https://deploymill.com/blog Ideas, examples, and the thinking behind an agent-safe control plane for shipping web apps. en-us Sun, 16 Aug 2026 00:00:00 GMT https://deploymill.com/blog/multi-tenant-when-the-tenant-is-an-agent https://deploymill.com/blog/multi-tenant-when-the-tenant-is-an-agent Sun, 16 Aug 2026 00:00:00 GMT Ryan Detzel Engineering Classic multi-tenancy never planned for a tenant that deploys and runs code on purpose, possibly driven by an untrusted prompt. How the threat model shifts when the tenant is an executing agent: VM-grade isolation, default-deny networking, fail-closed authorization, SSRF guards, and an audit trail that makes it all observable. https://deploymill.com/blog/code-an-agent-can-change https://deploymill.com/blog/code-an-agent-can-change Sun, 09 Aug 2026 00:00:00 GMT Ryan Detzel Engineering The primary reader of this codebase isn't a human — it's the agent that edits it. Why a dishonest type is a latent bug rather than a style nit, why small and boring beats clever, and how the rules are CI gates instead of vibes so a machine can touch the code without breaking it. https://deploymill.com/blog/apps-that-sleep https://deploymill.com/blog/apps-that-sleep Sun, 02 Aug 2026 00:00:00 GMT Ryan Detzel Engineering Most apps an agent deploys aren't busy — they should sleep and wake on demand. The hard part isn't the sleeping, it's knowing when an app is truly idle: where the activity signal comes from, the one invariant that keeps a busy app awake, and why the seam made it cheap to build. https://deploymill.com/blog/making-free-safe-to-give-away https://deploymill.com/blog/making-free-safe-to-give-away Sun, 26 Jul 2026 00:00:00 GMT Ryan Detzel Engineering A free tier is a security problem wearing a marketing costume. How the Explore → Builder → Enterprise lineup keeps free contained by design — locked egress at the network layer, no margin-burners — while keeping the one thing that matters open, and lifts the whole envelope from one place the moment a card lands. https://deploymill.com/blog/the-guardrail-that-wasnt https://deploymill.com/blog/the-guardrail-that-wasnt Sun, 19 Jul 2026 00:00:00 GMT Ryan Detzel Engineering I shipped a network security control with a verifier that checked five things, watched all five pass, applied it to prod — and took every app offline in seconds. The script wasn't wrong; it was checking the wrong direction. Why a guardrail that isn't a hard automated check isn't a guardrail. https://deploymill.com/blog/the-migration-that-rewrote-history https://deploymill.com/blog/the-migration-that-rewrote-history Sun, 12 Jul 2026 00:00:00 GMT Ryan Detzel Engineering A user reported a job stuck for days. It wasn't — I'd silently rewritten a live production table with one ordinary line of SQL. How a boot migration that succeeded produced bad data, why ADD COLUMN … DEFAULT is a history rewrite, and the rule that came out of it. https://deploymill.com/blog/deploying-the-deployer https://deploymill.com/blog/deploying-the-deployer Sun, 05 Jul 2026 00:00:00 GMT Ryan Detzel Engineering DeployMill deploys DeployMill — the best test harness I've ever had, with one terrifying failure mode. Why a bug in the self-deploy path is a deadlock you can't deploy your way out of, why the maintenance clock can't be an app, and why I keep the sharp edge anyway. https://deploymill.com/blog/one-file-fix-that-took-down-prod https://deploymill.com/blog/one-file-fix-that-took-down-prod Sun, 28 Jun 2026 00:00:00 GMT Ryan Detzel Engineering A clean one-line fix that passed every test took every host on the platform offline minutes after it shipped. The post-mortem: a self-deploy is only half a deploy, a delete-then-recreate primitive turns a write bug into data loss, and a green mock proves nothing about the real external system. https://deploymill.com/blog/prompt-to-production https://deploymill.com/blog/prompt-to-production Sun, 21 Jun 2026 00:00:00 GMT Ryan Detzel Engineering Tell your agent to ship an app and a minute later there's a real URL backed by a real repo, database, and domain — no dashboard, no wizard. A look at what start_project does underneath, why the build wait is honest, and why a failure is a resumption point, not a dead end. https://deploymill.com/blog/keys-to-production https://deploymill.com/blog/keys-to-production Sat, 06 Jun 2026 00:00:00 GMT Ryan Detzel Vision You don't trust an agent with production by trusting it to be careful — you make careless impossible. A tour of the five guardrails baked into the interface: isolated previews, auto-rollback, diff/plan/apply, an audit trail, and a secret the agent never sees.