Hello, I’m Mathias 👋
Hi! This is where I share my thoughts and notes on everything I’m passionate about and working on right now.
I’d love to connect with like-minded people.
Check out my latest blog posts below!
Interconnecting carrier SIP trunks and enterprise IPBXs looks simple on paper. In practice, it is one of the most expensive friction points in a VoIP infrastructure: you have to secure the IPBX exposed to the Internet, juggle several operators in parallel, fail over when one goes down, normalise routing — all without blowing the budget on a closed, opaque proprietary SBC.
PK-SBC is an open source answer to that problem. A Session Border Controller built on Kamailio, RTP Engine, Redis and PostgreSQL, designed along the KISS principle — Keep It Simple, Stupid — and battle-tested in production since 2012.
A synthesis of Mario Zechner's ideas on coding agents. Why the minimalism of the Pi agent, coupled with strict context engineering and CLI tools, often beats heavy frameworks.
A test suite can show good coverage and miss an obvious bug. To measure real quality, I look at four complementary axes, with a simple audit to apply to an existing project.
Two releases on the same day, twenty minutes apart: v1.0.1 then v1.0.2. Both do the same job — harden pi-secured-setup itself. This is a short post to explain what changed and why it matters, because a security tool that ships its own vulnerabilities loses all credibility.
If you’re new to the project, the introductory article covers the basics: Guards, Scanners, the audit trail.
v1.0.1 — the quality pass#
Three threads:
Once the spec is in place, I split the work between humans, AI, and deterministic tools. The critical test does not always come from the same author as the code, and the critic-agent often matters more than the writer-agent.
The first step in the AI workflow is specification. This article shows how I turn a vague user story into something a human and an agent can use without guessing, with Gherkin, typed examples, and properties.
A Markdown knowledge base built to last several years, with an AI agent and vector search. Seven design choices are documented along with their costs.
The implicit promise of AI coding assistants was that tests would become a thing of the past. The reality documented by Kent Beck, ThoughtWorks, and several 2025 studies is the opposite: with AI, tests become essential — but the work has shifted.
pi in YOLO mode gives you full filesystem access, unrestricted command execution, zero guardrails. The creator made that choice deliberately. But when your project contains .env files, SSH keys, or a production.yaml, that choice puts you at risk.
I covered pi-secured-setup a few days ago. Guards, Scanners, audit trail, wired into the agent. Since then I looked at another extension: pi-permission-system by MasuRii. Both secure pi. Not the same way.
In the previous article, I introduced pi-secured-setup — a pi extension that adds Guards, Scanners, and an audit trail to your AI coding agent. It ships with sensible defaults: boundary enforcement, protected path globbing, bash command classification, secret redaction, skill verification.
But every project has unique risks. A Terraform shop needs different rules than a Node.js monorepo. A team with strict compliance requirements needs different audit granularity than a solo developer.
