Blog
How agent platforms and the systems around them work, written while building them.
2026
A browser for agents needs more than one score
A Rust browser engine built for agents, compared with Chrome across 1,024 sites, and why text, links, pixels and scripts each need their own result.
Agent systemsEvaluationPlatforms
A browser that writes down the form instead of sending it
An agent-first browser engine runs a click the way page code expects, then records a form submission and stops, leaving network access, protocol transport, threads and session state with the application that embeds it.
BrowsersAgent systemsRuntimeArchitecture
A catalogue import is not finished when the upload ends
A large book import passes through a source fixture, uploaded objects, an activated generation and a reader's filtered view, and each has its own count. Why a check has to name which count it means, and how to verify one without uploading again.
DataImportsVerificationFerrite
A deadline has to live outside the code it limits
A handler that never yields defeats timers inside the isolate, so the deadline for agent-generated JavaScript has to be a process kill from outside it.
Agent systemsPlatformsSecurity
A desktop can look correct and still lose your work
A Firefox Undo that could take a whole note sat beside 5,550 passing screenshot comparisons. What pixel checks, behavioural journeys, store readback and honest reports each catch in a React rebuild of macOS Catalina.
VerificationBrowsersReact
A failed save should leave the person’s work where they can recover it
What a form owes you when the server refuses your text: where the only copy lives while a request is in flight, how a task board and a shared document editor were repaired, and how to test a refusal without hiding it.
EditingFormsConflictsVerificationBrowsers
A faster check has to fail the same way
Two optimization campaigns and a queue change on agent tooling, where golden outputs, differential checks and A/B gates test whether a speedup keeps its behaviour.
Agent systemsPerformanceVerification
A live region is not a long request
A team-chat page on a runtime with buffered replies: what Suspense still means, why subscriptions need their own authentication and authorization checks, and how polling cost follows the whole log.
Web frameworksRustStreamingConstrained runtimes
A prompt that holds still while the files change
How provider-specific reasoning replay and a frozen working set of files keep a prompt prefix cacheable while the agent is still told what changed.
Agent systemsPerformance
A running app still needs to publish a usable page
Why a passing health check says nothing about the page: how the Macalicious desktop publishes its frontend into a blob at boot, why startup writes need their own budget, and what asset-before-index ordering still doesn't guarantee.
DeploymentVerificationReliabilityMacaliciousFerrite
A video call is more than connecting two media streams
Why an old tab’s hang-up must not end the call that replaced it: numbered seats, idempotent joins, a per-person claim and whole-description signalling in a browser WebRTC demo with no TURN relay.
WebrtcBrowsersConcurrencyArchitecture
Admitting one turn from an at-least-once queue
Why a mention needs redelivery to survive a crash, and how keeping the dedup marker in the commit that admits the turn stops a teammate answering twice.
Agent systemsPlatformsOpen source
Agent memory that remembers the current answer
Building a multi-tenant memory service where identity bounds access, later facts supersede earlier ones, and tests grade the final answer rather than retrieval.
SelectedMemoryEvaluationSecurity
Making an agent’s memory useful without slowing its next reply
Capture, evidence, retrieval, projection and delivery can each fail alone. A small replay found a fact lost before search could see it, and 92 live calls carried no receipt that any memory had arrived.
SelectedAgent systemsMemoryRetrievalPerformance
Authentication is only the first part of deciding who may use an app
What an application still has to decide after Google or GitHub has verified someone: who is admitted, how fast a removal takes effect, what an invite may do, and what happens when an app changes hands.
SecurityVerification
Compacting agent conversations without losing the source
How a compaction ledger keeps instructions verbatim, ties each fact to the journal entries behind it, and recovers original evidence within a fixed scope.
Agent systemsMemoryVerification
Comparing an agent’s context without copying the expected answer
What it takes to show a port builds the same model request: rebuilding each part from independently captured inputs, labelling copied parts as supplied, and reading zero differences beside zero complete requests.
SelectedAgent systemsPortingContextVerification
What a component compiler owns when the server can’t run JavaScript
Compiling JSX-shaped templates to plain Rust, and dividing scoping, type checks, escaping and navigation among the compiler, rustc and the runtime.
PlatformsInterfacesSecurity
Copying code on purpose when applications can’t share a crate
When an application may link only one crate, shared code has to be copied. A canonical source tree, declared mounts, file hashes and a drift check keep the deployed copies aligned.
PlatformsVerificationSecurityPerformance
Correcting the grader without rewriting the run
A coding-agent evaluation whose first grader was wrong in both directions, and how original records, corrected verdicts and repairs stayed separate results.
SelectedEvaluationPlatformsVerification
Counting input tokens when the answering provider can change
Why one usage field means different things across model providers, and how to normalize token counts without hiding missing or contradictory data.
Agent systemsPlatformsInterfaces
Counting the ways an internal note can reach a customer
A helpdesk enforces note privacy through one caller-specific projection across counts, previews, search and exports, and narrows what customer-bound drafts can use.
SecurityInterfaces
The decisions a restart shouldn’t get to make twice
Which coordination decisions an agent runtime must persist before acting, which it can re-derive, and how recovery separates unstarted work from uncertain effects.
Agent systemsPlatforms
Delivering background job results to the turn that owns them
Binding background jobs to their owning turn and sandbox so that completions survive restarts, arrive at least once and report a result someone can vouch for.
Agent systemsPlatformsVerification
Did your agent experiment test what you think it tested?
Wrong models, arms that never switched on, shifting workloads and features that ran without helping: checks that show an agent comparison contains the change.
SelectedAgent systemsEvaluationVerification
Evidence should belong to the run that used it
How per-run source rows, revision checks and publication-time binding keep a research report tied to the evidence it used, and what that doesn't prove.
Agent systemsMemoryVerification
Finding the resource that actually stopped the build
A build died at the link step with most of its memory unused. A controlled comparison found the limit it had really hit, and the autoscaling work that followed needed proof of its own.
InfrastructureCapacityDebuggingRelease engineering
Following a streaming transcript without fighting the reader
A follow controller for agent transcripts that keeps reader intent as explicit state, separate from scroll geometry, and the cases that shaped it over two months.
InterfacesAgent systems
Following an agent failure down to the process
Tracing a completed-but-failed agent run through thread, deployment, tool call, adapter and terminal pane, and what to do when logs and status mislead.
Agent systemsPlatformsVerification
Forgetting a memory must survive the retry that created it
How a delayed create can bring a deleted memory back, and what stops it: durable operation receipts, a tombstone that keeps only the ID, supersession edges moved before a duplicate is forgotten, and recall whose staleness has a stated bound.
SelectedMemoryStorageAgent systemsReliability
Giving an agent project a durable owner
What has to change when a coding conversation becomes a project that keeps running while you are elsewhere: a coordinator added to existing threads, a record that outlives any one conversation, and an interface that won't infer one state from another.
SelectedAgent systemsOrchestrationProductArchitecture
Grading agents without trusting the simulator
An evaluation lab where the oracle never calls simulator code, grades in ten gates, tests itself with mutations and can answer that it doesn't know.
SelectedAgent systemsEvaluationVerification
An interrupted model call still has to be accounted for
When a stream breaks, the caller's connection says little about what the provider did. How a durable operation record, a recorded dispatch, a fixed settle-or-refund intent and an explicit unknown state keep a model call's charge defensible across retries and crashes.
Ai gatewaysBillingReliabilityIdempotency
Keeping a coordinator responsive while its workers are busy
When a coordinator shares a process with its workers, load and every recovery action land on both. How the deciding agent was separated from the process that holds the tree, sandboxes and workers, what the relay between them costs.
SelectedAgent systemsOrchestrationArchitectureRuntime
Keeping scheduled work moving after a crash
A morning pipeline built on durable, date-keyed obligations, leases and a five-minute sweep, so a crash between steps cannot silently drop the work that is owed.
Agent systemsPlatformsVerification
Keeping the real workspace beside the conversation
Giving a browser workspace stable panel identity, separate lifetimes for layout and shell, and the agent’s real files and terminal instead of a plausible substitute.
InterfacesAgent systemsSecurity
Letting an agent edit the canvas
A canvas prototype where an agent and a person edit the same typed document, with selection-aware snapshots, canvas operations, and aliases for objects just created.
InterfacesAgent systems
Keeping long agent turns steerable and within their context budget
A steer could wait 40 minutes behind a foreground command, and a rule meant to spare people from summaries let threads overflow. Bounded yields and a budget judged on the request actually sent address both.
Agent systemsRuntimeContextCompaction
Making a search index prove itself at query time
A search engine that treats every posting as a lead, publishes updates by stage-then-flip, and checks each candidate against one served version before its ACL runs.
PlatformsVerificationSecurity
Merge or refuse? Choosing a conflict model for text, cards and drafts
A test for when concurrent writes should merge and when they should be refused, applied to a text CRDT, a task board and fenced draft publishing.
Agent systemsInterfacesPlatforms
Model concurrency is not machine capacity
Why admitting sub-agent sessions and admitting work to a shared machine are separate problems, handled with queues, resource preflights, leases and useful refusals.
SelectedAgent systemsPlatforms
Monitoring should keep working when one of its own checks breaks
One alert policy the engine refuses could stop every policy sorted after it from running. Why validation can't prevent that, where the failure boundary belongs, and how the same question applies to notifications, overloaded ingestion and diagnostic bundles.
VerificationObservabilityReliabilityRust
Mutations a form can’t express: merges, legal moves and stale edits
A CRM merge, legal issue transitions and stale-edit fences: treating changes as named server operations, with history in the write and a readable state after a crash.
PlatformsInterfaces
One application definition, several ways for an agent to use it
Generating discovery files, OpenAPI and MCP tools from one declared surface keeps the formats agreeing. It can't make a flag true, write a recovery procedure or count as extra test coverage. A skills pilot and a live byte comparison show where the line falls.
SelectedAgent systemsMcpApi designVerification
One desktop, many windows, and the changes that arrive late
In a browser rebuild of Catalina, remounting the menu bar kept closing the person’s live stream. How to give each long-lived resource an owner with the right lifetime, and how numbered changes tell a page’s own late writes from someone else’s.
BrowsersReactConcurrencyArchitecture
One sign-in screen, three owners of identity
How hosted authentication, a sign-in broker and application-local accounts each vouch for a different fact, with signed browser handoffs and each one's limits.
SecurityPlatforms
Why opening a conversation should not wait for its whole history
A page asking for twelve entries could still wait 31 seconds. Pagination limited the answer and not the work behind it, so the design serves the first view from read models the writers maintain.
PerformanceArchitectureAgent systems
“Ported” is several different claims
Why a parity percentage can't describe a port of an agent toolkit: a ledger that keeps gaps as rows, and the separate proofs a behaviour needs natively, in a constrained application, when hosted and against a real provider.
PortingVerificationAgent systemsArchitecture
Porting an agent by making omissions visible
How a checklist generated from the syntax tree, clean-context reviewers and a ledger that keeps “translated” apart from “reviewed” exposed what a model-assisted port of a 340,000-line Python agent had left out.
SelectedAgent systemsPortingCode reviewFormal methodsVerification
Publishing a SQLite database through one compare-and-swap
How a WebAssembly SQLite adapter makes a whole database image live through one manifest swap, why deletes follow publication, and what bounded cleanup leaves behind.
PlatformsPerformance
Real files on disk, with sync running beside them
Two systems that give tools an ordinary directory and sync alongside it: echo detection without clocks, a guarded remote commit, and measured cold-restore times.
PlatformsPerformanceAgent systems
Rebuilding Catalina as a React interface
How a React library reproduces macOS Catalina's look and its window logic in a browser: interaction from Base UI, appearance as CSS tokens tagged by the evidence behind them, window state carried by the cascade, and a repository where concurrent contributors rarely need the same file.
ReactCssDesign systemsAgent systems
Recovering a deploy that may already be serving
How a deployment client journals an attempt before submitting, retries under one operation ID, and after a crash accepts only status bound to that operation.
PlatformsVerification
Recovering a service deployment after its visible work has already happened
What a deployment controller has to do when a route has gone out and the catalog write fails: why a completed saga step can't be trusted on resume, how a retry recognises its own intent, and why cleanup is bound to the version it read.
RuntimeVerificationDeploymentReliability
Recovering an agent’s half-finished edits
How expected and intended digests let a restarted coding agent tell whether each file edit landed, is still owed or was overtaken, and when it must refuse to write.
Agent systemsVerification
Reducing allocation churn in an agent platform
Why an agent gateway with broad retained state allocated gigabytes a minute, how repeated sizing and serialization drove it, and what bounded buffers and encode-once paths do and don't fix.
PerformanceMemoryProfilingTypeScriptAgent systems
Replaying the deterministic part of an agent
Recorded model replies and terminal output drove a port through whole sessions, so each difference could be located, classified and rechecked from a checkpoint. What the loop found, how its masks stayed honest and where live runs fit.
SelectedAgent systemsPortingReplayVerification
Reviewing code that won’t hold still
Binding review approvals and test results to the exact source revision they examined, and stopping when the latest change has gone unread.
Agent systemsVerification
Routing sub-agents to models without risking the run
A router with a bounded judge, a fallback that keeps the child task moving, layered settings, and a record of why each sub-agent got its model and effort.
Agent systemsPlatforms
Putting a Rust server behind somebody else’s Next.js storefront
Porting Next.js Commerce onto a Rust platform with no server JavaScript: generated contracts, runtime adapters, and what the frontend assumed about its server.
PlatformsInterfaces
Giving a shared revision store the repository tools an agent expects
How agents get familiar status, diff, log and publishing tools over a shared revision tree with no .git, and how those tools say where their contract differs from Git's.
Agent systemsDeveloper toolsVersion controlTool designConcurrency
Sharing a book's text without sharing the reader's notes
How the Macalicious Books app keeps one shared copy of a public-domain book and private bookmarks and notes for each reader: bounded fetch rounds, a seam digest in place of HTTP validators, and what eviction does to offsets.
StorageHttpPrivacyMacaliciousFerrite
Shipping an SDK that does not depend on the developer’s laptop
What has to be true before a private source tree can become a usable public SDK: fresh snapshots, a private manifest, a checker that never runs exported code, clean-container consumers and generated notices.
SelectedSDK contractsVerification
Shutdown can only stop what it can find
A sandbox coordinator fix that puts bootstrapping instances within reach of shutdown, and an API that says when it stopped waiting without knowing the outcome.
PlatformsInterfaces
Stock transfers and booking holds: what changes when a claim can expire
Why a warehouse transfer fits in one compare-and-swap, why a calendar hold can lapse with no write at all, and why a durable seat claim is the one that can leak.
PlatformsInterfaces
Taking Raft out of our configuration service
Replacing a home-grown Raft cluster with Valkey: which jobs moved to the store, which rules stayed in the service, and how atomic scripts keep the two together.
PlatformsSecurity
Every draft passed the judges
A pipeline of model judges passed every draft. What those scores measured, how a reader’s preference differs, and why taste and facts need separate evidence.
WritingAgent systemsEvaluationCraft
Ten stories is a maximum: letting a morning briefing run short
How a briefing pipeline lets issues run short: a per-source cap, an evidence floor, smaller budgets for thin stories and a lexical audit of the final prose.
Agent systemsVerification
Testing a release without turning every release into a research project
How a release on an agent-operated platform stays finite: scope chosen once, evidence reused only where it still applies, limits on retries, and a plain record of what never got checked.
SelectedRelease engineeringVerificationAgent systemsOperations
Testing the promises an API actually makes
How to test what a multi-service JSON-RPC API promises: coverage from its advertised methods, hostile payloads, concurrent writes and literal replay checks.
SelectedInterfacesSecurityVerification
The invalidation that arrives while the loader is running
Why a cached entry must record tag epochs before its loader runs, why writers invalidate after they write, and why leases only limit duplicate loads.
PlatformsPerformance
The same scheduled occurrence, delivered twice
Giving scheduled work a stable occurrence name so redelivery can be recognised, and what that name can’t settle once work leaves the commit or reaches a provider.
Agent systemsPlatforms
The test passed, but the person still could not do the thing
What a browser test has to establish beyond a 200 or a successful click, followed along a new user’s path from documentation to clipboard to the app and its dashboard.
SelectedVerificationBrowsersRelease engineering
Twenty-one workspaces sharing one filesystem flush
Diagnosing a 5.6× slowdown across 21 agent workspaces with a durability-matched control, and why a filesystem-wide syncfs made deployment layout part of its design.
PerformancePlatformsAgent systems
Two ways a tool description goes stale
Why a discovered tool definition is not permission to call it: re-checking catalog, policy and capability at call time, and deriving every format from one source.
SelectedAgent systemsSecurityInterfacesEvaluation
Voice shouldn’t have its own idea of the task
Building voice as one more client of existing thread operations, with guards for steering races, ambiguous references and a spoken “yes” that names nothing.
InterfacesAgent systemsSecurity
Waiting for an async host by running the program again
How a synchronous QuickJS guest in WebAssembly waits for async Rust: abort on each host call, answer it, then replay the program with the answers preloaded.
Agent systemsPlatformsSecurity
What a double-entry ledger can promise without a transaction
A double-entry ledger on a store with only conditional writes: a journal entry lands whole, account totals catch up, and retries recognise work already applied.
PlatformsVerification
What a permission model looks like from inside Notes
A browser-based desktop makes cloud boundaries visible in ordinary actions: a note that survives a reload but does not reach another browser, shared rooms, guest accounts, a lock screen the server enforces, and writes refused when another site sends them.
SecurityWebSessionsMulti tenancy
What a plugin upgrade is allowed to destroy
Plugin packages, plugin data and sandbox caches have different lifetimes. How an installer applies digests, atomic renames and restore rules to each one.
PlatformsSecurityVerification
What a tool-call approval actually approves
Binding a human yes to one tool call, with exact inputs, policy revision, thread and turn, spending it once across replicas, and asking where the last check sits.
SelectedAgent systemsSecurity
What an agent can afford to lose
Sorting an agent platform’s data into irreplaceable work and rebuildable cache, and letting that decide journal storage, migration, eviction and restores.
Agent systemsPlatformsPerformance
What an agent may find, read and publish
How a read-only context library keeps discovery, search, observation and publishing apart, with a capped catalog of untrusted text and access rechecked for each observer. This is a contract rather than a deployed service.
Agent systemsSecurityContextArchitecture
What an agent runtime has to write down before it says yes
What a durable agent runtime must store before acknowledging a turn, how it recovers a crash mid tool call, and what at-least-once still leaves to the tool.
Agent systemsPlatformsSecurity
What an evidence vault can prove without a notary
What content hashes, separated review and a chained audit log establish inside one application, and where blob deletion and the signing key's holder limit them.
SecurityVerification
What “clean locally” is allowed to mean
How a local platform emulator reproduces leases, retries and denied egress, and says where its verdict stops at the moment a check comes back clean.
PlatformsVerificationInterfaces
What “completed” means in an AI gateway
Why an AI gateway held back the terminal event until stored responses had landed, and what that release path did and did not promise about usage accounting.
PlatformsInterfacesVerification
What did the agent actually change?
How an agent platform computes a pull request from a registered base and a scoped view of the workspace, and keeps absent, unverifiable and unknown outcomes distinct.
Agent systemsPlatformsVerification
What happens when two windows edit the same note?
Two windows save the same note and the later save is refused. What happens next decides whether the person keeps their text: a revision check, a three-way merge applications opt into, a Keep Mine choice, and a test that holds a save back on purpose.
ConcurrencyCollaborationFrontendVerification
What has to commit together when a payment arrives twice
In a reference shop with hedged requests and retried webhooks: what must land in one write, and why durable intent, rediscovery and receiver idempotency are separate.
PlatformsSecurity
What should be identical in a five-language agent SDK
Which parts of a multi-language SDK must match exactly, such as errors, identity and event order, how shared fixtures enforce them, and what each language keeps.
SelectedAgent systemsInterfacesVerification
What should travel when you share an agent
A blueprint shares an agent's code and the connections it needs, but never its history, credentials or schedules, and the recipient wires in their own grants.
Agent systemsSecurityOpen source
What survives when you replace the client
Replacing a browser client on a shared TypeScript package and adding a native Rust client on the protocol alone: what each reused, and where scrolling and login cut across.
InterfacesAgent systemsSecurity
What TanStack Start actually asks of its server
Porting TanStack Start to a Rust host shows how much of its server contract lives behind fetch: Nitro’s rules, cache behavior and the things a port must refuse.
PlatformsInterfacesOpen source
When a usage dashboard is entitled to show zero
Treating usage replies as evidence: a browser parser that refuses inconsistent numbers, and display states that separate an observed zero from unavailable, stale or partial.
InterfacesPlatformsVerification
When the evaluator is the broken part
Sixteen generated apps passed their functional checks while the benchmark recorded two passes. Separating what was built, how it was built and what the observer could prove explains the gap.
EvaluationVerification
When the older worker finishes last
How a change-tracking pipeline fences cursor moves, repairs a stale publish across D1 and R2, and separates an empty source from an unreachable one.
PlatformsVerification
Where an agent’s URL actually connects
Following an agent's URL past the allowlist: resolving every address, pinning the connection, vetting each redirect, and why each browser backend differs.
Agent systemsSecurityPlatforms
Whose mistake did the coding-agent benchmark catch?
Reference and empty-patch controls, test-file collisions and environment faults: how to adapt a coding-agent benchmark and tell an agent's failure from the harness's.
SelectedAgent systemsEvaluationVerification
Whose request is this? Delegated identity between services
Keeping the calling service separate from the user behind it: absent, invalid and verified identity, binding claims to the resource, and what replay memory needs.
SelectedSecurityInterfaces
Why a project worker needs to own the whole job
Why splitting implementation, review and follow-up into disconnected turns loses obligations, what belongs to the coordinator, the worker and its helpers, and the leases, anchored findings and content-bound checks that let ownership survive on a shared tree.
SelectedAgent systemsOrchestrationCode reviewConcurrency