Systems & Software, set in type.

Full-stack · WorkflowOps

WorkflowOps

Build, run, and monitor business workflows.

A SaaS to create, run, and monitor business workflows — onboarding, approvals, and the like. Ordered steps with conditions invoke mock integrations through one swappable adapter; a background worker walks each run through a state machine with retries; the dashboard reflects the engine's authoritative state, live.

Architecture. Run/step state machine (pending → running → succeeded/failed) with bounded retries; Redis-backed workers; one Adapter protocol with swappable mocks; server-side RBAC (admin/editor/viewer), JWT role re-read from the DB each request.

workflowops.app / runs / live

eval-free condition evaluator paired with parameterized SQL yields a zero-injection surface; the RBAC matrix is proven by 22 dedicated tests.

Full-stack · QueueForge

QueueForge

Reliability is the product.

Submit background jobs; workers process them asynchronously while a dashboard tracks status live. Retries with backoff, a dead-letter queue, scheduling, priority, and worker heartbeats — the unglamorous machinery that makes a queue trustworthy.

Architecture. Job state machine with a DLQ at max attempts; a worker pool with heartbeats and a visibility timeout, so a dead worker's in-flight job is requeued; an atomic Lua ZPOPMIN → ZADD claim — no check-then-act race.

queueforge.app / workers / dlq

dead-worker requeue is tested end-to-end; the webhook SSRF guard is live-probed — IPv6 loopback, DNS-rebind, and metadata IP all blocked.

Full-stack · DevGate

DevGate

Generate, gate, and observe API access.

Register APIs, generate and revoke keys, enforce per-key rate limits, and view usage analytics — counts, error rate, p50/p95. A gateway authenticates the key and a Python SDK wraps the whole thing for callers.

Architecture. Keys shown once; only a SHA-256 hash plus a masked prefix is persisted; constant-time verification via hmac.compare_digest; per-key rate limiting through one atomic Redis Lua script; ownership 404s that leak no existence.

devgate.dev / keys / analytics

verified live — a generated key authenticates at the gateway (200); missing, garbage, or query-string keys all return 401.

Full-stack · CollabBoard

CollabBoard

Boards, tasks, presence — live.

A team workspace with boards, tasks, threaded comments, and a shared document that all update in real time over WebSockets, with live presence so you can see who's there and what they're touching.

Architecture. The WS connection is authenticated and authorized per board before accept(), with per-message re-auth; removing a member force-closes their sockets; REST authz via one require_board_access (404, not 403); optimistic version checks (409) on concurrent edits.

collabboard.app / board / live

the hard part — authorizing a WebSocket connection before the handshake completes — done right, and proven by 7 dedicated tests.

Full-stack · Ledgerly

Ledgerly

Import, categorize, report — safely.

Upload CSV transactions, categorize them with priority-ordered rules, track invoices, and view monthly reports with safe exports. Money is held as integer cents; every read and write is scoped to the owner's organization.

Architecture. A bounded streaming CSV parse with a smart column auto-mapper; priority categorization rules; CSV formula-injection neutralized on export; org_id always derived from the JWT, never from client input.

ledgerly.app / reports / monthly

verified live — an exported "=cmd|calc" becomes "'=cmd|calc"; any cross-org access attempt returns 404.