OldKnowledge,New Vessel.
Essays on on-device AI, data sovereignty, and building systems that keep knowledge where it belongs.
Enter the archive →— 00 / ThesisEvery business runs on knowledge older than its software.
Latest Entries
External Attack Surface Management: Finding the Assets Nobody Owns (2026)
SIM Swap and the Telecom Channel: Designing Authentication That Survives It (2026)
CERT-In Directions in Practice: 6-Hour Reporting and 180-Day Logs as an Architecture (2026)
KV-Cache Side Channels: Cross-Tenant Prompt Leakage in Shared LLM Inference (2026)
Logging Without Leaking: PII, Secrets and the Observability Boundary (2026)
अथ प्रथमोऽध्यायः ॥
विद्या ददाति विनयं विनयाद् याति पात्रताम् ।
पात्रत्वाद्धनमाप्नोति धनाद्धर्मं ततः सुखम् ॥
We digitize centuries-old manuscripts. Then we build with the same discipline.
AppScale's roots are in a quiet project: structuring classical Sanskrit texts into faithful digital form. Extraction, structure, provenance, sovereignty — the same principles now power our client work.
Built for Every Business
Intelligence that never leaves the device
Offline-first, data-sovereign systems — LLMs, vector search, inference at the edge.
02Document IntelligenceAir-gapped document vaults
Sealed, searchable, provable.
03AI ProductsFull-cycle AI product builds
Mobile-first, production-grade.
04MCP & AI SecuritySecuring the agentic stack
Tool poisoning, prompt injection, confused deputies — studied and hardened.
05Indic Language AIOCR for scripts the world forgot
Sovereign OCR for Indic scripts.
06Consulting & Architecture19+ years shipping at scale
OTT, e-commerce & mobility platforms serving millions.
External Attack Surface Management: Finding the Assets Nobody Owns (2026)
EASM is a discovery-to-ownership pipeline, not a scanner: seed, expand, verify, attribute, decide — and default unclaimed assets to decommission before they are exploited.
SIM Swap and the Telecom Channel: Designing Authentication That Survives It (2026)
SIM swap defeats SMS and voice OTP at the carrier, not in your stack. The architecture: demote the number, query carrier SIM-change signals, and tier recovery.
CERT-In Directions in Practice: 6-Hour Reporting and 180-Day Logs as an Architecture (2026)
CERT-In's 6-hour reporting and 180-day India-resident log mandate, read as a specification: instrument the "noticed" event and build a queryable, tamper-evident log tier.
KV-Cache Side Channels: Cross-Tenant Prompt Leakage in Shared LLM Inference (2026)
Shared prefix caches leak prompts across tenants through timing. Why a content-keyed KV cache is an oracle, and how to put the tenant boundary into the cache key.
Logging Without Leaking: PII, Secrets and the Observability Boundary (2026)
Logs are the most-replicated copy of your sensitive data. Redact PII and secrets at emit — not at read — and treat the log pipeline as a DLP export path.
Built-In Browser AI: On-Device Models Behind a Web API (2026)
Chrome now runs an on-device LLM behind web APIs. Treat built-in AI as a detected enhancement with a real fallback — never a hard dependency.
Open Weights vs Closed Models: A Strategy Decision, Not a Values Debate (2026)
Open vs closed AI is not a values debate. It is a per-workload choice of which lever you buy — cost floor, exit cost, or compliance. The move is a portfolio, not a camp.
Credential Stuffing at Scale: Rate Limits Are Not a Defence (2026)
Per-IP rate limits never stop credential stuffing — it is distributed across a proxy botnet. The real defences price the attack: breached-password checks, device signals, passkeys.
Continuous Validation: Breach and Attack Simulation vs the Annual Pentest (2026)
The annual pentest is a photo; breach and attack simulation is the regression test that proves your controls still detect known ATT&CK techniques and catches control drift.
Vision-Language-Action Models: The Robotics Foundation-Model Shift (2026)
VLA foundation models — GR00T, Gemini Robotics, π0.5, OpenVLA — reshaped robotics by 2026. The architecture that matters is not the model but the dual-rate loop around it.
The Predictive-Maintenance Closed Loop: Digital-Twin Architecture From Sensor to Work Order (2026)
Predictive maintenance fails when the loop stays open: a dashboard predicts and nothing happens. The digital-twin architecture from sensor to approved work order to feedback.
Outcome-Based Pricing for Software: The Metering, Attribution and Dispute Architecture (2026)
Outcome-based pricing makes your metering pipeline a system of record for money. How to define the outcome, meter it idempotently, attribute it with evidence, and survive disputes.
Automated Threat Modelling: STRIDE at the Speed of a Sprint (2026)
Threat modelling dies as an annual workshop. The 2026 pattern: a diagram-as-code model that STRIDE-analyses every pull request and fails the build on new risk.
Technical Debt in AI-Generated Codebases: Detection and Containment (2026)
AI-generated code fails as plausibility, not a crash. The 2026 taxonomy of that debt, how to detect it by provenance and churn, and the containment architecture.
DORA for Engineering Teams: Operational Resilience Beyond the Policy Document (2026)
DORA is engineering capabilities with clocks: 4-hour incident notification, a graph-backed provider register, TLPT every 3 years, rehearsed exits, measured restores.
SPIFFE/SPIRE: Workload Identity Without Long-Lived Secrets, and the Attestation Chain That Makes It Real (2026)
SPIRE issues short-lived SVIDs only after node and workload attestation, so no workload stores a secret. Design the chain, keep 1h TTLs, federate across clouds.
Alert Fatigue Is an Architecture Problem, Not a Discipline Problem (2026)
The on-call still gets 400 pages a week after every cleanup because pages fire on causes, not symptoms. The fix is SLO burn-rate alerting, inhibition, and ownership routing.
Signed Images or It Didn't Ship: Sigstore, Attestations, and Admission Gates That Actually Refuse (2026)
"We sign all our images" stops nothing until an admission gate refuses. Identity not keys, SLSA provenance, digest pinning, fail-closed per namespace, and negative tests.
Secret Rotation at Scale: The Architecture Behind "We Rotated Everything" (2026)
After the Drift and Nx token thefts, "rotate everything" took weeks. The architecture that makes it a button: overlap windows, evidence-gated revoke, dynamic credentials.
Data Clean Room Architecture: Privacy-Preserving Collaboration Without Handing Over the Data (2026)
Clean rooms are query policy engines, not storage. How identity matching, analysis rules and privacy budgets let partners compute joins without handing over data.
Bring this thinkingto your business.
conversation
One essay, most weeks. No noise.