Posts

templateContext Deep Dive: Bundling Metadata with Jobs and Stages

templateContext Deep Dive: Bundling Metadata with Jobs and Stages

You are building a central template that accepts a list of jobs. But you need each job to carry its own “owner” email and “security_tier” without forcing every developer to use a custom job schema. You try adding these as parameters, but Azure DevOps throws a schema …

Identity and Access Architecture for Azure Landing Zones: Entra ID, RBAC, and PIM

Identity and Access Architecture for Azure Landing Zones: Entra ID, RBAC, and PIM

The security team’s Slack message arrives on a Tuesday afternoon: “We’re seeing resource deletions in prod. Investigating.” Your heart rate goes up. You pull the Azure Activity Log. The deletions are attributed to a service principal—one your team created eight months ago for …

Iterative Debugging: Fixing Hallucinations in 9B Local Agents

Iterative Debugging: Fixing Hallucinations in 9B Local Agents

You hit enter. OpenCode spins up a 50-line component, the terminal goes quiet for a second, and then your dev server throws it back at you in red: ReferenceError: window is not defined. The agent just wrote perfectly confident, perfectly broken code — it reached for window.innerWidth like it was …

The Best 7B and 8B Code Models for Local Development in 2026

The Best 7B and 8B Code Models for Local Development in 2026

You’ve configured Ollama, built a custom Modelfile, and wired it to OpenCode. The stack works. Then you ask the model to generate a React component using the use() hook from React 19, and it confidently produces code using patterns from React 16. You try a Rust async function with 2024 edition …

Keyless AI: Using Entra ID Managed Identities for Azure OpenAI

Keyless AI: Using Entra ID Managed Identities for Azure OpenAI

You followed the quickstart. You grabbed the key from the portal, pasted it into a .env file, and your app worked. Now that key lives on your laptop, in your CI/CD secrets, probably in a Slack message from six months ago, and quite possibly in a git log you haven’t checked. It does not expire. …

Advanced each Looping: Iterating Through Complex Nested Objects

Advanced each Looping: Iterating Through Complex Nested Objects

You have a deployment pipeline that needs to hit 12 different Azure regions. You could copy and paste the same 50 lines of YAML 12 times—but now you have a 600-line file that is impossible to maintain. When the security team mandates a new compliance step, you have to update it in 12 places. This is …

Governance at Scale: Writing and Deploying Azure Policies with Terraform and Bicep

Governance at Scale: Writing and Deploying Azure Policies with Terraform and Bicep

The compliance report arrives on a Friday afternoon. You scan through it and stop on a finding: a Storage Account with public network access enabled, sitting in your production subscription, deployed three weeks ago. Someone bypassed the documented standard, the ARM deployment succeeded, and nobody …

Integrating MCP (Model Context Protocol) with OpenCode for Web Dev

Integrating MCP (Model Context Protocol) with OpenCode for Web Dev

You ask your local agent to write an Express route that aggregates monthly sign-ups, and it hands back a query filtering on users.created_date. Your column is created_at. The agent didn’t get this wrong out of carelessness — it never saw your database. It guessed at a plausible schema because …

The Enterprise Case: Security and Privacy with Local AI

The Enterprise Case: Security and Privacy with Local AI

Your team completes a three-month migration to an air-gapped environment to satisfy new compliance requirements. Two security audits. Significant budget. Two weeks after go-live, someone discovers the developers are using personal phone hotspots to access GitHub Copilot — because the local …