// TECHNOMANCER & SYSTEMS ARCHITECT
Passionate about low-level Linux systems engineering, high-scale Kubernetes deployments, local artificial intelligence pipelines, and defensive security. Building robust, sovereign computing environments that stand the test of time.
42 articles published
An All Hallows' Eve deep dive into neuro-symbolic Cyber Reasoning Systems: how in-process Rust LibAFL fuzzing, SymCC concolic Z3 solvers, LLVM IR backward slicing, and ASan Shadow Memory hunt down 0xDEADBEEF ghosts and Malloc Maleficarum heap bugs.
How the Linux kernel's CONFIG_LIVEPATCH subsystem splices replacement C functions into a running Ring-0 kernel using ftrace trampolines, per-task stack consistency transitions, klp_shadow variables, and kpatch-build ELF diffing.
Why standard datacenter ECMP hashing collapses to 45% utilization under NCCL AllReduce elephant flows—and how to build a non-blocking Rail-Optimized Clos fabric with BGP Unnumbered, SRv6 uSID, Dynamic Load Balancing (DLB), and Out-of-Order Direct Data Placement.
Why standard INT4 quantization collapses on reasoning models—and how hardware-accelerated MXFP4 / NVFP4 block microscaling, Blackwell tcgen05.mma Tensor Cores, and Walsh-Hadamard orthogonal rotations preserve 99.6% accuracy at 2x FP8 throughput.
Why legacy syscall-hooking EDRs are completely blind to modern io_uring SQPOLL implants and self-hiding eBPF rootkits—and how to hunt them using BPF_LSM, /proc/kcore prog_idr XArray forensics, and hardware PMU branch tracing.
How Compute Express Link (CXL.mem and CXL.cache over PCIe 6.0 PAM4) decouples memory capacity from CPU sockets—and how to orchestrate zero-CPU NUMA nodes, bandwidth-weighted interleaving, and automated hot/cold page migration with Linux DAMON.
How to cryptographically isolate proprietary LLM weights and sensitive workloads from a malicious host hypervisor using AMD SEV-SNP Reverse Map Tables, Intel TDX Trust Domains, and NVIDIA H100/B200 Confidential Computing.
Why co-locating compute-bound prefill and memory-bandwidth-bound decode on the same GPU pool ruins tail latency—and how disaggregated KV-cache streaming over GPUDirect RDMA transforms production LLM serving.
An adversarial engineering analysis of ransomware-proof immutable backups: evaluating S3 Object Lock (Compliance Mode) across SeaweedFS, MinIO, Garage, RustFS, Ceph RGW, and Backblaze B2—and why true WORM immutability lives in the substrate architecture around the bucket.
An offensive and defensive security analysis of the Model Context Protocol (MCP): dissecting tool-description poisoning, cross-server shadowing, rug-pull attacks, OAuth 2.1 confused deputies, and building cryptographic MCP proxy guardrails.
Hardening sovereign WireGuard overlay meshes against Harvest-Now-Decrypt-Later (HNDL) quantum adversaries using Rosenpass hybrid Classic McEliece + ML-KEM post-quantum key rotation.
An architectural blueprint for containing autonomous AI coding and cyber red-teaming agents: why standard Docker containers fail, and how to combine Firecracker KVM microVMs, Landlock LSM, and eBPF network & socket filters.
How Linux 6.12+ sched_ext (scx) lets engineers hot-swap CPU scheduling policies via eBPF and Rust without rebooting—eliminating p99 tail latency under heavy compute load.
Solving the 'Bottom Turtle' Secret Zero problem on sovereign bare-metal Kubernetes clusters using motherboard TPM 2.0 cryptographic attestation, Measured Boot PCRs, SPIFFE/SPIRE X.509 & JWT SVIDs, and OpenBao.
Inside Coordy—Tekromancy's zero-telemetry geospatial bearing calculator and tactical vector plotter featuring Slerp great-circle orthodromes, Rhumb line loxodromes, an offline WMM2025 spherical harmonic magnetic declination solver, universal OLC/DMS/what3words coordinate parsing, and serverless base64url hash serialization.
How we engineered a zero-dependency procedural Canvas 2D elemental effects library, proximity cursor tethering, an SLERP-interpolated 3D hologram globe, and a Web Audio API synthesizer without a single external asset.
A deep-dive frontend and static-site generation postmortem on optimizing incantations.tekromancy.com: eliminating 3,371 Framer Motion hydration islands, fixing a 22.7M-operation O(N²) build bottleneck, and cutting initial wire weight by 99.8%.
Dissecting Nick Bostrom's Paperclip Maximizer through Joshua Gans's game-theoretic principal-agent model—and showing how paperclipai/paperclip and legitblock/legitblock solve the exact multi-agent coordination bottleneck to let anyone spin up a cryptographically governed, autonomous AI corporation from scratch.
An investigative deep dive into Israeli AI red-team firm Irregular (formerly Pattern Labs), the testing-environment failures behind OpenAI, Google Gemini, Anthropic, and Meta real-world exploits, and whether frontier labs authorized these offensive cyber missions.
Announcing the open-source release of our Incantations repository—a grimoire bridging the 1994 Gang of Four design patterns, esoteric programming languages, and modern generative AI prompt structures.
Introducing SpareTank—a sovereign Android utility engineered to eliminate electrochemical cycle degradation with 25%–75% charging alerts while preserving a dedicated 15% emergency reserve tank for critical field contingencies.
A battle-tested production guide to filtering volumetric DDoS attacks at 20+ Mpps using eBPF eXpress Data Path (XDP), kernel ring buffers, and hardware NIC offloading.
A deep dive into NVIDIA GPUDirect Storage (GDS) and NVMe over Fabrics: streaming massive multi-terabyte dataset shards directly into GPU HBM without CPU bounce buffers.
How speculative decoding leverages small draft models and vectorized tree verification to double generation speed on vLLM and TensorRT-LLM without sacrificing a single bit of model precision.
Introducing Silent Mode Control (SMC)—a privacy-first Android application hooking into the native Telecom framework to deliver granular ringer, vibration, and mute schedules per contact with 100% on-device processing.
Building an automated offensive threat emulation lab with Atomic Red Team, Caldera, Wazuh SIEM, and Sigma detection rules in virtualized Linux topologies.
A comprehensive production blueprint for running sovereign bare-metal Kubernetes clusters with immutable OS, eBPF BGP routing, and distributed NVMe block storage.
Building an enterprise self-hosted WireGuard control plane with Headscale, Keycloak OIDC authentication, private DERP relays, and split-tunnel CoreDNS.
Deep dive into the architecture of Linux io_uring, ring buffers, SQPOLL kernel threads, and building a 500k+ IOPS non-blocking TCP socket server in C and Rust.
How the Linux kernel handles page cache reclaim, memory.max vs memory.high throttling, swap accounting, and debugging Exit Code 137 container crashes with eBPF.
Benchmarking throughput, Time to First Token (TTFT), RadixAttention prefix caching, AWQ vs FP8 quantization, and GPU memory overhead for local LLM serving.
Battle-tested bpftrace recipes and one-liners for diagnosing CPU latency, block I/O bottlenecks, network drops, memory leaks, and process executions in production.
Join the Austin Cyber Alliance tonight, Sep 8, 2026 (6:00-8:00 PM CDT) at Austin Community College Rio Grande Campus for an interactive 3D technical briefing on the history of CTF wargames, followed by intel on the upcoming Fall 2026 CTF.
From DEF CON 4's ethernet cables to modern adversary emulation: the evolution of Capture The Flag, offensive/defensive tradecraft, and the definitive guide to open-source CTF platforms.
A comprehensive, battle-tested operational checklist for hardening production Linux servers against modern automated adversary campaigns.
Visualizing Nmap XML scans into interactive force-directed topologies, GeoIP ballistic threat maps, and automated security diffs with Tekromancy's NastyMap.
Designing an ultra-low-latency encrypted multi-region mesh network using Bird, WireGuard, and Linux network namespaces.
Architecture and optimization techniques for deploying open-weight models locally with continuous batching, AWQ quantization, and GPU memory tuning.
Replacing legacy kube-proxy with Cilium eBPF for wire-speed packet filtering, Layer 7 network policies, and transparent mutual TLS.
How extended Berkeley Packet Filter (eBPF) transforms observability, security, and networking directly in the Linux kernel without risky kernel modules.
Bootstrapping instant KinD and K3s clusters pre-loaded with ArgoCD, OpenBao, Harbor, and automated mkcert TLS via DeployCoop's vigilant-octo-waffle.
Building, provisioning, initializing, and orchestrating production-grade Kubernetes clusters PDQ with Kubash, QEMU/KVM, Packer, and Kubeadm.
