PRJ-001 · live in production
Auto-Infra — a platform that heals itself
Monitoring signals are deduplicated into a single clear picture of what's actually wrong, then consolidated by a planning layer into sequenced, dependency-aware maintenance plans that respect the ordering real clusters demand — quorum, gateways, and identity services never go down together.
The repair side runs in shadow mode by default: proposed actions are graded against reality, and autonomy is only granted when measured accuracy earns it. The first operator-approved automated repair has already shipped. The same discipline tunes the system itself — noisy signals are fixed at the source, not papered over downstream.
Security is part of the same loop. Auto-Infra continuously scans the environment for known vulnerabilities and drafts the remediation — patch, config change, or version bump — then routes it through the identical approval-gated, shadow-graded path as any other repair. It isn't fully hands-off yet, and we don't pretend it is: the patch-automation is still earning the reliability autonomy demands. But the trajectory is clear — vulnerability management that closes its own loop, with a human on the gate until the numbers say it's earned.
PRJ-002 · active build
An agent brain with its hands tied properly
Most "AI agents" put a language model directly in the action path and hope. Ours inverts that: the LLM proposes, deterministic machinery disposes. Every action passes through typed capability boundaries, pre-flight checks, and approve → execute → rollback semantics. It draws work from the ops loop, reasons over the lab world-model, and attaches a blast-radius estimate to every proposal.
The discipline is the whole point. An agent that can touch real infrastructure earns that privilege through typed boundaries and graded accuracy — never through trust in the model. A design that puts the LLM in the action path can't be patched into safety after the fact, so this one doesn't.
PRJ-003 · boots on hardware
Ophanim — full Docker on a consumer phone
Android ships without the kernel namespaces and cgroup configuration Docker needs, and actively fights you on the rest. I built a custom kernel from source — clang, careful config surgery on a vendor 4.14 tree — then solved the chain the platform throws at you: mount propagation that breaks pivot_root, cgroup layouts dockerd doesn't expect, a libc that lies. The result: dockerd running natively on a flagship phone, serving a containerized HTTP workload.
It's now growing a management layer — an on-device container store, lifecycle manager, and a custom metrics daemon that reads /dev/memcg directly, because Android's stats APIs return zeros. Equal parts systems engineering and stubbornness.
PRJ-004 · proven
Lab World-Model — blast radius in few tokens
AI agents are expensive and slow when they rediscover infrastructure from scratch every time. The world-model is a deterministic dependency graph — every host and service in the environment inventoried automatically from existing monitoring, overlaid with hand-recorded operational hazards — plus a retriever that answers "what breaks if this goes down?" without touching a single host. Proven against the live environment with no privileged access required.
PRJ-005 · design complete
Janus — identity, rebuilt cloud-native
A ground-up replacement for an Active Directory domain: modern SSO and directory (Authentik) plus authoritative DNS (PowerDNS), designed dual-site active-active on Kubernetes so identity survives the loss of either site. The migration is staged with rollback at every step — because identity is the one system you don't get to break. Designed plan-first: the full set of workstreams mapped before a single manifest was applied.
PRJ-006 · live
Secure GPU gateways — private compute, public reach
Hardened single-purpose gateways publish private GPU services to the internet without trusting it — an LLM inference endpoint and a research rig — behind layered authentication, edge access control, and an automated build-and-verify pipeline that won't ship a misconfiguration. The exact construction stays private on purpose: in security, ambiguity is part of the control surface, and a front door is worth less to everyone once its hinges are published.
PRJ-007 · live
Broadcast-grade media engineering
A fully automated media platform: self-healing acquisition pipelines with import watchdogs that keep storage from ever filling, GPU-accelerated transcoding, artwork pipelines, and a faithful recreation of early-2000s cable television — daypart-accurate schedules, era-correct commercial breaks — streamed as live TV. Plus a custom visual discovery app for the "nothing to watch" problem.
PRJ-008 · in production
Maintenance Planner — from chaos to calendar
The bridge between "the system found hundreds of problems" and "here is this month's maintenance calendar." The planner classifies findings per host, decides reboot-then-upgrade versus targeted patching, sequences work so critical services never go down together, and books the windows into a shared calendar. Security findings are just its first input source.
PRJ-009 · you're in it
This website — the stack, demonstrated
Hand-written HTML, CSS, and JavaScript — no framework, no template, no tracker. A custom WebGL background, served by nginx in a container on my own cluster, published through a Cloudflare tunnel with zero inbound ports, deployed from a private GitLab repo via merge request. The contact form reaches me through a small service running on the same cluster. The site is small; the plumbing is the résumé.