Source / Tests / Case studies
I've gathered recorded screenshots, source evidence and test results in one place. I also note which projects are examples and which source repositories aren't public.
The archived screenshots document earlier synthetic tests, alongside recorded outcomes and static diagrams showing the trust boundaries.
View featured evidence →Reference projects / Local tests
I put these small test projects together with AI assistance to study replay, retries, and token rotation. The tests ran locally; the GitHub repos are currently private. They aren't customer deployments.
TypeScript / Node.js crypto / node:test
One-time challenge, request binding, replay rejection and concurrency edge cases.
5 passing Node tests at publication
Not platform attestation; a distributed deployment needs an atomic shared replay store.
Source repo currently private
Read the source evidence →TypeScript / Node.js / example PostgreSQL schema
Concurrent HTTP mutation deduplication, tenant-scoped keys, request fingerprints and retained outcomes.
6 passing Node tests at publication
Not distributed exactly-once processing or external transaction coordination.
Source repo currently private
Read the source evidence →TypeScript / Node.js crypto / node:test
Single-use refresh credentials, revoked sessions and replay-resistant family transitions.
5 passing Node tests at publication
Not a production auth provider; multi-node state requires durable transactions.
Source repo currently private
Read the source evidence →Publicly inspectable / Educational examples
Download the TypeScript models, runnable Node.js tests and threat models for local inspection. The bundle includes the Break It / Fix It API cases and passkey/TLS/API decision checks. All data is synthetic, not private project or customer data.
Download source and testsThese models do not prove cryptographic attestation, production authentication, operational telemetry, or a particular customer deployment.
These are write-ups of systems I worked on and built in enterprise environments. The architecture diagrams are simplified, and customer source code, infrastructure details and internal results remain private.
I hardened iOS device-trust decisions by separating untrusted client signals from evidence verified by backend services.
Private implementation · public architecture notes
1 linked reference article(s)
Review the case study →I worked on session-recovery controls that made identity checks, step-up decisions and failure states explicit instead of weakening authentication during recovery.
Private implementation · public architecture notes
0 linked reference article(s)
Review the case study →I built backend verification safeguards so retries and dependency outages would not quietly bypass risk and authorization checks.
Private implementation · public architecture notes
0 linked reference article(s)
Review the case study →Release engineering / Verification limits
I run TypeScript, lint, regression tests and a full site build before deploying. I also check the actual pages in a browser. GitHub Actions is configured, but GitHub currently blocks those runners because of an account billing limit.
The downloadable source bundle includes local tests and reference fixtures; it does not provide a hosted simulator.
Open source / GitHub
Public GitHub projects, with live updates when GitHub is reachable.
Fetching public projects…
No public original projects to show right now. The private stuff is staying private.
