Blog
Thoughts, deep dives, and notes on systems engineering.
FinOps Sentinel: AWS Cost Protection Agent
An autonomous agent that finds cloud waste, prices it, explains it, and removes it, but only after a human says yes.
Building a Slack Approval Workflow That Deletes Cloud Infrastructure
Block Kit, signature verification, and the design decisions that stop a button click from becoming an incident.
Alembic in Practice: Structure, Revisions, and the Traps SQLite Sets
What those hex filenames mean, why migrations silently applied to the wrong database for two months, and how to widen a CHECK constraint without quietly breaking it.
Hexagonal Architecture: What It Actually Buys You (And What It Costs)
Ports and adapters explained through a system that deletes AWS resources for a living: the four real advantages, and the five costs nobody mentions.
Building a Local Token Usage Tracker for LLM API Spend
A zero-dependency observability tool that captures live telemetry across Claude Code, Gemini/Antigravity, and custom scripts, using nothing but the Python standard library.
Building an Autonomous LLM Agent That Cannot Lie About Your Resume
A local-model resume agent built around one constraint: every claim it makes must be traceable to the source document, enforced in the schema rather than the prompt.
Designing Resilient Third-Party Ingestion Pipelines
SSRF guards, streaming size caps, layered extraction, and an error taxonomy that tells the user what to do next, drawn from a pipeline that ingests job postings from arbitrary URLs.