"I don't build systems to impress — I build them to quietly endure.
From bare-metal infrastructure to AI agent governance: solid systems begin with steady hands."

With 11+ years in IT Operations & Systems Engineering (bare-metal virtualization, multi-site enterprise networking, and zero-downtime disaster recovery), I approach Artificial Intelligence from a First-Principles engineering perspective.

While most treat AI as prompt-driven magic, I treat it as an untrusted, high-velocity compute layer that demands:

• Deterministic Guardrails: Hard runtime boundaries, process sandboxing, and write receipts instead of hoping the LLM "behaves."
• Epistemic Integrity: Enforcing a strict separation between hypothesis ([HYPO]) and physically proven evidence ([PROVEN]).
• Zero-Root Infrastructure: Multi-layer perimeter defense (Edge WAF $\rightarrow$ Traefik v3 $\rightarrow$ CrowdSec $\rightarrow$ Passkey FIDO2) with bounded autonomous self-healing.

┌─────────────────────────────────────────────────────────────────────────┐
│              COGNITIVE LAYER: Governed Second Brain                     │
│    • SSoT Knowledge Base & Deterministic Orchestrator (wiki.py)          │
│    • ADLC Finite State Machine & Gate D Deep-Why Verification           │
└────────────────────────────────────┬────────────────────────────────────┘
                                     │ Issues Path-Scoped Write Receipts
                                     ▼
┌─────────────────────────────────────────────────────────────────────────┐
│              EXECUTION LAYER: g8s (The Gatekeepers)                     │
│    • Zero-Trust Go Binary Runtime for AI CLI Workers                    │
│    • Capability Dropping, Subagent Sandboxing & Supervisor Fix Loop     │
└────────────────────────────────────┬────────────────────────────────────┘
                                     │ Controlled Action / Code Changes
                                     ▼
┌─────────────────────────────────────────────────────────────────────────┐
│              OPERATIONS LAYER: AI-Assisted Homelab Platform (IaC)       │
│    • Bare-Metal Proxmox VE, Rootless Podman, Tailscale Zero-WAN Mesh    │
│    • Autonomous SRE Butler Agent: CTI Ingestion, SBOM & LogSQL Hunting   │
│    • Human-in-the-Loop (HITL) HMAC-SHA256 Telegram Approval Cards       │
└─────────────────────────────────────────────────────────────────────────┘

A Lightweight, Zero-Trust Process Execution & Capability Harness for AI Agent CLI Workers
“k8s orchestrates your compute containers; g8s orchestrates your AI subagents.”

• Two-Tier Agent Harness: Enables high-tier Brain orchestrators (Claude 3.7 / Opus / GPT-4o) to safely dispatch mechanical tasks to lightweight CLI workers (Antigravity CLI, Claude Code CLI, Gemini CLI) under strict sandbox constraints.
• Cryptographic Write Receipts: Grants time-limited, path-scoped write authority (Schema v3) to prevent unauthorized file mutation and codebase drift.
• Supervisor Fix Loop: Automated execution verification, metrics ingestion, and self-correcting agent loops.

Production-Inspired Reference Architecture & SRE Automation for Bare-Metal Homelabs

• 3-Tier Balanced Architecture: Perimeter Ingress & Identity (Traefik v3, CrowdSec, Tailscale Mesh, Dual-Tier IAM) $\rightarrow$ AI Gateway & Operations Plane (LiteLLM, SRE Butler Agent) $\rightarrow$ Observability & GitOps Core (VictoriaLogs, VictoriaMetrics, Age Encryption).
• Dual-Tier Zero-Trust IAM: Biometric Passkey FIDO2 via Pocket ID combined with ForwardAuth proxy via Authelia and LLDAP.
• Closed-Loop SRE Automation: SRE Butler periodically polls CTI feeds (CISA/GHSA), performs $O(1)$ local SBOM matching, executes retroactive forensic hunts via VictoriaLogs LogSQL, and dispatches HMAC-SHA256 signed Telegram approval cards (300s TTL).
• Zero-Spam GitOps Engine: Automated hypervisor drift reconciliation every 15 minutes with content-addressable SHA-256 suppression and Age Zero-Knowledge secrets encryption.

Governance Middleware Between AI Agents and Your Codebase

• Acts as an automated defense layer preventing AI agents from generating hollow artifacts, executing unverified cowboy commits, and polluting Single Sources of Truth (SSoT).
• Enforces strict contract schemas and validation checks before mutations reach Git repositories.

Autonomous Open Source Contribution Engine

• Contributed to autonomous multi-agent pipelines for discovering open-source issues, synthesizing reproducible tests, and authoring pull requests.
• 9 PRs successfully merged across 21+ open-source repositories.

(Architectural blueprints and private self-hosted fleets operated under strict Zero-Leakage OpSec standards)

• Challenge: Scaling personal knowledge and technical decision-making across dozens of AI agent sessions without context drift, unverified assumptions, or knowledge rot.
• Architecture & Mechanism:
  • Engineered a deterministic Python runtime (wiki.py) functioning as a physics engine for the vault: forces orientation, JIT similarity searching, and epistemic labeling before any file modification.
  • ADLC (Agentic Development Life Cycle): Enforces finite state machine (FSM) transitions and Red Test Proof sections on engineering plans, backed by automated Git pre-commit gates.
  • Memory Distillation Pipeline: Background daemon scanning execution logs to distill ephemeral agent interactions into proven axioms with Zero DLP leakage.
• Impact: Zero hallucinated rules across 500+ documentation nodes; 100% auditable knowledge lineage.

• Challenge: Managing a high-availability bare-metal virtualization cluster hosting 20+ services with zero public exposure and sub-second incident triage.
• Architecture & Mechanism:
  • Zero-WAN Exposure Law: Management interfaces (Proxmox VE, RouterOS, VictoriaLogs) strictly restricted to internal LAN and Tailscale Mesh VPN (Zero-Trust Encrypted Mesh).
  • Dual-Plane Observability: Synthetic uptime monitoring separating compute plane ([LAN] internal container health) from edge ingress ([WAN] public domain health), isolating routing vs service failures in under 2 seconds.
  • Single Authority DHCP: Centralized RouterOS static lease binding as the single source of truth for container network identities.
• Impact: 99.9% fleet availability, zero unauthorized ingress attempts, and under 5-minute automated disaster recovery.

A decade of bare-metal and cloud operations providing the bedrock for scalable AI systems.

Domain	Technologies
Systems & Languages
AI Agent & Protocol Systems
Virtualization & Containers
IaC & Automation
Security & Networking
Observability & SRE

• Mechanism over Prompting — Don't instruct AI to be careful; build guardrails and process harnesses that make violations impossible.
• Evidence over Plausibility — If it isn't verified by an execution command or physical log, it remains a hypothesis ([HYPO]).
• Stability over Complexity — Fewer moving parts, zero spurious drift, and architectures designed to quietly endure.
• Document along the Way — Systems outlive their builders; code without architectural context is technical debt.