Lukáš Henderson
CZEN
Contact

The machine

Ten stations from a keystroke on my laptop to a watched production, across three servers: dev/CI, production and web.

Track diagram of the ten stations. A job runs from the operator through admission, the hive and the airlock to the gateway, Deployik and Watch; a production error loops back to an agent.LaptopDevulinka runnersTrust boundaryBlue-green swap1Operator2Agent3Devbox4Admission5Hive6Semafor7Airlock8Gateway9Deployik10WatchYour jobOther jobsStopClearBack to an agent
  • Your job
  • Stop
  • Clear
  • Back to an agent

  1. Operator

    Pultík and claude-switcheroo

    Pultík puts every product, pipeline and server one keystroke away. claude-switcheroo accounts for every AI token and hour.

    • ⌥ Space opens Pultík

  2. Agent

    Výbava in a worktree

    A git worktree on the laptop, running Výbava. Credentials never leave the laptop; the guard rails hold even when the agent has every permission.

    • 38 guard rails

  3. Devbox

    A stack per branch

    Each branch gets its own full stack on a dev VM, and idle ones park.

    • 48-vCPU dev VM
    • Back from parked in about 16 s

  4. Admission

    The priority queue

    One priority queue across the repositories; every waiting job climbs a tier as it waits.

    • 19 repositories
    • Up a tier every 5 min

  5. The hive

    firefly-vm

    One hot VM, a throwaway container per job, warm caches. Median wait about 5 s on the busiest days, down from about 22 s.

    • About 1,100 jobs a day
    • 2,064 at peak
    • 80 vCPU
    • 32 slots

  6. Semafor

    The witness

    It only observes. Every job leaves a record and every refusal has a reason. Memory is sized from measured peaks.

    • Idea to production in one day

  7. The airlock

    bastion-vm

    Deploys never run in the hive. Each boots its own disposable VM from a signature-verified image: no keys, no mounts, no VPN.

    • 2 trust zones

  8. Deploy gateway

    Holds the keys

    It holds the keys, runs only whitelisted verbs and writes the audit log first. An unauditable action does not run.

    • 15 deploy targets

  9. Deployik

    One Go binary

    Self-hosted, Vercel-like one-click deploys: blue-green swaps, automatic TLS, a preview URL for every branch.

    • 47 apps
    • 30 production environments

  10. Watch

    And back to an agent

    Self-hosted Sentry and encrypted backups with restore tests. A production error goes straight back to an agent, and the loop starts again.

    • 207 Prometheus + 23 Loki alert rules
    • 20 dashboards
Runs on
3 servers: dev/CI, production and web
Lanes
41 defined, 39 live
Figures
As of September 2026

Why build a machine

Four products and a fleet of coding agents only work together if every change takes the same safe road to production. The machine is that road, and the products I run ship on it.

Two trust zones

Ordinary CI runs in the hive: one hot VM, a throwaway container per job. Anything that can touch production leaves it. Deploys boot their own disposable VM from a signature-verified image, with no keys, no mounts and no VPN, and ask a gateway that holds the keys, runs only whitelisted verbs and writes its audit log first.

Measured, not guessed

Semafor records every job and every refusal. Memory reservations come from measured peaks rather than guesses — lanes that reserved 32 GiB turned out to peak below 10. The queue wait on the busiest days dropped to a median of about 5 seconds.

Configuration from git

Two of the three servers converge from git every two minutes, and any hand edit is held and raises an alert. The lanes are generated from one manifest: 41 defined, 39 live.

What you get from it

Your app gets the same discipline: a stack for every branch, previews for every change, isolated deploys and a watch that sends errors straight back to be fixed. I can run it for you, or build the same road inside your company.

Tell me what you need: an app built, a team trained, or agents put into production.

ContactAll tools