Known Activities

Multi-tenant SaaS on Cloudflare Workers, routing every LLM call through one callModel() boundary for cost telemetry and provider fallback.

Marketing site whose live audits run against the production API; every staging deploy rehearses a rollback and verifies the served build.

Scale-to-zero self-hosted GitHub Actions runner pool: zero public ingress (SSH and the k3s API are Tailscale-only), secrets encrypted at rest with SOPS + age, and first-boot node joins use one-hour single-use OAuth keys instead of 90-day static tokens.

Reusable GitHub Actions workflows, SHA-pinned and hardened with zizmor and actionlint, shared across four production sites.

Three free community sites for Omaha's queer and music scenes, run with the same CI discipline as commercial work: shared voidflow pipelines, Playwright and axe-core gates, and a license-policy check on every dependency change.