Projects & Tools

Self-hosted personal knowledge system (RAG). Ingests notes, code, documents, and infrastructure data from multiple sources, auto-categorizes with hybrid rule-based and LLM tagging, stores vector embeddings in pgvector, and makes everything queryable by any AI assistant via MCP or REST API.

• Hybrid search: vector similarity (70%) + full-text (30%) with source weighting
• Multi-source ingestion: GitHub (14 repos), EzNotez, file library, inbox drops
• Dual interface: MCP (Claude Code) + REST API (any LLM)
• Auto-categorization with hybrid rule-based and LLM tagging

Self-prompting agent system for Claude Code. Instead of a human re-typing prompts, the environment assembles the next instruction — the agentic loop itself is the harness. From a single prompt it grows a real, versioned project, verifies what is objectively checkable with an ungameable grader, honestly labels what is not, and surfaces to a human approval gate.

• Pure-Python decision core with thin hook shims — no bespoke orchestration engine
• Ungameable grader: objective verification separated from self-assessment
• Human approval gates on a fully autonomous loop

Pointer-first memory hub for a fleet of AI agents. Sessions recall cheap summaries with an addressable handle on every line, zoom a handle to the level of detail they actually need, and store typed memory objects — decisions, traps, open threads of work — that outlive the session which wrote them. Layered scopes resolve nearest-first, so a project memory shadows a global one without either being lost.

• Five memory layers, each with its own decay policy and write gate
• Pointer-first: a memory addresses where the body lives instead of copying it
• Context packs compiled to a token budget and injected at session start
• Append-only event journal — every write and recall is auditable, and retraction never deletes

Production-grade multi-tenant SaaS platform for cleaning business management. Features task scheduling, employee time tracking, client management, recurring service agreements, interactive calendars, invoicing, and availability management. Built with enterprise-grade security (OWASP Top 10 compliant) and deployed on Kubernetes.

• 68 database models, 31 service classes, 259 API endpoints
• Multi-tenant architecture with 5-role RBAC system
• Celery async task queue with Redis broker
• GitOps deployment with ArgoCD

Lightweight, modular status page platform for monitoring application health from external and internal perspectives. Features HTTP, TCP, and DNS checks with a real-time auto-refreshing dashboard, internal push-based agent, and comprehensive security hardening.

• Real-time dashboard with sparklines, environment badge glow, and focus mode
• Comprehensive security hardening: SSRF, CSRF, audit logging, log masking
• Internal agent architecture with encrypted communication
• HTTP, TCP, and DNS health checks with configurable intervals

AI-driven Kubernetes resource and cost optimizer. Analyzes workloads via Prometheus metrics and provides intelligent recommendations for optimizing resource requests, limits, and HPA configurations using Claude AI. Generates human-readable diffs for suggested changes.

• Manifest scanning for Deployments, StatefulSets, DaemonSets, HPAs
• AI-powered optimization via Claude API
• Historical auditing with PostgreSQL persistence

Production-grade Model Context Protocol (MCP) server providing secure AI agent access to Visma e-conomic financial API. Supports customers, products, invoices, orders, journal entries, and more with dual transport modes (stdio/HTTP) and REST API fallback.

• 35+ REST endpoints with OpenAPI 3.0 spec
• Dual transport: stdio for local, HTTP for remote agents
• Smart date filtering and read-only security mode

Personal daily notes and task organizer. A simple library for your thoughts — organize entries by type (notes, tasks, meetings, ideas), with markdown support, inline editing, search, export, and privacy blur mode.

• 6 entry types with status cycling and keyboard shortcuts
• Full-text search with type and date filtering
• Markdown with live preview, inline editing, privacy blur mode
• Export to Markdown, JSON, or CSV

End-to-end automated blog platform with daily AI-generated content. N8N workflow orchestrates the full pipeline: loads previous posts for context, prompts ChatGPT API with blog template, publishes to tech blog, generates LinkedIn summary with book link, sends email for human approval, and posts to LinkedIn upon confirmation. All generated content is human-reviewed before publishing.

• Daily AI content generation with human approval workflow
• N8N orchestration: context loading → AI generation → multi-platform publishing
• LinkedIn integration with automatic post creation and book promotion
• XSS prevention, rate limiting, and content sanitization

A read-only viewer for the Loci event journal, drawn as a neural web: light travels inward when a memory is written and outward when a context pack is delivered, and the entire history replays from the first event. It turns an append-only log into something that can be watched rather than queried.

• Read-only by construction — the viewer cannot mutate the journal it renders
• Full replay from the first event, not merely a live view

Interactive Microsoft Graph mail connector that gives an AI assistant live, audited, rate-limited access to a mailbox. Named for the Egyptian scribe god: it records, organises, and writes — it does not deliver. Sending stays a human action, so the worst outcome of a bad model decision is a draft that nobody sent.

• Never sends: every outbound path terminates in the Drafts folder
• Audited and rate-limited per consumer, with bearer-token access for non-agent clients

Personal dashboard renderer. On a schedule it collects operational signals from Cortex, EzNotez, the local knowledge vault, ArgoCD and Prometheus, then writes one Markdown dashboard into the vault — rendered on the desktop and synced to mobile. Static output by design: nothing to keep running, nothing to log into.

• Static Markdown output — the dashboard is a build artifact, not a service
• One scheduled run, one file, readable wherever the vault already syncs

Markdown-backed prompt library with a three-pane UI: browse the tree, fill {{ variables }} with live preview, and copy the rendered text into any AI tool. No database, no accounts — prompts are plain .md files in a folder you point it at.

• Variable pane builds itself from the placeholders found in the prompt body
• Sandboxed template rendering and a hardened hosted deployment
• Bundled Claude Code skill — the library is usable from the terminal too

Autonomous coding pipeline: drop a short task file into a queue and a scheduled Claude Code skill picks it up, clones the target repository, plans with built-in two-agent review, executes, validates, and opens a draft pull request. It never touches main — a safety contract, not a convention.

• Two-agent independent plan review before any code is written
• Draft-PR-only output: a human merges, always
• Runs unattended on a schedule — task queue in, pull requests out

Keeps developer secrets out of the AI context window without breaking the workflows that need them. OS-level isolation ensures credentials never reach the model, closing the leak chain from shell history to context dumps. Cross-platform: Windows and Linux.

• 672 passing tests; v1.0 feature-complete
• Secrets resolve at execution time, outside the model's view
• Two execution surfaces: guarded shell and programmatic API

Email triage and routing for Microsoft 365 mailboxes. Reads inbound mail via Microsoft Graph, classifies with deterministic rules plus a local LLM (Ollama), and executes policy-gated actions: move, label, soft-delete, or draft a reply. The system never sends — drafts land in the Drafts folder and the operator clicks Send.

• Local-first LLM classification — mail content never leaves the machine
• Policy-gated actions with an operator-in-the-loop send model
• Deterministic rules first, model second: predictable triage

A monorepo of shared Python infrastructure packages — authentication (argon2id, Ed25519/ES256 JWT, sessions, API keys), structured logging with a multi-layer secrets scrubber, audit primitives, and mail — organised as a framework plus a family of packages built on it, with deterministic AI-agent integration.

• Seven packages plus a TypeScript companion, stable v1.x family
• Package playbook, template, and scaffolder skills: new packages are stamped, not improvised
• ADR-driven conventions for lifecycle, versioning, and observability

Local-vision knowledge pipeline: drop screenshots and photos into an inbox, and a local Ollama vision model classifies each image, extracts text and metadata, and writes a git-tracked Markdown knowledge base plus a searchable image library with per-image sidecars. Nothing leaves the machine.

• Dual collection: text-only knowledge base + image library with Markdown sidecars
• Template-repo pattern — every knowledge base pulls tool updates upstream
• Feeds the Cortex RAG system with vision-derived knowledge

Personal command center for the K3s home cluster, answering one question at a glance: does this need me right now? Drop-in collectors gather cluster signals, a FastAPI daemon schedules, stores, and applies threshold rules, and a glanceable web board renders the result live. Built on the HEKATON II design system from its predecessor project, Argus.

• Eyes → Panoptes → Surface: drop-in collectors with a universal signal envelope
• Threshold rules turn raw signals into a single attention verdict
• Live board over Server-Sent Events; guarded cluster actions phased in

A timeline workbench for infrastructure-lifecycle work: certificates, API keys, licenses, patch windows, and contracts on a single zoomable tick-wheel. FastAPI JSON service plus a React 19 SPA that renders the wheel in pure HTML and CSS transforms — no canvas, no chart library.

• Three zoom states (month, days, hour) with smooth 3D-blended transitions
• Six lifecycle types and six statuses on one canvas
• Pure CSS-transform rendering — the wheel is just the DOM

A Windows Scheduled-Task backup CLI designed around loud failure — the classic pitfall is a backup that runs nightly for years and fails silently the one time it matters. Compresses source folders to multiple targets with per-target retention, SHA-256 integrity manifests, and a health command that distinguishes fresh, stale, missing, and partial states.

• Smoke-test gate: refuses to schedule until a manual run has succeeded
• Exit codes Task Scheduler can react to; structured per-target logs
• 111 passing tests; no daemon, no service — just a reliable CLI

A daily Kubernetes broom that deletes terminal pod and finished Job debris older than 24 hours — inside a strict safety envelope. Report-first by design: every run writes a report, dry-run is the default, and it only arms after a clean observation week.

• Safety envelope: only terminal states, only orphaned debris, never CronJob-owned history
• A report is written on every run — observable before it is destructive
• GitOps-deployed with a pinned image

AI workflow optimization tool for Claude Code. Addresses critical failure modes in AI-assisted development: premature completion declarations, disorganized repositories, inadequate testing, and chaotic setup processes. Features session management, context tracking, and 70% token reduction.

• 40+ CLI commands for workflow management
• 70% token reduction via Context Critical Protocol
• Context Critical Protocol for LLM optimization

A library of 21 Claude Code skills covering security auditing (OWASP, supply chain, IaC, logging, prompt injection), DevOps validation (K8s hardening, CI/CD, Dockerfile linting, monitoring), code quality, SEO/GEO analysis, and documentation generation.

• 7 security skills: secrets, OWASP, IaC, logging, supply chain, prompt injection, GDPR/SOC2
• 4 DevOps validators: K8s hardening, CI/CD linting, Dockerfile audit, monitoring config
• Script + prompt hybrid architecture, reusable across all projects via symlinks

Production-ready Flask REST API for managing, composing, versioning, and sharing AI prompts. Features a fragment system with typed prefixes, slot registers, webhook notifications, and a full CLI tool with clipboard integration.

• Fragment system: 5 typed prefixes (persona, context, task, format, constraint)
• Automatic versioning with restore, bulk operations, usage analytics
• API key auth with SHA-256 hashing and per-key rate limiting

Kubernetes-native stock monitoring agent that tracks prices, news feeds, and social media to provide AI-powered analysis and alerts. Features backtesting framework, cross-stock correlation, and sector rotation detection.

• Multi-source data: Yahoo Finance, Finnhub, 30+ RSS feeds, Reddit
• AI-powered sentiment analysis, anomaly detection, and market regime classification
• Backtesting with Sharpe ratio, max drawdown, and win rate metrics

Full home lab environment: 3-node K3s HA cluster with ArgoCD App-of-Apps GitOps, MetalLB, Longhorn distributed storage, cert-manager, and kube-prometheus-stack. Hosts 15+ GitOps-managed applications — including several of the projects on this page.

• 3-node K3s HA (etcd quorum) on Hyper-V, tolerates 1 node failure
• ArgoCD App-of-Apps: platform services + workloads, all declaratively managed
• Longhorn 3-replica storage with S3 backup + NFS for shared access
• Full observability: Prometheus, Grafana, Alertmanager

Visual timeline-based task management application with a year-at-a-glance view. Features an innovative horizontal scrollable SVG timeline with task density visualization, smooth infinite scrolling, and interactive day/task panels.

Retro-styled FTP client for connecting to FTP servers and transferring files and folders. One of my early Python projects demonstrating network programming fundamentals.

Security application for encrypting files with 128-bit encryption. Generates password-protected decryption keys for secure online communication and offline storage.

Backup utility that transfers files to alternative storage devices with compression to save disk space. Practical tool for personal data protection.

Utility for converting image formats and resizing images for web use. Batch processing capabilities for handling multiple files.

Credential management application using a single master password for multiple sites and email accounts. Early exploration of security-focused development.

Text processing tool for removing duplicates, filtering by word length, and splitting large files. Useful for security research and data processing.