iPucu Lab · Blog

Deep technical articles and platform announcements

Topics we meet in the field, grounded in official documentation and explained with practical examples.

The architecture and AI journey

A route ordered from easier to harder. Every article is a level; the path lights up as you read.

Chapter 1FoundationsDependencies, lifetimes and shared state

01You are hereiOS + Android22 min readShould you really delete every singleton?What hurts in large iOS and Android codebases is hidden access and global mutable state; having exactly one instance of something hurts nobody. Which singletons stay, which get scoped to the session and which go, step by step with Swift 6 and Hilt.02You are hereiOS20 min readDependency injection done wrong: DI container anti-patterns on iOSAdding a DI container to a project does not mean you inject dependencies. We cover resolve calls that turn into a service locator, registrations that crash on the screen QA never opened, the god container and SwiftUI environment traps, then the composition root we use instead and the migration.03You are hereAndroid19 min readDependency injection done wrong: DI container anti-patterns on AndroidHaving Hilt or Koin installed does not mean your dependencies are managed. How graphs where everything is @Singleton, service locators in disguise and the 80-@Provides AppModule come to exist, and how to clean them up step by step.04You are hereiOS + Android20 min readWhy global state objects like BookingFlowContext are dangerousThe context bag with thirty optionals that every screen in a multi-step flow reads and writes is a convenience on day one and a crash source by year three. What it breaks, why making it observable does not help, and the typed input, output and state machine model we use instead, in Swift and Kotlin.

Chapter 2BoundariesWhere do we cut the code and the domains?

05You are hereiOS + Android20 min readFeature-based architecture vs layer-based architectureShould the top-level slice of your codebase be the technical layer or the feature? How layer-first projects age, what feature-first really costs, the structure we recommend at scale, and a migration that moves one feature at a time, with iOS and Android examples.06You are hereiOS + Android21 min readHow do you decide where a domain boundary goes?Before you modularize, you have to decide where one domain ends and the next begins. We walk through cutting along language, co-changing code and data ownership instead of screens or endpoints, using a hypothetical travel booking app.07You are hereiOS + Android19 min readShared models or domain-specific models?The sixty-field `Booking` that every feature imports couples the whole app, even when the module graph looks clean. Feature-owned models, boring mappers, a small shared kernel and a way to split a god-model one consumer at a time, in Swift and Kotlin.

Chapter 3ModulesThe dependency graph, cycles and enforcing the rules

08You are hereiOS + Android20 min readThe real cost of modularization: when should you not modularize?Modularization is sold as free, and the bill arrives later. Build configuration per module, interface modules that double the count, launch time, Gradle configuration time, and boundaries frozen in the wrong place. Here is when we advise against splitting, and what to measure before you decide.09You are hereiOS19 min readHow to prevent circular dependencies in large iOS projectsSwiftPM and Xcode already refuse a module cycle. The real damage is how the cycle comes back, as a bloated Common module or a monolith nobody can split. Five techniques, which one fits which cause, and a CI script that fails the build on a forbidden edge.10You are hereiOS22 min readManaging the compile-time dependency graph: iOSYou split the app into 60 modules and one line in Core still rebuilds everything. How Swift decides what to recompile, access levels on imports, interface modules, and a repeatable way to find the hot spots in your own graph.11You are hereAndroid18 min readManaging the compile-time dependency graph: AndroidIf the project you split into forty modules still takes minutes to rebuild after a one-line change, look at the shape of the graph. We cover api versus implementation in Gradle, the api/impl module split, the things that leak unnoticed, and how to measure the gain.12You are hereiOS21 min readMaking the compiler enforce your architecture dependency rules: iOSA dependency rule that lives in a wiki is already broken. We move it into Package.swift, access control, a CI script and Swift 6 isolation so that it fails the build, and we show the gap where SwiftPM quietly downgrades a violation to a warning.13You are hereAndroid21 min readMaking the compiler enforce your architecture dependency rules: AndroidA dependency rule that lives in a wiki page or a code review comment is already broken. We turn the rules into checks that fail the build, using Gradle module boundaries, convention plugins, explicitApi, module graph assertions, Konsist, ArchUnit, detekt and dependency guards.

Chapter 4ScaleTooling for 100+ modules and large organizations

14You are hereiOS18 min readTuist / SPM / XcodeProj: which one for a large organization?A decision article for teams of 20 to 200 iOS engineers. Hand-maintained .xcodeproj, a thin project plus local Swift packages, project generation with Tuist or XcodeGen, and Bazel. What we pick in which situation, with a migration path you can reverse.15You are hereiOS22 min readA 100+ module iOS architecture on Swift Package ManagerA hundred modules on local Swift packages is workable if you write the manifest as code instead of data. One package or many, linking traps, the real cost of macros, and a CI script that runs only the affected tests, end to end.

Chapter 5SecurityProtecting the client and the traffic

16You are hereiOS + Android27 min readSSL pinning: when you need it, how to do it right, how it gets bypassedPinning shrinks the set of CAs you trust from hundreds of roots to a few keys, and in exchange ties your certificate calendar to your app releases. Correct setup on iOS and Android, a rotation runbook, telemetry, testing, and how pentesters get past it.17You are hereiOS + Android23 min readApp Attest and Play Integrity: an end-to-end guide to stopping fake clientsYour API doesn't know who it's talking to. From threat model to data model, from Swift and Kotlin client code to server-side verification in TypeScript, from the decision matrix to a staged rollout, this is how we set up App Attest and Play Integrity in production, step by step.

Chapter 6AIAI-assisted delivery, automation and governance

18You are hereGeneral19 min readBuying code assistant seats is not a transformation: building an AI-assisted SDLC step by stepSeats change how fast individuals type. They leave the way a team delivers untouched. Here is how we build an AI-assisted SDLC in phases, with shared instruction files, commands kept in the repo, a PR template, a CI step and written working agreements.19You are hereGeneral21 min readAI code review: what gets caught before the human review, and what does notOnce a team writes more code with AI, the review queue is the first thing to clog. What an AI pre-review reliably catches in the mechanical layer, what it misses, the instruction file, the CI wiring, noise control and the work left for humans, with Swift and Kotlin examples.20You are hereiOS + Android25 min readRunning AI agents in a large iOS/Android codebase: project rules, context and limitsCoding agents shine in a small repo and stumble in a 100-module mobile app, and the difference is mostly how ready the repo is. Single-module build and test commands, per-module rule files, bounded context and the permissions you withhold, end to end.21You are hereiOS + Android23 min readKeeping AI-written code from eroding your architecture: enforce the rules on agents tooAn agent optimises for the task passing, and your architecture is not part of that goal. Any rule the build does not enforce gets broken faster and more politely than a human would manage. Here is the guardrail stack we use, and how we protect the guardrails themselves.22You are hereiOS + Android25 min readAI-generated tests: coverage goes up, but does confidence?An agent can double your coverage in an afternoon, yet most generated tests make the code vouch for itself and can never go red. With Swift and Kotlin examples, we show what to ask for, what to reject, and how to tell whether confidence actually improved.23You are hereGeneral25 min readMeasuring AI productivity: turning 'we feel faster' into numbersThe team says it is faster, the budget owner wants a number, and the vendor dashboard shows acceptance rate. Which metrics mislead, which hold up, how to pull the data from your own Git host, and how to report to leadership without overselling.24You are hereGeneral24 min readYour first production automation with n8n: form, classification, CRM, Slack (end to end)We take an n8n workflow that classifies website contact form submissions with an LLM, writes them to a CRM and announces them in Slack, and move it from demo grade to production grade. Webhook or queue pull, idempotent writes, an error workflow, dead-letter storage, testing and a runbook included.25You are hereGeneral23 min readMaking AI steps reliable in n8n: error handling, human approval, cost limitsThe LLM step that worked in the demo will drift off schema, obey injected instructions and inflate the bill under real traffic. We build the output contract, approval step, dead-letter store, idempotency and daily budget gate in n8n 2.x, with node settings and code.26You are hereGeneral23 min readBuilding an internal knowledge assistant: when RAG is enough and when it is notAn assistant that knows our docs usually disappoints in three ways: confident wrong answers, stale answers, and answers that leak what the asker should never see. An end-to-end guide, from collecting questions to permissions, freshness and evaluation.27You are hereiOS + Android23 min readAdding an LLM feature to a mobile app: on device or on the server?Define the feature before you pick a model. Using a travel app, we walk through the decision axes (quality, latency, cost, privacy, device coverage), the gateway that keeps the key, streaming clients in Swift and Kotlin, hybrid fallbacks to on-device models, and a decision table by feature type.28You are hereiOS + Android27 min readOn-device models on iOS and Android: what is possible today?Foundation Models, Core ML and Core AI on one side; Gemini Nano, ML Kit GenAI, LiteRT and Play for On-device AI on the other. As of October 2026, which API runs on which devices and languages, where it falls short, and what your app does when the model is missing, with code.29You are hereGeneral25 min readAn AI usage policy for your company: where can code, data and customer information go?If you have no policy you still have one, written separately by every developer. We cover what really differs between tools from a data point of view, a classification engineers can apply in ten seconds, rules for code and customer data, technical enforcement, and a one-page template you can adapt.