A cloud-native Python platform for extraction, semantic search, summarization,
async processing, and API-driven document workflows.
Python · FastAPI · Celery · Vector search
Cloud environments
Modal, Hermes, and DevPod tooling
Experiments for isolated agent execution, persistent runtime state, and reusable
remote development environments.
Modal · DevPod · Docker · Python
# in production
Built, deployed, and operated end to end.
A full-stack TypeScript platform with payments, background jobs, and an on-site device
agent. I own the infrastructure, the delivery pipeline, and the production operations.
Live
In production since Oct 2026, after a staged cutover from a PaaS host to the edge
3 tiers
Local, staging, and production, each with isolated data, secrets, and tokens
51 migrations
Replayed on a clean database and drift-checked in CI before every deploy
220 test files
Unit, database-backed, and live payments-sandbox end-to-end suites
Edge runtime
API and SPA served from one Cloudflare Worker: an Express app on the Node compat layer, static assets, per-environment custom domains, and Smart Placement.
Cloudflare Workers
Static Assets
Cron Triggers
Durable Objects
R2
Data layer
Serverless Postgres reached through a connection pooler, Prisma on its query-compiler engine, and forward-only migrations checked for drift against a shadow database.
PlanetScale Postgres
Hyperdrive
Prisma
Postgres 18
Delivery pipeline
Branch-per-environment promotion, fast-forward only; production deploys only commits already proven on staging. Preflight secret checks, migrate, deploy, health smoke test.
GitHub Actions
Wrangler
SHA-pinned actions
Dependabot
Payments & async work
Idempotent checkout saga, HMAC-verified webhooks with event dedup, acknowledge-then-process, reconciliation sweeps, dead-letter alerts, and a requeue runbook.
Idempotency keys
Webhooks
Reconciliation
Server-Sent Events
Security
Typed env schema resolved from a password vault, scoped tokens per environment, RBAC sessions, CSRF and rate limits, Zero Trust on internal surfaces, and a deploy guard that keeps staging off production data.
varlock
1Password
Cloudflare Access
RBAC
JWT
Operations
Cut over from a PaaS host to Workers, traced and fixed a ~1.1 MB-per-request ORM memory leak on the edge, and shipped a Windows device agent with remote status and at-most-once commands.
Workers Observability
Email alerts
esbuild
Windows service
# skills
Backend, data, and AI in production.
Python services, data pipelines, and retrieval and agent systems on AWS, measured
with evaluation suites and production observability.
12 min → 8 s
Internal knowledge-search time for 2,000+ users, via a FastAPI + pgvector API
82% → 94%
Answer accuracy, driven by a 500-case evaluation suite and model benchmarking
30 h / week
Manual review replaced by agents with tool use, shipped into 6 teams’ services
40k docs / mo
Classified and extracted at 91% accuracy; retrieval recall@10 up 27%
Languages & backend
Python
SQL
TypeScript
FastAPI
RESTful APIs
Node.js
Express
React
Next.js
gRPC
Microservices
Event-driven jobs
Amazon SQS
Celery
Data & search
PostgreSQL
pgvector
PlanetScale
Prisma
OpenSearch
Hybrid search
Reranking
ETL pipelines
Spark
Schema validation
Data quality
AI applications
RAG systems
LLM agents
Tool use
LangChain
Guardrails
Evaluation suites
OpenAI
Anthropic
spaCy
MCP
Cloud & infrastructure
AWS
Cloudflare Workers
Terraform
OpenTofu
Docker
Kubernetes
Jenkins
GitHub Actions
CI/CD gates
Git
Reliability
LangSmith tracing
OpenTelemetry
Prometheus
ELK
Dashboards
Automated testing
strace · gdb · tcpdump
Governance
Access control
RBAC
Data lineage
Metadata tracking
Audit readiness
# workflow
Agent-assisted, isolated, reproducible.
How I set up day-to-day engineering: several coding agents in parallel, each fenced
off from secrets and production, on environments I can rebuild from code.
Parallel agent harnesses
Claude Code, Codex CLI, and Kimi Code side by side, one config directory per account, in persistent herdr panes inside Ghostty.
Claude Code
Codex CLI
herdr
Ghostty
Isolation first
OrbStack Linux VMs and Docker Sandboxes microVMs as the boundary per account; untrusted harnesses get repo-only mounts and an egress allowlist.
OrbStack
Docker Sandboxes
Portainer
MCP without leaked secrets
A small launcher every harness calls, pulling credentials from Keychain or a vault per project; secret-free servers via a gateway; a shared fleet over a private network.
MCP
Docker MCP Gateway
1Password
Tailscale
Disposable cloud dev servers
Per-account servers defined in code: baked images, persistent home volumes, SSM sessions with no inbound ports, short-lived credentials, and state backups before teardown.
AWS
OpenTofu
SSM
EFS
restic
Reproducible projects
Pinned runtimes and package managers, committed lockfiles, pnpm workspaces for monorepos, and typed env schemas instead of .env files.
pnpm
Node.js
TypeScript
varlock
Knowledge as code
Decisions, evaluations, and runbooks kept as a versioned knowledge bundle with sources and staleness dates, plus HTML explainers and agent briefs.
Open Knowledge Format
ADRs
Runbooks
# work map
Three areas I keep returning to.
The common thread is making powerful systems easier to operate, inspect, and trust.
01 / AI systems
Model-backed workflows
Agent graphs, voice and chat surfaces, semantic search, and practical observability.