All Articles

I built a SaaS with multi-tenancy, event-driven architecture, and elaborate domain abstractions — for millions of users that never arrived. The product now serves two or three internal people in the same building. This is the architecture post-mortem, and the operating patterns that would have changed the outcome.

An anonymized teardown of a consumer platform I scaled to several million users. The architecture that carried ~30K req/s at peak, the four walls we hit on the way up — database connections, a cache stampede that caused a 19-minute outage, payment double-charges, and a credential-stuffing attack that looked like organic growth — and the trade-offs behind each fix. Topology, layered caching, the data tier, WAF and rate-limiting stack, and four real ADRs. No vendor named; the engineering is exactly as it happened.

Most agent SDLC setups use the LLM as the runtime for everything—including deciding which files to read—which is the biggest source of token waste and non-determinism. SpecLoom flips this: write your spec as typed blocks with IDs and dependencies, and a deterministic compiler emits a minimal, hash-stamped bundle for one task. A real engineer bundle compiles to ~370 tokens instead of 20–60k, the same task always produces a byte-identical bundle, and @spec:ID#hash anchors turn spec/code drift into a CI failure. Covers the .loom format, the Deterministic Context Compiler, tiered budget degradation, the drift gate, engine-enforced persona gates, and a 60-second loop to try it.

Most teams ship an LLM call in an afternoon and spend the next month firefighting. This walkthrough shows the correct order — spec, architecture decision, eval criteria, implementation, CI gate, production observability — using a real cloneable repo (spec-to-ship-workflow) that runs in 10 minutes with zero API keys. Covers the retrieval-confidence floor that prevents most RAG hallucinations, two-mode providers for CI reproducibility, golden test cases before implementation, and the eval drift alert that catches regressions no other metric sees.

The number one reason AI coding agents produce confident, wrong code is they're guessing about your system. MCP (Model Context Protocol) fixes that — a standard way for agents to pull real context from real sources instead of you copy-pasting it. What MCP is (a USB-C port for AI tools), how to set up your first server, which context to expose (schema, docs, issues) and what to keep out, and the security model you must get right.

A practical reference catalog of the eight architectures worth knowing — layered, modular monolith, hexagonal, event-driven, CQRS + event sourcing, microservices, serverless, and the strangler fig. Each with a diagram, the forces that make it the right call, the failure mode that makes it the wrong one, and a link to runnable reference code. Plus a decision flowchart so you pick on fit, not hype.

You can't ship a reliable LLM feature on vibes. Evals are the regression net for a dependency that's non-deterministic, drifts when the provider updates the model, and fails silently. How to build one without boiling the ocean: start with 30 real examples, layer three kinds of checks (assertion, LLM-as-judge, human), measure faithfulness, and run it on every prompt, model, and retrieval change.

Autonomous PRs are real leverage and a real way to drown your best engineers in review debt. The operating model: autonomy scales inversely with blast radius, you can only generate as many PRs as you can genuinely review, the three gates every autonomous PR must pass, and the metrics that tell you it's working instead of quietly rotting your codebase.

Adding an LLM to your product is a distributed-systems problem with a non-deterministic dependency, not a single API call. When RAG actually helps (and when a prompt will do), how to think about vector databases and chunking without cargo-culting, the retrieval pipeline that separates demos from products, and the seven-point production checklist — evals, guardrails, cost ceilings, latency budgets, fallbacks, observability, and a human-in-the-loop boundary — to put in place before a real user touches it.