I build secure automation and local AI systems for infrastructure that cannot afford to fail.

Systems / Solutions Engineer working across data protection, Windows automation, detection engineering, and governed AI agents.
My projects connect production infrastructure experience with practical Python, PowerShell, RAG, and security engineering.

Interactive CyClaw Demos

CyClawOS is a browser-based desktop environment that puts the CyClaw agent architecture behind a real interface. Instead of a chat box and a diagram, you get a simulated Linux workstation that boots, arms its guardrails, and lets you drive the agent's actual control surfaces: retrieval, the write gate, the soul file, and the audit log.

Two independently deployed builds of the same system, so the demo survives one host having a bad day.

CyClawOS 2.0.0 (linux-x86_64)
Loading kernel modules .............. ok
Starting gate.py :8787 .............. ok
Soul + guardrails ................... armed
Starting desktop session ............

The CyClaw tooling sits inside a complete desktop — file manager, text and code editors, Python runner, git client, SSH and network tools, and the usual accessories — because the point is showing governed agent tooling in an operating environment, not as an isolated widget.

The design decisions on display are the ones that matter in the real system:

• Retrieval always runs before generation. The LLM is the last node in the graph, not the first.
• Writes are gated, reads are allow-listed, SQL is SELECT-only. Denial is the default and it is visible.
• Everything is auditable. If a tool ran, there is a line in audit.jsonl saying so.

Interactive Domain Map — the diagram below is a static version of the same map.

           Security / Detection / Programming
               YARA rules · Powershell
                Python · C2 · OWASP
                        │
            ── BRIDGE ──┤── BRIDGE ──
        YARA pre-restore│  YARA → prompt injection
        malware-aware DR│  pattern defense for LLMs
                        │
  Backup & DR    ───────┼─────── Local LLM / RAG
  Veeam VBR             │        LangGraph · ChromaDB
  Network Security      │        BM25+RRF · Ollama
Systems Architecture    │        offline-first
                        │
            ── BRIDGE ──┤── BRIDGE ──
VBR data → AI or SIEM   │  topology = policy enforcement
    remediation agents  │  Agentic compliance & governance
                        │
              AI Safety | Agent Governance
               CyClaw   · Agentic AI drift detection
      SHA-256 integrity · MCP server
                        │
              Automation / Sysadmin (substrate)
       PowerShell· SCCM · HCI · VMware
       Azure · AWS  · Edge · Hyper-V

• Secure local AI: offline-first RAG, agent governance, policy-enforced workflows, prompt-injection defenses, and MCP-based tooling.
• Data protection and recovery: Veeam operations, malware-aware restore workflows, health-check automation, and resilient infrastructure lifecycle management.
• Detection engineering: YARA rules, ransomware indicators, suspicious infrastructure detection, and SIEM-ready output.
• Windows and platform automation: PowerShell, Python, SCCM, WinRM, VMware, APIs, and operational tooling designed for real environments rather than immaculate demo laptops.

Governed, offline-first RAG agent

Python 3.12 LangGraph FastAPI ChromaDB BM25 + RRF SQLite pgvector MCP Ollama

A local AI agent built around the principle that architecture should enforce policy. CyClaw uses a LangGraph state machine, hybrid retrieval, integrity checks, scoped tooling, and auditable execution to reduce reliance on prompt-only safeguards.

• RAG-first retrieval — retrieval runs before generation, every time.
• Topology as policy — the graph decides what is reachable; the prompt does not get a vote.
• Scoped tools — allow-listed filesystem reads, approval-gated writes, read-only SQL.
• JSONL audit logging and SHA-256 integrity checks over the corpus.

Why it matters: organizations need useful AI systems that can operate around sensitive data, constrained networks, and explicit governance requirements without quietly turning every control into a polite suggestion.

Try it: CyClawOS interactive demo · mirror · project page

Malware-aware recovery inspection

PowerShell YARA Veeam JSON Forensics Detection Engineering

PowerShell and YARA tooling for detecting .onion infrastructure, cryptocurrency payment indicators, and command-and-control patterns in recovery data, with structured output suitable for investigation and SIEM workflows.

Safe infrastructure maintenance

PowerShell SCCM WinRM VMware Veeam

Coordinates Veeam proxy availability with SCCM patching so maintenance can proceed without casually rebooting infrastructure beneath active backup jobs, a surprisingly popular human pastime. Runs SCCM-integrated or standalone from VBR.

production constraint
      ↓
explicit threat / failure model
      ↓
architecture-enforced controls
      ↓
auditable automation
      ↓
operator-friendly outcome

I tend to optimize for:

• Local-first operation where privacy, cost, latency, or network isolation matter.
• Defense in depth rather than a single magical control with an impressive acronym.
• Dry-run modes, validation, logging, and rollback-aware workflows.
• Useful interfaces for operators, not just technically correct code that demands its own priesthood.
• Clear documentation and reproducibility so projects can be evaluated beyond screenshots and claims.

                 Security / Detection
            YARA · ransomware indicators · OWASP
                         │
       malware-aware DR  │  injection-pattern defense
                         │
Data Protection ─────────┼───────── Local AI / RAG
Veeam · recovery         │          LangGraph · hybrid retrieval
proxy lifecycle          │          local models · MCP
                         │
      operational data   │  topology-enforced governance
                         │
                 Automation Layer
          Python · PowerShell · SCCM · WinRM · APIs

• Expanding CyClaw's governed agentic coding and local-model support.
• Growing the CyClawOS demo so the governance surfaces — write gate, soul file, audit trail — can be evaluated by anyone with a browser.
• Improving policy enforcement, evaluation, observability, and offline deployment paths.
• Turning hard-won infrastructure and recovery patterns into reusable security automation.

Atlanta, GA · Infrastructure · Data Protection · Security · Applied AI

_{Building systems that remain useful after the demo ends.}