Leads the design and delivery of cloud systems and SaaS platforms. Uses Kubernetes, FluxCD, and infrastructure as code. Builds AI systems that use LLMs in business workflows.

Experience

#experience

happyvertical.com

Founder & Lead Engineer
2024-12 – Present

Open-source platform for vertical AI agents and local knowledge bases.

s-m-r-t.dev

A TypeScript framework for software that people and AI agents operate on equal terms. One typed domain model generates the schema, REST, CLI, MCP, and browser agent tools, with authority enforced down to the database row. 64 packages released daily in lockstep, plus a docs site that doubles as the framework's live test bed.

One Declaration, Four Surfaces

Decorated classes compile at build time into a manifest that is at once the SQL schema, the generated REST, CLI, and MCP servers, the browser-side WebMCP tool set, and the permission catalog. 291 registered objects across 18 manifest-shipping packages.

Authority Agents Cannot Exceed

Every call resolves as a real principal in one tenant under generated Postgres row-level security. Server-side agents run as a persona's bound user with power limited to user RBAC, agent-class ceiling, and persona allow-list. Browser agents run as the signed-in user.

Agents Propose, Humans Confirm

A control-interaction registry lets an agent stage a form value beside the live one, but applying it requires a trusted human gesture. Agent self-improvement is gated the same way: reflection can propose instruction changes, activation stays with a person.

Agents as a Shipped Feature

Persona-configured autonomous agents on cron schedules, backed by a durable job queue with priorities, retries, liveness-based crash recovery, and tenant caps. A conversational harness whose tools are the app's own manifest operations, plus inter-agent dispatch.

Multi-Tenant by Construction

AsyncLocalStorage context with a global interceptor that filters every read path and stamps tenant ids on writes. Hierarchical tenants to depth 10 with opt-in permission inheritance. SvelteKit, Express, and CLI adapters.

Three Databases, One Migration Story

PostgreSQL, SQLite, and DuckDB share schema and migrations, with lock-safe concurrent-index migrations, live-schema parity checks, and a zero-config SQLite runtime so a new app runs before a database exists.

Domain Modules as Batteries

Content governance with versioning and corrections, a nine-contract commerce model with double-entry revenue recognition and fiat plus crypto rails, a double-entry ledger, multi-channel messaging, analytics, and declared-aggregate reports.

Built for Coding Agents Too

Version-matched AGENTS.md in every package, a deterministic build-time knowledge contract, a doctor command, a development MCP server, and 371 Svelte components with 285 in the public reference at 97 percent prop coverage, five themes, and i18n.

Agent Development Control Plane

Private control plane that lets AI coding agents and humans ship to a 69-repository fleet under one enforced lifecycle. Agents lease issues, get independent multi-model review, and produce signed release evidence before a merge queue will accept their work. 16 portable skills, 22 schemas, and a 1,900-assertion test harness in dependency-free Python.

2026-05

Issue Lease Lifecycle

Designed a claim, heartbeat, and release protocol where agents hold a renewable four-hour lease on an issue, races resolve by GitHub server order, and release evidence is an immutable owner-attributed commit status bound to the exact PR head. Identifiers are selectors, not credentials.

Merge Authority

Wrote a lifecycle check that revalidates every closing issue's released cycle on each PR head and in the merge queue, so a later push or reopened issue always requires a new cycle.

Signed Policy Distribution

Built policy as a signed OCI artifact pinned by digest, with a byte-bound authority substrate, monotonic generations, and channel-aware promotion through canary and smoke rings with rollback. Consumer repositories cannot select their own policy.

Multi-Model Review Roster

Defined four reviewer tiers across GPT and Claude families with risk-scaled floors, an implementer-independent reviewer rule, immutable review packets, and a finding classification scheme. Skills run across seven agent harnesses.

Portable Skills

Shipped 16 agent skills, including implement, ship, review-cycle, and claim-issue, governed by a lock file recording hash, license, permission footprint, and harness matrix.

Hybrid GitOps Platform

Declarative hybrid Kubernetes platform spanning Hetzner Cloud and homelab GPU nodes. One k3s cluster with embedded etcd quorum across cloud and on-prem, provisioned by CDKTF and NixOS and operated through Flux, at about 82 percent lower cost than the managed cluster it replaced.

2025-05

Layered Bootstrap

CDKTF in TypeScript provisions Hetzner compute, load balancing, and firewalls plus AWS Route53, SES, and S3. NixOS flakes define each host including k3s, GPU drivers, and mesh networking. Flux reconciles system, application, and tenant layers in dependency order.

GitOps at Scale

276 Flux Kustomizations, 51 Helm releases, and 109 namespaces across 66 applications. Image automation opens promotion pull requests instead of committing to main.

Dual Overlay Networking

Tailscale mesh with native k3s VPN auth and a Nebula mesh carrying flannel. Fixed an upstream Nebula version gap and made k3s rebuild its VXLAN device on mesh restart.

Data and Storage

13 CloudNativePG clusters with scheduled barman backups to object storage, Velero, JuiceFS, MinIO and Garage S3, and Hetzner CSI volumes.

GPU Workloads

NVIDIA time-slicing and AMD ROCm device plugins serving vLLM, llama.cpp, Ollama, ComfyUI, TTS, and OCR services on owned hardware.

Secrets and Policy

Separate age key domains for host and cluster secrets under SOPS, template-rendered secrets with checksum guards, 81 network policies, Kyverno and conftest policies, and 48 conformance tests run in CI.

Self-Hosted CI and Cost Controls

Actions Runner Controller scale sets per GitHub organization on owned GPU hardware, 14 workflows including per-host NixOS deploys and manifest validation, plus a GCP AI-spend circuit breaker and cloud cost exporter.

HAVE SDK

The HAVE SDK is an abstraction layer designed to decouple application logic from volatile infrastructure dependencies.

Designed adapter and factory interfaces for AI, database, and cache services. The interfaces isolate business logic from provider implementations.

Built adapters for AI providers, databases, caches, payment systems, and identity services.

Built one interface for chat, streaming, embeddings, vision, text-to-speech, and function calling.

Used AI-assisted development to build lightweight first-party adapters. Consumers install provider dependencies only when needed.

Added AGENT.md context files and an MCP documentation server for SDK integration work.

Used pnpm, Turborepo, ESM, Vitest, Biome, conventional commits, and Changesets to maintain the SDK.

anytown.ai

Multi-tenant SaaS platform running an AI-assisted local news network for small towns. A dashboard tier manages network and publication tenants, provisions each town's static site and infrastructure, and runs a roster of production agents that gather, write, illustrate, broadcast, and monetize local coverage. About 580,000 lines of TypeScript and Svelte with 503 test files, built solo in eight months.

Municipal Coverage Agent

Twelve scraper adapters for real council portal software, LLM-based source discovery with adapter auto-detection, PDF extraction with OCR fallback, and priority scheduling across upcoming, completed, and backfill meetings. Every announcement links to its source document as proof, with extracted facts stored alongside.

Agent Roster as Installable Plugins

Eight production agents covering weather aggregation, sports with play-by-play and AI recaps, AI news-anchor video, social publishing and analytics, two-stage email routing, GitHub project automation, and ad sales. Each agent ships its own admin UI, CLI, MCP tools, and cron methods, and activates per tenant.

News-Anchor Video Pipeline

Separates performer face identity from character role and scene so one face can play many branded roles. Script to voice clone, lip-sync, motion, long-video segmentation with last-frame chaining, and post-production through checked-in ComfyUI graphs on local GPUs.

Monetization

Ad server with sponsorship, standard, and house tiers, budget-weighted selection, immutable delivery events, and fail-closed zone registration. Business subscriptions with a rotating subscriber ad pool, sponsored content with separate commercial and editorial approvals, four-level commission settlement with partner ledgers and payout batches, and Stripe billing.

Governance and Cost Control

Per-tenant moderation policy setting agent versus human approval, daily agent-approved budgets and rates, sensitive categories, and forced review for new partners. Idempotency reservations prevent duplicate paid AI calls.

Platform

174 decorator-generated domain objects, 143 pages, and 440 API endpoints on SvelteKit. PostgreSQL on CloudNativePG with a database per site so towns keep serving if the SaaS tier is down. One image split into web, background worker, and serialized deploy worker roles. Automated per-site AWS provisioning with CDKTF, S3, CloudFront, ACM, and Route53. Kotlin Multiplatform reporter app with an offline write queue.

ergot.io

Tenant-aware media asset management and processing orchestration platform, shipped as a hosted service and an open-source community edition sharing one domain model. Captures from cameras and turntable rigs, runs GPU media pipelines on-prem or in cloud, keeps rights and provenance with every output, and sells licenses through an agent-first marketplace. About 130,000 lines of TypeScript with 759 tests.

Model-Driven Core

50 domain models and about 60 services on the s-m-r-t framework, each declaring its REST, CLI, and MCP exposure. Six apps, six packages, and two agents in a TypeScript monorepo, including a SvelteKit control plane, an Electron capture client, and a Python GPU runtime.

Rights and Provenance Engine

Typed rights contracts covering license tier, territory, exclusivity, derivatives, attribution, and AI-training permission. Rights snapshots carry a precedence-ordered basis chain across nine sources, and every pipeline step declares whether it preserves rights, creates a derivative, or inherits the generative model's own license constraints. A preflight endpoint checks a use before it runs.

Four-Way Execution Placement

Pipeline steps dispatch to the control plane, the capture node itself, a paired GPU worker, or cloud by capability-tag matching with lease-based claiming and heartbeats. NVIDIA, AMD ROCm, and Apple MPS paths.

Media Pipelines

Seventeen pipeline types across TTS with voice cloning, transcription with word timestamps, face embedding and matching, image editing, talking-head and text-to-video generation, 360 conversion, photogrammetry, and Gaussian splat reconstruction. Runs Wan 2.2, LTX-2.3, HunyuanVideo, Whisper, InsightFace, and Qwen3-TTS through ComfyUI workflows.

Offline-First Capture

Device adapters for Sony Camera Remote SDK, gphoto2, Insta360, and a Flipper Zero turntable controller, with a simulator so contributors never need proprietary SDKs. Capture nodes write to SQLite and disk first, then sync immutable checksummed packages. Intake hashes with SHA-256, extracts GPS into a geo index, and stages batches for human curation before assets are minted.

Consumer Surface

About 51 consumer API endpoints, 22 capability scopes on API keys, HMAC-signed outbound webhooks, inbound hooks that pipelines can suspend on, idempotent tenant provisioning, a published SDK, and embeddable Svelte components.

Agent-First Marketplace

Account-less buyers identified by email purchase time-bound or perpetual licenses in a few API calls. Pluggable payment backends for USDC on Base, Bitcoin via BTCPay, and Stripe, signed PDF licenses, and revenue splits paid out in the buyer's currency. Access on sale reuses the tenant asset-sharing rules.

digitalfuel.io

Technical Lead
2021-03 – 2024-12

Built and ran Polycephal, a multi-tenant headless CMS and static publishing platform serving about 97 niche content and review sites across 16 organizations.

Platform Architecture

PostgreSQL with PostGraphile, row-level security across 13 tables and 31 policies, 109 SQL functions, and 98 migrations. React and Next.js admin with react-admin and a multi-root rich text editor. Graphile Worker job queue with 58 task types.

AI Content Pipeline

Multi-stage LLM pipeline that qualifies feed items against editorial criteria, derives rewritten articles, generates SEO metadata, and resolves categories against each tenant's taxonomy. Cheap models for classification and premium models for article bodies, prompt-hashed idempotency so the same job never bills twice, per-tenant API key isolation, and unmapped items routed to human review.

Syndication Engine

About 200 RSS sources polled every five minutes feeding 179 subscriptions that watch, qualify, rewrite, translate via DeepL, and publish as drafts on a delay. Roughly 200,000 articles and versions in production.

Database-to-Hugo Compiler

Streams tenant content into Hugo page bundles, pulls git-hosted themes per site, injects site config and styles, and builds and deploys to S3 and CloudFront. About 80,000 recorded build-and-deploy runs.

Self-Provisioning Sites

A state machine that purchases domains through GoDaddy, creates Route53 zones, issues ACM certificates, builds CloudFront distributions, and flips nameservers, with propagation polling. Google Analytics and Tag Manager properties provisioned programmatically.

Operations

Helm chart, Terraform modules, and GitOps promotion through Flux across three hosting generations: AWS EKS, DigitalOcean, then self-hosted Gitea, Harbor, and Kubernetes. Playwright and Jest suites. Authored about 87 percent of 1,800 project commits over three years.

xmatters.com

Integrations Engineer
2020-03 – 2020-12

Built tools for code coverage, OAuth integration, and database patching.

Code Coverage

Built a code-coverage tool that finds untested paths.

OAuth Integration

Implemented OAuth to link Slack accounts with xMatters users.

Automation

Built Spring Framework scripts to apply database patches.

omnium.io

Technical Lead
2015-10 – 2020-03

Led architecture and delivery of a multi-tenant SaaS ERP and warehouse platform for apparel brands, distributors, and 3PLs, replacing a legacy system through incremental migration.

Platform Architecture

Designed a multi-tenant Node.js and Sails.js API with 93 models and 238 documented endpoints covering catalog with size and color matrices, orders, purchasing, receiving, bin-level inventory, allocation, pick and pack, shipping, invoicing, returns, and multi-currency pricing.

Warehouse and Inventory Engine

Wrote transactional allocation and inventory-position logic with hand-tuned SQL that reconciles sold, received, picked, and on-hand quantities per SKU across open and completed pipelines.

Documents and Data Exchange

Built PDF generation for invoices, credits, RMAs, and pick tickets, styled multi-sheet XLSX order forms, and bulk SKU and customer importers with real-time progress over sockets.

Tenancy and Access

Implemented tenant scoping by domain, default-deny role policies across seven user tiers, white-label customer portals, per-tenant storage, audit logging, and store-level feature flags.

Delivery and Quality

Set up a Jenkins pipeline that builds Docker images, runs the test suite against MySQL, and deploys to AWS ECS through ECR. Maintained about 1,000 tests covering nearly every controller. Extracted a shared order-math package so the API and the browser computed identical totals.

Team Leadership

Led a five-person team and authored about 60 percent of roughly 7,000 commits across the API and UI. Migrated the legacy Blastramp system by serving legacy pages alongside the new SPA.

Internet Media Corp

Technical Director & Partner
2003-06 – 2008

Built server and media systems for content syndication and video streaming.

Server Cluster

Built a server cluster with FreeBSD and Spread Toolkit. The cluster supported B2B content syndication.

Video Streaming System

Built a PHP video streaming system. It includes pseudo-streaming, usage billing, and data tracking.

Technical Consulting

Provided technical consulting and training to ISP infrastructure teams. Set operational standards for media systems.

Green Room Media

Lead Programmer & Technical Consultant
2000-04 – 2002-12

Built web products for digital media and gaming clients.

Engineering Leadership

Built a digital agency with media buyers. Led engineering work for web products.

Gaming Platforms

Built full-stack systems for betting exchanges, PPC search engines, and sports prediction products.

Dish Clothing

Software Engineer
1999-11 – 2000-03

Built manufacturing and barcode systems for inventory and invoicing.

ERP Migration

Built an MS Access and VBA system to replace a FileMaker database. The system manages inventory, orders, and material calculations.

Mobile Barcode Software

Built Windows Mobile barcode software for inventory and invoicing.

Vizworx

Software Developer
2020 – 2021

Built Kubernetes and AWS CDK infrastructure, e-sports bracket algorithms, and Terraform templates.

coink.it

Founder
2013 – 2015

Built a cryptocurrency platform with blockchain APIs and a secure wallet server.

iWinback

Software Engineer
2011 – 2012

Built a web call-center application to replace a Delphi system.

Gogiro Internet

Lead Developer
2009 – 2011

Built a multi-tenant affiliate SaaS platform on AWS.

Matrix Content

Software Engineer
2002 – 2003

Built a web store and backend for an image and video licensing company.

Cannabis Culture Magazine

Software Engineer
1997 – 1999

Other Experience

#other

Software Developer

Vizworx · 2020–2021

Kubernetes/AWS CDK infrastructure, e-sports bracket algorithms, Terraform templates.

Founder

coink.it · 2013–2015

Cryptocurrency platform with blockchain API and secure wallet server.

Software Engineer

iWinback · 2011–2012

Web-based call center application replacing legacy Delphi system.

Lead Developer

Gogiro Internet · 2009–2011

Multi-tenant affiliate SaaS platform on AWS.

Software Engineer

Matrix Content · 2002–2003

Relocated to Los Angeles; built web store and backend for image/video licensing business.

Software Engineer

Cannabis Culture Magazine · 1997–1999

Education & Certifications

#education
  • Agile Product Ownership
    UBC Sauder School of Business
    Issued Feb 2018 · Credential ID: II863
  • CELTA (Certificate in Teaching English to Speakers of Other Languages)
    Issued Jul 2016
  • Earl Marriott Secondary School
    Network administrator for Novell NetWare and AppleTalk networks. Built a hallway broadcast system using distributed televisions. Set up the school's first student internet workstation. Self-taught; programming since age 10.