Posts

A billion proofs a day Amazon’s Automated Reasoning Group just published a decade of reflections. It’s the story of a decade spent proving AWS correct. Their policy … Anthropic reached the same list Anthropic published how they secure an AI-native software development lifecycle. Claude writes roughly 80% of the code merged there, so no control that … Take a whiff of choudoufu Choudoufu is IAM-governed state for OpenTofu. Estates are inherited by granting access. Terraform bundles three jobs into a state model that has survived … Guardrails that survive the round trip chant CLICKOPS 💥 🔥 🔥 🔥 Kubectl and its cousins operate on your estate based on domain knowledge they carry. The revolving door of authoritative state Pulumi, an infra company founded on TypeScript, is now shipping HCL. Every argument Pulumi opened with has been repackaged as a feature. This pivot gave me … An ecosystem of gruel Configuration tooling keeps getting thrown into one cauldron. Start with eye of newt. Add a splash of versioning and a pinch of transformation and a few … aws-bench: scenario 1 wrap Scenario 1 is done. aws-bench puts an agent in front of a live AWS estate and grades its answers. Six configurations ran it on the same model Haiku 4.5. … Queryable Infrastructure Agentic ops means agents need to query your infra on demand. If the live details of your estate are fragmented this can lead to extra lookups costing time … Flame graphing the leftness of infra tooling Last month I claimed chant sits to the left of other infra toolchains when it comes to execution. To prove this claim I wrote the same small app for both … TypeScript is the right choice for infra Typed configuration languages are one fix for YAML hell. Pkl, CUE, and KCL give you types, value constraints, and a compiler. TypeScript solves the same … The long tail is a tail By definition a tail is the small, infrequent remainder. The long tail of spec-less APIs never touches chant. Here’s why. chant compiles a typed … The long road back to cloud native The sensible answer about Terraform and AI goes like this: the agent writes the HCL while Terraform keeps the governance and lifecycle that matter. William … An entire industry exists to fix Terraform This is what an industry of coping mechanisms looks like. One attempt to leave Terraform’s model outright was Winglang which compiled a new language … Configuration as code, and as data Brian Grant coined the Kubernetes Resource Model and argues that configuration should be data, not a program you run to find out what it is. chant agrees, … Honor the lower layer This post makes one narrow claim, one you should check rather than take on faith. Every tool sits on a lower layer. For infrastructure it is a … Policy belongs left of the platform Everyone is shifting policy left. HashiCorp just shipped tfpolicy, a policy-as-code framework in HCL that moves the catch earlier than Sentinel ever did. … Your infra database is a road to hell The authoritative model Terraform made famous has always been a poor fit for teams just trying to automate a little infra. The state file is only its most … A release is a compile target Call something a compile target and you have said two things about it. It can be correct by construction, and it is cheap to produce. A compiler checks the … The apply verb you only get on Kubernetes Kubernetes made something uniform that people forget was ever a choice. Every service deploys the same way. A manifest describes the desired state. kubectl … Governance without the state file How easily can you prove that all your repositories have aligned configuration according to policy? Governance is easy when it comes to things people …