Context Engineering for AI Agents: Audit the Manus Context Loop

The practical answer to “Context Engineering for AI Agents: Lessons from Building Manus” is not to copy six prompt tricks. Turn each lesson into an invariant you can inspect during a run. A stable prompt prefix should have a version and hash. A tool mentioned in history should still have a resolvable schema. Compacted material should have a restorable reference. The current objective should have a revision and freshness limit. Failed actions should leave redacted evidence. Repeated actions should be compared with output change. A terminal report should still require an outcome receipt. That gives you a context health contract. It can tell the difference between an efficient run, a recoverable run, a run making useful progress, and a run that is actually safe to call complete. Cache hits and lower token counts help, but neither proves the agent kept the evidence required to finish correctly. Read the Manus lessons as claims with boundaries The original Manus engineering post describes local design choices reached while building its agent framework. Its author reports an average input to output token ratio of roughly 100:1 for Manus and argues that prefix cache behavior therefore matters greatly to latency and cost. The post recommends: keeping the prompt prefix stable and serialization deterministic; masking actions instead of removing tool definitions mid run; externalizing large context to restorable files; rewriting a task list so the objective returns to recent attention; retaining failed actions and observations so the model can adapt; introducing controlled variation to resist repetitive behavioral patterns. Those are useful engineering hypotheses, not universal thresholds. Provider caches differ. Some runtimes can version historical tool schemas safely. A URL may be preserved but later become inaccessible. Raw stack traces may contain secrets. “Repeat the objective every eight steps” is a test value, not a general law. Independent evidence also argues against treating advertised context capacity as a health guarantee. Anthropic’s context engineering guidance frames context as the full inference state—system instructions, tools, external data, and message history—and recommends keeping the smallest high signal set that supports the desired behavior. It also describes just in time retrieval, progressive disclosure, compaction, structured notes, and multi agent separation as different strategies with different costs. Chroma’s controlled Context Rot evaluation tested 18 models while varying input length and reported non uniform degradation. Distractors, semantic distance, and haystack structure changed performance. The operational implication is modest but important: “inside the context limit” is not a verdict. You still need evidence that the current context supports the current decision. Build one receipt for six context mutations Capture hashes and counters, not raw prompts. A useful receipt can be attached to each decision point: The fields answer separate questions. Prefix stability is an efficiency check. Record the stable template version and a content hash over the cacheable prefix. Exclude volatile values such as a per request timestamp from that prefix where the runtime permits it. A hash change is not automatically a task failure: if useful output is still moving, classify the run as degraded and investigate the churn. Tool schema continuity is a decision integrity check. Keep a versioned schema registry or an explicit translation from historical tool calls to their defining contract. If a prior action says browser fetch but the current context no longer defines that action—or a compatible version—the model may be reasoning from an incomplete record. That should block a healthy verdict. Restorable external context is a recovery check. A file path, object key, query, or URL is only a reference. Pair it with an integrity digest when possible, a last reachability check, scope, and the operation that restores it. Dropping a document from the live window while preserving a verified reference is reversible compression. Dropping it with no usable reference is evidence loss. Objective freshness is an attention check. A task plan revision should identify the active goal, accepted constraints, completed milestones, and next decision. Measure its age in steps or time. Do not endlessly append duplicate plans; refresh one compact receipt when the work meaningfully changes or its freshness limit expires. Failure retention is a learning and audit check. Count failed actions and preserved failure records. Store the error class, tool, attempt identity, retry decision, and a redacted digest—not arbitrary raw output. If two failures occurred but only one safe record remains, a later retry cannot be justified from complete evidence. Repetition versus progress is a drift check. A repeated action is not a loop by itself: pagination, polling, and bounded retries can be legitimate. Combine an action signature with an output delta counter, objective freshness, dependency state, and retry budget. Three repeated actions with changed artifacts can be working; three with no state delta deserve a loop risk verdict. The stable prefix and controlled variation lessons are not contradictory. Keep the cacheable prefix and tool contracts deterministic. Apply necessary variation after that prefix—in examples, action observations, or a bounded selection policy—and measure whether it changes useful progress. Apply a precedence rule instead of averaging signals Do not collapse these fields into one opaque score. A cheap, stable prefix run with unrecoverable context is not “mostly healthy.” Use precedence: 1. unsafe — historical tool references are unresolved, compacted evidence is not restorable, or a failure record disappeared; 2. loop risk — the objective is stale and actions repeat without output change; 3. unverified — the agent reports terminal completion without a valid outcome receipt; 4. healthy — every context invariant passes and the task specific outcome is verified; 5. degraded — context integrity remains intact, but prefix churn or another efficiency fault is present; 6. working — invariants pass, useful output changes, and the run is not terminal. This ordering deliberately makes integrity failures stronger than efficiency gains. The accompanying fixture changes one condition at a time: Expected result: The eight cases include a verified outcome, useful intermediate progress, prefix churn, tool schema drift, irreversible compaction, erased failure evidence, stale goal repetition, and reported completion without a receipt. One result is intentionally inconvenient: the cache churn case is degraded , not unsafe. Its prefix changed, but schemas, references, failures, and useful progress remain intact. By contrast, irreversible compaction is unsafe even though its prefix is stable. That is the difference between a cost problem and an evidence problem. Verify the receipt without collecting the conversation The receipt should reveal whether evidence exists without uploading the evidence itself. For the prefix, retain a template identifier and digest. For tools, retain schema version, action name, and compatibility result. For external context, retain a scoped reference, digest, byte count, reachability result, and freshness time. For failures, retain a redacted class and attempt identifier. For progress, retain hashes or counters for expected artifacts. Keep prompts, responses, credentials, raw tool payloads, and absolute host paths out of shared telemetry unless a separate, explicit data contract requires them. Use three tests before adopting the contract. First, run a single mutation replay . Start from a known good fixture and change only one field. The verdict should move for the reason you expect. If removing a restorable reference leaves the state healthy, the rule is too weak. Second, run a redaction canary . Put a synthetic secret into a failure payload, process it through the receipt builder, and assert that the secret is absent while the error class and retry decision survive. Retaining the “wrong stuff” does not authorize retaining sensitive content. Third, run an outcome counterexample . Feed the classifier a terminal agent message while withholding the actual deliverable receipt. It must return unverified . Then add the task specific check—a file digest, passing test, destination API read, or human approval—and confirm that only this change permits healthy . The outcome check is necessarily workflow specific. A research task might require cited source coverage and a saved report. A deployment task might require a live health response and version parity. An email task might require reading the destination mailbox. There is no context only proof that an arbitrary goal was achieved. Use the contract as a boundary, not a product claim The Manus post is valuable because it exposes real design tensions: cache efficiency versus mutable context, smaller windows versus irreversible loss, stable behavior versus repetition, and error cleanup versus learning evidence. The operational move is to make those tensions inspectable. Adopt the contract when you can answer these questions for one real run: Did the cacheable prefix change, and was that expected? Can every historical tool action still be interpreted? Can every omitted observation be restored and integrity checked? Is the current objective fresh enough for the next decision? Did every failed action leave safe evidence? Are repeated actions changing the task state? What separate receipt proves the requested outcome? If any integrity answer is unknown, preserve unknown or unsafe ; do not manufacture green. If only efficiency is degraded while evidence and progress remain sound, keep the run working and fix the cost issue separately. Sidewisp is currently in private preview. Its public experience is an early access website and interactive demonstration; production agent health collection and context monitoring are not generally shipped. The intended product direction is to turn evidence like freshness, context continuity, useful progress, and verified outcomes into a clear health view while keeping uncertainty and approval boundaries visible.