# Aditya Firmansyah

> Senior Software Engineer — Scalable Platforms & AI Workflows. 13+ years building scalable platforms, microservices, and autonomous multi-agent AI workflows. Practitioner notes, architecture war stories, and engineering benchmarks.

## Overview
- Website: https://aditf.com/
- Blog: https://aditf.com/blog/
- Consultation & Advisory: https://aditf.com/consult/
- RSS Feed: https://aditf.com/blog/rss.xml
- GitHub: https://github.com/adityafirmansyah
- LinkedIn: https://linkedin.com/in/aditya-firmansyah-21940845
- Location: Surakarta, Central Java, Indonesia

## Core Competencies & Technical Stack
- AI & Autonomous Agents: Multi-agent orchestration, LLM tool-calling, Hermes Agent, Claude Code, evaluation harnesses, prompt workflows.
- Backend & Microservices: Python (FastAPI), Node.js (NestJS, Express), TypeScript, Rust, PostgreSQL, SQLite (WAL mode), Redis.
- Frontend & Web: Next.js, React, TypeScript, Tailwind CSS, static site generation, responsive UI/UX.
- Systems & Infrastructure: Linux homelab self-hosting, Docker, Caddy, Nginx, Git post-receive deploy hooks, systemd services, Cloudflare.
- E-Commerce & Domain Platforms: Multi-tenant SaaS, order orchestration, Indonesian QRIS payment flows.

## Flagship Projects
- [Dagango.com](https://dagango.com): High-performance multi-tenant e-commerce storefront platform built with Next.js and FastAPI.
- [mycv.ai.id](https://mycv.ai.id): Automated 8-stage AI resume and ATS optimization web application.
- [TirtaDesa](https://tirtadesa.com): Rural clean water utility management SaaS for Indonesian village communities.

## Field Notes & Technical Articles
Practitioner notes from production engineering, agent orchestration, and self-hosted infrastructure:

- [Cloudflare Ported TypeScript to Rust for Wasm, Not for Speed](https://aditf.com/blog/tsrs-typescript-in-rust-wasm-agent-loops/): Cloudflare's tsrs is up to 8x faster than TypeScript 7.0 with ~70% less memory. The benchmark is the side story. WebAssembly is why the port exists. (Filed 21 Oct 2026, tags: typescript, rust, webassembly, ai-agents, performance) (also available in [Indonesian](https://aditf.com/blog/tsrs-typescript-in-rust-wasm-agent-loops/id/))
- [When the Compiler Becomes a CA: Go's Emergency Distrust of Eight SPKIs](https://aditf.com/blog/go-distrusts-eight-intermediate-cas/): Eight eMudhra intermediates were revoked for key compromise on October 18. A day later Go shipped the only enforcement most backend services will ever receive. (Filed 20 Oct 2026, tags: golang, security, pki, tls, devops) (also available in [Indonesian](https://aditf.com/blog/go-distrusts-eight-intermediate-cas/id/))
- [Why Our Multi-Agent Tooling Hallucinated Kubernetes (And How We Fix Context Poisoning)](https://aditf.com/blog/why-our-tooling-hallucinated-kubernetes/): Our internal developer tooling for docs and runbooks cleanly approved a specification claiming Dagango.com runs on Kubernetes. Here is how context poisoning broke verification. (Filed 19 Oct 2026, tags: ai-agents, software-architecture, devops, prompt-engineering, software-engineering) (also available in [Indonesian](https://aditf.com/blog/why-our-tooling-hallucinated-kubernetes/id/))
- [The 30,000 PR Illusion: Why Stacking AI Reviewers Degrades Architectural Cohesion](https://aditf.com/blog/the-30000-pr-illusion/): Anthropic merges 30,000 changes daily by having AI review AI with zero human sign-off. But machine-only reviews turn immediate architectural alignment into delayed production regressions. (Filed 17 Oct 2026, tags: ai-agents, code-review, software-engineering, devops, software-architecture) (also available in [Indonesian](https://aditf.com/blog/the-30000-pr-illusion/id/))
- [Why I Built mycv.ai.id: How AI Resume Tools Silently Strip Technical Depth and Hallucinate Dates](https://aditf.com/blog/why-i-built-mycv-ai-id/): Standard AI resume builders quietly strip concrete tech stacks into corporate fluff and hallucinate that 2026 dates are from the future. Here is how I engineered mycv.ai.id to stop them. (Filed 16 Oct 2026, tags: ai-engineering, resume-optimization, ats-parser, python, fastapi, anti-slop, self-hosting) (also available in [Indonesian](https://aditf.com/blog/why-i-built-mycv-ai-id/id/))
- [Agent Sandboxes That Fail Open: systemd --user Silently Skips Containment](https://aditf.com/blog/systemd-user-sandbox-fails-open/): Configure ProtectHome=yes, ProtectSystem=strict and IPAddressDeny=any on a systemd --user unit and systemctl show reports them all as active. On modern Ubuntu they fail open and enforce nothing. (Filed 15 Oct 2026, tags: systemd, agent-safety, sandboxing, apparmor, self-hosting) (also available in [Indonesian](https://aditf.com/blog/systemd-user-sandbox-fails-open/id/))
- [The Multi-Agent Concurrency Bottleneck: Why Your Coding Fleet Locks Up](https://aditf.com/blog/multi-agent-concurrency-bottleneck/): Three coding agents on one repository stop failing on model quality. The failures become file locks, bound ports, and database races. Here is the isolation that fixes it. (Filed 14 Oct 2026, tags: ai-agents, devops, software-engineering, architecture, git) (also available in [Indonesian](https://aditf.com/blog/multi-agent-concurrency-bottleneck/id/))
- [Codex's Auto-Started Daemon: What systemd Would Have Done Differently](https://aditf.com/blog/codex-daemon-vs-systemd-supervision/): Since 0.157.0, Codex CLI starts a persistent, self-updating background daemon on qualifying interactive sessions. Here is what that breaks, and what a supervised service would have done instead. (Filed 13 Oct 2026, tags: agents, systemd, self-hosting, coding-agents, linux) (also available in [Indonesian](https://aditf.com/blog/codex-daemon-vs-systemd-supervision/id/))
- [The Remote Attestation Trap in Passkeys: Why WebAuthn Threatens User Sovereignty](https://aditf.com/blog/passkeys-remote-attestation-webauthn-trap/): Passkeys promise phishing-resistant logins, but WebAuthn carries a remote attestation switch. If relying parties turn it on, user-controlled password managers like KeePassXC get locked out. (Filed 12 Oct 2026, tags: security, authentication, webauthn, privacy, architecture) (also available in [Indonesian](https://aditf.com/blog/passkeys-remote-attestation-webauthn-trap/id/))
- [Cloudflare Acquires Deno: What the Sunset Actually Means](https://aditf.com/blog/cloudflare-acquires-deno-workerd-durable-objects/): Ryan Dahl is ending Deno runtime development in a year and sunsetting Deno Deploy in six months. The reason isn't defeat: it's a bet that Durable Objects are the right primitive for stateful distributed systems. (Filed 10 Oct 2026, tags: javascript, cloudflare, deno, distributed-systems, architecture) (also available in [Indonesian](https://aditf.com/blog/cloudflare-acquires-deno-workerd-durable-objects/id/))
- [Someone Applied for .lan: Why OpenWrt and Homelab DNS May Leak](https://aditf.com/blog/dot-lan-gtld-openwrt-dns-leak-risk/): ICANN's 2026 gTLD round includes a live application for .lan, the domain OpenWrt has hardcoded as a router default for two decades. Here's what that means for every homelab using it. (Filed 09 Oct 2026, tags: dns, networking, homelab, self-hosting, security) (also available in [Indonesian](https://aditf.com/blog/dot-lan-gtld-openwrt-dns-leak-risk/id/))
- [Chrome 155 Ships JPEG XL in Rust: What It Actually Changes for an E-Commerce Image Pipeline](https://aditf.com/blog/chrome-jpeg-xl-rust-ecommerce-image-pipeline/): Chrome 155 reverses its 2022 decision and ships JPEG XL decoding, built on a pure-Rust decoder. For a platform that got burned by AVIF's encoding cost, this is the format worth re-evaluating. (Filed 08 Oct 2026, tags: web-performance, rust, ecommerce, browsers, architecture) (also available in [Indonesian](https://aditf.com/blog/chrome-jpeg-xl-rust-ecommerce-image-pipeline/id/))
- [Why next/font/google Broke Our CI: Self-Hosting 13 Font Subsets for Zero-Network Builds](https://aditf.com/blog/nextjs-self-host-font-subsets-zero-network-builds/): Our master CI died twice in twelve hours inside next/font/google, on commits that carried identical font code. Here is how Dagango.com vendors 13 font subsets on disk and makes next build fetch nothing. (Filed 07 Oct 2026, tags: nextjs, frontend, performance, webdev, architecture) (also available in [Indonesian](https://aditf.com/blog/nextjs-self-host-font-subsets-zero-network-builds/id/))
- [The SQLAlchemy Session Poisoning Trap in Bulk CSV Import](https://aditf.com/blog/sqlalchemy-session-poisoning-bulk-csv-import/): One failed row in a bulk import can poison a shared SQLAlchemy session and kill the next 497. Here is the real session-lifecycle fix, with numbers from PostgreSQL 18.6. (Filed 06 Oct 2026, tags: python, sqlalchemy, postgresql, backend, architecture) (also available in [Indonesian](https://aditf.com/blog/sqlalchemy-session-poisoning-bulk-csv-import/id/))
- [Reproducing the .git Hook Attack: git status Runs an Attacker's Command](https://aditf.com/blog/reproducing-the-git-hook-attack/): Frank Wiles got a fake project inquiry, a Dropbox folder of specs, and a hidden .git with a post-checkout hook. I reproduced both vectors on git 2.53.0, and the popular fix is overridable. (Filed 05 Oct 2026, tags: git, security, ai-agents, supply-chain, devtools) (also available in [Indonesian](https://aditf.com/blog/reproducing-the-git-hook-attack/id/))
- [My 17 Agents Remember With 1,069 Markdown Skills, Not Vectors](https://aditf.com/blog/agents-remember-with-markdown-skills-not-vectors/): A memory plugin attaches the five most similar snippets to every prompt. I run 17 agents, and their durable knowledge is 1,069 Markdown skill files plus a memory file I keep under a kilobyte. (Filed 04 Oct 2026, tags: ai-agents, documentation, llm-tooling, knowledge-management, software-engineering) (also available in [Indonesian](https://aditf.com/blog/agents-remember-with-markdown-skills-not-vectors/id/))
- [A Database Per Agent Costs More Than a File](https://aditf.com/blog/database-per-agent-costs-more-than-a-file/): Supabase says agents should be able to create a database as cheaply as a file. I already run one database per agent on a mini-PC, so I counted. The create is free; everything after it is the bill. (Filed 03 Oct 2026, tags: sqlite, databases, ai-agents, infrastructure, self-hosting) (also available in [Indonesian](https://aditf.com/blog/database-per-agent-costs-more-than-a-file/id/))
- [You Said No MCP: The Tool-Loadout Tradeoff Nobody Tests](https://aditf.com/blog/mcp-in-core-tool-loadout-tradeoff/): Pi spent a year saying it would never speak MCP, then shipped it in the core. The reason was not that MCP got better. The sandbox underneath it did. (Filed 03 Oct 2026, tags: ai-agents, mcp, tooling, architecture, self-hosting) (also available in [Indonesian](https://aditf.com/blog/mcp-in-core-tool-loadout-tradeoff/id/))
- [Git 3.0's SHA-256 Default Is a Primary-Key Migration](https://aditf.com/blog/git-3-sha256-primary-key-migration/): I created a SHA-256 repository with the git I already have. Two of three daily operations failed outright, and the third is documented to die on older clients. The hash is not the migration; the key is. (Filed 02 Oct 2026, tags: git, developer-tooling, migrations, version-control, storage) (also available in [Indonesian](https://aditf.com/blog/git-3-sha256-primary-key-migration/id/))
- [18 Gateways to 1: The Fix That Isn't in Git](https://aditf.com/blog/gateway-fix-not-in-git/): Eighteen gateway daemons became one in under three minutes. The dashboard watching them broke, then got fixed with 270 uncommitted lines. A clean checkout puts production back to reporting 16 of 17 profiles down. (Filed 01 Oct 2026, tags: ai-agents, homelab, systemd, observability, self-hosting) (also available in [Indonesian](https://aditf.com/blog/gateway-fix-not-in-git/id/))
- [Two Kinds of Decision, and No Way to Prove the Model Did Not Change](https://aditf.com/blog/decision-classifier-vs-reasoning-drift/): A reasoning classifier and a drift benchmark landed a day apart. Together they say which decisions deserve thinking, and why your own latency numbers cannot prove the model changed. (Filed 30 Sep 2026, tags: ai-agents, local-llm, evaluations, homelab, software-engineering) (also available in [Indonesian](https://aditf.com/blog/decision-classifier-vs-reasoning-drift/id/))
- [Egress Is the Boundary: What 700 Escaped Agents Taught About Containment](https://aditf.com/blog/egress-is-the-boundary-agent-containment/): A forensic report on 700 escaped agents reads better as a containment checklist than an incident recap. Here is what it changed about how I run my own fleet. (Filed 27 Sep 2026, tags: ai-agents, security, devops, self-hosting, sandboxing) (also available in [Indonesian](https://aditf.com/blog/egress-is-the-boundary-agent-containment/id/))
- [Why We Built Isolated Subdomains Instead of a Public Store Directory](https://aditf.com/blog/isolated-subdomains-vs-public-store-directory/): A public /stores directory would have made Dagango.com behave like a marketplace. We shipped per-tenant host routing and metadata instead, and the crawl-budget argument is what settled it. (Filed 26 Sep 2026, tags: multi-tenancy, nextjs, seo, e-commerce, architecture) (also available in [Indonesian](https://aditf.com/blog/isolated-subdomains-vs-public-store-directory/id/))
- [Why Your Postgres LIKE Query Silently Seq Scans (And the One-Line Fix)](https://aditf.com/blog/postgres-like-queries-seq-scan-fix/): On a default en_US.UTF-8 Postgres, a UNIQUE (tenant_id, slug) index cannot serve LIKE 'prefix%' queries. Here are the benchmark numbers at 20,000 rows and the varchar_pattern_ops index that fixes it. (Filed 25 Sep 2026, tags: postgresql, database, backend, performance, optimization, sql) (also available in [Indonesian](https://aditf.com/blog/postgres-like-queries-seq-scan-fix/id/))
- [Your Agent's Config Silently Failed: The Canary Test That Catches It](https://aditf.com/blog/agent-config-canary-test/): Claude Code shipped AGENTS.md support gated behind a remote flag, so telemetry-off users got silent failures. Here's the five-second test that catches this class of bug in any agent setup. (Filed 24 Sep 2026, tags: ai-agents, claude-code, developer-tooling, debugging, llm-workflows) (also available in [Indonesian](https://aditf.com/blog/agent-config-canary-test/id/))
- [Self-Hosting Behind CGNAT: A WireGuard Bridge That Actually Works](https://aditf.com/blog/self-hosting-behind-cgnat-wireguard-bridge/): Port forwarding stopped working and it wasn't your router's fault. Here's the outbound WireGuard tunnel pattern that gets a homelab back on the public internet under CGNAT. (Filed 23 Sep 2026, tags: self-hosting, homelab, networking, wireguard, cgnat) (also available in [Indonesian](https://aditf.com/blog/self-hosting-behind-cgnat-wireguard-bridge/id/))
- [AI Agents Flooded Our PR Queue: Fixing CI Before It Breaks](https://aditf.com/blog/ci-bottleneck-in-agent-era/): Coding agents made writing PRs nearly free, which means your pipeline is now the bottleneck. Here's what Linear's CI rework maps to on a small-team budget. (Filed 22 Sep 2026, tags: ci-cd, ai-agents, developer-productivity, testing, github-actions) (also available in [Indonesian](https://aditf.com/blog/ci-bottleneck-in-agent-era/id/))
- [Why I Self-Host Everything on a Mini PC](https://aditf.com/blog/why-i-self-host-on-a-mini-pc/): A Celeron box with 14GB RAM in the corner of my room runs my stores, my agents, and this blog. Here is the math on why cloud bills stopped making sense. (Filed 22 Sep 2026, tags: self-hosting, infrastructure, homelab) (also available in [Indonesian](https://aditf.com/blog/why-i-self-host-on-a-mini-pc/id/))