Module 8 · Lesson 8.2 · Headline technical insight

Handoff is a contract.

The most common failure mode of multi-agent systems is not a bad model or a bad prompt — it is an arrow between two agents that was left as an arrow when it needed to be a specification. Arrows do not carry meaning. Contracts carry meaning. This lesson teaches the four-field handoff contract, the rule of one contract per handoff, the schema-vs.-prose decision, the six signs of a vague contract, and the blueprint file structure. By the end you have /capstone/pipeline-v1-draft/blueprint.md with every handoff contract filled in.

Stage 1 of 3

Read & Understand

5 concept blocks

Why the interface matters more than the agent CORE

Imagine you have two agents, each of which does a fine job on its own. The research agent produces a clean, well-cited set of notes when you hand it a topic. The drafter agent produces a clean, readable brief when you hand it a set of notes. Separately, both are good. Connected, their combined pipeline produces a brief that reads like it was written from half the research — citations drop, the angle is off, the draft misses one of the source documents entirely.

A Module 7 student’s instinct is to blame the drafter — “the drafter isn’t picking up on the sources correctly.” A Module 8 student reads the trace and asks a different question: what did the researcher hand to the drafter, and did the drafter know what to do with it?

Almost always, the answer is the same. The researcher produced notes in one shape — a pile of bullet points, some with source URLs, some without, some with two-sentence summaries, some with one-sentence summaries. The drafter was given those notes and told “write a brief.” The drafter did what it was trained to do — it produced a readable brief — but it had no way to know that the one-sentence bullet points were the important ones and the two-sentence ones were peripheral, or that a bullet without a URL was supposed to be flagged and excluded. The drafter guessed, sensibly, and guessed wrong.

Nothing in the drafter’s prompt was wrong. Nothing in the researcher’s prompt was wrong. The thing that was wrong was the interface — the handoff. Neither agent had a shared understanding of what the output of the research step was supposed to look like and what the input to the drafting step was supposed to be.

This is the most common failure mode of multi-agent systems. It is not “the model is bad.” It is not “the prompt is bad.” It is that the student built two agents and then drew an arrow between them and assumed the arrow would carry meaning. Arrows do not carry meaning. Contracts carry meaning. A handoff contract is the written specification of what flows down the arrow, and it is the most important artifact in the pipeline.

The headline claim of this module, in one sentence: the quality of an orchestrated system is set by the quality of its handoff contracts, not by the quality of its agents. A pipeline of three mediocre agents with tight contracts will outperform a pipeline of three brilliant agents with vague ones. This is not a marketing slogan; it is what you will see the moment you start building.

The four-field handoff contract CORE

A handoff contract has four fields. You write them down before you write the agents. The contract is short — rarely more than half a page per handoff — because its purpose is to be readable at a glance by the student, by a future self, and by the agent on either side of the handoff.

1. Input shape. What the receiving agent expects to get. The name of the file (or files) it will read. The format — markdown, JSON, prose, a list. Any required structure (headings, bullets, numbered steps, fields). Any required content (must include citations, must not include speculative claims, must be under a length limit). If the input is a set of files, the contract names how many files, how they are named, and what each one contains.

2. Output shape. What the sending agent promises to produce. Same structural specificity as input shape, but from the sender’s point of view. If the receiver’s input shape and the sender’s output shape do not match, the contract is broken by definition. In practice the two fields often look identical — that is fine, and is the sign the contract is tight.

3. Success criteria. How the receiving agent decides that the handoff is usable. “The file exists at the expected path.” “The file has at least three bulleted items.” “Every claim has a URL in parentheses.” “The summary is between 200 and 400 words.” Success criteria are checks the receiver can perform without reading the sender’s mind — they are objective, and ideally testable.

4. Failure mode. What happens if the handoff fails — if the file is missing, if the structure is wrong, if the success criteria are not met. Failure modes come in a small menu: stop the pipeline and alert the student, retry once with a tighter prompt, fall back to a degraded output, skip this stage and pass empty to the next. Naming the failure mode in advance prevents the retry-runaway problem — an agent that “retries until it works” is an agent that can spend your month’s budget in an afternoon.

All four fields must be present. A contract with three of the four is not a contract; it is a wish. The most common omission is field 4 — students name success criteria but do not say what happens when those criteria are not met. That omission is exactly the opening through which retry runaway enters.

Worked example — research → draft handoff

Handoff: research → draft

  • Input shape (draft agent reads): A single file at /pipeline/<pipeline-name>/<YYYY-MM-DD>/01-research/sources.md. Markdown. Required sections: ## Summary (100–300 words), ## Key sources (a bulleted list; each bullet is [Title](URL) — 1-sentence takeaway), and ## Open questions (a bulleted list; may be empty).
  • Output shape (research agent produces): Same file at the same path, same structure.
  • Success criteria: File exists. ## Summary section is 100–300 words. ## Key sources has ≥ 3 bullets, and every bullet has a URL in parentheses. ## Open questions exists (may be empty).
  • Failure mode: If the file is missing or any success criterion fails, stop the pipeline and write a short failure note to /pipeline/<pipeline-name>/<YYYY-MM-DD>/00-status/research-failed.md naming which criterion failed. Do not retry automatically.

That is half a page. It is enough for the research agent to know what to produce, enough for the draft agent to know what to read, and enough for the student to debug the pipeline in ninety seconds when it breaks. A contract shorter than this is not specific enough; a contract much longer than this is usually trying to do the agent’s job inside the contract, which is a different mistake.

How many contracts, in which pattern CORE

A pipeline has exactly as many contracts as it has handoffs. Count the handoffs, write that many contracts. The count varies by pattern:

Sequential pipeline. N agents, N–1 handoffs. A two-agent pipeline (research → draft) has one contract. A three-agent pipeline (research → draft → review) has two: research → draft, and draft → review. A four-agent pipeline has three. Each contract stands alone; the fact that research → draft exists does not tell the draft → review contract anything.

Parallel workers. Two contracts per fan-out/fan-in unit, regardless of the worker count. The fan-out contract specifies what each worker receives as input and what each worker is expected to produce as output (the workers all share this contract). The fan-in contract specifies how the combiner reads the N worker outputs and what the combined output looks like. A pipeline with three parallel workers has one fan-out contract and one fan-in contract — two contracts total, not four. The combiner is an agent, but its input is governed by the fan-in contract, which already says “reads N outputs produced per the fan-out contract.”

Hierarchical supervisor. One contract per supervisor-worker edge. A supervisor with four worker types (even if it chooses to spawn multiple instances of a worker type) has four contracts — one per worker type. The supervisor itself needs a contract if it is receiving input from an upstream agent or producing output for a downstream one; that is a separate contract.

Counting contracts before you start writing agents is a useful sanity check. A pipeline with too many contracts — six, eight, ten — is almost always a pipeline that wants to be flatter than its author has let it be. A pipeline with too few contracts for its agent count is almost always a pipeline where handoffs have been left as arrows without specification, and the student has not noticed yet.

The contract-counting sanity check

Before you write any agent prompt, count the handoffs and write that many empty contract blocks in the blueprint (just the four field headings, no content). If the count feels wrong — too many, too few, or surprising — revisit the shape in Lesson 8.1 before you fill the contracts in. Contract count is a cheap structural check that catches most orchestration mistakes before they become expensive.

When the contract needs a schema CORE

A handoff contract is always written as prose in the blueprint. The question this block answers is whether the output shape the sender produces should be a structured format the receiver can parse by pattern (JSON, YAML, a table) or a prose format the receiver reads as natural language (markdown with headings, a plain paragraph). Both are legitimate. The wrong choice either adds ceremony that slows the pipeline (schemas where prose would do) or leaves the receiver guessing (prose where a schema would have been clearer).

The three-part test:

1. Is the output consumed by logic or by language? If the next stage is an agent that will read the output and reason about it, prose is usually fine — the agent can parse meaning from text. If the next stage is a script or tool that will act on specific fields (write to a calendar, file an email, populate a template), you need a schema. Every field the script will read needs to be in a machine-parseable format.

2. Is the output’s structure stable enough to write down? If the output has a fixed set of fields that appear every time — title, URL, summary, three-word tag — that is a schema-shaped output. If the output is variable-length, variable-section, variable-emphasis — “however many sources the topic needs, with whatever commentary makes sense for each” — forcing it into a schema is ceremony and will probably lose information.

3. Is the pipeline running often enough to reward the ceremony? A pipeline you will run once a week is not worth a schema you will also have to maintain; prose is fine. A pipeline that runs every day at 6 a.m. and whose output feeds a downstream script benefits from a schema because you will save minutes of debug time every time it runs.

Applied to the research → draft handoff from Content Block 2: consumed by language (the drafter reads, reasons, writes), variable structure (summaries vary in length and emphasis), runs several times a week. Prose with a markdown structure is the right call — which is what the example contract used.

Applied to a scheduled-tasks handoff where the first stage writes calendar events and the second stage populates a calendar via an MCP connector: consumed by logic (a tool will read specific fields), stable structure (every event has start, end, title, attendees), daily. JSON schema is the right call.

The practical consequence: most Module 8 pipelines end up with prose contracts for their language-to-language handoffs and one or two structured-schema contracts where a tool takes over at the end. That asymmetry is normal. It is not a sign the pipeline is inconsistent; it is a sign the pipeline is honest about where language ends and structure begins.

Six signs of a vague contract CORE

A key Module 8 skill is the ability to look at a handoff contract and recognize when it is vague. Here are the signs. Every one of them has bitten a student into a runaway or a silent-failure hour.

  • “The output should be good.” Or “high-quality,” or “well-organized,” or “clear.” These are not success criteria; they are hopes. Replace with testable statements: word counts, required sections, required fields, “every claim has a URL.”
  • “The receiver reads the output and uses it.” Not specified what shape, not specified what happens if the shape is unexpected. Replace with file path, format, structure, and the failure mode on malformed input.
  • “Retry if something goes wrong.” Unbounded retries are the fastest path to token runaway. Specify how many retries, under what conditions, and what triggers “give up and stop.”
  • “The output is a JSON object.” Not specified which keys, which types, which are required vs. optional. A JSON contract that does not name its keys is a prose contract in disguise, with an extra step.
  • “The input is whatever the upstream agent produces.” This is the absence of a contract. If you find yourself writing it, stop and write the actual input shape — you have not thought about the handoff yet.
  • Contract longer than a page. Usually a sign the student is trying to do the agent’s job inside the contract. A contract describes the interface; the agent’s prompt does the work. If the contract is doing work, pull it back out.

When you write contracts for your pipeline, read each one with this list in hand. A contract that passes all six is rare on the first draft and common on the third. The iteration is the point.

Stage 2 of 3

Try & Build

1 recipe + activity

The blueprint file and the contract template RECIPE

Applies to Both the Claude Code CLI path and the Cowork-tab path
Last verified 2026-04-18
Next review 2026-07-18
Companion recipe writing-a-handoff-contract.md

The pipeline blueprint is a single markdown file at /capstone/pipeline-v1-draft/blueprint.md (and, after Lesson 8.4, at /capstone/pipeline-v1/blueprint.md). Its sections, in order:

  1. Goal. One sentence. The same goal you named in Lesson 8.1’s Orchestration Posture.
  2. Shape. Sequential / parallel / hierarchical, with one sentence of justification from the two-question test.
  3. Agents. One sub-section per agent. Each sub-section names the agent, its responsibility in one sentence, the model it runs against (cloud or local, and which family), and the tools it is allowed to use.
  4. Handoffs. One sub-section per handoff. Each uses the four-field contract template.
  5. Shared-state folder. The folder convention the pipeline uses: /pipeline/<pipeline-name>/<YYYY-MM-DD>/<stage>/. Name every stage folder the pipeline will write to.
  6. Budget and kill switch. Placeholders for now; filled in Lesson 8.5. The fields are there in Lesson 8.2 so the structure is complete.
  7. Next review. Placeholder for the ≤ 90-day review date; filled in Lesson 8.5.

The four-field contract template, copy-paste ready:

### Handoff: <upstream agent> → <downstream agent>

- **Input shape (<downstream agent> reads):** <file path; format; required structure; required content>
- **Output shape (<upstream agent> produces):** <file path; format; required structure; required content>
- **Success criteria:** <testable conditions the receiver uses to decide the handoff is usable>
- **Failure mode:** <what happens on failure — stop, retry-once, fall-back, skip — and who gets told>

The template also ships as a printable worksheet at handoff-contract-template → for convenience. Copy it into the blueprint once per handoff, fill it in, revise it as you build.

Try it — Stand up the blueprint and write every contract CORE

three deliverables · pipeline planner → · contract drill →

Part 1 — Create the blueprint draft.

Create the folder /capstone/pipeline-v1-draft/. Inside it, create blueprint.md using the seven-section structure from the RECIPE block above. Fill in:

  • Goal. The one-sentence goal from your Lesson 8.1 Orchestration Posture.
  • Shape. The pattern you named in 8.1 with one sentence of justification.
  • Agents. One sub-section per agent from your Lesson 8.1 sketch. For each: name, one-sentence responsibility, intended model (cloud/local, family), tools the agent is allowed to use.
  • Shared-state folder. /pipeline/<pipeline-name>/<YYYY-MM-DD>/<stage>/. Replace <pipeline-name> with a short kebab-case name for your pipeline and name each stage folder you will write to.
  • Handoffs. Count the handoffs in your shape. Create one empty contract block per handoff using the copy-paste template. Do not fill them in yet.
  • Budget and kill switch. Leave as placeholders with the text “filled in Lesson 8.5.”
  • Next review. Leave as placeholder.

Part 2 — Fill in every handoff contract.

Work through the contract blocks one at a time, in upstream-to-downstream order for a sequential pipeline, or supervisor-first for a hierarchical pipeline. For each:

  • Input shape. Write the file path the receiver reads, the format, the required structure, and any required content. Be specific: “the file is at /pipeline/daily-briefing/<date>/01-research/sources.md; markdown; required sections ## Summary (100–300 words), ## Key sources (≥ 3 bullets, each with a URL in parens), ## Open questions (may be empty).”
  • Output shape. Write the sender’s promise. In most cases this will look nearly identical to the input shape of the next contract — that is a sign the contract is tight.
  • Success criteria. List the testable conditions the receiver will use to decide the handoff is usable. At least three conditions, each testable without reading the sender’s mind.
  • Failure mode. Name one of: stop and alert, retry once with tighter prompt, fall back to degraded output, skip and pass empty. Be explicit about what “alert” means (a file written where, a notification how).

After you finish the last contract, read all of them together in order. Check that:

  • The output shape of contract N matches the input shape of contract N+1 (for sequential). Any mismatch is a silent-corruption risk.
  • No contract is longer than ~half a page.
  • Every contract’s failure mode names a bounded action (no unbounded retries).

Part 3 — Run the Handoff contract drill.

Open the Handoff contract drill →. The drill shows you five vague handoff descriptions — the kind a student would write on the first try — and asks you to rewrite each into a four-field contract. The drill scores each rewrite against a rubric (four fields present, each field is testable, no unbounded retries, no “the output should be good”). Aim for 4 out of 5 on the first pass; iterate on the one you miss until you see what the rubric is checking for.

The drill is not graded, but you should be able to complete four out of five on first attempt after Part 2.

If your contracts feel obvious

A contract that feels obvious is almost always a good contract. The point of the four-field structure is not to surface novel information — it is to force you to write down the obvious things that are otherwise left unsaid. If you write a contract and think “well, this is all stuff the agents would figure out,” you have just named exactly the assumption that most often fails silently in first-draft pipelines. Ship the obvious contract. It is doing work.

Deliverables. Three artifacts: /capstone/pipeline-v1-draft/blueprint.md with the seven sections populated and every handoff contract filled in; every contract readable as half a page or less with all four fields present and no unbounded retries; the HTML Handoff contract drill completed with 4/5 or better.

Done with the hands-on?

When the recipe steps and any activity above are complete, mark this stage to unlock the assessment, reflection, and project checkpoint.

Stage 3 of 3

Check & Reflect

key concepts, quiz, reflection, checkpoint, instructor note

Quick check

Four questions. Tap a question to reveal the answer and the reasoning.

Q1. Which of the following is not a required field of a handoff contract?
  • A Input shape.
  • B Output shape.
  • C Agent’s system prompt.
  • D Failure mode.
Show explanation

Answer: C. The four required fields are input shape, output shape, success criteria, failure mode. The agent’s system prompt is part of the agent’s definition, not part of the handoff contract — it belongs in the blueprint’s Agents section. Mixing the two is a common first-draft mistake and one of the reasons contracts drift past half a page.

Q2. A parallel-worker pipeline has four workers that each take the same input and produce their own output, which is then combined. How many handoff contracts does the blueprint need?
  • A One.
  • B Two.
  • C Four.
  • D Five.
Show explanation

Answer: B. One fan-out contract (which all four workers share) and one fan-in contract (governing how the combiner reads the four outputs). The worker count does not multiply contracts because the workers all read and produce under the same pair of contracts. (C) multiplies by workers, which is a common mistake; (D) adds an extra for the combiner that is already covered by the fan-in contract.

Q3. A student writes a handoff contract whose failure mode says “retry until successful.” What is the primary risk, and what is the correct fix?
  • A Risk: slow pipeline. Fix: parallelize the retries.
  • B Risk: unbounded cost and token runaway. Fix: specify a retry cap (e.g., “retry once with a tighter prompt; on second failure, stop and alert”).
  • C Risk: retry is fine; the fix is to add more agents.
  • D Risk: the pipeline is too shallow. Fix: add a meta-supervisor.
Show explanation

Answer: B. “Retry until successful” is the textbook retry-runaway — a flaky stage plus an unbounded retry loop can easily multiply token usage by ten, and the failure will often be silent because the final output looks plausible. The correct fix is always a bounded retry: name the cap, name what happens when the cap is reached.

Q4. The upstream agent’s contract promises “a markdown summary with sources.” The downstream agent’s contract expects “a structured JSON object with summary and sources fields.” The pipeline runs and the downstream agent’s output is incoherent. What happened, and where do you fix it?
  • A The downstream agent is broken; rewrite its prompt.
  • B The upstream agent is broken; rewrite its prompt.
  • C The two contracts disagree — output shape is markdown, input shape is JSON. Fix the contracts to match (either both markdown with a structure convention, or both JSON with named fields) and re-run.
  • D Add a middleware agent to convert markdown to JSON.
Show explanation

Answer: C. This is the canonical silent-corruption failure. Neither agent is broken; the handoff is. The output shape of one side must match the input shape of the other. (D) is the mistake students often reach for — adding agents instead of tightening the interface — and it buries the problem under more surface area. (A) and (B) will not help because the agents will correctly produce and consume what their own contracts say; the disagreement is between the contracts.

Reflection prompt

What did you assume the two agents would “just figure out”?

Write 4–6 sentences in your journal or my-first-loop.md in response to the following: Pick one handoff in your pipeline. Before you wrote the contract for it, what did you assume the two agents would “just figure out” about the handoff? After writing the contract, what did you have to make explicit? What would have happened if you had not written the contract and had just let the two agents talk to each other through an unspecified arrow?

No length minimum past four sentences; no length maximum. The purpose is to notice how much unspecified context you carry around in your head as the pipeline’s designer — and how that unspecified context is precisely what silently corrupts a pipeline when it runs without you watching.

Project checkpoint

Ship /capstone/pipeline-v1-draft/blueprint.md with every handoff contract filled in.

By the end of this lesson, your blueprint draft contains:

  • Goal, shape, agents, shared-state folder — populated.
  • One filled-in handoff contract per handoff, each with all four fields (input shape, output shape, success criteria, failure mode), each readable as half a page or less, no unbounded retries anywhere.
  • Budget / kill switch / next review — placeholders with the text “filled in Lesson 8.5.”
  • Handoff contract drill — completed at 4/5 or better.

Do not proceed to Lesson 8.3 until every contract in the blueprint passes a read-through against the six vague-contract signals. Lesson 8.3 builds the Claude Code version of your pipeline against these contracts; an unclear contract here becomes an unclear subagent there.

Next in Module 8

Lesson 8.3 — Building the pipeline in Claude Code.

The first of two recipe-heavy lessons. Build your pipeline as Claude Code subagents — .claude/subagents/<name>/SUBAGENT.md with frontmatter and a tight tool allowlist, plus an orchestrator prompt in the parent session that does the five-step bookkeeping. Run a research-sweeper → brief-drafter → brief-reviewer pipeline end-to-end. Capture two full invocation traces. This is the first lesson where the pipeline actually runs.

Continue to Lesson 8.3 →