Amy Engineering

How we ship a credit-based ledger that survives partial failures, refunds, and webhook re-deliveries — without losing a single cent.

Running an agent's browser actions next to production data is a footgun. Here's the isolation model we landed on.

Traces work great until your span outlives your trace exporter. Notes from instrumenting eight-hour agent jobs.

Cron-style triggers, idempotent dispatch, and the surprising amount of work that lives between 'fire' and 'run'.

We replaced a Redis-based mutex with a single Postgres advisory lock and removed an entire class of races.

Token buckets in Postgres, no Redis, and a hot-key strategy that doesn't pretend hot keys won't exist.

Why a multi-tenant worker pool was the wrong abstraction the moment users brought their own MCP servers.

RLS, auth, and a Postgres we don't have to babysit. The trade-offs are real; the leverage is bigger.

Partial JSON is a UX problem first, a parser problem second. How we render incomplete tool calls cleanly.