Publications & Blueprints
Technical perspectives on enterprise cloud modernization, scalable data pipelines, and applied AI systems.
An architect's review of TypeSafe's Jev System One decision model: typed Choice, Score and Noul answers, confidence-gated routing, pricing and failure modes.
Agent harness engineering in practice: context budgets, staged compaction, goal pinning and schema-validated tool calls, with evidence, code and failure modes.
How to build an orchestrator-worker multi-agent system on local LLMs with Ollama: structured delegation, hard loop limits, and when not to use multiple agents.
Modernizing legacy monoliths with the Strangler Fig pattern: edge routing with Istio, canary and cohort releases, data decoupling, and when not to strangle.
How to put deterministic guardrails around tool-calling AI agents: least-privilege tools, schema validation, risk-tiered approval, budgets and audit trails.
Designing an enterprise RAG pipeline: ingestion and chunking, hybrid dense + BM25 retrieval with RRF, cross-encoder reranking, tenant isolation and evaluation.
Engineering-led FinOps for AWS and Azure: enforced tagging, pre-merge cost estimates, scale-to-zero non-prod, and FOCUS-normalised billing data you can query.
Migrating live legacy databases with log-based CDC (Debezium + Kafka): snapshot and stream, reconciliation, near-zero-downtime cutover and reverse-CDC fallback.
How to turn security controls into tested Policy-as-Code: OPA/Rego v1 on Terraform plans, Conftest in CI, waivers, runtime drift detection, and known limits.
Zero trust in Kubernetes: default-deny NetworkPolicies that actually work, Istio mTLS with identity-based authorization, least-privilege RBAC, and pitfalls.
A practitioner's guide to GitOps with Argo CD: sync and self-heal semantics, ApplicationSets, secrets, prune safety, and when GitOps is the wrong tool.
Build closed-loop remediation on OpenTelemetry: correlated signals, SLO burn-rate detection, throttled runbooks, and the guardrails that keep self-healing safe.