Four production bugs from a national SSO platform: X.509 parsing, a misdiagnosed 500, a payment clock race, and Chrome's TLS renegotiation asymmetry

Solution architect, 17 years in. From March 2026 to July 2026 I was the only hands-on developer on the identity and single-sign-on layer for a Gulf country's national port community system — the platform that fronts its ports and logistics sector. It's live in production. I want to be precise about "sole," because it matters: other people committed to both repos — CI, automation tests, a few fixes, downstream integration work. I authored ~80% of backend commits and ~70% of frontend. Nobody else did hands-on feature development on the core system. That's the honest version. **Volume, straight from `git log --numstat`:** * 602 commits, ~184,000 lines changed across 1,423 files * Backend: 383 Java files / ~21k LOC, 19 controllers, 83 REST endpoints * Frontend: 152 TS/HTML files / ~15.3k LOC, 62 Angular components * 6 external integrations, each with a real *and* a mock adapter * 4 environments, 2 independent penetration tests remediated My own written estimate to leadership in April, before any of this was contentious: 3–4 engineers over 3 months. ## Architecture Hexagonal (ports and adapters) + CQRS. The domain package has **zero Spring or JPA imports** — greppable, returns nothing. That's the actual test of whether hexagonal is a design decision or a buzzword, and most codebases claiming it fail that check. domain/ Pure domain — models, value objects, events, ports. No framework imports. application/ Use cases — Commands (writes) and Queries (reads), DTOs, assemblers. dataprovider/ Adapters — JPA entities, Spring Data repos, SOAP clients. web/ Inbound adapter — controllers, DTOs, mappers, JWT filter, SAML handler. Every feature is a paired `XxxCommand`/`XxxCommandImpl` (transactional writes) and `XxxQuery`/`XxxQueryImpl` (read-only). Every external dependency sits behind a port with a real and a mock adapter selected by Spring profile — which meant QA and UAT ran full end-to-end flows without depending on government systems being up. They frequently weren't. One JPA