Skip to content
View JacobStephens2's full-sized avatar
16 followers · 22 following

Achievements

Achievement: QuickdrawAchievement: Pull Sharkx3Achievement: Pair Extraordinairex3Achievement: YOLO

Achievements

Achievement: QuickdrawAchievement: Pull Sharkx3Achievement: Pair Extraordinairex3Achievement: YOLO

Block or report JacobStephens2

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
JacobStephens2/README.md

Jacob Stephens

Safe AI automation for revenue-critical legacy systems. I lead a two-engineer team owning a multi-million-dollar specialty-travel stack — a multi-portal PHP / MySQL reservations platform, multi-tenant AI assistants on Docker, and a Python agent-orchestration host — and I run the whole thing behind a human merge gate.

  • ~80% of measured query load removed across the reservations platform via three zero-downtime online-DDL indexes (before/after EXPLAIN + slow-log deltas, no customer-visible cutover).
  • Manifest page: 5–7s → ~1s, SQL / request 2,650 → 183, byte-identical HTML — the caching layer is verified equivalent, not just faster (case study).
  • 12 manager-prototyped features shipped through a human merge gate (Vagabond marketing lead prototyping on live production data; review + hardening by me and one engineer I manage), zero agent-caused incidents in production (factory ADR: shared collector seam, scoped system user ADR).
  • 14-host observability fleet + 3 enterprise migrations (Bitbucket → GitHub, WordPress hardening, Tailscale rollout), no customer-visible outage.

Most of that work lives in private repos. The architecture and the reasoning behind it are written up in the ETA Platform case study and in infrastructure-patterns — sanitized ADRs, a threat model for agent sandboxes, and an operational review checklist.

Public artifacts

Repo What it proves Evidence
vaulted-agent-launcher (va) Per-agent blast radius: launches Claude Code, Codex, Grok, and Kimi with vault-resolved secrets in-process — no .env files or vault tokens on disk (1Password, Bitwarden SM, pass, sops; macOS + Linux) Design issues #70, #72 · installer hosting docs
muxboard Babysitting long-running agents: Flask-embeddable web dashboard over tmux for one host or a fleet, live in-browser attach — default-deny auth, attach caps, documented threat model muxboard.dev
infrastructure-patterns Sanitized ADRs and the operational review checklist from the ETA factory — the human merge gate, in writing ADR index
chart35-showcase Privacy-by-construction: offline-first PWA, end-to-end encrypted sync, provider sharing. 83 iOS + 17 Android installs, 52 web accounts (40 verified, 47 synced) on Chart35 — App Store / Play / TestFlight, growth via organic search alone Architecture + privacy slice public; production data stays E2E-encrypted so the server sees only account metadata and encrypted-snapshot sizes
cascade Headless-core + native-UI kata: one Rust core driving six shells. Web PWA live; Windows, notarized macOS, Android sideload, and iOS TestFlight on /apps (watchOS comes with iPhone) cascade.stephens.page · architecture
k3s-demo Production-grade k8s manifests: probes, resource limits, hardened securityContext, HPA, ingress, kustomize; statically validated with kubeconform Dockerfile

Upstream contributions

  • MySQL 8.4 caching_sha2_password auth-handshake fix in krowinski/php-mysql-replication — PR #148. The library's handshake ignored the new default plugin; patched the auth-switch path so binlog readers connect to MySQL 8.4 without downgrading server auth.
  • Kimi Code kimi -p env-key regression in MoonshotAI/kimi-code — PR #2746 closing issue #2745. agent-core-v2's auth gate resolved credentials from args.provider?.env ?? {} and ignored process.env, breaking headless -p runs; fixed the resolver to fall through to process.env.
  • SwarmForge whole-swarm teardown bug in unclebob/swarm-forge — issue #49. Unexpected exit of the cleanup-owner agent triggered an unconditional teardown of every swarm session; proposed decoupling teardown from the cleanup-owner's process lifecycle.

More landing in the Model Context Protocol ecosystem — that's where the "safe AI automation" thesis externally validates.

Also shipped

Products, tools, and published packages — click to expand

Products

  • Drome — local-first iOS tracker for 75-day challenges; one Rust rules engine, native SwiftUI + WidgetKit, event-sourced

Tools in daily production use

  • inkvoke — single-binary, agent-friendly Go CLI for OpenAI's image models; prompt / edit / manifest-batch (inkvoke.dev)

Published packages — wire-compatible TypeScript + Go pairs, tested against parity vectors for byte-identical output. TypeScript releases publish via npm Trusted Publishing (OIDC) — no long-lived tokens, provenance on every version.

Package TypeScript (npm) Go (pkg.go.dev)
HMAC webhook verifiers (GitHub / Stripe / Twilio / Mandrill) @stephenspage/webhook-verify webhook-verify-go
AES-256-GCM envelope + PBKDF2 vault + zero-knowledge sealed shares @stephenspage/webcrypto-envelope webcrypto-envelope-go

📄 Resume · Portfolio · Available for Staff / Lead platform-infra roles

St. Carlo Acutis, pray for us.

Pinned Loading

  1. infrastructure-patterns infrastructure-patterns Public

    Sanitized ADRs and infrastructure patterns from production systems I have designed and operated

  2. webhook-verify webhook-verify Public

    Tiny typed HMAC webhook verifiers - raw-body (GitHub-style), timestamped with replay tolerance (Stripe-style), and URL+sorted-params (Twilio, Mandrill) - constant-time compares, zero dependencies.

    TypeScript

  3. muxboard muxboard Public

    Flask-embeddable web dashboard for managing tmux sessions across one host or a fleet, with live in-browser attach. Default-deny auth, attach caps, and a thorough threat model.

    Python

  4. cascade cascade Public

    Waterfall white-noise player: one headless Rust core driving six native shells — web (PWA), Android, macOS, Windows, iOS, watchOS. A headless-core + native-UI kata.

    Swift

  5. vaulted-agent-launcher vaulted-agent-launcher Public

    Launch Claude Code, Codex, Grok, or Kimi with vault-resolved secrets in-process (1Password, Bitwarden SM, pass, sops). Per-agent blast radius, optional prompt auth. macOS + Linux.

    Rust

  6. chart35-showcase chart35-showcase Public

    Architecture and privacy showcase for Chart35, a cross-platform end-to-end-encrypted Creighton Model FertilityCare charting app (web, iOS/watchOS, Android).