What we took from Scion for AI agent Workspaces, and what we deferred
What we took from Anthropic's Scion for plori Workspaces: a per-path history and automatic acceptance of clean worker changes, plus a merge cost we measured and deferred.
Blog
Notes from running AI agents in Workspaces.
Plori runs AI agents that collaborate on one product in the cloud. These engineering notes cover storage, cold starts and production incidents, with measurements. For what the product does, see the docs.
Where should a small team run Firecracker? Nested virtualization support and cost by cloud
Nested virtualization support and monthly cost for a small Firecracker workload on Vultr, AWS, Google Cloud, Azure, OVHcloud, DigitalOcean and bare metal.
Will Claude Code use an MCP server the user did not name? We measured it
Claude Code sees only MCP tool names and server instructions at session start. We measured delegation in 240 indirect runs before and after a rewrite.
How we store AI agent files: local disks and restic revisions
How plori keeps each AI agent's files on a local disk, saves read-only restic revisions every minute, and accepts results with a compare-and-swap, with staging numbers and trade-offs.
Running a FUSE filesystem inside gVisor: what broke
What broke when we ran a JuiceFS FUSE client inside gVisor: 4 KiB writes, mmap returning ENOSYS, fsync that did not wait, and EINTR that broke git.
Why we stopped using JuiceFS for AI agent storage
Why plori replaced JuiceFS with local disks and restic revisions for AI agent files: each step we took, the data behind it, and what we gave up.
A Search Console method to decide which SEO tasks to keep
Eight steps that join Search Console with search results, deploy dates, URL Inspection and signups to decide which SEO tasks to keep or close.
Firecracker agent sandboxes on nested KVM
Boot times from 305 Firecracker microVMs on nested KVM, why the documented guest clock corrections failed, and our jailer, network and memory setup.
Claude Code routines: what they run, where they stop, and when to use a hosted agent
Claude Code routines from Anthropic's docs: triggers, the daily run cap, headless mode, a setup checklist, and when to add a hosted agent next to them.
Deploying gVisor on Kubernetes for AI agent sandboxes
What our gVisor rollout tested beyond installation: runtime configuration, real Kubernetes workloads, fresh nodes, and verification after a reboot.
AI agent retries: avoiding duplicate tool calls
A recovery drill showed why an interrupted agent can have a completed tool call. Check saved results before retrying, and handle uncertain outcomes.
How to test AI agent sandbox persistence
An agent read its new file, but a later reader could not. Test the latest bytes after sleep and replacement, with lessons from a controlled storage drill.
GPT prompt caching: how to improve cache hit rates
A practical GPT prompt-caching guide with real before-and-after numbers: exact prefixes, GPT-5.6 breakpoints, cache keys, metrics, and debugging probes.
How to secure a cloud AI agent that can run arbitrary code
A practical handbook for hosted agents, drawn from a real environment leak: subprocesses, scoped tokens, network policy, /proc, and regression tests.
DeepSeek's agent harness makes everything a plugin, even the approval policy
An early read of DeepSeek's dsh agent harness: an event-sourced session log and deny-only tool guards, with the safety policy in a swappable config layer.
One AI agent used 1.06M tokens and never wrote the patch
A max-turn cap keeps an agent from running forever, but cannot tell work from waste. We catch repeated failures and save partial work before stopping.
Our model router was overpaying 33x for the same results
Our router paid 33x more for every model call. A control run on the cheapest candidate resolved the same 34 of 50 tasks at 44% of the model spend.
What a Kubernetes warm pool cannot prewarm for a stateful AI agent
A stateful AI agent warm pool should prewarm runtimes, then bind the existing disk, tenant identity, and final credentials atomically at claim time.
The workflow engine said OK after a failed step
An RPC acknowledgement can be OK while a workflow step fails. The durable terminal record, not the transport ACK, must define the execution result.
Why we put a server between our AI agents and JuiceFS
JuiceFS CE enforces --subdir, quotas, and ACLs in the client. Our clients are untrusted AI agents, so isolation lives in a server in front.
We let 443 dead FUSE mounts pile up and it wedged kubelet
How 443 dead FUSE mounts wedged kubelet teardown and starved a node, plus the 60-second janitor that fixed it. With the nsenter and /proc/mounts traps.
We moved JuiceFS metadata from Postgres to Redis and file ops got 7x faster
A production JuiceFS migration: metadata moved from Postgres to Redis, create+rename 22ms to 3.2ms (~7x). Durability config, RAM ceiling, dump/load steps.
Every post is also available as plain Markdown: request it with an Accept: text/markdown header, or append .md to the URL. Agents can start from llms.txt.