Recommended
Start with these notes if you are new here.
A curated set of posts that best represent the site's themes: secure delivery, AI governance, architecture, and technical systems thinking.
Secrets Management in Defense CI/CD
How defense CI/CD pipelines handle secrets without embedding credentials in code — covering HashiCorp Vault, SOPS, Platform One's approach, and how to wire rotation events into your cATO evidence stream.
Read noteThe Defense DevSecOps Toolkit
A curated index of the policy documents, NIST publications, Platform One services, pipeline tools, and compliance resources that defense software teams actually use.
Read noteContinuous ATO in Practice
A technical breakdown of Continuous ATO — what it actually requires, how OSCAL enables machine-readable evidence, and where most DoD programs fail to sustain it.
Read noteATO for AI Systems
How AI models actually get authorized in the DoD — the Assess Only construct, the coming NIST 800-53 AI overlays, and the re-authorization trigger problem nobody has solved.
Read noteArmy RMF 2.0: How the Updated Framework Works
How Army RMF 2.0 (Project Sentinel) restructured control selection, inheritance, and monitoring — and how it maps onto the DoD's new five-phase Cybersecurity Risk Management Construct.
Read noteCDAO, Swarms, and the Kill Chain as Microservices
Why the kill chain is decomposing into services on a data fabric — what Replicator's dissolution into DAWG reveals, how Open DAGIR works as an API contract, and where the microservices metaphor breaks.
Read noteSBOM in the Defense Industrial Base
A practical breakdown of SBOM requirements, format standards, toolchain options, and where DIB contractors consistently fall short when the contracting officer asks for one.
Read noteCMMC 2.0 in Practice
A practical breakdown of CMMC 2.0 levels, NIST SP 800-171 control domains, and what contractors must demonstrate to pass a C3PAO assessment.
Read noteRuntime Governance for Mission AI
A runtime governance model for autonomous systems operating beyond traditional approval gates.
Read noteThe DoD Zero Trust Strategy: Where It Stands
A breakdown of the DoD Zero Trust Strategy's seven pillars, FY2027 targets, and the implementation gaps that still threaten the timeline.
Read noteAI Agents in the CI/CD Pipeline
How AI agents change the assumptions behind CI/CD pipelines, review gates, and accountability.
Read notePolicy as Code: The DevSecOps Evolution
Why policy-as-code turns security rules into enforceable, testable delivery controls.
Read noteGitOps in the Age of AI and Modern Warfare
Why GitOps matters for reproducible infrastructure, automation, and accountable software delivery.
Read noteSystem Design 101
A practical index of system design concepts, patterns, and real-world architecture references.
Read note