I'm Andrew Dunn and here you'll find me documenting my explorations through life, analytical computing, and creative computing, exploring ways to make that work accessible to a wider audience.
September 2026
The Key in the Wrong Keyring
We wanted to sign everything for cairn in CI, including a key for kernel modules, and reached into shim's part of the boot chain without asking first.
September 2026
Operationalizing Ontology with Language Models
Projects co-written with language models grow semi-structured data that drifts. An ontology is one approach to consistency I wanted to investigate: what one is, how to run a program over it, what that buys, and the small experiment I designed to find out.
August 2026
The Flywheel and the Meter
Documented open models and pricing pain arrived in the same season, and I wanted to know whether the alignment is real or a rhyme. Building a flywheel to read my own usage, finding two moats where the argument assumed one, and a license question that answered itself while I wrote.
August 2026
The Other Half of the Corpus
The benchmark I built in the last post measured my imagination, not my work. Your history is two corpora, artifacts and transcripts, and I had never indexed the second one.
August 2026
When Retrieval Is Not the Question
What replaced the retrieval pipeline on the artifact side: a decay report that runs without a query, a fact lane for questions with one right answer, and disagreement surfaced rather than resolved.
July 2026
Service-to-Service Routing in Rootless Podman
Part one isolated the network planes. The sequel: if every service is in its own plane, how do they talk? The answer is FQDN-everywhere through one always-available local router. Getting there meant a hunt through link-local host access, an SSRF guard that rejected it, pasta's --map-guest-addr, and a careful reading of what podman upstream has actually decided. Plus an epilogue: what happened when the pattern met the whole fleet, and the upstream patch that lets the workaround retire.
Estate · active
Cairn
A sealed bootc estate: db-signed UKI boot under keys from an offline ceremony, composefs-pinned root, TPM2 unlock bound to a signed PCR11 policy. Images promote only after booting for real in CI.
Project · active
varve
A local record lake over agent-session transcripts. Normalizes Claude Code, pi, and opencode session records into Parquet partitions and queries them with DuckDB. Files are canonical, the engine is disposable, and nothing leaves the machine.
Project · active
egress
A public, versioned catalog of every outbound connection a self-managed GitLab instance can make, built for administrators who have to write the firewall and allowlist rules for a controlled-egress or air-gapped environment.
Project · active
Evidence Factory
A worked demonstration of running a continuous ATO evidence pipeline for NIST 800-53 controls entirely inside GitLab: a policy plane injects a conformance stage no repository can edit, a released CI/CD Catalog runs the checks, and one Python driver turns each result into a merge gate and a control posture.
Project · active
gitlab-contribution
Vendors GitLab's official AI-agent skills for Claude Code at a pinned commit, plus one authored skill for contributing to GitLab projects without a GitLab Development Kit.
Project · active
bulkhead
Least-privilege self-managed GitLab CI runners on a fixed set of AlmaLinux hosts: rootless Podman for ordinary jobs, ephemeral libvirt VMs for jobs that need root, and the cgroups v1 versus v2 trap that decides which release to build on.
On Harnesses
April 2026
Larder
Build a small assistant for dinner out of one agent and a folder of plain files, and learn the shape that transfers to most of the other things you keep doing by hand: when the answer is wrong, correct the file, not the answer.
August 2026
Ontology
Operationalize an ontology with a language model. Give the agent a small model of the kitchen instead of a list of what is in it, so the answers stop wobbling from one session or model to the next, and check that model with a script, because it is only worth having once something checks it.
September 2026
Representation
See, with your own key, how the same question about the Apollo 11 SysML v2 model changes in tokens, cost and correctness as the representation changes.
February 2026
Birthday at the Theater
Alasdair turned three and we threw him a party at the theater, which required splicing together TV episodes, phone-recorded introductions, and Ken Burns effects on Route 66 maps.
September 2016
Iceland and the United Kingdom
Three weeks across Iceland, Scotland, and England. Waterfalls, geothermal lagoons, the best Thai food we've ever eaten, and sneaker waves at Reynisfjara.
September 2016
Travel Planning
How we planned the 2016 Iceland, Scotland, and England trip: flights, logistics, and the pleasure of planning months in advance.
July 2016
Las Vegas
Things to do in Las Vegas that don't involve gambling or sitting poolside: the Hoover Dam, Red Rock Canyon, and the strip from a distance.