Engineering notes
The design decisions behind Keenrig, written in enough detail that you can argue with them.
Designing a cloud disconnect switch people dare to press
The right to leave only means something if it breaks nothing. This is the preflight, the honest list of what you actually lose, and how to come back.
Pin the digest, never the latest tag
Every manifest in the Keenrig catalog pins a specific digest and is Ed25519-signed. Here is why, and why "just use the latest tag" is a slow-acting trap.
Why local is the source of truth, not the cloud
Keenrig's first architectural principle: the instance holds all state required to operate, and the cloud is an optional layer on top. Here is what that choice costs as well as what it buys.