Things I've built, and the stories behind them.

A performance-obsessed, self-hostable cloud drive. The database is aggressively cached in RAM, uploads are chunked and gzip-compressed in the browser, and WebSockets push every change in real time. Collections are a many-to-many graph, not a folder tree.

• RAM-first metadata layer — SQLite is durable storage, RAM is the operational index
• 7 MB chunked uploads, up to 6 chunks per file and 3 files concurrently, gzip-compressed in the browser
• Persistent WebSocket state pushes file, collection, and stats updates instantly
• Cycle-safe collection graph with cached aggregate size propagation
• SHA-256 content-addressed storage with direct filesystem downloads
• Multi-level lazy rendering: bounded file cards, IntersectionObserver previews, browser image lazy-loading

A code-execution API that skips Docker entirely and implements the sandbox boundary directly with Linux kernel primitives — namespaces, cgroups v2, chroot, bind mounts, and seccomp-BPF. It is a micro-container runtime specialized for short-lived compiler jobs.

• Manual containerization: PID/mount/network/user namespaces, no Docker daemon
• cgroup v2 enforces memory, swap, CPU quota, and a 64-process cap (fork-bomb safe)
• seccomp-BPF denylist blocks mount, ptrace, reboot, and other dangerous syscalls
• Sandbox root maps to host UID 65534 — root inside is never host root
• Static C/C++ compilation for a minimal chroot; read-only runtime mounts for Python/Java
• Global RAM admission control rejects overload before a sandbox is created

A bootable hobby OS that owns the entire path from the BIOS's first instruction into its own kernel — custom bootloader, BIOS disk I/O, GDT, protected-mode transition, linker-controlled kernel placement, and direct VGA text rendering.

• Custom 512-byte BIOS bootloader with INT 13h disk loading — no GRUB
• Manual GDT construction and CR0 protected-mode transition
• Linker places the kernel at 0x10000, matching the bootloader's load address
• Freestanding C compiled with -ffreestanding -nostdlib
• Direct VGA text-mode rendering at 0xB8000 with a working terminal
• Assembly-driven command shell with a custom strcmp

A fault-tolerant PowerPoint-to-PDF service. Instead of calling LibreOffice once and giving up, it treats conversion failure as recoverable — repairing PPTX archives, flattening nested roots, normalizing paths, and retrying through a fallback ladder until a valid PDF exists.

• Speculative repair: generates clean, flattened, and store-only ZIP candidates
• Detects ZIP vs legacy OLE containers from just 8 bytes
• Two-step ODP normalization when direct PDF export fails
• Short-path retry removes filename/path weirdness from the equation
• Validates the output artifact, not just the exit code
• Per-invocation LibreOffice profile isolation for safe concurrency

A competitive-progress tracker with no application server. GitHub Actions is the scheduler and worker, Git is the database and audit log, a JSON file is the materialized dataset, and Netlify serves a static React dashboard.

• GitHub Actions polls every 10 minutes and commits only meaningful changes
• Git is the database — 2,055 historical readings in a ~68 KB JSON file
• Incremental append-only updates keep history compact and diff-friendly
• Drag-to-select time windows and pairwise delta lines for real analysis
• Zero third-party runtime dependencies in the Java updater