Senior systems and platform engineer with 20+ years modernizing delivery, infrastructure, and developer workflows. I turn complex environments into systems that are safer to change, easier to operate, and easier for the next engineer to understand.
My work crosses systems, security, automation, and AI, but the throughline is operational ownership: clear boundaries, measurable behavior, explicit failure modes, and a path for someone else to run what I built.
I use a 30-agent development fleet as engineering leverage, with scoped ownership and independent review gates. The agents accelerate implementation; architecture, evidence standards, and final judgment remain human responsibilities.
Representative, anonymized work from enterprise engineering environments.
Moved an engineering organization to a new Git organization and GitHub Actions delivery model, then connected Vault JWT authentication, artifact storage, and certificate automation. The durable result was one repeatable path from source to deployment instead of a collection of manual handoffs.
Replaced a legacy Windows Forms workflow with a WPF engineering console for build monitoring, deployment tracking, and documentation search. A retrieval-backed assistant made a large codebase searchable in natural language without displacing the operational controls engineers relied on.
Five projects that show how I reason about boundaries, reliability, security, and operability. Smaller experiments and earlier products, including FreeChat, remain in Side Quests.
JefeOS 1.1.2 and JefeRust 1.0 are released, from-scratch x86_64 kernels in C++ and Rust. Both boot native userspace, provide substantial Linux ABI compatibility, and include custom networking, cryptography, SSH/SFTP, and Xylem membership and failure detection. Rust 1.0 tracks the earlier JefeOS 1.0 baseline rather than the current C++ line, which now adds local service reconciliation and a deterministic-primary stateless singleton failover demonstration. Graphics work remains experimental; production fencing, migration, and replicated state are still open.
A local inference and retrieval platform that gives multiple applications one governed path to models. It combines RAG collections, backend routing with explicit timeouts and fallbacks, experiment tracking, and evaluation tooling so model behavior can be measured instead of guessed.
An automated security-review pipeline built around grounded evidence. Deterministic scans from Semgrep, Trivy, grype, pip-audit, and npm-audit feed structured triage; experimental model-driven sweeps remain separate and require verification. The design choice is to make repeatable findings the operational path instead of treating model output as proof.
A service-oriented secrets broker with scoped service tokens, operator handoff tokens, encrypted storage, rotation and version workflows, policy reporting, and guarded deployment and rollback paths. The emphasis is less on a feature checklist than on making secret handling explicit and reviewable.
A tabletop campaign application with persistent world state, an AI Lore Master workflow, and optional narration and generated scene art. It is also a practical test of where probabilistic generation belongs in a product and where ordinary application state must stay authoritative.
The systems above are products and workloads. Underneath them is a smaller, deliberately conventional infrastructure layer that handles compute, source, delivery, routing, and evidence. That separation lets product experiments move quickly without turning every service into platform infrastructure, while shared operational concerns stay observable and replaceable.
Operate: Linux, Docker, CI/CD, observability, routing, identity, secrets, and recovery.
Build: C++ and Rust systems; Python and TypeScript services; React, FastAPI, and Express applications.
Evidence-backed notes from ongoing engineering work, including the decisions, regressions, and validation behind the finished screenshots.
A small interface to the same professional background summarized above. It is here as a convenience, not as the main event.
Prompts are sent to the JefeAI backend and may be logged. Do not submit sensitive data. Chat history is kept only in this open page.