André Loreth
André is a founder of abi group. He leads product engineering and builds the technical infrastructure behind abi group's products and consulting work.
LinkedIn Profile →Articles by André Loreth
Standards? Standards! What we adopt, what we invent, and what we refuse to decide twice
Why we adopt the standards other people already wrote, insist on writing our own where nobody else can, and treat every question answered a second time as time taken from the work that actually matters.
The XY Problem: why the solution you arrived with is usually not the one you need
Clients rarely bring us a problem. They bring us a solution they already picked, and the problem behind it never gets stated. Here is how we get back to it, and why language models made that harder.
payloadcms-mcpx: schema on demand and JSON Pointer patches for Payload CMS
Why we built a Payload CMS plugin that hands agents the field shapes one node at a time and takes writes as RFC 6902 patches, instead of inlining the whole schema and taking the document back whole.
stillmap: static maps without a browser, a key, or a third party
Why we built a TypeScript library that renders a map to SVG or PNG in plain Node.js®, with no headless browser, no native map library, and no API key.
Killing the ArgoCD token: trading GitHub Actions OIDC for scoped sync access
How to let GitHub Actions diff and sync ArgoCD applications without a static ArgoCD API token in CI secrets, using ArgoCD's own built-in Dex for a token exchange and RBAC scoped to the GitHub OIDC claims.
Killing GitHub PATs: trading OIDC tokens for scoped GitHub App credentials
Why we built a broker that exchanges a GitHub Actions OIDC identity token for a short-lived, least-privilege GitHub App installation token, gated by CEL policy.
Self-hosted tunnels with real SSO: frp plus a CEL policy engine
ngrok gates team SSO behind paid tiers and Cloudflare Tunnel locks you into its Zero-Trust model. We self-host frp instead, and wrote a CEL-based server plugin so our own IdP decides who can proxy what.
oidc-token-cli: one OIDC client for every tool
Why we built a small Go CLI that fetches and caches OpenID Connect tokens, so kubectl, frpc, curl, and CI never have to implement auth themselves.
Why we built abi group
A first note from the founders: what abi group is, why we started it, and what we hold to.