What I build and run outside client engagements. Some of it is published, some is on its way, and some is research. It lives here so it can be found — the practice itself is infrastructure, and that is what the rest of this site is about.
Every status below is the real one. When something ships, the badge changes — four of them did today.
Endpoint detection with 1,232 Sigma rules, five live threat-intel feeds, automated containment behind an approval gate, and a mail gateway. It runs my own fleet. The source, the install notes and a plain list of what does not yet work are on the project page.
One Go agent for Linux, macOS and Windows: patching, inventory, alerting, click-to-SSH with host-key pinning, and remote desktop. Same codebase and same agent as the EDR — details and download.
Jobs, quoting, invoicing, expenses, inventory and payroll behind a working contractor website. The most complete business system I have built: you can click through it, or run it yourself — the archive ships an install guide and a one-line command that creates the first owner login.
Download Electrical King ↓ · 0.1.0-20260902 · 1.4 MB · AGPL-3.0 · sha256
A till for BC retail that gets tax right: GST and PST with the real exemptions, integer cents so totals never drift, and an end-of-day Z-report. Built for my own use first. PHP and SQLite, nothing else to run.
Download SD POS ↓ · 0.1.0-20260902 · 69 KB · AGPL-3.0 · sha256
Quoting, invoicing, stock and inventory, customers and follow-ups — PHP and SQLite on one server, with a small JSON API so an AI assistant can read the books without being handed the database. The ERP assistant on the AI page works against it. Two archives, one shared shell.
Download SD ERP ↓ · 0.1.0-20260902 · 76 KB · AGPL-3.0 · sha256
Download SD CRM ↓ · 0.1.0-20260902 · 73 KB · AGPL-3.0 · sha256
A mail gateway needs an MX record, which a personal Gmail or Outlook account cannot give it. The next piece reads the mailbox directly, checks what has already arrived, and quarantines into a folder — so a sole trader on a free account gets the same protection as a company behind a gateway.
The code is mine end to end, and I chose to open it rather than license it. A one-person practice cannot buy the trust a security vendor has; it can earn it by letting anyone read exactly what the agent does on their machine. The practice competes on the work — designing, building and running infrastructure — not on a subscription.
The platform stands on other people's work and says so. Detection rules come from the SigmaHQ community under the Detection Rule License; remote desktop is MeshCentral under Apache-2.0; on-access scanning is ClamAV. Every archive ships a NOTICE file naming them. Bugs found on my own fleet are fixed and ship in the next release, and the archive carries a status document that lists the gaps first, not last.
The next releases are aimed at signed, reproducible builds; a Windows Server profile that coexists with Defender rather than fighting it; self-serve enrolment on the hosted instance; and the mailbox-side email security above. The business systems — point of sale, ERP, CRM and the contractor back office — ship the same way the platform does: a release script strips my data, rewrites the strings that named my servers, runs a leak scanner that first has to catch a planted canary, and refuses to pack anything that will not boot from an empty data directory.
The questions I am working on when there is no client on the clock.
A current MacBook Pro with 36 GB of unified memory runs a 35-billion-parameter mixture-of-experts model at conversational speed, entirely offline. For a small business that means capable private AI on a machine that already exists, with no server room and no subscription. I am working out where that holds up and where it does not.
A GPU server on my own network serves open-weight 7B–14B models to the LLM Chat demo and the ERP assistant. The interesting problems are small ones: one request at a time beats parallel on a modest card; retrieval over a company's own documents matters more than model size; and an agent that can act needs a sandbox, not trust.
Behavioural detection that needs no prior signature — process lineage, credential access, mass-encryption patterns — and the automation that contains a host in seconds. Blocking at the moment of execution is the obvious next step, and in my testing it deadlocks the host; finding a safe way to do it is an open problem.
Taking SPF, DKIM and DMARC to enforcement for businesses that have never looked at them, and what real protection looks like for mail that never passes through a gateway at all.
If you have one of those — email, a server, a network, a system your staff fight with every day — an hour of my time costs nothing, and the write-up is yours either way.