Reliability & Automation
Any machine can do any job, a stranger's code runs somewhere with no home to go back to, and the list of what a machine can do is not allowed to lie about it.
The problem
Per-project worker pools mean per-project secrets, per-project deploys, and per-project bugs. One generic worker means one attack surface, which is only an improvement if that surface is actually held.
Each application keeps its own jobs table and its own endpoints for claiming work and reporting back. The worker polls all of them off a list. There is no central hub sitting in the middle holding everybody's data, because a central hub is one convenient place to steal all of it from.
That matches the per-tenant isolation story the regulated platforms are sold on, and it keeps every credential narrow: a worker holds a per-source secret by indirection, never a master key.
Arbitrary caller-supplied code runs as a non-root user inside bubblewrap with the home directory unmounted. The API keys and tunnel material are not merely permission-denied, they are not present in the namespace. No network unless the job asks for it. Hard kill on timeout.
It fails closed: no sandbox binary present, and the capability is not advertised at all. A smoke test asserts each of those properties individually, and the repository says plainly that if that test fails, the fleet is handing out root, not that the test is stale.
A box advertises only what it can actually execute. A language runtime installed under a user's home directory is withheld, because the sandbox cannot see it. Browser capability gates on a real engine binary, not on the package being installed.
Claiming a capability you then fail is worse than not claiming it: the scheduler routes work to a lie, and the failure surfaces as a mystery instead of a gap.
A balancer holds one slot per model per key and rotates through them, benching a model when it fails and dropping it for good when the provider says it no longer exists. A probe runs on a short timer, pings every model the box has a key for, and rewrites the active list underneath the balancer, which picks it up without a restart.
So the roster turns over on its own as providers rate-limit, retire and restore models. Without anyone editing a config.
Vision routing is a hard filter, not a preference, because a text-only model handed an image returns a 400. The upstream catalog tracks no modality, so the allowlist is probed rather than declared: each candidate was sent a red image and a green image and had to name both colours.
Engineering decisions
Callers own retries; the worker only retries result delivery.
A worker that retries the caller's business logic is a worker that decides how many times a payment gets attempted.
Slots measure capacity; the headline measures variety.
A second account with the same provider repeats all of that provider's models in the rotation. That buys more free quota and more concurrency, not more choice. Reporting them as the same number would be a vanity metric.
Namespace your process names before you script against them.
An un-namespaced pattern kill aimed at a stray process was terminating the worker daemon itself on one box. Renaming the entrypoint cost five minutes; finding it cost a day.
Reliability & Automation
One person cannot watch a production fleet around the clock. So the machine takes the first action, and the interesting part is everything that stops it.
Security & Response
Everybody has detection. Nobody has anybody to read it. That is not a problem you hire your way out of, and it is not a problem you buy another product to fix.
Security & Response
The AI never writes a command. It picks a number off a list, so the worst a hostile input can do is make it pick a different approved action.
If your team is drowning in toil, alert noise, or incidents that never quite close. That is the work I do.
Get in touch