Articles on software engineering, cloud infrastructure, DevOps and building AI systems.https://www.sumonselim.comen-ushttps://www.sumonselim.com/timothy-part26-one-terminal-event-and-five-ways-to-lose-ithttps://www.sumonselim.com/timothy-part26-one-terminal-event-and-five-ways-to-lose-itA slow model on a CPU-only box made streaming chat turns vanish with zero trace: no assistant message, no error, no evidence the turn ran. Five commits trace one causal chain, defending a single contract in the gateway: a stream ends with exactly one terminal event.Thu, 06 Aug 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part25-routes-as-roles-not-nameshttps://www.sumonselim.com/timothy-part25-routes-as-roles-not-namesRouting used to be 7 frozen route names compared by string literal across the gateway and brain. Now a capability column and a role column decouple what a route does from what it is called, routes are user-managed from the settings panel, and the headline feature shipped unreachable through the public API for a few hours because the proxy allowlist and the gateway endpoints live in different files.Wed, 05 Aug 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part24-an-orange-t-and-a-one-line-installhttps://www.sumonselim.com/timothy-part24-an-orange-t-and-a-one-line-installTwo commits landed twenty-five minutes apart on the same morning: one gave Timothy a face by rotating the brand accent from purple to a tabby-orange T mark, and one made it installable without cloning the repo, through a release pipeline, a prebuilt-image compose file, and a magic-link sign-in.Tue, 04 Aug 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part23-hand-built-charts-and-a-faster-cihttps://www.sumonselim.com/timothy-part23-hand-built-charts-and-a-faster-ciThe analytics dashboard's charts came from recharts and looked it: flat bars, no hover, no way to isolate a series. I replaced them with a small set of hand-built SVG chart primitives, and while I was in the CI file anyway, fixed the bigger problem of every PR paying for a full test suite it didn't need.Mon, 03 Aug 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part22-connector-sensitivity-and-a-same-day-bughttps://www.sumonselim.com/timothy-part22-connector-sensitivity-and-a-same-day-bugPart 18 pinned a session to a local model the moment it touched Gmail specifically. This part generalizes that floor to any connector I flag sensitive in settings, and tells the honest story of shipping it, missing the mid-turn case, and fixing it the same day.Sun, 02 Aug 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part21-pdf-attachments-and-a-turn-that-outlives-the-requesthttps://www.sumonselim.com/timothy-part21-pdf-attachments-and-a-turn-that-outlives-the-requestTimothy can now read PDFs, converted to markdown once at send time instead of on every turn, and a chat turn no longer dies just because the browser tab that started it went away. Both fixes trace back to the same instinct: a turn belongs to the session, not to whatever request or conversion happened to kick it off.Sat, 01 Aug 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part20-voice-input-and-image-attachmentshttps://www.sumonselim.com/timothy-part20-voice-input-and-image-attachmentsTimothy can now hear and see: a microphone button transcribes speech entirely on-box through a self-hosted Whisper sidecar, and the composer accepts image attachments that are stored content-addressed on the brain and routed to a dedicated vision chain. Both are input-only for now; the model still cannot speak back or generate an image.Fri, 31 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part19-a-chat-that-survives-reloads-and-raceshttps://www.sumonselim.com/timothy-part19-a-chat-that-survives-reloads-and-racesThe event log from parts 6 and 7 made turns durable on disk, but the live chat above it still lied under ordinary failure: a reload mid-answer looked stuck, a dead turn looked like a stuck spinner, and parallel tool calls could stack duplicate prompts. This post covers the milestone that made the live experience as honest as the log underneath it: reattach across reloads, one turn per session, persisted permission asks, and turns that say plainly when they produced nothing.Thu, 30 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part18-sensitive-sessions-stay-home-local-model-routinghttps://www.sumonselim.com/timothy-part18-sensitive-sessions-stay-home-local-model-routingSome content should never reach a cloud provider, no matter which model is smartest. I added a sensitive-tool route that pins a session to a local model the moment it touches something like Gmail, made the pin sticky across every later turn and side-call, and moved local inference off a containerized Ollama onto a native host runner so it's actually fast enough to use.Wed, 29 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part17-missions-schedules-notifications-and-the-canaryhttps://www.sumonselim.com/timothy-part17-missions-schedules-notifications-and-the-canaryA mission that never gets scheduled again is barely different from a chat message. This post covers the cron scheduler that fires mission templates, transition notifications pushed over SSE, per-mission spend read honestly off the cost ledger, an opt-in escalation route for stuck missions, and the golden-mission canary that gates every change to the harness.Tue, 28 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part16-missions-verification-review-and-the-sandboxhttps://www.sumonselim.com/timothy-part16-missions-verification-review-and-the-sandboxA mission that reports itself done is not the same thing as a mission that is done. This part covers the harness-owned verification that never trusts a model's word for it, an antagonistic reviewer that has to be talked out of rejecting, and the move to run every model-authored command in a disposable sandbox instead of the brain's own process.Mon, 27 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part15-missions-a-state-machine-for-long-running-agent-workhttps://www.sumonselim.com/timothy-part15-missions-a-state-machine-for-long-running-agent-workChat turns cap out at a few minutes of a model's attention, but real work runs for hours. This post covers the mission engine: a pure Go state machine, an append-only event log, fresh-context workers seeded from persisted artifacts, and the sentinel protocol that catches a worker trying to quit early.Fri, 24 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part14-agents-first-sessions-and-scored-routinghttps://www.sumonselim.com/timothy-part14-agents-first-sessions-and-scored-routingThe chat composer had grown a task-category picker, a skill chip, and a model hint, and none of them agreed with each other. This post covers the agents-first redesign: one profile that bundles a prompt, a route, tool and skill allowlists, and a memory switch, plus the scored routing underneath it that replaced fixed provider chains with live price, latency, and uptime data.Thu, 23 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part13-connectors-gmail-calendar-and-mcp-toolshttps://www.sumonselim.com/timothy-part13-connectors-gmail-calendar-and-mcp-toolsThe assistant could search the web and run shell commands in its own workspace, but it had no way to touch my inbox, my calendar, or any third-party API. This post covers the connectors framework: a generic MCP client for the escape hatch, a first-party Google kind for OAuth-backed Gmail and Calendar tools, and the two bugs that shipped after the demo worked.Tue, 21 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part12-control-plane-and-web-searchhttps://www.sumonselim.com/timothy-part12-control-plane-and-web-searchWith sessions, memory and the first-party models in place, the ledger was full of numbers no one could see and the model still lived inside its training cut-off. I added usage aggregates, a full admin surface for providers and routes that hot-reloads, feature switches enforced in code, and a web_search tool backed by a self-hosted SearXNG instance that the model can never reach directly.Sun, 19 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part11-first-party-models-on-aws-bedrock-driver-and-capability-routinghttps://www.sumonselim.com/timothy-part11-first-party-models-on-aws-bedrock-driver-and-capability-routingAmazon Bedrock (Nova for chat/tools, Titan for embeddings) is now a first-class provider in the gateway. The driver reuses the same normalized stream contract; model-level capability declarations prevent routing an embeddings-only model into a chat chain. Nova rides inference profiles and the SDK default credential chain, no static keys.Sat, 18 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part10-remembering-on-demand-three-retrieval-legs-one-token-budget-and-a-fencehttps://www.sumonselim.com/timothy-part10-remembering-on-demand-three-retrieval-legs-one-token-budget-and-a-fencePer-turn recall runs vector k-NN, full-text, and entity match in parallel over one Postgres table. Results are fused with reciprocal rank fusion plus recency decay, packed under a real-tokenizer budget, and injected as fenced DATA at the tail of the system prompt so provider caches keep hitting. Content can never close the fence.Fri, 17 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part9-memory-that-belongs-to-me-staged-facts-that-only-supersedehttps://www.sumonselim.com/timothy-part9-memory-that-belongs-to-me-staged-facts-that-only-supersedeLong-term memory is now first-class in Timothy: typed facts are extracted automatically but land pending, only the owner promotes them to active retrieval, and corrections never mutate an existing row: a new fact is inserted and the old one points to it via superseded_by. The model proposes; deterministic Go decides.Thu, 16 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part8-letting-the-model-act-tools-permissions-skillshttps://www.sumonselim.com/timothy-part8-letting-the-model-act-tools-permissions-skillsThe model can now act through a single deterministic loop in the brain. Tools are registered with strict schemas and junior-dev descriptions; every call passes through constraint middleware and a permission chain that treats opaque or destructive commands as first-class reasons to ask the user. Skills are versioned packs that load on demand so the system prompt stays small.Wed, 15 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part7-sessions-that-survive-resumable-ui-and-replayhttps://www.sumonselim.com/timothy-part7-sessions-that-survive-resumable-ui-and-replayThe backend stores sessions as an append-only event log with a dedicated projection. This post records the decisions around the UITranscript projection, composite cursors, and faithful resume from the server without duplicating compaction or interruption logic.Tue, 14 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part6-sessions-that-survive-event-sourcing-the-backendhttps://www.sumonselim.com/timothy-part6-sessions-that-survive-event-sourcing-the-backendPhase 0 kept conversation history in a 20-message in-memory buffer. This post records the architectural decisions that replaced it with an append-only event log, dual projections, prefix-stable LLM context, structured turn residue, automatic compaction, and crash-safe pending state.Mon, 13 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part5-the-first-web-chat-interfacehttps://www.sumonselim.com/timothy-part5-the-first-web-chat-interfaceWith the gateway and brain in place, the first client streamed the normalized events, rendered the transcript including reasoning, surfaced retries and costs honestly, and survived network hiccups using the terminal meta contract.Sun, 12 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part4-pass-through-chat-the-brains-first-apihttps://www.sumonselim.com/timothy-part4-pass-through-chat-the-brains-first-apiBefore full event-sourced sessions, I needed an end-to-end chat that actually worked. The brain became a thin authenticated pass-through: one bearer token, a tiny in-memory history buffer, a gateway call, and a terminal meta event that tells the client exactly what happened.Sat, 11 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part3-the-llm-gateway-providers-as-data-streaming-cost-ledgerhttps://www.sumonselim.com/timothy-part3-the-llm-gateway-providers-as-data-streaming-cost-ledgerThe gateway is the only component that ever touches an API key or subscription. I built it to treat providers as rows in Postgres, normalize every response into one event stream, and record a receipt for every token in a cost ledger, even when things go wrong.Fri, 10 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part2-the-architecture-three-go-services-and-a-rulehttps://www.sumonselim.com/timothy-part2-the-architecture-three-go-services-and-a-ruleBefore writing a single line of Timothy, I committed the architecture to paper: three Go services, one Postgres, one React app, and one rule that shapes everything: deterministic code orchestrates, and each LLM session does exactly one thing.Thu, 09 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/timothy-part1-why-i-am-building-my-own-ai-assistanthttps://www.sumonselim.com/timothy-part1-why-i-am-building-my-own-ai-assistantI pay for five AI subscriptions and still don't have one place that remembers me, routes each task to the right model, and shows me what I spend. So I am building Timothy, a self-hosted personal AI assistant in Go and React, running on my homelab. This is Part 1 of the series.Wed, 08 Jul 2026 00:00:00 GMTTimothyMuhammad Sumon Molla Selimhttps://www.sumonselim.com/zero-trust-eks-part4-irsa-supply-chainhttps://www.sumonselim.com/zero-trust-eks-part4-irsa-supply-chainCompleting our Zero Trust in EKS series, this post focuses on securing North-South traffic using AWS IAM Roles for Service Accounts (IRSA) and establishing a robust software supply chain to ensure the integrity and trustworthiness of our container images.Mon, 12 Jan 2026 00:00:00 GMTAWSMuhammad Sumon Molla Selimhttps://www.sumonselim.com/zero-trust-eks-part3-network-data-securityhttps://www.sumonselim.com/zero-trust-eks-part3-network-data-securityBeyond identity, a robust Zero Trust strategy for Amazon EKS demands stringent network isolation and comprehensive data protection. This post explores how to implement a 'Default Deny' network posture using Kubernetes Network Policies and safeguard sensitive data with AWS KMS Envelope Encryption and AWS Secrets Manager.Sun, 11 Jan 2026 00:00:00 GMTAWSMuhammad Sumon Molla Selimhttps://www.sumonselim.com/zero-trust-eks-part2-spiffe-spire-identityhttps://www.sumonselim.com/zero-trust-eks-part2-spiffe-spire-identityIn a Zero Trust architecture, relying on network location for security is a relic of the past. This post delves into how SPIFFE/SPIRE provides cryptographically verifiable identities to workloads in Amazon EKS, enabling robust mutual TLS for East-West communication.Sat, 10 Jan 2026 00:00:00 GMTAWSMuhammad Sumon Molla Selimhttps://www.sumonselim.com/zero-trust-eks-part1-beyond-perimeterhttps://www.sumonselim.com/zero-trust-eks-part1-beyond-perimeterThe traditional perimeter-based security model is no longer sufficient for modern cloud-native applications, especially within dynamic environments like Amazon EKS. This post introduces the fundamental principles of Zero Trust, its critical importance in Kubernetes, and the five core pillars that form a robust security architecture.Fri, 09 Jan 2026 00:00:00 GMTAWSMuhammad Sumon Molla Selimhttps://www.sumonselim.com/my-journey-as-an-aws-community-builder-benefits-how-to-apply-and-what-to-expecthttps://www.sumonselim.com/my-journey-as-an-aws-community-builder-benefits-how-to-apply-and-what-to-expectBecoming part of the AWS Community Builders program has been one of the best decisions in my cloud career. I’m now in my third year…Fri, 12 Dec 2025 00:00:00 GMTAWSMuhammad Sumon Molla Selimhttps://www.sumonselim.com/installing-web-server-lemp-amazon-ec2-instancehttps://www.sumonselim.com/installing-web-server-lemp-amazon-ec2-instanceSSH into an Ubuntu EC2 instance with your .pem key, install Nginx, MySQL and PHP 8.2 FPM, and configure the default Nginx server block to run PHP.Sun, 09 Jul 2023 00:00:00 GMTPHPMuhammad Sumon Molla Selimhttps://www.sumonselim.com/launching-free-amazon-ec2-instancehttps://www.sumonselim.com/launching-free-amazon-ec2-instanceLaunch a free-tier Amazon EC2 instance step by step: pick the Ubuntu 22.04 AMI, choose t2.micro, create and download a key pair, set a security group, add an 8 GiB EBS volume.Sun, 02 Jul 2023 00:00:00 GMTAWSMuhammad Sumon Molla Selimhttps://www.sumonselim.com/sync-forked-github-repository-masterhttps://www.sumonselim.com/sync-forked-github-repository-masterSync a forked GitHub repository with the original: add the source repo as an upstream remote, fetch, merge upstream/master into your master, and push.Fri, 08 Jul 2016 00:00:00 GMTGitMuhammad Sumon Molla Selimhttps://www.sumonselim.com/lets-learn-coding-tech-life-asian-radio-fm-90-8https://www.sumonselim.com/lets-learn-coding-tech-life-asian-radio-fm-90-8I (Founder, Lets Learn Coding) along with my friend Rakibul Hasan Rashed (Faculty, Department of CSE, IUBAT) were special guests on the show “Lets Learn Coding…Tue, 09 Feb 2016 00:00:00 GMTPodcastsMuhammad Sumon Molla Selimhttps://www.sumonselim.com/increase-your-wordpress-maximum-file-upload-size-limithttps://www.sumonselim.com/increase-your-wordpress-maximum-file-upload-size-limitTwo ways to raise the WordPress upload limit on shared hosting: set upload_max_filesize and post_max_size via .htaccess (php_value) or a php.ini file in the site root.Tue, 24 Mar 2015 00:00:00 GMTWordPressMuhammad Sumon Molla Selimhttps://www.sumonselim.com/installing-php-5-6-apache-2-4-mysql-5-6-elementary-freyahttps://www.sumonselim.com/installing-php-5-6-apache-2-4-mysql-5-6-elementary-freyaInstall a LAMP stack on elementary OS Freya: Apache 2.4, PHP 5.6 and MySQL 5.6 from the ondrej PPAs, then verify with a phpinfo() page.Mon, 27 Oct 2014 00:00:00 GMTPHPMuhammad Sumon Molla Selimhttps://www.sumonselim.com/customizing-terminal-elementary-freyahttps://www.sumonselim.com/customizing-terminal-elementary-freyaSet up a developer terminal on elementary OS Freya: install Guake for an F12 drop-down terminal, oh-my-zsh for a better shell, and screenFetch for system info at startup.Sun, 26 Oct 2014 00:00:00 GMTLinuxMuhammad Sumon Molla Selimhttps://www.sumonselim.com/fixing-date-time-visibility-problem-elementary-os-freyahttps://www.sumonselim.com/fixing-date-time-visibility-problem-elementary-os-freyaDate and time missing from the elementary OS Freya top bar (wingpanel)? Add LC_ALL="en_US.UTF-8" to /etc/environment and restart.Sun, 12 Oct 2014 00:00:00 GMTLinuxMuhammad Sumon Molla Selim