October 13, 2026
Execution policy belongs outside the workflow
GitHub Actions execution protections can block disallowed runs before workflow code starts, but they cannot make trusted workflow code safe.
Read article
Writing on architecture, delivery pipelines, security and data, and the trade-offs behind them.
Essays and shorter notes.
October 13, 2026
PostgreSQL 14’s end of life is a compatibility-planning problem
PostgreSQL 14 reaches end of life on November 12, 2026; I explain how to map compatibility checks and sequence migration work around each workload.
Read article
October 13, 2026
Kubernetes 1.37 has two adoption gates
I separate the decision to adopt Kubernetes 1.37 from the decision to rely on it in production, then explain how to keep that policy portable.
Read article
October 13, 2026
A workflow security incident needs a recovery design
A recovery-ready CI architecture maps compromised actions to repositories and credentials, then restores safe shipping without reopening the same blast radius.
Read article
October 13, 2026
Worktrees move agent risk to integration contracts
I explain why isolated agent worktrees reduce edit collisions but leave task ownership, interface compatibility and integration decisions unresolved.
Read article
October 13, 2026
Trial .NET 11 without changing the production build
A reusable pipeline can test services with the .NET 11 preview SDK and runtime while keeping its established production toolchain unchanged.
Read article
October 13, 2026
Give Claude Code workflows explicit stop conditions
A repo-scale coding agent needs defined checks, evidence to return, and clear points where human judgment takes over.
Read article
October 8, 2026
Treat custom runner images as build dependencies
I argue for versioning custom GitHub Actions runner images as shared build dependencies, with clear ownership for patching, validation and rollout.
Read article
October 8, 2026
Test Kubernetes security defaults at the workload level
I explain how to test Kubernetes v1.36 security behavior against real workloads and make the intended posture explicit before upgrading.
Read article
October 8, 2026
Treat observability integrations as operational dependencies
A support-window plan for cluster integrations helps teams schedule upgrades deliberately and preserve options when vendor compatibility timelines differ.
Read article
October 8, 2026
A connection-count metric is not a pool health check
A database connection count shows how many clients are present, not whether an application pool is saturated, queuing work or holding connections idle.
Read article
October 8, 2026
Treat SELinux mount labeling as a workload-level change
Kubernetes 1.36 can avoid recursive SELinux volume relabeling, but the startup benefit depends on node configuration, storage, and workload behavior.
Read article
October 8, 2026
Model upgrades should earn their place in coding-agent workflows
A repeatable set of repository-specific tasks can show whether a new coding model improves your workflow enough to replace its current default.
Read article
October 6, 2026
Managed coding agents change the control-plane question
A practical way to compare managed coding agents with agents running in your own environment is to trace who controls access, execution and evidence.
Read article
October 6, 2026
A GitHub Actions lockfile needs an update policy
A lockfile can make workflow dependencies easier to audit, but shared pipelines still need owners, cross-repository tests, and an urgent-fix path.
Read article
October 6, 2026
Ingress controller retirement is an architecture migration
A practical way to replace a retired ingress controller is to map the edge responsibilities first, then preserve the external-to-internal contract deliberately.
Read article
October 5, 2026
Long-running coding agents need checkpoints, not just larger tasks
I explain why inspectable changes, explicit stopping points, and deliberate resumption make extended coding-agent work easier to review and recover.
Read article
October 5, 2026
Kubernetes Pod user namespaces are worth piloting
I explain how Pod user namespaces change the host-side impact of a container escape, what they do not replace, and what I would test before relying on them.
Read article
October 5, 2026
Treat OpenTelemetry as an application-to-platform boundary
I explain which telemetry decisions belong in application code, which belong in the platform, and how to keep the seam portable without hiding ownership.
Read article
October 4, 2026
What Claude Code auto mode can decide—and what I would gate
I explain where Claude Code auto mode can reduce approval friction, and which actions I would still keep behind explicit human approval.
Read article