The full write-ups
The Homelab page shows what I've built. These are the deep dives: the problem, the approach, what went wrong, and what each project taught me. All names and internal details generalized: the lessons are the point.
Twenty-nine case studies is a lot. These five are the ones I'd point you to first.
The full five-month arc: a private production cloud, an AI control plane, and every era of the program in one retrospective. Start here.
Read the story →One app's auto-deploy had been frozen for months while its records claimed otherwise: finding it, fixing the class, not just the case.
Read →Built an isolated, credential-free tester that probes an app the way a stranger would, then pointed it at this very site, which surfaced a wide-open chatbot endpoint and photos quietly leaking GPS.
Read →Turning a passive usage logger into the mandatory gateway every app's AI traffic flows through: per-function routing, a central kill switch, cost caps.
Read →Turning app retirement into a nine-phase runbook, including the verification query that caught a wrong-database deletion before it happened.
Read →The full five-month arc: a private production cloud, an AI control plane, and every era of the program in one retrospective. Start here.
Read the story →The evergreen method behind everything else: AI roles at distinct skill tiers (architects, developers, testers, auditors), with me at the top judging outcomes in plain English.
Read the story →Turning a passive usage logger into the mandatory gateway every app's AI traffic flows through: per-function routing, a central kill switch, cost caps.
Read →A three-panel IDE that generates code, reviews diffs hunk by hunk, and commits, plus the credential leak that taught it discipline.
Read →Replacing an opaque off-the-shelf RAG stack with a purpose-built vector-search service: incremental ingestion, local embeddings, measurable quality.
Read →A conversational assistant that reads and acts across the app fleet, with every destructive action gated behind explicit confirmation.
Read →The one service everything depends on was itself unauthenticated: closing that gap live, with zero consumer breakage.
Read →A three-tier approval model, a pre-execution policy hook with its own test suite, and the replay method that caught the gates disagreeing with each other.
Read →Turning a general-purpose coding agent into a fleet-specific operator: skills as executable runbooks, per-task model routing, and a sync daemon that refuses to be clever.
Read →Replacing a pile of Word documents with a searchable spec repository, and the rules that stop an agent inventing facts from it.
Read →Ten agent jobs built, trialled attended, re-run headless, and costed end to end. All ten worth keeping; none on a schedule. That's the finding.
Read →A collector, pricing layer, API, dashboard, and mobile client for usage nothing ever invoices, where the obvious data source held barely a quarter of the history.
Read →Cursor-paginated transaction sync, atomic token exchange, and nightly automation. Bank-data plumbing built end to end.
Read →A repeatable checklist that turned self-hosted web apps into real SwiftUI clients for iPhone, iPad, and Mac from one codebase.
Read →An app that only existed as a chat artifact, tracked down, adopted, and shipped to real standards.
Read →Standing up a self-hosted Notion alternative on a busy production box, and the three non-obvious failure modes caught on the way.
Read →Polish, a real app showcase, privacy hardening, and closing an actual home-network exposure along the way. The site you're reading, in fact.
Read →Replacing per-app manual deploys with a self-hosted CI runner and canonical templates: the whole fleet on one pattern.
Read →From no real backups and a single-point-of-failure credential store to nightly backups, a secrets service, and tested restores.
Read →Relocating monitoring and backups onto dedicated hardware, with history, dashboards, and alerting migrated intact.
Read →The whole app fleet, a database stack, secrets, and CI moved to new hardware as a parallel build, verified before cutover.
Read →Replacing a fragile permissions hack that silently broke deploys for a year with a self-healing, least-privilege model.
Read →One app's auto-deploy had been frozen for months while its records claimed otherwise: finding it, fixing the class, not just the case.
Read →Turning app retirement into a nine-phase runbook, including the verification query that caught a wrong-database deletion before it happened.
Read →A mature backup pipeline that had never actually been restored: the first drill, a bare-metal resurrection, and the drill method that would have lied.
Read →Built an isolated, credential-free tester that probes an app the way a stranger would, then pointed it at this very site, which surfaced a wide-open chatbot endpoint and photos quietly leaking GPS.
Read →Turned an old retired laptop into a dedicated user-tester, fenced so it can reach only the app under test, and in two runs it caught real layout, validation, and error-handling bugs before real users could.
Read →An evidence-driven audit that found the network perimeter quietly doing all the authenticating, then fixed the real gaps and wrote down the accepted risks.
Read →Super-admin, org-admin, and per-item sharing built from scratch across two apps' databases, web frontends, and mobile clients, then a real user click found what no automated check did.
Read →