Engineering Noteshttps://akibullah.github.io/engineering-notes/Deep dives into the design decisions, trade-offs and tests behind my open-source backend projects: payments, queues, rate limiting, auth, retrieval and agents.enSun, 25 Oct 2026 09:00:00 +0000Running webhook workers in parallel without double deliveryhttps://akibullah.github.io/engineering-notes/posts/parallel-webhook-workers-skip-locked/https://akibullah.github.io/engineering-notes/posts/parallel-webhook-workers-skip-locked/Sun, 25 Oct 2026 09:00:00 +0000How webhook-relay lets several workers share one PostgreSQL queue with FOR UPDATE SKIP LOCKED, claim leases and crash recovery, and the test that fails the moment the lock is removed.postgresqldistributed-systemspythonreliabilityMeasuring retrieval instead of guessinghttps://akibullah.github.io/engineering-notes/posts/measuring-rag-retrieval/https://akibullah.github.io/engineering-notes/posts/measuring-rag-retrieval/Sun, 25 Oct 2026 09:00:00 +0000What rag-eval-lab learned by scoring three chunkers against four retrievers on a bilingual English and Bangla help centre, how evidence spans make the comparison fair, and where the numbers should not be trusted.raginformation-retrievalevaluationbanglaGuardrails that don't trust the modelhttps://akibullah.github.io/engineering-notes/posts/guardrails-that-dont-trust-the-model/https://akibullah.github.io/engineering-notes/posts/guardrails-that-dont-trust-the-model/Sun, 25 Oct 2026 09:00:00 +0000How ai-support-agent lets a language model call refund and address tools without letting it authorise anything, and the ablation run where 46 of 53 scenarios still pass with the soft guardrails off and no money moves.ai-agentsllmsecurityevalsFive rate-limiting algorithms, one Lua script eachhttps://akibullah.github.io/engineering-notes/posts/five-rate-limiting-algorithms/https://akibullah.github.io/engineering-notes/posts/five-rate-limiting-algorithms/Sun, 25 Oct 2026 09:00:00 +0000Token bucket, fixed window, sliding log, sliding window counter and GCRA side by side in rate-limiter-service, why every Redis step is a single Lua script, and what the benchmark table actually tells you.redisrate-limitingalgorithmspythonIdempotency keys done properly in a payment APIhttps://akibullah.github.io/engineering-notes/posts/idempotency-keys-payment-gateway/https://akibullah.github.io/engineering-notes/posts/idempotency-keys-payment-gateway/Sun, 25 Oct 2026 09:00:00 +0000Replaying stored responses, rejecting a reused key with a different body, committing the receipt with the charge, plus the state machine and integer money that make retries safe in fastapi-payment-gateway.paymentsfastapiidempotencyfintechRefresh-token rotation with reuse detection, and tenancy in one dependencyhttps://akibullah.github.io/engineering-notes/posts/refresh-token-rotation-tenant-isolation/https://akibullah.github.io/engineering-notes/posts/refresh-token-rotation-tenant-isolation/Sun, 25 Oct 2026 09:00:00 +0000How multi-tenant-saas-auth rotates refresh tokens in families so a replayed token logs out the thief and nobody else, and how one FastAPI dependency answers "which tenant, with what permissions" for every route.authenticationsecurityfastapimulti-tenancy