Projects

**What it is.** Full-stack AI meal-planning platform built as a pnpm monorepo and running on Hetzner + Cloudflare Workers. NestJS owns business logic while a separate Python FastAPI ai-service runs the AI brain. In production: 311 generations from 105 users (September 2026) at ~$0.26 per plan on Claude Haiku 4.5, ~$0.33 on Sonnet. **AI generation pipeline.** The AI brain is a LangGraph StateGraph agent with a ReAct-style USDA tool loop and a forced submit tool; it never writes nutrition numbers itself — the server computes every macro from USDA data, a hard anti-hallucination guarantee. USDA lookup is Postgres full-text search plus an LLM rerank (pick accuracy 0.64 → 0.92 on frozen probes), and a separate recipe retrieval on Qdrant over ~230k filtered RecipeNLG recipes feeds dish ideas into generation. A separate chat agent with 16 tools lets users inspect, create and start plans in conversation. **Reliability & quality.** Quality is enforced by a 3-layer validate-and-retry cascade, and graph state is checkpointed to Postgres (AsyncPostgresSaver), so an interrupted plan restarts from the next unfinished day. A cross-provider fallback (Anthropic ⇄ a self-hosted model) is live and fired in production when the Anthropic balance ran out. A pre-release eval harness — golden sets of 101 meal plans and 80 chat cases, RAGAS, DeepEval and MLflow, best score 0.971 — catches regressions, and every generation is traced in self-hosted Langfuse v3 with OpenTelemetry. **Streaming & deployment.** Server-Sent Events stream meals live from Python → NestJS → Next.js behind a configurable 360 s hang watchdog. The platform moved from Railway to Hetzner + Cloudflare Workers in August 2026.

**Data platform.** Federal contract data from SAM.gov runs through a Temporal-orchestrated ETL into PostgreSQL and, via CDC, into a ClickHouse CQRS read model. SmartSync holds ~7.06M contracts, ~1.48M vendors and ~94.4M award transactions from SAM.gov and USAspending.gov, used by a few hundred daily active users. **SmartSync on Temporal.** In production since 2026-09-25: 32 schedules on 6 task queues run extract → transform → load → verify per window for opportunities, entities and contract awards, plus enrichment (descriptions, attachments, SBA certifications) and guard jobs. The legacy scheduler was deleted, and replay tests of production histories run in CI. A 13-key SAM.gov pool with a usage ledger keeps every pipeline inside the API quota. **Completeness, proven.** A green run only proves execution, so each dataset is checked against a second copy of the source: 0 of 80,922 active notices and 0 of 733,627 FY2025–26 archive notices missing against SAM.gov's own files. The opportunities sync that once reported success while holding 17.5% of notices is gone with it. **CQRS read model and mirror.** PostgreSQL is the write model; one Temporal coordinator per table projects new rows into ClickHouse by watermark (query-based CDC), and a daily reconciliation checks checksum parity — contracts, entities and 94.4M award transactions match. A logical-replication PostgreSQL → PostgreSQL mirror (pgoutput) runs as Temporal Workflows with hourly health and daily hash checks. A teammate introduced ClickHouse and wrote the first copy scripts; I rewrote them with checkpoints and a parity check, moved them onto Temporal, and built the mirror. **Backend and Next.js on Cloudflare.** A headline query went from 13.6 s to ~1 s (a trigger-maintained indexed slug column instead of a per-row function) and ClickHouse queries from 2.2 s to 0.27 s. I added a single-flight guard to the Express API's in-memory response cache against query stampedes and aligned the React Query, ISR and API cache TTLs at 10 minutes, cutting worst-case feed lag from ~3–5 h to ~10 min by design. The Next.js 16 frontend runs on Cloudflare Workers via OpenNext with an R2 page cache; I added the D1 tag cache that makes on-demand revalidation work and edge-cached the sitemaps. The backend moved from Hetzner to OVHcloud in August 2026, when a change of stakeholders consolidated hosting there. **AI content.** A smaller Python service drafts blog, social and SEO copy from contract data behind a human review queue and a guard against invented figures, on Cloudflare Workers AI.

**What it is.** A B2B Web3 platform for token-distribution (airdrop) campaigns: a campaigner drafts a campaign and its eligibility criteria, delegates vote on the criteria and on the distribution, and tokens are distributed. Campaign state lives on an L2 rollup that teammates built and connected to Ethereum. **Server routes.** Node server routes aggregate an external blockchain-analytics API for the campaign dashboard in parallel with Promise.allSettled, so one failing upstream call empties only its widget. Clerk sessions are exchanged for PostgreSQL (Supabase) access on the server and in the browser. **Rollup integration and signing.** The web app queries the rollup's REST API for campaigns, votes and accounts, submits transactions to the sequencer and polls the ledger for their status. Transactions are signed in MetaMask: the client fetches the account nonce, serializes the call with the rollup's own serializer compiled to WebAssembly, signs it with EIP-191 and submits it — one wire format, no TypeScript port to drift. 64-bit values travel as BigInt via json-bigint, and a new wallet's first transaction works because the account lookup's 404 maps to nonce 0. **Wallet and UI.** Ethereum (Sepolia) wallet flows with ethers.js sit behind one transaction adapter for Ethereum and rollup transactions, under the campaign wizard, voting and campaign pages of the web client.

**What it is.** A B2B platform where brands sell NFT-backed products: buyers pay by card through Stripe, the platform mints the NFT on Polygon, and the buyer later burns it to redeem a real-world discount code or ticket that venue staff verify. Brands also earn royalties when their NFTs resell on OpenSea or Rarible. **Backend.** Business logic in Node.js on PostgreSQL: an Express + Sequelize core API (~79 REST endpoints, JWT with ACL roles, per-route validation and rate limits, Swagger generated from the route definitions) and a NestJS + MikroORM payment service on Stripe Connect, called with short-lived service tokens. Order, royalty-ledger and contract-deployment lifecycles run on a state-machine workflow engine with guards and lifecycle events; background work runs as cron jobs with a DB-backed job log and a single-instance guard. **Correctness.** Checkout overselling was fixed with a row lock and atomic SQL counters. The order-expiry job checks Stripe before expiring, so late payments still complete, and money math moved from floats to decimal.js. Burn-to-redeem is idempotent on the transaction hash, with a recovery job for redeems whose HTTP call never arrived, and brand ↔ customer CRM data is kept by a PostgreSQL trigger plus an idempotent backfill. **Royalty ledger.** A resale indexer for OpenSea and Rarible reads checkpointed block windows with an overlap re-scan and adaptive range splitting, and feeds a per-brand ledger whose withdrawals are gated by balance guards and block confirmations. **Frontends.** React apps for brands, checkout, redeem and venue verification share a UI kit and API client through a git submodule.

**What it is.** An employee-engagement and gamification platform for shift and hourly workers. Employees earn points for shift-attendance answers, weekly check-ins, peer shout-outs, performance goals and milestones, then redeem them for gift cards; leaders get an inbox of team reports and insights dashboards. **Backend.** A Python FastAPI service, multi-tenant by subdomain: every request resolves its tenant from the host, a global login returns the user's tenant, and JWT access/refresh tokens with role guards separate employees, leaders and admins. The web client calls ~73 API operations plus one WebSocket channel. **Points and rewards.** An append-only points ledger from five earning sources with a pending → approved status, balances derived from approved rows, and gift-card redemption with points ↔ dollar conversion and per-card denomination ranges. **Goals, insights, notifications.** Performance goals with targets, comparators and point values; date-ranged check-in and shout-out insights scoped by role; and a WebSocket inbox that pushes unread counts, with the client refetching only the affected list. **HRIS integration.** UKG Pro credentials and location mapping per tenant drive shift-attendance polls and a configurable SMS scheduler; late or absent answers notify the leader.

**What it is.** A benchmarking and KPI analytics platform for Ontario hospitals: hospitals submit their trial balances and compare financial and staffing indicators against peer groups, in a report hub and interactive dashboards. **Report engine.** An Express service next to the main platform API. The platform exchanges a server-held key plus the user's entitlements (reports, years, peer groups) for an access token, so the engine enforces subscriptions without reading the portal database. Its report and dashboard endpoints carry the benchmarking business logic: each hospital's indicators against its peer group's median and quartiles, with multi-year trends. **Server-driven UI.** Responses are arrays of typed UI blocks — layout, inputs, tables and charts — so new reports ship without a frontend release. Drill-downs post the clicked quartile and year back, and the engine returns only the block to replace. **Report UI.** A React + TypeScript renderer walks those blocks recursively, with MobX stores per domain, ag-Grid tables and Chart.js charts.

**What it is.** A multi-chain NFT marketplace — ERC-721 and ERC-1155, fixed-price sales and auctions — on Ethereum and Concordium, with white-label copies for partner brands. **Indexer drivers.** Chain watching lives outside the marketplace backend in one network driver per chain. Each driver follows the marketplace contracts from a per-contract block cursor seeded at the deployment block, so a cold start backfills and a restart resumes. It decodes contract events — mint, transfer, listing, sale, bid, pause, close — into one chain-neutral protobuf event (23 types) and pushes it to the backend over an HMAC-SHA256-signed endpoint. The backend applies each event idempotently, fingerprinting it in the same database transaction as the state change, so driver retries never double-count a sale or a bid. **Shared TypeScript layer.** A versioned private npm package used by 4 separate Next.js marketplace apps: API clients, MetaMask/WalletConnect and Concordium wallet adapters behind one interface, and a transaction layer on web3.js with 10 operations across 4 lot types, resolving contract addresses at runtime from the drivers' contract set. **Closing the loop.** The UI marks a transaction pending when the wallet returns a hash and flips it only when the indexed event comes back over STOMP, or times it out after 5 minutes — the indexed chain state is the source of truth, not the client receipt.

**What it is.** A pump.fun-style token launchpad live on Robinhood Chain (chain ID 4663, an Arbitrum Orbit L2 with ETH gas, ~100ms blocks, and a single FCFS sequencer). One transaction launches a fixed-supply ownerless ERC-20 into a bonding curve; once the curve hits its flat ETH target, anyone can graduate it into a full-range Uniswap V3 position. **Anti-rug by construction.** Seven immutable contracts, no proxies, one exact compiler pin, MIT and Blockscout-verified. Sells can never be paused — no flag or code path can block a curve sell, and no pause authority of any kind survives graduation. Both fee legs accrue in-contract as pull payments, so neither a hostile treasury nor a broken creator address can freeze trading. The graduated LP NFT lives in an ownerless vault whose only external function is `collect()` — principal mathematically cannot leave. **The stack behind it.** A pnpm + Bun monorepo: a Ponder indexer writing venue-continuous candles, holder balances, and confirmation watermarks into Postgres; a Hono-on-Bun API serving 25+ REST endpoints plus a Bun WebSocket fanout driven by Redis pub/sub; a keeper service that fires the permissionless `graduate()` within a block or two; and a four-page Next.js 16 + React 19 frontend on wagmi/viem. Every cross-service type, ABI, and constant is defined once in a Zod-first shared package, with ABIs and deploy addresses generated rather than hand-written. **Deployment.** Backend runs as a Docker Compose stack behind a Cloudflare Tunnel so the Redis→socket hop stays co-located; the Next.js frontend is SSR on Cloudflare Workers via OpenNext, with content-addressed images, canonical metadata, and rendered OG cards on R2.