Corey James- 1 mintimer cadence for container cleanup
- 2 minpoller cadence in FAFOHive
One declared fleet for the access plane
Auth and access plane holds the operations layer, and I wanted the fleet's behaviour fixed in configuration. A few dozen services sit under one stack target, with explicit ordering, and the unit files and an inventory are versioned with the code.
PartOf cascades carry a dependency's restart through to its dependants, drop-ins make data-store clients wait for the network and declare cascade membership, and Docker-wrapped services are managed like native ones. Routine work such as container cleanup is a timer, visible and controllable on its own rather than a loop hidden in a script.
Sandboxing the unit that faces the public
The OAuth server faces the public, so its unit runs sandboxed. Its secrets arrive through LoadCredential, so they sit in no environment variable or readable file.
Governance work that runs with nobody present
AgentOS has governance work that must carry on with nobody present. Timers drive its background checks and work-order status reporting. A templated unit runs one bridge instance per activation, so many instances come from one definition, and the member runtime that hosts managed agent seats is its own service.
Pipeline services that restart on their own
Inference Fabric is a set of systemd services, each restartable on its own, so one service can be upgraded without draining the pipeline. See Millions of queued items that were not there.
Secrets and timers for the social modules
FAFOHive's in-house social modules get their secrets through LoadCredential, and their poller runs as a timer. The reverse proxy in front refuses outside callers on the modules' control endpoints.
I build services to be operated: declared dependencies, sandboxing on anything public, secrets handled by the init system and recurring work in the open.