Why I replaced an eight-second confirmation request with an asynchronous intent
A write-path redesign that released Tomcat request threads immediately and fixed an overly broad rule that could supersede unrelated pending approval actions.
Personal Projects
Products and experiments built independently from problem definition through operation.
↗
Validating Cilium FQDN egress without touching a single-node production cluster
A disposable kind lab that proved identity-specific toFQDNs and Hubble drops while keeping the risky production CNI migration behind an explicit gate.
Why a public ALB still had to be closed behind CloudFront
A zero-downtime origin lockdown that moved the BFF first, then restricted direct ALB HTTP access to AWS-managed CloudFront origin-facing networks.
A GitOps deadlock between a new readiness probe and an old image
GitHub redirected the repository but not the GHCR coordinate, so Argo CD combined a new /ready probe with an image that could only return 404.
Designing Kafka consumer groups when every Pod must receive an SSE event
A cutover from lightweight database notifications to Kafka KRaft, including broadcast semantics, a duplicate-bean rollout failure, and a live broker interruption.
Why I trust runnable tags instead of node names in a LangGraph SSE stream
A streaming and routing repair for real event metadata that differed from mocks, leaked tool preambles, and let stale turns influence new routes.
Why I stopped asking an LLM to repeat a download URL
A deterministic terminal formatter and safe-anchor boundary for an LMS ZIP capability link that disappeared before the final response.
Why I added CPU instead of another index for a 2.68-second spatial p95
A small production read-only load test and EXPLAIN analysis that separated a CPU-bound spatial path from two unrelated missing user-query indexes.
Why I store coordinates as geometry but calculate meter searches as geography
A PostGIS design using expression-identical GiST indexes to preserve Hibernate and bounds-query compatibility without sacrificing correct radius and kNN semantics.
What should a rate limiter count when one API call fans out six times?
A redesign of a limiter that returned 429 during a normal seat search because its unit did not match the actual upstream call graph.
Running a JVM with JNA and ZIP scratch files on a read-only root filesystem
A write-path audit that reduced a writable container to explicit /tmp scratch and an export PVC, then verified the native FFI path in production.
Why a monthly ingestion job did not need a new distributed-lock service
An EventBridge Scheduler Universal Target invoking ECS, with manual and scheduled runs serialized by a PostgreSQL advisory lock held on one physical connection.
Why valid bearer requests returned 401 only in production
A Spring Security incident where an Auth0 filter chain captured every path, rejected another JWT format, and remained invisible under the test profile.
Replacing a broken Set-Cookie proxy with a one-time SSO code exchange
How multiple Set-Cookie headers exposed a fragile proxy boundary and led to a 256-bit, atomically consumed Redis authorization-code protocol.
Reducing 100 same-seat requests to one upstream write
A durable reservation queue using Postgres intents, short claim leases, an outbox, and seat-level coordination around a non-idempotent school API.
How one failed ECS revision delayed the next deployment for five hours
Separating a masked shell exit code, ECS launch backoff, and an undersized health grace period to make automatic rollback trustworthy.
Trusting the first X-Forwarded-For value broke rate limiting
Redesigning client-IP trust across ALB and a BFF, then bounding the rate-limiter map that attacker-controlled keys could grow indefinitely.
Making a 50,000-record spatial import safe to rerun
Natural keys, incremental persistence, and real HTTP contract tests for geocoding a coordinate-free public CSV into PostGIS.
Why approving the card did not execute the reservation
Separating MCP content blocks, LangGraph checkpoint forks, and stale actions to make the human-in-the-loop flow verifiable beyond the UI.
Redrawing the failure boundary to preserve 70 successful LMS files
How four unsupported attachments led to explicit origin checks and a partial-success policy instead of discarding an otherwise valid export.
Healthy dashboards, silent alerts, and an empty trace backend
Repairing quiet observability failures by deriving Prometheus label contracts and Spring Boot tracing autoconfiguration from live evidence.
Cross-instance real-time updates without adding Redis
Using PostgreSQL NOTIFY only as invalidation, then combining authoritative rereads with SSE snapshots for a small multi-instance ECS service.
Why a 3/3 connection indicator still left private tools unavailable
A three-service authentication incident resolved by separating web identity, provider credentials, and MCP session grants.
The success-path bug hidden behind HTTP 429
How I isolated a RAG embedding failure to token throughput, then fixed the Jackson response contract that only appeared after rate limiting was gone.
Replacing an unencrypted RDS instance without losing data
A snapshot-copy-and-restore migration for an RDS encryption setting that cannot change in place, including Terraform state recovery and 15 minutes of measured downtime.
Why a Synced StatefulSet kept running the old configuration
A production incident where Kafka and Tempo remained on broken probes and memory settings even after the Git manifests were corrected.
Why the survival score has a SQL layer and a Java layer
PostGIS derives facts while a pure policy function handles weights and missing data, making a composite score explainable and testable.
When a cached Spring context points to a dead Testcontainer
Aligning class-scoped containers with a cached Spring context, then removing a second CI flake caused by a reservation worker consuming test fixtures.
Production was Ready while the primary URL served the old release
Git and Vercel succeeded, but a manually assigned .vercel.app alias remained pinned to an older deployment until promotion became an explicit, reversible step.
Why green CI left ARM64 k3s running the previous image
A delivery record that turned an AMD64-only OCI manifest into separate build, registry, Git write-back, reconciliation, and runtime gates.
Why I Split My Technical Blog into Static Pages and a Git-Backed Admin
An architecture record of separating Astro's static reading experience from browser-based management of posts, categories, and drafts with Keystatic.
Why Worklogs Belong on GitHub and Explanations Belong on the Blog
A documentation structure that connects Issues, worklogs, ADRs, troubleshooting records, and technical articles without copying every project change into the blog.
When an expiry predicate dominates a PostGIS spatial query
How execution plans over 300,000 synthetic places and 210,000 reports showed that expiry aggregation—not the spatial GiST index—was the bottleneck.
Aligning identity boundaries from the browser to private MCP tools
How discarding client-claimed principals and separating a server-verified subject from an explicit MCP session prevents IDOR on principal-owned threads and silent privilege downgrade.