Compile Theory
Deep dives on how software gets built: .NET, Azure, distributed systems, and AI that survives production. Written for engineers who want to know why.
- A Reference Architecture for Production Databricks Systems — Seven checklists assembled into one system. Fourteen decisions, the couplings between them, and the order to make them in.
- Four Ways to Isolate Tenants in Unity Catalog — Where the tenant boundary sits is expensive to reverse. Four options in Unity Catalog, strongest isolation first, with the blast radius and cost of each.
- If agents can leave notes, your eval stopped measuring individuals — The collusion.wiki case points to a narrow failure mode with big consequences. Once one agent run can write durable public state that later runs can read, your harness measures a communicating population, and the fix starts with outbound-write policy and clean-room resets.
- Unity Catalog as a Platform Contract — Unity Catalog is introduced as access control, which leads teams to treat it as configuration. It is where every other decision in this series becomes enforceable.
- Before You Trust an LLM Judge, Measure Its Noise Floor — An evaluation score moved from 0.81 to 0.84 and the change shipped. Measuring what your judge produces on unchanged input, before you trust the difference.
- What an Agent Trace Reveals, and What It Cannot Prove — Tracing is the first thing teams instrument and the last thing they reason about. What a trace genuinely establishes, and the questions it cannot answer.
- Evaluating AI Agents on Databricks — When the correct output is a set rather than a value, you cannot assert it. Code scorers, LLM judges, and where each one belongs in an evaluation.
- Calling Databricks from ASP.NET Core Without Building a Fragile Integration — A cold warehouse, a double-clicked button, and a deploy mid-request. The state machine and idempotency work that keeps an ASP.NET Core integration from going fragile.
- A session should survive a node change — Long-lived agents, auth redirects, and cross-region failover all punish the same design: session truth trapped in one worker. Treat sessions as portable references to durable state, and keep sticky sessions on a removal plan.
- GitHub Actions OIDC should trust workflows, not repositories — GitHub lets any job with `id-token: write` choose its OIDC audience at runtime. If your cloud trust policy keys on repo identity alone, separate workflows share one blast radius.
- Seven Signals That a Databricks Repository Is Still a Prototype — Seven cheap checks that tell you whether a repository was promoted to production by decision or by usage, and which failure will arrive first.
- The SQLite CVE mess shows where your vulnerability automation needs a gate — A bad advisory turns expensive once scanners, ticket bots, and coding agents treat it as work. The SQLite episode points to a simple boundary: verify provenance and evidence before severity fans out into your pipeline.
All articles · Topics · Series · Posts · About