Arthur Costa

storage has seen token 33

Simulates a missing safety dependency. Every demo on the page then fails closed and refuses to run; reading is unaffected.

33token · lease granted

Fencing · only the current token writes

Arthur Costa

    Accepted writes · the only quantified results

      Writer A (token 33) paints my portrait, pauses, and loses its lease; B (token 34) finishes it, and A's late writes are rejected.
      34token · invariants

      The invariants I write under

      Everything after this section is checked against these. They lead because they are the part of my work that holds when something else breaks.

        35token · production

        In production

        The two records from work, with their measured results. Invariant 5, load tests before peak events, was written here.

        36token · AC-006writes refused

        Fail closed

        One hook, three clients: what “fail closed” means in practice

        An agent sends four commands through the hook (illustrative commands). Remove the safety dependency (top bar, or the button below on a phone), then run them again.

          Text equivalent: with the dependency present, each command reaches the policy check. With it missing, each is refused with a reason, never caught and allowed; a fail-open hook would have let all four through.

          37token · AC-004writes refused

          Crash it on purpose

          Kill points, 0 to 50 ms, and what the suite checks after each

          PASS implemented and heldFAIL implemented and brokeSKIP not implemented, never PASS

          Text equivalent: the create is killed at the chosen point (0–50 ms), which can leave a half-made VM. On restart the driver reclaims the previous run’s VMs; the check is a leak counter back at zero.

          38token · AC-007writes refused

          A paused writer cannot win

          Lease expiry and a stale writer (DDIA's tokens 33 and 34)

          storage holds one image

          Text equivalent: A (token 33) writes the top rows, pauses and loses its lease; B (token 34) writes the rest. A wakes and writes with 33: with token checks on, storage rejects it and the portrait stays whole; off, A’s stale rows land over B’s and the image is corrupt. AC-007 applies the rule to lab user ids and CA rotation.

          39token · own time

          Where the token lives in the rest of my work

          The same rule, a token checked before a write is accepted, in the other systems I built on my own time.

            40token · roles

            Leases held, 2017 to 2026

            Each role is a lease with a higher token than the one before, handed over rather than overlapped. Described by system and domain; employers are not named.

              41token · tools

              What I write with, and what I gave back

              Also built, on my own time

                Upstream and community

                  42token · next lease

                  Grant the next lease

                  Current state of storage: one consistent image, written only by the newest token. The next lease is token 8; the last one is on the timeline above.

                  43token · colophon

                  Why this design

                  1. The concept is DDIA chapter 8: a lease holder can pause, wake up and write anyway, so storage must check a fencing token and reject anything older than the newest it has seen.
                  2. The page is that storage: every section is a write carrying a token, 33 to 43; a token turns from grey to ink when storage has seen it, the tokens only rise as you read, and the bar at the top shows the highest one storage has seen (reads need no token, so scrolling back changes nothing).
                  3. Safety leads the information architecture: the invariants come first as the spine, then the production work they were written in, then the three records where the rule is most direct (AC-006, AC-004, AC-007), and roles become leases handed from one token to the next.
                  4. “Remove safety dependency” makes the whole page fail closed: every demo refuses with a reason instead of running, which is AC-006's rule applied to this document.
                  5. My portrait is the storage: the hero paints it under two writers over a faint copy, so it is never an empty frame; the stale-writer demo shows what an unchecked token does to it, and the contact section shows it whole, written only by the newest token.
                  6. One family, Archivo, from tokens at width 62 to reading text at width 100 and 17.5 px; its width axis is the pause, so the name narrows while writer A is stopped. IBM Plex Mono is kept for tokens, labels and the demos' output.
                  7. Colour comes from the plate: warm off-white and ink, teal for the current token and anything accepted, ochre for the stale writer, terracotta only for a rejection or a refusal, each also written as a word.
                  8. Motion shows only causality and plays once; every demo has a text equivalent, controls are real buttons and inputs at 44 px, reduced motion shows end states, and Pause stops everything.

                  Facts on this page come from my records; employers and clients are deliberately not named. Demo commands are illustrative.

                  Complete profile

                  Senior backend & platform engineer · Porto, Portugal

                  I build platforms that hold up in production: moving fleets to the cloud, turning batch into event streams, and, on my own time, execution platforms and safety tooling for coding agents.

                  Open to senior backend or platform roles, remote or hybrid

                  Nine years in production (since 2017)

                  Decision records

                  2023–2025 · At work · Platform · Delivered

                  200+ instances to cloud local zones, with autoscaling

                  Compute cost fell by ~70% across 200+ instances.

                  ~70% lower compute cost — 200+ instances moved from on-prem and edge sites to cloud local zones, with autoscaling

                  200+ instances migrated — with autoscaling, for live sporting-event peaks

                  Context and decision

                  Context. A real-time platform for live sporting events ran its workloads on on-prem and edge environments.

                  Decision. Lead the infrastructure modernization: migrate the workloads to cloud local zones and enable autoscaling, with multi-region load tests before peak events.

                  Stack. Cloud local zones · Autoscaling · Go · Python · Locust

                  2022–2023 · At work · Payments · Delivered

                  Payment settlement, from batch to event-driven

                  Processing success rose from 60% to 90%+.

                  60% → 90%+ processing success — payment settlement moved from batch to event streams with change data capture

                  Context and decision

                  Context. A legacy payment and settlement platform ran as batch processing on a monolith.

                  Decision. Move the core components to Java and Go, replace batch with streaming and change data capture, containerize on Kubernetes, and centralize logs and dashboards for the SLAs.

                  Stack. Java · Go · Streaming · CDC · Kubernetes

                  2026 · Own time · Platform · Working system

                  Horus: remote execution for builds and agent jobs

                  A changed worktree is a new job, never a silent retry; a worktree without a data class never leaves the machine.

                  Context and decision

                  Context. Builds and coding-agent jobs start on a workstation but need the CPU, isolation and uptime of a remote fleet, without leaking a private worktree or losing work halfway.

                  Decision. A local daemon with a socket API and a written durability contract; content-hash sync so a job runs on exactly the bytes submitted; recovery bound to that content; a versioned accounting ledger; gVisor sandboxes on VPS runners behind a data-class gate.

                  Stack. Go · Rust · gVisor

                  2026 · Own time · Virtualization · Spike

                  Firecracker microVMs as a sandbox compute driver

                  A failure-injection suite on a KVM host (kill mid-create, simulated reboot, duplicate RPCs, kill points 0–50 ms, a leak counter) and 23 security probes on a 22-item adversarial matrix. An unimplemented check reports SKIP, never PASS. Proposed upstream as OpenShell#4351.

                  Context and decision

                  Context. Can Firecracker microVMs, with the jailer, back an open-source agent sandbox runtime (OpenShell) through the whole lifecycle, and stay correct when things crash?

                  Decision. A compute driver with its own guest kernel, images from a verified catalog, reclamation of the previous run's VMs at start-up, and a guest flush before Stop.

                  Stack. Go · Firecracker · KVM

                  2026 · Own time · Platform design · Accepted

                  Retire my own agent platform; keep the native clients

                  Far less to operate; contribution rules now refuse new routers, schedulers and dashboards.

                  Context and decision

                  Context. My agent-workflow repository had grown a router, a scheduler, a coordinator hierarchy, a provider dispatcher and a dashboard in front of three coding-agent clients.

                  Decision. Retire it (19 October 2026). Each client runs natively; the repository keeps shared skills, a small configuration, standalone safety tools and 26 dated decision records.

                  Stack. Python · Bash

                  2026 · Own time · Platform safety · Accepted

                  Safety tools fail closed

                  Documented as a tripwire, not a sandbox, so nobody mistakes it for isolation.

                  Context and decision

                  Context. Coding agents run shell commands in real repositories from three clients with three hook systems; secrets once reached a model through process arguments.

                  Decision. One command-safety hook for all three clients; output redaction; long-lived credentials kept out of worker reach; a missing safety dependency refuses instead of being caught and allowed.

                  Stack. Python

                  2026 · Own time · Distributed systems · Lab

                  Course labs on microVMs, behind an mTLS control plane

                  A lab's user id stays reserved until its cleanup has succeeded; CA rotation cannot be bypassed by session resumption.

                  Context and decision

                  Context. A course platform gives every learner a disposable lab machine, created and destroyed constantly by many people at once.

                  Decision. A microVM lab runtime with a chaos test that kills VMs mid-session; idempotent resets by key; mutual TLS on a control-plane CA with reload without restart; pinned keyless signing that fails closed.

                  Stack. Go · Kotlin · protobuf

                  2026 · Own time · Storage & consensus · Study

                  A relational database, from storage to Raft

                  Built layer by layer as a study; each phase is a commit history.

                  Context and decision

                  Context. The fastest way to understand a distributed database is to build its layers in order and see where each guarantee comes from.

                  Decision. Disk manager, buffer pool, B+ tree, heap file and write-ahead log; SQL parser, planner and Volcano executor; 2PL then MVCC; Raft, Multi-Raft with range sharding, Percolator-style transactions, SSI with hybrid logical clocks, an S3 backend and the PostgreSQL wire protocol.

                  Stack. Rust

                  2026 · Own time · Sync & security · Working system

                  Offline-first sync with signed form-fill

                  The extension never fills a form the owner did not approve.

                  Context and decision

                  Context. A personal job-search tool runs on several desktops plus a browser extension; data must sync without a central source of truth.

                  Decision. Tombstones pruned only once every active desktop has applied them; fill tokens signed on the desktop with a P-256 key from the OS keyring; an encrypted vault export; an LLM judge measured against blind readings.

                  Stack. Go · Rust

                  2025–2026 · Own time · Developer tooling · Shipped v2.1.1

                  gitshift: many Git identities, one machine

                  Switching on a directory change went from about 3.8 s to about 0.5 s.

                  3.8 s → 0.5 s directory switch — gitshift identity switch on directory change, release v2.1.x

                  Context and decision

                  Context. Several GitHub and GitLab accounts on one machine means juggling keys, identities and signing by hand.

                  Decision. One command switches Git author, SSH key, commit signing and the GitHub CLI account, by alias or automatically by directory; releases through GoReleaser and a Homebrew tap.

                  Stack. Go · GoReleaser · Homebrew

                  Project source

                  Experience

                  1. Software engineer, core call control

                    2025–2026 · Cloud contact-centre platform

                    Load tests to inform cost optimization and Kubernetes autoscaling; graceful shutdown and connection draining in a shared Helm chart; CI repaired with quality gates; codebase rules for agentic coding, shared with the team.

                  2. Software engineer, platform / backend

                    2023–2025 · Real-time platform for live sporting events

                    Led the move of on-prem and edge workloads to cloud local zones with autoscaling (AC-001); real-time, event-driven services on serverless and containers; Go and Python automation; Locust multi-region load tests for peak events; CI/CD across GoCD, GitHub Actions, Jenkins, Buildkite, Ansible and Packer; metrics, logs, traces and alerts.

                  3. Software engineer, payments / settlement

                    2022–2023 · Payment and settlement platform (consulting)

                    Led the modernization of a legacy payment and settlement platform to event-driven streaming and CDC (AC-002).

                  4. Software engineer, post-purchase

                    2021–2022 · E-commerce marketplace, several countries

                    Backend services in Go, Java, Node.js and Groovy for post-purchase and payment workflows; faster claim and dispute resolution.

                  5. Software engineer

                    2019–2021 · Core banking, Brazil

                    Monoliths and mainframe-based systems modernized into Java and Spring microservices; migration of microservices to the public cloud under regulatory SLAs.

                  6. Associate software engineer, CRM & integrations

                    2018–2019 · Fintech CRM

                    Real-time CRM features integrated with banking services such as loans, OTP and account management.

                  7. Associate software engineer

                    2017–2018 · Software house

                    CRM and warehouse management systems in PHP and JavaScript.

                  How I work

                  Also built

                  Drover

                  Watch and approve agent sessions from any device: a Rust core over UniFFI, pairing scopes bound to the consumed token.

                  Rust

                  JVM performance labs

                  Eleven on-heap versus off-heap lock-free scenarios with JMH, and 13 serialization frameworks behind one endpoint. Numbers not quoted until re-run with raw output.

                  Java · JMH

                  graphql-federation

                  Federation 2 across Java, Go and TypeScript subgraphs, gRPC between services, SLO burn-rate dashboards.

                  Java · Go · TypeScript · gRPC

                  Ponte

                  A management system for tutoring schools: live lessons with recording and consent, TOTP and lockout, a finance ledger ported to Go and checked by replaying a shared corpus.

                  TypeScript · Go · PostgreSQL

                  deep-engineering-knowledge-base

                  An LLM pipeline that writes and checks engineering lessons, with an independent critic that excludes the author.

                  Python

                  techish-visual

                  An engine for animated technical diagrams: a ThorVG WASM renderer and performance budgets in CI.

                  TypeScript

                  keyframe

                  A Linux studio for recording and editing technical videos, with cuts snapped to silence.

                  Rust

                  java-workflows

                  Reusable GitHub Actions for Java teams: a Java 11 to 25 matrix, security scanning and SBOMs.

                  GitHub Actions

                  Upstream

                  OpenShell#4351

                  Firecracker compute driver proposal, from AC-004 (open source). · open

                  OpenShell#4591

                  A gateway reporting "database is locked" under two concurrent clients. · open

                  Orca, 10 pull requests

                  SSH OAuth forwarding, pairing-offer rotation without restart, security events, isolation from external agent config. · 9 open, 1 closed

                  Stack

                  Languages
                  Go · Java · Python · TypeScript · Node.js · Rust · Kotlin
                  Cloud & runtime
                  Kubernetes · GKE · GCP · AWS · Helm · Serverless · Firecracker · KVM · gVisor
                  Data & messaging
                  Kafka · RabbitMQ · Streaming & CDC · PostgreSQL · MongoDB Atlas · Raft · MVCC
                  Delivery
                  GitHub Actions · GitLab CI · GoCD · Jenkins · Buildkite · Ansible · Packer · Terraform · Locust
                  Observability
                  OpenTelemetry · Grafana · Loki · Tempo · Mimir · Datadog · Dynatrace · ELK
                  Earlier
                  Spring · gRPC · Istio · Akka / Pekko · GraalVM · PHP

                  Community

                  Tech.ish Thoughts, a collaborative tech blog and GitHub organization (actors, JVM serialization and off-heap work, reusable CI, gitshift).

                  The Actor Model, at a DevOps community meetup in Porto.

                  Mentors Brazilians entering software engineering through an NGO.

                  Background

                  Associate's degree, Systems Analysis and Development (2016–2018).

                  Portuguese (native), English (full professional, C2), Spanish (limited working).