SysContract: Stop–Check–Act Runtimes for Agents that Control Computer Systems

LLM agents are increasingly given write access to schedulers, database knobs, and serving stacks. A single quality metric does not determine whether the resulting configuration is admissible. We study unconstrained GPT-4o-mini on three control tasks. On a fluid serving model it triples tokens/s while violating the TTFT and KV-cache envelope on every seed. On a cluster packer and on SQLite it often violates invariants without improving the scored metric. Putting the same invariants in the prompt, with no gate, raises SQLite hold rate to 1.0 but still leaves serving hold at 0.40 and does not stop post-plateau thrashing. SysContract admits an action only if a machine-checked envelope holds, rolls back dynamic failures, and stops when further calls are not buying improvement. It is admission control for configuration actions, not a better prompt. On all three tasks it rejects every violating write and cuts GPT token use by 4–4.5×; on SQLite it also improves latency inside the envelope.