In this article 5 sections

OpenAI says Pando now handles all Git traffic for its monorepo. The company reports nearly a petabyte of daily traffic, a median push-latency reduction of nearly 80%, and one production hour in which the system served 57 TB while more than 99% of bytes came from local disk cache. Those are provider-reported results, not an independent benchmark, but the underlying design decision is concrete: Pando stopped coordinating every branch into one repository-wide snapshot. (OpenAI)

Instead, Pando serializes updates to each Git ref and preserves causal history for the packfiles behind that ref. Two clients can fetch different combinations of branch versions at the same moment. OpenAI argues that users and coding agents generally depend on the order of updates to one branch, not a total order across every branch in the repository.

That trade creates scale by narrowing the consistency contract. It does not eliminate consistency work. It assigns that work to the parts of the system whose invariants genuinely span multiple refs.

The coordination boundary moved from repository to ref

A push arrives as an immutable Git packfile. Pando streams that pack to blob storage, validates it in one pass, and writes a ref version containing the new tip, the supplying pack, and earlier ref versions on which the pack depends. A metadata transaction then advances the ref pointer. OpenAI says this gives the writer read-your-own-write behavior with O(1) metadata reads and writes.

A fetch starts from the history the client already has. Pando selects the additional packs required to reach the requested ref version, returns packfile URIs, and lets regional caches serve the bytes. The metadata lookup grows with the distance between versions, while immutable packs can be reused across requests. Background compaction builds larger covered sets without deleting the original packs, which preserves dependency edges while reducing fetch planning and transfer overhead.

The important abstraction is not simply “eventual consistency.” Pando offers a stronger, scoped contract:

  1. Updates to one ref are serialized.
  2. A reader of a ref receives the causal history needed to reconstruct it.
  3. A writer can read its own successful update.
  4. Reads of several refs do not form an atomic repository snapshot.

The fourth point is where application design begins. A merge queue that checks a target branch and a policy ref, a release process that signs several refs together, or a compliance job that inventories every branch may require a consistent cross-ref view. Those consumers need an explicit snapshot identifier, a manifest of accepted ref versions, or a higher-level transaction. Repeating reads until they look stable is not a substitute because concurrent writers can keep producing individually valid but mutually different views.

Immutable data makes both scale and migration easier to reason about

Pando also changes what the server advertises during negotiation. By advertising only trunk as shared history, it makes incoming packs easier to reuse. A side-branch push may resend commits already present in an earlier side-branch pack, but OpenAI reports a median pack below 20 KiB and a 99th percentile below 3 MiB. The bandwidth trade is accepted to reduce coordination and improve cacheability.

The migration path is as instructive as the steady-state design. OpenAI placed Pando in a read-through and write-through proxy in front of the old backend, compared behavior, and shifted traffic in phases. The proxy deduplicated requests so validation traffic would not overload the legacy system. The team also used Git conformance tests, deterministic simulation, and formal specifications in Lean and TLA+.

Uber described a complementary design in July 2026. Its GitFarm does not replace repository storage. It centralizes Git clients behind a gRPC service, then assigns requests to pre-warmed checkouts inside ephemeral sandboxes. Uber reports that one read-heavy ownership service cut CPU from more than 70 cores to 16, memory from 400 to 600 GB down to 32 GB, and startup from 15 to 20 minutes to under one minute. Another compliance workflow reduced median latency from 110 to 160 seconds to 20 to 30 seconds. These are also company-reported results, but the comparison clarifies the design choice: Pando changes server-side consistency and object delivery, while GitFarm removes duplicated client state without becoming the system of record. (Uber Engineering)

For an internal platform team, this suggests a practical sequence:

  • Write the consistency table before the performance test. Name which operations are serializable, causal, read-your-own-write, or unconstrained across keys.
  • Identify every consumer that joins multiple coordination domains. Those are the callers most likely to depend on an accidental global snapshot.
  • Preserve immutable inputs and versioned metadata during migration. They make dual reads, replay, and disagreement analysis possible.
  • Measure cache origin, not only cache hit rate. A high hit rate is useful only if the hit is tied to the requested version and dependency set.
  • Test the compatibility surface with production-shaped clients. Git behavior includes negotiation, hooks, large object flows, merge queues, and long-lived automation, not only clone and push.

OpenAI says the first production version was designed by one engineer, implemented with coding agents, and deployed by a small team in ten weeks. That is evidence about this project, not a general productivity coefficient. The reusable lesson is that fast implementation raises the value of executable invariants, simulation, and phased migration. It does not reduce the need for them.

Infrastructure watch: vLLM 0.33 is an upgrade event

vLLM 0.33 was released on November 2 with 927 commits from 389 contributors. The project added model support, new speculative-decoding paths, hardware-specific kernels, a /v1/decisions endpoint for supported generation models, token embeddings with optional late chunking, and a watchdog that can dump traces from stuck engine and worker processes. The release notes also report substantial throughput and latency gains on specific model and accelerator combinations. Those measurements come from the linked pull requests and should be reproduced on the target workload. (vLLM)

The migration surface matters more than the headline benchmark. Default release wheels and images move to CUDA 13.0, CUDA 12.9 artifacts are no longer published, and the default ROCm stack moves to ROCm 10.0 while separate ROCm 7.2 artifacts remain available. Medusa and the MLP speculator are removed, the legacy Ray compiled-graph executor is removed, and requests received while generation is paused now return HTTP 503.

Treat 0.33 as a versioned platform change. Pin the image digest, replay representative request mixes, compare model outputs and tool-call schemas, exercise pause and recovery behavior, and validate the hardware matrix before changing a shared serving fleet. A benchmark improvement on one kernel does not prove end-to-end improvement after queuing, tokenization, network transfer, and fallback behavior are included.

Stay Sharp: session guarantees are product contracts

The 1994 paper Session Guarantees for Weakly Consistent Replicated Data separated four promises that an application can request without requiring every replica to expose one global snapshot: read your writes, monotonic reads, writes follow reads, and monotonic writes. The guarantees can be layered on a weakly consistent store, but each one restricts which replicas are eligible to serve an operation and can therefore reduce availability. (Terry et al.)

Pando makes this old distinction operationally visible. Read-your-own-write is useful after a push, but it does not imply monotonic reads across unrelated branches or an atomic view of all refs. The same distinction appears in AI systems that store agent checkpoints, evaluation results, prompt versions, and deployment manifests in separate records.

Before choosing a consistency mechanism, write one failure sentence for each user journey: “After I publish version N, this session must never observe a version older than N,” or “A deployment may start only from a manifest whose model, prompt, tools, and policy versions were approved together.” The first can often be satisfied by a session guarantee. The second needs a versioned aggregate or transaction. Naming the required observation is more useful than labeling the whole system strongly or eventually consistent.

Watch next

  • Whether OpenAI publishes failure distributions, recovery objectives, or independent measurements for Pando beyond median push latency and cache-served bytes.
  • Which cross-ref consumers required compatibility work during the migration, especially merge queues, release tooling, branch protection, and compliance inventory.
  • Field reports from vLLM 0.33 upgrades across CUDA 13.0, mixed accelerator fleets, speculative decoding, and paused-generation recovery.
  • Whether future Git protocol work makes version manifests or cross-ref snapshot semantics explicit without returning to repository-wide write coordination.