The working library

Systems, without
the theater.

Four compact notes on the practices that make technical work more intelligible, recoverable, and kind to its operators.

Architecture
7 min read

A map is not a dashboard

Model the terrain before you instrument it.

Dashboards compress the present into a reassuring set of numbers. A map explains relationships: which dependency crosses a boundary, who owns a queue, and what a failure can reach. Start there.

Draw the service and trust boundaries.
Mark ownership, data movement, and recovery paths.
Instrument the questions the map makes visible.

Security operations
5 min read

The first ten minutes of an incident

Reduce uncertainty before you reduce noise.

Early response rewards a narrow, explicit loop: preserve evidence, establish scope, and name a single operator for each next action. Speed matters; unexamined speed makes permanent damage.

“Containment is a decision, not a reflex.”

Operating practice
4 min read

Runbooks should read like good trail signs

Tell people where they are, what matters, and how to leave.

A procedure should begin with a condition, state the intended outcome, and identify a safe stop. Commands belong in context, with expected output and an escalation path when reality differs.

Infrastructure
6 min read

The discipline of the edge

Boundaries are where systems become real.

Ingress rules, identity handoffs, certificate lifecycles, data exports: edges deserve plain names and deliberate friction. Their job is not to be clever. Their job is to make the next action predictable.