Cloud-Native Infrastructure & Software Engineering
DARKDEN
Building production-grade systems on Kubernetes. From the forge of the gods to the edge of the cloud.
01—
Projects
Hefesto
Ἥφαιστος — God of the Forge
Platform that orchestrates persistent AI agent teams over a Kanban board, with one Python pod per role (LangGraph and the A2A protocol), RAG on Qdrant, Ollama models and a Kubernetes sandbox.
.NET 10PythonLangGraphNext.js 16KubernetesQdrant
Nekopitsu
猫 — Neko, the Cat
Public multi-tenant Discord bot for anime communities with tiered AI moderation, per-server configurable personality, freemium quotas and active/passive high availability.
.NETDiscord APIOllamaNext.js 16PostgreSQLKubernetes
Hermes
Ἑρμῆς — Messenger of the Gods
Helpdesk ticket classifier across 8 .NET 10 microservices and Kafka: reads mailboxes, filters noise, classifies with RAG against the client documentation and escalates on SLA before breach.
.NET 10KafkaQdrantBlazor ServerPostgreSQLAzure APIM
Aletheia
Ἀλήθεια — Spirit of Truth
Event-driven platform of 13 .NET 10 microservices on Kafka that ingests, enriches and classifies alerts with LLMs, with its own inventory graph and a Next.js command center featuring an immersive WebXR view.
.NET 10KafkaQdrantNext.jsWebXRSignalR
02—
Blog
Field notes from production. Deep dives into Kubernetes, service mesh debugging, cloud-native infrastructure, and the pursuit of fully autonomous development workflows.
Latest Post
Audit Your Own Code As If You Were the Attacker
Reviewing your code looking for confirmation that it's fine finds typos, not design flaws. Adversarial review flips the goal: it assumes the code is broken and tries to prove it. Multiple lenses, independent verification, and why 'zero criticals' isn't security.
browser --httpOnly cookie--> BFF proxy
BFF --Bearer (server-side)--> API
refresh.onError(401).singleFlight()
oidc.callback: code -> cookies (no token in URL)
The JWT Should Never Touch the Browser: the BFF Pattern
Stashing the access token in localStorage is handing it to the first XSS that comes along. The Backend-for-Frontend pattern keeps the JWT on the server and leaves only an httpOnly cookie in the browser that JavaScript can't read. How it works, step by step.
loop.detect(identical | alternating | target-repeat)
monitor.heartbeat(turn) => stale ? kill : continue
gate.require(toolCalls > 0) else FAILED
retry.classify(error) => retry | escalate | abort
The 4 Failure Modes of AI Agents in Production (and How to Mitigate Them)
Leave an agent loop running unsupervised and the runaway token bill and corrupted state show up on their own. The four failures that recur in every agentic system —loops, stuck turns, no-op turns, and misclassified errors— and the engineering patterns that contain them.
task.state: ToDo -> InProgress -> InReview -> Done
review.gate(QA) && review.gate(Security)
transition.allow(Done) iff gates.passed && merged
else escalate(lead) -> escalate(human)
Governing AI Agents: Why 'Done' Has to Be Earned
An autonomous agent that approves its own work isn't autonomy, it's a time bomb. How to govern teams of agents with separation of duties, independent review gates, and a 'done' invariant that nobody gets to skip.