These are my public, open-source projects, mostly Go. They’re the open counterpart to my day job in platform and security engineering: the same class of tools, built in the open. My largest professional work is internal, but the themes below are the same. Everything here is on GitHub.
fleetsweeper
Multi-cluster Kubernetes drift detection. The cluster that drifted is the one that pages you at 3am. Fleetsweeper finds it first. It makes the fleet its own baseline, using a modified z-score across your clusters, so there are no rules or thresholds to tune. One scan returns a 0-to-100 Fleet Score, the cluster least like the rest with the exact fields that flagged it, and ranked fixes that rate a change touching ten clusters above the same change on one. It ships an optional admission webhook that denies pods deviating from the fleet’s actual norm, and folds AlertManager, Falco, Trivy, and Kyverno/Gatekeeper reports into one signal stream.
Repo · Go
cipher
Programmatic SOPS for Go. One library and one CLI to encrypt, decrypt, rotate,
walk, edit, and audit secret files, drop-in next to your existing sops files.
Backends for age, AWS KMS, GCP KMS, Vault Transit, Azure Key Vault, and PGP. Edit
encrypted files in $EDITOR and they re-encrypt on save, rotate keys on demand or
by age, add or drop recipients without re-encrypting the payload, and walk a whole
tree in parallel. It also gives you a git pre-commit hook that blocks plaintext,
net/http middleware, and OpenTelemetry traces. Every release is exercised end to
end against real Vault Transit, AWS KMS through LocalStack, and a fresh PGP
keyring.
Repo · Go
jwtmint
JWTs for Go, batteries included. A JWT library wrapping golang-jwt/jwt/v5
with a daemon, a Kubernetes controller, an admission webhook, and HTTP/gRPC
middleware. It adds context propagation, configurable clock skew, multi-key
rotation, JWKS publishing, revocation, and an opt-in OIDC discovery endpoint. Sign
and verify benchmarks sit beside the code, across every supported algorithm.
Repo · Go
yardmaster
Ansible orchestration in a single binary. A self-hostable alternative to AWX and Semaphore that runs the same playbooks with none of the standup. AWX wants a Kubernetes operator, Postgres, Redis, and Receptor before it runs a line. Yardmaster is one process and one SQLite file, live in seconds. Every run is a host-by-task status matrix you read like a dashboard instead of a scrolling text log, big jobs split across parallel shards, and results merge back into one view.
whodar
Find who to talk to about X. Someone at your company already knows the answer. Whodar tells you who. Point it at the tools your org already uses, ask in plain words, and get back the people and channels to ask, each with the reason and a confidence score behind it. Local by default, and it works with or without an LLM. It ships a CLI and a local web UI where every answer is shareable by URL.
Repo · Go
slop-chop
Strip the AI tells out of text. Paste in writing and get back something that reads like a person wrote it. A fast, deterministic rules pass swaps the giveaway characters, cuts the stock phrases, fixes spelling to one dialect, and tidies punctuation, all markdown-aware so fenced code blocks pass through untouched. An optional model pass handles the rewrites rules can’t, like reworking a sentence toward a voice you picked. Bring your own list of things to cut.
vamoose
Calendar workflows, minus the tedium. Route time off through an approval chain and fan it out to the team without touching a scheduling tool by hand. One workflow engine drives four calendar backends, Microsoft Graph, Google, Apple iCloud, and any CalDAV host, so you switch providers and change nothing. The approval rides the calendar invite itself, so there is no second tool to check. It cuts both ways: the same yes that clears your time off can fire the manager’s own follow-on steps, posting an alert, logging a note, or handing off coverage, since guards, delays, branching, and notifications are plain JSON you can read and share. Drive it from the CLI, Claude over MCP, or Slack with Approve and Decline buttons.
battlesight
An interactive visual encyclopedia of human conflict, from 3000 BC to today. A 3D globe with hand-crafted phase replays of the iconic battles and an auto-stepping war cinematic that walks any conflict end to end. The catalog covers more than 13,000 battles imported from Wikipedia and Wikidata, with a curated layer on top that adds narrative, tactical reconstructions, territory-control snapshots, and war casualty totals. Built with Go, React, MapLibre, and deck.gl.
Repo · TypeScript · Go
midden
A journal kept as plain markdown. Append timestamped, tagged entries from the terminal or a Claude Code skill, then grep across years. Small, local, and yours.
Repo · Go
gus
A messy working tree into clean commits. Point it at a pile of uncommitted changes and it splits them into ordered, human-looking commits that read like you made them one step at a time, instead of one dump labeled “wip”. A Claude Code skill, so it runs inside the assistant you already use.
Repo · Claude Code skill