The garden

Agent memory is a data modeling problem wearing an AI costume — and the 2026 memory-system landscape (Letta, Cognee, bi-temporal organizational graphs) has converged on the same answer: typed, structured, provenance-carrying records. Schema decisions matter more than embeddings.

Persistent memory is an attack surface and a compliance surface; retention, provenance, access control and deletion must be designed before retrieval quality matters — and memory control-flow hijacking makes the store a command channel if you don't.

Metrics dashboards answer how often an agent fails; only full trajectory capture and replay answers why — the unit of observability for an agent is the complete decision trace, and replayability should be a design requirement.

An agent can be 100% up and still failing constantly; reliability engineering for agents means enumerating and designing for semantic failure modes, not infrastructure availability.

Long-running agent work must survive process death, redeploys, and rate-limit stalls; durable execution is the WAL of agentic systems — an architectural requirement, not an optimization.

The workflow-vs-agent decision is economics: if the path can be enumerated in advance, a deterministic workflow is cheaper, testable, and auditable — spend agent autonomy only where enumeration costs more than supervision.

Every compaction strategy is a lossy compressor; the failure isn't compression, it's never deciding what class of information you're willing to lose.

What goes in the context window, in what structure, with what priority, is schema design — representation, grain, and ownership of information. Prompt engineering by vibes is schema design done badly.

LLM cost is determined by architecture decisions — caching strategy, context discipline, model routing, gateway budgets — made months before the invoice arrives.

Evals are the executable definition of "working" that gates every change, like a test suite; without them every prompt tweak and model upgrade is an unreviewed production change.

Retrieval quality is mostly decided at write time. Treat agent memory reads the way a database treats queries: plan them, don't just embed and hope.

You cannot instruct your way out of an architecture flaw. Assume injection succeeds, then bound what it can reach.

Most RAG failure is ingestion failure — chunking, freshness, metadata, index lifecycle — while teams debug the retriever and reranker downstream.

Conflating resumable session state with long-term memory produces systems that do both badly — the lifecycles, consistency needs, and storage are different.

The engineering value of sub-agents is a fresh, scoped context window — isolating noisy exploration and bounding blast radius — not an anthropomorphic org-chart of specialists.

80% of enterprise AI initiatives stall between demo and production. The model was never the problem — integration, data, and ownership are.

The differentiated engineering in an agent system lives in the harness — context assembly, tool execution, permissioning, loop control, recovery — while models are swappable components.

A tool schema is an API whose caller is probabilistic: descriptions are the documentation the caller actually reads, errors must teach recovery, and schema ambiguity becomes wrong calls at runtime.

An MCP server is third-party code with prose injected into your context and credentials in its hands — a supply-chain trust decision, not an app-store install.

"The agent did it" is not an audit answer; regulated environments need an accountability chain designed into the architecture, because it cannot be reconstructed afterwards.

LangGraph, CrewAI, and AutoGen abstract the loop the way ORMs abstract SQL — the demo gets easy, and the debt comes due in production. What frameworks genuinely earn is persistence and contracts; the orchestration vocabulary is where the lock-in lives.

MCP, A2A, SLIM, and WebMCP are already layering the way networking did; bet on layer boundaries and protocol-independent invariants — identity, delegation chains, audit — not on a single winner.

CodeAct showed up to 20% higher success and ~2x fewer steps: code composes tools with loops and variables where JSON spends a round-trip per call. The advantage has a competence threshold and a security bill — match the action space to the task's compositionality.

Pixel-in, action-out is the most expensive and most fragile way to integrate with software — treat GUI automation as the fallback for when APIs don't exist, and engineer the fallback like the hazard it is.

Sampling, mixture-of-agents, and debate are redundancy priced in tokens; write down the exchange rate, because a verifier or uncertainty-routed escalation often buys the same reliability cheaper.

Prompt drift, provider drift behind unchanged model IDs, slow quality decay — a frozen suite is structurally blind to all of it. Control charts, judge sampling, and gated rollouts are the eval that runs on truth; invert the eval budget toward monitoring.

LoRA and QLoRA made the tuning run cheap and disposable. The dataset — curated instructions, preference labels, filtered trajectories — is the asset that survives base-model churn, and it deserves data-engineering discipline.

Refusal copy, false-positive rates, gate frequency, and guard latency are what users actually experience at the boundary — the soft guardrail layer is product design, resting on a hard deterministic floor that isn't.

Production hallucination usually traces to the pipeline — failed retrieval, stale knowledge, ungrounded prompts, missing abstention paths — so treat it with systems engineering, not model shopping.

Retrieval systems answer from what they indexed, not from what's true now; freshness must be engineered as lifecycle, not hoped for from the retriever.

The characteristic failure of long-running agents is gradual coherence loss that no retry logic catches, because every individual step succeeds; you need budgets, drift detection, and deliberate re-grounding checkpoints.

Failure taxonomies keep finding that individual agents mostly do their jobs — systems fail at the edges: misunderstood handoffs, divergent state, lost context. Topology and edge contracts deserve the design attention.

1–7B models, mature quantization, and sub-50ms local tokens make placement the real design question: partition agent functions by latency class and data sensitivity — and let memory bandwidth, not TOPS, decide what fits.

OPRO, DSPy, and ProTeGi turn intent plus evals into prompt text. Once prompts are compiled artifacts, hand-editing them is patching a binary — version the sources, pin the model, and gate changes with regression suites.

Test-time compute made planning quality purchasable per query — but self-verification still fails, external verifiers still decide what's true, and planning discipline survives the new price list.

An agent's attack surface shifts with every model, prompt, and tool change — red teaming has to run continuously in CI with utility-under-attack metrics, not as a point-in-time audit.

A classic cache returns the right answer or nothing. A semantic cache can return a confident wrong answer at cache speed — so operate it like a retrieval model with thresholds and evals, not like a Redis instance.

Sandbox selection is a blast-radius calculation, not a security fashion choice: ask what the worst accepted action costs, then buy exactly that much isolation.

The warehouse world solved 'a fact changed and we need both current truth and history' decades ago; agent memory teams are reinventing it badly.

The boundary where an LLM meets deterministic software is a schema contract; constrained generation, validation-and-retry, and repair layers are the serious engineering at that seam.

Articles 9, 12, and 14 read as an architecture spec: tamper-evident logging, intervention surfaces, iterative risk management. The Act's agentic gaps make conservative design the rational default — and Annex III enforcement began this month.

Routing, fallbacks, budgets, tenancy, residency, model pinning — the gateway is the one chokepoint every token crosses, which makes it where cost, reliability, and compliance policy actually execute. Treat its config as versioned policy code.

A production voice agent is a hard real-time system with a ~400ms end-to-end budget; pipeline shape, turn detection, barge-in policy, and caching are all spends against it.

There is no shortcut through embeddings. Data that can't support analytics semantics can't support an agent's decisions either.

Schema change without negotiation is the root cause of most pipeline breakage and silent AI degradation; contracts turn data interfaces into APIs with semantics.

Agent memory needs cheap append, time travel, schema evolution, ACID merge, and multi-engine access — exactly what open table formats and the lakehouse already deliver.

Text-to-SQL against raw schemas fails on semantics, not syntax; a semantic layer makes NL2DB reliable by moving meaning from the prompt into the platform.

The composability of the modern data stack is a byte-layout agreement: Arrow in memory, Parquet on disk, zero-copy at every boundary. Standardize on the format pair and the engines become interchangeable parts.

The data-product idea fails in operation: no owner after launch, no deprecation path, no feedback loop. A data product without an operating model is a dataset with a logo.

The vault-vs-star argument is resolved by measurement, not loyalty: count your sources, measure their churn, check your audit obligations. The vault absorbs change in Silver; the star provides meaning in Gold — a pipeline, not a rivalry.

When agents become first-class data consumers, metadata stops being documentation: what an agent can discover, query, and be permitted to do is executed through catalogs, contracts, lineage, and policy — not described by them.

Agents act now, on current state — batch-refreshed data that was fine for human dashboards becomes an error source for autonomous action. Streams, real-time OLAP, and activation paths shift from luxury to default.

"Our product gets better with usage data" is an architecture claim — capture points, feedback pipelines, labeling loops, and retraining triggers must physically exist. The moat is the pipeline, not the intention.

Embedding search is an index type with HNSW/IVF trade-offs, filtering, and tenancy concerns — increasingly living inside databases you already run. Evaluate it like an index, not a category purchase.

Third normal form is a starting position, not a destination. Where you sit on the normalization spectrum is a workload decision.

Choosing between strong and eventual consistency is choosing which anomalies your users experience — make it explicitly, with product stakeholders in the room.

Most CRUD apps never replay anything and pay the event-sourcing complexity tax forever; agent systems are the rare case where replay IS the product — debugging, audit, and resume all consume the log.

Retries are the universal failure response, and retries without idempotency convert failures into duplicates; designing safely repeatable operations is decades-old discipline agentic tool execution makes urgent again.

Context window as RAM, tools as device drivers, permissions as user vs kernel space, the loop as a scheduler with budgets — the analogy imports fifty years of resource-management discipline, right up until the kernel turns out to be stochastic.

A spec's primary value isn't documentation — it's forcing decisions to be made while they're still cheap.

Seat pricing assumes value scales with humans logged in — exactly the assumption AI products break. Usage and outcome pricing demand metering infrastructure and margin discipline most SaaS companies don't have.

The demo sells capability; procurement buys accountability. Audit trails, permission models, and certifications decide enterprise AI deals — the graduated trust ladder is the real product, so put the audit trail in the demo.

Vertical agent products defend on encoded domain constraints, workflow integration, compliance postures, and proprietary feedback data — not on having a better model. The constraint set is the product.

The goal is calibrated trust, not maximum trust. Approval UX is a security property, and every permission dialog is spending a budget.

A design system was always a constraint system pretending to be a component library. Generative UI makes it literal: machine-readable tokens and rules become the grammar the model composes in — and the ablations price the constraint set at ~100 ELO.

When the model emits interface rather than paragraphs, design systems become grammars the model composes in — the designer's job shifts from drawing screens to defining the constraint system the generation must obey.

When visual elegance and usability heuristics pull in opposite directions, which one yields — and why.

Quotas, gang scheduling, isolation profiles, readiness probes, scale-to-zero — every "agent infra" requirement has a mature platform primitive. The substrate is solved; spend the novel engineering on the semantic layer, where agents genuinely are new.

Agents change fast and need audit, rollback, and drift detection more than any workload before them — declarative desired state in git with reconciliation is precisely that discipline.

The alternative to policy-as-code is policy-as-meetings — and agents move too fast for meetings. Evaluable, versioned, auditable policy converts 'too risky' into 'risky actions denied by policy X', which is a yes.

Atomic notes, an explicit taxonomy, and hub navigation turn accumulation into teachable structure — curriculum design becomes a query over a knowledge graph instead of a blank outline.

Sequencing learning so each layer is load-bearing for the next — and why most training fails at layer two.

Autonomy is granted in scopes and earned by track record — read-only before write, review-everything before spot-check, narrow domain before broad. Skipping rungs fails the same way for agents and juniors alike.

Tool knowledge depreciates at the vendor's release cadence; judgment — when to delegate, how to specify, how to verify, when to distrust — compounds. Teach the tool as the vehicle, not the destination, and preserve the work that keeps people qualified to supervise.