https://noushadhossain.com/writing Engineering notes on PostgreSQL, data pipelines, LLM agents, email infrastructure and running small platforms in production. en Tue, 20 Oct 2026 22:17:41 GMT https://noushadhossain.com/writing/idempotent-batch-apis-with-external-id https://noushadhossain.com/writing/idempotent-batch-apis-with-external-id Mon, 19 Oct 2026 09:00:00 GMT Designing a certification platform's provider API so retried batches never duplicate certificates and partners can integrate without talking to us. https://noushadhossain.com/writing/a-channel-taxonomy-in-one-csv https://noushadhossain.com/writing/a-channel-taxonomy-in-one-csv Tue, 13 Oct 2026 09:00:00 GMT The most useful thing to come out of a dbt spike was fifteen lines of CSV: one place where every vendor's channel name maps to ours. https://noushadhossain.com/writing/a-week-with-dbt-and-its-sharp-defaults https://noushadhossain.com/writing/a-week-with-dbt-and-its-sharp-defaults Tue, 06 Oct 2026 09:00:00 GMT A time-boxed spike to decide whether dbt fits our silver-to-gold layer: it did everything asked, and showed how easily it produces silently wrong data. https://noushadhossain.com/writing/testing-row-level-security-as-a-non-superuser https://noushadhossain.com/writing/testing-row-level-security-as-a-non-superuser Tue, 29 Sep 2026 09:00:00 GMT RLS tests that run as the postgres superuser prove nothing. How the Intelect test suite exercises the policies for real, and what that costs. https://noushadhossain.com/writing/two-layers-of-tenant-isolation https://noushadhossain.com/writing/two-layers-of-tenant-isolation Tue, 22 Sep 2026 09:00:00 GMT How a multi-tenant CRM on one shared PostgreSQL database keeps tenants apart twice: once in SQLAlchemy, once in the database itself. https://noushadhossain.com/writing/migrating-wordpress-to-postgres-without-mysql https://noushadhossain.com/writing/migrating-wordpress-to-postgres-without-mysql Tue, 15 Sep 2026 09:00:00 GMT Two education platforms moved from WordPress to FastAPI and Postgres 16. The migration pipeline is reproducible, keeps a safety net, and lets old passwords keep working. https://noushadhossain.com/writing/secrets-hygiene-for-a-small-platform https://noushadhossain.com/writing/secrets-hygiene-for-a-small-platform Tue, 08 Sep 2026 09:00:00 GMT The written rules InkPigeon follows for passwords, API keys, DKIM keys, logging, configuration and migrations, and why they are rules rather than habits. https://noushadhossain.com/writing/where-port-25-works https://noushadhossain.com/writing/where-port-25-works Tue, 01 Sep 2026 09:00:00 GMT Most cloud providers will not let you send mail on port 25. How that constraint shaped where and how InkPigeon runs. https://noushadhossain.com/writing/two-privilege-escalations-i-shipped https://noushadhossain.com/writing/two-privilege-escalations-i-shipped Tue, 25 Aug 2026 09:00:00 GMT InkPigeon's custom-roles feature passed its tests and still had two ways to escalate privileges. What a dedicated adversarial pass found, and the rules it produced. https://noushadhossain.com/writing/the-mail-queue-lives-in-postgres https://noushadhossain.com/writing/the-mail-queue-lives-in-postgres Tue, 18 Aug 2026 09:00:00 GMT InkPigeon's delivery workers claim messages with FOR UPDATE SKIP LOCKED instead of a Redis or Celery queue. The reasoning and the trade-off. https://noushadhossain.com/writing/a-modular-monolith-on-one-vps https://noushadhossain.com/writing/a-modular-monolith-on-one-vps Tue, 11 Aug 2026 09:00:00 GMT InkPigeon is one Python codebase deployed as about eight containers that scale independently. Why that beats microservices on a single server. https://noushadhossain.com/writing/build-or-adopt-an-email-platform https://noushadhossain.com/writing/build-or-adopt-an-email-platform Tue, 04 Aug 2026 09:00:00 GMT I evaluated five open-source mail products before building InkPigeon's own pipeline. Here is what each one is, and why only two components survived. https://noushadhossain.com/writing/ai-coding-sessions-need-a-standards-file https://noushadhossain.com/writing/ai-coding-sessions-need-a-standards-file Tue, 14 Jul 2026 09:00:00 GMT I use AI coding assistants heavily. The thing that keeps them from drifting is not a better prompt but a written standards file that outranks the model. https://noushadhossain.com/writing/the-cutover-playbook https://noushadhossain.com/writing/the-cutover-playbook Tue, 23 Jun 2026 09:00:00 GMT How we move frontend modules from legacy endpoints to a new backend one constructor at a time, and why the first cutover is the one that matters. https://noushadhossain.com/writing/deleting-endpoints-safely-code-audit-vs-access-logs https://noushadhossain.com/writing/deleting-endpoints-safely-code-audit-vs-access-logs Tue, 09 Jun 2026 09:00:00 GMT Seven groups of old API endpoints have zero callers in our code. We still are not deleting them until the access logs agree. https://noushadhossain.com/writing/replacing-a-five-year-rewrite-with-a-bounded-migration https://noushadhossain.com/writing/replacing-a-five-year-rewrite-with-a-bounded-migration Tue, 26 May 2026 09:00:00 GMT Our plan to migrate all 18 modules to a new architecture would have taken 3.5 to 6 years. Here is how we replaced it with a target the company could actually reach. https://noushadhossain.com/writing/who-owns-which-layer-python-dbt-celery https://noushadhossain.com/writing/who-owns-which-layer-python-dbt-celery Tue, 05 May 2026 09:00:00 GMT Before choosing a transform tool for our ETL v2 platform, we fixed which layer each component owns. The boundaries outlived the tool decision. https://noushadhossain.com/writing/idempotent-ingestion-run-ids-and-hashes https://noushadhossain.com/writing/idempotent-ingestion-run-ids-and-hashes Tue, 21 Apr 2026 09:00:00 GMT How the bronze layer of our ETL v2 design makes every load safe to re-run, and why a data contract has to exist before the first table does. https://noushadhossain.com/writing/a-security-gate-that-does-not-block-delivery https://noushadhossain.com/writing/a-security-gate-that-does-not-block-delivery Tue, 07 Apr 2026 09:00:00 GMT How I built our GitHub Actions staging pipeline to fail on security findings by default while letting a reviewer approve a deployment with a record. https://noushadhossain.com/writing/reconciling-hotel-identities-across-vendor-apis https://noushadhossain.com/writing/reconciling-hotel-identities-across-vendor-apis Tue, 24 Mar 2026 09:00:00 GMT Why the hardest problem in a multi-source analytics platform is agreeing on which hotel a row belongs to, and how we made that explicit. https://noushadhossain.com/writing/grounding-llm-reports-in-your-own-apis https://noushadhossain.com/writing/grounding-llm-reports-in-your-own-apis Tue, 10 Mar 2026 09:00:00 GMT How we added LLM-written narrative reports to an analytics platform without letting the model invent a single number. https://noushadhossain.com/writing/what-a-coding-agent-costs-per-pull-request https://noushadhossain.com/writing/what-a-coding-agent-costs-per-pull-request Wed, 25 Feb 2026 09:00:00 GMT Why I built a per-run cost ledger into my coding agent, and how knowing the price of a pull request changed which tickets I give it. https://noushadhossain.com/writing/four-tools-are-enough https://noushadhossain.com/writing/four-tools-are-enough Wed, 11 Feb 2026 09:00:00 GMT How I built an agent that turns well-specified tickets into pull requests with four tools, hard limits and a provider abstraction. https://noushadhossain.com/writing/missing-data-should-be-a-state https://noushadhossain.com/writing/missing-data-should-be-a-state Wed, 28 Jan 2026 09:00:00 GMT How the analytics platform I lead turned silent gaps in vendor data into tracked states with monitors, triggers and automatic resolution. https://noushadhossain.com/writing/celery-beat-with-a-database-scheduler https://noushadhossain.com/writing/celery-beat-with-a-database-scheduler Wed, 14 Jan 2026 09:00:00 GMT Why the analytics platform I lead keeps its sync schedules in PostgreSQL rather than in code, and what went wrong before it did.