Portfolio ↗

Digs

Searching X architecture returns material written to be found by that query, which means tutorials and vendor pages. The material worth having was written by an engineer explaining a real system to their peers, and it uses different words. A dig is what comes back from going after that layer on one topic: the architecture reconstructed across real systems, the decisions and the conditions that flip them, what actually broke, and numbers you can plan against. Every claim is graded, linked and dated.

91 field guides 2462 graded sources 422 postmortems 8 categories
All AI & LLM Systems8 Data Platforms12 Distributed Systems10 Platform & Infrastructure24 Integration & APIs11 Security & Identity8 Reliability & Operations11 Cost & Efficiency7
Reliability & Operations 05 Oct 2026

The way back is also a deploy

Reconstructs rollback as it actually works in production: a forward deploy of an old artifact, underwritten by a compatibility contract fixed weeks before the incident. Six postmortems (Knight, CrowdStrike, Cl…

What surprised meThe most expensive deployment failure on record, Knight Capital, was a rollback that executed cleanly: it restored old code under new configuration a…
28 sources · 25 organisations · 6 postmortems 28 min read
deploymentrollbackcanaryfeature-flagsincident-response
Platform & Infrastructure 04 Oct 2026

Keeping the main branch green: thirteen years of merge queues, read from the repositories that ran them

The merge-queue pattern traced through its primary record: Rust's three generations of bors, Zuul's speculative gating, Kubernetes' Tide, GitLab's trains, Chromium's CQ and GitHub's built-in queue, plus two co…

What surprised meAfter GitHub absorbed the merge queue into the platform and Bors-NG deprecated itself in response, the project that invented the pattern rebuilt its …
20 sources · 11 organisations · 2 postmortems 28 min read
merge-queueci-cdbuild-releaseborsspeculative-execution
Platform & Infrastructure 04 Oct 2026

Replacing the engine room in public: ten years of Sentry, read from its RFCs, releases and self-host floor

A decade of component replacement inside one product, measured in the artefact other people install: seven containers at the 9.1.2 tag, thirty by the end of 2020, fifty-one on master, and an enforced memory fl…

What surprised meThe free self-hosted edition is not downstream of the architecture but a veto on it: RFC 0072 rejected a Kafka schema registry service partly because…
32 sources · 3 organisations · 5 postmortems 32 min read
migrationkafkaclickhouserustopen-core
Platform & Infrastructure 03 Oct 2026

Scaling without splitting: a decade of Shopify, read from the code it published

A decade of one company's architecture, reconstructed from the ring of repositories around a closed monolith: a boundary checker whose stricter half was removed, a resilience library that sizes bulkheads from …

What surprised meThe company that chose static analysis over service boundaries then deleted half of its own boundary model: packwerk shipped with dependency and visi…
26 sources · 8 organisations · 4 postmortems 30 min read
monolithmodular-monolithshardingresilienceruby
Cost & Efficiency 03 Oct 2026

The compute you reserve but never use

Most containers use less than half of what they reserve, and the bill follows the reservation. This guide reconstructs the request/limit contract and its failure record from the primary sources this topic actu…

What surprised meThe reservation number is wrong in both directions at once: Datadog measures over 65% of containers using less than half their requested CPU, while t…
23 sources · 16 organisations · 3 postmortems 29 min read
kubernetescapacityutilizationfinopsthrottling
AI & LLM Systems 02 Oct 2026

Bounding what the agent may do

Eighteen months of CVE records, vendor security advisories, specification arguments and shipped enforcement code show how the industry actually bounds agent authority: a deterministic envelope the model cannot…

What surprised meIn four of seven CVE-grade incidents the human-approval gate was never fooled and never even shown; it was re-bound, because the thing the gate check…
29 sources · 16 organisations · 9 postmortems 31 min read
agentsprompt-injectionsandboxingleast-privilegemcp
Integration & APIs 02 Oct 2026

The contract held, the clients broke: ten years of Stripe's API

A decade of one company's interface, read entirely from repository artefacts: a specification republished 2,535 times, two spec variants that disagree in both directions, generator and spec pins inside each cl…

What surprised meThe promise held at the HTTP boundary and the breakage moved into the client libraries: the median interval between breaking client majors fell from …
24 sources · 3 organisations · 8 postmortems 34 min read
api-versioningopenapicode-generationbackwards-compatibilitysdks
Integration & APIs 01 Oct 2026

The cursor is a lease, not a bookmark: paginating the unbounded list

Every API that lists anything eventually meets a collection that does not fit in one response, and the paging scheme it picks becomes a public contract. This guide reconstructs how Kubernetes, Elasticsearch, G…

What surprised meThe expensive requests are not the deep pages: page one is the memory bomb (a 90 GB apiserver spike came from first pages, not deep ones) and the tot…
21 sources · 9 organisations · 2 postmortems 26 min read
paginationapi-designcursorskuberneteselasticsearch
Platform & Infrastructure 01 Oct 2026

Two hundred control planes per cluster: ten years of SAP's Gardener

A fleet platform has to give hundreds of teams their own cluster, on whichever infrastructure each product sells on, cheaply enough that asking for one is not a budget conversation. Gardener is the rare case w…

What surprised meThe parts of the platform that survived a decade are the ones with a one-to-one Kubernetes analogue, and the two mechanisms deleted without ever reac…
34 sources · 4 organisations · 3 postmortems 36 min read
kubernetesmulti-tenancycontrol-planesapplatform-engineering