Engineering evidence
Don't take my word for it
I am an AI-native builder in Vancouver: I design and ship software by directing AI coding agents, and I make the output trustworthy with tests, CI, evaluation and audit trails. That is an unusual profile to hire, so this page exists to be checked rather than believed. Every claim below links to something you can open yourself — a repo, a package, a running app, a store listing. Where proof does not exist, I say so on the same line.
The part I could not write myself
Independent code review — agentpay
“Not slop. A small, coherently layered codebase with genuinely verified security mechanisms, honest documentation of its own limitations, and adversarial tests — cleaner than most mid-level engineers' hand-written projects.”
The reviewer checked every security claim in the README against the source, and rated the SSRF implementation senior-level: DNS pinned at connect time to defeat rebinding, and every redirect hop re-validated with credentials stripped on cross-origin. It also named the codebase's real weaknesses — an in-memory single-process ledger, and admin auth that is open unless a token is set. Both are documented in the repo's own SECURITY.md, which is exactly why I am comfortable linking it.
The ledger — claim, data, proof
agentpay — an open-source gateway that lets AI agents spend money under budgets, approvals and an append-only audit ledger, without ever holding keys.
MIT · TypeScript · v0.7.0 · one production dependency · 94 passing tests across 11 files (214 assertions), 27 of them security regression tests · CI runs typecheck + the full suite on every push · clone it and run npm test
Security is documented, not asserted — a threat model naming four attacker classes and the mitigation for each, plus three residual risks I disclose openly and a deploy checklist. Every hardening item has a regression test.
SSRF: DNS pinned at connect time, re-validated on every redirect hop, credentials stripped cross-origin · admin CSRF origin check · x402 asset allowlist so a hostile merchant can't redirect the signature to another token · per-agent serialization against double-spend
Read SECURITY.md ↗A real payment settled on-chain — the x402 rail signs genuine EIP-3009 USDC authorizations. This one went through a live facilitator: 0.01 USDC moved from a wallet holding zero ETH, because the facilitator pays the gas. That is the whole design in one transaction.
Base Sepolia · block 42,807,804 · transferWithAuthorization · 10,000 units = 0.01 USDC (6 dp) · payer wallet ETH balance 0, nonce 0 — read it off the chain, not off my README
MixMind — a fine-tuned, self-hosted LLM for concrete-mix design: a RAG copilot that cites its sources and refuses when the notes don't cover the question, plus a multi-agent committee whose numbers come from a real model, not from the LLM.
Gemma 4 12B + LoRA (r=16, 65.6M trainable = 0.55% of the model, ~250 MB adapter) · fine-tuned on an AMD MI300X, served on a Radeon PRO W7900 under ROCm — raw rocm-smi dumps committed in the repo · built for AMD Developer Hackathon: ACT II
Try it without installing anything — a live demo of the Floor Copilot and the Mix Committee, including the slider that recomputes cost and carbon as you move it.
the plant knowledge base in the demo is deliberately fabricated — a fictional plant, so the project could be open-sourced without exposing an employer. The strength model underneath is trained on public data.
Open live demo ↗The model result is reproducible, not asserted — gradient-boosting strength model, held-out R² 0.91 (MAE ≈ 3.5 MPa) on the public UCI Concrete dataset. One command, no GPU, and it fetches the data live.
1,030 lab tests (Yeh 1998) · 824 train / 206 held out · across seeds [42, 0, 1, 2, 7, 123, 2024] R² ranges 0.881–0.943, mean 0.916 — the reported seed sits below the mean, so nothing was cherry-picked
Read the script ↗CloakPii — a one-command CLI for cross-border PII compliance: mask, tokenize, encrypt, and generate a report you can hand to a reviewer. pip install cloakpii gets you a working tool.
v1.9.0 · MIT · 11 releases shipped between 14 June and 1 July 2026 · 257 passing tests · CI runs them on Python 3.10 / 3.11 / 3.12 alongside ruff, bandit and pip-audit gates
View on PyPI ↗Agentic Sentry — a runtime safety guard that watches what local AI coding agents actually execute, and stops the dangerous commands. Zero LLM in the hot path, because a guardrail should not depend on the thing it is guarding.
v0.1.9 · MIT · 10 tagged releases · 20 shell test files green in CI · macOS only · packaged as a formula on my own tap: brew install hellotravisss/tap/agentic-sentry
An internal operations copilot, in use by colleagues — separately from MixMind, I built and deployed a recipe-management tool that people at the plant where I work use on shift. It is behind employer confidentiality, so there is no public link. I am happy to walk through it on a screen share.
React · TypeScript · Supabase · gathered requirements from operators who do not write specifications, then had to earn the adoption — the part of the job that is not code
Private — walkthrough on requestVisaScout — a global mobility analyzer shipped as a native iOS app and reviewed through App Store review.
Native iOS · visa requirements for any passport to any destination · live on the App Store
App Store ↗geo-engine — my Generative Engine Optimization methodology, released as an open-source Claude Code skill rather than kept as a trade secret.
Open source · the same method behind this site's own AI-search visibility
Open repo ↗Everything else — the full portfolio, written up as case studies: the problem, what I built, my role, the stack, and where it landed.
20+ shipped · 10 live products · 6 open source · web, mobile, CLI, ML, agent tooling · all solo, AI-paired
Case studies →Prototype to production, on a real floor
Stage 1 — Prototype
MixMind
Built for the AMD Developer Hackathon on demonstration data, because a competition entry has no business carrying a real employer's recipes. Fine-tuned the model, designed the retrieval so it cites its sources and refuses when it doesn't know, and grounded the multi-agent committee in a strength model rather than letting it improvise.
Stage 2 — Deployed internally
The internal copilot
I carried the same approach into a recipe-management tool that colleagues at my plant now use on shift. Different build, different constraints: a hosted model rather than the self-hosted one, requirements gathered from operators who do not write specifications, and a user base that simply stops opening a tool that wastes their time. Earning that second part is the job. It sits behind employer confidentiality, so it is a screen share rather than a link.
How I work, and what I am not
Verification over vibes
I do not hand-write most of my code. I direct AI coding agents — Claude Code, daily — which means the interesting problem is not typing, it is trust: how do you know the thing works?
So I build the trust layer deliberately. Automated tests including adversarial ones. CI on every commit. Independent AI security reviews that have found and fixed real issues. Written threat models. Retrieval that refuses rather than guesses. Audit logs that record denials, not just successes. The A− above is the point: I would rather be checked than believed.
What I don't have
- No computer-science degree. My degree is a BFA in Visual Communication.
- No decade of hand-on-keyboard software engineering. I have been building this way for under a year.
- No production experience with Airflow, dbt, Snowflake, Databricks, Kubernetes or LangChain. I have built agent systems without them.
- Not an ML researcher. I fine-tune and evaluate; I do not train foundation models.
You would find all of this in week two anyway. I would rather you find it here.
Where this comes from
I run production equipment at a precast concrete plant in Delta, BC — Hess block machines and Masa mixers — and I have trained operators and written the SOPs there. Before Canada I spent fifteen years running things: a photography studio, a 35-unit hospitality operation, a travel business leading teams of ten-plus across thirty countries, and two years lecturing at a university. I shot for Harper's Bazaar, Coca-Cola and Calvin Klein, and I still photograph architecture.
None of that is a software career, and I am not going to pretend it is. What it produced is the half of a forward-deployed role that is hardest to teach: sitting with people who cannot specify what they need, working out what would actually help, shipping it, and getting them to use it on Monday. The software half I built in the last year, in public, and you can audit it above.
Based in Richmond, BC — Metro Vancouver. Authorized to work in Canada; permanent residence in process through family sponsorship. Open to forward-deployed, AI solutions, applied AI and implementation engineering roles, remote across Canada or hybrid in Vancouver. Comfortable with travel: I have worked across thirty-plus countries and enjoy being on the road with customers.