Blog
Engineering, product, and public-sector notes on the DevOps execution layer.
In organizations where product managers write code with AI and several agents work at once, who checks what before a change reaches production? A role design for verification, approval, and recovery that is independent of the author, grounded in NIST SSDF, SLSA provenance, and the Google SRE postmortem culture.
John Baek
The problem Mylyn set out to solve in the mid-2000s is the agent context problem. What changed is that the thing reading that context is no longer only a person.
Yeongsang Kim
Once writing code got cheap, a developer's time moved to judging and approving. Here is why those jobs cannot live outside the editor, and the choices behind the CollabOps VS Code extension.
Seungbaek Lee
How does this work with Eclipse, and can it integrate with our ITSM — these two questions almost always arrive together. What "standard Git protocol" actually means as an answer, and why the real substance of the ITSM requirement is the evidence chain.
John Baek
Ten concurrent users fit on one 80GB GPU, dozens start at two, and if a hundred people run agents simultaneously you're genuinely talking dozens of cards. The VRAM formula, model tiering, and why agent token consumption dominates sizing. A write-up of the GPU questions we keep getting in meetings.
John Baek
A major SI organization with a fully automated toolchain asked us why they'd need us at all. Three-year projects, year-long planning phases, strict governance. Their question rests on three premises. Let's examine each one.
John Baek
Every demo gets the same question. Shouldn't the AI look at the connected sources, not just the file it's changing? And who builds those connections? The answer is that nobody does. Here's the structure behind that short answer.
John Baek
Claude Code and Cursor are collapsing the cost of writing code. But when code gets cheap, the bottleneck doesn't disappear; it moves. On context supply, execution paths, approval, and where coding agents and a DevOps platform interlock.
John Baek
Twelve months after The Next Decade of DevOps Is Agentic. Honest evaluation of which hypotheses held, which were partially wrong, and which we abandoned.
John Baek
Six months after Why Three Pillars Aren't Enough. How the four added signals (events / user journeys / deploy correlation / similarity) actually performed in production.
John Baek
On per-minute price, self-hosted wins by 80%. On DIY total cost, GitHub Actions wins by 35%. Move the indirect costs from people to a platform and the math flips one more time. Twelve months of measured numbers.
John Baek
New domain. Zero backlinks. DA zero. Can we get *cited in LLM answers* in six months? *Conditional yes*. The four-stage experiment with measured results.
John Baek
Cloud DR guides assume *multi-region*. Air-gapped has *no regions*. A four-resource taxonomy and a redundancy strategy for each.
John Baek
"Multi-agent systems" are 2026's hype. We tried it five times and *fell back to single-agent every time*. Why *one agent + good tools* is almost always the right answer.
John Baek
Not "agents replace people." It's that humans and agents share the same authority model and the same audit trail. That single difference defines the next ten years.
John Baek
The MCP server *official guide* gets you to PoC. The *production deployment* that follows hits five things the guide doesn't cover — JSON-RPC translation, per-tool authorization, error semantics, lifecycle, isolation.
John Baek
2023's answer was almost always RAG. 2026's answer is *conditional*. Four variables that decide it — and the cases where the answer is *both*.
John Baek
Nine months running self-hosted *Llama 3 / Qwen 2.5* in an air-gapped environment where cloud LLMs aren't an option. The four things guides skip — GPU allocation, throughput, fine-tuning, model refresh.
John Baek
We assumed *LLM call cost is small*. Six months in, the bill was *$4,200*. Six weeks of work and six patterns brought it to *$890*. The breakdown.
John Baek
Code assistants only need a cloud GPU. Operational agents don't. Three structural constraints — data boundary, execution authority, audit obligation — decide everything else.
John Baek
When an agent acts in production, you must be able to *undo it*. It's not "ctrl+z". Four rollback strategies and the scenarios each fails in.
John Baek
CollabOps's minimum is *one VM, 8 vCPU, 16 GB RAM, 200 GB SSD, one internal IP*. That single line compresses *six months of architectural decisions*. Here's how.
John Baek
At some point an AI agent decides *I can't* and hands off to a human. If that handoff isn't designed well, the human *starts the investigation from scratch*.
John Baek
Cosign adoption itself takes *two weeks*. The key-rotation policy took *seven months* to settle. Four assumptions that broke in that gap.
John Baek
LLM agent *memory* isn't about *storing everything*. It's about *deciding what to forget*. Four memory types, four forgetting policies.
John Baek
We started with SBOM as an *audit PDF*. Six months later it had become *the first tool we reach for in incident response*. The four-stage transition.
John Baek
SLSA Level 2 is *nearly free*. Level 3 is where *real cost* starts. Eighteen months of measured time, money, and political cost.
John Baek
There's plenty of comparison material between the two — almost none from the *air-gapped* perspective. Where they actually diverge across four evaluation axes.
John Baek
Five Dockerfile patterns that were *recommended in 2020* now *work against you in 2026*. What changed.
John Baek
"Tests are slow, parallelize them" isn't always the right answer. Six months of data on diminishing returns.
John Baek
What I thought when I first read the spec, the traps that bit us over six months of writing tool adapters, and why this turned out to be the deciding piece for our DevOps agents.
John Baek
We started with *3 OS × 3 Node = 9 jobs*. Six months later, *4 axes × avg 5* meant *100× the original build time*. How to cost matrices *up front*.
John Baek
After adopting Renovate, *60% of our PRs* were auto-generated and *5% broke production*. Those four patterns.
John Baek
The monorepo / polyrepo debate isn't unanswerable. It's *conditionally* answered. Five variables decide it. The pattern across seven cases.
John Baek
We asked the same one-line question to seven customer security teams. The answers split *completely*. The four variables that decide the answer — and the boundary we recommend.
John Baek
The decision to spin up an ephemeral environment per PR is *seductive*. Twelve months of measured cost showed *the bill wasn't where the cost lived*.
John Baek
A list of every cloud-CI assumption that broke when we shipped our first on-prem deployment. Not theory — what actually went wrong, in order.
John Baek
We started with feature flags as on/off toggles. Nine months later they had become *the most frequently changed surface in our infrastructure*. The transition point and what changes there.
John Baek
The assumption that canary works is *mostly correct*. Outside that "mostly" are seven patterns. Cases we lived through, broken down.
John Baek
Error budgets in books are clean. A year of *actually applying one* in production isn't. What four quarters taught us, in order.
John Baek
It is convenient to say "three views of the same picture." That isn't accurate. The differences are responsibility boundary, SLOs, and the platform-as-product model.
John Baek
For SCA and dependency scanning to mean anything in air-gapped networks, you need to maintain CVE / OSV / vendor advisory data internally. Four data streams, four sync traps, one verification.
John Baek
Logs, metrics, and traces all looked normal. Twenty-three users couldn't pay for twenty-three minutes. The gap between those two facts is where the "three pillars of observability" stopped being enough.
John Baek
We swapped 47 long-lived AWS access keys for OIDC workload identity. Six months later the audit trail dropped from 47 lines per deploy to one. The six-step migration and the assumptions that broke along the way.
John Baek
We thought we'd save $48k a year by going self-hosted. We saved $11k. Here's where the other $37k went.
John Baek
Past the "shift left" slogan — what DevSecOps means in practice, where it fails, and how it changes shape in on-prem environments.
John Baek
We migrated four customers off Jenkins. Three went smoothly. The fourth took seven months. The difference wasn't the pipelines. It was the five things Jenkins kept hidden.
John Baek
Six months of writing a PEG parser because we couldn't accept the "almost the same" 80% of GitHub Actions expressions. What we cut, what we added, what it actually cost.
John Baek
Seventeen years, five distinct stages. What each one solved, what it left unsolved, and where we actually are now.
John Baek
The structural reasons tool integration keeps failing in on-prem environments — and why an execution layer matters more than another dashboard on top.
John Baek
