Open to Backend, GenAI & Full-Stack roles · remote or Hyderabad

Email me Schedule a call

// decisions — 43 entries

Decisions

Real architecture and engineering tradeoffs from across my production work and open-source projects — the choice made, the alternative considered, and the cost actually paid. Every entry links back to the project or case study it came from.

MindForge

Advisory governance over fail-closed hooks

Outside Claude Code's own hook channel, MindForge enforces policy by convention rather than by blocking — a trade its own README states outright, made against a fail-closed tail that was measured denying benign commands on a fresh clone.

View source

MindForge

A single canonical version source over a "bump N files" heuristic

`package.json` feeds a sync script and test gate fanning out across 16 channels — the SDK, the MCP server, three lockfiles, the Homebrew formula, the Dockerfile, the marketplace listing. The cost of skipping that gate already happened once: v11.9.2 shipped with the Homebrew formula and Dockerfile still pinned four releases behind.

View source

MindForge

A zero-dependency SDK over a bundled WebSocket client

Shipping `sdk/` with no runtime dependencies keeps it lean, but it means `WebSocketEventStream` can't function on Node 18 or 20 unless the caller manually installs and polyfills `ws` onto `globalThis` — a real enough gap that the code now throws a descriptive error instead of the bare `ReferenceError` it used to.

View source

Graph-Forge

Chose a parser-built context header over an LLM-generated one, despite losing retrieval precision

Anthropic-style "Contextual Retrieval" — an LLM writes a situating blurb per chunk at index time — would have coupled the otherwise LLM-free, Kafka-driven indexing pipeline to Bedrock's uptime, rate limits, and per-chunk cost. I kept indexing pure and cheap: a parser-built header plus query-time Neo4j neighborhood recovers most of the same signal without ever calling an LLM during ingest.

View source

Graph-Forge

Chose Bedrock-primary with automatic Ollama fallback, and left a known gap in it rather than hide it

The fallback keeps the whole platform functional — and free — with zero cloud credentials configured. The cost: the swarm binds tools via LangGraph's `bind_tools`, so the fallback model has to be tool-capable too. If Bedrock goes down and the fallback model (the Compose default is `qwen2.5-coder:7b`) can't actually call tools, tool calls silently no-op instead of erroring. That gap is documented in the repo, not papered over.

View source

Graph-Forge

Chose architectural breadth over test coverage

Nineteen services, a durable HITL multi-agent swarm, Istio-enforced zero-trust, and hybrid RRF retrieval shipped before a single Go unit test did. The project's own tech-debt tracker rates "Go services: no unit tests, only compile checks" as a HIGH-priority gap against its own documented 80%-coverage standard — an honest trade I'm now closing on two unmerged branches (`feat/test-suite-go-services`, `feat/test-suite-python-services`) rather than one I'm pretending isn't there.

View source

Agent-Forge

Git as the rollback mechanism, not a custom versioned store

Commit-or-revert rides on git's own history instead of a bespoke database of spec versions. The cost is a real git operation per iteration, slower than an in-memory diff-and-discard — the payoff is an audit trail already inspectable with tools every engineer has, with no parallel system to keep in sync.

View source

Agent-Forge

Held-out validation as a periodic overfit check, not a per-iteration eval pass

Scoring every candidate against the same examples that shaped its proposal risks the loop learning to game its own judge. Rather than paying that cost every iteration, a held-out check runs periodically (every 10th iteration by default) against examples the loop never optimized against — cheaper than gating every commit on it, at the cost of only catching overfitting in arrears rather than blocking it in the moment it happens.

View source

Agent-Forge

Framework-agnostic adapters over a deep, single-framework integration

Thin adapters across LangChain, LangGraph, CrewAI, AutoGen, and raw SDKs mean none gets the tightest integration a framework-native rebuild could reach. In exchange, the same loop runs over whatever stack an agent is already built on, instead of forcing a migration first.

View source

ContextOS

Made the embedding provider optional, not bundled

`@xenova/transformers` pulls in `onnxruntime-web` → `onnx-proto` → `protobufjs`, which carries a critical RCE advisory with no fix in any maintained ONNX package. Default install: 83 packages, zero known vulnerabilities. Opt into semantic search: 130 packages, 1 critical + 4 high advisories `npm audit fix` can't clear. Cost: an upgrade silently drops semantic search until the dependency returns — why degraded retrieval now surfaces across five output surfaces instead of failing quietly.

View source

ContextOS

Hard-fixed the vector index at 384 dimensions

the local MiniLM model's width — instead of auto-negotiating per provider. Gemini and Ollama report 768 dimensions, so enabling `GEMINI_API_KEY` or `OLLAMA_MODEL` deliberately throws at startup instead of silently writing mismatched-width vectors into the store. Cost: those "supported" providers don't work out of the box — using them means re-embedding the index or injecting a custom 384-dim provider.

View source

ContextOS

Left git auto-commit off by default

The architecture doc explains why: an agent-authored commit puts an unreviewed write into shared history — "and that is precisely how a corrupt write once reached this repository's history." With `CONTEXTOS_AUTO_COMMIT` unset, agent writes exist only as an audit-log row and an unreviewed diff until a human opts in — a real reviewability gap, traded against repeating the incident that caused it.

View source

ag-bash

FNV-1a over SHA-256 for the AST cache key

a non-cryptographic hash gives roughly 10x faster key generation and works in the browser, at the cost of weaker collision resistance; the project's own architecture notes defend it only as "sufficient distribution for realistic script populations," not a formal guarantee.

View source

ag-bash

`DestructiveStage` defaults to `warn`, not `block`

a detected `rm -rf /` or fork bomb surfaces as an Observation rather than a refusal, trading hard-stop safety for agent throughput. Callers who want the refusal have to opt in explicitly with `destructivePolicy: 'block'`.

View source

ag-bash

Node floor of >=20.6.0 despite full ESM-hook sandbox hardening needing >=23.5

chose broad compatibility over guaranteeing the complete hardening story on the officially supported minimum runtime.

View source

Tombstone

Fail-open, async Rekor submission over a blocking write

A third-party outage should never stop a flag mutation, so Rekor submission sits off the critical path and swallows its own failures by design. That same posture let a real bug — AUD-1b — go unnoticed for an unknown stretch: the Rekor client submitted a "rekord" entry claiming signature format `x509` but never actually included a signature or public key, so Rekor's server-side validation rejected every entry and the existing fail-open handling swallowed the failure silently. Every `REKOR_ENABLED=true` deployment believed it was writing to the transparency log while, very likely, no entry had ever been successfully recorded.

View source

Tombstone

Duplicated HTTP clients over one shared Go module

The retry/backoff/circuit-breaker logic above is copied byte-for-byte into six-plus services rather than factored out. The cost: any tuning change has to be hand-applied to every copy instead of landing with one version bump.

View source

Tombstone

Audit-log correlation over a real dependency graph for blast-radius "dependent flags."

Scoring counts how often two flags changed together in the last 30 days — cheap and always available, but correlation, not causation. Two flags toggled by the same engineer in the same sprint count as dependent; a flag with a genuine hard dependency that hasn't been co-changed recently scores as having none.

View source

Not-Humans-Lab

No shared build tooling, over a Turborepo/pnpm umbrella

Each sub-project keeps its own toolchain instead of folding into shared build tooling — framed as YAGNI ("each project's toolchain is small enough on its own... shared tooling would add coordination cost without a proven need"). The cost: the architecture doc's own Risks section admits the layout is "unvalidated against real code," and the system-level tech-stack research pass meant to back this call came back as a placeholder/error — thinner-evidenced than the three project-level stack decisions it sits alongside.

View source

Not-Humans-Lab

Numbered ADRs, over commit-message-driven history

Cross-cutting decisions get a Nygard-style ADR instead of living only in commit messages or PR threads, at the cost of "a small amount of process overhead per significant decision" and a standing risk that the practice quietly lapses back into chat-only decisions if nobody keeps writing them.

View source

Not-Humans-Lab

Mandatory PR review, over direct commits — even solo

`main` is protected: no force-push, no direct commits, a PR required even when the maintainer is the only contributor. There's no team to review for; the stated purpose is a single self-imposed checkpoint against agent output, deliberately removing the option to bypass CI "just this once."

View source

Trelix

7-leg fan-out over a simpler pipeline, despite the cost

No single tool combines all 7 legs, and RRF rewards agreement across them — but a full fan-out costs 50-500ms per query versus under 1ms for a tier-1 hit. The 3-tier planner exists to keep most queries out of that expensive path.

View source

Trelix

"Beast-mode" features (FLARE, HyDE, multi-query expansion) ship opt-in

Each is a real LLM cost — stacking HyDE and multi-query expansion runs N+2 chat calls (4 at default N=2). Docs recommend one flag at a time, not all on a slow backend.

View source

Trelix

Call-graph depth caps at 1 hop for most single-intent queries, with one deliberate exception

The traversal code warns against depth=2 for tier 2 to keep latency predictable, but `feature_flow` overrides that guidance — a "how does X flow" question needs the extra hop to be useful at all.

View source

CommandVault

Two SQLite engines instead of one

better-sqlite3 gives native speed for the CLI; sql.js gives a pure-WASM fallback for the extension, which can't ship a native module across Electron's ABI. The cost is real — two adapters must stay behaviorally identical and both get tested — paid so the extension isn't a degraded second product.

View source

CommandVault

A fixed 500ms debounce, not per-event parsing

Every save waits up to half a second before the vault reflects it, even an isolated change — a latency floor accepted so bulk operations like a branch checkout don't trigger a parse storm.

View source

CommandVault

500-character truncation in the two fast search tiers, full content in the slow one

Fuse.js and MiniSearch cap indexed content at 500 characters; FTS5 stores everything, after an earlier 2000-char cap on that tier was explicitly removed. The fast tiers trade match depth for speed — a match buried deep in a long file only ever surfaces through FTS5.

View source

Inkforge

Bedrock's fallback stops at Haiku 4.5 and skips Opus 4.6

Bedrock's fallback stops at Haiku 4.5 and skips Opus 4.6 on purpose — Opus needs separate per-account Bedrock enablement, and I chose zero extra AWS config over deeper resilience. Fallback eligibility is narrow too — only connection errors, 429/404/5xx, and IAM-deny 403s trigger it; a bad-credentials 403 doesn't, since a new model won't fix that.

View source

Inkforge

I kept Hashnode's client despite its now-decommissioned API

I kept Hashnode's client despite its now-decommissioned API, and never built a real publisher for LinkedIn at all — different reasons, same effect. Hashnode fails loudly with a documented manual-paste workflow instead of a silent no-op; LinkedIn never had an API to integrate, so the render-spec-plus-human-upload path was the honest choice from day one, not a fallback. The cost: "publish without leaving the terminal" holds for Dev.to alone.

View source

Inkforge

Generated articles never get committed; only the tracking record does

Generated articles never get committed; only the tracking record does. That keeps the repo's diff history clean, but the article text isn't recoverable from git if local `content/` is lost — only proof it was published survives.

View source

Order Processing System

Saga orchestration, not Two-Phase Commit

2PC is the obvious alternative for cross-service atomicity, but it needs distributed locks held across every participant and a coordinator that becomes a single point of failure. Sagas avoid both, but the cost lands on the order flow's consistency model — it's eventually consistent, and correctness now depends on compensating transactions actually reversing partial work cleanly when a step fails midway.

View source

Order Processing System

At-least-once-with-dedup, not real exactly-once

The "exactly-once-ish" label above is intentionally hedged: a CDC outbox plus idempotency keys plus a DLQ is, underneath, an at-least-once delivery guarantee with deduplication bolted on — not the theoretically pure exactly-once semantics the name gestures at. Consumers have to be built idempotent by construction, in exchange for not needing a distributed transaction coordinator to get reliable delivery.

View source

Order Processing System

etcd leader election over letting any instance write

Single-writer coordination through etcd buys write-conflict and split-brain avoidance by construction, but it adds a new coordination dependency with its own failure modes — leader flapping or quorum loss becomes part of this system's failure surface. What happens to in-flight writes during a leader-election gap isn't something the current design spells out.

View source

Pensieve

Constraints

Production LLM workflows at 2K+ DAU required sub-second orchestration latency with zero data loss across concurrent agent sessions — while maintaining a full audit trail for every approval gate decision.

View source

Pensieve

Tradeoffs

Chose Redis Streams over a traditional message queue for the orchestration backbone: streams give persistent, replayable event history (critical for audit) at the cost of more complex consumer-group management. Kept the gate logic synchronous rather than async to guarantee ordering — simpler to reason about under concurrent load, at the cost of some throughput ceiling.

View source

AAVA Code

Constraints

The single-agent prototype already had clients in 5+ environments — the re-architecture had to be backward-compatible with existing VS Code extension contracts while expanding to 150+ skills without a flag day migration.

View source

AAVA Code

Tradeoffs

Used crewAI flows for the Main-Agent → sub-agent topology instead of a custom orchestrator: faster to ship and battle-tested for tool-calling, but constrained by crewAI's execution model. Traded orchestration flexibility for delivery speed — the right call under the timeline.

View source

Wireframe Generator

Constraints

The entire vertical slice — UI design, Angular frontend, backend stream handling, and real-time rendering — had to ship in roughly one week without compromising stability. Existing Experience Studio clients couldn't be disrupted.

View source

Wireframe Generator

Tradeoffs

Chose SSE over WebSockets for the real-time rendering pipeline: lower infrastructure overhead, works through existing HTTP proxies, and sufficient for the unidirectional wireframe stream. The tradeoff is no bidirectional channel — acceptable since the generation flow is inherently one-way.

View source

Prompt-to-React

Constraints

Generated components had to be production-ready — not prototypes. They needed to follow the team's existing component conventions and integrate cleanly with their routing layer without manual cleanup by engineers.

View source

Prompt-to-React

Tradeoffs

Generated modular components with explicit routing logic rather than monolithic page outputs: more complex generation pipeline, but produced code developers could actually ship without refactoring. The tradeoff was a harder prompt engineering problem — worth it given the 55% reduction in manual coding effort.

View source

Execution Engine

Constraints

Outputs had to be deterministically structured — free-form LLM responses weren't acceptable as product artifacts. The engine needed to enforce schema on outputs while remaining flexible enough to handle diverse prompt inputs across teams.

View source

Execution Engine

Tradeoffs

Paired RAG for context grounding with a ReAct reasoning loop for step-by-step artifact construction: more complex than a single-pass generation approach, but the only way to achieve the 85% first-pass acceptance rate. The added latency per request was acceptable given the 6× planning time reduction.

View source