Selected Work
Deep dives into real-world engineering challenges: the problem, the approach, and what happened.
Pipeline Platform: A Config-Driven Document Processing System
Orchestrator, workers, dashboard, auth, and an MCP bridge built around a single DAG model
Pipeline Orchestrator: One DAG Engine to Retire 535 Source Processors
A config-driven DAG engine for document processing with terminal evaluation and publish-before-commit safety
Modernizing a Micronaut 1 Monolith Without a Big Bang
Micronaut 1 to 4, Java 11 to 17, Gradle 7 to 8, and Hibernate 5 to 6 across a monolith with no tests, then a far cheaper second jump to Java 25
A 207-Key Cryptographic Migration Gated by a Single SQL Row
A staged AWS KMS key migration for per-tenant document encryption, gated at every step and settled by one database query
Fail-Closed by Construction: OAuth 2.1 and a SAML Replay Guard in Postgres
Choosing the store whose failure mode a security control can actually survive, then hardening it through two review passes that each found a real bug
Strangling a Monolith Through Its Data Layer
A schema-first entity library and a gRPC bridge that let two framework generations share one Postgres database
Grafana as Code: 21 Dashboards to Terraform in 24 Days
Two click-ops Grafana estates moved into git and Terraform, with rename-safety engineered in for a risk the design itself introduced
An AI Engineering Platform the Team Actually Adopted
A closed-loop TDD memory system, an explicit context budget, and the design review that said no to eight of thirteen proposed skills
Pipeline Workers: Ten Generic Stages That Coexist With a Legacy Schema
Generic sub-processors over RabbitMQ, with read-only entity scan to share a database without owning it
Pipeline Dashboard: A Thin SPA and the API-Perimeter Lesson
A Vue 3 operator surface that grew from read-only observability to config editing without ever owning a mutation
Pipeline Auth: A Standalone JWT Issuer With a Zero-Downtime Route Migration
A Micronaut auth service that decoupled the new platform from the legacy stack, and the dual-controller alias pattern that shipped it without an outage
Prove It Before It Ships: Discovery Walks and a Zero-Side-Effect Dry Run
How source onboarding moved from porting legacy processors to walking one real notification, curating fixtures, and proving them against the live source with the side effects turned off
A Tenant-Scoped MCP Server With a Fail-Closed Security Boundary
Twelve dashboard tools for LLMs, gated by OAuth 2.1, per-request audience binding, and a trusted-host check that runs before anything else
MCP Bridge: Shipping the Data Plane, Deferring the Framework
Building MCP-aware tooling against a framework that was still picking its annotation style
EventHorizon: Building a Detection Platform for the Fourth Time
A personal rebuild of the ingest, detect, and explain problem I solved three times at two companies, now on real labeled data instead of demo events
CI/CD Pipeline Optimization
Replacing a serial Docker build of 17 services with 17 parallel JIB builds, and what the pipeline records say it actually bought
EKS Cluster Migrations
A three-cluster Kubernetes upgrade under deadline pressure