Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
A multi-account support and commerce platform where agents, AI and payments work from one console. It connects directly to each business's core customer API — signed, cached and normalised per site — and to its payment providers, so every conversation is answered with live account data, while ticket queues, counts and notices stay in sync across every agent in real time through WebSocket and Redis pub/sub. AI drafts replies grounded in each account's own documents (RAG), and slips are verified and campaigns sent from the same place. Channel-neutral from the data model up: it runs on LINE and supports Facebook integration through one channel registry, with Telegram for operator alerts. I own both the API and the console.
Declared reply ladder — ~40 single-purpose steps in a fixed order; a new rule is one file, a reply bills once.
Handoff engine — outbound targets chained into sequences; callbacks are signature-checked (HMAC / bearer / basic) and matched to their job by ordered strategies that never guess — ambiguous goes to a human inbox. Payments ride on it: 3 slip providers per account, a slip already credited says so instead of paying twice, a decline never reads as an outage.
Dynamic reply cards — the model picks the card and fills up to 10 content slots; cards bind live profile and site-rule data through a spec-driven variable map with per-field format rules, drop empty boxes and promo bubbles, fall back on broken images, and each payment state maps to its own card — any failure degrades to the old text, never throws.
Ticket system — live queues over WebSocket (new, claimed and closed cases land with their tab counts and notices), claims guarded by compare-and-set so two agents never take one case, keyset cursor paging for history, a close-case wizard that records follow-up decisions, open-from-room and reopen, assignment history and insight reports.
Dynamic customer API — each upstream site is a provider: a field-path table (mostly data, not code), a few derive rules and a closed set of four section types the console renders. Adding a site is a back-end-only change with no console release; calls are HMAC-signed and cached with a refresh cooldown, raw data stays untouched, a malformed section is dropped and logged, and providers also declare ticket categories, tool minting and hidden screen sections.
Off means byte-identical — RAG, translation and the proxy gate add nothing when switched off, pinned by baseline tests.
Three-layer lockdown — Vultr firewall admits Cloudflare only · a Traefik file switch 403s all but webhooks and health · an app-level secret gate; plus HttpOnly JWT, HMAC-signed webhooks, rate limits and AES-256-GCM credentials.
Latest — TanStack Query across the console with request counts proven unchanged · RAG with hybrid BM25 + vector search · the 5,500-line ticket screen split into components (−29%) with realtime untouched.
Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
A self-hosted RAG (retrieval-augmented generation) engine that gives people, scripts and AI clients one governed place to ask a project's documents and run repeatable analyses on its live data. Answers cite their sources and are checked line by line; numbers come from code, never from a model. Designed and built end to end — data model, retrieval, security, console and deployment — and running on Coolify behind Cloudflare.
Quality — pytest on a real database (187 tests) · Vitest · pyright strict · ruff · migration round-trip · Newman
System overview
Security in the database — every access rule is one SQL function used by both the API and row-level security, so they can never disagree; roles, user groups (members inherit, a personal role wins) and restricted categories.
Signed machine access — API keys sign each request with Ed25519 (RFC 9421 + content digest), short-lived tokens with rotation and reuse detection, nonce replay guard; Argon2id passwords, AES-256-GCM secrets, __Host- cookies + CSRF.
Grounded answers — hybrid retrieval with a measured off-topic cut-off; answers cite passages [P1] and a checker flags unknown references and uncited lines; every question, answer and AI-client report lands in one results history.
Retrieval measured, not guessed — golden-set evals (hit@k, recall, MRR, nDCG, abstention) plus an LLM judge; vectors are reused by content hash across document versions, so unchanged sections are never embedded twice.
Playbooks — JSON specs composed from registered functions, immutable versions with a lifecycle (draft → active → retired), assigned per project; each run pins the exact dataset versions, so any result can be replayed.
Connectors & datasets — generic HTTP connectors (CSV, JSON, column-oriented JSON) on schedules; versions stored compressed and only when the bytes change; a market-data pack reproduces the original scripts, proven by a parity test.
Events & learning — CloudEvents webhooks (Standard Webhooks HMAC / Ed25519) with per-receiver queues, retries and replay; Synapse turns new commits in a source repository into redacted proposals accepted item by item.
One-command projects — provisioning tools build complete projects on live public data (USGS, GitHub, NASA, Our World in Data, Open-Meteo) with keys and a Postman environment, verified end to end with Newman.
Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
Market Data Service (z-service) — Python + React
A service that collects US stock price data from TradingView, calculates technical indicators and keeps the history in MongoDB, then supplies it to research scripts, reports and other systems through an API and file exports. I built the fetch scheduler, the API and a new React console that replaces the old dashboard.
Project stack
Service — Python · FastAPI · pandas · MongoDB · pydantic-settings (typed config per domain, generated reference)
Market data — TradingView feed over WebSocket · NYSE calendar and sessions (pandas_market_calendars) · indicators
Fetch only what changed — the scheduler keys each timeframe to its newest closed bar, so a full round dropped from ~66 to ~11 minutes (6× faster) and stopped rewriting bars that had already closed.
Exports that scripts trust — multi-timeframe CSV in parts plus the formula sheet and a one-call zip, with short-history symbols kept (not dropped) and flagged, so every consumer sees the same snapshot.
Shared screening engine — the research engine runs inside the service, kept in step with its source by a sync script and a parity test that the gate enforces.
Inbound events — other systems report results as CloudEvents over Standard Webhooks (HMAC or Ed25519), stored once per delivery id, so senders retry freely.
Layered access — browser sessions with revocation, scoped machine keys (only SHA-256 stored), a read-only pull key for scripts, rate and body limits, security headers.
Domains, not a monolith — watchlists, portfolio, radar rounds, earnings scan, gold mode, exports and settings each live in their own module; config is validated at boot, a bad value stops startup.
Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
An automated gold and FX trading system on the cTrader Open API. A NestJS service analyses the market, sizes each trade and places orders under hard risk rails; a React dashboard runs and audits it; an optional strategy runner (zTraderActor) signs its users in through the service. It trades on DEMO by default, and LIVE needs two explicit switches.
Project stack
Service — NestJS 12 · TypeScript 6 (strict) · Mongoose · class-validator · cTrader Open API over WebSocket + protobuf · event-driven modules (broker, orders, execution, klines, strategy, dashboard)
Dashboard — React 19 · Vite · TanStack Router / Query / Table · role-gated UI · strict CSP with no inline script
Analysis — rule-based TA engine per mode (scalp · intraday · swing · position) · Gemini assist / lead · RSS news and Yahoo Finance companion markets
Quality / ops — node:test e2e on mongodb-memory-server · Vitest · replay regression suite · ESLint · multi-stage Docker · Compose with MongoDB · Coolify
System overview
AI can only lower risk — the model may veto a trade or cut its confidence and size, never raise them; a setup the AI proposes on its own gets half size, stricter gates, and an R:R recomputed from real prices.
Risk rails in code — risk-based lot sizing per instrument, a daily loss stop, open-position caps per instrument and in total, a loss cool-down, and market hours that follow DST.
Idempotent order intake — the order uuid is a unique index, so two concurrent requests cannot open two positions, and the service, not the caller, decides which account trades.
Secure by default — every route needs a session unless it is explicitly public or machine-only (API key), the two schemes never stand in for each other, and LIVE refuses to start without its second switch.
Proved, not assumed — a regression suite replays more than 5,500 archived rounds against the previous build and must match decision for decision; end-to-end suites cover auth, CSRF, lockout, roles, sessions and the machine API.
Strategy runner — Express + Socket.IO; sessions are re-checked against the service every 60 s, and operator actions fail closed while the service is unreachable.
Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
Mobile Applications — React Native (iOS + Android) + Go API
Aurum TV — Live TV App + Go API
Go 1.27net/httpExporeact-native-tvosexpo-videoDockerGitHub Actions
A live-TV player for Android TV and Apple TV, and the API that feeds it. The app is built for remote control first: channel rail with enlarged numbers, CH+/CH− without opening menus, air-mouse hover, a rail that folds itself away, Thai and English. The backend serves the channel list, plays every stream link to prove it works, and fails over to backups on its own.
Rewritten from Node.js to Go as a drop-in — same endpoints, error codes, signatures and data files; 46 identical requests compared against the old server and the app's own API code run against the new one, so the shipped app needed no change.
Device authentication in two layers — HMAC-signed requests with a timestamp window and nonce replay guard, then a session token rotated ahead of expiry; reusing an old refresh token after the grace window revokes the session.
Self-healing sources — a background monitor plays each link end to end (playlist → variant → real media segment), confirms before marking it down, fails over only to a backup verified as up and switches back when the primary recovers.
Hardened by default — production refuses to start without keys; the rate limit uses the proxy-appended address so X-Forwarded-For cannot be spoofed; probe errors never leak signed URLs; owner-only data files; non-root, read-only container.
Operator CLI — one Go binary for source health, rule-based backup discovery (only links that play are added), link sync, restore, key generation and a smoke test that signs exactly like the TV.
Tested without a TV — race-clean Go suite (77% coverage) and 26 player behaviour tests on a simulated clock; CI runs vet, staticcheck, govulncheck and a container healthcheck on every push.
Root-caused, not patched — 17 defects investigated on real TVs (low-memory crashes, refresh loops, stutter, black screens on channel switch) and written up with cause and fix.
Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
Per-app VPN / proxy client — Android
React NativeML Kit OCRJest
An Android client that routes selected apps through a chosen proxy, with on-device OCR (ML Kit text recognition) to read configuration from screenshots and images rather than making the user retype it. React Navigation, image picker, persisted settings, and a test suite.
Several of my systems are in production with real clients. If you would like to see this one running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
Smaller Services
AI equity research agent — Python. Long-running agent that maintains its own state files between sessions.
Equity screener and automation — Python screening pipeline with symbol-health checks and scheduled watchlist updates.
Realtime WebSocket gateway — standalone ws + Redis + JWT service, kept separate from the API so a socket restart cannot take the HTTP tier with it.
Telegram automation over MCP — TypeScript service exposing its tooling through the Model Context Protocol.
AI messaging service — Node service on Google Generative AI.
Customer onboarding landing — Hono + TypeScript, with field validation that warns early and stays quiet while the user is still typing.
Analytics dashboard — React + Recharts with i18n.
Encrypted internal task board — a single static file, AES-256-GCM with PBKDF2 at 310,000 rounds; the deployed file contains neither plaintext nor a password hash.
AI crew agent — Python agent running as a systemd service.
Chatwoot — forked, customised and operated in production (not authored).
Several of my systems are in production with real clients. If you would like to see any of them running or try it hands-on, I would be glad to arrange a demo or test access — please feel free to get in touch.
How I Work
Tests are part of the work, not an afterthought.
The suite is kept comparable in size to the code it guards, and it runs green before anything is called done.
Mutation testing on every feature.
Real code is broken on purpose; a test that stays green was measuring nothing. This caught a test that had transcribed the implementation instead of calling it — deleting the real feature still passed until the test was rewritten to invoke the shipping method.
Read the row before writing the code.
Field names are never guessed: a query on a field that does not exist returns null, and the feature disappears with no error to trace.
Schema changes are announced and approved first.
Code can be reverted; production data cannot. New fields are designed so existing rows already mean the right thing — no migration, no backfill.
Prove a new feature cannot reach an old one by sweeping the full cross, not by sampling.
Every combination of the old inputs against every shape of the new ones, asserting the old answer does not move. A sweep that finds nothing is a proof of independence; a sample that finds nothing is only an absence of evidence.
Establish who owns a failing test
by re-running an untouched earlier revision before attributing it — neither inheriting blame nor hiding my own breakage.
Keep files small with a ratchet.
A file that outgrows the limit is split rather than excused, and the exemption list is only ever allowed to shrink.
Write down why, not what.
Comments carry the decision and the way back out, so the next person can revert something safely without reconstructing the argument first.
ระบบเทรดทองคำและค่าเงินอัตโนมัติบน cTrader Open API ฝั่ง service พัฒนาด้วย NestJS ทำหน้าที่วิเคราะห์ตลาด คำนวณขนาดไม้ และส่งออเดอร์ภายใต้กฎความเสี่ยงที่เขียนไว้ในโค้ด มี dashboard React สำหรับสั่งงานและตรวจสอบย้อนหลัง และมีตัวรันกลยุทธ์เสริม (zTraderActor) ที่ผู้ใช้ล็อกอินผ่าน service ค่าเริ่มต้นเทรดบนบัญชี DEMO หากจะใช้บัญชี LIVE ต้องเปิดสวิตช์ยืนยันสองชั้น
AI ทำได้เพียงลดความเสี่ยง — AI ปัดตกไม้ หรือลดความมั่นใจและขนาดไม้ได้ แต่เพิ่มไม่ได้ ไม้ที่ AI หาเองจะได้ขนาดเพียงครึ่งเดียว ต้องผ่านเกณฑ์ที่เข้มกว่า และคำนวณ R:R ใหม่จากราคาจริง
แอปพลิเคชันมือถือ — React Native (iOS + Android) + Go API
Aurum TV — แอปดูทีวีสด + Go API
Go 1.27net/httpExporeact-native-tvosexpo-videoDockerGitHub Actions
แอปดูทีวีสดบน Android TV และ Apple TV พร้อม API ฝั่งหลังบ้าน ออกแบบให้ใช้รีโมตเป็นหลัก แถบรายการช่องขยายเลขช่องให้อ่านง่าย กด CH+/CH− เปลี่ยนช่องได้โดยไม่ต้องเปิดเมนู รองรับการชี้ด้วย air mouse แถบเมนูหุบเองเมื่อไม่ได้ใช้งาน และรองรับภาษาไทยและอังกฤษ ฝั่ง backend ให้รายการช่อง ทดลองเล่นทุกลิงก์สตรีมจริงเพื่อยืนยันว่าใช้งานได้ และสลับไปใช้แหล่งสำรองโดยอัตโนมัติ
เขียนใหม่จาก Node.js เป็น Go โดยใช้แทนได้ทันที — endpoint รหัส error ลายเซ็น และไฟล์ข้อมูลเหมือนเดิมทั้งหมด ทดสอบด้วย request ชุดเดียวกัน 46 แบบเทียบกับเซิร์ฟเวอร์เดิม และนำโค้ดฝั่ง API ของแอปมารันกับเซิร์ฟเวอร์ตัวใหม่ แอปที่ใช้งานอยู่จึงไม่ต้องแก้ไข