

Turning an RSS Reader Into an Intelligence Pipeline
Introduction I consume far more feeds than I can reasonably examine with sustained attention, which means that the substantive difficulty lies not in volume alone but in the profoundly uneven distribution of relevance within that volume. On an active day, a hundred articles may arrive in rapid succession; perhaps four contain a development warranting action, while the remaining ninety-six obscure those few consequential pieces beneath a familiar and relentless accumulation of headlines, summaries, reposts, and derivative commentary. ...
One Ollama Endpoint, Two Very Different Backends
Introduction Nine namespaces in my cluster depend upon a local language model. The SDR research stack tags transcriptions, the politics dashboard summarizes feeds, the congressional-trade tracker prepares daily summaries, and several agents submit work to the service continuously. Despite their differing purposes and operational rhythms, each consumer was designed to address one stable hostname on port 11434. That hostname fronts two active Ollama deployments: an RTX 5090 in a desktop tower that is intentionally powered down at intervals, and an NVIDIA GB10 Spark board whose unified-memory architecture causes GPU-backed allocations to count against the pod’s memory limit. The repository contains a CPU-only deployment manifest, but the active Kustomization excludes it under ordinary circumstances. The Spark deployment is therefore the operational fallback. ...
No Proxy, No Fetch Tool: Capability-Scoped Internet Access for In-Cluster Agents
Introduction Consider an agent running in a cluster or on a server that needs to read the news. The customary response is to provide an HTTP client and permit it to fetch URLs, perhaps through an egress proxy intended to impose a measure of network hygiene. The agent in question is an in-cluster assistant with material access to its environment. It can receive a projected ServiceAccount token, whose effective authority derives from Kubernetes RBAC; it can control home automation; and it can reach several important internal services. Giving a system with that degree of reach a general-purpose fetch(url) tool creates a direct security problem: every page it reads becomes a potential source of adversarial instruction, and every host on the internet becomes a potential destination for whatever information the agent can assemble. ...
Parsing Every Congressional Stock Disclosure: Seventeen CronJobs and a Lot of Bad PDFs
Introduction Members of the United States Congress must disclose many securities transactions, and the resulting records are public. As a dataset, however, they are close to unusable: the House publishes a ZIP archive whose underlying filings are frequently scanned images; the Senate uses a separate system with its own irregularities; tickers are inconsistent or absent; and neither chamber provides an interface resembling a durable public API. Several commercial services solve this and sell the result. I wanted to see how much of it I could do myself, in-cluster, from the primary sources. ...
Agentic Static-Site Hosting: Giving Claude a Place to Publish on Kubernetes
Introduction I use Claude Code for substantial one-off analysis, and its output is frequently a single self-contained HTML file. Examples include a flight-log dashboard, an interactive trainer derived from an audiobook transcript (described in Building Interactive Trainers From My Audiobook Library), a pedigree chart, and a client map. Each began either as a Live Artifact or as a file in /tmp that I opened with file://, inspected once, and subsequently lost. ...