Posts
A Release Pipeline With No Long-lived Tokens and No Silent Tampering
How I secured the Hookie CLI release pipeline with OIDC trusted publishing, staged npm releases behind 2FA, and immutable GitHub release assets.
- Supply Chain Security
- npm
- GitHub Actions
- CI/CD
A CLI Should Do More Than Wrap Your API
Notes from building Hookie: API-shaped commands are useful, but AI-native dev workflows need CLI commands that own the whole task.
- Developer Tools
- CLI
- Product Engineering
Shipping Code Faster Is Not the Bottleneck
Agent-loop discourse sells parallel code output. For solo builders the binding constraint is usually demand, and a useful receipt needs cost, artifact, and a user-visible before/after.
- AI
- Agentic Programming
- Productivity
- Thinking
The Interview Gap
The industry says AI agents will write most of the code. Senior engineering interviews still gate on whether you can produce a graph traversal cold in 45 minutes. A checkpoint piece, four months into the job search, on the gap between the two.
- Product Engineering
- Engineering Interviews
- Thinking
- AI
Building Incident Memory From Slack and Meet Transcripts
How we built an internal AI post-incident platform around the workflow responders already used: PagerDuty, Slack, Google Meet, structured reports, retrieval, and the tradeoffs that showed up once agent orchestration became production work.
- AI
- Incident Response
- Developer tools
- Internal Tools
I Didn't Know What Was in My Context Window. So I Went Looking.
After installing gstack, I wanted to dig deeper than vendor UIs into what actually lands in context. I built Context Mate as a local experiment to unify traces across Cursor, Claude Code, and Codex. So far it is only partly successful: useful for coarse Cursor buckets and Claude token curves, but not a full inventory by name, and fragile on undocumented storage.
- AI Coding Agents
- Cursor
- Claude Code
- Context Engineering
