A technical read on what I've built

The gate is real: the deployed sleeve failed its own pre-registered acceptance battery and was retired, with the due-diligence record written up making no forward performance claim.

Risk metrics (Sharpe, Sortino, max-drawdown, VaR, Kelly) are implemented twice, once in pure Elixir and once as matching Rust NIFs via Rustler, so the hot path can drop to native code without changing the calling contract.

It runs the whole thing on its own. In one unattended run it cloned three strategy repos, pulled 12 strategies off Freqtrade's dependency graph into a self-contained pandas/TA-Lib engine, backtested and ranked them, and spat out production strategy files plus a 16-strategy by 6-pair deployment script.

A governance-first architecture where a hard-coded "Master Constitution" priority hierarchy (Mac hardware protection → loss prevention → user obedience → profit → stability → learning) sits above every module, including the risk manager, so safety constraints can't be overridden by profit logic.

I validated the edge honestly. Under 5-fold walk-forward on fresh Hyperliquid data, only the Donchian trending leg cleared an out-of-sample Sharpe above 0.5 (+0.88), so the two unproven legs are switched off by default in the code (EDGE_VALIDATED_MODES = {"trending"}) instead of shipped as decoration.

Every trained policy has to pass a rolling walk-forward gate (60-day train / 30-day out-of-sample, 3 windows) where it must beat buy-and-hold Sharpe on all windows before it ships, backed by 280 test functions.

A hardened FastAPI proxy layer sits between the public site and my internal trading APIs, per-endpoint rate limits, locked CORS origins, 5s timeouts, and fail-open fallbacks, so the site never exposes the live system directly and never blanks out when an upstream is down.

The report documents a strategy that failed and was shut down, and makes no forward performance claim. It is written to be checked, not to persuade.

I text it on WhatsApp like a person and it acts as my chief of staff, reading my email, calendar, and reminders to keep me updated and running multi-step agentic jobs, all on infrastructure I own.

A single TypeScript control plane that unifies 13+ real messaging channels behind one agent, backed by 1,026 test files across a ~494k-LOC monorepo.

One HTTP endpoint fronts every model my stack uses, it picks the right provider chain per task, auto-fails-over on error, and meters spend so nothing runs away.

Instead of one sycophantic model, a panel of named personas with explicit priors debates each decision, and a mandatory devil's-advocate forces the uncomfortable hypothesis into the open.

A path/host/endpoint trading firewall proven to hold at two independent levels: 187 red-team bypass attacks each closing a discovered hole at the unit boundary, plus a 77-case safety-through-loop suite proving that even when the model itself is tricked into emitting an order, zero effectors fire and subprocess is never invoked.

A defense-in-depth trading firewall that scores 62/62 with zero leaks on the golden set, including all 13 adversarial bypass cases, by folding Unicode confusables, leetspeak, zero-width splitters, and letter-gap attacks down to a normalized form before matching.

Cycle 1 ran end to end on live local data: 8 candidate findings survived an adversarial refuting verifier (which deflated inflated EV estimates to honest bands), surfacing ~135 qualified sales leads sitting cold for 20 days and driving 20 outreach emails that actually got sent.

The safety rules here are code, not prompt instructions, so they hold regardless of which model is running.

A vision agent loop (screenshot to Claude to action) wrapped in real production guardrails. There's a per-run cost circuit breaker, a persistent daily-spend kill switch, a prompt-injection guard, and a wedge detector that trips after 3 identical frames.

Sessions are stored as portable Playwright storage_state encrypted at rest with Fernet, so a login captured on the Mac transfers cleanly to a headless server without shipping fragile Chrome profile directories.

It's self-healing. When a helper the agent needs doesn't exist (say upload_file()), the agent edits helpers.py mid-task, adds it, and carries on, so the toolset grows to fit the task instead of the task bending to a fixed API.

It drives the real web app instead of reimplementing it. Record an action once in your own logged-in Chrome and it captures every network call, works out the volatile fields like CSRF tokens by diffing two runs, then generates a buildable MCP server crate an agent can call.

A working autonomous pipeline that queries the official UK Companies House API across five production-sector search terms, scores and tiers every active company, dedups, and exports outreach-ready CSVs, run hands-free on an hourly overnight cron loop.

Password checks use HIBP's k-anonymity protocol, only the first 5 chars of the SHA-1 hash ever leave the machine, so the tool verifies exposure without transmitting the password itself.

Reverse-engineered an undocumented supplier gateway with no public docs and reconciled ~91,000 SKUs into a live store, idempotently, every night.

An agency run by an AI agent org (CEO, leads, outreach, delivery, ops, auditor) where the entire pipeline is automated and a human only sends, calls, signs, and banks.

The homepage is served as a single self-contained HTML document from a root +server.ts, bypassing the layout and client router entirely so the artifact ships byte-identical to what was designed.

On an adversarial test set of 51 leases and 804 payments with 25 planted defects, it caught all 25 (100% detection) with zero false positives.

The site sells by showing, not telling. It fronts my live-money trading bots as the evidence, backs a $500 audit with a real Stripe checkout, and wires payments straight into Slack and Discord alerts through a working webhook handler.

The real asset is hand-curated UK cancellation playbooks (13 merchants like Sky, David Lloyd, PureGym) that encode each retailer's dark patterns and exact cancel steps, something no API sells you.

The upstream system is real and in production use by Ghostty, and Jordan's fork adds a working CLI-only GitNexus quality gate that blast-radius-checks changed critical paths before they can be pushed.

A polished, fully responsive marketing site in a single ~15KB file with zero build step, used as a live GlideOps sales showcase.

A full self-hosted streaming stack I run on a repurposed MacBook, fronted by a Google OAuth gate so only approved emails get in, with hardware transcoding and a public request portal.

22 pure-Dart engines and 20 Flutter apps in one monorepo, backed by 1,112 tests and a strict 95%+ coverage bar, launching to both stores for ~$124 total cost.

The journal app encrypts everything at rest with AES-256-GCM. Entries are sealed in a self-describing JSON envelope, the key lives in the platform keychain, and decryption throws the moment anything's been tampered with, because GCM authenticates the whole box.

Ten separately-tailored privacy policies, each written to match that specific app's actual data surface (Firebase Analytics, AdMob non-personalized ads, RevenueCat purchases, camera/photos/location) rather than one boilerplate template copy-pasted across the portfolio.

The lazy version of this, a loudness threshold plus last-word matching, is what the free clones ship, and it breaks in any room with a fan. The voice gate and the aligner both needed real signal processing to work.

It closes the loop on itself. An alert email carries the jobs running on that server, one click opens a live process, CPU and network snapshot, and a failed job auto-opens a ticket with the logs, history, and linked metrics attached.

The hardware results carry job IDs and raw shot counts, so the fidelities can be recomputed by anyone who doubts them. An ideal simulator would have returned 500/500 and no off-basis counts.

Replaced a paid dictation subscription with a local build where audio never leaves the Mac, speech is transcribed on-device and only optional text cleanup touches the network.

It gives a headless CLI to an app Epson never shipped a CLI for, by driving the live macOS accessibility UI tree with cliclick and AppleScript, hardened against AppleScript injection through user-supplied printer and path strings.

Most code-graph tools stop at code. This one takes documents, papers, images and video in the same corpus, which is what real research actually looks like.

Every system I run is authored and driven from one machine that treats five servers across three continents as a single private network.

I turned an old MacBook Pro into a always-on Debian server running a Scout agent and the WhatsApp bridge as a lingering system service that survives reboots with no QR re-scan.

One VPS hosts my whole AI backend, the WhatsApp and Discord assistant, the Pulse LLM router, and the n8n automations, all self-hosted so I own the data and the models.

I isolate anything that touches live capital on its own server, so trading runs on a box that does nothing else.

A cheap, fast extra server I use as a jump host and overflow node for the fleet.

Five machines across three continents behave like one private LAN over Tailscale, I SSH to any of them by name, and each carries a dedicated role in the stack.