<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>Blogcraft</title><description>Beautiful technical writing, rendered with care.</description><link>https://blogcraft.pages.dev/</link><language>en-us</language><item><title>Skills — Giving an Agent a Playbook</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-09-skills-playbook/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-09-skills-playbook/</guid><description>Bonus post. Skills are not a new rung on the ladder — they&apos;re a way of packaging the rungs you already have, so an agent can pull a mini-playbook off the shelf on demand instead of carrying every instruction in its head. Here&apos;s the concept, the mechanism, and when to reach for one.</description><pubDate>Mon, 20 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Multi-Agent Systems &amp; Production Platforms</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-08-multi-agent-production/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-08-multi-agent-production/</guid><description>One agent is a worker. A team of agents with a supervisor, evals, tracing, guardrails, and cost control is a platform. Here&apos;s when multi-agent actually helps, when it hurts, and the four pieces of scaffolding that turn a demo into a product you can run.</description><pubDate>Sun, 19 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Memory — How Agents Build Continuity</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-07-memory-continuity/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-07-memory-continuity/</guid><description>Context windows forget. Production agents don&apos;t. The difference is a layered architecture: working memory, session memory, and long-term memory split into facts, events, and skills. Here&apos;s how real agents remember — and why forgetting on purpose matters.</description><pubDate>Sat, 18 Apr 2026 00:00:00 GMT</pubDate></item><item><title>The Agent Loop — ReAct, Plan-Act-Observe</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-06-agent-loop/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-06-agent-loop/</guid><description>One tool call is an API. A loop of tool calls with reasoning in between is an agent. This post walks through the four-step cycle that turns one-shot chat into step-by-step work — and the surprisingly tricky question of when to stop.</description><pubDate>Fri, 17 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Tool Use — Giving the Model Hands</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-05-tool-use-hands/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-05-tool-use-hands/</guid><description>Text in, text out — until you let the model call functions. This is the moment a chatbot stops explaining how to do things and starts actually doing them. Here&apos;s what function calling really is, the typed contract that makes it work, and why this is the hinge rung of the whole ladder.</description><pubDate>Thu, 16 Apr 2026 00:00:00 GMT</pubDate></item><item><title>RAG — Giving the Model a Library</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-04-rag-library/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-04-rag-library/</guid><description>Your company&apos;s docs, this morning&apos;s tickets, yesterday&apos;s deploy notes — none of it is in the model. Retrieval-augmented generation hands it the right page, right before it answers. Here&apos;s the two-phase pipeline, honest failure modes, and what &apos;embeddings&apos; actually are.</description><pubDate>Wed, 15 Apr 2026 00:00:00 GMT</pubDate></item><item><title>System Prompts &amp; Personas: The Cheapest Control Surface</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-03-system-prompts-personas/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-03-system-prompts-personas/</guid><description>Before RAG, before tools, before agents — a well-written system prompt is still the single highest-leverage knob you have. Here&apos;s what it actually does, why most people misuse it, and what its honest limits are.</description><pubDate>Tue, 14 Apr 2026 00:00:00 GMT</pubDate></item><item><title>The Chat Baseline: What You&apos;re Starting With</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-02-chat-baseline/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-02-chat-baseline/</guid><description>Every AI product in the world starts as the same small, strange thing — a stateless function that turns tokens into tokens. Understand that substrate clearly and every capability above it stops looking like magic.</description><pubDate>Mon, 13 Apr 2026 00:00:00 GMT</pubDate></item><item><title>The Tool System: How an AI Gets Hands</title><link>https://blogcraft.pages.dev/blog/ai-harness-02-tool-system/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-02-tool-system/</guid><description>A language model without tools is an expensive autocomplete. This post dissects how a production AI harness defines, registers, validates, and executes 40+ tools — from file reads to shell commands to MCP integrations — with type safety, concurrency control, and deferred loading.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Anatomy of an AI Harness: What Lives Between You and the Model</title><link>https://blogcraft.pages.dev/blog/ai-harness-01-anatomy-overview/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-01-anatomy-overview/</guid><description>Everyone debates which AI model is best. The real engineering happens in the harness — the production system of tools, permissions, memory, and orchestration that makes any model actually useful. This is a map of that system, drawn from real source code.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>The Permission Boundary: Human-in-the-Loop at Scale</title><link>https://blogcraft.pages.dev/blog/ai-harness-03-permission-boundary/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-03-permission-boundary/</guid><description>An AI with shell access and no guardrails will eventually destroy something you care about. This post dissects how a production harness implements layered permissions, hooks, dangerous pattern detection, and trust boundaries — balancing safety with usability.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>The Orchestration Loop: Where Everything Converges</title><link>https://blogcraft.pages.dev/blog/ai-harness-05-orchestration-loop/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-05-orchestration-loop/</guid><description>The orchestration loop is the heart of an AI harness — a state machine that coordinates API calls, streaming responses, concurrent tool execution, error recovery, and token budgets. This post traces the complete data flow from user input to final response.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Skills: Packaging AI Workflows as Code</title><link>https://blogcraft.pages.dev/blog/ai-harness-06-skills/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-06-skills/</guid><description>Ad-hoc prompting is fine for one-off questions. Repeatable workflows deserve structure. This post dissects how a production harness defines, discovers, loads, and executes skills — reusable AI workflows that turn tribal knowledge into executable automation.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>State, Cost, and the Production Surface</title><link>https://blogcraft.pages.dev/blog/ai-harness-08-state-cost-production/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-08-state-cost-production/</guid><description>The invisible foundation beneath every AI harness layer: centralized state management, per-model cost tracking, rate limit handling, a custom React-to-terminal renderer, and multiple entry points. This post covers what makes &apos;works in a demo&apos; become &apos;works in production.&apos;</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Tasks and Concurrency: Background Agents at Work</title><link>https://blogcraft.pages.dev/blog/ai-harness-07-tasks-concurrency/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-07-tasks-concurrency/</guid><description>A production AI harness is not single-threaded. Background agents explore codebases, shell commands execute, remote agents run on cloud infrastructure — all while the main conversation continues. This post dissects the task system that manages this concurrency.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Context Engineering: Building the Model&apos;s World</title><link>https://blogcraft.pages.dev/blog/ai-harness-04-context-engineering/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-harness-04-context-engineering/</guid><description>The model is only as good as the context it receives. This post dissects how a production AI harness constructs system prompts, loads project instructions, manages persistent memory, and compresses context when the window fills — all to give the model the right information at the right time.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>From Chat to Agent: Why the Leap Matters</title><link>https://blogcraft.pages.dev/blog/chat-to-agent-01-why-the-leap-matters/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/chat-to-agent-01-why-the-leap-matters/</guid><description>A chatbot answers. An agent finishes the job. The gap between them is not one feature — it&apos;s a stack of seven capabilities, built one rung at a time. This series walks that stack in plain English, for engineers and curious non-engineers alike.</description><pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Full-Stack DI with dependency-injector, FastAPI, and SQLAlchemy</title><link>https://blogcraft.pages.dev/blog/clean-code-python-24-dependency-injector/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-24-dependency-injector/</guid><description>FastAPI&apos;s Depends() handles per-request wiring. dependency-injector handles everything else — configuration, singletons, factories, and a declarative container that makes your entire object graph visible in one file.</description><pubDate>Sat, 11 Apr 2026 00:00:00 GMT</pubDate></item><item><title>AI Skills in Practice: What Are AI Skills (And Why Prompting Isn&apos;t Enough)</title><link>https://blogcraft.pages.dev/blog/ai-skills-01-what-are-ai-skills/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-skills-01-what-are-ai-skills/</guid><description>You have been typing instructions into AI assistants one conversation at a time. Skills flip that model — they turn your best prompts into reusable, structured workflows that any team member can run. This post explains the shift from ad-hoc prompting to skill-driven development.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>AI Skills in Practice: Context Is the Skill</title><link>https://blogcraft.pages.dev/blog/ai-skills-02-context-is-the-skill/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-skills-02-context-is-the-skill/</guid><description>Every AI assistant starts each conversation knowing nothing about your project. Context files change that — they encode your stack, conventions, and constraints so the AI works with your codebase instead of against it. This post shows how to build the foundation layer that makes every skill smarter.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>AI Skills in Practice: Building Your First Skill</title><link>https://blogcraft.pages.dev/blog/ai-skills-04-building-your-first-skill/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-skills-04-building-your-first-skill/</guid><description>You have used AI skills. Now you build one. This post walks through the complete process: identifying a repetitive workflow, extracting it into a structured skill, testing it against real work, and iterating until it reliably produces quality results.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Astro Deep Dive: Scaffolding a Production-Ready Astro 5 Project</title><link>https://blogcraft.pages.dev/blog/astro-deep-dive-01-scaffolding/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/astro-deep-dive-01-scaffolding/</guid><description>Most Astro tutorials stop at pnpm create astro. By the time you need TypeScript strict mode, Tailwind 4, and a Cloudflare deployment pipeline enforcing Lighthouse 100, you are patching together Stack Overflow answers. This post gets you production-ready from the first command.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Astro Deep Dive: The Island Architecture</title><link>https://blogcraft.pages.dev/blog/astro-deep-dive-02-islands-architecture/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/astro-deep-dive-02-islands-architecture/</guid><description>Every client:load directive you add ships JavaScript to every reader. Most of them do not need it. The difference between Lighthouse 100 and 85 is understanding which components need interactivity and choosing the right hydration strategy for each.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Astro Deep Dive: Content Collections — Schema, Querying, and Type-Safe MDX</title><link>https://blogcraft.pages.dev/blog/astro-deep-dive-03-content-collections/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/astro-deep-dive-03-content-collections/</guid><description>Your blog has 50 posts and a typo in one date field blows up the whole page. Content Collections catch schema violations at build time — before your readers do. This post covers the Content Layer API, Zod schemas, dynamic routes, and image validation.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Astro Deep Dive: Deployment, CI/CD, and Lighthouse 100/100</title><link>https://blogcraft.pages.dev/blog/astro-deep-dive-04-deployment-cicd/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/astro-deep-dive-04-deployment-cicd/</guid><description>Your Astro site builds locally but fails on deploy — Mermaid needs Playwright, edge functions reference process.env, and Lighthouse scores crater. This post configures Cloudflare Pages, GitHub Actions, and Lighthouse CI so deploy day is boring.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>AI Skills in Practice: Anatomy of a Skill</title><link>https://blogcraft.pages.dev/blog/ai-skills-03-anatomy-of-a-skill/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-skills-03-anatomy-of-a-skill/</guid><description>A skill is not a long prompt. It is a structured workflow with a trigger, a prompt body, references, and an output contract. This post breaks down each component, shows how they interact, and explains the design decisions that separate skills that work from skills that frustrate.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>AI Skills in Practice: Composing Skills — Agents, Hooks, and Pipelines</title><link>https://blogcraft.pages.dev/blog/ai-skills-05-composing-skills/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-skills-05-composing-skills/</guid><description>A single skill handles a single workflow. But real development involves chains of workflows — review then fix then test then commit. This post covers composition patterns: how skills delegate to other skills, how hooks automate triggers, and how pipelines chain skills into end-to-end workflows.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>AI Skills in Practice: Skill Patterns for Real Workflows</title><link>https://blogcraft.pages.dev/blog/ai-skills-06-real-workflow-patterns/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/ai-skills-06-real-workflow-patterns/</guid><description>Four complete skill definitions for workflows developers actually do every day — debugging, code review, technical writing, and deployment. Each pattern is tool-agnostic, tested in production, and ready to adapt to your own projects.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Multi-Tenant Foundation — Context, Isolation, and the Data Boundary</title><link>https://blogcraft.pages.dev/blog/clean-code-python-09-multi-tenant-foundation/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-09-multi-tenant-foundation/</guid><description>Your BookStore API now has 200 customers who each want their own data. One missing WHERE clause leaks tenant data and kills the company. Here is how to make cross-tenant data leakage structurally impossible with context propagation, session events, and row-level isolation.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Connection Pooling and Database Resilience Under Load</title><link>https://blogcraft.pages.dev/blog/clean-code-python-11-connection-pooling/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-11-connection-pooling/</guid><description>Your pool_size=5 default just met Black Friday traffic. 200 concurrent requests, 5 connections, 195 coroutines waiting on pool checkout — then timeouts cascade into a full outage. Here is how to configure connection pooling, read replicas, and circuit breakers for production traffic.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Observability — Structured Logging, Tracing, and Metrics</title><link>https://blogcraft.pages.dev/blog/clean-code-python-12-observability/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-12-observability/</guid><description>When a tenant reports &apos;my order failed 20 minutes ago,&apos; you need to find that exact request across API logs, database queries, and background tasks within 30 seconds. Here is how to build observability into a multi-tenant Python backend from day one.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Configuration, Feature Flags, and Secrets That Scale</title><link>https://blogcraft.pages.dev/blog/clean-code-python-10-configuration-feature-flags/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-10-configuration-feature-flags/</guid><description>Hardcoded config breaks the moment your 200 tenants need different rate limits, feature access, and API keys. Here is a hierarchical configuration system with per-tenant overrides, percentage-based feature rollouts, and encrypted secrets — all hot-reloadable without restarts.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Caching Architecture — Redis, Invalidation, and Tenant Isolation</title><link>https://blogcraft.pages.dev/blog/clean-code-python-13-caching-architecture/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-13-caching-architecture/</guid><description>Without caching at 1M transactions per day, the database becomes the bottleneck within weeks. But caching in a multi-tenant system is treacherous — one missing tenant prefix in a cache key leaks data between tenants.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Background Tasks — Queues, Workers, and Context Propagation</title><link>https://blogcraft.pages.dev/blog/clean-code-python-14-background-tasks/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-14-background-tasks/</guid><description>At 1M transactions per day, you cannot process everything in the request cycle. But background tasks are where tenant context silently disappears — the worker has no request, no middleware, no headers. Here is how to propagate context safely.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Rate Limiting and Noisy Neighbor Prevention</title><link>https://blogcraft.pages.dev/blog/clean-code-python-15-rate-limiting/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-15-rate-limiting/</guid><description>Without rate limiting, one tenant&apos;s bulk import consumes all your database connections and API throughput. Here is how to build tiered, sliding-window rate limiting in Python with Redis — protecting every tenant from every other tenant.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Locking, Idempotency, and Sagas</title><link>https://blogcraft.pages.dev/blog/clean-code-python-16-data-consistency/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-16-data-consistency/</guid><description>At 1M transactions per day, two requests modifying the same inventory record is not an edge case. Here is how to prevent lost updates with optimistic locking, double charges with idempotency keys, and partial failures with the saga pattern.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Multi-Tenant Migrations Without Downtime</title><link>https://blogcraft.pages.dev/blog/clean-code-python-17-multi-tenant-migrations/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-17-multi-tenant-migrations/</guid><description>A naive ALTER TABLE on a 100M-row table locks it for minutes. Multi-tenant makes it worse: one failed migration across 200 schemas leaves tenants on inconsistent versions. Here is the expand-contract pattern and the tooling to migrate safely.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Event-Driven Architecture — Domain Events and CQRS Lite</title><link>https://blogcraft.pages.dev/blog/clean-code-python-20-event-driven-architecture/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-20-event-driven-architecture/</guid><description>When order placement triggers inventory, email, webhooks, analytics, and distributor notifications — doing it synchronously makes the endpoint slow and couples everything. Domain events decouple &apos;what happened&apos; from &apos;what should happen next.&apos;</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Health Checks, Graceful Shutdown, and Zero-Downtime Deploys</title><link>https://blogcraft.pages.dev/blog/clean-code-python-19-health-checks-deployment/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-19-health-checks-deployment/</guid><description>Without health checks, your load balancer sends traffic to dying instances. Without graceful shutdown, every deploy drops requests. Here is how ShelfWise achieves zero-downtime deployments with proper probes, SIGTERM handling, and connection draining.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Security Hardening — RBAC, API Keys, and Audit Trails</title><link>https://blogcraft.pages.dev/blog/clean-code-python-18-security-hardening/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-18-security-hardening/</guid><description>A single tenant data leak can end your SaaS business. SOC 2 and GDPR demand audit trails, scoped access controls, and data isolation verification. Here is how to build RBAC, API key management, and immutable audit logging into ShelfWise.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: API Versioning and Backward-Compatible Evolution</title><link>https://blogcraft.pages.dev/blog/clean-code-python-21-api-versioning/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-21-api-versioning/</guid><description>A breaking API change that &apos;only&apos; affects 5% of tenants still breaks real businesses. Without versioning, you can never evolve your API. Here is how to version a multi-tenant FastAPI backend with per-tenant version pinning, deprecation workflows, and contract testing.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Performance — Profiling, N+1 Detection, and Load Testing</title><link>https://blogcraft.pages.dev/blog/clean-code-python-22-performance/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-22-performance/</guid><description>An N+1 query that takes 50ms with 10 rows takes 5 seconds with 1000. A memory leak that grows 1MB/hour OOMs in 3 days. Here is how to profile, detect, and load test a multi-tenant Python backend before production tells you first.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: From git init to Production Traffic</title><link>https://blogcraft.pages.dev/blog/clean-code-python-23-production-deployment/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-23-production-deployment/</guid><description>Theory without deployment is fiction. This capstone assembles all 22 prior patterns into a deployed, monitored, incident-ready multi-tenant Python backend — from Docker Compose to runbooks to your first production incident.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: The Security Mental Model You Need First</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-01-security-mental-model/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-01-security-mental-model/</guid><description>Authentication and authorization are two different problems that most tutorials conflate. Here is the mental model, threat landscape, and FastAPI security toolkit you need before writing a single line of auth code.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: API Key Authentication for Machine Clients</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-04-api-key-authentication/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-04-api-key-authentication/</guid><description>API keys are the most misused auth mechanism in production. Here is how to generate, scope, rotate, and rate-limit API keys in FastAPI — with the patterns that separate toy projects from production systems.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: JWT Tokens — Stateless Authentication</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-03-jwt-tokens/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-03-jwt-tokens/</guid><description>JWTs eliminate session storage but introduce revocation challenges. Here is how to build access tokens, refresh tokens, and token rotation in FastAPI — with the security pitfalls that tutorials never mention.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: Password Authentication Done Right</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-02-password-authentication/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-02-password-authentication/</guid><description>Password hashing is not security — it is one layer. Here is how to build registration, login, session management, and brute-force protection in FastAPI without the mistakes that lead to credential breaches.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: OAuth 2.0 — The Authorization Framework</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-05-oauth2/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-05-oauth2/</guid><description>OAuth 2.0 is not authentication — it is authorization. Here are the four grant types, why PKCE is now mandatory, and how to implement the authorization code flow in FastAPI with working code and sequence diagrams.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: OpenID Connect and Single Sign-On</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-06-openid-connect-sso/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-06-openid-connect-sso/</guid><description>OAuth 2.0 does not tell you who the user is. OpenID Connect adds the identity layer. Here is how to implement Google SSO, validate ID tokens, and understand when OIDC beats SAML.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: Authorization Patterns — RBAC, ABAC, and Beyond</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-07-authorization-patterns/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-07-authorization-patterns/</guid><description>Authentication answers who. Authorization answers what. Here are three authorization models — RBAC, ABAC, and ReBAC — implemented as FastAPI dependencies with decision flows, comparison tables, and production patterns.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>FastAPI Auth: The Decision Framework — Choosing the Right Approach</title><link>https://blogcraft.pages.dev/blog/fastapi-auth-08-decision-framework/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/fastapi-auth-08-decision-framework/</guid><description>Eight authentication and authorization methods, one decision tree. Here is the comparison matrix, production combination patterns, and pre-launch security checklist that turns auth knowledge into shipping decisions.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Hashing Deep Dive: SHA, bcrypt, scrypt, and Argon2id From the Inside Out</title><link>https://blogcraft.pages.dev/blog/hashing-deep-dive/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/hashing-deep-dive/</guid><description>Not all hashes are created equal. Here is how SHA-256, bcrypt, scrypt, and Argon2id actually work under the hood — the math, the memory, the attacks they resist, and exactly when to use each one.</description><pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Build-Time Mermaid Diagrams: Cut 1MB of JavaScript</title><link>https://blogcraft.pages.dev/blog/build-time-mermaid-diagrams/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/build-time-mermaid-diagrams/</guid><description>Stop shipping Mermaid.js to your readers. Render diagrams to SVG at build time with rehype-mermaid and Playwright, cutting ~1MB of client-side JavaScript to zero.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Project Structure and Naming That Scales</title><link>https://blogcraft.pages.dev/blog/clean-code-python-01-project-structure/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-01-project-structure/</guid><description>Most Python backend projects start clean and become unmaintainable. Here is the folder layout and naming convention that keeps a FastAPI + SQLAlchemy codebase navigable at any size.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Type Safety with Protocols Over ABCs</title><link>https://blogcraft.pages.dev/blog/clean-code-python-02-type-safety-protocols/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-02-type-safety-protocols/</guid><description>Python&apos;s ABC machinery adds inheritance overhead you do not need. Protocols give you structural subtyping — type-safe duck typing with zero coupling between your repository interfaces and implementations.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: The Repository Pattern with SQLAlchemy</title><link>https://blogcraft.pages.dev/blog/clean-code-python-03-repository-pattern/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-03-repository-pattern/</guid><description>Wrap your database access behind a clean interface. The Repository pattern decouples business logic from SQLAlchemy, makes testing trivial, and gives you a single place to optimize queries.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Structured Error Handling Across the Stack</title><link>https://blogcraft.pages.dev/blog/clean-code-python-06-error-handling/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-06-error-handling/</guid><description>Scattered try/except blocks and generic 500 errors signal a system that was not designed. Here is how to define domain exceptions, translate them to HTTP responses, and give your API clients errors they can act on.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: The Service Layer — Where Business Logic Lives</title><link>https://blogcraft.pages.dev/blog/clean-code-python-04-service-layer/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-04-service-layer/</guid><description>Repositories fetch data. API routes handle HTTP. Business logic belongs in neither. The Service Layer is the missing middle that keeps both clean and testable.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Dependency Injection Without Magic</title><link>https://blogcraft.pages.dev/blog/clean-code-python-05-dependency-injection/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-05-dependency-injection/</guid><description>FastAPI&apos;s Depends() is the most underused tool in the framework. Here is how to use it to wire repositories, services, and authentication into your route handlers with no global state and no service locator pattern.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Async Patterns That Actually Scale</title><link>https://blogcraft.pages.dev/blog/clean-code-python-07-async-patterns/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-07-async-patterns/</guid><description>asyncio.gather() is not always the answer. Here is when to parallelize database calls, when NOT to, and how to avoid the most common SQLAlchemy async session mistakes that cause subtle production bugs.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Clean Code Python: Testing Strategies for the Full Stack</title><link>https://blogcraft.pages.dev/blog/clean-code-python-08-testing-strategies/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/clean-code-python-08-testing-strategies/</guid><description>Unit tests, integration tests, and API tests — each has a role in a Python backend. Here is a complete testing strategy for a FastAPI + SQLAlchemy project, showing what to test at each layer and how the patterns from this series make testing effortless.</description><pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate></item><item><title>Hello, Blogcraft</title><link>https://blogcraft.pages.dev/blog/hello-world/</link><guid isPermaLink="true">https://blogcraft.pages.dev/blog/hello-world/</guid><description>A comprehensive guide to Blogcraft&apos;s content pipeline featuring Expressive Code, Mermaid diagrams, and rich static MDX components.</description><pubDate>Wed, 08 Apr 2026 00:00:00 GMT</pubDate></item></channel></rss>