What the last few weeks have actually been spent on, read from the commit history every fifteen minutes. The subjects are grouped; the names stay private.
4,971 commits across 176 private repositories.
30% of them went into platform & business applications and web platforms & sites.
Most of the work is about infrastructure & deployment, native apps and testing & quality.
Read from commit messages and grouped into a fixed set of subjects — the messages themselves, and the names in them, stay private.
I design, build and operate a private production estate end to end — architecture, code, infrastructure, security and release engineering. Client and product names are withheld; the engineering is described below.
A five-node Linux server estate running more than twenty production web applications. Relay-based remote execution independent of inbound SSH, content-addressed resumable multi-gigabyte transfers with full SHA-256 verification, immutable releases and recorded rollback state for every deployment.
ERP with double-entry general ledger, CRM with workflow automation, file storage on S3-compatible object storage, real-time chat, video meetings over an SFU, webmail, time and attendance, and a shared identity service — one estate, many tenants.
A full identity provider: OIDC/OAuth2 authorization server with PKCE and RS256, a SAML 2.0 service provider hardened against XSW, XXE and replay, SCIM 2.0 auto-provisioning, and passwordless FIDO2/WebAuthn passkeys — built on the standard library rather than a vendor SDK.
Schema-per-tenant separation for the business applications and PostgreSQL row-level security for the shared ones, with the tenant GUC set at a single authentication chokepoint and FORCE row security so even the table owner cannot read across tenants.
Local LLM inference with per-organisation retrieval-augmented generation over pgvector embeddings, so tenant content is never sent to a third-party model API. Plus a cross-application copilot and rule-based assistants where a model is not warranted.
A browser-based 3D world with vehicle dynamics, physics, day/night simulation and multi-user presence — including draw-call reduction work, GLB asset pipelines, collision and surface-continuity audits, and GPU shader program validation against a hard frame-time budget.
CRDT co-editing over a WebSocket relay with scoped HMAC tokens, behind a suite of document, spreadsheet, presentation, PDF, forms, whiteboard and diagram editors sharing one portable engine core.
The same product surfaced as native applications across platforms — Kotlin and Jetpack Compose on Android, .NET 8 WPF and Qt 6 C++ on Windows, plus packaged desktop builds — with signed releases, in-app updates and CDN distribution.
Point-in-time recovery with WAL archiving and mutual TLS streaming standbys between hosts, encrypted off-host backups with validated catalogs, health probes, and documented failover procedure — designed so recovery is rehearsed, not improvised.
A cloud service that validates, stores and dispatches G-code to networked machines, and a six-axis motion controller on STM32H743 with grblHAL, a Wi-Fi co-processor link and Modbus spindle control — cloud and firmware on the same project.
Digital elevation models from LiDAR point clouds and from synthetic-aperture radar, GPU hillshade and colour-relief rendering for interactive terrain, custom QGIS tooling, a Windows port of a Linux GIS stack, and GPU-backed Kubernetes for the processing workloads.
A GIS workspace and a navigation product on one backend: a 16,000-line web map application, native Android and Windows clients, a navigation engine that keeps a moving vehicle steady on its route, an India-focused geocoder over OSRM, and consent-gated telemetry feeding live traffic.
Per-application credential isolation in systemd units, a WireGuard VPN for administrative access, automated TLS issuance and renewal across dozens of hostnames, least-privilege service users, and hands-on incident response including a live web-shell compromise.
Services that compile and run untrusted code submissions under isolation, across several languages, with per-run resource limits — plus a small compiler toolchain of my own. Running arbitrary code someone else wrote is a containment problem before it is a language problem.
Session-integrity monitoring for remote assessment: camera and behaviour signals scored continuously to flag anomalies rather than accuse. The same detection and tracking discipline as the industrial inspection work, applied where a false positive costs someone their result.
Automatic speech recognition running on my own hardware, so audio is transcribed without leaving the estate — the server-side counterpart to the on-device voice-to-text work in the vehicle cabin.
A durable job and workflow engine with a separate worker pool: long-running tasks survive a restart, retry on their own terms, and report progress rather than disappearing. The unglamorous layer everything else depends on.
Verification agents running on every host in the estate: visual regression polling, release qualification and health verification, so a release is gated on measured evidence rather than on someone remembering to check.
A data and API layer with its own admin console — schema, auth, storage and generated endpoints — so a new application starts from a working backend instead of rebuilding the same foundations again.
Current work, with its honest status. Shipped means in production and in use; in build means the feature exists but its acceptance gate has not passed yet; held means it is finished and waiting on a decision that is not mine to make.
A hiring platform with staged assessments — the first stages are live and in use. Remote proctoring is the stage in build: session integrity is the part that has to be right before anyone relies on a result.
A multiplayer WebGL world on a continuous release train — terrain, roads and rivers, vehicle handling, animal and NPC behaviour. Every release has to clear a measured frame-time gate against a concurrent-client target, and a release that misses it does not ship.
STM32H743 running grblHAL with a Wi-Fi co-processor over USART and Modbus spindle control. Firmware and motion tuning in progress; the cloud service it reports to is already live.
Validates, encrypts, stores and dispatches G-code to networked machines, with two-factor access and object storage behind it. Complete and running; the payment path stays deliberately closed until the gateway webhook is verified end to end.
Video-backed course platform with DRM-protected offline downloads, refunds and ticketing. Pre-launch: the software is qualified, the remaining gates are commercial and legal rather than technical.
Per-site registration, email verification and administration for a fleet of independent sites. Piloted on one site and working; the roll-out across the remaining sites is the outstanding work.
Desktop and mobile clients for the accounting and operations applications, built to work with no connection and reconcile afterwards. Built and tested, held back from release pending a device-qualification pass — shipping an untested build is not a trade I make.
Grouped by family and consolidated from surveys of all five servers, the local project archives and the operations record. Titles describe the work; product and client names stay out.
Multi-tenant business applications behind one identity provider.
One identity provider in front of a whole suite of applications: an OIDC/OAuth2 authorization server, a SAML 2.0 service provider, SCIM 2.0 provisioning, passkeys, organisation billing and a shared help desk — written against the standard library rather than a vendor SDK.
A browser ERP for small Indian businesses: sales, purchasing, inventory, payroll and a double-entry general ledger, with every tenant in its own database schema so isolation is a property of the database rather than of the code.
Leads, contacts, accounts, deals and reporting with rule-driven automation and a telephony hook, run as a primary/secondary pair behind the proxy.
An IMAP-backed webmail client with labels, scheduled send and rules, on top of a mail server run in house for several domains — SPF, DKIM and DMARC published and verified per domain.
Client-side-encrypted team chat and browser video meetings over a selective forwarding unit on two media nodes; both run as high-availability pairs on immutable releases with drift detection.
Folders, sharing, versions and resumable uploads on object storage, with a desktop sync client and a written disaster-recovery runbook that has been exercised.
Attendance, leave and payroll inputs with a public API-key system, and an eighteen-step hire-to-pay chain in which each step is blocked server-side until the one before it is complete.
The parts every application needs exactly once: plan checkout and subscription activation, a tax-invoice renderer, a central help desk embedded in eight applications, guided product tours on thirteen, and tenant onboarding.
Visitor chat on the public sites routed to a native Android operator app, with a messaging-platform bot and server-side guards on the bridge.
A Windows remote-support foundation built on an explicit consent model, and self-service WireGuard provisioning for the estate.
Documents, sheets, slides, PDF and whiteboards on one engine core.
A word processor with reflow pagination, a spreadsheet engine, a presentation editor and PDF tools on one engine core, with real-time co-editing over WebSockets and the same core inside native shells.
A diagram editor that imports the common desktop diagram format, a collaborative whiteboard with timers, voting and stamps, per-user notes and a form builder.
Each product delivered as a native application on the platforms it is asked for — written against the platform toolkit rather than wrapped in a browser — and distributed through an in-house store with signed packages.
The services other products are built on: backend, workflow, QA, work management.
Databases, authentication, storage, functions and hosting as a service: functions run in containers, vector search and GraphQL sit on the same data, and billing is self-serve.
An issue tracker, a wiki, a service desk and a workflow-automation engine that share one link graph, so a ticket, a page and an automation refer to each other by contract rather than by URL.
Staged technical assessments for hiring. The first stages are live and in use; remote proctoring is the stage still in build, because session integrity has to be right before anyone relies on a result.
A programming language whose keywords and errors are in Tamil: a native compiler written in C11, a sandboxed web playground, and a language that reaches classes, inheritance and exception handling.
A household device-policy service with a web console, run on the same identity and release machinery as the business suite.
Thermodynamics, terrain analysis, parametric design and drafting — tools an engineer signs off.
The engineering tool for a grain-cooling chiller line: vapour-compression cycle modelling against real refrigerant property data, psychrometric and load calculations, equipment selection and the sizing reports an engineer has to sign.
A parametric design service that generates parts and documents from parameters, and signs the provenance of everything it produces so an output can be traced to its inputs.
A self-contained two-dimensional drafting application that runs entirely in the browser.
Desktop tools over digital elevation models: elevation-model generation from LiDAR, GPU hillshade and marching-squares contouring, kriging interpolation, and viewshed, line-of-sight, bistatic and height-based coverage for radar and radio planning.
Two-sided marketplaces, course delivery, storefronts and the payments around them.
A video course platform with DRM-protected streaming and offline download, refunds, ticketing and mail. Software-qualified; the remaining gates are commercial and legal rather than technical.
A two-sided marketplace with escrowed milestones, wallets, commission tiers and identity verification on an exact-arithmetic ledger. Live milestone funding stays gated until settlement is reconciled end to end.
A commerce backend with a content-publishing pipeline, payment and shipping integrations, streamed video and a typed front end.
A shop and learning site for makers, generated to static pages from structured content, with search-console and video-channel automation running on timers.
A battery storefront with an admin console and an operations application alongside it.
A carbon-accounting service with per-organisation isolation on PostgreSQL.
An inventory API and catalogue agent behind a storefront, with Android and desktop clients in the same repository.
A dozen public sites kept as reviewable source and moved between hosts and hostnames without breaking a link: path-preserving redirects, per-destination certificates and rollback material for every migration.
A learning portal on observatories, planets and orbital mechanics, with interactive models.
An illustrated world-history site for children with graded learning applications behind it; its releases are immutable asset trees served from the CDN.
Motion control, board firmware, PCB tooling and the machines themselves.
An STM32H743 running grblHAL with a Wi-Fi co-processor over USART and Modbus spindle control; one board definition serves eleven machine kits.
Validates, encrypts, stores and dispatches G-code to networked machines through a command queue, with two-factor access; desktop and Android clients are distributed from a geo-replicated CDN zone.
A catalogue of eleven machine kits in which every bill of material is a data module, so prices, quantities and the 3D model brief are generated rather than typed.
A gated web workbench that edits, builds and packages controller firmware, with a knowledge base ingested from the firmware source feeding a modification assistant.
A console for microcontroller boards that dial out to it: a wire protocol of compact lines sized for 32 KB of RAM, interlocked user commands, and over-the-air firmware with the clock pushed from the server.
A board editor and routing engine served as a web application: projects, cloud storage and simulation behind fifteen API tiers, with the engine built and staged per release.
Firmware for an autonomous guided vehicle on STM32, developed against a bench of real boards. Datasheets are ingested into a database of cited facts, and the link step refuses to build until the pin map has been physically verified.
An ingestion API and dashboard for vehicles and bench rigs reporting over the network.
A working library of schematics, layouts and fabrication outputs, including a Cortex-M4 controller board taken to Gerbers.
Map workspaces, terrain analysis, routing and turn-by-turn navigation.
A map workspace that puts 2D maps, a 3D globe and terrain, drawing and measurement, weather, sun and moon, and live aircraft, ship and traffic layers in one place, on self-hosted tiles and its own accounts.
A navigation engine — route projection, damped heading, re-routing and road-named voice guidance — shared by native Android and Windows clients and a 3D world view.
Multiplayer worlds in the browser, held to a measured frame-time budget.
A server-authoritative WebGL city on a continuous release train — roads and rivers, vehicle handling, flight, a day/night clock and resident behaviour. Every release must clear a measured frame-time gate; one that misses it does not ship.
An original building-and-survival game with nine civilisation stages and a shared credits ledger, taken from first release to fifty-one versions in eight days.
A real-time arena game on the surface of a sphere, with gravity wells and a vacuum mechanic, run as four small workers behind one origin.
The control plane, release engineering, backups and observability underneath everything else.
Architecture, code, infrastructure, security and operations for the whole estate: virtual hosts, services, timers, databases and certificates across five Linux servers, surveyed into a database rather than remembered.
Remote execution that needs no inbound port: workers dial out to a relay and hold the line, so a blocked or banned SSH port changes nothing. Version 2 added resumable multi-gigabyte transfers with content addressing.
Immutable timestamped releases with recorded rollback state for every deployment, three independent backup layers, more than thirty uptime monitors, and restore drills that are actually run.
One storage zone and one pull zone per project, recorded in a registry, with a publishing tool that refuses a path outside the project's prefixes and verifies every upload by SHA-256 through the CDN.
Self-hosted models, autonomous QA and planning agents, evaluation design.
A testing console with a two-pass sign-off gate, a scheduler that plans each tester's day, and agents that generate, execute and triage cases — deny-by-default, so an agent can never pass its own work.
A canonical store of what the estate is and what changed, curated every few minutes, with a planner that may propose work but never execute it, and monitors for mail and SSH reachability.
A mixture-of-experts model served locally on consumer hardware and relayed to the estate, so tenant data never leaves it.
A native Android application that drives coding agents on remote workers through the control plane, behind a single-user gate.
Work whose result is a finding rather than a product.
A phone-only research platform for sensing with Wi-Fi channel-state information: a native Android recorder and on-device trainer, an independent PyTorch implementation of a published method, and a paired web console. No trained pose weights are claimed.
A prototype computing fabric made of identical simple cells rather than a layered neural network, with a visualiser.
CAD, 3D printing and the mechanisms that come off the bench.
A twelve-servo quadruped designed in CAD through two iterations, from leg linkage to body shell.
A tendon-driven hand and a head assembly designed for printing.
Four years of printed parts — brackets and mechanisms, a wearable helmet, and the fixtures the other projects needed.
Drive-train sizing and wiring for a small electric vehicle, and a parametric propeller modelled in CAD.
The projects behind the career timeline.
Designed transformers and reactors to customer specification up to 5 MVA and 33 kV — winding and core-cutting instructions, oil and cooling calculations, and the drawings production built from.
Designed and built domestic and industrial robots and ran the training side of the business; boards went from schematic to etched copper in house.
Currency authentication and oil-seal inspection systems, a 600 kg material-handling robot, and a six-degree-of-freedom biped for radiation survey — the last of which was published.
GPU-accelerated deep learning for retinal layer segmentation, real-time 3D reconstruction in OpenGL, and the Qt application clinicians used every day. Included two international onsite engagements.
Led the team building surround-view 3D visualisation, obstacle rendering and a natural-language voice interface on automotive silicon, owning performance across CUDA, OpenGL ES and the model.
Designed and peer-reviewed GPU-programming evaluation tasks used to train and benchmark frontier language models: explicit inputs, constraints, objective acceptance criteria and validated reference solutions.
Read from a private Postgres record built from server surveys, project archives and the operations log. The evidence behind it carries real names, and this site's database role cannot read it — only the public titles and summaries shown here.
The independent work above is not a handful of demos. This is what it adds up to in version control — queried from the inventory database, not typed out here.
Everything I build on my own account is under version control, and every repository is private. They stay that way: the clients, products and domains behind them are not mine to publish.
What the count is for is shape and scale — the breadth of subjects below, each one carried from an empty repository to something running in production, and the languages that came with them. The languages were chosen per target rather than per preference: Kotlin and Swift because the phone demanded it, C and C++ because the microcontroller did, Python because the server did.
The same product delivered as a native application on every platform it is asked for — Android, Windows and Apple — each written against its own toolkit rather than wrapped in a browser.
Identity and single sign-on, resource planning, customer management, mail, chat, meetings, file storage, attendance and payroll: multi-tenant services with per-organisation isolation enforced in the database itself.
Production web estates kept as reviewable source — server-rendered sites, custom plugins, build pipelines, and the deployment paths that put them live.
Two-sided marketplaces with escrowed milestones, wallets and commission tiers, identity verification, and a course platform with DRM-protected offline video.
Everything that does not sit neatly in one of the groups above.
Motion-control firmware on STM32, a CAM path from mesh to G-code, machine platform design, in-house electronics kept as reviewable text, and telemetry coming back off the boards.
A dial-out control plane that survives the loss of inbound SSH, a WireGuard VPN, mail-server infrastructure, per-site authentication, and the runbooks that make recovery a procedure rather than a memory.
Documents, spreadsheets, slides, PDF, forms, notes, whiteboard and diagrams: one engine core behind web and native shells, with real-time collaborative editing.
Vector map services, geospatial processing tools, and native mapping clients with offline tiles and turn-by-turn navigation.
Industrial chiller design against real thermodynamic property data, GPU capability analysis with offline fine-tuning, and a parametric design platform that signs the provenance of everything it generates.
Self-hosted language models with per-tenant retrieval so nothing leaves the tenant, an on-device inference client, and a testing console driven by an agent rather than a script.
A multiplayer 3D world with server-authoritative state and delta-compressed networking, and 3D-print commerce built on the same rendering stack.
Alongside them, in markup, styling, shell and build files: HTML (92) · CSS (68) · Shell (46) · CMake (24) · PowerShell (22) · Inno Setup (12) · Batchfile (8) · Assembly (5) · SCSS (3).
Figures are read from a private Postgres inventory refreshed from the source control API — repository names and descriptions never leave it. Inventory last refreshed 2026-11-02 09:17 UTC.