Resources.

Config-driven Drupal field access that fails closed for values, JSON:API filters, and Views sorting, while requiring explicit non-administrator role grants for sensitive fields.

A reusable Drupal audit service that detects inserted, deleted, reordered, or edited history through one hash-chained sequence, with optional HMAC signing, encryption, rotation support, and independent Drush verification.

An operating model for AI coding agents: one versioned baseline repository, rules changed by pull request, third-party skills pinned and license-gated in code, and a health check that can actually fail.

How Wilkes & Liberty consolidated the configuration of several AI coding tools into one versioned baseline repository — one reviewed change lands on every machine, and drift announces itself instead of hiding.

AI agent skills are dependencies. Declare them in one reviewed file, pin them to a version, enforce the license gate in code, and check for drift — the same discipline you already apply to packages.

A signed link keeps a file's address secret. It does not check who opens it. Here is why sensitive downloads increasingly ask for a hardware key, and how to add that step without turning every file into a chore.

A signed download link protects the address, not the person who holds it. This paper describes a way to release sensitive files only after the recipient proves they hold a hardware credential — a security key or a PIV or CAC card — and the choices that keep the control real without making the download a chore.

Most teams that gate sensitive files end up with two credential systems: one for logging in, one for downloading. We built the other arrangement — one security key, enrolled once at the identity provider, authorising both — and the build taught us three things worth passing on.

If a download has to be authorised by a security key, something has to check the key. Making your file service a second relying party is one answer; verifying what the identity provider asserts is the other. The second is federation, and it changes what you verify, what you may call it, and how long it stays true.

An AI-attribution policy is a sentence in a contributing guide until something reads the author field. We had the policy, we had the check, and a bot-authored commit still merged clean. What we found fixing it.

A gate that fails on clean work and a security finding nobody can ever clear do the same damage: they teach the people watching to stop watching. Three cases from one week, why volume was never the problem, and the three practices that came out of it.

A secret sent as a query parameter is written to every access log, proxy and trace that sees the request. Rotating it is necessary and insufficient. Why the transport comes first, how to change a protocol without a synchronised cutover, and how to verify the change actually took effect.

Most naming debates deserve five minutes. A few are architectural decisions in disguise. Why an interface name should describe its role rather than the vendor, tenant, host or environment behind it — which names must not be changed, and how to migrate one safely.

Six defects found in one evening on one platform. None crashed. Every deployment reported success, and several had been running that way for weeks. What they had in common, and the three habits that found them.

Tokenization is leaving the pilot lab and meeting the examiners. What compliance-grade digital asset infrastructure actually requires — regulated ledger integration, stablecoin treasury rails, key-management architecture, and sovereign ledger infrastructure — and why the XRP Ledger's design maps to institutional requirements.

Decision-makers don't lack information — they lack the structure that turns the world's signals into their decisions. The anatomy of an intelligence pipeline that fuses, analyzes, and delivers inside your boundary: ingest, fusion, analytics, need-to-know security, and delivery at the cadence leadership actually works in.

Why the organizations with the most to gain from large language models are the least able to send their data to one — and the architecture that resolves the dilemma: private model hosting, retrieval-augmented generation over data that never leaves the boundary, and the governance layer that makes the whole thing defensible.

In one release we fixed three defects on the boundary between a Drupal CMS and its Next.js front end. None of them produced an error. All three were invisible to CI, types, and health checks. This is why that boundary fails quietly, and what we did to make it fail loudly instead.

We found an OAuth service account carrying the administrator role and expected to find a privilege leak. There wasn't one — simple_oauth had been ignoring that role all along. Then we nearly took the site down proving it.

GraphQL rejects a query in its entirety if a single selected field is gone. Rename one Drupal field and every page running that query goes blank at once — while TypeScript, the build, and CI all stay green. Here is the gate we added.

Our preview pipeline validated its token, enabled draft mode, and rendered a node — then served the published version. Every layer reported success. The bug was one line that read a flag and did nothing with it.

Config Split keeps env-specific configuration out of the canonical sync directory, but running drush cex while a split is active deletes the split-owned files from config/sync. The safe model: hand-edit the split's member lists, verify with cim instead of cex, and route per-environment values through settings.php overrides rather than the split.

A git-ignored path repository that symlinks a registry module to a local checkout writes a path dist into composer.lock. Commit that lock and every CI job and image build fails, because the sibling directory only exists on your machine. Relock with the override set aside, and add a CI guard that rejects a path dist.

An interrupted docker compose up leaves an orphaned, hash-prefixed container squatting a service name, so every later deploy fails to recreate it until someone removes it by hand. Adding --remove-orphans (or a pre-clean) lets the deploy heal its own stack instead of failing on state left by a previous run.

On a JSON:API or REST write, Drupal checks field edit-access against the stored value, not the incoming one — so a field-access gate governing what an agent may set sees the wrong value. The right seam is a validation constraint, which runs on the parsed entity and can compare the incoming value against policy across every transport.

How to expose a health endpoint that gives the public a coarse up/degraded roll-up while unlocking full per-service detail only to a server-to-server caller holding a shared secret. Covers constant-time comparison, private caching, fail-closed defaults, and a deploy-order-safe rollout.

A locale rewrite forced onto http: is cross-origin behind an HTTPS proxy, so Next re-issues it as an external request that re-enters the proxy and 301-loops the homepage. It passes every local test because the loop only appears when X-Forwarded-Proto: https is set. The fix: mark the internal rewrite with a per-process secret so canonicalization skips it.

Deleting a Drupal module's code is the easy part. Doing it without breaking your next automated deployment takes a two-phase migration — here's the pattern, and the production incident that taught it to us.

Binding a value into a signature is necessary but not sufficient. If the way you serialize claims before signing is ambiguous, an attacker can reshape a request so a bound claim silently disappears — and the signature still verifies. The pitfall, a concrete example, and the rule that prevents it.

A production-only 500, a green staging run, and a one-line fix: how X-Forwarded-Proto turns a Next.js middleware rewrite into a TLS handshake against a plaintext port — and how to reproduce and prevent it.

The engineering behind File Gate: how a decoupled Drupal 11 platform withholds a private file until a visitor has earned it — deny at the source, deliver through a short-lived signed route, and never leak the storage path.

Private-file delivery for Drupal after a real gate: short-lived signed grants, eight shipped access methods, revocation and usage controls, optional hardware-backed assurance, and a framework-neutral API.

Wilkes & Liberty has open-sourced File Gate, a Drupal module that gates private files for any front end — available now on drupal.org.

We consolidated the content model behind wilkesliberty.com from twelve types to six — in place, preserving every URL. A short take, with a link to the full engineering whitepaper.

A free, open-source Drupal module for hybrid navigation: curate your top-level menu and let each item's children build and maintain themselves from published content, with clean, headless-ready URLs.

Hybrid Drupal navigation for editors and site builders: curate each parent, then reconcile ordinary menu-link children from taxonomy, content bundles, or an ordered node list.

How we collapsed twelve Drupal content types into six on a live headless site — in place, with no downtime, and without losing a single node id, URL, revision, or SEO value.

How we built self-maintaining hybrid navigation for headless Drupal 11 and Next.js: editors curate the top level, children populate themselves from published content, and every URL stays canonical.

Drush-powered TypeScript, GraphQL fragment, and React scaffold generation from Drupal’s live GraphQL Compose schema, with CI drift detection for headless frontend contracts.

Server-side governance for authenticated AI-agent access to Drupal: OAuth-scoped policy profiles, publish gates, redaction and DLP, quotas, approvals, reliable webhooks, and tamper-evident audit evidence.

A secure Node.js Model Context Protocol connector for one or many Drupal sites, with governed content operations, dual JSON:API/GraphQL reads, audits, dry runs, and an optional Drush bridge.

Infrastructure-as-Code makes government environments auditable, reproducible, and rebuildable from the repository — and adopting it does not require a disruptive migration.

A working definition of sovereignty in federal IT — data, operational, and architectural — and the questions that test whether a technology stack actually achieves all three.

Why federal agencies are decoupling Drupal: security isolation for the editorial backend, cleaner USWDS integration, and multi-channel delivery from a single content API.

Wilkes & Liberty's principal engineer contributed platform engineering to pandemicoversight.gov, the PRAC's public accountability site for federal pandemic relief spending, now archived.

A shared Drupal distribution for the USPS Office of Inspector General, designed and built by Wilkes & Liberty's principal engineer so affiliated oversight entities run one maintainable platform.

Principal-engineer contribution to an HHS/CMS headless Drupal modernization spanning editorial workflow, governed content delivery, and frontend performance.