Projects

The platform runs on five GKE clusters, about 600 vCPUs. A highly available Argo CD reconciles every cluster from Git, so what runs is always what was reviewed. Kargo promotes signed releases through dev, staging and production, and a Kyverno policy stops automatic promotion into production. Twenty OPA policies check placement and every GitOps change before merge. CI renders each change once, runs nine validation stages and posts one verdict, with a diff of what will change on each cluster. Traffic enters through an API gateway on Envoy Gateway, and Terraform builds the Google Cloud foundation underneath. Terraform went from two laptops with admin credentials to about 36 reviewed changes a week: each stack applies through Workload Identity Federation to a least-privilege identity, production changes wait for a named approver, and the tooling blocks an apply if the approved commit is no longer current. Nobody holds standing production access either. Access runs through GCP Privileged Access Manager with 87 tiered entitlements, a CLI that requests and approves access in seconds, and automation that keeps on-call permissions in line with the rotation, and it passed a NIST 800-171 customer audit. Then I moved production onto it. I turned 22 stalled pull requests into a staged rollout: merge every config dormant, enable one service at a time, snapshot each step for rollback and prove each cutover with a render-versus-live diff tool. All 38 services moved with no code freeze and nine days early, and 50 bespoke CI workflows were retired. The ingestion service, undeployable for four years, cut over in ten minutes. More than 15 engineers now ship through it, and a teammate onboarded 12 services unaided.

Service-owned monitoring across five clusters on Grafana Cloud, with eBPF tracing and no code changes. A CI check renders every alert rule against live metrics and fails the pull request's check when a rule is broken or could never fire.

A workflow that lets coding agents plan and check infrastructure changes while a person does every merge, apply and promotion. An adversary agent tests each plan against deliberately broken changes. It shipped as seven skills and four evaluation suites.

Designed and built in TypeScript on Lambda, S3, SQS and SNS for the Aviation Resiliency Project, with missing-data alerting so it couldn't look healthy while files never arrived.

Atlas joins ticketing history, artist interest, app engagement and on-site behaviour into one profile per attendee, so a festival can see who its best customers are, which artists they came for and how they move around the site. On-site analytics show movement, time spent and where crowds build through the day. Its first paying customer is Sub180's Rolling Meadows festival, with about 10,000 attendees. I built it as one TypeScript monorepo: the back office and REST API on Next.js, Prisma and Postgres, and the attendee app for iOS and Android in Expo and React Native. Lineup changes reach the app only as verified releases, and push notifications go out through Vercel Workflows.

A desktop app and CLI that pulls in my agent history, works out where each session is at, and builds a view of each day: what needs me, an overview, and a section for each piece of work. Everything stays on my machine in a local SQLite archive, and the sources are never changed. Search, a week view, the work still open in each project and Ask, which answers with citations, all read from the same archive.

Built with Next.js and Motion. Posts are MDX files in the repo, so there's no CMS to look after.

Creates the resources GitHub Actions needs to sign in to AWS or Azure with short-lived tokens.

A small Go service for shortening links.

Builds a machine image with Packer and configures the Pritunl VPN server on it with Ansible.