Kane

A commercial QA service: submit a URL and ten specialised agents test the application in real headless Chromium — console errors, layout, forms, accessibility, performance, broken links, mobile, user journeys and security.

• Every finding ships with a screenshot, reproduction steps, a failing Playwright test and a paste-ready fix prompt.
• A verification pass re-runs each finding and discards any that will not reproduce, so reports stay short and trustworthy rather than long and noisy.
• Per-origin regression memory produces a run-to-run diff — fixed, still open, new, regressed — matched on a stable fingerprint rather than the finding's title.
• Subscription billing on Stripe, with charging gated behind both a key and an explicit live flag, mandatory webhook signature verification, and a return-URL fallback so a slow webhook never strands a paying customer.
• The free tier runs every agent and shows every finding honestly; what is paid for is the proof, the depth and the history.
• Found a genuine exposure on my own infrastructure on its second ever run — a publicly readable repository directory — which I then fixed and guarded against.

StackNode.js · Playwright · SQLite · Stripe

Full replatform of a directory that has been trading since 2017, moving it off WordPress onto Cloudflare Workers and D1 without losing a single live listing.

• Migrated hundreds of real listings plus supplier accounts, moderated reviews and a purpose-built admin covering listings, renewals, enquiries and claims.
• Photo-led search workbench with category, region and sort controls, backed by SQLite FTS5.
• An LLM intent parser sits behind ordinary search copy with a deterministic fallback, a short timeout and a bounded cache — so a slow or failed model call silently degrades to local results.
• Layered abuse protection: per-IP and global per-minute and per-day caps, with spam-shaped input never reaching the paid model at all.
• Every destructive or billing-related field is explicitly confirmed before use, so no supplier is moved onto a plan nobody agreed to.

StackCloudflare Workers · D1 · SQLite FTS5 · LLM integration

Design and day-to-day operation of roughly 67 supervised services across two machines, published through Cloudflare tunnels with no raw public ports.

• Automatic cross-machine failover: a watcher flips DNS to a standby host after three consecutive health failures and returns it once the primary is stable again.
• Self-healing network watchdog with a staged escalation ladder; fixed a real defect where the original rung re-bounced the radio every 60 seconds and actively prevented reassociation.
• Edge-triggered alerting to Telegram for process crash loops, credential brute force, scanner probes and endpoint outages — with deduplication so one incident is one alert.
• Crash-loop backoff tuned so the supervisor actually trips its restart ceiling rather than looping thousands of times.
• Diagnosed a reported 'site down' as a Wi-Fi rekey failure rather than a hosting fault by proving every layer healthy from origin to edge first.

StackCloudflare Tunnels · pm2 · systemd · Linux · Bash

A ten-page site for a timber-buildings firm, built around a parametric SVG configurator that redraws the building live as options change.

• Hand-written SVG renderer with lit and shaded faces, shiplap and loglap board profiles, ledge-and-brace doors and ironmongery, glazing bars, guttering, base options and a scale figure for proportion.
• Around twenty configurator options across building, openings and finish; openings auto-scale with width until the user overrides them.
• Pages generated from one shared shell at build time — the deployed output is pure static HTML with no client-side build step.
• Rebuilt on the client's genuine published data after finding three factual errors in the previous version, including a photo of their logo file presented as a product.
• Only genuinely published extras carry a price; everything else renders as 'ask us' rather than an invented number.

StackPython · SVG · Vanilla JS · ffmpeg

Give it any business-directory URL and it infers the structure itself, extracts every listing, then grades each business's website.

• No per-directory configuration: sitemap discovery plus URL-shape clustering and selector-free extraction, proven on two unrelated directories neither of which was configured.
• A–F site grading, on the basis that a site which technically works can still be a rebuild candidate — which surfaced an entire market previously discarded as healthy.
• Persistent memory with an anti-spam guard: a 90-day contact cooldown and permanent suppression once someone declines, so rescans get smarter instead of repetitive.
• Generates a working concept site per lead, so the approach is 'here is your site, live' rather than 'you need a site'.
• Drafts only — nothing sends. After a parser bug produced three false statements about a real business, all structural checks were moved onto a real HTML parser.

StackNode.js · SQLite · Cheerio

The internal platform the rest of the work runs on: a browser-based operator console, shared agent memory, job coordination and a suite of dashboards.

• Shared working memory and a typed job board that multiple independent agents read and write, with turn-taking rules to stop them talking over each other.
• Telegram operations bot for fleet status, service control, deployment health, traffic analytics and signup monitoring, with a scheduled daily digest.
• Split-host authentication where only explicitly listed public paths bypass the gate — deliberately kept narrow, because the same host also fronts a live remote-desktop session.
• Model fallback chains declared explicitly per call site, so no LLM feature has a single point of failure.
• Diagnosed an opaque provider error as a wrong-endpoint-for-key-type problem rather than an empty account, saving a needless top-up.

StackNode.js · Claude API · Telegram Bot API · SQLite

A chat widget on a public marketing page, scoped so tightly it cannot invent claims about the business.

• Runs with zero tool grants and a system prompt limited to the page's approved facts.
• Adversarially tested against invented-pricing bait and a direct prompt-injection and infrastructure-disclosure attempt; both correctly refused.
• Per-IP rate limiting plus a global daily budget breaker, because a public anonymous endpoint that costs money per request needs a hard ceiling.
• Rewrote the page copy after discovering it advertised two safety rails that did not actually exist — replaced with only verified rails and an explicit 'known limits' section.

StackNode.js · Claude API

A deterministic NFT character pipeline in Blender where the clothing is genuinely tailored to the body rather than a mesh stuck on top.

• Garments are grown from the character's own surface so they cannot float or detach, with tailoring derived from real open-source sewing patterns expressed as code.
• Quilting and panelling come from a seedable mathematical function rather than a physics solver — fully deterministic and incapable of exploding mid-render.
• The pipeline art-directs itself: automated gates reject exploded, detached, untextured, clipped, silhouette-failing or black renders, and a strict mode refuses to write a bad frame at all.
• Audited asset licensing properly and established that no compliant source mesh existed — several assets marketed as public-domain carried viral share-alike licences.

StackBlender · Python · ffmpeg