Notes from the studio.
Guides and field notes on web, cloud, and DevOps — written by the team.
Building Production AI Agents with Claude: Tool Use, MCP, and Guardrails
A practitioner's guide to shipping Claude-powered features that survive contact with production — tool schemas, forced tool use, MCP, prompt caching, and the guardrails that keep an agent from becoming an incident.
Passkeys and the Post-Password Stack: Auth Architecture in 2026
Passkeys have crossed from conference-talk material to default expectation. Here's how we architect signup, login, sessions, and recovery around them — and where the sharp edges still are.
Supply-Chain Security for JavaScript Teams: Surviving the npm Attack Era
Billion-download packages hijacked in an afternoon, a self-replicating worm crawling through maintainer accounts, credentials exfiltrated straight out of CI. Here's the supply-chain hardening playbook a small JavaScript team can actually run.
Platform Engineering in Practice: An Internal Developer Platform Without a Platform Team
You don't need a platform team to have a platform. Here's how small engineering orgs get 80% of an internal developer platform from repo templates, reusable CI, IaC modules, and a managed PaaS — and where the remaining 20% is a trap.
Zero-Secret CI/CD: OIDC, Ephemeral Credentials, and Pipelines That Can't Leak What They Don't Have
Long-lived cloud keys in CI secrets are a breach waiting for a timestamp. Here's how we build pipelines around OIDC federation and short-lived credentials — so there's nothing to steal in the first place.
AWS Cost Engineering: Graviton, Spot, and the Discipline of Not Overpaying
Cloud bills don't explode — they creep. An engineering-first tour of the AWS cost levers that actually matter: Graviton, Spot, storage tiering, commitment discounts, and the discipline to skip the optimizations that cost more than they save.
Terraform at Scale: Modules, State, and the OpenTofu Question
Past the tutorial stage, Terraform problems stop being about syntax and start being about structure: state blast radius, module contracts, drift, and now a genuine fork in the road. Here's how we think about all of it.
Designing for the AI Era: UX Patterns for Streaming, Uncertainty, and Trust
AI features break three assumptions classic UX was built on: determinism, predictable latency, and honest failure. Here are the streaming, uncertainty, and trust patterns we actually ship — and the ones we refuse to.
The Modular Monolith: Why Your Next Backend Probably Shouldn't Be Microservices
Most teams pay the distributed-systems tax years before anything forces them to. Here's how a modular monolith buys you real boundaries, async messaging, and a clean path to services later — without the pager fatigue.
API Design in 2026: REST, GraphQL, gRPC — and Making Your API Agent-Ready
The protocol wars are over and REST quietly won — but a new API consumer has arrived that nobody designed for. Here's how we design APIs that serve humans, services, and AI agents without three separate codebases.
Just Use Postgres: Queues, Search, Vectors, and the Case Against Ten Databases
Most startups don't need Redis, Elasticsearch, Pinecone, and RabbitMQ — they need one well-run Postgres. Here's how far a single database actually goes, with real SQL, and an honest map of where it stops.
Server Components, Settled: How We Architect Next.js Apps Now
A few years after the App Router shipped, the arguments have died down and the patterns have hardened. Here's how we actually architect Next.js apps in production — server by default, client components as islands, and the boundary as a design tool.
Web Performance in 2026: INP, Speculation Rules, and Making the Web Feel Instant
The 2019 performance checklist — minify, compress, lazy-load — no longer moves the needle. Here's what does: INP debugging, speculative navigation, bfcache, and measuring what your users actually feel.
Observability Without a Platform Team: OpenTelemetry That Pays for Itself
You don't need a platform team to know why production is slow. A pragmatic OpenTelemetry setup — traces first, a Collector you control, sampling that keeps the bill sane — for teams of two to ten engineers.
TypeScript in 2026: The Go-Powered Compiler and Type-Driven Development
TypeScript's compiler is going native — Microsoft's Go port promises roughly 10x faster type-checking — but raw speed only pays off if your types are doing real work. Here's how we practice type-driven development on client projects, from branded types to knowing when to stop.
Shipping with AI Coding Agents: Workflows, Guardrails, and Review in the Agentic Era
Coding agents stopped being autocomplete a while ago — they read your repo, run your tests, and open PRs. Here's how we actually integrate them at Luminary: the workflows that work, the guardrails that matter, and why code review is now the constraint.
Beyond Naive RAG: Context Engineering for AI Products That Actually Answer
The chunk-embed-top-k recipe demos beautifully and disappoints in production. Here's how we build retrieval in 2026 — structured chunking, hybrid search, access control, agentic retrieval, and evals that actually predict answer quality.
Local-First and the Sync Engine Renaissance: Apps That Never Show a Spinner
Local-first has gone from research manifesto to shipping architecture: reads and writes hit a store on the device, sync happens in the background, and the spinner disappears. Here's how the new sync engines work, where they hurt, and how we'd adopt one incrementally.
Accessibility Is Law Now: Building for the European Accessibility Act (and Everyone Else)
The European Accessibility Act is in force, ADA suits keep climbing, and overlay widgets won't save you. Here's how a small senior team actually ships accessible products — the regulations, the 80/20 of real bugs, and the code.
SEO After the Ten Blue Links: Being the Answer in AI Search
AI answers are eating the search results page. Here's an engineer's guide to staying visible when the interface is a paragraph, not a list — what's real signal, what's snake oil, and what to actually ship.
Zero-Downtime Database Migrations: Expand, Migrate, Contract
Schema changes don't need maintenance windows — they need discipline. A practical walkthrough of the expand/migrate/contract pattern, the Postgres locking details that actually matter, and the deploy-order rules that keep live systems live.
Monorepos That Don't Melt: pnpm Workspaces, Turborepo, and CI That Scales With You
Monorepos won the argument for product teams — then the CI bill arrived. Here's the architecture we actually use: pnpm workspaces, Turborepo, affected-only CI, Changesets, and the boundaries that keep it all from melting.