[ Archive ]
Practical notes from current work and experiments across architecture, inference systems, and infrastructure.
12/01/2027
A practical method for evaluating AI agents — completion decided from audit events instead of the model's own account, typed blockers as honest outcomes, repair budgets that ignore rewritten prose, and paired benchmarks on frozen inputs.
05/01/2027
What it takes to run one agent across hosted and self-hosted models — a common wire format, per-model capability records, refusal instead of silent fallback, confidentiality that follows content, and domain rules that live in typed code rather than prompts.
29/12/2026
How to put real-time values into AI-written text safely — an explicit closed token instead of guessing, a component the sanitiser can't break, one shared subscription per conversation, and a display that always says whether a number is live.
22/12/2026
An argument for agent-generated UI built on a closed, typed spec — data by reference, no styling or handlers in props, invalid specs returned as repairable results, sources that must be real, and a tightly fenced HTML escape hatch.
15/12/2026
Sizing worker pools when there's no next node — ready capacity versus process count, cgroup-aware limits, warm drains, a parent/child deadlock that's easy to build, and an admission bug that double-counts memory.
08/12/2026
How I'd structure tool exposure for an agent with a very large catalogue — permission filtering before anything else, stable route profiles, on-demand loading as an escape hatch, a guard on every call, and why loading fewer tools can cost more.
01/12/2026
Compaction in a long-running agent conversation is a trade between availability and completeness. Notes on triggers, summariser choice, what a summary may contain, and why a lossless log plus search makes a lossy summary acceptable.
24/11/2026
When delegating to child agents is worth it, why a child shouldn't see the parent's transcript, how to accept its results, and why I'd fence children with a parent-only denylist and per-call permission checks rather than a tiny allowlist.
17/11/2026
A browser plane for agents that read logged-in sites — one container per session, an egress proxy with a narrow job, control fenced by a version number, human-only passwords, and a recovery rule that replays only reads.
10/11/2026
Caches, queues, streams, leases, and wake-up hints have opposite failure contracts. Separate instances by eviction policy, refuse stale writes in Lua, fence stream consumers, and keep SQL as the source of truth.
03/11/2026
A runtime fallback chain from microVMs to gVisor, the container flags that matter, memory-first admission, a network design with no exceptions, and the bugs hiding in workspace snapshots.
27/10/2026
Run ownership, fenced leases, application-owned retries, and one rule above the rest — an uncertain outcome should become a visible receipt, never a silent retry.
27/10/2026
An agent's prompt should be built fresh from a durable log on every call — through per-tool projections with hard caps, a budgeted snapshot of the world, and a stable prefix that dynamic context never touches.
27/10/2026
An approval that travels back through the model is a suggestion, not an authorisation. How I'd design agent approvals — server-side resolution, compare-and-swap answers, no default on silence, version-bound approvals, and write-backs with idempotency keys.
27/10/2026
Why an innocent-looking sort can halve your cache hits, where dynamic context should go instead, how to measure prefix stability per call, and why "missing" usage data must never count as zero.
27/10/2026
RQ promises very little, which is exactly why it works for long agent runs. Put intent in the database, reconcile instead of retrying, keep child work from starving parents, and be honest that cron isn't exactly-once.