Selected write-ups
The Homelab page shows what I've built. These are the deep dives: the problem, the approach, what went wrong, and what each project taught me. Below them is every other project I've worked through. All names and internal details generalized: the lessons are the point.
The full five-month arc: a private production cloud, an AI control plane, and every era of the program in one retrospective. Start here.
Read the story →Turning a passive usage logger into the mandatory gateway every app's AI traffic flows through: per-function routing, a central kill switch, cost caps.
Read →A three-tier approval model, a pre-execution policy hook with its own test suite, and the replay method that caught the gates disagreeing with each other.
Read →Built an isolated, credential-free tester that probes an app the way a stranger would, then pointed it at this very site, which surfaced a wide-open chatbot endpoint and photos quietly leaking GPS.
Read →The whole app fleet, a database stack, secrets, and CI moved to new hardware as a parallel build, verified before cutover.
Read →One app's auto-deploy had been frozen for months while its records claimed otherwise: finding it, fixing the class, not just the case.
Read →The ones above are the best examples of how I approach a complex technical problem. Here's a broader sample of what else I've worked through, summarized. Happy to talk through any of them.
I replaced a fleet with no backups and one point-of-failure credential store with restore-tested nightly backups and a self-hosted password manager.
I replaced manual SSH deploys with a self-hosted CI runner, so pushing code automatically syncs and restarts each app across the whole fleet.
I replaced a fragile email-parsing data source with a real bank integration: idempotent transaction syncing, atomic multi-table writes, and a net-worth engine, built sandbox-first.
I built an AI assistant that reads and acts across my apps, with every destructive action gated behind explicit confirmation, then fixed a rare startup bug only it could trigger.
I deployed a multi-container self-hosted app onto a busy production system without touching its existing shared database, catching three non-obvious failure modes along the way.
I turned app retirement into a repeatable runbook used across a dozen-plus apps, once catching a documentation error that would have deleted the wrong app's data.
I built a self-hosted AI coding tool that generates code, reviews diffs, and commits under its own bot identity, then turned a real credential leak into a lasting rule.
I built a repeatable methodology for turning self-hosted web apps into native iOS apps, and each rebuild doubled as an audit that caught real bugs in the web version.
I replaced an opaque off-the-shelf retrieval stack with a purpose-built service of my own, with a clean authenticated interface a second app could consume without any rework.
The gateway every app's AI traffic routes through was missing authentication on its most sensitive surface. I locked it down and closed two leaks without breaking a single consumer.
A fleet-wide security audit found a strong network perimeter had quietly become the only thing authenticating several backends. I closed the gaps and turned the findings into an enforced rule.
I tracked down an app I remembered building but couldn't find anywhere, proved it had only ever existed as a chat artifact, then rebuilt and deployed it to production standards.
I moved a production system's monitoring and backup stack onto its own dedicated hardware, migrating every tool's data so dashboards, history, and logins all survived intact.
I replaced a fragile world-writable permissions hack, which had silently broken automated deploys for over a year, with a self-healing permissions model, piloted on one app before rolling it fleet-wide.
I designed a three-tier permission model, super-admin, org-admin, and per-item sharing, from scratch across two apps' databases, frontends, and mobile clients, then promoted both to production the next day.
I took my portfolio site from a private dev version to genuinely launch-ready, with polish, accessibility and privacy hardening, and closed one real exposure it uncovered along the way.
Backups only prove themselves once restored. I ran real restore drills across the fleet, including a full rebuild on a retired machine, to confirm recovery actually works.
I built the site's chatbot on the assumption that anything it is told is effectively public. Its knowledge is limited to what the site already publishes, so the design never depends on the prompt staying secret.
I built a pipeline that prices my AI coding usage even though the flat-rate subscription never bills for it, recovering months of history and pricing all of it.
I built the layer that turns a general AI coding agent into a fleet-specific one: repeatable context, scoped permissions, and governance patterns, all version-controlled.
I built a markdown documentation repository as the single source of facts for my infrastructure, maintained entirely by AI coding agents and checked against reality rather than trusted by default.
I designed and trialled thirteen candidate autonomous AI jobs, measuring cost and reliability on each. Ten were worth keeping, and I still chose not to put any of them on a schedule. Deciding that deliberately, on evidence, was the real result.
I split one flat AI-agent workspace into six separate organizations, each with its own crew and configuration, so unrelated work stops sharing context by default.
I turned a retired laptop into a dedicated user-tester that logs into my apps with a throwaway account and drives them like a real person. It found bugs code review missed, fixed the same day.
The case studies above are a fair sample of how I work a technical problem, not the whole list. There's a lot more behind them across infrastructure, AI, security, automation, and application development. If any of it lines up with what you're building, or with the role you're hiring for, I'd be glad to talk you through the problem, the approach, the tradeoffs I made, and what I'd do differently next time.