Turns complex technology into calm.
Here we share what we learn along the way.
· 12 min read
Operational debt is knowledge that was never written down. People could always ask the colleague who knew; AI agents cannot. Why the AI era turns ratified content and deterministic retrieval into an engineering discipline.
· 8 min read
We measure technical debt in our code. Operational debt lives between our systems, where processes converge only eventually, through people. What distributed systems engineering teaches us about paying it down.
· 11 min read
Part 2/2 - In agentic systems, the decision to stop is as important as the decision to act. The guardian pattern formalizes that decision as a typed, independent evaluator that preserves the actor's agency while enforcing safety and business-relevant constraints.
· 7 min read
Part 1/2 - An agent is only as good as its exit conditions. Most failures are not bad first steps, but loops that never stop. This post makes a simple case: breaking conditions should be first-class evals, checked at every iteration. A new class of models, which TypeSafe AI calls System One models, makes that economically realistic for the first time.
· 5 min read
A decision model classifies 10,000 mobile app reviews for cents, an LLM writes only the synthesis, and self-hosted Laya keeps the data inside the company.
· 9 min read
Part 4/4 - A reference architecture for audit trails, written as an architecture decision record: transactional outbox, Merkle log, qualified timestamps, crypto-shredding and a masked access plane.
· 4 min read
Architecture standards usually offer two outcomes: comply, or get an exception. Real systems need a third option: a sanctioned, bounded deviation that keeps the State-of-the-Art (SOTA) target within reach.
· 5 min read
A customer switching banks is one decision on the outside and days of long-running, third-party-dependent work on the inside. How child workflows, signals, updates, Nexus and Kafka each earn their place — and where orchestration should stop.
· 12 min read
Part 3/4 - Separation of duties applied to evidence: why feature teams must never be the sole authors of their own audit records, and how a Kafka proxy, CDC and reconciliation fix it.
· 11 min read
Part 2/4 - Built naively, an audit trail becomes the largest and least erasable store of personal data you own. How privacy principles and minimal disclosure shape a trail that proves without exposing.
· 8 min read
Part 1/4 - Writing "the Earth is flat" in a server log proves nothing. What it takes to turn records into evidence: tamper-evidence, eIDAS 2 qualified timestamps and traced break-glass access.
· 9 min read
AES-GCM stops anyone from forging or altering your ciphertexts. It does not stop them from moving a valid one somewhere else. A concrete attack, the one parameter that fixes it, a test that keeps it fixed, and what is left to protect once it is.
· 9 min read
Part 2/2 - AI-driven development has changed how we ship code. To keep review fast and keep quality high, match scrutiny to risk, use evidence instead of assertion, and design deployments that make mistakes cheap.
· 8 min read
Part 1/2 - AI-driven development has changed how we ship code. To keep review fast and keep quality high, match scrutiny to risk, use evidence instead of assertion, and design deployments that make mistakes cheap.
· 9 min read
Four eras of engineering with AI, from autocomplete to agentic harnesses: what each one taught us, and how to build a good harness and choose its tools.
· 12 min read
When a delegated purchase goes wrong, both sides have logs, and the logs disagree. Why TLS can't settle that, and what RFC 9421 message signatures can (and can't) do about it.
· 7 min read
Security never ends in an unconditional root of trust; it ends where the next layer stops paying for itself. For SSH keys on a Mac, three layers are enough, and one of them is already in your laptop.
· 11 min read
From Scala to Kotlin to Go: twelve years of back-end language choices, the lessons behind each switch, and why AI may decide the next one.
· 11 min read
In part 1, I explained why hand-written test scenarios kept our tests green while delivery dates slipped, and why the answer is data that carries the shape of production by construction. This post describes the method in three steps: profile, generate, prove.
· 5 min read
We did everything right: defined clear scenarios, built realistic datasets, and kept them under version control. Yet every time we hit production-like data, new bugs surfaced. We could no longer say when we would be done. The lesson: synthetic data at scale, built from real profiles, fixes the most expensive form of unpredictability.
3 min read
I have spent the last 25 years in tech. Along the way, I have watched many programs fail. A few failed loudly, with cancelled contracts and difficult board meetings. Most failed quietly. Deadlines slipped one sprint at a time. Budgets stretched. Scope was trimmed until what finally shipped was a shadow of what had been promised.
9 min read
Sharks get the movies. Mosquitoes get the body count. Programs rarely die of one dramatic failure, but of a thousand reasonable yeses. Ten faces of the speed trap, and how to hold a direction.
9 min read
Programs rarely sink from one bad idea. They sink from carrying every good one.
12 min read
A plan is a hypothesis, not a promise. Most programs treat it as a promise. Agile thinking helps at team level, but most organizations still struggle to plan at program level.
14 min read
Most programs are planned as if people were interchangeable, and fall into the people trap. Ten faces of the trap and how to build teams that deliver.
8 min read
Programs rarely die of bad decisions. They die of decisions that never quite get made.
9 min read
Engineers want to build great programs, but ego disguised as ambition sinks them. Ten faces of the perfection trap, and how to stay ambitious without gambling.
8 min read
Programs are rarely slow because people work slowly. They are slow because work spends most of its life waiting.
9 min read
Green outside, red inside. Why good people report green on troubled programs: ten habits that grow a watermelon, and how to make the truth cheap to say.
9 min read
The work is split between teams, vendors and systems, each with its own plan, its own backlog and its own definition of done. Each team builds its part carefully, but the integration is never owned until it is too late.
11 min read
The wedding lasts a day, but the marriage is everything after. Why programs delivered on time still fail, ten faces of the go-live trap, and how to plan the marriage, not just the wedding.