Aquifer

The Aquifer agent platform (session/harness/sandbox split) powers River, a Slack-native coding agent, plus PR-review and headless Vanilla agent profiles; other teams have requested research, migration, and compliance-scan agents.

Company: Shopify
Approach type: Platform
Work supported: Coding, Code review
Interfaces: Slack
Deployment stage: Scaled
Evidence strength: Detailed primary
Entry reviewed: 2026-09-17

Copy as MD Ask ChatGPT

Capabilities and architecture

Model

The design lets Shopify change the model without changing the sandbox^{[Source 1]}The documented content is the swap design; no specific model is named.

Harness

Session (durable; Postgres append-only event log) + Harness (cheap agent loop) + Cell (ephemeral Go runtime); cells die, sessions persist^{[Source 1]}

Sandbox

An execution environment (filesystem, shell, repo, build/test) separated from the harness; Shopify credits the brain-and-hands framing to Anthropic^{[Source 1]}The brain-and-hands framing the claim credits to Anthropic appears in the capture only as an unnamed linked essay.

Tool access

Repo + tests + data warehouse + production traces + PR creation; a gateway credentials proxy^{[Source 1]}

Knowledge

Monorepo 'World' (code + skills + conventions + intent docs + runbooks + AGENTS.md); Nix reproducible envs; Slack-transcript corpus mining^{[Source 1]}

Context management

Skills loaded on-demand as files, updatable per session; session survival across cell/sandbox/machine death^{[Source 1]}

Credentials

Gateway credentials proxy and per-profile sandbox policies; the source does not name an SSO mechanism.^{[Source 1]}The credentials proxy and per-profile sandbox policy are documented; Shopify SSO is not named in the capture.

Interfaces

Slack is named; the capture documents pull-request creation but never names GitHub as the host.

slack

^{[Source 1]}

Mechanisms

Session/Harness/Sandbox split

Durable identity, disposable loop, isolated execution; swap any layer independently^{[Source 1]}

River (public-by-default)

River works in shared Slack threads whose history can be searched and used to update skills^{[Source 1]}

Skills as files

Written-down knowledge mined from successful patterns and public transcripts^{[Source 1]}

Documented uses

One River thread: public @river request through worked findings, a human redirect, and a searchable transcript.

Take a request in a public channel

A person @-mentions River with a question or task in a public Slack channel; River works only in the open^{[Source 1]}

Work the problem in the open

River reads files, runs queries and tests, and posts partial findings to the thread^{[Source 1]}

Absorb a mid-thread redirect

A second person drops in with a constraint or redirect; River incorporates it without losing the conversation and continues^{[Source 1]}

Leave a reusable transcript

The finished thread stays searchable so the next person starts from it, and observed patterns feed back into skills^{[Source 1]}

Access and controls

See documented credential and access boundaries in the architecture above. Scoped human-review assessments for individual uses remain in research details.

Reliability and validation

Not reported: Tests River runs are part of its work, and CI improvements serve human developers; no check of River's own output is documented.

Adoption and operating evidence

These results come from the sources. Notes below each result explain what it covers and any reported limits.

Headline claim

River use example: 1 in 8 merged PRs company-wide coauthored by River^{[Source 1]}

Reported by: Shopify
Scope: Merged River-coauthored PRs across Shopify
Denominator: All Shopify merged pull requests

About this result

Category: Adoption output
Evidence type: Reported measurement
What it covers: Company-wide merged pull requests coauthored by River

Key observation

River: 59,918 sessions / 30 days across 5,170 Slack channels^{[Source 1]}

Reported by: Shopify
Scope: River sessions and distinct Slack channels in a recent 30-day period
Method: river_sessions domain table, written by River every session

The source does not report the denominator of this figure.

About this result

Category: Adoption output
Evidence type: Reported measurement
What it covers: River sessions and distinct Slack channels over a recent 30-day period

Key observation

3,536 River-coauthored PRs merged; 1 in 8 merged PRs company-wide^{[Source 1]}

Reported by: Shopify
Scope: River-coauthored merged PRs in the recent 30-day period; company-wide PR share
Denominator: All Shopify merged pull requests for the one-in-eight share
Method: river_sessions domain table for reported session-linked counts

About this result

Category: Adoption output
Evidence type: Reported measurement
What it covers: River-coauthored merged pull requests and their company-wide share in a recent 30-day period

Key observation

River: Median session 19 min; median 50 tool calls/session^{[Source 1]}

Reported by: Shopify
Scope: Median River session duration and tool calls per session

The source does not report the denominator of this figure.

About this result

Category: Cost latency
Evidence type: Reported measurement
What it covers: Median River session duration and median tool calls per session

Lessons

Reported opinion: Shopify says its monorepo, reproducible environments, written skills, and CI improvements benefited both engineers and agents.^{[Source 1]}

Shopify uses shared River threads and the run corpus to update skills, prompts, and defaults for later work.^{[Source 1]}

Aquifer stores session identity and its event log in Postgres so a fresh worker can continue the same conversation.^{[Source 1]}

Shopify adds agent variants as profiles containing prompts, skills, extensions, sandbox policy, and model defaults on Aquifer.^{[Source 1]}

Back to infrastructure

Improve this record

Give your coding agent the context and instructions to prepare a source-backed update.

Suggest on GitHub

Paste the prompt into your coding agent, then describe the correction or add a public source.

Preview prompt

Help me update the Internal Agents Map record for Aquifer at Shopify.

Repository: https://github.com/steel-experiments/internal-agents-map
Record: data/agents/shopify-internal-agents.yaml
Published record: https://internal-agents.com/agents/shopify-internal-agents
Readable context: https://internal-agents.com/agents/shopify-internal-agents.md

Use the correction or public source I provide in this conversation. If I have not supplied either, ask what I want changed before editing.

Use an existing checkout of this repository, or clone it if needed. Read the current record from the repository. Follow AGENTS.md, CONTRIBUTING.md, and the relevant instructions in data/schema.md.

Verify that the evidence supports the requested change. Preserve uncertainty and distinguish reported facts from catalog judgments. Follow the repository process for capturing new sources. If evidence is insufficient, explain the gap instead of inventing details.

Make a focused change on a branch. Regenerate derived files and run the required checks. Do not edit generated content by hand.

Show me the change, supporting evidence, and check results, including any checks you could not run. Ask whether to submit a pull request unless I already requested one. Do not merge the pull request. If you cannot edit the repository, prepare a source-backed issue draft.

Sources and research details

Citations link to the original publisher. Each source also keeps a preserved copy in the repository, so a changed or removed page stays checkable.

Under the Riverhttps://shopify.engineering/under-the-riverEngineering blog · First party · Last source verification: 2026-08-31
Preserved copy

Question coverage and scope

purpose: Reported
workflow: Reported: The article documents exactly one representative workflow, the well-going public River thread; PR review and the headless Vanilla profile are separate Aquifer profiles, not steps of this run.
human involvement: Not applicable: There is no single platform-wide agent review boundary. Scoped downstream operating-model claims remain in research details; access controls are described separately.
implementation: Reported
validation: Not reported: Tests River runs are part of its work, and CI improvements serve human developers; no check of River's own output is documented.
observations: Reported
lessons: Reported

Research details for every claim on this page

Summary
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Headline claim
Statement type
Metric
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
Reported by
Shopify
Scope
Merged River-coauthored PRs across Shopify
Denominator
All Shopify merged pull requests
Method
Not reported
Observation date
Not reported
- SupportsUnder the RiverPreserved content.md, lines 12
Sandbox
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Harness
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Model
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Interfaces
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Tool access
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Knowledge
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Credentials
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Context management
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Session/Harness/Sandbox split
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
River (public-by-default)
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the RiverPreserved content.md, lines 71-79,87
Skills as files
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the River
Take a request in a public channel
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the RiverPreserved content.md, lines 69, 75
Work the problem in the open
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the RiverPreserved content.md, lines 65, 76
Absorb a mid-thread redirect
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the RiverPreserved content.md, lines 77-78
Leave a reusable transcript
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsUnder the RiverPreserved content.md, lines 71, 79
Key observation
Statement type
Metric
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
Reported by
Shopify
Scope
River sessions and distinct Slack channels in a recent 30-day period
Denominator
Not reported
Method
river_sessions domain table, written by River every session
Observation date
Not reported
- SupportsUnder the RiverPreserved content.md, lines 83
Key observation
Statement type
Metric
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
Reported by
Shopify
Scope
River-coauthored merged PRs in the recent 30-day period; company-wide PR share
Denominator
All Shopify merged pull requests for the one-in-eight share
Method
river_sessions domain table for reported session-linked counts
Observation date
Not reported
- SupportsUnder the RiverPreserved content.md, lines 12, 83
Key observation
Statement type
Metric
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
Reported by
Shopify
Scope
Median River session duration and tool calls per session
Denominator
Not reported
Method
Not reported
Observation date
Not reported
- SupportsUnder the RiverPreserved content.md, lines 65
Lesson
Statement type
Opinion
Provenance
Reported
Confidence
Medium
Confidence reason
The retrospective identifies these as existing human-development priorities made more urgent by agents; it does not quantify each contribution.
- SupportsUnder the RiverPreserved content.md, lines 24-25,38-47
Lesson
Statement type
Fact
Provenance
Reported
Confidence
Medium
Confidence reason
The article describes mining earlier runs and preserving searchable threads, replacing the vague claim that private agents cannot teach anyone.
- SupportsUnder the RiverPreserved content.md, lines 57,71,79,87
Lesson
Statement type
Fact
Provenance
Reported
Confidence
Medium
Confidence reason
The session and lifecycle sections explicitly separate the durable log from disposable cells; they do not claim every external side effect is automatically recoverable.
- SupportsUnder the RiverPreserved content.md, lines 116-134
Lesson
Statement type
Fact
Provenance
Reported
Confidence
Medium
Confidence reason
The profile section enumerates the bundle contents and explains how a new bundle becomes an internal agent product.
- SupportsUnder the RiverPreserved content.md, lines 142
Operating model assessment
Unclassified for River coding request → River-opened, River-coauthored pull request; human attention boundary: unknown.
Statement type
Inference
Provenance
Catalog judgment
Confidence
Unverified
Confidence reason
The source documents River-opened, River-coauthored pull requests that are later merged, but no passage establishes that a person reviews the work product on each run; PR review runs as a separate Aquifer profile and is described as often having no human in the loop.
Observation date
2026
- SupportsUnder the RiverPreserved content.md, lines 65, 83, 140

Capabilities and architecture

Mechanisms

Documented uses

Access and controls

Reliability and validation

Adoption and operating evidence

Lessons

Related reading

Agents using this

Sources and research details