Least privilege. Maximum curiosity.
Curious by nature, paranoid by profession. This is where I think out loud - security research, cloud experiments, postmortems, and the occasional personal detour. Every star up there is an entry; hover a tag to find its constellation, or browse the whole sky below. The portfolio lives under Projects.
Bringing Google Workspace under Terraform with zero stored keys hit three live faults in one day, and every one of them failed closed with an error that pointed at itself.
978 tests, months of maintenance behind them, a standing mention in every PR description, and not one execution in CI across the life of the repo. Adding the gate exposed 94 latent failures nobody had ever seen.
I scheduled a KMS key deletion with a 30-day window and broke every CI init in the org within seconds, because scheduling IS disabling and four state files were still encrypted under it.
Engram's memory was filling up with session summaries and PR announcements, so now there's a bash script that hangs up on the model when it tries.
Eight years in one place, and the hardest part wasn't leaving - it was admitting I needed to.
An AI agent autonomously deleted my AWS SSO instance during a greenfield identity migration, and the cascading failures taught me more about agentic guardrails than any documentation could.
How I unified Gemini CLI and Claude Code into a single high-integrity environment with autonomous background auditing and organic memory.
How I built a personal memory layer for Claude Code in a weekend - the architecture decisions, the wrong turns, and what the collaboration actually looked like.
Building a reusable KMS CMK module with enforced rotation, admin/user separation in the key policy, and sensible prod defaults.
Building a reusable S3 module that defaults to locked down: SSE-KMS, Block Public Access, access logging, versioning, and a bucket policy that enforces TLS.
Building a reusable WAF WebACL for CloudFront with managed rule groups, rate limiting, geo-restriction, and full request logging to S3.
A one-line CloudFront change triggered a cascade of IAM permission failures, exposed an architectural design flaw in how CI/CD roles were managed, and required a full workspace refactor to resolve correctly. This is the honest account of what went wrong, what was tried, and what the right answer actually is.
A four-layer defense-in-depth pattern for Lambda-to-API Gateway calls across AWS accounts - zero public internet exposure using Interface VPC Endpoints, Security Group peering, endpoint policies, and SigV4 authentication.
End-to-end walkthrough of setting up a full dev environment inside WSL2 - from a bare shell through ZSH, Claude Code, Git and GitHub CLI, and the Terraform and Node.js toolchain.
A complete walkthrough of building this site in a single session with Claude - infrastructure, accessibility gotchas, the knowledge graph, and an honest accounting of what the AI got wrong.
