Kristopher L. Porath

AI Infrastructure and Agent Operations

Remote (US) · Michigan, Eastern Time · US citizen, no sponsorship required

kitporath@gmail.com · kitporath.com · github.com/kitporath · linkedin.com/in/kitporath

Summary

More than twenty years in automotive manufacturing, nine of them leading production teams and one as the on-site IT person at our second building, taught me how to run systems under pressure and find the real cause when something breaks. When I went deep on computers I brought that discipline with me: I started in cybersecurity, built my own infrastructure so I had real systems to defend, and rebuilt the platform three times from bare metal through Kubernetes until it was recoverable, locked down in layers, and driven entirely by GitOps.

Today that rack runs a production private cloud in my workshop and a multi-GPU inference tier that I serve and tune myself. Local open-weight models handle most of the routine work on the estate, by my own accounting about 90% of operations and 80% of coding, while frontier models (currently Claude 5.5 and Gemini 4 Argon) come in for the big decisions and the deep root causes. I do not write or read application source code. Agents write it, and what I own is the architecture, the security design, the specs, and the final check against the live system before anything merges. I also publish where they get it wrong.

Selected results

• Published an error analysis of AI agents doing infrastructure work. 13 claims audited, 8 with a material error (3 mine). One agent's reported 80% CVE reduction (210 to 41) rescanned at 28% (210 to 151), and 15 of the 52 images it retired as unused were still running, the CNI among them.
• Built health checks that report their own failure. Found Vault's auto-unseal dead for 27 hours behind green dashboards. After one crontab rewrite silently killed nine nightly jobs for twelve days, including the Vault and Gitea backups, had a watchdog built on a systemd timer, not cron, that reads the restic-backed jobs' last success from restic itself.
• Tested security controls instead of trusting them. An agent-run purple-team exercise found the pod-quarantine response layer silently dead since its network policy was applied, fixed and re-verified that night. The follow-up battery found five detections that could never fire, because the Falco rules they referenced were not in the deployed ruleset, and restored four.
• Held AI agents to least privilege. Credentials live on one host. Negative probing of a scoped Terraform identity found a GROUP USE path to administrator, closed before service. Agents reach Vault through one subtree on ten-minute tokens.
• Led recovery from a total power loss in about 1h50m with zero data loss, and an RKE2 and Cilium upgrade across six nodes that closed 24 critical CVEs with zero workload outage. Chaos-tested the control plane by hard-killing a host with two of three masters: quorum held.

Experience

Independent · AI Infrastructure and Agent Operations

2025 – Present · Self-employed · Remote

• KWS, a production private cloud. Architected, built and run, my third generation after Valhalla (k3s) and Asgard (Proxmox, Talos). 19 monitored hosts on a 10G/40G Cisco Nexus fabric, five bare-metal hypervisors, a six-node RKE2 cluster (about 120 pods, 23 ArgoCD applications, merge is deploy), LINSTOR/DRBD storage, Keycloak SSO, a three-node HA Vault, and 87 digest-pinned images for airgapped operation. Nine layers of defense in depth, each tested.
• Agent operations and inference. Local open-weight agents behind a LiteLLM gateway (per-role routing, quotas, cost attribution) carry routine operations and smaller projects, and the estate can run on them alone. Built and tuned the GPU tier behind it: cards up to 32GB plus a 180B Qwen Flash model split across CPU and GPU, on llama.cpp and ExLlamaV3.
• Workbench, my daily coding-agent app, built under my direction (~52,200 lines of Go, 535 tests). Every thread runs in its own git worktree, anything reaching outside it is held at an approval gate in the harness code, and plugin harnesses are confined by a Linux Landlock sandbox.
• Groundly, a self-hosted research notebook built under my direction (~9,200 lines of Go, 69 tests). Every claim carries a span-level citation or the answer abstains, and a CI-gated citation eval held the Python-to-Go cutover until it passed.
• Hirdforge, the multi-agent platform Workbench's harness came from, built under my direction and running on production Kubernetes (about 450 merged pull requests), where tests and CI decide completion.

Prefix Corporation · Automotive Manufacturing Operations & IT

2010 – Present · Michigan

• Paint Logistics Coordinator (Dec 2024 – Present): material logistics for an automated paint line.
• Program Manager (2020 – 2021), then IT System Administrator (Jun 2022 – Jun 2023): owned cross-functional delivery, then was the primary IT person on a new manufacturing-tracking software rollout and the on-site IT support at the second building.
• Team Lead, then Supervisor (2013 – 2022): led up to 35 people for quality, throughput and on-time delivery, including shift-level incident response and root-cause analysis.

Saleen Inc. · Team Lead, through 2008 · Michigan

Skills

• Platform: Kubernetes (RKE2, Talos, k3s), ArgoCD, Helm, Terraform, Ansible, Gitea Actions, OpenNebula/KVM, Proxmox, Prometheus, Loki
• Security: Keycloak OIDC/SSO, Vault (HA, transit unseal), External Secrets, cert-manager, Cilium, Falco and Talon, Suricata, Trivy, gitleaks, auditd, AIDE
• AI systems: llama.cpp, ExLlamaV3, LiteLLM, quantization and KV-cache tuning, MCP, ACP, CI-gated evals, claim-versus-measurement auditing
• Network and storage: Cisco Nexus 10G/40G, OPNsense, HAProxy, LINSTOR/DRBD, MinIO, ZFS, restic
• How the work gets done: Agents write the code in Workbench, t3 code, Claude Code and opencode. I own the architecture, specs and the merge decision.

Certifications & education

• Oakland Community College, Business Administration (36 credits, 2002 – 2004, no degree). Google Cybersecurity Certificate (Coursera), Simplilearn Cyber Security Expert Master's Program (completion certificate, 2023 – 2024), TryHackMe top 10k.