I work on the depth of a running system rather than one layer of it — the service, the platform underneath it, and the automation that keeps both alive. The through-line in everything below is behaviour under failure: what a system does when a dependency dies, a job double-starts, or a model returns nonsense.

My commercial work is in payments at a large European bank — high-throughput, multi-format payment processing. Before that, payroll, card and regulatory-reporting systems in banking. That code is closed; what is public is the other half — infrastructure, tooling and systems built in the open.

Services — Java and Spring, reactive where it earns its place: WebFlux, R2DBC, Kafka, Liquibase, PostgreSQL. Domain work in payments, payroll and regulatory reporting.

Platform — around 40 Terraform repositories for AWS: reusable modules for EKS and node pools, Aurora/RDS Postgres, MySQL and Oracle, Kafka and ActiveMQ/RabbitMQ, ElastiCache, Secrets Manager, IAM and KMS, ECR, remote state, GitLab runners and EKS/EC2 monitoring — plus the per-service stacks built on top of them. The operational glue is small Lambdas in Rust and Python: database health probes, EC2 lifecycle control, secret rotation, IAM config generation.

Systems and tooling — Rust when the answer should be one fast self-contained binary, Kotlin for Android TV, Rust/Anchor for Solana programs.

A self-hosted control plane that turns one Telegram message into supervised agent work. A deterministic triage sizes each task and prices its risk; an agent pipeline then carries it to a real pull request behind a human merge gate.

flowchart LR
  classDef entry fill:#e0f2fe,stroke:#0369a1,color:#0f172a
  classDef agent fill:#e0e7ff,stroke:#4338ca,color:#0f172a
  classDef verify fill:#dcfce7,stroke:#15803d,color:#0f172a
  classDef term fill:#fef3c7,stroke:#b45309,color:#0f172a

  TG([Telegram]):::entry --> TRI{triage<br>size + risk}:::entry
  TRI --> BA[BA]:::agent
  BA -. clarify round-trip .-> TG
  BA --> PD[pattern detector]:::agent
  PD --> ARCH[architect]:::agent
  ARCH --> DEV[developer<br>git worktree]:::agent
  TRI -. small task: skip ahead .-> DEV
  DEV --> TEST[tester]:::verify
  DEV --> SEC[security]:::verify
  TEST --> REV[reviewer]:::verify
  SEC --> REV
  REV -- approve --> PR[pull request]:::term
  REV -. changes requested, max 3 rounds .-> DEV
  PR --> GATE([human merge gate]):::term
  DEV -. any stage hits a cost/token cap .-> PARK([parked, one-tap resume]):::term

The control plane owns what the coding model cannot: per-stage routing across providers — frontier models where the task is reasoned about, cheaper ones where it is executed — hard cost and token caps that park a task for one-tap resume instead of failing it, crash recovery through resumable per-stage sessions, and task-scoped semantic memory written back as typed lessons. Every stage lands in a cost ledger. None of that substrate is coupled to coding; software delivery is simply its first consumer. Runs on one host: systemd on Linux, a supervisor script on macOS.

Reactive Spring Boot — WebFlux, R2DBC, Kafka, Liquibase — with a React panel, for LLM-driven Telegram automation. Also the living showcase of ai-delivery: its features were specified, implemented, tested and reviewed end to end by that pipeline.

tar | zstd | encrypt | split collapsed into a single ~1 MB binary. ChaCha20-Poly1305 in AEAD STREAM mode, keys derived with Argon2id and wiped on drop, the archive header bound in as authenticated data — tampering, truncation and block reordering are all detected. One command locks a folder into fixed-size volumes, one brings it back.

A Solana escrow program: make-offer / take-offer token exchange with vault-held deposits, where the on-chain side of my payments interest lives.

Not my project — a fork of an Android TV IPTV engine that drives a Philips armeabi-v7a set at home. Device-specific tweaks stay in the fork; anything generic goes back upstream as a pull request, most recently EPG channel-name matching outside the Latin alphabet.

• Failure modes are the specification. Every policy in ai-delivery's control loop exists because something actually broke: a double-spawn race became an authoritative flock, a review nitpick loop became a convergence check, and "timeout" stopped being treated as "crash".
• Fix it where it belongs. Local hacks stay local; anything generic becomes a patch against the upstream project.
• Infrastructure is a product. Versioned modules with real inputs, not stacks copy-pasted between environments.

Berlin · Telegram