Systems integration engineer. I build backend and full-stack systems that have to hold up under real constraints — auth, data integrity, delivery guarantees, observability — and I write them up honestly, including what's not done yet.

I contribute to projects I actually use or read the code of, not for the sake of a commit graph. Two recent ones below go deep enough to be worth reading even before they're merged — the engineering is the point, not the merge button.

Bifrost is an LLM gateway; providers are configured with a network_config.base_url. My PR added support for resolving that field from environment variables and vault secret references instead of only plain strings, so a base URL can be swapped per environment without editing the provider config itself.

What made this worth doing carefully: the review caught six real findings before it was done, two of them security issues — including a case where an unresolved secret reference could silently fall through to being used as a literal URL instead of failing closed. I addressed all six, including both security findings, and the PR passed CodeRabbit's review clean with zero actionable comments on the final revision.

Status: open. Rebased onto the latest dev and re-verified green; the maintainer's human re-review is still pending. I'd rather show a PR that survived a real review pass than one that merged on the first try.

A small, focused feature PR against authlib's OAuth/OIDC client library. Clean diff, clean merge state, no dependency or API surface expansion beyond what the feature needs. Authlib's maintainer bandwidth is limited — this one's been waiting on a first look, which is normal for the project, not a signal anything's wrong with the change.

• hookdeck/outpost — working with the maintainers on adding an AWS EventBridge destination (issue #201): scoping the config shape (credentials, region, event source/detail-type mapping) against their existing destination conventions before writing the implementation.
• Smaller contributions and issue triage elsewhere, as I find things worth fixing.

Six self-contained repos, each built to show a different slice of real-world engineering — auth, distributed delivery guarantees, applied ML, or a live data pipeline — rather than one big portfolio piece trying to do everything at once. Every README documents what's not done yet.

• BriefGenerator — Flask API that turns source documents into branded PDF briefings, with OAuth2/JWT auth and an OpenAPI schema built for use as a Custom GPT Action.
• OpsDesk — a Next.js/ TypeScript internal-tools console (ticket dashboard, background job runner, utility toolkit) with role-gated session auth and full test coverage.
• WebhookRelay — a webhook delivery service in Go: Postgres-native queue (River), HMAC signing, retries with dead-lettering, and replay, with the API and worker as independently observable processes.
• frameforecast — a FastAPI + React app that estimates gaming FPS from hardware and mod choices using a scikit-learn regression model, with explicit feature-importance output and an "estimate, not simulation" framing.
• gitticker — a live dashboard for public GitHub activity: a TypeScript/Express backend polling the Events API with ETag caching and backoff, fanning out to a React frontend over WebSocket.
• linkpulse — a link shortener with click analytics, built on FastAPI and Postgres, with optional accounts for claiming and tracking links.

I document tradeoffs and known limitations in-repo rather than papering over them — every project above has a "what's not done" or "roadmap" section, and I keep them current as I do follow-up work. If you want to see how I think through a design decision under review, the bifrost PR above is a good place to start.