Articles
In-depth articles on AI, web development, cloud native, and indie hacking.
A diff generated by an agent doesn't mean the engineering task is done. This article builds validation gates—static checks, targeted tests, regression scope, migration review, and human confirmation—so every patch carries traceable, mergeable evidence.
Chat, collaboration, push notifications, and real-time dashboards need server-initiated delivery, which HTTP handles poorly. This article explains WebSocket fundamentals, when to use it versus SSE or polling, connection management, broadcasts and rooms, Redis Pub/Sub scaling across instances, and common real-time architecture choices.
A line of text in a terminal doesn't mean a command actually ran in the approved way. This article defines an immutable receipt for command argv, cwd, executable, policy decision, exit status, and output digest, while preventing secrets from spreading through logs.
Redis is more than a cache. In distributed systems it provides locks, rate limiting, messaging with pub/sub and Streams, leaderboards, and session storage. This article explains each use case and its key reliability concerns, including safe lock release, Stream consumer groups, and accurate rate limiting.
A larger context window doesn't mean you should hand the whole repo to the model. This article covers task-level token budgets, layered summaries, evidence references, cache invalidation, and compression-quality checks to keep a coding agent's engineering judgment intact within limited context.
Microservices are not a silver bullet; a bad decomposition hurts more than a monolith. This article explains the core patterns: service boundaries, interservice communication (synchronous vs. asynchronous), API gateways, service discovery, distributed transactions, observability, and, most importantly, when to use microservices (most teams should not).
A single error message and the final patch aren't enough to prove a bug was reproduced. This article defines a content-addressed debug evidence bundle that freezes code, uncommitted state, dependencies, inputs, and failure criteria, so an isolated runner can first observe the old failure, then verify the new fix.
Authentication and authorization underpin every product, yet many developers remain unclear about how OAuth, OIDC, JWT, and sessions relate. This article explains sessions vs. JWTs, OAuth 2.0 flows, OIDC's authentication layer, SSO implementation, token storage, and security so the concepts no longer feel tangled.
A plugin that behaves correctly now does not guarantee the next automatic update stays read-only on the repo. This article binds extension artifacts, publisher provenance, permission capabilities, and update generations into an admission contract, using isolated canary runs and revocation drills to control IDE, MCP, and Agent plugin supply chains.
GraphQL is flexible and powerful, but production brings pitfalls: N+1 queries, complex-query attacks, difficult caching, and overly coarse authorization. This article covers DataLoader, depth and complexity limits, persisted queries, caching strategies, and field-level authorization.
Automatic retries can disguise flaky tests as green. This article establishes failure fingerprints, environment capture, deterministic reproduction, time-boxed quarantine, and recovery gates so that Agents can handle flaky tests without weakening regression protection.
Data is life; lose it and you are done. This article explains PostgreSQL high availability and disaster recovery: streaming replication, synchronous vs. asynchronous replication, physical backups with pg_basebackup and WAL archiving, logical replication, the 3-2-1 backup strategy, and recovery drills that help databases withstand failures.