I build delivery platforms, operating systems, and tools that help engineers understand the systems they run.
Enterprise infrastructure is my day job. Independent systems projects are where I explore the rest of the stack.
I care about what happens after the first successful demo: how a system fails, how someone diagnoses it, and whether the next engineer can safely change it.
The work below connects those questions across enterprise infrastructure and independent projects. The notes include the decisions, tests, and unfinished parts.
Representative, anonymized work from enterprise engineering environments.
Moved an engineering organization to a new Git organization and GitHub Actions delivery model, then connected Vault JWT authentication, artifact storage, and certificate automation. The durable result was one repeatable path from source to deployment instead of a collection of manual handoffs.
Replaced a legacy Windows Forms workflow with a WPF engineering console for build monitoring, deployment tracking, and documentation search. A retrieval-backed assistant made a large codebase searchable in natural language without displacing the operational controls engineers relied on.
Operating systems, shared services, and applications. Different problems; the same interest in how the pieces actually work. Smaller experiments live in Side Quests.
Two from-scratch x86_64 kernels — one C++, one Rust — that boot to a real userspace and run real Linux programs through a WSL1-style syscall layer: a staged Alpine/BusyBox rootfs, plus interactive SSH/SFTP sessions from stock clients like PuTTY. Each carries its own TCP/IP stack, TLS 1.3, ChaCha20-Poly1305 and Ed25519 crypto, NTFS read/write, an ELF64 loader with ring-3 execution, and a preemptive scheduler. Xylem adds in-kernel clustering — node membership, failure detection, and automatic workload harvest and respawn behind a self-rearming circuit breaker. JefeOS 1.2 is in release hardening now: SMEP/SMAP and signal-path hardening, POSIX permission-mode enforcement, and a machine-scored evidence pipeline (independent clean build, ephemeral-QEMU boot proof, fault-injection recovery). The Rust kernel tracks the C++ line at feature parity.
A local inference and retrieval platform that gives multiple applications one governed path to models. It combines RAG collections, backend routing with explicit timeouts and fallbacks, experiment tracking, and evaluation tooling so model behavior can be measured instead of guessed.
An automated security-review pipeline built around grounded evidence. Deterministic scans from Semgrep, Trivy, grype, pip-audit, and npm-audit feed structured triage; experimental model-driven sweeps remain separate and require verification. The design choice is to make repeatable findings the operational path instead of treating model output as proof.
A service-oriented secrets broker with scoped service tokens, operator handoff tokens, encrypted storage, rotation and version workflows, policy reporting, and guarded deployment and rollback paths. The emphasis is less on a feature checklist than on making secret handling explicit and reviewable.
A tabletop campaign application with persistent world state, an AI Lore Master workflow, and optional narration and generated scene art. It is also a practical test of where probabilistic generation belongs in a product and where ordinary application state must stay authoritative.
The systems above are products and workloads. Underneath them is a smaller, deliberately conventional infrastructure layer that handles compute, source, delivery, routing, and evidence. That separation lets product experiments move quickly without turning every service into platform infrastructure, while shared operational concerns stay observable and replaceable.
Operate: Linux, Docker, CI/CD, observability, routing, identity, secrets, and recovery.
Build: C++ and Rust systems; Python and TypeScript services; React, FastAPI, and Express applications.
Evidence-backed notes from ongoing engineering work, including the decisions, regressions, and validation behind the finished screenshots.
A small interface to the same professional background summarized above. It is here as a convenience, not as the main event.
Prompts are sent to the JefeAI backend and may be logged. Do not submit sensitive data. Chat history is kept only in this open page.
For engineering roles, platform work, or a conversation about something you read here.