The Actors List Lies. Trust the Workers List.
The actors list lies: every finished Agent Substrate session leaves a Suspended entry behind, so the inventory grows without bound and returns partial results …
Read more →$
whoami --verbose
● always shipping
|
Portland, OR
|
agentic mesh · agent runtimes · ai gateways
MIKE MOORE
building the agentic future in public
I run LLMs, robots, and gateways into production walls so you don't have to. Deep dives on the agentic mesh, agent runtimes, AI gateways, and the Kubernetes substrate that keeps autonomous systems honest — every post ships with a repo you can clone and receipts you can check.
Start here
Agent Identity
How an agent proves who it is: SPIFFE, token exchange, and audience binding.
Open the hub →Agent Security
Controls that look like controls and are not, and what to put in their place.
Open the hub →AI Gateways
The call path between agents and models: identity, spend, and policy in one place.
Open the hub →MCP
How agents find tools, which servers exist, and who those tools act for.
Open the hub →Agent Runtimes
Start, stop, and isolate agents on Kubernetes. kagent and the substrate under it.
Open the hub →Robotics
The house as a cluster, the cost of a capable machine, and who signs the test report.
Open the hub →The Latest Drops
Binary Verification for Agents
Binary verification for agents is a typed yes/no on the tool-call path, with a confidence score I have actually graded. It takes a tool name, arguments, maybe …
Read more →Who Runs Next When the Agent Pool Is Full
Who runs next when the agent pool is full is the question the runtime answers by accident. Agent Substrate rejects with substrate worker pool has no free …
Read more →Agent Checkpoint to Object Storage
Agent checkpoint to object storage is how Agent Substrate parks an actor’s RAM and disk so the worker slot can go to someone else. The runtime should …
Read more →Why OAuth Is Not Enough for Agents
Why OAuth is not enough for agents: the flows we actually ship authenticate a person in a browser, or a confidential client with a secret. An unattended agent …
Read more →Agent Identity vs Service Account
Agent identity vs service account is a layering split: the SA authenticates the worker pod, and the agent needs its own principal that can be revoked per …
Read more →Zero Trust Architecture for AI Agents
Zero trust architecture for AI agents means sandbox, egress, and identity, each assuming the others failed. Every action is authenticated as the agent, …
Read more →Running Agents in Production on Kubernetes
Running agents in production on Kubernetes takes a named identity for the agent, default-deny egress, a gate on tool calls, a demand signal that is not CPU, …
Read more →How Many Agents Per Kubernetes Pod
How many agents per Kubernetes pod is two numbers: live sessions equal workers, and registered agents equal snapshots. One live actor per worker pod at a time, …
Read more →One Run Is an Anecdote
One agent run is an anecdote. Nolan Lawson built the same specified app five times per JavaScript framework, reported the median with the range, and still saw …
Read more →