dr➔ver

Two ways the loop breaks, each already solved

An agent is a loop: plan, act, observe, repeat. In production it isn't durable (a crash halfway through a twelve-step job restarts the whole job and pays for it twice) and it isn't bounded (nothing stops a stuck loop from spending forever). drover doesn't reinvent either fix. It runs the loop as a rerun workflow and points every model call at a leash proxy: rerun makes the run survive a crash; leash makes it survive the invoice.

The loop is a durable workflow

for step := 0; step < maxSteps; step++ {
    resp := Do("model-N", callModel) // a completion, through the leash proxy
    if resp.Stopped != "" { break } // leash tripped a budget → stop, cleanly
    if !resp.Acting()    { break } // a final answer → done
    for _, call := range resp.ToolCalls {
        Do("tool-N", invokeTool) // a side effect, journaled once
    }
}

Every nondeterministic input (the model's reply, a tool's result) is captured inside a Do, so a crash resumes at the step that was in flight. drover keeps no state of its own: on recovery the conversation is refolded from the journal. A completed step replays without re-running; a tool caught mid-flight re-runs (at-least-once), so tools must be idempotent.

Owns only orchestration

Three layers, one job

drover orchestrates. rerun makes it durable. leash makes it affordable.