Things I have built, mostly Go command-line and platform tools built in the open, the same class of work as my day job in platform and security engineering. Not everything is here. My largest professional work is internal, and some of my own projects are not public.

Every link below goes straight to the source. Read it, clone it, run it, and judge the work before you talk to me.

Platform and systems

The work closest to what I take on for clients.

cipher

Programmatic SOPS for Go. One library and one CLI to encrypt, decrypt, rotate, walk, edit, and audit secret files, drop-in next to your existing sops files. Backends for age, AWS KMS, GCP KMS, Vault Transit, Azure Key Vault, and PGP. Edit encrypted files in $EDITOR and they re-encrypt on save, rotate keys on demand or by age, add or drop recipients without re-encrypting the payload, and walk a whole tree in parallel. It also gives you a git pre-commit hook that blocks plaintext, net/http middleware, and OpenTelemetry traces. Every release is exercised end to end against real Vault Transit, AWS KMS through LocalStack, and a fresh PGP keyring.

Source · Go

fleetsweeper

Multi-cluster Kubernetes drift detection. The cluster that drifted is the one that pages you at 3am. Fleetsweeper finds it first. It makes the fleet its own baseline, using a modified z-score across your clusters, so there are no rules or thresholds to tune. One scan returns a 0-to-100 Fleet Score, the cluster least like the rest with the exact fields that flagged it, and ranked fixes that rate a change touching ten clusters above the same change on one. It ships an optional admission webhook that denies pods deviating from the fleet’s actual norm, and folds AlertManager, Falco, Trivy, and Kyverno/Gatekeeper reports into one signal stream.

Source · Go

jwtmint

JWTs for Go, batteries included. A JWT library wrapping golang-jwt/jwt/v5 with a daemon, a Kubernetes controller, an admission webhook, and HTTP/gRPC middleware. It adds context propagation, configurable clock skew, multi-key rotation, JWKS publishing, revocation, and an opt-in OIDC discovery endpoint. Sign and verify benchmarks sit beside the code, across every supported algorithm.

Source · Go

Other work

Built because I wanted them. Different problems, same standard.

slop-chop

Strip the AI tells out of text. Paste in writing and get back something that reads like a person wrote it. A fast, deterministic rules pass swaps the giveaway characters, cuts the stock phrases, fixes spelling to one dialect, and tidies punctuation, all markdown-aware so fenced code blocks pass through untouched. An optional model pass handles the rewrites rules can’t, like reworking a sentence toward a voice you picked. Bring your own list of things to cut.

Source · Go

kibble

The proving ground for your docs. Kibble runs your README’s install steps in a clean container, so a broken install fails in CI instead of in a user’s terminal. Docs stop being prose you hope is right and become an executable contract that every release has to pass.

Source · Go

preen

A messy working tree into clean commits. Point it at a pile of uncommitted changes and it splits them into ordered, human-looking commits that read like you made them one step at a time, instead of one dump labeled “wip”. It can also absorb a run of unpushed commits and redo them properly. A Claude Code skill, so it runs inside the assistant you already use.

Source · Claude Code skill

vamoose

Calendar workflows, minus the tedium. Route time off through an approval chain and fan it out to the team without touching a scheduling tool by hand. One workflow engine drives four calendar backends, Microsoft Graph, Google, Apple iCloud, and any CalDAV host, so you switch providers and change nothing. The approval rides the calendar invite itself, so there is no second tool to check. It cuts both ways: the same yes that clears your time off can fire the manager’s own follow-on steps, posting an alert, logging a note, or handing off coverage, since guards, delays, branching, and notifications are plain JSON you can read and share. Drive it from the CLI, Claude over MCP, or Slack with Approve and Decline buttons.

Source · Go

Elsewhere

I build and ship commercial products under KordLoom LLC. The one closest to this work is SwitchTender, an Ansible orchestration platform whose point is the governance layer: tamper-evident audit, policy-gated approvals, and secrets masking with Vault. It has a live demo. Also Whodar, which maps who knows what across an organization’s tools.