I build deterministic full-stack applications, human-in-the-loop (HITL) agentic workflows, and fault-tolerant API integrations. My engineering methodology focuses on replacing fragile AI improvisation with strict state machines, cryptographic webhook verification, typed schema contracts (Pydantic/Zod), and reproducible test suites (800+ automated tests shipped).

• Human-in-the-Loop (HITL) Multi-Agent Operations Platform: Full-stack orchestration engine (TypeScript, React, Node 24) featuring task runtime recovery, multi-party transaction rooms, pipeline attribution, and strict approval gates. Verified across 600+ automated web tests and 15 analytics suites.
• B2B Commercial Procurement & Document Discrepancy Engine: Automated multi-document diffing engine comparing supplier quotes, purchase orders, and confirmations across pricing, freight, incoterms, and specifications with confidence scoring. 100% detection of 20 critical discrepancy cases across a 60-pair synthetic benchmark.
• Encrypted Bilingual Professional Matching Platform: Bilingual (EN/ES) matching engine with automated credit-reservation lifecycles, encrypted messaging, RBAC admin queues, and Stripe webhook billing. Verified via 166 automated unit/integration tests and 26 Playwright E2E browser journeys.

flowchart LR
    A[User or webhook input] --> B[Authentication and schema validation]
    B --> C[Deterministic state machine]
    C --> D{Sensitive action?}
    D -->|Yes| E[Human approval queue]
    D -->|No| F[Execution and audit ledger]
    E -->|Approved and scope unchanged| F
    E -->|Blocked or expired| G[Structured fallback and recovery]

The diagram summarizes a shared design approach. Provider-specific webhook signatures, human identity, tenant scope and approval consumption are enforced at their respective boundaries.

Public architecture showcases expose synthetic contracts and independently authored utilities while retaining commercial implementations privately.

• b2b-procurement-discrepancy-benchmark
• encrypted-bilingual-matching-architecture
• hitl-agent-operations-architecture

• The Most Important AI Product Feature May Be the Next Action
  • Core Thesis: Why production AI systems and tool-calling agents must emit structured next-action recovery contracts and deterministic state transitions rather than raw text when operations fail.
  • Linked Proof: ForgeFlow AI Automation & HITL Multi-Agent Platform
  • Companion repository: forgeflow-ai-automation
• AI Agents Are Becoming Economic Systems
  • Core Thesis: Designing bounded agency, conversation/credit reservation lifecycles, and mandatory human-in-the-loop (HITL) financial authorization gates in B2B workflows.
  • Linked Proof: Encrypted Bilingual Matching Platform (credit reservation lifecycle) & B2B Document Discrepancy Engine
• When Completed Is Not Complete
  • Core Thesis: Preventing silent downstream data corruption in asynchronous batch APIs when transport-level HTTP 200/"completed" flags mask partial item failures or truncated pagination.
  • Linked Proof: olostep-integration-reliability-lab (9 deterministic async failure scenarios)
  • Companion repository: olostep-integration-reliability-lab
• A Valid Signature Is Not Replay Protection
  • Core Thesis: Why cryptographic HMAC-SHA256 verification alone is insufficient without signed timestamp tolerance windows, persistent event identity ledgers, and atomic database rollbacks.
  • Linked Proof: webhook-trust-lab (39 deterministic security tests)
  • Companion repository: webhook-trust-lab
• Turning Security Evidence into Developer Action
  • Core Thesis: Bridging the gap between static OpenAPI/security claims and runtime verification using reproducible claim ledgers and explainable contract diagnostics.
  • Linked Proof: dx-orbit & hookforge-sdk
  • Companion repository: dx-orbit
  • Companion repository: hookforge-sdk

• webhook-trust-lab (Python / SQLite / AppSec): Deterministic webhook security reference architecture enforcing HMAC-SHA256 verification, signed timestamp replay windows, concurrent delivery locking, and atomic SQLite rollbacks (39 deterministic tests, 9 failure scenarios).
• olostep-integration-reliability-lab (Python / Async APIs): Asynchronous batch-processing and fault-recovery harness handling polling, pagination, partial dataset failures, and idempotent retries across 9 offline failure scenarios.
• dx-orbit & hookforge-sdk (Python / TypeScript / OpenAPI): Explainable OpenAPI contract gap analyzer and type-safe TypeScript SDK generator enforcing predictable API error contracts.
• signalos-developer-experience-platform (TypeScript / React / Node 24 / Zod): 5-application ecosystem (MailTrace DX Lab, ClearRoute API, ForgeFlow, AccessPath Console) testing out-of-order events, RBAC state transitions, and accessible error recovery.

Stack: Python FastAPI TypeScript React Next.js Node 24 SQLite Pydantic Zod Playwright Vitest Pytest Docker GitHub Actions

I build software and write the documentation that makes it usable. My work connects API contracts, SDK behavior, failure recovery, application security, and the decisions developers need to make along the way.

My approach starts with a working example: reproduce the behavior, test the difficult paths, explain the tradeoffs, and give the reader a clear next step. The result is a body of independent projects with source code, tests, technical reports, and walkthroughs you can inspect together.

Portfolio · Engineering evidence · LinkedIn · Medium · Contact

For a five-minute review, choose one question, open its walkthrough, then compare the explanation with the implementation and tests. For the broader product architecture, explore SignalOS below.

• Technical Work Is a Form of Translation — moving between code, product, operations, and human judgment.
• The Hidden Economics of AI Automation — examining why faster is not necessarily better.
• The Most Important AI Product Feature May Be the Next Action — making explanations useful at the moment a reader needs to act.

Read more on Medium →

Two independent case studies connect code, tests, recorded walkthroughs, and technical writing. Each article is available online and as a designed PDF.

• A Valid Signature Is Not Replay Protection — Technical article.
• From Signed Request to Safe Processing — Research brief.
• Turning Security Evidence into Developer Action — Editorial practice.
• When Completed Is Not Complete — Case study.
• Recovery Without Duplicate Work — Engineering deep dive.
• Document the Decision — Developer education.

SignalOS — The Developer Experience Reliability Platform

One payment-launch investigation connects contract findings, an outdated quickstart, timeout recovery, duplicate protection, agent approval, policy replay, and an exportable evidence trail.

• Analyze OpenAPI contract gaps and supported breaking changes.
• Reproduce local HTTP failures; retry a committed operation without duplicating it.
• Inspect HMAC verification, replay windows, and synthetic event ordering.
• Require an expiring, argument-and-policy-bound approval before a simulated financial action.
• Preserve investigation history in SQLite and export Markdown, JSON, HTML, or CSV.
• Inspect estimated economics with explicit inputs; unknown costs remain unknown.

Working local MVP: React, TypeScript, Node 24, SQLite, 44 behavioral tests, desktop/mobile browser checks, and GitHub Actions. The broader platform is a documented roadmap; the current SDK, documentation, and economics features support the payment scenario.

Case study and console preview · Architecture · Engineering article · Verification

Webhook Trust Lab follows an event from HMAC verification and signed timestamps to persistent event identity and an atomic SQLite-local effect. Inspect 39 deterministic tests, concurrent delivery, rollback, a threat model, and nine recorded scenarios. Case study and walkthrough.

Olostep Integration Reliability Lab makes asynchronous batches, polling, pagination, partial results, and recovery explainable. Nine offline scenarios accompany a sanitized two-URL live compatibility check. Case study and walkthrough.

Both are independent reference projects. Local security behavior and a bounded live compatibility check do not establish production adoption or exactly-once remote effects.

• Technical Portfolio / Signal Engine: a React/TypeScript review experience connecting project narratives, actual application previews, public source, tests and implementation boundaries. Visit the website.
• Portfolio Assets: the supporting visual asset repository for the portfolio.

• Make inputs, state transitions and failure paths explicit.
• Validate before acting; keep permission and approval decisions inspectable.
• Test recovery, malformed requests and duplicates alongside the happy path.
• Keep measured behavior, estimates, assumptions and synthetic fixtures distinguishable.
• Document what runs today and what production operation would still require.

Working stack: TypeScript · React · Node.js · Python · FastAPI · Pydantic · Zod · REST/OpenAPI · JSON Schema · SQLite · pytest · Vitest · Playwright · Docker · GitHub Actions

Evidence boundary: These are independent engineering projects. Simulated payments, agent execution, feedback and onboarding sessions are labelled. Forecasts are not measured savings; tests and local verification do not imply production adoption, scale, authenticated security or customer outcomes. Each repository documents its own implemented scope and limitations.