2], and the failure demonstration he links is a separate third run ^[19]. Nothing in that gives you a failure rate. For the reporting problem to transfer to your stack, two things have to hold: your tools return statuses instead of raising, and your monitoring reads the run status instead of each tool result. The first is normal HTTP behaviour. The second is the default here, on a platform where the only thing you switch on deliberately is the agent itself, which is inactive until activated ^[5].

The developer published the prompt verbatim and the raw execution record with one redaction ^[24], and wrote that "an agent you cannot read is an agent you cannot argue with" ^[8].