I build full-stack AI products and the production infrastructure behind them.

A free, anonymous full-stack web app that checks medical bill charges against CMS Medicare reference rates: OCR extracts CPT/HCPCS codes and dollar amounts, a fee-schedule lookup scores each line as a multiple of the Medicare rate (near, above, or far above reference - or unverified when a code isn't in the CMS tables, so it never asserts an overcharge it can't confirm), and Claude drafts a review letter for the flagged charges.

The React 19 + Vite frontend on Vercel calls serverless functions that proxy to a Python FastAPI backend on Modal behind a fail-closed shared-secret trust boundary. Uploads are validated by magic bytes with decompression-bomb and PDF page-cap guards and processed entirely in memory - nothing is stored, and per-IP rate limiting keys on an HMAC so raw IPs never are either. Every letter is re-verified server-side against the CMS tables, ignoring client-supplied rates, and untrusted text is fenced off from the model to block prompt injection.

GitHub Actions runs 158 tests across 3 parallel jobs on every push and PR - 82 pytest (94% backend coverage, including end-to-end OCR through real Tesseract), 60 Vitest, and 16 Playwright browser E2E tests with an axe-core WCAG 2.1 AA scan of every page at zero violations. The suite is mutation-checked: breaking a status band, the 413 handler, or a label's contrast fails CI. Vercel's Git integration ships a preview build for every PR and deploys each merge to main straight to production.

Trains an LSTM forecasting model and serves its predictions through a REST API to a real-time dashboard.

The 3-layer PyTorch LSTM sits behind a FastAPI REST API; a React + Tailwind dashboard streams real-time training progress alongside 7-day price forecasts.

A self-hosted platform on Proxmox VMs with TrueNAS (ZFS) storage and Dockerized apps, including a GPU-accelerated media server with hardware transcoding serving 20+ users across streaming and photo services.

Remote access is zero-trust - Cloudflare DNS, a hardened VPS reverse proxy, and a Tailscale mesh VPN - so there are zero open ports while holding 99.9%+ uptime over three years.

A Home Assistant custom integration (distributed through HACS) that controls Midea and Midea-OEM air conditioners locally over the network. It exposes a full climate entity - power, HVAC mode, target temperature, fan speed, and swing - alongside switches, sensors, selects, a number, and a fan entity for the extra features a unit supports: eco / sleep / boost modes, indoor and outdoor temperature, humidity, energy and realtime power, airflow angle, and a fresh-air module.

Built on the midea-local protocol library, it uses the Midea cloud account only once during setup - to discover devices and fetch each unit's local encryption keys - after which control is fully local (local_push, no runtime cloud dependency). Entities are generated dynamically from each unit's own reported capabilities, so only the controls your specific AC actually has ever appear.

TetherDisplay uses an iPad (10th gen) as a USB-C second monitor for a Windows laptop. Since iPads have no native display input, this is a compressed-video streaming pipeline that runs over the USB cable: Windows captures a virtual display via Windows.Graphics.Capture, encodes it with NVIDIA NVENC for low-latency HEVC, streams it over usbmux (the same protocol macOS uses for device syncing), then decodes and renders on the iPad using VideoToolbox and Metal.

The stack spans two systems: Windows host service in C++ (IddCx virtual display, WGC capture, NVENC encode, clean-room usbmux transport) and a Swift/Xcode iPad app (PeerTalk tunneling, VideoToolbox decode, Metal render). All protocol logic is portable, compiled, and tested in WSL (93 unit tests pass); Win32/WinRT/GPU code is written against citation-backed docs and verified on hardware. Security: TOFU pairing + libsodium AEAD encryption. No Wi-Fi, no LAN, no cloud - only the USB cable.

A persistent key-value store built on a Log-Structured Merge tree in pure C++17. Writes hit an fsync'd write-ahead log and a sorted in-memory memtable, then flush to immutable on-disk SSTables; reads check the memtable, then each SSTable newest-to-oldest - a per-table bloom filter skips the ones that can't hold the key (no disk I/O at all, cutting negative-lookup cost ~42x), and a sparse index seeks the rest to within a 16-record scan.

Range scans do a k-way heap merge over the memtable and every SSTable, newest source winning per key with tombstones filtered out; compaction folds all tables into one and drops deleted keys. A rewritten-atomically manifest survives crashes mid-write, and a WAL replay on restart never loses an acknowledged write. CI builds with -Wall -Wextra -Werror and runs the assert-based suite twice - plain, then under AddressSanitizer + UBSan.