Case Studies

Community Needed Enterprise Features on a Startup Budget

A community organization needed a full-featured platform with real-time messaging, event management, member directories, and privacy protection. Traditional development estimates ranged from $381K to $736K with 12-18 month timelines.

Agentic Engineer + AI Paradigm

Solo developer leveraging AI-assisted development - not "vibe coding," but a disciplined engineering process where a human architect directs AI tools to produce production-grade output. Every line reviewed. Every pattern intentional.

• End-to-end encrypted direct messaging (Web Crypto RSA-OAEP key exchange)
• Stripe Connect payouts for event fees and membership (Express accounts)
• Cross-platform delivery via a Capacitor 7 native shell over the Next.js web app
• Real-time updates via Supabase subscriptions across 87 Postgres tables
• Row-level security enforced on every table; STRIDE threat model
• WCAG 2.1 AA accessibility; PWA with offline support and push notifications

Sensitive Data Can't Leave the Device

Veterans need help navigating complex VA disability claims - understanding regulations, rating criteria, and documentation requirements. But personal health information and service records are extremely sensitive. Sending that data to a cloud API is a non-starter.

AI That Runs Entirely in the Browser

Instead of calling OpenAI or any external API, the entire AI pipeline runs in the user's browser. LLM inference, RAG retrieval, voice processing, and OCR - all on-device. Zero network calls for personal data. Ever.

Treating the LLM Itself as an Attack Surface

On-device inference removes the server, but an LLM that reads VA regulations, scanned paperwork, and retrieved documents is still exposed to prompt injection. The defense is built like a real trust boundary:

• Dual-LLM split defense — a privileged controller orchestrates, while untrusted content is processed by a quarantined worker that never sees privileged actions (dualLLM.js)
• PII spotlighting & scrubbing — untrusted text is delimited and obfuscated PII is scrubbed before it reaches the model (piiScrubber.js), and URLs are stripped from output before any external send (sanitize.js)
• Hash-chained, tamper-evident audit log — each AI interaction is appended with sha256(prevHash ‖ entry); a single changed byte breaks the chain. It stores SHA-256 digests, never raw prompts or PII — and it's honestly tamper-evident, not tamper-proof (no signing key)
• Red-team CI gate — every build replays a corpus spanning 7 attack classes (direct & indirect injection, exfiltration, URL bait, schema hijack, PII traps, and mixed) against the defenses
• STRIDE threat model + OWASP LLM Top 10 mapping; NIST SSDF v1.1 and OWASP ASVS L1 aligned informally (no formal attestation claimed)

• On-device LLM inference (WebLLM / Wllama) — no API calls, no data exfiltration
• RAG pipeline over 38 CFR Parts 3 & 4, validated against the eCFR
• Voice input/output and document OCR for scanning VA paperwork
• 41 free claim tools (C-File analyzer, nexus builder, C&P prep, buddy statements)
• Optional BYOK Google Gemini for users who want it — local-first by default
• 803 passing tests across 46 files; 6-job CI (quality, test, build, e2e, red-team, security) + CodeQL

Compliance Framework Overload

Organizations subject to multiple regulatory frameworks (SOC 2, HIPAA, GDPR, PCI DSS, etc.) face massive redundancy. The same control - "encrypt data at rest" - appears in different language across every framework. Teams waste months re-documenting the same controls.

Codify Everything. Map Once. Export Anywhere.

Treat compliance like code: version-controlled, testable, and machine-readable. Map controls across all 10 frameworks to identify overlaps, generate NIST OSCAL catalogs for interoperability, and provide developer tools for inline compliance checking.

• 10 regulatory frameworks cross-mapped with shared controls identified
• NIST OSCAL export for GRC tool interoperability
• AI-assisted compliance review (offline + Claude API)
• VS Code extension with IntelliSense for control IDs
• MCP server for AI assistant integration
• Automated evidence collection and gap analysis

Proving Systems-Level Engineering Depth

Web portfolios are common. Proving you can architect large-scale C++ systems with real-time constraints, memory management, and modular plugin architecture? That requires building something substantial.

Full UE5 Game with Enterprise Patterns

Build a complete RPG with the Gameplay Ability System, modular architecture (17 separate modules), automated testing, and custom MCP integration for AI-assisted game development.

• GAS-based combat: combo, block, dodge, magic, ranged, melee
• 78+ automation tests for regression safety
• Save/load system with serialization
• Object pooling for performance optimization
• Custom gameplay debugger for runtime inspection
• 68 native gameplay tags for clean event routing

Practice What You Preach

Most portfolio sites claim expertise in security, accessibility, and compliance - but their own codebase doesn't demonstrate any of it. If you're selling best practices, your portfolio should be the proof.

Recursive Portfolio Architecture

The site itself demonstrates everything it advertises. Compliance engine? Built in. WCAG accessibility? Tested and validated. Security headers? A+ rated. CI/CD pipeline? 4-stage with SAST, DAST, and SBOM generation.

• 12 compliance frameworks with 651+ controls codified
• 642 passing tests across 54 test files (unit, integration, E2E, accessibility)
• 5-phase deploy pipeline: Fix → Validate → Prepare → Build → Ship
• 4-stage CI/CD: CI → CodeQL SAST → OWASP ZAP DAST → Release with SBOM
• VPAT (Voluntary Product Accessibility Template) generation
• AI guardrails with prompt injection defense
• PIV/CAC authentication flow for federal clients
• WCAG 2.2 accessibility throughout

Veterans Need Real Connection, Not Another Directory

Veteran isolation is a crisis. Existing platforms offer directories and forums, but nothing that creates genuine, real-time connection with Battle Buddy matching, mutual aid, and community support — the kind of platform that usually requires a team of 5-10 engineers.

Full Social Network Architecture, Solo Build

Build a complete social platform with real-time messaging, push notifications, image processing, OAuth with military verification, and content moderation — all as a single developer leveraging AI-assisted engineering.

• Battle Buddy matching by branch, era, location, and interests
• Groups & communities with real-time messaging
• WebSocket-powered live updates, typing indicators, online presence
• VSO Finder for veteran service organizations
• Mutual aid system (request/offer help: transportation, housing, food, employment)
• Crisis Support with 24/7 Veterans Crisis Line integration
• OAuth + ID.me military verification
• Image uploads with automatic optimization
• Push notifications (browser) + HTML email notifications
• Admin dashboard with content moderation and audit logs

Music Platforms Take Too Much, Give Too Little

Artists lose 15-30% of revenue to platforms. Distribution is locked behind gatekeepers. DDEX compliance is a nightmare. Musicians need a platform where they own their data and keep 100% of their revenue.

Vertical SaaS — Payment to Distribution in One Platform

Build a vertically integrated music platform: Stripe Connect for split payments, Cloudflare R2 for zero-egress content delivery, DDEX for industry-standard distribution, and Playwright for end-to-end quality assurance.

• DDEX industry-standard music distribution export
• Stripe Connect split payments & subscriptions
• Cloudflare R2 storage (S3-compatible, zero egress costs)
• Artist dashboard & analytics
• Fan storefronts with custom theming
• Album/track management with metadata
• Playwright E2E testing

Tax Software You Can't Trust

Tax preparation software handles the most sensitive financial data imaginable, yet most tools send everything to a server, use single-algorithm calculations, and offer zero legal traceability. Service-disabled veteran business owners face unique tax complexities that generic software handles poorly.

Client-Side Only, Dual-Algorithm Verification

All data stays in the browser, encrypted with AES-256. Every calculation is verified by two independent algorithms that must agree before any number is accepted. Every field is mapped to specific IRS legal citations for full traceability.

• Double-Blind Calculation Validation — two independent algorithms, locks on discrepancy
• Legal Citation Layer — every field mapped to specific IRS codes (26 USC, IRS Publications)
• SHA-256 cryptographic integrity for tamper detection
• All data stays in browser (AES-256 encrypted, zero-trust architecture)
• Federal calculators — Form 1040, Schedule C, SE tax, Section 179 / MACRS depreciation, QBI (federal totals and depreciation modules are in active stabilization — see test status below)
• Oregon / Portland-Multnomah state calculators — in progress; their test suites currently fail and are being resolved
• Auto-generated project health dashboard (tests, architecture checks) via the CTK toolchain

Service Businesses Need Secure Client Data Handling

Service-based businesses — wellness practitioners, consultants, therapists, coaches — collect sensitive client information: health histories, contact details, session notes, and payment data. Off-the-shelf booking platforms store this data on third-party servers with opaque security practices. HIPAA-grade data isolation shouldn't require enterprise budgets.

Encrypt Everything. Own Your Data.

Build a self-hosted client management platform where all personally identifiable information (PII) is encrypted at rest with AES-256. Role-based access control ensures staff see only what they need. Appointment scheduling, intake forms, session tracking, and client communications — all in one system with full audit logging.

• AES-256 encryption for all client PII at rest
• Appointment scheduling with availability management and reminders
• Digital intake forms with encrypted submission storage
• Session notes and treatment tracking with provider-only access
• Role-based access control (admin, provider, front desk)
• JWT authentication with refresh token rotation
• Full audit logging for compliance traceability
• RESTful API designed for future frontend integrations

Community Safety Education Needs Professional Infrastructure

Running a firearm familiarization service for marginalized communities requires professional class management, secure registration, payment processing, and scheduling — but off-the-shelf solutions don't serve the mission.

Purpose-Built CMS with Full Business Logic

Build a complete content management system with public-facing class listings, student registration with waiver agreements, Stripe payment processing, admin dashboard with calendar view, and email notifications — all optimized for the specific needs of a community-focused training organization.

• Student registration with digital waiver agreements
• Multi-provider payments — Stripe, Square, and PayPal behind an ADR-defined payment source-of-truth, plus gift cards and a merch store
• Admin dashboard — class management, calendar view, orders, and a system health panel
• Distributed rate limiting, feature flags, and webhook event-status tracking
• Interactive range-location map (Leaflet)
• Email notifications via Nodemailer; NextAuth.js + bcrypt authentication
• STRIDE threat model and 13 ADRs documenting the key architecture decisions

Safety Apps Must Be Trustworthy — Zero Knowledge Required

LGBTQIA+ individuals need safety resources, community connection, and secure communication — but existing platforms collect data that could be weaponized. A safety app that stores your data in plaintext isn't a safety app.

Zero-Knowledge Architecture with Signal Protocol

Build a full-stack safety platform where the server can never read user content. End-to-end encryption via Signal Protocol, anonymous community boards, geospatial resource mapping with PostGIS, and emergency features including panic mode with shake-to-hide and duress PINs.

• Resource map with 19+ verified organizations (HRC, Trevor Project, PFLAG, etc.)
• End-to-end encrypted messaging via Signal Protocol
• Tribes — anonymous community boards across 19 categories
• Mutual aid network for requesting and offering support
• Queer Cache — location-based encrypted messages
• Panic mode with shake-to-hide and duress PINs
• Community Bridge — transparent bug tracking
• Admin moderation system with trust levels
• React Native mobile app

Cloud AI Is a Leash — Local LLMs Need Orchestration

Running AI locally preserves privacy and control, but individual models can't handle complex multi-step workflows. You need parallel agents with different specializations working together — an architect, a programmer, and an executor — without sending a single byte to the cloud.

Swarm Architecture with Specialized Agents

The core is a spec → code → execution pipeline where the Architect defines requirements, the Programmer implements them, and the Executor runs and validates the output — each on its own local LLM endpoint with a custom system prompt. That pipeline grew into a registry of 94 specialized agent modules exposing 674 MCP tools (code, media, data, DevOps, and GPU), all served from a local MCP server with no cloud calls.

• 94 specialized agent modules exposing 674 MCP tools from one local server
• Architect → Programmer → Executor spec-to-execution pipeline
• GPU task router scheduling work across 4 local GPUs (~64GB VRAM, PCIe-aware)
• 6-job DevSecOps CI — lint, Snyk SCA + Code, tests, container scan, SBOM
• Snyk SCA clean (0 vulnerable dependencies across 12); MCP server over HTTP/SSE
• Docker containerization; extensible — add agents without changing the core

Information Overload Requires Intelligence, Not Just Aggregation

Tech professionals need to stay current across multiple domains — AI, cybersecurity, full-stack development — but RSS feeds are noise without curation. You need trust scoring, bias detection, and relevance filtering to separate signal from noise.

Curated Intelligence Pipeline with Hybrid Retrieval

Build a multi-source pipeline that scores every source on a 0-100 trust scale with bias indicators, then ranks content for relevance against one of 21 domain profiles (agentic AI, cybersecurity, MLOps/LLMOps, clean architecture, and more). Retrieval is hybrid: a BM25 lexical index and a dense sentence-transformers index are merged via reciprocal rank fusion, so results aren't dependent on either exact keywords or embedding quality alone. A pluggable multi-provider AI agent (OpenAI + Anthropic, with per-model cost tracking) synthesizes the ranked set into a searchable knowledge base.

• 404 curated RSS/TLDR sources (Stratechery, MIT Tech Review, Krebs, etc.)
• Trust scoring (0-100) with Platinum/Gold/Silver/Bronze tiers + per-source bias indicators
• Hybrid retrieval: BM25 lexical index + dense sentence-transformers, fused with reciprocal rank fusion
• 21 domain relevance profiles (agentic AI, cybersecurity, MLOps/LLMOps, clean architecture, …)
• Pluggable multi-provider AI agent (OpenAI + Anthropic) with per-model cost tracking
• Flask dashboard + REST API across 32 endpoints; CSV / Markdown export
• 8-job CI (lint, type-check, tests, pip-audit, Bandit SAST, gitleaks, CodeQL, zizmor) + SECURITY.md threat model
• 101 passing tests across 17 files

Security Professionals Need Unified Reconnaissance Tools

Security reconnaissance involves dozens of specialized tools, each with its own interface and output format. Professionals need a unified dashboard that catalogs tools, configures pipelines, runs audits, and presents findings — without juggling terminal windows.

Unified Security Dashboard with Pipeline Orchestration

Build a multi-page PWA that serves as command central for security operations — tools catalog with categorized listings, configurable recon pipelines, privacy audit workflows, agent architecture visualization, and an extensible scanner dashboard.

• Dashboard overview with security posture summary
• Tools catalog with categorized security/recon tools
• Recon pipeline configuration and execution
• Privacy audit assessment workflows
• Agent architecture visualization
• Security recommendations engine
• Scanner dashboard with scan history
• Offline-capable PWA — works without internet

Role-Specific Skills, Not Generic MBA Theory

Workers across every occupation sector need short, job-relevant continuing education — but most business and professional-development content is generic, long-form, and not mapped to a specific role or its regulatory context. A line cook, a paralegal, and a wind-turbine technician do not need the same lesson, and none of them has an hour to spare.

One Micro-Curriculum Per Occupation, Generated and Served at Scale

Each occupation gets a "kit" — a structured curriculum of roughly five-minute lessons with quizzes, branching scenario exercises, and spaced repetition. AI handles generation and runtime tutoring, but every call passes through a cost-aware router that maps the task to the cheapest viable model. One codebase serves consumer, high-school, university, and enterprise (SSO/seat-based) audiences across twenty languages.

• Four-tier model router (on-device Llama → Haiku → Sonnet → Opus) selects the cheapest model that can handle each task to control token cost
• 23,000+ MDX lessons across 501 occupation kits, validated in CI
• Internationalized to 20 locales from a single codebase via next-intl
• 58 versioned Supabase migrations through enterprise seats, org subscriptions, and SSO
• Spaced-repetition scheduling (FSRS / SM-2) and branching scenario assessments
• Stripe / PayPal / Square payments; SCORM 1.2 and LTI export for institutions
• Documented lethal-trifecta security audit and 14 CI workflows (AI-eval gate, Lighthouse, gitleaks, SBOM) plus 224 automated tests

History Is Hard to See in Space and Time Together

Historical data is scattered and rarely visualized spatially and temporally at once. It is even harder to see the displacement of looted cultural artifacts — the path from where an object originated to the museum that holds it today. History GPS makes both legible on a single interactive globe.

A Zero-Build Globe Over a Disciplined Data Pipeline

The front end is intentionally dependency-free: plain HTML, CSS, and JavaScript render a globe.gl / Three.js globe with no bundler and no framework. Behind it, a four-phase Node pipeline (validate → merge → verify → report) consolidates roughly 160 regional batch files into one canonical dataset, dedupes records, enforces ID uniqueness, and emits a machine-readable report. A dual-range slider filters by year; an arc toggle draws origin-to-museum provenance arcs for looted items.

• Interactive 3D globe (globe.gl / Three.js) with zero build step and no framework
• Dual-range timeline slider spanning 100,000 BCE to the present
• Looted-artifact provenance arcs drawn from an object's origin to its current museum
• Four-phase merge pipeline that consolidates ~160 regional batch files in a measured 1.26 seconds
• Canonical dataset with deduplicated, ID-unique records across 20 site categories
• 119 Vitest tests covering data integrity, filtering, coordinates, and globe logic

Every Prompt Pays Top-Tier Prices

AI coding spend balloons when every prompt — trivial or complex — hits a top-tier model at full token price. Developers have no easy way to match task difficulty to model cost, or to apply 2026 cost-optimization patterns (caching, compression, cascading) automatically inside the editor.

Score the Prompt, Then Route It

ORC intercepts the prompt before it reaches the model. It scores cognitive load on a 1–10 scale — using a fast rule-based heuristic or a roughly $0.001 Haiku classifier — maps the score to one of five routing tiers, and picks the cheapest viable model and effort level, surfacing an Approve / Override / Escalate / Downgrade decision. On top of routing it layers prompt caching, Haiku-based context compression, and a FrugalGPT quality cascade that only escalates to pricier models when cheap output fails a quality check.

• Five-tier cognitive router (minimal → extreme) mapping load score to model and effort
• FrugalGPT-style three-tier quality cascade (heuristic → structural → Haiku LLM) that escalates only on failure
• Haiku-based context compression to shrink prompts before the expensive call
• Prompt caching with ephemeral cache_control breakpoints on stable context
• Real Anthropic SDK integration with streaming execution
• Local Semgrep SAST with five custom rules plus documented prompt-injection hardening

A Gate Nobody Has Watched Run Is a Claim, Not a Control

A quality gate is a claim a codebase makes about itself, and reading the config only tells you the claim was written down — not that the gate runs, that it blocks a merge, or that it inspects anything at all. The same trap swallows a findings register: a row marked DONE is prose, and prose is not evidence. Both failure modes are invisible in code review because they look like diligence — a scanner in package.json, a required-checks aggregator in CI, a test file with negative cases. Everyone believes the control ran. Nobody has watched it run.

Execute Every Gate, Then Re-Prove Every Prior Claim

A coverage-ledger red-team protocol run against a real project at a pinned commit (HEAD 130dbb6, 2026-07-31), one orchestrator coordinating six lane/verifier sub-agents. Phase 0 builds a ledger of every tracked file via git ls-files — 462 files across 91 rows, every row starting UNSEEN and closing only as CLEAN or FINDING on a written evidence line, never by assertion. Phase 0.5 runs every quality-gate command verbatim and records three things separately: does it run, does it BLOCK with structural proof, and what did it actually return. Phase 3 is an anti-trust pass that re-opens every prior "DONE" finding against the current HEAD and re-proves it rather than inheriting it. Phases 4 through 7 add a dedicated verifier that votes to refute the orchestrator's own candidate findings, a completeness critic that hunts for surfaces never examined, and a final self-critique pass that attacks the audit's own output.

• Phase 0 coverage ledger — every tracked file enumerated via git ls-files; a row closes only as CLEAN or FINDING on a written evidence line
• Phase 0.5 gate audit — every quality-gate command run verbatim, with does-it-run, does-it-block, and what-did-it-return recorded separately
• Phase 3 anti-trust pass — every prior "DONE" finding re-opened against HEAD and re-proved, never inherited
• Dedicated verifier sub-agent votes to refute the orchestrator's own candidate findings before they're accepted
• Completeness critic hunts for surfaces the audit never actually examined
• Final self-critique pass that attacks the audit's own output
• One orchestrator plus six lane/verifier sub-agents; STRIDE-per-DFD, LINDDUN, MAESTRO, and attack trees layered on top of the gate audit
• Gates executed verbatim: typecheck, lint, vitest, Semgrep SAST, gitleaks, osv-scanner, license audit, markdownlint

A Genuine Quote From Superseded Law Is Still a Wrong Answer

Legal AI fails in two directions at once: it fabricates quotations that read perfectly, and it answers "what does the law say" without answering "as of when." Point-in-time correctness is not a nice-to-have in law — a genuine quote from superseded statute is a wrong answer delivered with full confidence.

Structurally Impossible, Not Statistically Unlikely

The model emits (version_id, char_start, char_end), never prose. Every character of legal text in a response is a server-side slice of an immutable, content-addressed blob, and the model's own copy of the text is discarded unconditionally — "there is no code path by which model-generated characters reach a quote field" (README.md:7-9). Around that structural guarantee: a bitemporal schema with a required as_of, a SourceAdapter contract enforced by twelve conformance checks, an NLI entailment gate whose backend was chosen against a 300-pair legal entailment benchmark spanning 25 premises, and a V1–V8 verification chain that runs on every answer.

• Model emits (version_id, char_start, char_end) offsets — every quoted character is a server-side slice of an immutable, content-addressed blob
• Bitemporal schema with a required as_of for point-in-time-correct retrieval
• SourceAdapter contract enforced by twelve conformance checks; eCFR and US Code adapters built and verified
• NLI entailment gate (DeBERTa-v3-base) benchmarked against a 300-pair legal entailment set over 25 premises
• Hybrid lexical + vector retrieval with an as_of pre-filter
• Resumable ingest orchestrator plus Wayback Machine backfill
• V1–V8 verification chain runs end to end on every answer before it's returned

Every Incumbent Fails at the Same Layer: Granularity

Nextdoor scopes to a neighborhood-ish blob, Ring Neighbors to a doorbell radius, Citizen to a city firehose; none can answer "is the 1400 block of Elm safe to walk right now, and is Building C's north stairwell still dark?" (README.md:15-18). And the one product that got closest to that resolution acquired a reputational problem — bulk law-enforcement access — that the category has never lived down.

Derive the Geography First, Then Write the Constraints Before the Code

TIGER ingest → districts → block faces → sectors, with a QA queue for human review of flagged derivations and a benchmark command that measures point resolution against the project's own database rather than a synthetic fixture. The product constraints were written as non-negotiables before the code: no bulk law-enforcement access ever (consent-gated, per-incident, logged), anonymity claims that are true at the storage layer, evidence integrity server-attested rather than client-asserted, an explicit "we are not a 911 service" on every surface, and race/appearance descriptors structurally constrained in the reporting UI.

• TIGER ingest → districts → block faces → sectors pipeline, with a QA queue for human review of flagged derivations
• Benchmark command (pnpm run geo:bench) measures point resolution against the project's own database, not a synthetic fixture
• No bulk law-enforcement access, ever — consent-gated, per-incident, logged
• Anonymity claims true at the storage layer; evidence integrity server-attested rather than client-asserted
• Explicit "we are not a 911 service" messaging on every surface
• Race and appearance descriptors structurally constrained in the reporting UI
• Postgres row-level security, negative-tested in CI
• Ten planning documents and seven accepted ADRs constrain what Sprint 2 onward may build, including a documented audit of defects in the originating blueprint marked "do not carry forward"

The Engineering Problem Is Reversibility, Not Optimization

The Windows-optimizer category is a trust wasteland: fabricated registry-error counts, "speed up 300%" claims, bundled PUPs, and changes that cannot be undone once applied. Building a genuinely useful tool in that space means treating reversibility, not optimization, as the actual engineering problem.

Six Prime Directives, Enforced Structurally

Reversible by default — the exact inverse of every destructive action is recorded in an append-only undo journal before execution. Preview before apply. A verified System Restore point before any Advanced/Expert batch. Least privilege via a never-elevated UI plus an on-demand elevated broker behind a validated IPC boundary. A documented DANGER refusal list — disabling Defender, removing Edge/WebView2, killing Windows Update, registry cleaning. And honest reporting with no unverifiable performance claims. Destructive operations are tested against throwaway VHDX volumes and temporary registry hives.

• Reversible by default — the exact inverse of every destructive action is recorded in an append-only undo journal before execution
• Preview before apply on every change
• A verified System Restore point required before any Advanced/Expert batch operation
• Least privilege: a never-elevated UI plus an on-demand elevated broker behind a validated IPC boundary
• A documented DANGER refusal list — disabling Defender, removing Edge/WebView2, killing Windows Update, registry cleaning
• Honest reporting with no unverifiable performance claims
• Destructive operations tested against throwaway VHDX volumes and temporary registry hives
• CI enforces the same gates: NuGet lock-file enforcement, dotnet list package --vulnerable, and cargo audit

Standards Drift Per Project — AI Agents Make the Gap Structural

An engineer's standards drift per project — the security checklist that was rigorous in January is half-remembered by June, and every new repo re-litigates decisions that were already settled. Add AI coding agents and the problem compounds: an agent with no canonical reference will confidently apply whatever convention it saw most in training.

One Canonical Corpus, Mechanically Propagated

Guides are written once under docs/best-practices/, and scripts/propagate-ai-rules.mjs pushes five mirror rule files into every repo — CLAUDE.md, .github/copilot-instructions.md, .cursor/rules/best-practices.mdc, .windsurfrules, .continuerules — so the same standard binds Claude Code, Copilot Chat, Cursor, Windsurf, and Continue. For agents specifically, the toolkit ships a routing index (AGENTS.md), a machine-readable manifest (guides.json), and an llmstxt.org summary (llms.txt), so an agent looks the answer up rather than inventing it.

• Guides written once under docs/best-practices/, propagated mechanically via scripts/propagate-ai-rules.mjs
• Five mirror rule files per repo — CLAUDE.md, .github/copilot-instructions.md, .cursor/rules/best-practices.mdc, .windsurfrules, .continuerules — binding Claude Code, Copilot Chat, Cursor, Windsurf, and Continue to the same standard
• AGENTS.md routing index so an agent finds the right guide instead of guessing
• guides.json machine-readable manifest
• llms.txt summary following the llmstxt.org convention
• Spans security, accessibility, compliance, AI agent architecture, red-teaming, DevOps, and domain-specific playbooks, with sources cited throughout

Privacy-First AI Applications

Scenario: An organization handles sensitive user data (health records, financial info, PII) but wants to leverage AI for analysis, guidance, or decision support — without sending data to cloud APIs.

Solution Approach: Deploy on-device AI using WebLLM (WebGPU) and Wllama (WASM) for browser-based LLM inference. Pair with a RAG pipeline over domain-specific regulations or knowledge bases. Voice I/O and OCR for accessibility. Zero network calls for personal data.

SFG Capabilities Applied:

• On-device LLM inference and RAG pipeline architecture
• Zero Trust data architecture — no server-side collection
• PWA for offline-first operation
• WCAG 2.2 AA accessibility (voice, keyboard, screen reader)
• Compliance with HIPAA/NIST data handling requirements

Rapid Enterprise Platform Development

Scenario: A community, nonprofit, or startup needs a full-featured platform — messaging, events, member management, privacy protection — but has a startup budget and a tight timeline.

Solution Approach: Agentic Engineer + AI paradigm: human architect directing AI tools to produce production-grade code at 18-36x traditional ROI. End-to-end encryption, row-level security, real-time subscriptions, WCAG accessibility — shipped in days, not months.

SFG Capabilities Applied:

• AI-assisted development methodology (not "vibe coding" — reviewed, intentional)
• Full-stack architecture: Next.js, Supabase, PostgreSQL, TypeScript
• End-to-end encryption and 233+ RLS policies for data isolation
• PWA with offline support and push notifications
• MBAi Sustainable Balanced Scorecard for measuring ROI across financial, social, and environmental axes

Multi-Framework Compliance Automation

Scenario: A defense contractor, SaaS company, or healthcare organization is subject to multiple compliance frameworks (NIST 800-171, CMMC, SOC 2, HIPAA, GDPR, PCI DSS) and drowning in redundant documentation.

Solution Approach: Codify all compliance requirements as version-controlled, machine-readable data. Cross-map controls across frameworks to eliminate redundancy. Generate OSCAL catalogs for GRC tool interoperability. Provide developer tools (MCP server, VS Code extension) for inline compliance checking.

SFG Capabilities Applied:

• 12-framework cross-mapping engine with 651+ controls
• NIST OSCAL export for SIEM/GRC platform integration
• MCP server (7 tools) for AI assistant integration
• VS Code extension with IntelliSense for control IDs
• AI-assisted gap analysis and evidence collection
• Engineering Commandment X: "Enforce Standards Programmatically"

Large-Scale Systems Engineering

Scenario: A project requires deep systems programming — real-time constraints, memory management, modular architecture, and automated testing at scale — beyond typical web application complexity.

Solution Approach: Apply enterprise software patterns (modular architecture, subsystem decomposition, automated testing) to systems-level code. Use the Gameplay Ability System pattern for complex state machines. Build custom MCP tooling for AI-assisted development at scale.

SFG Capabilities Applied:

• C++ systems programming with modular plugin architecture
• MCP automation (369+ commands) for AI-assisted development
• Automated testing suites for regression safety
• Performance optimization (object pooling, fast iteration)
• Engineering Commandment I: "Write Tests First" — applied to systems code

Recursive Portfolio & Meta-Demonstration

Scenario: A business needs its web presence to not just claim expertise but demonstrate it — compliance, accessibility, security, performance, and AI integration all provable in the codebase itself.

Solution Approach: Build the site as a living demonstration. The compliance engine runs on the site. The WCAG accessibility is tested and validated. Security headers are A+ rated. The CI/CD pipeline includes SAST, DAST, and SBOM generation. The AI assistant uses both server inference and on-device WebLLM.

SFG Capabilities Applied:

• 12 compliance frameworks codified in the site's own codebase
• 4-stage CI/CD pipeline (CI → CodeQL SAST → OWASP ZAP DAST → Release with SBOM)
• Dual-tier AI assistant (server API + WebLLM local inference)
• WCAG 2.2 AA accessibility with DHS Trusted Tester v5.1 methodology
• 6-gate preflight system enforcing all 10 Engineering Commandments
• A+ security headers (Helmet.js, CSP, HSTS)

Veteran & Mission-Driven Social Platforms

Scenario: A veteran service organization, community group, or mission-driven nonprofit needs a full social platform — matching, real-time messaging, mutual aid, crisis support — not just a directory or forum.

Solution Approach: Build a complete social network with WebSocket-powered real-time messaging, intelligent matching algorithms, push notifications, OAuth with identity verification, and admin moderation tools. Crisis support integration for high-risk communities.

SFG Capabilities Applied:

• Full social network architecture (messaging, presence, notifications)
• Matching algorithms (by branch, era, location, interests)
• Crisis support integration (Veterans Crisis Line)
• Identity verification (ID.me, OAuth)
• Content moderation and admin audit logs
• MBAi Servant Leadership coaching framework applied to platform design

Vertical SaaS & Industry-Specific Platforms

Scenario: An industry (music, legal, medical, trades) needs a domain-specific platform with industry-standard integrations, split payments, content delivery at scale, and compliance with sector-specific regulations.

Solution Approach: Build a vertically integrated SaaS platform with industry-standard data formats (DDEX, HL7, ACORD), split payment processing (Stripe Connect), zero-egress CDN (Cloudflare R2), and end-to-end testing (Playwright). The platform model, not a service agency.

SFG Capabilities Applied:

• Industry-standard format integration (DDEX, OSCAL, XML schemas)
• Payment platform architecture (Stripe Connect, split payments, subscriptions)
• CDN and content delivery (Cloudflare R2, S3-compatible)
• E2E testing with Playwright
• MBAi Triple Bottom Line P&L — financial sustainability with social mission

Financial-Grade Secure Web Applications

Scenario: A financial tool, tax preparation system, or calculator handles extremely sensitive data and requires legal-grade correctness guarantees — where a miscalculation has real consequences.

Solution Approach: Client-side-only architecture with AES-256 encryption. Double-blind calculation validation (two independent algorithms must agree). Legal citation mapping for regulatory traceability. Cryptographic integrity verification (SHA-256) for tamper detection.

SFG Capabilities Applied:

• Double-blind calculation validation — two independent algorithms must agree
• AES-256 encryption + SHA-256 integrity hashing
• Legal citation layer mapped to specific regulatory codes
• Zero-trust browser architecture — no server-side data
• Engineering Commandment III: "Security Is Not Optional"

Encrypted Client & Practice Management

Scenario: A wellness practice, consulting firm, law office, or therapy practice needs client management — appointments, intake forms, session notes, billing — with genuine data protection, not a SaaS platform that stores client data on someone else's server.

Solution Approach: Self-hosted Express/Node.js platform with AES-256 encryption for all PII at rest. Role-based access control (admin, provider, front desk). JWT authentication with token rotation. Full audit logging for regulatory compliance. RESTful API for future integrations.

SFG Capabilities Applied:

• AES-256 encryption at rest for all client PII
• Role-based access control (RBAC) with principle of least privilege
• JWT auth with refresh token rotation
• Audit logging for HIPAA/regulatory traceability
• Compliance-as-Code patterns applied to healthcare/service data
• Engineering Commandment II: "Automate Everything Repetitive" — scheduling, reminders, intake workflows

What Ties Every Use Case Together

Regardless of domain, every SFG project shares a common engineering DNA:

• Security by Default — AES-256, Zero Trust, CSP, HSTS on every project. Not bolted on after launch.
• Accessibility First — WCAG 2.2 AA, Section 508, DHS Trusted Tester v5.1. Keyboard, screen reader, and voice support.
• Compliance Built In — NIST, CMMC, FedRAMP, OSCAL baked into the development lifecycle, not a post-hoc audit.
• AI-Augmented Development — MCP servers, agentic workflows, on-device inference integrated into the engineering process.
• MBAi Methodology — Triple Bottom Line accounting, Servant Leadership, Sustainable Balanced Scorecard applied to every engagement.
• Preflight Quality Gates — 6-gate system (Format → Lint → Tests → Docs → LLM Context → Audit) runs before every deploy.
• 4-Stage CI/CD — CI → CodeQL SAST → OWASP ZAP DAST → Release with SBOM. Every commit scanned.