Personal monorepo. Dev tooling and deployment for my projects.
- EmberVM: Firecracker microVM orchestrator. An Elixir control plane and a Go node daemon run task, session, serving, stateful, and composite workloads. See its current architecture.
- Firecracker components: guest images and shared host/guest utilities retained by EmberVM after the original fc-invoke daemon was retired.
- Knowledge pipeline: an on-cluster LLM decomposes markdown into structured facts, embeds them, and stores them in pgvector. Searchable via MCP tools and a SvelteKit frontend.
- Agent platform: AI agents in sandboxed microVM sessions, with the monolith providing the user-facing control plane.
- Discord bot: LLM-powered chat with vision, web search, knowledge graph context, and a per-user trust ledger (monolith architecture, section 5).
- OCI Model Cache: Kubernetes operator that syncs ML models from HuggingFace to OCI registries. Compiler-enforced state machines.
- Sextant: code generator that turns YAML state-machine specs into type-safe Go for operators. Invalid transitions are compile errors, idempotency keys are forced into transition signatures. Generates the OCI Model Cache machine, drift-checked in CI.
- Design system: the shared
--ds-*token contract the frontends build against. One namespaced vocabulary, three deliberately distinct themes (neobrutalist, ember, Grimoire) that override it inside their own scope class. Rationale in the platform architecture. - oom-inference: Rust inference engine for mixture-of-experts models bigger than memory. Serves a 125B model from a 24 GB GPU by tiering experts across VRAM, pinned RAM and NVMe. See its architecture.
- Build system: custom Bazel rules for Helm and Cloudflare Pages. All builds run remotely via BuildBuddy RBE.
Public apps served by the monolith at jomcgi.dev/app:
- Marine tracking: Real-time AIS vessel tracking with a MapLibre GL frontend.
- Trip tracker: Reconstruct travel routes from photo EXIF data with elevation profiles.
- Stargazing: Best stargazing spots in Scotland with cloud-cover and darkness forecasts.
- Campsites: BC Parks availability crossed with weather.
- World Cup 2026 odds: Scotland's qualification odds via an Elo Monte Carlo model.
- Hiking routes: Scottish route finder with weather-based recommendations.
- Grimoire: Postgres-first D&D campaign manager with a public rules and lore explorer.
- Notes: Anonymous chat over an on-cluster Qwen model on a shared public scratchpad.
- LLM Leaderboard: Agentic coding benchmark results across models, from the model-bench harness.
- NHS jobs: NHS Scotland anaesthetics consultant vacancy aggregator.
See docs/security.md for the defense-in-depth model, projects/monolith/STPA.md for the hazard analysis, and docs/observability.md for automatic instrumentation.
| Area | Approach |
|---|---|
| Ingress | Cloudflare Tunnel only; nothing exposed directly |
| Untrusted code | Firecracker microVMs (EmberVM), STPA hazard model colocated with the monolith |
| Networking | GKE Dataplane V2 (managed Cilium); network enforcement details in the platform architecture |
| Observability | Opt-in OpenTelemetry collector exporting traces and synthetic probes to Honeycomb |
| Policy | Kyverno enforces non-root (uid 65532), read-only filesystems |
| Secrets | 1Password Operator, OnePasswordItem CRDs, nothing in Git |
| Storage | GCE persistent disks; Cloudflare R2 for monolith blobs and GCS for EmberVM exports |
| Messaging | NATS JetStream: pub/sub backbone for AIS data, trip points, agent jobs |
| GPU | Chat inference on the tailnet GPU host; embeddings on the GKE hub |
| Images | apko + rules_apko: amd64, non-root uid 65532 |
| CI | ci for validation; BuildBuddy remote execution; image publish on merge |
| GitOps | ArgoCD with colocated deploy/ dirs; kubectl is read-only |
projects/ # All services, operators, websites, colocated with deploy configs (major dirs shown)
├── platform/ # Cluster-critical infrastructure (ArgoCD, Cilium, OTel collector, etc.)
├── monolith/ # Knowledge graph, Discord bot, task management, public apps, frontend
├── monolith-public/ # Read-only public replica of the monolith
├── monolith-agents/ # Agent-facing MCP tier, pruned and with no cluster RBAC
├── mcp/ # Context Forge gateway + MCP servers
├── inference/ # Inference configuration and llama.cpp embeddings
├── oom-inference/ # MoE inference engine for models bigger than memory (Rust, Cargo)
├── loom/ # Default-off Postgres control-plane wiring for weave-hand/loom
├── operators/ # Custom Kubernetes operators
├── sextant/ # State-machine code generator for operators
├── embervm/ # Firecracker microVM orchestrator (Elixir control plane + Go node daemon)
├── firecracker/ # fc-invoke microVM substrate (frozen; embervm forked its node daemon from it)
├── gke-apps/ # Active GKE Applications for app workloads
├── gke-cluster/ # Hand-maintained ArgoCD root and parent Application for the GKE hub
└── platform-gke/ # GKE cluster-critical infrastructure overlays (Tailscale, ArgoCD, Otel, Cloudflare)
bazel/ # Build infrastructure (rules, tools, images)
docs/ # Cross-domain documentation and runbooks
See AGENTS.md for the rules every change follows and the map of where to look next. Each domain's ARCHITECTURE.md records its current state, decided direction, and decision history.
Active initiatives are tracked in GitHub Issues. Decision rationale lives in each domain's ARCHITECTURE.md.
Built by Joe McGinley. MPL-2.0.