Notes from the engineering desk.
Writing about architecture, systems, identity, and AI engineering. Making engineering reasoning inspectable, verifiable, and practical.
The case for boring architecture
Proven technology, clear failure modes, good observability, and maintainable code usually beat unnecessary novelty in long-lived production systems.
Queue-backed telemetry without burst-driven processing
Designing ingestion pipelines that absorb spiky telemetry with queue-based backpressure, idempotent ingestion, and analytical decoupling.
Why public OAuth clients are not trusted clients
Understanding confidential vs public clients, why client secrets cannot be kept in browser code, and how PKCE and token binding protect the perimeter.
Designing customer-hosted software that must securely talk to the cloud
Architectural patterns for hybrid systems operating inside strict customer-controlled networks with restricted outbound proxies and zero inbound access.
What AI-generated code changes about senior engineering
As code generation gets cheaper, the value of engineering shifts decisively toward architecture, verification, failure mode analysis, and responsibility.
Traceability is the missing layer in many AI systems
Why capturing execution spans, inputs, tool calls, and evidence nodes is essential before deploying probabilistic models into high-stakes workflows.
ClickHouse vs PostgreSQL for operational analytics
Comparing row-oriented transactional databases with columnar analytical engines for telemetry, event streams, and time-series aggregation.
Why diagrams lie when deployment topology is ignored
Logical box-and-arrow diagrams often conceal network latency, network partition failure modes, certificate expiration, and deployment bottlenecks.
Threat modeling without turning it into paperwork
A developer-centric approach to identifying trust boundaries, credential risks, and attack surfaces during architecture design rather than post-hoc compliance.
PKCE vs client credentials vs DPoP vs hardware-backed identity
Different security problems require different architectural mechanisms: comparing token authorization and machine authentication patterns.
How to review AI-generated code like a Staff Engineer
Mental models, boundary checks, concurrency traps, and memory leak patterns to audit when evaluating AI-authored contributions.