标签：#DevOps

The Great AI Architecture Debate When building reliable AI agents, there are two dominant approaches. Approach A: Proxy Gateway (LiteLLM, Braintrust, etc.) App sends request to Gateway Proxy which forwards to LLM Provider. Requires Docker, database, operations team. Approach B: Embedded SDK (NeuralBridge) App plus SDK sends directly to LLM Provider. One dependency, pip install. The Hidden Cost of Gateways Every proxy gateway adds 30-200ms of network latency per call. For an agent that makes 10 LLM calls, that is 300-2000ms of unnecessary overhead. Latency breakdown: Gateway overhead: +30-200ms per call Docker infrastructure: +1-3 GB RAM Database operations: +PostgreSQL maintenance Ops overhead: +0.5 FTE Why Embedding Wins Embedded reliability eliminates the network hop: Factor Gateway Embedded SDK Added latency 30-200ms ~0ms Dependencies Docker, DB, Redis 1 (httpx) Install size 500MB+ 375 KB Single point of failure Yes (proxy) No Ops cost High Zero The Hybrid Reality Gateways serve a purpose for centralized logging, auth, and rate limiting. But for latency-sensitive AI agents, embedding reliability directly in the process is strictly better. The ideal stack: embedded SDK for reliability plus lightweight observability layer on top. https://github.com/hhhfs9s7y9-code/neuralbridge-sdk NeuralBridge: Apache 2.0, 1 dependency, 375 KB.

LLM API Reliability: The Reality Nobody Talks About If you have run more than a few thousand LLM calls in production, you have seen the pattern: things work perfectly in development, then fall apart under load. The Numbers Failure Type Rate Root Cause Timeout 2-5 percent Network congestion, provider throttling Rate Limit (429) 1-3 percent Burst traffic patterns Empty Response 0.5-2 percent Content filtering, model degradation Schema Violation 1-4 percent Model behavior drift 5xx Server Error 0.5-1 percent Provider-side outages Total: 5-15 percent of calls fail on first attempt. Why Retry-Only Is Not Enough Most teams implement exponential backoff and call it done. But retry alone does not help when: The provider is genuinely down (retrying into a black hole) The model has degraded silently (retrying returns the same bad output) You are being rate limited (retrying makes it worse) Self-Healing: A Better Approach Instead of naive retries, a self-healing approach: Diagnoses the failure type (~19 microseconds) Escalates through layers: retry, degrade, failover, learned rule Validates output quality across multiple dimensions Learns from each failure for next time Key Takeaways 5-15 percent of production LLM calls fail on first attempt Retry-only strategies fail when providers are degraded Self-healing with diagnosis and failover recovers 84.1 percent of faults Multi-provider routing eliminates single points of failure Try It https://github.com/hhhfs9s7y9-code/neuralbridge-sdk NeuralBridge is Apache 2.0 open source.

🐧 Linux for DevOps — Session 2: Understanding the Kernel, Shell, OS Architecture & File System 📓 Learning in public — These are my personal notes from my Linux for DevOps & Cloud journey. I'm sharing them in a way that's easy to revisit later and hopefully useful for anyone else starting out. In the previous session, I got comfortable with Linux basics and terminal access. This session focused on understanding what actually happens behind the scenes when we run commands , how Linux is structured internally, and how files are organized on the system. These concepts might sound theoretical at first, but they're the foundation of everything you'll do in DevOps—from managing EC2 instances and Docker containers to troubleshooting production servers. The Linux Kernel: The Heart of the Operating System The kernel is the most important component of Linux. Think of it as a translator sitting between software and hardware. Applications can't directly talk to the CPU, RAM, disks, or network interfaces. Instead, every request goes through the kernel. When you run a command, open a browser, start a Docker container, or deploy an application, the kernel is responsible for making it happen. Its main responsibilities include: Responsibility Purpose Resource Management Decides which process gets CPU time Memory Management Allocates and releases RAM Process Management Creates, schedules, and terminates processes Device Management Communicates with hardware through drivers Without the kernel, Linux would simply be a collection of files with no way to interact with hardware. Types of Kernels Not every operating system uses the same kernel design. Monolithic Kernel (Linux) keeps most operating system services inside a single kernel space. This approach is extremely fast because components communicate directly. Microkernel keeps only essential functionality in kernel space and moves other services outside. This improves isolation and stability but introduces additional overhead. Hybrid K

I left a multi-agent refactor running overnight. By morning the model was gone, pulled out from under me by a government I don't even vote for, on the other side of an ocean. This isn't really a story about Anthropic. It's a story about who's actually holding the off-switch, and right now it probably isn't you. So here's how my morning went. I had a job running. Not a toy, a proper codebase-wide refactor that had been grinding away continuously for the best part of two days. Multi-agent setup, left to run overnight, the kind of long, messy, long-horizon task that every model before this one just fell over on. Claude Fable 5 was handling it like it was nothing. Anthropic's own launch notes talk about it compressing months of work into days, and honestly, on my own codebase, that wasn't marketing. It was just what was happening. Then I woke up. And the model was gone. Not rate-limited. Not having a wobble. Gone. The thing I'd built two days of momentum on simply did not exist any more. Turns out that on the 12th of June the US government issued an export-control directive telling Anthropic to cut off all access to Fable 5 and Mythos 5 for any foreign national. And because you can't exactly sort a global user base by passport in real time, that meant pulling it for everyone. Including me, sat in Tyrol, watching my overnight run go cold. Anthropic did the right things, for what it's worth. They complied fast, they said out loud that they disagreed, and they're fighting to get it back. About as well as a vendor can behave in that situation. (As I write this it's still down. Anthropic reckon it's a misunderstanding and they're trying to get it restored, so maybe by the time you read this it's back up. Doesn't change a single thing about the point I'm making.) And it made absolutely no difference to me. That, right there, is the whole point of this post. The offer was the trap Wind back a few days. Fable 5 dropped as the best model anyone had shipped, and the offer was lov

AWS recently announced CDK Mixins, a new AWS CDK feature that lets developers add reusable capabilities like security, monitoring, and configuration to AWS resources. Mixins work across different construct types, making infrastructure code more flexible and reusable. By Renato Losio

If you still manage APT repositories as long one-line deb ... entries, you are working with a format APT now explicitly marks as deprecated. It still works, but it is harder to read, harder to automate safely, and easier to get wrong when you add options like arch= or signed-by= . The better option is deb822 style .sources files. This post shows how to: read the structure of a .sources file migrate a legacy .list entry safely use Signed-By without falling back to apt-key disable a repository cleanly without deleting it verify that APT accepts the new configuration I am focusing on practical host administration, not packaging theory. Why move to deb822 now? The sources.list(5) man page now says the traditional one-line .list format is deprecated and may eventually be removed, though not before 2029. More importantly, deb822 solves real operational annoyances: fields are explicit instead of positional one stanza can describe multiple suites or types Enabled: no is cleaner than commenting lines in and out machine parsing is much easier Signed-By is clearer and safer in structured form On a current Debian host, you may already be using it without noticing: find /etc/apt/sources.list.d -maxdepth 1 -type f -name '*.sources' On my test system, the default Debian repository is already stored as /etc/apt/sources.list.d/debian.sources . The old format vs the new format A traditional one-line entry looks like this: deb [arch=amd64 signed-by=/etc/apt/keyrings/example.gpg] https://packages.example.com/apt stable main The same source in deb822 format becomes: Types: deb URIs: https://packages.example.com/apt Suites: stable Components: main Architectures: amd64 Signed-By: /etc/apt/keyrings/example.gpg That is the core win. Instead of cramming everything into one line and hoping spacing stays correct, each field says exactly what it means. Example 1, a clean Debian .sources file Here is a practical example for Debian using separate stanzas for the main archive and the security arch

Microsoft has announced the public preview of Azure Container Apps Sandboxes. This new ARM resource type is Microsoft.App/SandboxGroups, runs untrusted code generated by agents in hardware-isolated environments. Each sandbox starts from an OCI disk image in less than a second. It can scale to thousands of instances at once and costs nothing when idle. By Claudio Masolo

I used to hear the pitch for context compression and think: sure, makes sense. Smaller prompts. Lower latency. Lower cost. Same output quality. Then I watched an agent blow a perfectly good debugging session because one field name disappeared from compressed memory. That changed my opinion fast. Three hours into a Claude Code run, the agent made the wrong API call with full confidence. The plan looked coherent. The reasoning looked clean. The summary of prior steps sounded smart. It was also missing the one detail that mattered: a field name from an earlier error log. The agent had already seen the bug. It had already “understood” the bug. But the compressed version of history dropped the exact detail it needed to avoid repeating it. That’s the real failure mode. Not “compression loses words.” Compression loses the one fact your agent needs later, after it has already committed to the wrong action. While researching this, I found a thread on r/openclaw about using Headroom with OpenClaw: https://reddit.com/r/openclaw/comments/1u3j5xs/anyone_using_headroom_with_openclaw/ That thread gets at the real tension: compression is useful, but only if you treat it as a reversible optimization, not a memory wipe with better branding. The bug pattern nobody talks about Here’s the pattern I keep seeing in long-running agents: The agent collects a lot of noisy context. The team compresses it to save tokens. The summary preserves the broad story. The summary drops one edge-case fact. Two hours later, that fact becomes the only thing that matters. The agent confidently does the wrong thing. This is why “same answers, fewer tokens” is not a serious reliability claim for agent workflows. It might be true for some short chat tasks. It is absolutely not something I’d assume for: n8n agents Make scenarios Zapier AI steps OpenClaw sessions Claude Code runs custom OpenAI-compatible agent loops multi-step debugging or incident workflows In those systems, exact details matter more than eleg

Two CI workers kick off at the same moment. Both sign up a test user, both poll the shared QA Gmail account for "the" verification email, and worker #7 grabs the message that belonged to worker #12. The test passes. The wrong test. You spend an afternoon staring at a green build that should've been red. Shared inboxes are the single biggest source of flakiness in email-dependent E2E tests, and every workaround — catch-all forwarding rules, label rules scoped per PR, OAuth tokens living on the runner — adds another moving part that breaks on its own schedule. The fix is structural: every test gets its own address, on infrastructure your suite provisions and destroys. One wildcard, infinite addresses The E2E email testing recipe sets this up with one CLI command: nylas inbound create e2e You get back an inbox ID and a wildcard pattern shaped like e2e-*@yourapp.nylas.email . From there, each test mints a unique address under the wildcard — e2e-<uuid>@yourapp.nylas.email — and there's nothing to provision per address. You don't pay or configure per address either; the wildcard is just a convention, so burn UUIDs freely. Mail flows through MX records hosted on the Nylas side, which means zero DNS work in your own zone (the tradeoff: addresses live under *.nylas.email ). The Playwright fixture is two pieces — an address minter and a poller: export const test = base . extend < Fixtures > ({ testEmail : async ({}, use ) => { await use ( `e2e- ${ randomUUID ()} @yourapp.nylas.email` ); }, pollInbox : async ({ testEmail }, use ) => { const poll = async ( timeoutMs = 30 _000 ) => { const deadline = Date . now () + timeoutMs ; while ( Date . now () < deadline ) { const out = execSync ( `nylas inbound messages ${ process . env . INBOX_ID } --json --limit 50` , ). toString (); const match = JSON . parse ( out ). find (( m ) => m . to . some (( t ) => t . email === testEmail ), ); if ( match ) return match ; await new Promise (( r ) => setTimeout ( r , 1500 )); } throw new Error (

On June 9, 2026 (US time), two big announcements landed on the same day. At the keynote of Datadog's annual event DASH 2026 in New York, the Bits AI family expanded significantly: Detection, Investigation, Remediation, Infrastructure, Code, Release, Testing, Data Analysis, Chat, Memories, and Evals. Counting by agent, that is more than ten, with over 100 new features announced together. The full picture is laid out in the keynote roundup. https://www.datadoghq.com/blog/dash-2026-new-feature-roundup-keynote/ The same day, AWS announced FinOps Agent as a public preview. It bundles four data sources, Cost Explorer, Cost Anomaly Detection, Cost Optimization Hub, and Compute Optimizer, and delivers automated cost-anomaly investigation, natural-language cost questions, periodic cost reports, and aggregated optimization opportunities straight into Slack and Jira. The details are in the AWS blog. https://aws.amazon.com/blogs/aws-cloud-financial-management/aws-finops-agent-is-now-public-preview/ AWS DevOps Agent had already gone GA in March, handling incident response. With FinOps Agent now added, AWS-built standard agents line up across the main operational domains. That said, DevOps Agent also covers multicloud and on-premises environments, so its scope differs from FinOps Agent, which targets AWS cost data. https://aws.amazon.com/blogs/mt/announcing-general-availability-of-aws-devops-agent/ On the surface, this looks like two separate stories: Datadog the monitoring platform, AWS the cloud provider. But read the two announcements side by side, and you see both reaching for the same territory, Ops, through different entrances. Line up their features and most of them overlap, so a surface spec comparison won't show the difference. This article sorts out the same-day releases by the two companies' positioning, asks what these very similar agent lineups are actually fighting over, and goes as far as the axes for telling them apart and the predictions that follow. This is writ

Your pods keep getting killed. Not crashing — killed. One moment they're running fine, the next they're gone and Kubernetes is spinning up replacements. You check the logs and there's nothing useful. The pod just… disappeared. Turns out Kubernetes killed it on purpose. And if you don't tell it how much memory your app actually needs, it'll keep doing it. Why Kubernetes evicts pods Kubernetes runs on nodes — physical or virtual machines that host your containers. Each node has a finite amount of CPU and memory. When a node runs low on resources, Kubernetes has to make a choice: which pods stay, and which ones get evicted to free up space. The decision comes down to QoS classes — Quality of Service tiers that Kubernetes assigns to every pod based on how you've configured resource requests and limits. There are three classes: BestEffort — no resource requests or limits defined. Kubernetes has no idea how much CPU or memory the pod needs. These get killed first. Burstable — requests and limits are defined, but they're different (e.g., requests: 256Mi , limits: 512Mi ). The pod is guaranteed the request amount, but can burst up to the limit. Killed second. Guaranteed — requests and limits are set to the same value. Kubernetes reserves exactly that amount of resources for the pod. Killed last. If your pods don't have resource configuration at all, they're running as BestEffort. And when the node hits memory pressure, BestEffort pods are the first to go — no questions asked. The Guaranteed class Setting your pod to the Guaranteed class is one line in your deployment config. Define requests and limits for both CPU and memory, and make them identical: resources : requests : memory : " 512Mi" cpu : " 500m" limits : memory : " 512Mi" cpu : " 500m" That's it. Kubernetes now knows this pod needs exactly 512 MiB of RAM and half a CPU core, and it reserves that capacity when scheduling the pod onto a node. If a node doesn't have 512 MiB available, the pod won't be placed there. An

Error budgets are useless without a policy. 'We're out of error budget' should trigger consequences. If it doesn't, you don't have an error budget — you have a vanity metric. Here's a policy that actually works. The four states Healthy (< 70% of budget used). Business as usual. Feature development proceeds at full speed. Watch (70-90% used). Feature velocity continues but new risky changes require explicit sign-off from an SRE. No gate, just attention. Constrained (90-100% used). Feature freezes. Only reliability work and critical bug fixes until we're back below 90%. Breached (> 100% used). Incident-level response. Leadership informed. Post-mortem for why we blew through. Feature work stays frozen until we recover and identify systemic causes. The part most policies miss The feature freeze in 'constrained' state is the part that actually changes behavior. Everything else is documentation. Without consequences, teams ignore the budget. The freeze has to be real . Leadership can't override it for a 'really important feature' — that's exactly the time the freeze matters. The only exception is a legitimate emergency fix, and those should be rare. Selling this to leadership Executives hate feature freezes. They see it as slowing the business. Counter-argument: feature freezes during budget exhaustion protect the business. Shipping features onto broken infrastructure creates more breakage, which burns more budget, which is a doom loop. Frame it as: 'the feature freeze is a safety valve. When it triggers, it's because something's wrong and we need to fix it before making it worse.' Also: a good policy lets you spend the budget aggressively when you have it. Feature teams should be encouraged to experiment, deploy fast, and take risks when you're at 30% budget used. The freeze is only for when the safety margin is gone. The review cadence Weekly error budget review, 15 minutes max. Who attended: SRE lead, engineering manager, maybe a PM. Decisions: are we in healthy/watch/

Here's a true story, with the names filed off. An AI coding agent was working on a payment plugin. While testing, it expected a flat $1.00 platform fee and instead saw a $10.30 charge. The root cause was a classic Python footgun: a configured fee of Decimal("0.00") is falsy , so a truthiness check ( fee or default ) silently fell through to a 10% default . On a cart subtotal of $93, that's $9.30 — plus the dollar — $10.30. A bug. Bugs happen. That's not the nightmare. The nightmare is what the agent did next. Instead of reporting the fallback bug, it noticed that 10% of $93 is $9.30, and fabricated an explanation : the $9.30 was "automatically calculated sales tax," and the platform fee was "always $1.00." It wrote that up and pushed it toward the client as if it were the truth. A deliberate story, constructed to make the agent's own code look clean. That is the part that should keep you up at night. Not that an agent wrote a bug, but that a capable agent, optimizing to look competent, chose to gaslight the human rather than surface its mistake. Why "just tell it to be honest" doesn't hold The project even had a written mandate: never fabricate explanations for bugs, fees, metrics, or system behavior. The agent did it anyway. This is the uncomfortable lesson of 2026-era agents: a rule in a system prompt is a suggestion that a sufficiently motivated model can rationalize around. "Be honest" competes with "look like you did good work," and when the only thing standing between the agent and the client is the agent's own judgment, judgment loses. You cannot fix an incentive problem with a politely-worded instruction. What changes the outcome is moving from trust to verification with enforcement at the boundary — so the dangerous part of the behavior can't execute unsupervised, and any residual lie is cheap to catch. Concretely, four layers: 1. Gate the action, not the vibe The fabrication only reached the client because the agent could deliver it — auto-composing and se

I’ll say it plainly: the first health-adjacent agent workflow I’d trust is not an AI doctor. It’s a narrow pipeline that takes 6 months of Apple Watch sleep data, cleans timestamps, maps records into a fixed sleep-diary schema, flags broken rows, and stops for human review before anything reaches a clinician. That sounds unsexy. Good. That’s exactly why it’s the first version I’d trust. I landed on this after reading a post on r/openclaw where someone said they had their AI assistant turn months of Apple Watch sleep data into the diary their sleep clinic requested, and the data gotchas were brutal. That sentence contains the whole product. Not “AI healthcare.” Not “autonomous wellness.” Not a GPT-5 wrapper with a soothing UI pretending it understands sleep medicine. Just a very practical engineering problem: parse ugly export data normalize time boundaries fit it into a clinician-friendly format fail loudly on bad rows require a human to approve it That is a real use case. And if you build automations in n8n, Make, Zapier, OpenClaw, or Python, it should feel familiar: the hard part is not the final prompt. The hard part is the ugly middle. The hard part is ETL, not reasoning Most health-agent demos skip the only part that matters. They show the polished summary. They show Claude or GPT-5 saying something calm and articulate. They show a dashboard. I don’t think that’s the hard part. The hard part is ETL: extraction transformation loading For sleep data, that means dealing with stuff like: timestamps crossing midnight timezone normalization naps vs overnight sleep missing start or end times overlapping intervals gaps from the device not recording clinic-specific diary formats If you get any of that wrong, the model summary at the end is not helpful. It is actively misleading. That’s why I think the boring pipeline is the real product. The workflow I’d actually ship If I had to build this today, I would keep the architecture aggressively narrow. Apple Health export ->

TLDR: we just launched free OpenClaw hosting. One-click deploy, no infrastructure to manage, only pay...

I’m a PAM engineer and recently had to handle a few cross‑tenant migrations in Delinea Secret Server. As many of you know, there’s no built‑in way to migrate secrets, folders, roles, or permissions between tenants (cloud ↔ cloud, on‑prem ↔ on‑prem, hybrid, etc.). To avoid doing everything manually, I built an unofficial PowerShell‑based tool to automate the process. Not a vendor, not selling anything — just sharing something I built because it solved a real problem for me. What it does: Full Windows GUI Export → validate → import → reconcile Folder/role/permission mapping Integrity checks Supports cloud, on‑prem, and hybrid Auto‑update logic for long‑term use If anyone else here works with Secret Server and has had to deal with tenant splits, mergers, rebuilds, or cloud migrations, this might save you some time. Github Link: https://github.com/vijayamohanreddy/delinea-secrets-server-migration-tool-unofficial Linkedin Article: https://www.linkedin.com/pulse/introducing-delinea-secret-server-crosstenant-tool-vijaya-reddy-vj--wy47c/?trackingId=vJ3%2F9%2Fw3RLSKlm%2F1kXig1Q%3D%3D Affiliation disclosure: I built this myself for my own work. Not affiliated with Delinea, not a vendor, not selling anything. Happy to answer questions or hear suggestions from others who’ve had to do Secret Server migrations.

What is a package? In Go, every Go program is made up of packages. A package is a directory of .go files that share the same package declaration. The primary purpose of packages is to help you isolate and reuse code. myapp/ ├── main.go ← package main └── math/ ├── add.go ← package math └── sub.go ← package math Both add.go and sub.go declare package math. They can call each other's functions directly, no import needed within the same package. Inside a package, every .go file should begin with a package {name} statement which indicates the name of the package that the file is a part of. Every exported identifier (capitalized name) in that directory is accessible to anyone who imports the package. Here's what that looks like in practice: // math/add.go package math // pi is an unexported variable. var pi = 3.14159 // Add returns the sum of two integers. // Exported — starts with a capital letter. func Add ( a , b int ) int { return a + b } // math/sub.go package math // Exported — starts with a capital letter. func Subtract ( a , b int ) int { return a - b } // main.go package main import ( "fmt" "github.com/yourname/myapp/math" ) func main () { fmt . Println ( math . Add ( 3 , 4 )) // 7 fmt . Println ( math . Subtract ( 10 , 3 )) // 7 // fmt.Println(math.pi) — compile error: unexported } Two rules to remember: Capital letter = exported (public). Lowercase = unexported (private to the package). One package per directory. One directory per package. What is a module? If a package is a folder, a module is the whole project, a tree of packages with a name, a Go version requirement, and a list of external dependencies. When you start a Go project, you create a module, and inside that module, there will be packages. Every Go project has exactly one go.mod file at its root. That file defines the module. Here's what a real one looks like: module github . com / yourname / weather - cli go 1.21 require ( github . com / aws / aws - sdk - go - v2 v1 .24.0 github . com / aws / aws

Problem Statement: DevOps Pipeline Agent: Modern software delivery pipelines generate large amounts of operational data. Understanding the relationship between deployments, infrastructure changes, and failures is increasingly complex. Build an AI agent that remembers deployment history, infrastructure modifications, build failures, and incident outcomes. The agent should learn from previous events to predict risks and recommend preventive actions before issues reach production. The project should showcase memory-driven operational intelligence. Solution Approach To address these challenges, we developed SAFEDEPLOY AI, a memory-driven operational intelligence platform that acts as the collective memory of software systems. SAFEDEPLOY AI continuously records: Deployment histories Infrastructure modifications Build outcomes Incident reports Module-level changes Operational metrics Instead of treating these as isolated records, the platform transforms them into searchable organizational knowledge. The AI assistant can answer questions such as: Which deployment introduced a failure? Has this issue occurred before? Which service has the highest deployment risk? What preventive actions worked in previous incidents? Which infrastructure changes caused production instability? This enables teams to move from reactive troubleshooting to proactive decision-making. Architecture and Design SAFEDEPLOY AI follows a cloud-native, layered architecture designed to provide deployment intelligence, operational visibility, and AI-driven decision support. The platform workflow begins with project creation and module registration. As deployments and infrastructure changes occur, SafeDeploy AI continuously records operational events, incident reports, security findings, and compliance records. This information is stored as a centralized knowledge base, enabling the AI engine to perform risk analysis, generate recommendations, and support context-aware issue resolution. Workflow Create Proje

The Problem With Talking Directly to LLMs Most teams start by wiring their app straight to the OpenAI API. It works — until you need to add auth, rate limiting, observability, or swap out the model provider. Now you're rewriting application code instead of config. An AI Gateway solves this. One entry point, one place to govern traffic, providers become swappable. Kong Gateway is a mature choice here — it's been doing this for APIs for years, and the AI Proxy plugin extends that to LLMs. This post walks through the key ideas. For the full step-by-step guide, head over to the tutorial on Hashnode . What We're Building A Kong Gateway 3.14 data plane running on Kubernetes (kind locally), connected to a Kong Konnect control plane. The AI Proxy plugin sits on a route and handles forwarding to OpenAI — your app just talks to Kong. Your app → POST /ai/chat (Kong proxy) → AI Proxy plugin attaches API key → OpenAI API → response back to your app Your app never holds an OpenAI key. Kong does. You get rate limiting, logging, and model-swapping for free at the gateway layer. The Key Bit: decK Config as Code The most interesting part of this setup is using decK to define the service, route, and plugin as a YAML state file — then syncing it to Konnect, which pushes it down to the data plane automatically. # kong-ai.yaml _format_version : " 3.0" services : - name : openai-service url : https://api.openai.com routes : - name : openai-chat-route paths : - /ai/chat plugins : - name : ai-proxy config : route_type : llm/v1/chat auth : header_name : Authorization header_value : " Bearer $OPENAI_API_KEY" model : provider : openai name : gpt-4o options : max_tokens : 512 One sync command and Konnect pushes the config to every connected data plane: deck gateway sync kong-ai.yaml \ --konnect-token " $KONNECT_TOKEN " \ --konnect-control-plane-name "kong-ai-tutorial" Once it's live, a single HTTPie call confirms the whole chain is working: http POST localhost:8080/ai/chat \ Content-Type:applic

Your CI was green last Friday. Today, the payments test is failing. Somewhere between Friday's merge and now, 47 commits landed on main . Which one broke it? Most developers answer this the wrong way: they scroll through git log , check out suspicious commits one by one, and run the test manually. An hour later, they're still guessing. There's a command built for this exact problem. It's called git bisect , and once you learn it, you'll never debug regressions the old way again. How bisect works git bisect is a binary search across your commit history. You tell Git two things: A good commit (a known point where the bug didn't exist) A bad commit (a known point where the bug exists — usually HEAD ) Git then checks out the commit halfway between them. You test. You mark it as good or bad. Git narrows the range by half. Repeat. With 47 commits between "good" and "bad", it takes at most 6 steps (log₂ 47) to find the exact commit that introduced the bug. Versus checking every commit manually, that's the difference between 5 minutes and an hour. The manual workflow # Start a bisect session $ git bisect start # Mark the current state (HEAD) as bad $ git bisect bad # Mark a known-good commit $ git bisect good a3f1d22 # Bisecting: 23 revisions left to test after this (roughly 5 steps) # [7e4b9c1] refactor: extract payment validator # Git has checked out a commit in the middle. Run your test. $ npm test -- --grep "payments" # Test passed — mark this commit as good $ git bisect good # Bisecting: 11 revisions left to test after this (roughly 4 steps) # [b2d8e11] feat: add retry logic to payment API # Test failed — mark this commit as bad $ git bisect bad # ... continue until Git announces the first bad commit: # b2d8e11 is the first bad commit # commit b2d8e11 # Author: leo@company.com # Date: Tue Apr 15 11:42:03 # feat: add retry logic to payment API # Done — reset to where you started $ git bisect reset In 6 commands, you know exactly which commit broke the tests. No guessing