Every project below was read back out of its own repository — manifests, module graphs, commit history and infrastructure code — before a word was written about it. Where something is not publicly reachable, it says so.
Scroll to move through the chapters · each drives its own 3D scene
012026Founder · Sole engineer
PawDoc
AI pet-health triage where the safety rail runs before the model does.
The emergency keyword list is written three times — in Dart, Python and TypeScript — and a test fails the build if the three ever disagree.
Owners cannot tell an emergency from a nuisance, and the internet answers both the same way. A false negative — telling someone their animal is fine when it is not — is the single worst thing this product can do.
Architecture
A Flutter client, a Python FastAPI analysis service, Supabase Postgres with row-level security on every user table, roughly thirteen Deno edge functions, and Cloudflare R2 for image and video objects. Analysis tiers from Gemini to Claude.
Innovation
A hardcoded emergency-keyword override executes before any model call and is mirrored client-side so it still works offline. The keyword lists live in three languages — safety.py, emergency_keywords.mjs, emergency_keywords.dart — and a parity test fails the build if they drift apart.
Outcome
Structured JSON output only, temperature 0.1, a confidence floor below which the answer becomes "not enough information", and an action ladder with no "do nothing" rung. The model never names a condition and never says "normal".
Google Play production release build 1.0.0+8, approved 15 Aug 2026. Public store listing had not yet resolved when this page was built.
118
commits
3
languages kept in parity
0.1
model temperature
13
edge functions
Emergency override runs before the AI, not after it — and is mirrored on-device so it survives an offline cold start.
The AnalysisResult contract is frozen across Dart, Python and TypeScript; all three change together or not at all.
Row-level security on every user table with both USING and WITH CHECK, verified by a scripted RLS test against a real database.
Disclaimers are injected server-side. The client only gates on the flag, so it cannot render a result without one.
A safety-critical defect found during device QA — Emergency unreachable on an offline cold start — was fixed and regression-tested rather than noted.
Flutter
Dart
Riverpod
Python
FastAPI
Supabase
PostgreSQL
Deno
Claude
Gemini
Cloudflare R2
Sentry
PostHog
022026Founder · Sole engineer
Cloud Waste Hunter
A serverless FinOps platform that prices AWS waste from your own billing data.
The AI explains the finding. It never writes the command — those come from a deterministic playbook, because a hallucinated `aws` command deletes something real.
Cloud waste is invisible because it is boring: a stopped instance still bills for its volume, an unattached IP still bills hourly. The cost is real, the evidence is buried in a billing export nobody reads.
Architecture
A container-image Lambda runs FastAPI through Mangum behind API Gateway with a JWT authorizer. Scans fan out one asynchronous invocation per connected account, reaching customer accounts by STS AssumeRole with a generated ExternalId. All of it is provisioned by Terraform.
Innovation
Pricing degrades in three tiers: exact dollars from the account’s CUR 2.0 data lake via Athena, falling back to a DynamoDB-cached AWS Pricing API, falling back to static rates — so a number is always defensible and its provenance is always known.
Outcome
Over thirty resource collectors, eight security baseline checks rolled into a weighted A–F grade, and a Bedrock-backed advisor that explains impact while a deterministic playbook engine — never the model — produces the remediation commands.
Live and publicly reachable at cloudwastehunter.io. Source repository is private.
510
commits
30+
resource collectors
8
security checks
3
pricing fallback tiers
Cross-account access via STS AssumeRole with an auto-generated ExternalId and a one-click CloudFormation template — the confused-deputy problem solved the way AWS documents it.
Conversational FinOps chat streams over a Lambda Function URL specifically to escape API Gateway’s 30-second ceiling.
The LLM is explanation-only. Remediation commands come from a deterministic playbook, so the model can be wrong without being destructive.
Three-tier cost estimation with graceful fallback, so a figure is never silently fabricated when the data lake is unavailable.
`make deploy` provisions ECR, builds and pushes the image, applies Terraform in two phases, and prints the API URL.
Python
FastAPI
AWS Lambda
Terraform
DynamoDB
AWS Athena
AWS Bedrock
AWS Cognito
React
Vite
TypeScript
Tailwind CSS
032026Founder · Sole engineer
VibingCoderAI
Turns a casual idea into the brief a senior engineer would have written.
Credits are reserved and refunded through DynamoDB optimistic concurrency, so a failed model call cannot silently eat someone’s balance.
Coding agents fail on vague prompts, and the gap between "what someone wants" and "what an agent can execute" is a brief nobody wants to write.
Architecture
Deliberately split across two clouds: Vercel serves the Next.js frontend, AWS runs the logic. API Gateway with a Cognito JWT authorizer fronts Docker-based Node Lambdas; DynamoDB holds credits and history. No anonymous code path exists.
Innovation
A two-bucket credit economy — a daily allowance that resets at UTC midnight plus a never-expiring purchased bucket — with atomic reservation and refund through DynamoDB optimistic concurrency control. No double-spends, and no credits leaked when the upstream model call fails.
Outcome
Three generation modes each with their own strict system prompt, LemonSqueezy billing through an idempotent signature-verified webhook, and a deliberate cost ceiling: prompt caching, gateway throttling, budget alarms and scoped IAM.
Live and publicly reachable at vibingcoderai.com. Source repository is private.
89
commits
2
clouds, by design
3
generation modes
~16%
saved by prompt caching
Two clouds on purpose — Vercel for the edge, AWS for the brain — with a single public HTTPS contract between them and no shared code.
Credit reservation and refund are atomic under optimistic concurrency, which is the difference between a billing system and a spreadsheet.
Row-level authorization derived from the Cognito `sub` claim rather than a client-supplied user id.
Cost ceiling engineered rather than hoped for: prompt caching, API Gateway throttling, AWS Budgets alerts and a forecasted-spend pager.
Infrastructure is Terraform-managed end to end — the stack is re-creatable from the repository.
TypeScript
Next.js
React
Tailwind CSS
AWS Lambda
DynamoDB
AWS Cognito
Terraform
Claude
Vercel
042026Founder · Sole engineer
FormAI
A camera-driven fitness coach that counts and corrects reps on-device.
Packaged food never reaches the vision model — a barcode is an exact identification against the manufacturer’s own nutrition panel, and it is free.
Form is what makes training safe, and it is exactly what you cannot check alone. Sending video to a server to find out is slow, expensive and a privacy problem.
Architecture
Everything vision-related runs on the device through Google ML Kit pose detection. Supabase Postgres holds the exercise catalogue behind row-level security; a Deno edge function and a Terraform-managed AWS edge serve the legal surface.
Innovation
Two detectors share one camera stack rather than two. Barcode scanning was chosen from the same vendor as the pose detector so it adds a detector to the existing pipeline instead of bringing a second camera implementation that would fight the first.
Outcome
Roughly 61,000 lines of Dart across 177 source files, eight pose analyzers and a 138-exercise catalogue, with a four-layer release-build error guard and observability behind a KVKK/GDPR consent gate.
Build 1.0.0+40 on the Google Play closed testing track. Not yet publicly listed; iOS is written but has never been built.
604
commits
~61k
lines of Dart
8
pose analyzers
138
exercise catalogue
Pose analysis is entirely on-device — no video leaves the phone for the coaching path.
The barcode route exists so packaged food is identified exactly rather than estimated by a vision model.
Every user table is RLS-gated end to end; analytics sit behind an explicit consent gate.
A dependency was removed only after measuring that it had already been tree-shaken to 848 bytes — the reasoning is written down in the manifest.
The privacy policy was corrected when the calorie scanner started uploading photos, in a commit that says exactly that.
Flutter
Dart
Riverpod
Supabase
PostgreSQL
ML Kit
Terraform
RevenueCat
Sentry
PostHog
052026Founder · Sole engineer
Ehliyet Akademi
A driving-licence learning platform built on a spaced-repetition engine.
The scheduling engine is its own package with its own tests, because the thing that decides when you see a question again is the actual product.
Licence preparation is sold as question dumps. Volume is not the constraint — retention is. Answering two thousand questions once teaches less than answering the right two hundred on the right days.
Architecture
A Turborepo monorepo: a Next.js App Router web app, a Flutter mobile app, and shared packages for the content schema, the question bank, the database layer and the scheduling engine. Drizzle ORM over Postgres, with PGlite for embedded local execution.
Innovation
The spaced-repetition engine is an independent package that depends only on the content schema — no database, no framework, no network. That makes the part of the product that actually determines learning outcomes unit-testable in isolation.
Outcome
Quality gates that mirror CI exactly (`pnpm gates`), architecture decision records in-repo, and a binding content rule: an original question bank, with "official rule" reserved for verified legislation.
Web platform live at ehliyetegitim.com. Mobile build 1.0.0+6 produced; public store listing pending.
261
commits
4
shared packages
2
client surfaces
28d
from first commit to live
The scheduling engine is framework-free and database-free, so its behaviour is provable rather than observable.
PGlite alongside Postgres means the same schema runs embedded and hosted, which makes local development and tests real rather than mocked.
Documentation discipline is enforced by structure: ADRs in-repo, a roadmap treated as the single source of truth, phase gates that must be green before work continues.
Content legality is a first-class constraint — original questions only, and regulatory claims restricted to verified legislation.
Commit history is written in Turkish for a Turkish-market product, and in English everywhere else.
TypeScript
Next.js
React
Drizzle ORM
PostgreSQL
PGlite
Flutter
Turborepo
Playwright
Vitest
062026Founder · Sole engineer
CoachScore
A deterministic scoring engine that an LLM is only allowed to narrate.
Seven sub-scores are computed in code first. The model receives the finished numbers and writes the explanation — it never decides the grade.
Free advice in game communities is confident, contradictory and unaccountable. The question is asked constantly and answered badly.
Architecture
A Next.js application over Drizzle and Postgres. A deterministic engine grades an account across seven dimensions; Claude drafts the diagnosis from the exact computed numbers; a human coach verifies before delivery. Reports render to PDF via pdf-lib.
Innovation
The model is never the source of a number. It receives computed scores and a gap list, and its output is validated against a zod schema converted to a JSON schema for structured tool use — so a malformed or invented response is rejected rather than shipped.
Outcome
Three separate CI workflows — validation, security and quality — a phase ledger recording what is implemented versus activated, and an explicit unofficial-fan-content disclaimer in the README.
Scoring engine and AI pipeline implemented and green against the live API. Later phases are built but not activated pending external service provisioning. The domain was not resolving when this page was built.
7
scoring dimensions
3
CI workflows
0
numbers written by the model
Deterministic scoring first, narration second — the same pattern that makes the other AI products in this portfolio safe.
Schema-validated model output with an anti-hallucination pass, not prompt-level hoping.
A phase ledger distinguishes "implemented" from "activated", which is a rarer and more honest distinction than most status pages make.
Trademark and fan-content policy addressed in the repository rather than after a takedown.
TypeScript
Next.js
React
Drizzle ORM
PostgreSQL
Claude
Zod
Playwright
072026Architect · Engineer
NOVA
An on-device agent architecture, and an honest account of why it was not enough.
Its own architecture review concluded the model is not the product — the harness is — and that the agent’s core guarantee was prompt-hoped rather than enforced.
Research & architecture
The four beats
Problem
A phone assistant that can actually operate the phone has to be trusted with outward actions — sending, deleting, paying. Trust has to be structural, because one confident hallucination on an outward action is unrecoverable.
Architecture
Gradle multi-module with deliberately platform-free boundaries: core, planner, memory and the tool API contain no Android dependencies and are unit-tested in isolation. Voice, LLM providers and Android integration are separate modules behind interfaces.
Innovation
Verify-don’t-assume actuation — real machine verifiers read back the device state after an action rather than trusting the model’s report — plus a deny-first confirmation parser and a no-retry rule on outward actions.
Outcome
The architecture review is the deliverable. It identifies that success was accepted on the model’s word, that memory was a 500-row log with no consolidation, and that accessibility-as-spine was a strategic dead end — then argues for a channel hierarchy instead.
Working multi-module codebase plus a ten-document architecture review. Deliberately not shipped — the review concluded the enforcement model was not sound enough to ship.
13
Gradle modules
10
architecture documents
0
outward actions taken on trust
Platform-free module boundaries — the portable part of the system genuinely does not import Android.
Verifiers read device state back after acting, instead of accepting the model’s claim of success.
Deny-first confirmation parsing and a no-retry rule on outward actions.
The review is written against the author’s own work: "assume the current architecture is wrong until proven correct".
Instrumentation-first debugging — root causes are found rather than guessed.
Kotlin
Android
Gradle
Coroutines
082026Founder · Sole engineer
Tayfa
Friends through doing, not swiping — with attendance you cannot fake.
The north-star metric is a completed meetup: two verified people, in the same place, both confirming it happened.
Being new to a city is a coordination problem, not a matching problem. Existing apps optimise for time in feed, which is the opposite of getting people into a room.
Architecture
A Turborepo monorepo with an Expo React Native app as the primary surface, a web app, and shared packages holding the domain contract — schemas, analytics taxonomy and business logic — so the two clients cannot drift.
Innovation
The north-star metric is Weekly Completed Meetups, defined as two or more verified users confirmed present by geofence and mutual confirmation. Defining success as physical attendance rules out the engagement metrics that would otherwise be optimised instead.
Outcome
GDPR and KVKK compliance with EU data residency designed in from the first phase rather than retrofitted, and a shared domain package that makes the analytics taxonomy a compile-time artefact.
Eleven build phases completed over an intense four-day sprint, with device validation. Not released.
53
commits
11
phases
4
days
2
attendance proofs required
The domain contract — schemas, analytics taxonomy, business logic — was the second commit in the repository, before any UI existed.
Success is defined as real-world attendance, verified two ways, which is a deliberately hard metric to move.
Data residency and privacy regime chosen at phase zero, not after launch.
Fifty-three commits across eleven phases in four days, ending in device validation rather than a demo.
TypeScript
React Native
Expo
Turborepo
PostgreSQL
Zustand
092026Author · Engineer
Living Library
Six original books and the zero-dependency reading engine they run on.
The reading engine is inherited between books: the typography and page mechanics stay fixed, and only the identity changes.
Release candidate
The four beats
Problem
Reading apps optimise for library management. The actual experience — how a page turns, how a paragraph is set, whether the text is worth setting — is where the attention should go.
Architecture
Each volume is a self-contained build with its own Python build pipeline producing the packaged reading experience. The engine is carried forward between books rather than rewritten.
Innovation
Form discipline as an inheritance rule: when a new volume adopts the engine, the page mechanics, typesetting and performance characteristics are preserved deliberately, and only colour, atmosphere, cover and metadata change.
Outcome
Six volumes of original writing with a consistent reading experience, and a stated editorial position — a fable "leaves an observation rather than imposing a lesson".
Content and engine complete across six volumes; packaged Android build produced. Not published to a store.
6
volumes
0
runtime dependencies
15
fables in the first collection
The books are original work, not a reader for someone else’s catalogue.
A zero-dependency reading engine — the page-turn and typesetting are the engineering, not a wrapper around a library.
The engine is explicitly inherited between volumes so the reading experience cannot regress from book to book.
Editorial structure is deliberate: thematic clusters that order the work without imposing continuity.
TypeScript
Python
HTML
CSS
02How the work is built
Models hallucinate. Types and tests don’t.
Nineteen. Self-taught, two years in, no computer science degree. The early work happened around 01:30 bakery shifts and high-school exams — that is part of the record, but it is not the interesting part.
The interesting part is what the code does. Nine projects, six of them under version control, roughly sixteen hundred commits between February and August 2026. Three are live on their own domains. One shipped to a production mobile release track.
The through-line is narrow and deliberate: probabilistic systems constrained by deterministic ones. A hardcoded emergency check that runs before the model. A scoring engine the model is only allowed to narrate. A remediation playbook that writes the destructive command so the model never can.
Every production resource is provisioned in Terraform. If it cannot be re-created from a repository, I do not consider it deployed.
Operating principles
01
Production-first
Every system is designed for real users from day one. No prototypes wearing the costume of products.
02
Infrastructure as code
Reproducible, version-controlled, re-creatable from a git clone — or it does not count as deployed.
03
Cost-aware engineering
Every architectural decision considers dollars per request. At scale those choices compound faster than feature velocity.
04
AI as leverage
Augment with AI; never replace engineering rigour. Models hallucinate. Types and tests do not.
Cloud Architecture
Production AWS provisioned through Terraform. Cross-account access via STS AssumeRole with generated ExternalIds, JWT-protected APIs, container-image Lambdas, asynchronous fan-out, and cost analytics driven by the Cost & Usage Report rather than a price list.
AWS Lambda
Terraform
DynamoDB
AWS Cognito
AWS Athena
AI Systems
LLM orchestration where the model is bounded by design: structured output validated against a schema, confidence floors that resolve to "insufficient information", deterministic overrides that run before inference, and remediation produced by playbooks rather than generation.
Claude
AWS Bedrock
Gemini
Zod
Production SaaS
End-to-end products — authentication, metered billing with atomic credit accounting, scanning engines, and observability. Row-level authorization derived from the token, never from the client.
Next.js
FastAPI
PostgreSQL
Sentry
PostHog
Mobile Engineering
Flutter applications shipped to production release tracks: on-device machine vision, row-level-secured backends, subscription entitlement loops mirrored server-side, and offline paths that still work when the network does not.
Flutter
Dart
Riverpod
Supabase
ML Kit
03February — August 2026
Six months, six systems.
Dates are taken from commit history, not memory. Each entry links to work that can be inspected.
Monorepo platform · live in 28 days
Ehliyet Akademi
A Turborepo platform with a framework-free spaced-repetition engine as its own tested package, taken from first commit to a live domain in under a month, with architecture decision records kept in-repo throughout.
261 commits
Live at ehliyetegitim.com
Eleven phases in four days
Tayfa
A location-based social product built as a monorepo whose second commit was the domain contract — schemas, analytics taxonomy and business logic — before any interface existed. Ended in device validation.
53 commits
11 phases
Safety-critical AI · production release
PawDoc
A pet-health triage product where a false negative is the primary business risk, so the emergency path is hardcoded, mirrored on-device for offline use, and kept in parity across three languages by a test. Reached an approved production release build in August.
118 commits
Release 1.0.0+8
Two-cloud SaaS · 89 commits
VibingCoderAI
A deliberately split architecture — Vercel for the edge, AWS for the brain — with a metered credit economy built on DynamoDB optimistic concurrency so that a failed model call refunds cleanly instead of quietly costing a user.
89 commits
Live at vibingcoderai.com
On-device vision · 604 commits
FormAI
The largest single codebase in the portfolio: roughly 61,000 lines of Dart, eight pose analyzers, all inference on-device. Reached a closed testing track. Its most telling commit corrects the privacy policy the moment a feature started uploading photos.
604 commits
Build 1.0.0+40
First production SaaS · 510 commits
Cloud Waste Hunter
Started as "start FinOps Tool" and ended four months later as a live multi-tenant platform with cross-account scanning, a three-tier pricing fallback and a Bedrock advisor that is explicitly not allowed to write destructive commands. The final commits are a security hardening phase, closed deliberately rather than abandoned.
510 commits
Live at cloudwastehunter.io
04What is actually in the repositories
The stack.
No percentages, no proficiency bars. Each entry says how the technology is used, so the claim can be checked against the code.
Cloud & Infrastructure
Provisioned in code, or it does not count as deployed.
AWS Lambda
Container-image, Python & Node
Terraform
Every production resource
API Gateway
REST & HTTP, JWT authorizers
DynamoDB
Optimistic concurrency control
Cognito
Federated IdP, token-derived authz
Athena / CUR
Cost & Usage Report data lake
Cloudflare R2
S3-compatible object storage
Vercel
Edge delivery
AI Systems
The model is the least trustworthy component. Build accordingly.
Claude
Tool use, structured output
AWS Bedrock
Streaming over Function URLs
Gemini
Tiered analysis path
Schema validation
zod, Pydantic, JSON Schema
Prompt caching
Measured cost reduction
On-device ML
ML Kit pose detection
Application
Typed end to end, tested where it matters.
TypeScript
Strict, no escape hatches
Next.js
App Router, RSC
React
19, server-first
Flutter / Dart
Two production apps
Python
FastAPI services
Kotlin
Multi-module Android
Postgres
RLS with USING and WITH CHECK
Drizzle
Typed schema & migrations
Practice
The parts that are invisible until they are missing.
Conventional commits
~1,600 across six repos
CI quality gates
Green before progress
ADRs
Decisions written down
Playwright / Vitest
E2E and unit
Observability
Sentry, PostHog
Threat modelling
SSRF, confused deputy, RLS
05Evidence over paper
What can be verified.
Production-grade work first, paper second. Everything in the first list can be checked by following the link. Everything in the second is an exam that has not been taken yet, and is labelled as such.
Verifiable now — 4
Cloud Waste Hunter — live platform
Jun 2026
Self-issued · independently verifiable
Multi-tenant FinOps SaaS serving over the public internet on its own domain, with cross-account AWS scanning.
Cloud architecture, AI systems that have to be safe rather than impressive, and production mobile work. If you are building something where correctness matters more than speed, that is the interesting conversation.