Writing

Notes from the build

Articles on Laravel architecture, retrieval-augmented generation, AI agents, small language models, vector search and agentic commerce, drawn from production work rather than demos.

Page 2 of 4 · 48 articles

SaaS Architecture12 min

Build a SaaS platform in 2026: the architecture decisions that cost the most to reverse

Every guide to building a SaaS platform hands you a stack. The stack is the cheapest thing to change later. The decisions that hurt are the ones baked into every row, URL and integration, and by month eighteen reversing them is a migration with a customer communications plan. Here they are, ranked by what they cost to undo.

24 October 2026Read

PHP Security10 min

PHP's two critical RCEs of October 2026: which versions are fixed, how to patch, and what to do on 8.1 and older

On 21 October 2026 PHP shipped fixes for two unauthenticated remote code execution bugs, both CVSS 9.2, one of them demonstrated against mod_php before any application code runs. Which releases fix them, how to confirm the version your web server is actually running, what the mitigations do and do not buy you, and the options left on 8.1, 8.0, 7.4 and anything older.

23 October 2026Read

Agent Integration10 min

Website, WhatsApp, Slack, Teams or Jira: where your AI agent should actually live

Every comparison page is written by a vendor of one channel, and every one concludes that channel wins. The honest answer turns on three things a vendor cannot know about you: who the user is, where the work is already recorded, and what the channel costs to run once the demo is over. The decision table, the trap in each column, and the order I would build them in.

23 October 2026Read

Agent Integration9 min

Atlassian's remote agents for Jira: what assigning a work item to your own agent actually changes

When I planned this post, Atlassian's remote agent connector was early access. On 28 September it went generally available, on A2A 1.0 only. Read line by line, it turns an agent running on your own infrastructure into a real Jira assignee with a task lifecycle, and it leaves authorisation, cost and anything outside Jira Cloud exactly where they were.

22 October 2026Read

Agent Integration14 min

Jira agents without the vendor middleware: REST API, OAuth 3LO and your own MCP server

Every page ranking for a Jira AI agent either sells a connector or documents Atlassian's own platform. Building it yourself comes down to four decisions: an API token or OAuth 2.0 3LO, which scopes, which issue actions become tools, and whether those tools sit behind your own MCP server. Each one, with the numbers that decide it.

21 October 2026Read

Agent Integration9 min

Threads, mentions and context: making a Slack agent behave like a colleague

A colleague pulled into a thread reads the messages above the mention, answers in the thread, and stays out of the conversation they were not part of. None of the three is a Slack agent's default. What counts as conversation state in a channel, where the reply belongs, and how to stop the agent answering questions nobody asked it.

20 October 2026Read

Agent Integration12 min

Your AI agent in Slack: the scopes you should refuse to request

The install screen is the only security review most Slack agents ever get, and it is generated from your scope list rather than your intentions. What to refuse, why the narrow path ships faster, and the 2025 rate limit change that quietly killed reading a channel's past.

19 October 2026Read

Agent Integration9 min

WhatsApp agent gotchas: the 24-hour window, template rejections and webhook signatures

The agent ran for six weeks, nothing was deployed, and at 2am it stopped replying while every send call still returned 200. The error codes that mean something other than what they say, the signature check that fails the first time a customer types an emoji, and the alert that should have woken you earlier.

18 October 2026Read

Agent Integration12 min

Putting an AI agent on WhatsApp: everything Meta makes you do before a single message sends

The API call is twenty minutes. Before it works you need a number you can never use in the app again, a verified business, a template somebody at Meta approves, and, since 1 October, a payment method on file or the replies simply stop being delivered.

17 October 2026Read

Tenant Isolation9 min

Two tenants, one bug: the negative tests that prove isolation actually holds

Every multi-tenancy article ends with write tests, and none of them say what to assert. Here is the suite: two tenants, four roles, and the reads, writes, exports, retries and impersonations that all have to fail.

15 October 2026Read

Laravel Multitenancy10 min

Tenant-aware queues, caches and logs: three places Laravel multi-tenancy leaks

A global scope protects queries. A restored job model, a cache hit and a log line are the three places real work happens without one, which is exactly why they leak.

13 October 2026Read

Agent Integration13 min

How to add an AI agent to your website without renting someone else's widget

Nine of the nine pages ranking for this end at paste our script tag. Here is the build they skip: streaming, identity, rate limits, injection on your own page content, and what a session actually costs.

12 October 2026Read