https://wolinski.com/blog.html Thoughts on systems architecture, PHP, AWS, AI-driven automation, and building software that lasts. en Tue, 27 Oct 2026 07:30:00 GMT https://wolinski.com/blog/how-to-evaluate-ai-agents.html An agent does not produce an answer you can compare with a reference; it produces a changed world and an account of the change. A harness that grades the world: state diffs, pass^k over five runs, failure shapes and cost per success, measured on Claude Haiku 5.5 and 4.5 against an LLM judge. Tue, 27 Oct 2026 07:30:00 GMT https://wolinski.com/blog/how-to-evaluate-ai-agents.html https://wolinski.com/blog/mcp-integration-mistakes-java.html Five ways to wire an MCP server wrong without the mistake failing where it was made: a log line on stdout, an exception where a result belongs, a generated tool catalog, a result sized by the data, and a request that outlives the client. Reproduced and fixed on the Java SDK. Mon, 26 Oct 2026 09:00:00 GMT https://wolinski.com/blog/mcp-integration-mistakes-java.html https://wolinski.com/blog/inside-the-rsync-source.html rsync is thirty years old and nobody reads it. I did — the real tree, protocol 33 — for three ideas: a --delete that fails closed on an I/O error, a weak checksum that rolls so the cheap question stays affordable at every byte, and a file list that learned to stream the whole tree. Thu, 22 Oct 2026 08:00:00 GMT https://wolinski.com/blog/inside-the-rsync-source.html https://wolinski.com/blog/php-56-rce-under-sanitizers.html The advisory patches 8.2 to 8.5 and backports 7.4, 8.0 and 8.1. PHP 5.6 gets nothing. So I built 5.6.40 under AddressSanitizer and sent the advisory's own inputs at it: mod_php takes a real SEGV from two ordinary requests, PHP-FPM survives, and no exploit, it stops at the crash. Wed, 21 Oct 2026 20:30:00 GMT https://wolinski.com/blog/php-56-rce-under-sanitizers.html https://wolinski.com/blog/php-rce-cve-2026-109618-109619.html Two critical, unauthenticated PHP RCEs, patched the same day. The update is the easy part; knowing where you stand is not. Why the distribution version string and the moving image tag both lie, how to check the SAPI that serves traffic, and the interim settings the oldest branches skip silently. Wed, 21 Oct 2026 20:00:00 GMT https://wolinski.com/blog/php-rce-cve-2026-109618-109619.html https://wolinski.com/blog/laravel-dto-first.html Laravel already enforces two of the five boundary rules and breaks the other three. Deptrac covers the layers, five reflection checks cover what it cannot see, and the measured price is not the mappers — it is the validators that hit the database. Wed, 21 Oct 2026 14:00:00 GMT https://wolinski.com/blog/laravel-dto-first.html https://wolinski.com/blog/dto-first-php-symfony.html DTO-first is advice until something enforces it. Five boundary rules, each checked by a gate that fails the build — and the measured price of the doctrine: the mappers cost half a microsecond, and one validator constraint costs more than all the others together. Tue, 20 Oct 2026 09:00:00 GMT https://wolinski.com/blog/dto-first-php-symfony.html https://wolinski.com/blog/mcp-server-php-symfony.html An MCP server that asks before it rolls a service back has to survive being asked twice. Three defects found while reviewing a working one — a refusal read as consent, a signature mistaken for single use, and a replay guard with a race in it — with the measurement behind each fix. Wed, 14 Oct 2026 12:00:00 GMT https://wolinski.com/blog/mcp-server-php-symfony.html https://wolinski.com/blog/php-8-6-new-features.html PHP 8.6 removes ceremony: a placeholder instead of a lambda, a default instead of a constructor body, a Duration instead of an int. Every change here is measured on 8.5 and 8.6 — including the optimisations that did not reproduce and the one shape that got slower. Wed, 14 Oct 2026 11:00:00 GMT https://wolinski.com/blog/php-8-6-new-features.html https://wolinski.com/blog/git-archive-what-a-tarball-leaves-behind.html A tarball is what a repository hands to everyone who will never clone it — and it is not the repository. What leaves, what stays behind, and why the same commit can compress to different bytes on a different machine. Tue, 13 Oct 2026 08:17:15 GMT https://wolinski.com/blog/git-archive-what-a-tarball-leaves-behind.html https://wolinski.com/blog/bisect-in-ci-reproducing-old-commits.html git bisect run in a pipeline is one line and almost useless on its own: the work is making an arbitrary historical commit provisionable, buildable and testable — and reading the loop's own exit status honestly. Mon, 12 Oct 2026 07:06:09 GMT https://wolinski.com/blog/bisect-in-ci-reproducing-old-commits.html https://wolinski.com/blog/parallel-agents-on-git-worktrees.html A worktree per task stops two coding agents from overwriting each other's files. It does not isolate the approvals, hook paths and untracked instructions that decide what an agent does next — nor the lifecycle a headless run leaves behind. Mon, 12 Oct 2026 06:27:35 GMT https://wolinski.com/blog/parallel-agents-on-git-worktrees.html https://wolinski.com/blog/git-bisect-predicate-problem.html Bisect halves an interval and asks your predicate one question per step. On the same history, a broad predicate and a targeted one returned different culprits — both with exit status zero. Sat, 10 Oct 2026 06:33:50 GMT https://wolinski.com/blog/git-bisect-predicate-problem.html https://wolinski.com/blog/git-worktree-one-repo-many-working-trees.html One repository, several working directories on a single object store. What git worktree shares, what it isolates, the branch mutex, the lifecycle, relative paths, and the submodule limits the manual still calls incomplete. Fri, 09 Oct 2026 09:30:00 GMT https://wolinski.com/blog/git-worktree-one-repo-many-working-trees.html https://wolinski.com/blog/symfony-8-2-sudo-mode.html Symfony 8.2 makes sudo mode a primitive: IS_AUTHENTICATED_RECENTLY, a clock instead of a session flag, and a step-up that needs no code of yours. Plus the multi-attribute rule that silently drops the check. Mon, 05 Oct 2026 08:50:21 GMT https://wolinski.com/blog/symfony-8-2-sudo-mode.html https://wolinski.com/blog/etag-optimistic-concurrency-control.html ETag is a cache validator on reads and a concurrency guard on writes — the specification requires different comparison rules for each. Built end to end in PHP and Go, and proven with two real writers racing for one resource. Wed, 30 Sep 2026 06:31:51 GMT https://wolinski.com/blog/etag-optimistic-concurrency-control.html https://wolinski.com/blog/dapr-portable-api-conditional-guarantees.html Dapr's building blocks are portable; the guarantees underneath them are not. The same requests against two stores Dapr calls Stable — one failure is refused, the other is silent. With a runnable demo. Tue, 29 Sep 2026 19:34:43 GMT https://wolinski.com/blog/dapr-portable-api-conditional-guarantees.html https://wolinski.com/blog/four-failure-shapes.html Seven published incidents, two predating LLMs, collapse into four shapes: the label became the goal, the gate never held, validation stayed inside, and the recovery was never tested. Tue, 29 Sep 2026 18:39:49 GMT https://wolinski.com/blog/four-failure-shapes.html https://wolinski.com/blog/where-i-dont-use-ai.html AI can do more than I let it do. A practitioner's boundary list — the places I deliberately don't use it, the two questions that draw the line, and where I have already changed my mind. Tue, 29 Sep 2026 14:07:49 GMT https://wolinski.com/blog/where-i-dont-use-ai.html https://wolinski.com/blog/observability-for-ai-agents.html A 200 OK tells you nothing when the failure is a plausible wrong answer. Instrumenting agent systems: the span model, payload policy, tail sampling, cost accounting, and the path to diagnosis. Tue, 29 Sep 2026 13:35:48 GMT https://wolinski.com/blog/observability-for-ai-agents.html https://wolinski.com/blog/hallucinations-and-context-problems.html Hallucination is a family of failures, not one bug. A mitigation playbook: coverage versus utilization, grounding by construction, detection that routes, and containment. Fri, 25 Sep 2026 08:13:33 GMT https://wolinski.com/blog/hallucinations-and-context-problems.html https://wolinski.com/blog/measuring-ai-system-quality.html Quality is not a number. A production framework for measuring AI systems: component metrics, calibrated judges, statistical honesty, and the failure modes of measurement itself. Fri, 25 Sep 2026 06:51:15 GMT https://wolinski.com/blog/measuring-ai-system-quality.html https://wolinski.com/blog/laravel-event-sourcing-snapshots-schema-evolution-rebuilds.html Three production concerns that look like separate problems and are not. A working Laravel 13 skeleton with version-aware serializers, snapshot invalidation, and idempotent projection replay — all backed by tests. Tue, 01 Sep 2026 07:03:54 GMT https://wolinski.com/blog/laravel-event-sourcing-snapshots-schema-evolution-rebuilds.html https://wolinski.com/blog/agent-guardrails-and-permissions.html Permissions, output validation, multi-agent delegation, and the audit trail that reconstructs the decision chain. A production handbook for shipping agents that survive contact with reality. Mon, 31 Aug 2026 12:19:36 GMT https://wolinski.com/blog/agent-guardrails-and-permissions.html https://wolinski.com/blog/agent-vs-deterministic-workflow.html An LLM agent is a commitment, not a category. Here's the decision framework, the failure modes, the three-layer reliability model, and the hybrid architecture that actually works in production. Fri, 28 Aug 2026 13:00:00 GMT https://wolinski.com/blog/agent-vs-deterministic-workflow.html https://wolinski.com/blog/when-use-rag-vs-simple-search.html RAG sounds impressive, but most questions don't need synthesized answers from multiple documents. Here's how to choose the right approach. Thu, 27 Aug 2026 13:49:38 GMT https://wolinski.com/blog/when-use-rag-vs-simple-search.html https://wolinski.com/blog/haproxy-load-balancing-health-checks.html HAProxy sits in front of your servers, probes each one on a configurable schedule, and pulls failing hosts from the rotation before any user request reaches them. Load balancing across multiple VPS, sticky sessions, ACL routing, stick-table rate limi Thu, 27 Aug 2026 13:03:34 GMT https://wolinski.com/blog/haproxy-load-balancing-health-checks.html https://wolinski.com/blog/pgbouncer-connection-pooling-postgresql.html PostgreSQL spawns a separate process per connection, burning 5-10 MB of RAM before the first query. pgBouncer multiplexes hundreds of client connections through a small pool of real database connections, cutting RAM usage and preventing PostgreSQL from crawling under heavy concurrent load. Thu, 27 Aug 2026 12:44:13 GMT https://wolinski.com/blog/pgbouncer-connection-pooling-postgresql.html https://wolinski.com/blog/quick-tips-disable-sudo-dots.html Ubuntu 25.10/26.04 moved to sudo-rs, which echoes a dot per sudo password character by default. Bring back silent entry with Defaults !pwfeedback — the one-line fix. Wed, 26 Aug 2026 10:52:09 GMT https://wolinski.com/blog/quick-tips-disable-sudo-dots.html https://wolinski.com/blog/opentelemetry-symfony-grafana.html How to add distributed tracing to a Symfony 7 app in Docker: OpenTelemetry zero-code auto-instrumentation, OTLP HTTP export to Grafana Tempo 3.0, and Gantt traces in Grafana 13. Tue, 25 Aug 2026 16:02:38 GMT https://wolinski.com/blog/opentelemetry-symfony-grafana.html https://wolinski.com/blog/inbox-pattern.html When your consumer crashes after processing but before acknowledging, the broker redelivers — and your system processes the same message twice. The Inbox pattern is the answer to safe, idempotent message consumption. Tue, 23 Jun 2026 09:00:00 GMT https://wolinski.com/blog/inbox-pattern.html https://wolinski.com/blog/outbox-pattern.html When your database transaction commits but the message never reaches the queue, the Outbox pattern is the answer. A practical guide to reliable event publishing without dual-writes. Tue, 16 Jun 2026 09:00:00 GMT https://wolinski.com/blog/outbox-pattern.html