Things I've built

Every app behind one login. Two-factor is mandatory and enforced at enrolment, so an account cannot exist without it. Sessions are revocable without storing a single token: each one carries the epoch it was minted under, and bumping a counter on the user orphans all of them at once — no session table, no denylist to prune.

Signing moved from a shared HMAC secret to RS256, because with a shared secret the key that verifies a token also mints one — any of the six services holding it could have forged an admin session. The migration runs live: verification accepts both algorithms at once so week-old sessions keep working, and keys carry an id so rotation needs no flag day. An earlier version of that change refused to boot when half-configured, which turned an incomplete migration into an outage; it now derives what it needs from the key it already has.

Five services had each written their own copy of "check this session", which is five chances to get one security decision wrong — and the reason a revocation feature could not be rolled out fleet-wide: none of them ran the same code.

The rule that justifies the package: a valid signature does not mean the caller is logged in. The auth service issues short-lived tokens partway through login, signed with the same key, and accepting one as a session would let a stolen password through and defeat two-factor entirely. The test suite is the specification — anyone writing auth without this package has to satisfy the same cases.

Step sequencer, piano roll, mixer and sample browser built on the Web Audio API, with lookahead scheduling so timing survives the main thread being busy. Sample search is semantic rather than filename matching — an audio-text embedding model indexes the library, so "dark supersaw" finds one.

It talks to FL Studio through its piano-roll scripting API, with a shared pattern document as the source of truth so edits compose in either direction. There is also a MIDI file writer implemented from the specification rather than pulled from a library, which matters more than it sounds: note-off has to sort before note-on when one note ends exactly where the next begins, or the file plays one long stuck note. It is installable to a phone and works offline.

Not a chat wrapper. It plans, calls tools against the actual estate, and reports what it did — file operations, service checks, generating musical patterns that land in the workstation above. The interesting problems are the unglamorous ones: attributing work to the right account when a bot acts on someone's behalf, and making sure a request that fails does not take the process down with it.

Parses a recipe from a URL or a block of pasted text into structured ingredients, then prices it. Some retailers have a signed API; others need a headless browser, which is slower and far more fragile, so the two paths are kept clearly separate.

Most of the real work has been in the data. Ingredients arrived in three different shapes from three eras of the code and 176 rows were invisible because of it. Quantities are stored as text, because "1 ½" and "to taste" are not numbers and the numeric column silently lost them.

Built as a companion to a first-year chemistry text. It draws Lewis structures, balances equations, and reads a textbook PDF looking for one specific thing: places where a figure is quoted in SI and US units that do not actually agree.

The unit scanner is the part with judgement in it. Conversions are read from a single table rather than retyped per call site, and a guard fails the build if the two ever drift apart — a converter that is wrong in one direction only is the kind of bug that survives review. The periodic table was the fiddlier problem: the detail card lives in the table's own empty block, so it has to stay readable from a wide desktop down to a phone at 260% zoom without ever covering an element. That is arithmetic, not taste, and it is asserted against every tile at thirteen widths.

A dual virtual breadboard tied to a real parts inventory and to ESP32-S3 pin rules. The point is to find the mistakes while they are still free — a wire between two holes on the same strip is refused with a reason rather than silently accepted, and the generated firmware carries the pins the project actually assigns instead of a plausible default.

The original build plan was written without access to this platform and several of its load-bearing assumptions were simply wrong — it assumed an OIDC provider that does not exist here. Those corrections are recorded in the repository rather than quietly fixed, because the next person to read the plan will believe it otherwise.

The interesting part is not the planner, it is what happened when it gained multiple users. Rows created before ownership existed had no owner, and the obvious migration — backfill them to the most likely account — risks handing one person's work to somebody else, which is the exact thing being fixed.

So they belong to nobody until claimed, and an admin turning up is treated as proof enough of who was there first. To everyone else those rows do not exist. Asking for someone else's row returns a 404 rather than a 403 throughout, because a 403 confirms the row is there.

Both give every account its own database file rather than a shared table with an owner column. It is the less fashionable choice and it is the right one here: the file is the boundary, so a query that forgets to filter is still correct, and the failure mode of forgetting is nothing rather than everyone's data.

That only holds while two people can never resolve to the same file, and the filename is built from the username. For a long time the only thing preventing a hostile name was a validation rule in a different service — invisible from the file relying on it. It is now enforced in both places, and refuses rather than sanitises, because stripping the bad characters would quietly map two people onto one database.

A declarative host running containerised services, deployed by pulling from git rather than by anyone SSHing in — including an operations service that drives redeployments through the orchestrator's API and rotates credentials across stacks.

The lesson that cost the most: a variable set in the orchestrator only reaches a container if the compose file names it. Configuration that looks correct in the UI and never arrives is a genuinely nasty class of bug, because nothing errors — the service simply keeps using the old default while you believe you changed it.

Where the estate began, and still running. Kept on the page because the distance between this and the auth service is the actual story.