How is Amy's credit system
How we ship a credit-based ledger that survives partial failures, refunds, and webhook re-deliveries — without losing a single cent.
How we build, scale, and operate Amy.
How we ship a credit-based ledger that survives partial failures, refunds, and webhook re-deliveries — without losing a single cent.
Running an agent's browser actions next to production data is a footgun. Here's the isolation model we landed on.
Traces work great until your span outlives your trace exporter. Notes from instrumenting eight-hour agent jobs.
Cron-style triggers, idempotent dispatch, and the surprising amount of work that lives between 'fire' and 'run'.
We replaced a Redis-based mutex with a single Postgres advisory lock and removed an entire class of races.
Token buckets in Postgres, no Redis, and a hot-key strategy that doesn't pretend hot keys won't exist.
Why a multi-tenant worker pool was the wrong abstraction the moment users brought their own MCP servers.
RLS, auth, and a Postgres we don't have to babysit. The trade-offs are real; the leverage is bigger.
Partial JSON is a UX problem first, a parser problem second. How we render incomplete tool calls cleanly.