Projects

Each case study follows the same structure: the problem, the existing state, the constraints, the options considered, the decision, the safeguards, the outcome, and what I’d change next time. Employer work is generalized; code shown is public or recreated from scratch.

Case studies

gh-baseline: the required checks that accepted any source — A gh extension that reports where repositories drift from a declared security baseline. I built it in Go, a language I don’t work in day to day, with an LLM writing most of the code, and the judgment mattered more than the language. (Governance should enable engineers, Testing comes before trust, Automation must reduce risk, Documentation is engineering work)
Keel: the retry that could send one alert four times — Why “retry on server errors” isn’t safe for a request that can’t be repeated, and the redesign that makes a PowerShell mail library resend only when Microsoft Graph provably refused the message. (Automation must reduce risk, Testing comes before trust, Documentation is engineering work)
Email alignment checker — A scheduled GitHub Actions workflow that monitors this domain’s mail authentication records — and the three iterations it took to make it quiet, honest, and self-sustaining. (Automation must reduce risk, Reliability is a feature, Testing comes before trust)
Making this site faster on mobile — A PageSpeed mobile score of 86, three things the page was loading that it didn’t need, and the measurements that showed removing them changed nothing visible. (Testing comes before trust, Modernize incrementally)

Open source

gh-baseline — read-only gh extension in Go that audits GitHub repositories against a tiered security baseline: rulesets and where required checks come from, secret scanning, and workflow hygiene. Anything it can’t read is reported as unknown, never pass.
Keel — PowerShell modules for unattended automation, CI-tested on Windows PowerShell 5.1 and PowerShell 7: bounded HTTP retries and Graph-first mail that won’t resend after an ambiguous failure.
Email alignment checker — scheduled GitHub Actions workflow that monitors SPF, DKIM, and DMARC for this domain and commits only when something actually changes.
LinuxConfig — modular Bash pipeline that bootstraps RHEL hosts into Active Directory and Red Hat Satellite, with dry-run mode on every stage and bats + ShellCheck in CI.
adaptive-comm-tool — Python CLI that uses Claude to score and rewrite a message for each teammate persona, with output validated against a schema so no persona is invented or dropped.