Infrastructure · cybersecurity · AI inference and agent operations · Michigan · remote
The audit · August 2–3, 2026
13 claims, made by three AI systems and me, checked against live state.
One agent reported critical CVEs down 80%. The rescan said 28%.
| Outcome | Claims |
|---|---|
| Held up | 5 |
| Material error, another system | 5 |
| Material error, my own claim | 3 |
| Total | 13 |
| Measurement | Count | Change |
|---|---|---|
| Baseline | 210 | — |
| Agent reported | 41 | −80% |
| Rescan, live state | 151 | −28% |
I've spent more than twenty years in automotive manufacturing, much of it leading production teams, and one year as the on-site IT person at the company's second building. That is where I learned process discipline: how to run something the same way every time, and how to find the real cause when it breaks. When I got serious about computers I brought that with me. I started with cybersecurity, then built infrastructure to practice on, and rebuilt it three times, each version more secure and easier to recover than the last.
I'm looking for a team where I can do this work at a larger scale.
Receipts hover or tap a number
Product · daily driver
A coding-agent app: a Go server with its own agent loop, a web app, and a desktop app. Every thread works in its own git worktree, anything that reaches outside it waits for my approval, and plugin harnesses run confined inside a Linux Landlock sandbox. The boundary is in the harness code, not in a prompt asking the model to behave.
~52,200 lines of Go 535 Go tests 40 recorded decisions Private repository · demo on requestProduct · close to release
A self-hosted research notebook. Every claim in an answer cites the exact passage it came from, and when the sources don't support an answer, it says so. A citation eval gates CI. There is an answer pack for control plans, PFMEAs, and work instructions, the documents automotive manufacturing runs on and ones I've worked with myself.
Apache-2.0 · public release pendingPlatform · production
The private cloud itself. Bare metal through Kubernetes, GitOps, SSO, HA Vault, an internal PKI, and a GPU inference tier. I built it so my own agent platform would have somewhere to run that it could not break.
Incident records and decision logsPlatform · production
The multi-agent platform Workbench's harness came from, for running coding agents under supervision. Routing is deterministic, work runs in isolated sandboxes, and every change lands as a pull request that only merges when tests and CI pass. It runs continuously on production Kubernetes.
67,115 lines of Go 225 files 382 of 808 commits authored by agents Public repositoryPublished
I audited thirteen claims that three AI systems made about this estate over two days in August. Eight contained a material error, three of them were mine, and seven of the eight were a correct measurement taken against the wrong thing.
The taxonomyI build and run the physical and platform layers, the nine-layer security architecture, and the multi-GPU inference tier myself. I do not write or read application source code (Go, Python, TypeScript), including the Go that Workbench and Hirdforge are written in. For application software and routine operations, I set the architecture and constraints, own the spec and its definition of done, and direct agents to do the work. What I judge is whether the tests pass, what CI reports, and what the cluster actually does after a change lands. I learned that habit over twenty years in automotive manufacturing, nine of them leading production teams of up to 35 people, where a fix counts when the line is running again and not when someone says it is fixed.
The runbooks, incident records, and decision logs live in the repository, so an agent orients itself from the history of the project instead of from a prompt someone retypes each morning. Work happens in isolated branches and sandboxes with git as the rollback boundary, and completion is decided by tests and CI rather than by a model grading its own work.
KWS runs on local agents. Open-weight models on my own hardware (cards up to 32GB, plus Qwen Flash, a 180B model split across CPU and GPU on several machines) handle the normal operations, the smaller projects and campaigns, and the specs, plans and documentation that go with them, roughly 90% of the operations and 80% of the coding. The estate can run on them alone, airgapped if required. I bring in frontier models, currently Claude 5.5 (Opus, Sonnet, and Haiku) and Gemini 4 Argon, for the bigger problems: large project decisions, steering a project that has drifted off track, and root-causing deeper technical issues.
I've been handed wrong reports often enough that the evidence a change worked has to come from the running system. Vault's transit auto-unseal was silently dead for 27 hours while every dashboard showed green, and it only surfaced when someone queried Vault directly. Agents run checks like that one now, and I judge what comes back rather than accepting a summary.
These are the harnesses I drive, on the local open-weight fleet above for the routine work and on a frontier model when a bigger problem calls for one.
KWS, the private cloud everything here runs on. Work reaches it through a pull request, models are reached through one gateway, and nothing in the cluster talks to the internet directly.
The same system from the security side. Each layer is built on the assumption that the one in front of it can fail, and each one says how it was tested.
KWS runs everything on this page. This is how it is operated day to day, and the record behind each part.
Agents work in branches and open pull requests. Merging is the deploy: ArgoCD applies it within seconds and reverts anything changed by hand. A pull request can get its own sandbox namespace, and rolling back is a git revert.
Decision records, public →A cold-start runbook brings the estate up in dependency order, from the firewall through to Vault. In July a total power loss came back in about 1h50m with no data loss. A deliberate chaos test killed two of the three control-plane members, and the placement gap it exposed was fixed.
Incident records, public →The databases, Vault and every git repository are encrypted with restic before they leave the network, kept on a local tier and in an append-only offsite archive, and restore-tested. When one crontab rewrite silently stopped the Vault and Gitea backups for twelve days, the fix was a watchdog on a systemd timer, not cron, that asks restic itself for the last success of each restic-backed job, because a fresh log line is not evidence of a backup.
Backup runbook and report, August 2026Two gateway VMs on different servers share one virtual IP through keepalived and HAProxy, in front of both the Kubernetes API and the ingress. Failover was drilled, investigated for speed, and fixed until it completed in 13 seconds or less.
Failover drill reports, July 2026In July every hypervisor was drained, rebooted onto a new kernel and refilled by live migration: 22 of 22 VMs running and all six Kubernetes nodes Ready throughout. Separately, an RKE2 and Cilium upgrade closed 24 critical CVEs with no workload outage.
Patching campaign report, July 2026Local coding sessions run concurrently across three GPU machines, routed by role so no app names a model. New models are benchmarked before they get a lane, and one was taken back out the same day because the coding tools could not yet parse its tool calls.
Inference lane reports, Aug–Sep 2026Records marked public are in kitporath/kws. The others are dated reports in the private infrastructure repository, and I'm happy to walk through any of them.
Decommissioned enterprise servers and consumer GPUs in my workshop. The rack holds the two servers that carry the cluster's workers and platform VMs, the 10G switch, and two of the three inference machines. The control plane sits on three mini PCs beside it.
Beside the rack
The rack runs on a UPS. Photo of the rack
Newest first. The first three are the infrastructure generations, and Hirdforge is the platform they carry.
| Platform | How it was built | Where it is now |
|---|---|---|
| KWSbare metal to Kubernetes, GitOps, SSO, Vault, GPU inference | agent-built under my direction | production · survived a power loss and a chaos test |
| Hirdforgemulti-agent engineering platform | agent-built under my direction | production Kubernetes · running continuously |
| AsgardProxmox, Talos, full rack, 10G | built with AI collaboration | completed · runs Hirdforge in production |
| Valhallak3s on mini PCs | by hand | retired · those machines now run the KWS control plane |
I'm looking for AI platform, infrastructure, and forward-deployed roles: teams running AI infrastructure, teams bringing coding agents into real engineering work, and companies that need models self-hosted. Remote preferred. US citizen, no sponsorship needed, based in Michigan on Eastern Time.
Resume · Evidence index · llms.txt · resume.json
This site is written for people and readable by agents. Every figure on it has a dated source.
