Write-ups of production systems I have designed and shipped. Focus on the design decisions and the tradeoffs behind them.
Every pull request gets its own isolated stack. The URL scheme is designed so AI agents can drive it exactly like a human user would. No mocks, no bespoke harness, no test doubles.
Read →Terraform breaks Cloudflare Log Push by changing rule IDs on every update. Forked an aging OSS operator, stripped it to the two CRDs I needed, rewrote the API layer. Rule IDs stay stable. SIEM correlation stays intact.
Read →Engineers were buying Mac minis and running personal AI agents on unmanaged hardware. Instead of banning it, I built an ECS-based sanctioned runtime with per-agent EFS isolation, IAM task role separation, and no public ingress. Same productivity, controlled blast radius.
Read →AI-driven observability operator, PCI DSS 3.x to 4.x migration, and multi-agent orchestration patterns are next.