/blog
Long-form project deep-dives: why they exist, how they work inside, where it got hard, and how I solved it.
← HomeThe 4G router on the desk has a SIM and an app that sends SMS, but no documented API. Encrypted luci login, a controller found in the firmware that answers 404 to the web session, and why there ended up being three ways to send.
WhatsApp encrypts your messages but stays the middleman who sees who talks to whom, and when. What the architecture looks like when the server only ever holds opaque envelopes: PQXDH instead of X3DH, mailboxes instead of accounts, and spam defence without phone numbers.
Chat and voice fail in different ways, so Concord separates a control plane from a media plane. Plus the details that trip you up: snowflakes that don't fit a JSON number, UDP that can't cross Traefik, and a login with nowhere to redirect.
Two front doors into one system — MTProto for real Telegram clients, REST for embedded chat. Where the difficulty actually lives: message ordering, the storage split, and keeping an honest count of what's really implemented.
An hour of audio into a document in five minutes. Uploads that bypass the backend, one graphics card locked across several workers, per-minute billing that reserves before it charges, and two brands on one codebase.
One compromised container, a systematic audit of the rest of the fleet, and six architectural changes: OpenBao, database isolation, network isolation, rootless containers, vulnerability scanning, and updating every image — including the vulnerable Next.js one.
8+ self-hosted MCP servers, two forked AI coding CLIs locked to one hardcoded endpoint, and an LLM gateway behind all of it — what it took to get agent tooling talking to infrastructure with no vendor cloud anywhere in it.
Why spend test-time compute as tokens? I built latentGPT — a from-scratch recurrent-depth reasoner — to study when iterating in latent space beats chain-of-thought, and how to stop it from collapsing.