The agent I built in the Console could not be adopted by ant apply
ant apply refuses some drift and silently duplicates other resources. Here is where that line sits, why claude-lock.json belongs in your commits, and the five doors a second copy walks through.
One Shared Managed Agent Definition, Overridden Per Session
A design for collapsing four near-identical Managed Agents into one base definition, using agent version pinning and session-local overrides — with a validated factory and the traps I hit along the way.
When Memory Store Listings Returned Half the Rows: Migrating to agent-memory-2026-07-22
agent-memory-2026-07-22 changed memories.list: fixed ordering, stricter depth, segment-based path_prefix matching. How an audit quietly halved, an access layer that survives it, finding every call site with ast, and measured depth=1 traversal cost.
Connecting Managed Agents to Services You Don't Want to Expose: MCP Tunnel Design
How to connect Claude Managed Agents to an internal MCP server that is never exposed to the public internet. We cover the MCP tunnel, self-hosted sandboxes, authorization boundaries, and graceful degradation when things break.