Engineering
Projects I build and run myself
Independent work outside the day job, infrastructure and AI systems built the way I'd ship them at work. I use AI coding tools throughout, the same way I use them there, to move faster without losing track of how the system works. Every architecture decision below is mine, and I can walk through any of them.
Personal Project · v0–v4 Done and Verified Live
Guardrail — Kubernetes policy enforcement that can't be bypassed
A self-hosted policy platform: CI builds and signs a container image, GitOps deploys it, and a hand-written Go admission webhook blocks non-compliant resources inside the cluster itself, before anything unsafe can run.
~1s
Argo CD reverted an unauthorized manual change
0
Bypass paths found, including a direct kubectl apply against the running cluster
What it does
- Rejects a noncompliant pod at the Kubernetes API server itself: required resource limits, no root containers, no :latest tags, images only from an allow-listed registry
- Enforces that rejection even against a direct kubectl apply that skips the deploy pipeline entirely, confirmed live against a running cluster
- Keeps CI out of the cluster completely. It only commits an image tag to Git; Argo CD, running inside the cluster, is what actually pulls and applies it
Why it's built this way
- A hand-rolled Go admission webhook instead of Gatekeeper, a deliberately harder path chosen to demonstrate direct competency against Kubernetes’ own admission API
- Real supply-chain steps a solo project could easily skip: an SBOM generated and the image signed with cosign, keylessly through GitHub’s own OIDC identity, so there is no signing key that could ever leak
- Every claim checked against the real cluster. Argo CD’s self-heal reverting a manual scaling change in about a second, and the published image’s signature independently re-verified from a separate machine
Built with Go, a kind cluster, Argo CD, GitHub Actions, Trivy, and cosign. Full architecture diagram, roadmap, and the exact failure-mode tests are in the README.
View on GitHub →Personal Project · v0–v4 Done and Verified Live
Overseer — watching an AI agent from outside its own control
A control-plane component that observes an AI system from the kernel side, alerts a human when something looks wrong, and can kill the process on an explicit human command. It never acts on its own judgment.
320 → 3
Alerts after tuning out noise from real captured events
0
Code paths from the alerting engine to the kill switch
What it does
- Captures every process the watched system actually executes, via a hand-written eBPF probe on the kernel’s own syscall tracepoint, not anything the system reports about itself
- Tunes real alerts out of real noise: a naive first pass produced 320 alerts for two events a human would actually care about, tuned down to 3
- Kills the target for real on an explicit human command, a direct SIGKILL through the Docker Engine API, confirmed against a target built specifically to survive a softer stop
Why it's built this way
- No code path from the alerting engine to the kill switch. Not a permission check that could have a bug, but the literal absence of an import
- Falco, the standard tool for this, was tried first and tested live before being ruled out, once its rule engine never actually fired on real captured events
- The sandboxed demo target itself was adversarially tested before any misbehaving-agent code was written: a fork bomb stopped at exactly its configured limit, a write outside its scratch directory hit a real permission error
Built with Go and a hand-written eBPF probe for the monitoring layer, unprivileged Go services for reporting and the kill switch, and a Python target sandboxed for the demo. Same CI shape as Guardrail: CodeQL, gitleaks, Trivy, SBOM, cosign.
View on GitHub →