Enforce Image Trust at Admission, Not by Convention
A CI signature is a claim, not a guarantee that the signed image is the one running in your cluster. Put a deny-by-default, fail-closed check at admission.
Robert Allen
Technologist | Regenerative Agriculturist
Passionate about building robust, scalable systems and contributing to open source software. Specializing in backend architecture, API design, and developer tools. Author of open specifications for AI memory interchange and extension packaging.
Recent Posts
Scaling PostgreSQL: Proxies, Extensions and Managed Platforms
A decision guide for scaling PostgreSQL by where each option places the wire-protocol boundary: proxies, sharding extensions and managed elastic platforms.
Move the Evidence, Not Just the Image, When You Promote
Signatures, SBOMs, and provenance attach to an image as separate referrer manifests, not image layers. A naive copy by digest leaves all of that evidence behind.
Friday Roundup - Week 24: Fable 5, Recursive Agents, and Supply-Chain Threats
Claude Fable 5 launches with silent refusals; sub-agents gain recursive depth; Apple Intelligence 2.0 picks Gemini; Shai Halud targets AI developer repos; npm v12 rewrites security defaults.
Pick GitHub Flow When the Release Is an Attested Digest
For a service that ships one version continuously, the branching model is GitHub Flow and the release candidate is an attested digest, not a release branch.
Siri on Gemini: Apple Is Now an AI Distribution Layer
Apple rebuilt Siri on Google Gemini and shipped an OpenAI-compatible on-device inference API. Distribution, not model training, is now Apple's AI product.
The Release Is a Content Digest, Not a Mutable Tag
A container tag is a mutable pointer: what you verified and what you run can silently differ. Name the release by its content digest, and build it once.
Friday Roundup - Week 23: The Spec Becomes the Substrate
OpenAPI 3.2 and Arazzo 1.1 turn the API contract into a substrate agents run on, MCP security research probes it, and Elbit buys into autonomous farming.
Friday Roundup - Week 22: Can You Trust the Code?
Claude Opus 4.8 bets on parallel subagents, new research questions whether AI-generated code can be trusted, and TrapDoor hits npm, PyPI, and crates.io.
Friday Roundup - Week 21: Google I/O, GitHub Breach, Agents
Google I/O ships Gemini 3.5 and Jules; GitHub discloses a supply chain breach of 3,800 repos; Claude Code adds agent coordination; Arazzo 1.1 ships.