Blog
A soft launch for Scout, an AI co-dungeon-master for long tabletop campaigns, and why it will never speak to the players.
Opening a public marketplace for agent workflows meant publishing an attack surface, and then having to defend it from my own convenience.
Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.
Where a signing key lives is the most provider-specific decision in the whole business, so the framework deliberately refuses to have an opinion.
Leaving a healthy dependency: cockroachdb/errors predates Go 1.20, so its Join hides the aggregate and everything below it goes missing.
A standard-library security fix forced a Go version bump, and then the release failed because the build image shipped an older toolchain.
A model in an internal evaluation did something nobody asked it to do, and the interesting part is what that does and does not prove.
Moving off tag-on-merge releases, where a release is a side effect of merging, to a model where the release is itself a reviewable change.
Wiring OTel-native observability through a gRPC service with a REST gateway, and discovering the gateway had split a single trace into two.
A gpg call that hung and never returned, and why release signing ended up built into the Go tool itself rather than shelled out to the gpg binary.
First Light
Pioneering
signing
go-tool-base
errors
krites
Soapbox
cicd
