Archives

When monitoring client GCP projects, a broken permission that stops a check is as dangerous as a failing metric. Why our observability platform treats an inability to read data as a critical finding.

A rollback restores the code and leaves the database where the migration put it. Why "no rollbacks" depends on schema changes the previous release can still run against.

Per-matter prefixes, short-lived signed URLs, database-checked reads, and redacted logs for confidential documents in multi-tenant GCP apps.

Inbound replies and webhooks must link to the right record exactly once, and generated drafts must wait for a human. Two mechanisms from production systems: key on the sender id, hold behind a gate.

Code changes flow back into the knowledge graph the generator reads: changed files only, merge not replace, both artifacts patched. Freshness as write back, not retrieval ranking.

Hardening QuickBooks OAuth server side and structuring Profit and Loss, Balance Sheet and Cash Flow in Postgres so three reports read at different times still agree.

Grading an agent on the artifact it produced tells you nothing about how it got there, which is the one thing a tool-use environment exists to measure.

An agent has only your response bytes to reason from, which turns error messages into control flow and makes response size a correctness property.

Subscription state, idempotent Stripe webhooks and tenant scoped billing tables drawn from multi-tenant platform and ledger work.

Auditing Supabase Row Level Security for a multi-role SaaS pilot, testing tenant isolation role by role with the service key outside the test path.

Enforcing double-entry balance, integer minor units and append-only audit in Postgres with constraints that refuse the forbidden write.

Taking over cloud infrastructure someone else built, and why a read-only inventory answers the easy question rather than the one that decides the handover.

A thousand devices reporting over MQTT taught me that absent telemetry is ambiguous, and that the ambiguity gets worse the moment the device is allowed to move.

Read-only social API integration through Supabase Edge Functions in Deno and TypeScript, with tokens sealed server side and scoped to the minimum.

In a generated system the unit of review is not the output, it is the template that emitted it, because a defect there ships in every instance at once.

Putting a Go gateway in front of a Python RAG service to route across providers, stream safely, enforce per-customer budgets and cache without hiding failures.

An AI code generator that must compile and run its own output before it delivers, and the exit conditions that keep the loop from hanging.

Finding it meant ignoring the median, and controlling for the thing that made my first comparison lie.

Offset pagination has to produce every row it discards, and the fix has three parts that only work together: the sort key, the cursor, and the index.

A generated graph of 131 services can share one identity or carry 131 of them. The second costs 216 IAM bindings, and it is the only version where a leaked credential is survivable.

A 404 is not one thing, and the difference between text/plain, text/html and application/json was the entire diagnosis.

Adding multi-environment support to a platform that names its resources by service, and the collision that every successful deploy silently confirmed.

How generated Terraform learns to adopt infrastructure it did not create, and the three ways a cloud inventory lies about what things are called.

Generated infrastructure creates services before their containers exist, and a moving tag makes rollback a guess. Two fixes: read the live image before you write it, and pin to a digest.

Multi-tenant infrastructure generation, and the three design decisions that turned out to matter most.

Bridging 1,000+ MQTT devices into Pub/Sub, Spanner and BigQuery, and why a monotonic primary key quietly caps your write throughput no matter how many nodes you add.

A telemetry table that only grows forces three decisions: how you remove data, how many resolutions you keep, and what happens when a device reconnects and replays six hours of buffer.

Designing a Go alerting service where every operation worth doing is slower than the budget you have to respond in, and the sender retries if you are late.

A short post-mortem on recurring midnight outages on our internal PaaS, and why single-replica stateful services plus a maintenance window is a bad combination.

Why this site is a static Astro blog on GCS behind Cloud Run: near-zero cost, scale-to-zero, and deploys that are just git push.

Why this blog is a static Astro site served from a GCS bucket through Cloud Run, with zero footprint on any cluster and a scale-to-zero bill.