Service-to-Service Trust: mTLS in the Chassis
Convey's certificate middleware authenticates machines instead of users - a forwarded-cert header, a subject ACL, and two defaults that look like security and aren't.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 388 articles
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
Cards
List
Greenfield Is a Diagnosis, Not a Prize
Teams ask for a rewrite as though greenfield were a reward for enduring the old codebase - it is a diagnosis with a test attached, and misdiagnosis is how rewrites fail. Part 1 of 2 on choosing the field you build on.
The Mapper in the Middle
Seventeen parts of reading FastEndpoints and the series never once mentioned mappers - the entity-translation layer half the endpoint base classes exist to serve. The Missing Chapters opens with the biggest gap: where mappers live, how they are found, and why they are secretly singletons. Part 1 of FastEndpoints — The Missing Chapters.
JWTs and the Blacklist Problem
Convey's auth packages in two acts - a JWT layer that turns one config section into token issuing and validation, and the uncomfortable question every stateless system meets on logout day.
When the Percentage Looks Wrong
Every confusing statusline behaviour is a lesson about the harness underneath - the token arithmetic that refuses to match, the 300ms debounce, the five-second timeout, and the escape codes that fight back.
When Not to Use FastEndpoints
After sixteen parts inside the source, the honest retrospective - what the library gets right, the sharp edges that will cut you (singletons, statics, magic), and the projects where I would leave it on the shelf. Part 17, the conclusion of FastEndpoints in Depth.
Five Scripts and One Settings Key
The statusline build, end to end - a stdin JSON contract, an entry point that reads once and delegates, a colour-coded session line, git platform routing, and the single settings.json entry that wires it all in.
Secrets Before Configuration: Convey and Vault
How Convey's Vault package loads secrets into IConfiguration before the container exists, turns dynamic database credentials into ordinary config keys, and renews leases in the background - plus the secret-zero problem it cannot solve.
A Statusline Is a Tiny Harness
The first exercise I give anyone learning to direct coding agents has no prompt in it at all - it is a status bar. Why sixty lines of PowerShell teach context and harness thinking better than any lecture about either.
Throttling, Idempotency, and an HTTP 402 Surprise
The cross-cutting drawer of FastEndpoints holds a rate limiter that documents its own limitations, idempotency built on output caching, server-sent events - and a full implementation of the x402 micro-payments protocol. Part 16 of FastEndpoints in Depth.
Discovery and Load Balancing Before the Mesh
How Convey wires Consul registration, health-gated deregistration and client-side balancing - and why Fabio exists to take the balancing decision back out of your process.
What AI Changes About Measurement
The series retrospective - what the AI-era evidence actually says with every figure dated and attributed, the nine characteristics of ISO 25010 as revised in 2023, and what I now gate differently when much of the diff was machine-written.
The Misleading-Metrics Graveyard
Eleven numbers that still haunt engineering dashboards - what killed each one, from Goodhart to queueing theory to changing fashion, and the one-line replacement carved on every headstone.
Trading Reflection for Roslyn: Source Generators and Native AOT
Everything FastEndpoints does with reflection - discovery, setters, factories - has a compile-time twin in its source generators, and following that migration is a case study in making a reflection-heavy library AOT-ready. Part 15 of FastEndpoints in Depth.
Reporting to Three Audiences
The team, the team lead and the executives need different slices of the same truth - what each audience should actually see, the numbers I put in front of a boardroom, and dashboard principles that skip the red-amber-green pantomime.
Typed Clients Over One HTTP Door
Convey's HTTP story in two layers - a hardened IHttpClient with retries, masking and correlation headers, and RestEase interfaces on top that turn a service name in config into a typed client.
APIM API Provisioning: Governance as Code, One for_each at a Time
The catalog's finale: three child modules fanned out over locals maps turn AAD groups, APIM products and OpenAPI-imported APIs into reviewable code, map keys double as URL routing taxonomy, and policy XML gets environment-templated by a blunt string replace - plus a retrospective on what fifteen modules taught. Part 15 of the Terraform Module Catalog.
Capturing It All in Azure DevOps
What Azure DevOps will measure for you and where it stops - the two clock definitions, the reactivated-item rule, how to read a cumulative flow diagram, and why Microsoft's own guidance points past its widgets to OData.
Route-less Tests: Integration Testing With Typed Clients
FastEndpoints ships a testing package where tests call endpoints by class name, apps boot once per fixture, and even command handlers can be faked - the route string never appears in a test. Part 14 of FastEndpoints in Depth.
SPACE and the Human Dimensions
Why no single metric captures developer productivity - the SPACE framework's five dimensions in plain terms, the measure-at-least-three rule, and what I do about the two dimensions no dashboard can hold.
Persistence as a Registration: Mongo and Redis
What you get when a chassis reduces MongoDB to one builder call and a named collection - a generic repository, paging, camelCase conventions, a seeding hook - and the transactions and indexes it deliberately leaves on your desk.
Flow Metrics and Little's Law
The queue mathematics underneath delivery - one equation from 1961, Scaled Agile's six flow metrics rewritten in plain terms, and why the biggest delivery gains hide in the waiting rather than the working.
Private DNS: Anatomy of a Half-Finished Template
The catalog's cautionary tale: an empty variables.tf, no platform JSON, UPDATE placeholders for every value, one pvars file for four declared workspaces, a subscription ID hardcoded into the provider, and a pipeline with a leftover debug step - what shipping a half-finished golden template does to the two hundred copies made from it, and a checklist for done. Part 14 of the Terraform Module Catalog.
Five Metrics, Not Four
DORA as it actually stands - five metrics since the 2024 report, benchmarks dated to their vintage, the 2025 archetypes, and the comparison warning printed on the tin.
A Job Queue Is a Command With a Tracking ID
FastEndpoints' job queues persist commands through a storage provider you supply and execute them with a semaphore design that idles without polling. The state machine in JobQueue.cs is worth the read on its own. Part 13 of FastEndpoints in Depth.