Portfolio
Case studies and technical work showcasing real-world solutions and measurable impact.
Highlights
Quick wins and notable shipped work at a glance.
Aardvark: A Published CSV-Wrangling CLI
A zero-dependency Python CLI that filters and sorts CSV data by column, splitting matched and unmatched rows into separate files. Published to PyPI.
DealerClick.com: An Astro Islands Marketing Site
A fast, SEO-first marketing site on Astro 5 with React islands — static HTML by default, JSON-LD structured data, and an oklch theme with dark mode.
Gratia Sapientia: A Formation Engine with Real Math
A personal-formation PWA that gamifies daily practice and classical study with real math — exponential grace decay and linear mastery leveling across the seven liberal arts.
Case Studies
Deep dives: problem, decisions, execution, and measured impact.
AI/CD: Production-Grade Autonomous Developer Agent (Human-in-the-Loop)
A human-in-the-loop agent that converts well-scoped GitHub issues into production-ready PRs via a 5-stage pipeline — multi-tenant SaaS with Postgres RLS and full observability.
Building a Production-Ready Loan Origination System Integration
Real-time loan-application processing for auto dealerships in Go + Postgres JSONB with two-stage webhooks — 83% faster submissions, 98% fewer errors, 99.7% callback success.
Building an AI-Powered Multi-Tenant Admin Platform from Zero
A production multi-tenant dealer CMS with AI features, built solo in 2-3 months and serving 200+ dealerships with full self-service.
Corpus Mio: An Offline-First Nutrition PWA
An offline-first nutrition PWA — USDA food data, barcode lookup, and Claude-generated recipes over a 16-table Postgres schema with an IndexedDB sync engine.
Dealer Website Platform Rebuild: Basic Inventory to Full SaaS
A solo Next.js 14 rebuild that turned basic dealer inventory sites into a premium B2B SaaS — AI chat, blog CMS, location SEO, credit prequalification, and dealer tools.
Porch: A Self-Hosted, Multi-Cloud Social Platform
A private, invite-only social platform (Go + Next.js) that self-hosts from one command — passwordless auth, FFmpeg transcoding, MinIO, and Caddy auto-TLS, live on Hetzner.
Systems Engineering
Backend systems, services, and performance work.
Antialgo: An Offline-First, Privacy-First Media Library
A self-hosted media library built local-first — browser state by default with optional Postgres sync, no tracking and no recommendation algorithms.
Database-Enforced Multi-Tenant Isolation with Postgres RLS
A reference implementation that moves tenant isolation into the database with PostgreSQL RLS — fail-closed policies, 28 integration tests, ~8.45% overhead.
Security / DevSecOps
Threat modeling, hardening, and secure delivery pipelines.
Hardening an Admin Backend — MFA, Rate Limiting, and Lockout
The Go authentication core for a multi-tenant dealer SaaS — bcrypt, hashed JWT sessions, dual MFA with recovery codes, rate limiting, lockout, and email verification.
Scope-Gated Autonomous Agent: Permission-Bounded Tool Execution
A Claude-driven agent whose capabilities are bounded by least-privilege scopes — tools register only when its JWT holds the permission, with audit logging and server-side compliance.
Platform & Infra
Infrastructure, deployment, and reliability engineering.
A Reusable Provisioning & Deploy Agent for Self-Hosted Hetzner
The tooling I built to run my own infra — provisioning and deploy scripts that take a fresh VM to a TLS-secured, backed-up production host on Hetzner in one command.
Health-Gated, Rollback-Safe Deploys for a Self-Hosted Compose Stack
The deploy pipeline for my self-hosted apps — back up first, migrate, restart behind health checks, and roll back fast. Docker Compose and Bash, not Kubernetes.
Infrastructure for an Autonomous Agent Platform
The platform behind an autonomous developer agent — ephemeral sandboxes, a Redis/Asynq queue, a Qdrant vector store, RLS Postgres, and full observability, self-hosted from one Compose file.
Leadership & Cost
Technical leadership, decision-making, and cost optimization.
Delivering White-Label Dealer Sites at Scale
A versioned template and CI/CD pipeline for shipping many client dealer sites from one Next.js base — Playwright e2e, Lighthouse checks, and Sentry inherited by every site.
Leading a Legacy Frontend Migration Across a Multi-Site Platform
Led a multi-site auto-dealer platform migration from Gatsby to Next.js (App Router, strict TS) — a filesystem content model that removed ~2,000 lines of duplication.
Integrations
Third-party integrations and API work.
Automotive Data Orchestration: Carfax, KBB, and FTP Imaging
A Java/Spring Boot service that fronts automotive vendor data behind one API — Carfax over GraphQL with OAuth, KBB via SOAP, and vehicle imaging over FTP.
Multi-Source Media Ingestion: YouTube, RSS, and File Metadata
An ingestion layer that normalizes five media sources — YouTube, RSS, tagged audio, audiobooks, ebooks, and podcasts — behind one model, with SSRF-protected fetching.
Plaid Integration for Identity Verification and Bank Account Linking
Secure Plaid-based identity verification and bank linking for auto dealerships — dual stateless/stateful patterns and JSONB storage, cutting verification from days to minutes.
Runbooks & Refs
Operational runbooks and quick reference notes.
Reference: Hardened Reverse Proxy (TLS, Rate Limiting, Security Headers)
The reverse proxy I put in front of self-hosted stacks — Caddy for automatic TLS, or hardened nginx with rate limiting, tuned TLS, and strict security headers.
Reference: systemd Service + Timer for a Long-Running Agent
Running a long-lived Node agent on a plain Hetzner box with systemd — a service for the always-on process and timers for scheduled work, no Docker or cron.
Runbook: Nightly Postgres Backups with Integrity Checks and Retention
Nightly gzipped Postgres backups that are integrity-checked, retained for 30 days, and shipped to object storage — plus the restore path.
Runbook: One-Click Self-Hosting with Auto-TLS
Provision and deploy a full self-hosted stack to Hetzner, AWS, GCP, or any Ubuntu host in one command, with Caddy auto-TLS and nightly backups.