The projects, out loud.
Two hosts talking through what I've built and why — plus one short video — generated with Google NotebookLM from the projects' own documentation. If you'd rather listen on a commute than read a showcase page, start here: every episode has a download link, and each one is also embedded next to the project it covers.
The short one, and the only one with pictures: a single commit followed all the way to production — built, scanned, attested, checked against policy — and what the "digital passport" it accumulates is actually for.
The pipeline from the cockpit — the PARR loop running across PFactory, AIFactory and TFactory, and the point it keeps coming back to: the human always clicks.
Why compliance evidence belongs in a tamper-evident ledger inside your own cloud rather than a SaaS token you have to trust — and what changes when the CAB chair and the regulator are looking at the same dashboard.
The evidence ledger underneath SARC, on its own terms: provenance from commit to running runtime, four-eyes approval, hash-chained audit log, and why "we'll compile the evidence at quarter end" is the thing to kill.
Flux makes a cluster match git but has no opinion about what should be in git next. What it takes to make cross-environment promotion a reviewed, evidenced thing instead of hand-rolled CI nobody reads.
The longest one, and the argument underneath all the rest: no model in the gate, evidence as a by-product rather than a reconstruction, and why a gate verified only by passing is indistinguishable from one that cannot fail.
The planning half of the Factory suite — taking a plan, enriching it with live org and cloud context, running architecture, security and feasibility gates over it, and emitting governed work an agent can actually execute.
The whole pipeline end to end — PFactory plans it, AIFactory builds it, TFactory tests it, CFactory watches it — and the human gate at every seam that stops it being a machine that ships whatever it likes.
What it takes to put an MCP gateway in front of internal APIs and have it survive a security review — fail-closed on misconfiguration, secrets the model never sees, an SSRF guard, and redaction before anything reaches the LLM.
The last 10% of an Azure DevOps to GitHub Actions migration that the importer leaves to you — why it stays review-first, never auto-commits, and can run entirely on local models inside an air-gapped network.
These are machine-generated from each project's own documentation, so treat them as a readable summary rather than my own words — the written pages are the authoritative version. Audio is 96 kbps mono AAC and the video is 720p H.264; the files live in the repo, so a download is a plain HTTP fetch with nothing tracking it.