Selected Work
One open repository, three production systems.
invoice-assistant
A reference implementation of the four pieces, in the open.
- Tool calling with propagated identity: tools reach the domain through the app's own REST API carrying the user's token, so the assistant can never do more than the person using it
- Writes are proposed, not executed: structured policy in policies.json, human confirmation, and per-turn limits that stop prompt injection from chaining calls
- Evals run in CI against a real model; a one-line prompt regression turns the pipeline red
- Tokens, euros and latency metered per model call, behind a daily spend kill switch
Eval cases
36 in CI
Write gate
Server-side
Spend
Daily cap
Platform Re-Architecture
Moving a legacy monolith to cloud-native.
- Split the monolith into domains that deploy independently
- Moved communication between them onto Kafka, so one service failing no longer fails the request
- Reduced regression testing time from days to minutes
Deployment
Daily
SLA
>99.95%
Pipelines
30+
Cost & Performance Optimization
More throughput on a smaller bill.
- Rewrote the queries and indexes that dominated the load
- Put Redis in front of the reads that repeated most
- Sized the Kubernetes requests to what the pods actually used, and let autoscaling take the peaks
Throughput
15k+ msg/min
Regions
Multi-region
Reliability and On-Call
From firefighting to predictable reliability.
- Defined SLOs and measured the services against them
- Built the dashboards around those SLOs
- Automated the routine steps of incident response
MTTR
<30m
Monitoring
New Relic