Engineering
Technical deep-dives, architecture decisions, and lessons learned.
You most likely don't need the newest model: what a failing cheap model is telling you
A feature that only works on the largest model is usually not a hard feature. It is an underspecified one, and the model was quietly covering the difference.
Standards? Standards! What we adopt, what we invent, and what we refuse to decide twice
Why we adopt the standards other people already wrote, insist on writing our own where nobody else can, and treat every question answered a second time as time taken from the work that actually matters.
The XY Problem: why the solution you arrived with is usually not the one you need
Clients rarely bring us a problem. They bring us a solution they already picked, and the problem behind it never gets stated. Here is how we get back to it, and why language models made that harder.
Killing the ArgoCD token: trading GitHub Actions OIDC for scoped sync access
How to let GitHub Actions diff and sync ArgoCD applications without a static ArgoCD API token in CI secrets, using ArgoCD's own built-in Dex for a token exchange and RBAC scoped to the GitHub OIDC claims.
Killing GitHub PATs: trading OIDC tokens for scoped GitHub App credentials
Why we built a broker that exchanges a GitHub Actions OIDC identity token for a short-lived, least-privilege GitHub App installation token, gated by CEL policy.
Self-hosted tunnels with real SSO: frp plus a CEL policy engine
ngrok gates team SSO behind paid tiers and Cloudflare Tunnel locks you into its Zero-Trust model. We self-host frp instead, and wrote a CEL-based server plugin so our own IdP decides who can proxy what.