BCVK: A Local Test Bench for Bootable OS Images
BCVK is a local test bench for bootable container OS images. See how one OCI artifact moves through ephemeral, persistent, and disk-image modes before it reaches real hosts.
Loading visual explainer…
B2B Integration Architecture: Four Layers Between Your Service and the Customer's Stack
In B2B, most of the engineering lives in the seams: the tenancy boundary, the integration surface, state sync, and the cross-cutting trust rail. This diagram maps those four layers end to end.
Explanation
B2B software runs inside someone else's stack, so the architecture that matters is not only your service but the layers that connect it to a customer's systems of record. Those layers are the tenancy and identity boundary, the integration surface, the state and event sync path, and the cross-cutting rail of auth, rate limits, observability, and audit. Each boundary fails differently: a forwarded token breaks audience trust, a thin integration surface turns into per-customer code, and unhandled retries leave silently inconsistent data. Engineers should design these seams explicitly, because replacing them later costs more than replacing the service.
FAQ
When is a managed sync better than writing your own webhook handlers?
When the destination needs current state rather than event history. A managed sync such as Stripe Data Pipeline into Lakebase removes handlers, retry logic, and reconciliation for missed or out-of-order events. If you already maintain that plumbing and need custom transforms, owning it is reasonable; otherwise the maintenance cost compounds per customer.
The posts behind it
Related reading
Supabase · · TutorialGetting started with the Supabase .NET SDK
The Supabase .NET SDK provides a single C# client for Auth, Database, Storage, Realtime, and Edge Functions; version 8.0.0 moves serialization to System.Text.Json and adds injectable HttpClient with retry. It also ships a dependency injection package for ASP.NET Core that registers the client as scoped via IHttpClientFactory to pool connections. Models derive from BaseModel with table and column attributes; queries use From () with Where filters, and updates require explicit calls without a change tracker, supporting both model-based and query-builder approaches. Authentication covers email/password, OAuth, magic links, phone, and SSO, with auto-refresh tokens attaching to subsequent requests for Row-Level Security. Setup for ASP.NET Core uses AddSupabase, while other apps construct the client manually and call InitializeAsync; the post also distinguishes publishable and anon keys for client apps from secret and service keys that bypass Row-Level Security.
Databricks · · AnnouncementStripe Data Pipeline now syncs real-time Stripe data to Lakebase Postgres
Stripe Data Pipeline now supports real-time sync to Postgres, with Databricks Lakebase as a supported destination. Stripe streams real-time API data into Lakebase and manages the sync end to end, eliminating the need for custom integrations with APIs or webhooks that require handlers, retry logic, and reconciliation processes for missed or out-of-order events. One Stripe account can feed two Databricks destinations: Unity Catalog for analytics and AI workloads, and Lakebase for applications. With real-time sync, payment, customer, subscription, refund, and payout data updates arrive in Lakebase within seconds, enabling applications to control product and feature access based on subscription status, keep billing and account details up to date without calling the Stripe API on every page load, and provide real-time financial visibility with dashboards showing daily sales volume, refunds, and payouts as they happen. The feature is available in public preview and free to get started.
Notion · · Problem & solutionHow we connected Notion AI to 160 new apps in three weeks
Notion used the Model Context Protocol (MCP), an open standard for connecting AI tools to other apps, to expand its AI integrations. Previously, each new MCP connection required hours of manual setup, including creating accounts, navigating developer settings, and testing, so only 25 apps were connected. In three weeks, Notion grew that number to 185 by building a Notion agent that automates the pipeline from setup to production. The agent handles sign-ups, browser clicks, and tests, while humans still review code changes, design assets, and partner with vendors. A key lesson was that private developer apps could pass internal tests but fail for customers, so the agent now tests from a second account simulating real users.
Cloudflare · · AnnouncementContinuous accountability for Verified bots
Cloudflare introduces a system to continuously evaluate whether Verified bots honor website preferences, moving beyond identity verification to sustained trust by measuring compliance with robots.txt directives and HTTP 429 rate-limit responses over time. The system looks for repeated patterns of disregard rather than isolated violations, lowering a bot’s trust band if it ignores site preferences or fails to slow down after receiving rate-limit responses, while consistent compliance increases trust. Cloudflare previously de-listed Perplexity’s bot in 2025 for seeking to access opted-out resources and attempting to circumvent controls when blocked, illustrating the need for ongoing accountability. The company plans to share these trust scores publicly on Radar and eventually let customers choose the trust threshold for handling Verified bot traffic on their websites. This forms an accountability loop with Bot Preference Sync and Bot Management, ensuring trust is earned through sustained behavior rather than assumed from identity alone.
Auth0 · · ExplainerOn-Behalf-Of Is a Pattern. Token Exchange Is the Standard.
The post distinguishes the On-Behalf-Of pattern from the OAuth 2.0 Token Exchange standard (RFC 8693) and Microsoft’s implementation, warning against forwarding a user’s token downstream as it breaks the audience trust boundary. Token Exchange uses a subject_token for the user’s identity and an optional actor_token to record the calling service, with a chainable act claim for multi-hop calls. Microsoft’s implementation uses a jwt-bearer grant, only works for user principals, and can mint SAML assertions for legacy integrations, but the resulting token must never be relayed back to the client. For AI agents, neither OBO nor Token Exchange handles explicit user delegation, so integrators must log act claims, scope tokens to specific tasks, issue per-agent credentials, and build audit trails. The post notes the confused deputy problem resurfaces with agents, and regulatory transparency requirements around automated decision-making are already in effect.
Twilio · · ExplainerHow to modernize CX without ripping and replacing your stack
Thirty percent of businesses say their tech stacks cannot keep up with customer expectations, but CIOs in Twilio’s Innovators Report modernized customer engagement without full platform replacements. They placed an orchestration layer above systems of record, integrated voice and messaging into existing CRMs, retained control of core decision engines through APs, unified real-time data before scaling A, and shipped gradual changes using sandboxes and feature flags. Sweetwater enabled 850 agents with 50,000 texts and 40,000 calls daily, while WestC achieved 50 to 80 percent higher RCS conversion rates than SMS or email. Lendi Group’s CTO advises unifying the data layer first, as 84 percent of brands say their A can access customer history but only 40 percent design personalization around it. Modernizing the seams between systems is cheaper and safer than replacement, since a non-working layer leaves underlying systems intact.
Stack Overflow · · ExplainerMCP standardized tools. Now we need the infrastructure around them.
MCP standardized how AI models connect to tools, with clients like Claude Code and Cursor adopting it and SDK downloads approaching half a billion monthly. However, production use reveals that the protocol solves only the interface problem, not the operational concerns around authentication, rate limiting, idempotency, and observability. Teams repeatedly build duplicate infrastructure for deployment, secret handling, health checks, and access control because the protocol does not address these. Context efficiency also remains a challenge: a benchmark showed reducing context from 220,393 to 27,352 tokens (87.6%) while maintaining test pass rates, highlighting the need for deliberate context selection. The author argues that MCP’s success forces the question of building a production-grade infrastructure layer, similar to how HTTP led to CDNs and API gateways.
More like this
More architecture explainers
Alerting Is a Pipeline, Not a Threshold
Alerting is an architecture, not a threshold: signals flow through detection, sharded evaluation, grouping, and routing. Here is how each layer decides whether a page is real.
AI-DLC Architecture: One Spec Spine Through Inception, Design, and Construction
AI-DLC is an AI-driven development lifecycle that runs delivery through Inception, Design, and Construction, with specs, steering files, and hooks keeping agents aligned to agreed intent.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.