The story this week is agents learning to work with less. Less standing access. Less downtime. Less wasted capacity. And a Git backend that handles less-than-human push rhythms without breaking. Four teams shipped things this week that show what it looks like to build infrastructure for agents rather than around them.
Your AI agent shouldn't hold your GitHub token
Here's the scenario Ariadne Conill describes most often. A developer wants a coding agent to open a pull request against one repository. The easy path: hand it your personal access token. It works. And now the agent can read every repository you can see.
Nobody designed it that way. It's just what happens when the only option is "give the workload a secret."
Edera's answer, announced November 5, is to stop giving agents secrets at all. The company released Object Capability Bounded Authority as part of its Agent Runtime. The idea is simple and old: an unforgeable reference that bundles a resource and a permitted action. If you hold the reference, you have the authority. If you don't, there's nothing to ask for.
For the GitHub example, the agent runs in an isolated MicroVM with no token inside it. When the sandbox is created, it gets a capability — a reference to a credential broker running in a separate zone. The broker checks the caller's workload identity, confirms the capability covers the request, attaches the real credential, calls GitHub, and returns the response. The token never enters the agent's memory or filesystem.
Conill, co-founder and distinguished engineer at Edera and the person behind Alpine Linux's security model, says enforcement at the hypervisor is what makes this hold up. An in-process check runs in the same address space as the thing it's constraining. A fully compromised agent gets exactly what the job needed — maybe PR access to one repository — and nothing else.
What's available today: isolated sandboxes, scoped command execution via capsudo, and workload identity through SPIFFE/SPIRE. Try it at on.edera.dev; early access opens November 9. The credential-brokering piece (capcurl) is still in development. The tooling is open source under ISC and 0BSD licenses.
Conill's practical advice for teams not using Edera yet: "Get credentials out of the agent's execution environment. If your agent can read a token, assume an attacker will too." Put a broker in front of your APIs — even a small proxy you write yourself — and only forward the requests the agent's job actually needs.
Read more
When your agent crashes halfway through, make it finish — not start over
Most agent demos finish in seconds. Production agents don't. An agent working a production incident or an insurance claim can run for hours. Then a pod gets evicted and the whole run starts over. Every LLM call runs again. You pay for the same tokens twice. Actions that already happened may happen again.
Diagrid, the company behind the CNCF-graduated Dapr project, announced durable execution support for goose — the open source agent framework — plus LangChainGo and Mastra. The integration now spans more than 15 frameworks across Python, TypeScript, Java, and C#.
The mechanic is straightforward. The agent runs inside a Dapr Workflow. Each LLM call and tool call becomes a checkpointed step. If the process dies, the agent resumes from the last completed step, not from zero. LLM results are replayed from the checkpoint — the agent doesn't re-ask the model and risk a different answer halfway through a job.
Diagrid CTO Yaron Schneider's most useful filter: the right question isn't how long an agent runs, it's what losing progress costs. If the work is cheap, stateless, and safe to repeat, let it restart. Add durability when lost progress means wasted tokens, duplicate actions, or an unresolved incident.
The overhead is 50 milliseconds per step — Diagrid's own figure, and noise next to a multi-second LLM call. The integration is three lines of code in most frameworks. The idempotency problem is yours to solve: durable execution gets the agent back to the last committed step, but if a step sent an email or charged a card before the checkpoint landed, that step runs again on resume. Build for it.
One real case: a large EU manufacturing company runs agents in a complex OCR workflow. Durable execution saves tokens by resuming where the agent left off instead of restarting the whole process.
Schneider's honest last word: durability isn't correctness. A durable agent that reasons badly still finishes the wrong job, just more reliably.
Read more
OpenAI rebuilt Git — and nobody had to change a command
Coding agents kept finding the weak spot in OpenAI's infrastructure. As Codex multiplied branches, pushes, and fetches, the monorepo server couldn't keep up. Reliability at times dropped below 90%.
OpenAI didn't replace Git. It rebuilt the backend behind it. The new system, Pando, is now handling all development in the monorepo. Engineers and agents still run ordinary git push and git fetch commands against the same client. Nothing changed on their end.
The core problem was consistency. A conventional Git server treats the repository as one unit — pushes to unrelated branches wait on each other. Pando coordinates each branch independently. Two agents pushing to different branches never contend. A standard Git server also advertises every branch on every connection. With millions of branches, that list alone gets heavy. Pando advertises only a designated trunk branch by default.
On performance: median push latency dropped about 80%. Pando now serves nearly a petabyte of Git data daily using a handful of CPU cores. In its peak hour, it served more than 57 TB of packfiles, with over 99% coming from local disk cache. These are OpenAI-reported figures from its own environment.
A detail worth noting: OpenAI says Codex built Pando in about 10 weeks. One engineer designed the core architecture; teams of agents implemented it.
The lesson for everyone else isn't to build a custom Git backend. It's to notice where the pressure appeared: not Git itself, but the service built on the assumption that people push code a few times a day. Self-hosted Git servers, CI runners, artifact stores, and anything that clones on every push were sized for that rhythm. If you're running agents in parallel worktrees or CI, start tracking fetch latency and push failure rates now.
Read more
Kubernetes rightsizing that respects the lines you've already drawn
Most Kubernetes CPU and memory requests get set once — before the workload has seen real traffic — and never revisited. The guess usually runs high because over-provisioning feels safe. That becomes spend nobody can attribute.
groundcover released Autonomous Infrastructure in beta this week. It's an AI agent that right-sizes Kubernetes workloads using eBPF telemetry groundcover's observability platform already collects. No new agent to deploy. No SDK to add. The agent works from real production behavior.
The design is built around constraints. Requests only, never limits — the ceiling a team sets stays theirs. Node-aware sizing, so growing one workload doesn't push its neighbors out of resources. Hands off the HPA and KEDA — anything a horizontal autoscaler scales on by utilization is left alone. That last one matters: HPA utilization is measured as a percentage of the request. Change the request underneath it and you change when HPA scales. Two controllers adjusting the same signal is a good way to get a 3 a.m. page.
It's also off by default, one Deployment at a time, admins only, with every change creating an audit event. For now it handles Kubernetes Deployments only — StatefulSets aren't touched, which keeps most databases out of reach.
groundcover shared savings figures from four early customers: 57–83% reduction in CPU/memory costs, ranging from $5,859 to $134,904 per month. Read those as directional — the company didn't detail measurement methodology.
CEO Shahar Azulay's two questions to ask any vendor, including groundcover: Will it show you what it would change before you turn it on? Does it size each workload alone, or account for what else is on the node?
Read more
Also from this week
GitLab Orbit is now GA. The context graph for the software lifecycle — connecting code, merge requests, pipelines, vulnerabilities, and ownership — is generally available for Premium and Ultimate customers on GitLab.com. GitLab's own testing showed up to 45x fewer hallucinations and up to 4.5x fewer tokens on the same tasks with the same model. The more interesting result: Compare the Market tested four context approaches on 79 real merge requests and found that RAG performed worse than no added context at all, while Orbit matched about 70% of expected inline comments. Third-party agents including Claude Code, Codex, and Cursor connect through MCP. Read more
DeepSeek's Super-Agent fixes bugs it overhears in team chat. An open-source research prototype from DeepSeek Harness: a Router layer manages shared context, Worker sessions run tasks in parallel, and an external Watchdog keeps it running. The stated goal is to take agent coordination off the developer's plate — including picking up bug reports from group chat and opening pull requests without being tagged. DeepSeek is candid about the limits: it's a prototype, not production-ready, and has open problems in scaling, long-term memory, and security when cloud agents reach local devices. The more useful question: when agents open a steady stream of PRs from chat, the attention you save doesn't disappear. It moves to the review queue. Read more
MariaDB Enterprise Platform 2027 ships with agent tooling built in. AI Retrieval turns natural language into read-only SQL against live operational data, with no separate vector store to maintain. AI Plugins for Claude Code and Codex give coding agents MariaDB-specific skills and a throwaway sandbox to test against. Agent Memory provides a durable, in-memory context store. The CPO is candid about what doesn't work yet: row-level access isn't in AI Retrieval (table-level only), Agent Memory persistence is off by default, and Semantic Cache can't detect data changes. Skip it for balances and inventory. Available in public preview on MariaDB Cloud on AWS. Read more
EMBRACE update: some AI coding tool browsers are still unpatched. The file-system access vulnerability class affecting built-in browsers in AI coding tools — documented by Forever Security last month — still has open patches as of the latest reporting. If you use Codex or VS Code with built-in browser features, open assistant-generated links in an external browser until patches land. Read more
Developer Spotlight this week
Daniel Mgbechi is a computer science student at Lagos State University who builds in public — and writes about it honestly. He's currently building Sovari, a reading and note-taking app he created because he kept finishing books with nothing to show for the time. It runs in React with a local storage layer for now; Supabase and real accounts are next. His recent article about a trailing semicolon in a .env file that cost him five days on a school assignment — the cause: PORT=3000; — is the kind of thing every developer has lived through and nobody talks about. His take: "Five days. One character." He's also moving from frontend JavaScript into Node.js, taking the long route through the raw http module before touching a framework. His reasoning: "frameworks aren't doing black magic." Daniel coaches students at NACOS and built a small agency called BukahDev on the side. Worth following if you like builders who show their work while they're doing it.
Read more
The common thread this week is infrastructure built for a different world catching up. Git backends sized for human commit rhythms, Kubernetes requests set before traffic arrives, agents carrying credentials they don't need and crashing mid-task with no way to resume. None of these are new problems. They just got harder to ignore when agents started running at scale. The teams shipping fixes this week all made the same design call: build constraints into the system, not on top of it.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.