A focused selection of essays and guides: sovereign digital infrastructure, AI in production, product liability for developers, philosophy of technology, and my conference talks. Most topics feed directly into my consulting and workshop offers.
Agentic workloads need three things before they belong in production: isolation, security, and scale. kagent provides the declarative runtime, Agent Substrate the sandbox underneath — gVisor for software-level isolation, microVMs for hardware-level isolation, and Actors that only run while a session is live.
GPU teams face a bad trade-off: a control plane per team, or weak isolation in a shared cluster. This reproducible lab combines Kamaji (control planes as pods) and HAMi (fractional GPUs) on a single GPU-less machine using HAMi's mock device plugin.
A flash-sale surge on 15 cold inventory keys — and what the agent stack does about it: ADK triage, an APEX Layer-1 hotpatch through three governance gates, and a Tier-2 structural fix requiring dual-custody SRE sign-off.
Continuum finds, validates, and patches code vulnerabilities: it proves which findings are actually exploitable in your environment, ranks them by business impact, and proposes fixes — with human approval before anything ships.
Seven layers between an AI agent and your cluster: identity, admission, sandboxing, egress policy, tool mediation, secrets and runtime detection.
The coding agent you already have can investigate a Kubernetes cluster — what it lacks is context. A measured 50-fault bench on SREGym shows read-only MCP tools cut mean time-to-diagnosis from 191s to 64s and correct-within-2-minutes from 60% to 86%.