Writing

Engineering·November 9, 2026·3 min read

How I connected Swift and Kotlin clients to agent workflows, built Core ML and TensorFlow Lite integration boundaries, and kept authorization on the backend.

Engineering·November 9, 2026·6 min read

Building an agent that talks is the easy demo. The harder work is authenticated tools, retries, evaluation, telemetry, CRM synchronization and the people who have to operate it.

Engineering·November 6, 2026·3 min read

I scheduled 100 calls against one in-process idempotency key. The side-effect callback ran once; a real crash or a second worker is still untested.

Engineering·November 6, 2026·2 min read

I sent 200 scheduled refresh attempts through one local token family. Only one issued a successor; multiple workers would need a different test.

Engineering·November 6, 2026·3 min read

I tried consuming one action-bound challenge 200 times. My single-process guard accepted one call and rejected 199; shared-store races remain untested.

Engineering·November 6, 2026·3 min read

What requestHash protects, what the server must verify, and why an integrity verdict is not a substitute for authorization.

Engineering·November 6, 2026·3 min read

Design privacy-conscious auth decision logs that help explain failures without recording the credentials that caused them.

Engineering·November 6, 2026·4 min read

A timeout does not undo a committed write. Model retries, duplicate operations and correctly scoped idempotency keys.

Engineering·November 6, 2026·3 min read

Practical tests for broken object-level authorization in authenticated mobile and backend APIs.

Engineering·November 6, 2026·4 min read

Model sign-in, refresh rotation, expiry, step-up recovery, and revocation without creating a hidden authentication bypass.