Hermes Wiki
Synthesis/concurrency-checklist-names-what-agent-runtimes-build

Synthesis: Mihir's Own Concurrency Checklist Independently Names the Exact Problem Agent Runtimes Are Now Selling as Infrastructure

The connection

Developer/Checklists/concurrency_and_scalability_checklist.md — new this window (2026-08-11), first note in the brand-new Developer/ folder — is a hands-on audit checklist for scaling async FastAPI apps across multiple workers. Section 3, "In-Process State (the multi-worker killer)," names the failure mode plainly: module-level locks, events, and singletons "break across workers/pods," and the fix is to "document which state must be externalized before adding workers." Section 6 explicitly lists MCP Servers alongside LLMs and network devices as one of the external dependencies whose client state needs the same scrutiny.

That is, word for word, the problem three other parts of the vault describe agent-runtime vendors now selling as a managed product instead of a checklist item:

  • Architecture/CaseStudies/grab-palana-secure-ai-agent-platform.md (new this window) externalizes exactly this class of state for AI agents specifically — proxy-only secrets so the real credential never lives in agent-process memory, and kill switches that live outside the agent's own process because "agents can't be trusted to self-terminate." Both are direct instances of the checklist's "in-process singletons aren't safe to duplicate across workers" warning, applied to an agent instead of a FastAPI worker.
  • The AIDigest sandboxing cluster from this window — Zed 1.14's OS-kernel-level locks (AIDigest/2026/08/13/2026-08-13-06-zed-1-14-os-level-agent-sandboxing) and Databricks' per-agent WASM Postgres via the Electric acquisition (AIDigest/2026/08/14/2026-08-14-06-databricks-electric-wasm-postgres-agent-sandboxes) — push isolation down to the OS/runtime layer for the same reason the checklist tells a solo FastAPI developer to push locks into Redis: in-process state doesn't survive concurrency once you stop trusting a single process to hold the truth.
  • Synthesis/agentcore-stub-and-mcp-stateless-spec-both-point-at-oauth-oidc.md already named AgentCore's "session isolation... as infrastructure" claim as OAuth/OIDC identity plus Dogwood's sequence-aware policy state stacked together — this note's checklist gives that claim its plainest possible restatement: session isolation is "externalizing the state that used to live in one process," just packaged as a managed product instead of an internal audit.

Why this wasn't visible before

Developer/ is a brand-new folder (created 2026-08-10, per Developer/system_prompt) explicitly scoped to "day-to-day engineering craft" as distinct from Architecture/'s system-design layer — its one existing note is a checklist, not a concept explainer, so it doesn't carry the pillar-* or ai-agents framing that would make an obvious search hit against the AgentCore/Palana cluster. The connection only surfaces by reading the checklist's actual content (Section 3 and 6) rather than its title or tags.

Why it matters

The direction of the analogy is the useful part, not just the analogy itself: Mihir already has, in his own hand-written operational checklist, the exact question ("what state here is single-process and needs externalizing before this scales?") that AWS, Grab, Zed, and Databricks are independently answering at the agent-runtime layer this same month. That means the checklist is a legitimate lens for auditing any of Mihir's own agent-adjacent projects (Localz, the RBC Compliance Agent, FullStackFusions' BYOK chat) for the same class of bug before reaching for a managed runtime to solve it — session state, locks, and singletons are the first thing to check, not model capability.

Hermes Wiki