I build full-stack AI products and the production infrastructure behind them.

A full-stack web app that checks medical and dental bill charges against CMS Medicare reference rates: OCR extracts CPT/HCPCS codes and dollar amounts, a fee-schedule lookup flags each line as overcharged, within range, or unverified, and - for confirmed overcharges - Claude drafts a one-click dispute letter.

The React 19 + Vite frontend on Vercel calls serverless functions that proxy to a Python FastAPI backend on Modal behind a fail-closed shared-secret trust boundary. Uploads are validated by magic bytes with decompression-bomb guards and processed entirely in memory - nothing is ever stored. Every dispute letter is re-verified server-side against the CMS tables before it reaches the user, untrusted text is fenced off from the model to block prompt injection, and the whole pipeline is covered by 77 unit tests.

Trains an LSTM forecasting model and serves its predictions through a REST API to a real-time dashboard.

The 3-layer PyTorch LSTM sits behind a FastAPI REST API; a React + Tailwind dashboard streams real-time training progress alongside 7-day price forecasts.

A self-hosted platform on Proxmox VMs with TrueNAS (ZFS) storage and Dockerized apps, including a GPU-accelerated media server with hardware transcoding serving 20+ users across streaming and photo services.

Remote access is zero-trust - Cloudflare DNS, a hardened VPS reverse proxy, and a Tailscale mesh VPN - so there are zero open ports while holding 99.9%+ uptime over three years.

A Home Assistant custom integration (distributed through HACS) that controls Midea and Midea-OEM air conditioners locally over the network. It exposes a full climate entity - power, HVAC mode, target temperature, fan speed, and swing - alongside switches, sensors, selects, a number, and a fan entity for the extra features a unit supports: eco / sleep / boost modes, indoor and outdoor temperature, humidity, energy and realtime power, airflow angle, and a fresh-air module.

Built on the midea-local protocol library, it uses the Midea cloud account only once during setup - to discover devices and fetch each unit's local encryption keys - after which control is fully local (local_push, no runtime cloud dependency). Entities are generated dynamically from each unit's own reported capabilities, so only the controls your specific AC actually has ever appear.

TetherDisplay uses an iPad (10th gen) as a USB-C second monitor for a Windows laptop. Since iPads have no native display input, this is a compressed-video streaming pipeline that runs over the USB cable: Windows captures a virtual display via Windows.Graphics.Capture, encodes it with NVIDIA NVENC for low-latency HEVC, streams it over usbmux (the same protocol macOS uses for device syncing), then decodes and renders on the iPad using VideoToolbox and Metal.

The stack spans two systems: Windows host service in C++ (IddCx virtual display, WGC capture, NVENC encode, clean-room usbmux transport) and a Swift/Xcode iPad app (PeerTalk tunneling, VideoToolbox decode, Metal render). All protocol logic is portable, compiled, and tested in WSL (93 unit tests pass); Win32/WinRT/GPU code is written against citation-backed docs and verified on hardware. Security: TOFU pairing + libsodium AEAD encryption. No Wi-Fi, no LAN, no cloud - only the USB cable.

A persistent key-value store built on a Log-Structured Merge tree in pure C++17. Writes hit an fsync'd write-ahead log and a sorted in-memory memtable, then flush to immutable on-disk SSTables; reads check the memtable, then each SSTable newest-to-oldest - a per-table bloom filter skips the ones that can't hold the key (no disk I/O at all), and a sparse index seeks the rest to within a 16-record scan.

Range scans do a k-way heap merge over the memtable and every SSTable, newest source winning per key with tombstones filtered out; compaction folds all tables into one and drops deleted keys. A rewritten-atomically manifest survives crashes mid-write, and a WAL replay on restart never loses an acknowledged write. CI builds with -Wall -Wextra -Werror and runs the assert-based suite twice - plain, then under AddressSanitizer + UBSan.