Articles
In-depth articles on AI, web development, cloud native, and indie hacking.
External web pages, RAG fragments, and tool results remain untrusted even after being summarized. This article designs taint tags that propagate with data across steps, deterministic sink policies, audit events, attack testing, and isolated rollback.
Agent failures are usually not service crashes, but wrong tool selection, stalled loops, permission waits, or runaway budgets. This article designs a replayable Agent observability solution around task traces, step status, toolchains, manual confirmation, and runtime budgets.
Neither bot visits nor traditional impressions directly prove a page is cited in AI answers. This article establishes a repeatable question panel, citation normalization, and intervention records to avoid manufacturing GEO conclusions from scattered screenshots.
For RAG and semantic search, choosing a vector database is unavoidable. This article compares pgvector, Qdrant, Milvus, Chroma, and Pinecone by data scale, latency, operational cost, and hybrid search, with clear recommendations for when to use each.
Recording model deployments and IAM changes is not enough—attackers may disable logs, tamper with objects, or shorten retention periods. This article establishes an independent security domain, a digest chain, and gap detection.
Your service is running, but is it healthy or slow? This guide explains the classic Prometheus + Grafana stack: metric types, the pull model, PromQL fundamentals, application instrumentation, Grafana dashboards and alerts, and how logs and traces complete the three pillars of observability.
Inference workers, evaluation jobs, and model builders should not share cloud keys. This article separates the audiences of source credentials, exchange requests, and output tokens, and uses profiles and resource policies to block identity confusion.
Nginx is the most common reverse proxy and gateway in deployments, yet many developers only know how to copy a configuration snippet. This guide covers location matching, proxy_pass, X-Forwarded-* headers, load balancing, HTTPS/TLS, worker/buffer/gzip tuning, and common WebSocket, large-upload, and streaming pitfalls.
"Local mode" and "enterprise no-training" are not enough to prove code stays within bounds. This article binds repository classification, task materials, execution location, model calls, and residue cleanup into a verifiable routing contract, and defines safe degradation when cloud capability is unavailable.
A URL shortener is a classic system design interview problem spanning reads, writes, uniqueness, redirects, caching, and scaling. This article covers requirements, short-code generation, storage, 301 vs. 302 redirects, caching, sharding, and how to explain design tradeoffs during an interview.
Being able to export chat JSON doesn't mean you can leave a coding tool. This article defines a content-addressed exit package covering repository rules, task checkpoints, approvals, tool configuration, and audit receipts, and uses a cold start with an alternative tool to prove migration and revocation are truly complete.
Feed systems are a demanding design problem: high read and write volume, ranking, real-time delivery, and scalability. This article explains push, pull, and hybrid models; timeline storage; popular content; pagination and end-of-feed behavior; and what to choose at tens of thousands versus hundreds of millions of users.