🚀
Shipping Software
Understand, judge and change the code agents write for you.
A practical tour of the stack you actually run: Python and FastAPI back ends, React front ends, Azure hosting, research automation pipelines, and the Cloudflare edge. Written for someone who ships a lot of agent-written code and wants to know what it really does, where it breaks, and how to tell good from risky.
Reading code you didn't write
Get your bearings in an unfamiliar repo, read a diff properly, and review what an agent hands you.
- How to read a codebase you didn't write A repeatable route into any unfamiliar repo — manifest, entry point, config, routes, data models, tests — plus the specific smells that tell you the README is lying. ●●○○○ 18 min
- Where does this actually run? Build machine, CI runner, server process, container and edge isolate are five different computers — learn to tell which of your code runs on which, and which bugs come from getting that wrong. ●●●○○ 18 min
- Reading a diff and reviewing a pull request Read hunks and plus/minus lines fluently, know what a diff deliberately hides, review changes in dependency order, and use git log, blame and bisect to find when something broke. ●●●○○ 18 min
- Reviewing agent-written code A concrete checklist for reviewing a pull request an agent wrote: whether it did what you asked, hidden scope creep, invented APIs, swallowed errors, over-broad permissions, tests that assert nothing, and plausible-but-wrong SQL. ●●○○○ 18 min
- Types as documentation How to read Python type hints and TypeScript types as the fastest route into unfamiliar code, what mypy, pyright and tsc really check, why Any and 'as any' are smells, and how Pydantic models act as the contract between a FastAPI back end and a React front end. ●●○○○ 17 min
- Dependencies and lockfiles What a dependency actually is, how version ranges and lockfiles decide which code runs, how to read `requirements.txt`, `pyproject.toml`, `package.json` and `pnpm-lock.yaml`, and how to judge a package an agent added for you. ●●○○○ 18 min
- Debugging without a debugger A systematic method for finding bugs in code you didn't write: reproduce it reliably, narrow the search space, read the traceback properly, bisect by commit or by comment, log deliberately, check the boundaries — and what changes when it only breaks in production. ●●○○○ 18 min
Python & FastAPI back ends
Requests, validation, async, databases, background work, auth and tests.
- The life of a request: from fetch to FastAPI response Follow one request from a React `fetch` through the load balancer, uvicorn, ASGI, middleware, the router and validation to a JSON response — so you can tell from a failure alone which layer killed it. ●●○○○ 17 min
- Pydantic models: the contract at the edge of your API Read and judge Pydantic v2 models — field types, `Field` constraints, `field_validator`, `model_validate` and `model_dump` — and understand why separate request and response models are the thing standing between a database row and a data leak. ●●○○○ 18 min
- async, def and the event loop: how one line freezes the whole API Understand what `async def` really buys you, which ordinary-looking lines block the event loop and take the entire server down with them, and how to run blocking work and concurrent calls correctly. ●●●○○ 18 min
- Dependencies, lifespan and settings Read and judge FastAPI's `Depends` wiring, know what belongs in `lifespan` versus a per-request dependency, load configuration from environment variables with pydantic-settings, and override dependencies cleanly in tests. ●●○○○ 18 min
- Databases and migrations Read SQLAlchemy 2.0 ORM code with confidence, spot N+1 queries and missing indexes, understand transactions and connection pooling, and review an agent's Alembic migration before it destroys data. ●●●○○ 22 min
- Background work and queues Tell the difference between work that can live in a FastAPI request, work that fits BackgroundTasks, and work that needs a real queue and worker — and design the job record your React dashboard polls. ●●●○○ 18 min
- Auth and API security How sign-in actually works in a FastAPI plus React app: sessions versus bearer tokens, what a JWT contains and how to validate one properly against Microsoft Entra ID, dependency guards and role checks, and why CORS is not authentication. ●●●○○ 20 min
- Testing a FastAPI app Read and write pytest tests for an agent-written API: TestClient and httpx's ASGITransport, fixtures, a per-test database that rolls back, dependency overrides, mocking outbound HTTP and LLM calls, and how to read a CI failure. ●●●○○ 20 min
React front ends
Components, state, effects, data fetching, forms and the build step.
- Components, props and state Read a React component tree the way React runs it: props in, JSX out, state as the only thing that makes the screen change. You'll be able to trace where a value comes from, spot mutated state and prop drilling, and judge whether a component an agent wrote is put together sanely. ●●○○○ 18 min
- Hooks and their rules Understand what a hook actually is, why the call-order rules exist rather than being arbitrary style, and which of `useState`, `useRef`, `useMemo`, `useCallback` and `useContext` earns its place. You'll be able to recognise stale closures and read a custom hook for what it hides. ●●●○○ 18 min
- Effects, and when not to use them Learn what `useEffect` is genuinely for — synchronising your component with something outside React — how cleanup and dependency arrays work, why effects run twice in development, and the four cases where an agent reaches for an effect and shouldn't. ●●●○○ 20 min
- Data fetching and caching in React Why hand-rolled useEffect fetching goes wrong, how TanStack Query's cache actually works, and how to build the four states every fetch needs into a research dashboard. ●●○○○ 17 min
- Forms and validation in React Controlled inputs and why big forms re-render, react-hook-form and zod, sharing one schema between the form and your FastAPI types, and putting a server's 422 on the field that caused it. ●●○○○ 18 min
- Rendering and performance What actually triggers a React re-render, why most re-renders cost nothing, how to get list keys right, and when memo, useMemo and useCallback earn their keep — measured with the Profiler rather than guessed at. ●●●○○ 18 min
- TypeScript in React Read and write the types an agent puts on your React components — props, state, events, generics, discriminated unions for request state — and understand why a type on an API response is a promise, not a proof. ●●●○○ 18 min
- Build tooling and environment variables What `vite build` actually does to your React code, how the dev server differs from the production bundle, how `import.meta.env` and the `VITE_` prefix work, why a front-end environment variable can never hold a secret, and what lands in `dist/` on Cloudflare Pages. ●●○○○ 16 min
Azure & deployment
Where your code runs, how it gets there, and how to see what it's doing.
- Azure hosting options: where your code actually runs Tell App Service, Container Apps, Functions, Static Web Apps, AKS and plain VMs apart, understand what scale-to-zero and cold starts really cost you, and work out from the files in a repo which one you're deployed on. ●●○○○ 18 min
- Resources and infrastructure as code Learn the Azure resource model (tenant, subscription, resource group, resource, region, SKU), when to reach for the portal, the `az` CLI or Bicep, why click-ops drifts, and how to read an agent-generated deployment template critically. ●●○○○ 18 min
- Identity and secrets on Azure Understand how app settings, Key Vault and managed identity fit together, read a DefaultAzureCredential failure, assign least-privilege RBAC roles, and know exactly what to do when an agent commits a key. ●●○○○ 18 min
- Choosing Azure data services Pick the right store for research data - Postgres, Blob, queues, Cosmos DB or Redis - and understand the operational edges: firewall rules, private endpoints, connection pooling from a scaled-out app, and backups you have actually restored. ●●●○○ 20 min
- Logging and Application Insights Get useful telemetry out of a FastAPI app on Azure: structured logs, OpenTelemetry instrumentation, the difference between requests, dependencies, traces and exceptions, sampling, correlation ids across services, and enough KQL to answer a real question. ●●●○○ 18 min
- CI/CD and deployments Read and judge a GitHub Actions workflow that tests and deploys to Azure: build versus release, OIDC login instead of stored secrets, environments and approvals, deployment slots and swap, database migrations in a pipeline, rollback, and how to read a failed run. ●●●○○ 18 min
- Scaling and cost Scale out versus scale up, autoscale rules that don't flap, why a scaled-out app breaks in-memory state and connection pools, timeouts and health probes, and how to find the thing quietly costing you the most. ●●●○○ 18 min
Research automation pipelines
Scheduled jobs, retries, LLM steps, data quality and keeping data safe.
- Designing a pipeline that can be re-run Turn a script that worked once into a pipeline: stages with stored state, run records, idempotent writes keyed on natural keys, checkpoints you can resume from, dead-letter handling, and reproducible runs. ●●●○○ 18 min
- Retries, timeouts and backoff Decide which failures deserve a retry, set timeouts at every layer so a run can never hang, use exponential backoff with jitter and a retry budget, respect HTTP 429 and Retry-After, and know when a retry duplicates data. ●●●○○ 18 min
- Scheduling and orchestration: making jobs run when you think they do Read a cron expression correctly on any of your platforms, reason about time zones, overlapping runs and missed runs, choose between a timer trigger, a container job and a real orchestrator, and alert on a job that silently stops. ●●○○○ 18 min
- LLM steps in pipelines: treating a model call as an unreliable, expensive function Wrap a model call so the rest of the pipeline can trust it: schema-validated outputs, pinned prompts and models, caching by input hash, batching, cost and token budgets, retries on malformed output, defences against prompt injection from scraped documents, audit logging and review queues. ●●●○○ 20 min
- Evaluating automated research output Build a gold set of hand-checked examples, measure your pipeline with precision and recall, use an LLM judge without being fooled by it, and catch the pipeline that quietly gets worse. ●●●○○ 18 min
- Data quality and validation Validate data at the boundary with Pydantic and dataframe checks, spot schema drift from a supplier feed, handle nulls, duplicates, units and encodings, reconcile counts, and fail loudly instead of writing bad rows. ●●●○○ 18 min
- Privacy and secrets in a research pipeline An engineering primer, not legal advice: what counts as personal data, the UK GDPR ideas that change your code, pseudonymisation versus anonymisation, sending data to third-party APIs, encryption, access control, audit trails, secrets hygiene and what to do in the first hour of a breach. ●●●○○ 20 min
The Cloudflare edge
Pages, Workers, D1, KV and R2 — and when the edge is the wrong place.
- Cloudflare Pages and static sites What a static site actually is and why it costs almost nothing to serve, the difference between Git-built and `wrangler pages deploy` projects, how preview and production deployments work, custom domains, `_headers` and `_redirects`, SPA fallback routing, instant rollbacks, and why your site can look stale for minutes after a deploy. ●●○○○ 18 min
- Workers and the edge runtime What a Worker really is — a V8 isolate, not a Node process — how the fetch handler works, which Node APIs are missing and what `nodejs_compat` does about it, the CPU-time and subrequest limits, why bindings are the only way to reach storage, how Pages Functions differ from standalone Workers, and how to debug with `wrangler dev` and `wrangler tail`. ●●●○○ 20 min
- D1: SQLite at the edge Read and judge Worker code that talks to a D1 database — bindings, bound parameters, batches, migrations, indexes — and know when your 10 GB single-threaded SQLite database is the wrong tool. ●●●○○ 18 min
- Choosing KV, D1, R2, Durable Objects or Hyperdrive A decision guide for Cloudflare's five storage products, so you can tell whether the store an agent picked matches the consistency, size and cost shape of your data — and spot the classic mismatches. ●●●○○ 17 min
- Caching and headers: why you still see the old site Read and set Cache-Control with confidence, understand ETags and 304s, know the difference between the browser cache and the Cloudflare edge, and diagnose a deploy that looks like it never happened. ●●○○○ 17 min
- Secrets, environments and bindings Read a wrangler config an agent generated and know what every block does, tell bindings from variables from secrets, keep preview and production values apart, and rotate a key you have leaked. ●●●○○ 18 min
- Edge or cloud: choosing where a job runs Decide, with reasons you can defend, whether a piece of work belongs on the Cloudflare edge or on an Azure App Service or Container App — and how to split one system across both. ●●●○○ 19 min