Articles
In-depth articles on AI, web development, cloud native, and indie hacking.
Evidence that works at the beginning may be missed in the middle. Build position-controlled metamorphic cases and block model or context-assembly regressions using worst-position performance rather than averages.
Function Calling is how an Agent affects the real world, but several engineering gates separate “the model wants to call a tool” from reliable completion. This article explains the mechanism, parallel and multi-round calls, argument validation, error recovery, and its relationship with MCP, taking function calling from working to production-ready.
A successful charge does not mean the seller's share is ready for payout, and a successful transfer does not prove bank settlement. This article freezes share policies and settlement batches, then uses a balanced multi-party ledger, reserves, stable payout identities, and UNKNOWN reconciliation to prevent overpayment and duplicate payouts.
CORS and CSP sound similar but serve different purposes: CORS governs cross-origin reads, while CSP controls what a page may load. This guide covers simple requests, preflights, credentials, CSP source and inline-script restrictions, common pitfalls, and a production-ready set of security headers.
MCP Server audit logs need more than a one-line success or failure entry. This article covers call correlation IDs, authorization decisions, input/output summaries, sensitive-field redaction, retention policies, and event queries that provide an evidence trail for security and troubleshooting.
Code deployment is not feature release. Feature Toggles let you deploy code with functionality disabled and enable it when needed. This article covers four Toggle types (release, experiment, ops, and permission), implementation tiers, lifecycle cleanup, and the real costs of conditional complexity.
URL mode accept only means that the user agreed to navigate; it does not prove that authorization or payment was completed. This article separates form data from sensitive credentials and binds user identity, target domains, completion notifications, and retries of the original request.
Manually trigger downstream synchronization after every database change? CDC automatically captures changes and streams them to search, caches, data warehouses, and services in real time. Learn how WAL-based CDC works, how Debezium implements it, where it fits, and why it outperforms dual writes and scheduled polling.
A successful `initialize` does not let either side add or remove features freely during a session. This article seals the protocol version, both parties’ capabilities, implementation identities, and the `initialized` boundary into an auditable receipt, preventing existing connections from using capabilities negotiated only later.
Forms are frontend's most tedious work: validation, error messages, dynamic fields, and submission. This article covers complete React form practices: React Hook Form vs. Formik, Zod validation, controlled vs. uncontrolled inputs, Server Actions, and handling complex array and nested data.
The most dangerous failure in a multi-tenant MCP Server is not an error, but silently returning Team A’s data to Team B. This article presents a complete isolation design spanning identity context, query constraints, caching, tool parameters, and testing strategy.
PostgreSQL's killer feature is its extension ecosystem: pgvector for vector search, PostGIS for geospatial data, TimescaleDB for time series, and zhparser for Chinese tokenization. This guide covers their value, 10 popular extensions, installation and management, and when one PG instance can replace multiple components.