A token broker that let my sandbox call APIs it could never authenticate to
How an untrusted, autonomous agent reaches a customer's credentialed API without ever touching the credential — identity from an unforgeable token claim, never a request header.
The LLM wrote the code. Now where do you run it?
Running model-authored, attacker-influenced code means matching the isolation boundary to the threat. Why containers are the wrong default and microVMs are the sweet spot.
The queue was the answer the whole time
A distributed job system whose hardest bug wasn't the jobs — it was delivering the completion signal. When a message can't route, change the road, not the messenger.
Why my LLM stream died at exactly 45 seconds
A Go WriteTimeout guillotine, an EventSource that never reports its own death, and why I deleted the streaming code and shipped a polling loop instead.
The rename you're afraid to do
Migrating a live, stateful database without a big bang. The ordering is the whole lesson: dual-shape reads, canonical-only writes, and never leave the old path both required and unsupported.
The feature was built. It just didn't do anything.
Four bugs across four layers, one disease: successful nothing. Green dashboards, exit code 0, and features that quietly never ran.