Player-coach technical range

Distinguished "remove the lie" from "restore the capability"

When a fax-send channel was falsely reporting success with no backing infrastructure behind it, chose to fail closed immediately by returning a 409 error rather than wait for the full capability to be rebuilt, while treating that fix explicitly as a partial fix, not a resolution. (Project A -- the known-issues tracker's P0 writeup on the send channel)

Decoupled build order from launch order via dark-shipping

Standardized on building features fully behind flags so engineering throughput wasn't gated by business launch timing, with each feature carrying its own later go-live checklist. (Project A -- the operations log's design-day wave notes)

Roadmap pivot driven by market research synthesis

Restructured the near-term roadmap around a proactive exception-handling pathway after webinar and market research showed a federally available option was used by only a small minority of eligible professionals, reframing the product from a reactive tool into a proactive access platform. (Project A -- the product team's feature-roadmap document)

Codified anti-fabrication policy as an engineering control

Converted a no-fake-stats, no-fake-testimonials, no-fake-compliance-claims content policy into CI-enforced (GitHub Actions), mutation-tested test gates, replicated identically across three separate codebases (Python and TypeScript), after one banned statistic had already reached production copy. (Project A -- the known-issues tracker's content-policy CI section)

Build-vs-buy on regulated logistics

Chose vendor integrations for certified mail and fax transmission over building physical-mail and fax infrastructure in-house, keeping engineering focus on the core extraction, reasoning (Anthropic's Claude API), and letter-assembly pipeline. (Project A -- the letter-and-send subsystem notes)

KPI-first feature sequencing

Every roadmap item in a major feature wave carried an explicit dependency graph and a named success metric before implementation began. (Project A -- the feature-roadmap document's sequencing-and-measurement section)

Treated a proven capability as a business decision, not an engineering task

Deliberately exercised a public-perimeter flip -- opening it, measuring live traffic via AWS CloudTrail and AWS WAF logs for about nine minutes, then reverting -- to prove the mechanism worked, then explicitly refused to conflate proven-ready with should-ship, leaving the actual go/no-go to a stakeholder call. (Project B -- the infrastructure log's perimeter-exposure writeup)

Gated a scope expansion behind an unrun measurement pass

Rather than estimating capacity needs up front, required a data-quality and volume scan (DuckDB) of the target codes before sizing database growth (PostgreSQL), verification floors, or wave order. (Project B -- the backlog-expansion roadmap's measurement-gate section)

Pre-emptively red-teamed and disabled a legally sensitive feature pending counsel review

Rather than shipping the feature and hoping for the best, disabled it ahead of launch and tracked the decision as a named, dated item pending legal sign-off. (Project B -- the backlog-expansion roadmap's legal-decision log)

Enforced a legal/ToU gate by structural absence rather than a feature flag

Built one payer's data pipeline (Python) with no extraction path at all, rather than a disable switch, so the restriction can't be silently re-enabled by a config change. (Project B -- the payer-configuration reference and roadmap's legal-gates section)

Named and tracked "honestly deferred" scope at each ship boundary

Tracked upload support, per-row read state, and a backend rate-history ledger (PostgreSQL) as explicit, named backlog rather than quietly cutting them, so stakeholders always knew what a release did and didn't include. (Project B -- the platform roadmap and web product's honest-limits notes)

Replaced hardcoded per-letter rendering with a declarative registry

A spec/style/format-version registry, implemented in Python, lets one assembly walk produce four distinct letter kinds, and adding a new kind requires no changes to the render path itself. (Project A — the letter-formatting subsystem's registry design)

Resolved a recurring CD-vs-infrastructure-as-code conflict by giving each system a single role

Made the deploy pipeline (GitHub Actions) the sole writer of the current image pointer, held in AWS SSM Parameter Store, and made the infrastructure-as-code layer (Terraform) a reader only — removing the race between deploy-driven and infra-driven image changes. (Project A — the infrastructure module's image-pointer wiring)

Designed the AI-output schema so evolution can't silently break old consumers

Every new field on the reasoning service's output contract is optional and validated with strict extra-field rejection (Pydantic, in Python), letting old and new payload shapes coexist and be tested for parity mechanically. (Project A — the reasoning service's output-schema versioning)

Pinned the rules engine to the document's date, not today's date

The statutory-deadline engine, written in Python, resolves rule "vintage" from the denial letter's own date rather than the current date, so historical determinations stay reproducible even as the underlying rule corpus keeps getting updated. (Project A — the reasoning service's statutory-deadline engine)

Scoped an exception to a strict invariant as narrowly as possible instead of weakening the rule

Added exactly one gated backward transition to an otherwise strictly forward-only state machine, for crash recovery only, bounded by a PostgreSQL transaction-local flag rather than a general relaxation of the invariant. (Project A — the case data model's migration history)

Split retention policy from the data model so history survives independently of raw storage limits

One PostgreSQL fact table is retention-pruned for cost, while a separate percentile-aggregate table, refreshed transactionally alongside it, is never pruned — historical trends survive regardless of the raw-data retention window. (Project B — the rate-extraction pipeline's permanent aggregate table)

Built a repeatable privilege-bracket procedure for schema changes against a database with no direct network path

A standing, audited procedure temporarily re-points IAM credentials, runs the migration (Alembic), then reverts access — used across multiple schema releases in the absence of a bastion host. (Project B — the infrastructure runbook's migration privilege-bracket procedure)

Mapped database access pools to blast radius, not convenience

A row-grain "drill" tool runs on a separate, least-privileged connection pool from aggregate-only tools, with the boundary enforced as a PostgreSQL grant rather than application logic. (Project B — the web layer's three-pool database access design)

Serve four independently-versioned services from one container image

Each of four AWS ECS task definitions is pinned to a different tag of the same container image in AWS ECR, so any one service can roll forward without moving the other three. (Project B — the capture pipeline's container/task-definition design)

Turned cross-repo content drift into a build failure instead of a silent divergence

A large structured content corpus lives as version-controlled config in one repo, syncs idempotently into the PostgreSQL database via a GitHub Actions pipeline, and exports as a checksummed artifact consumed by a second repo, so the two can't quietly drift apart. (Project B — the channels subsystem's content-corpus sync pipeline)

Split ingestion into fetch and load stages connected by cloud-native events

Fetch and load run as separate services (Python, on AWS ECS Fargate) chained by state-change events, so a fetch failure never loses already-fetched data and a load never blocks on network I/O. (Project B — the pipeline's ingestion-architecture design)

Wrote property-based regression coverage for a cross-cutting invariant.

Wrote a pytest test asserting, across the full state-by-plan-class matrix, that a regional rule can never make an outcome worse than a federal baseline, protecting the invariant permanently rather than pinning individual cases. (Project A -- the reasoning service's statutory decision-due test suite)

Built a purpose-built PII/PHI scrubber and iterated it against real false positives.

Wrote a fail-closed, regex-based PHI scanner in Python, then iteratively tuned a curated allowlist after production data revealed benign terms -- agency names, payer names -- tripping it. (Project A -- the reasoning service's PHI scanner)

Matched test-suite architecture to CI cost and signal tradeoffs.

Separated unit, integration (Docker-backed), compliance, and live-provider smoke suites so GitHub Actions could run the cheap, deterministic majority on bare runners and reserve container-backed runs for what actually needed them. (Project A -- the claims-processing service's test suite and CI configuration)

Built image supply-chain hygiene into CI.

Enforced per-service Docker image size budgets, a production-image import check to catch dev-only dependencies leaking into prod images, and vulnerability scans (Trivy) on every build. (Project A -- the claims-processing service's CI pipeline configuration)

Diagnosed an unrecoverable CI-only browser-automation flake.

Identified that a test framework's form-fill call could leave React's internal value tracker out of sync with the DOM, meaning the same failing input could never be fixed by simply retrying. (Project A -- an internal engineering-lessons log entry)

Designed CI triggers around a GitHub Actions limitation.

Deliberately made a required cross-repo consistency check run unconditionally, rather than path-filtered, after learning that GitHub Actions never reports status for a skipped path-filtered required check -- which would otherwise block pull requests forever. (Project A -- the claims-processing service's cross-repo consistency CI workflow)

Diagnosed a CI-cost defect down to a specific third-party GitHub Action's quantifier semantics.

A path filter meant to skip an expensive job on unrelated pull requests was actually firing on every one, and its exclusion line never worked either, because of how the underlying pattern-matcher combines patterns; fixed by re-deriving the filter as positive enumeration and pinning the fix with a test that compiles the GitHub Actions workflow file itself. (Project B -- the web layer's CI eval-workflow configuration)

Root-caused a resource-leak class in query cancellation.

Measured that destroying a database client on cancel leaves the PostgreSQL backend connection permanently active -- never idle in transaction -- so a timeout-based reaper could never reclaim it, and fixed it by closing the read cursor instead of the connection. (Project B -- the query-execution and cancellation layer)

Built cache-cost math directly from the Claude API's documented mechanics.

Derived a per-round tool-call cap from the Claude API's cache-lookback block limit via an explicit inequality, rather than picking a number empirically. (Project B -- the chat engine's tool-call configuration)

Caught accessibility defects invisible to the full automated test suite.

Manual review found a fake aria-modal attribute, a silent success state with no live region, and a roving-tabindex bug that a click-driven test suite structurally cannot see, and used the findings to argue for accessibility-tree assertions as a first-class test category. (Project B -- a manual accessibility review of the web product)

Sequenced a live capacity-provider migration around a discovered ordering bug

Migrated a GPU-backed compute service to CPU-based serverless containers (AWS ECS Fargate) in two separate Terraform applies after finding that removing an AWS ECS capacity provider and its cluster association in one apply times out; fixed by disassociating first. (Project A -- the GPU-worker service's compute-provider cutover)

Closed an apply/deploy divergence that had orphaned revisions for weeks

Diagnosed that a Terraform lifecycle ignore-changes setting let new AWS ECS task-definition revisions get registered that the running service never adopted, then removed it fleet-wide so a Terraform apply and a deploy became the same guaranteed event. (Project A -- the infrastructure's task-definition ownership model)

CD hardened against two independent failure classes

Added a boot-smoke run of every new Docker image before swapping a live AWS ECS service, catching a bad build before it serves traffic, and an AWS ECR immutable-tag probe before rebuilding, fixing a rerun failure mode. (Project A -- the platform's CD and migration safeguards)

Cost-engineering tradeoffs made and documented as explicit levers

Ran a single-NAT-gateway AWS VPC network topology and a scale-to-zero AWS ECS Fargate posture as deliberate pre-revenue cost cuts, then later produced a rigorously verified scale-to-zero design for the most compute-heavy service by soliciting multiple independent design drafts and fact-checking every load-bearing AWS-behavior claim against primary AWS documentation before synthesizing a final approach. (Project A -- the network topology and worker scale-to-zero design)

Plan-time preconditions to prevent crash-looping services

Added Terraform preconditions that fail a plan, rather than a live boot, when a feature flag would be enabled without its required configuration present, and chose non-empty default string values specifically to avoid an empty-string enum crash at boot. (Project A -- the infrastructure's feature-flag plan preconditions)

Removed a security-sensitive CI artifact

Stopped publishing the binary Terraform plan file as a GitHub Actions CI artifact after recognizing it embeds refreshed state, including secrets, in plaintext, replacing it with a masked text summary. (Project A -- the infrastructure CI pipeline's plan-artifact handling)

"Merge is the apply" CI/CD discipline enforced consistently

Ran the same merge-is-the-apply convention across the platform's Terraform infrastructure, applied via GitHub Actions, paired with a documented exception where the marketing stack deliberately uses plan-on-pull-request plus manual apply, so operators never assume one convention applies everywhere. (Project B -- the infrastructure repo's CI convention and its documented exception)

Designed for cost via architecture, not tuning

Used a scale-to-zero-by-default posture with the AWS Application Load Balancer (ALB) as the one standing exception, and public-subnet AWS ECS Fargate tasks with no NAT gateway as a deliberate cost/security tradeoff, documented as such rather than left implicit. (Project B -- the platform's network and compute topology)

Declared and observed formal change freezes around first-ever scheduled batch windows

Coordinated freezes spanning multiple independent AWS ECS services (capture, extraction, verification), explicitly reasoning about which changes were in or out of scope for each freeze. (Project B -- the platform's operational change-freeze log)

Ran a repeatable, four-times-executed credential-elevation runbook

Used a standing procedure of temporarily re-pointing credentials, running the Alembic-managed migration, then reverting, against a PostgreSQL database with no administrative access path, with each of the four executions timed, verified, and reverted, and separately flagged the one component never brought into the pattern as an open critical finding rather than assuming coverage. (Project B -- the database migration privilege-elevation procedure)

Sub-agent-orchestrated design synthesis with a verification pass

A Terraform infrastructure design was produced by collecting multiple independently generated draft proposals and running a judging pass that fact-checked every load-bearing technical claim against primary sources before scoring and merging the strongest elements of each into a final design. (Project A — the worker scale-to-zero design process)

Eval harness spanning PR-time and nightly cadence

A curated gold-set of denial-classification cases runs on every PR via GitHub Actions without calling an LLM, a smaller LLM-backed eval subset using Anthropic's Claude API runs on PRs, and a full Claude API eval runs nightly, with an automatic graceful skip when no eval credentials are configured. (Project A — the gold-set test suite and CI / nightly-eval workflows)

TDD applied to AI-authored/AI-adjacent code

CI-enforced pytest tests, run through GitHub Actions, pin exact hallucination-guardrail behaviors, exact PHI-firewall exclusions, and exact fallback taxonomies, written before or alongside the corresponding production code paths. (Project A — the reasoning service's test suite)

Confidence-scored classification with an audited fallback path

The denial classifier prefers a corpus-matched code and only falls back to a category inferred by Anthropic's Claude API at a deliberately lowered confidence score set just under the human-review threshold, tracking which path produced each result for audit. (Project A — the reasoning service's denial-classification step)

Licensing-aware content guardrail

Member-facing procedure descriptions are restricted to a curated, human-reviewed, checksum-pinned glossary stored in PostgreSQL rather than any verbatim licensed descriptor text the model might otherwise echo. (Project A — the reasoning service's curated procedure-translation table)

A streaming tool-use loop with two distinct prompt-cache breakpoints

One prompt-cache breakpoint in the calls to Anthropic's Claude API sits at a byte-static system prefix and the other moves per round, with an explicit rule that the static prefix may never interpolate a date or id, because doing so would silently invalidate the cache for every user. (Project B — the web layer's chat engine)

A cheap-model-gates-expensive-model extraction pipeline

A fast triage pass, built in Python, filters most incoming content before an expensive structured-extraction pass using Anthropic's Claude API ever runs, with a separate dedupe-judgment pass to avoid creating duplicate structured records from the same underlying event. (Project B — the messaging-channel ingestion pipeline)

Guardrail against a real hallucination-adjacent failure mode

A React charting component refuses to draw rather than mislabel when the underlying data mixes incompatible units, added after a live incident where a percentage value was drawn on the same axis as a dollar figure. (Project B — the web layer's chart-rendering component)

A dual-persona voice system implemented entirely through prompt text

The two-persona voice runs with no routing code path at all, deliberately choosing self-selection by Anthropic's Claude API over an explicit branch so the single cached system prompt stays intact. (Project B — the persona-refresh and cadence design)

Diagnosed a model-behavior defect distinct from a backend defect

After an entitlement changed mid-conversation, every backend layer correctly reflected the new state, but Anthropic's Claude API kept asserting the old state because it anchored on its own prior turns; fixed with an explicit directive that the current context is authoritative, engineered as a pure function with zero extra PostgreSQL reads. (Project B — the web layer's entitlement-and-chat integration)

Designed the teaser answer path to be computed by deterministic SQL rather than by the model

The teaser path, computed directly in PostgreSQL, is asserted by a pytest test to contain none of the values that would make an incomplete answer look complete, keeping unentitled or rejected interactions cheap relative to full tool-using answers. (Project B — the product's locked-turn response pipeline)

Derived data-quality heuristics from real per-payer data instead of one global rule.

Built dead-man checks in Python for a structural anomaly class (plan-grain collapse or explosion) with per-payer exceptions, each justified from an actual measured ratio against that payer's real monthly data rather than a single global threshold. (Project B -- the pipeline design's observability and dead-man-check specification)

Kept a data-quality signal advisory rather than using it to silently drop rows.

Computed a suspicious-provider-share metric in Python and enforced, in code comments and schema documentation, that it exists to inform downstream judgment rather than to filter automatically — preventing silent data loss from a heuristic. (Project B -- rate-extraction pipeline's serving-state documentation)

Built PHI-specific data protection into the architecture rather than adding it on afterward.

Used dedicated, rotating AWS KMS-managed encryption keys scoped by data purpose, S3 Object Lock's write-once storage locking on PHI data, and copied an existing service's strong per-user authorization pattern into a service found to lack it. (Project A -- static-scan findings and infrastructure module layout)

Tracked vendor risk as a versioned artifact instead of tribal knowledge.

Maintained a machine-readable vendor compliance-agreement status file that was updated the same day a compute-provider swap changed which vendor handled raw PHI egress. (Project A -- vendor compliance-agreement status reference)

Built out threat detection incrementally, tied to real alerting rather than dashboards nobody watches.

Stood up AWS GuardDuty and AWS Security Hub threat-detection and security-posture services with severity-based alert routing, plus encrypted, centralized AWS CloudTrail audit logging, as part of a phased security hardening program. (Project A -- static-scan findings, infrastructure hardening section)

Engineered right-to-erasure with fail-closed safety properties.

Built a Python data-erasure capability shared by self-service requests and operational hygiene sweeps, requiring a matching read-only dry run before any destructive run, refusing to orphan case-anchored records, and leaving a permanent PHI-free audit trail. (Project A -- data-erasure hygiene-sweep runbook)

Used one service's identity design as the reference pattern and prioritized fixing a sibling service that fell short of it.

Fail-closed token verification plus PostgreSQL row-level security (RLS) checks were the established pattern in one service; the same review found a sibling service relying on unguessable identifiers alone, and that gap got prioritized for remediation. (Project A -- static-scan findings and identity subsystem review)

Tracked standing-privilege and secrets-hygiene gaps to closure instead of fixing them ad hoc.

Flagged a broad-privilege standing administrative IAM identity and secrets without automatic rotation, scheduling remediation for both as part of the same structured roadmap rather than one-off fixes. (Project A -- security vulnerability roadmap, standing-privilege and secrets items)

Layered network defenses by traffic shape rather than by rule count.

Separated volumetric and reputation AWS WAF rules, which were enforced, from content-inspection rules, which were deliberately left observation-only, reasoning explicitly about why a legitimate query payload would otherwise trip generic input-filtering rules. (Project B -- regional WAF access-control configuration)

Monitoring caught a real production drift during an active change window.

An out-of-band emergency IAM policy patch made mid-incident correctly triggered its intended AWS CloudWatch alarm; rather than treat the alarm firing as the end of the story, the fix was codified back into the Terraform infrastructure-as-code with a matching runbook update. (Project A -- infrastructure notes on the IAM-drift codification)

Root-caused a payment-integrity class of bug, not just the symptom.

Traced a defect that let members pay before discovering their letter wasn't actually sendable to an ordering bug in the Python backend between a paywall check and a readiness check, then fixed the ordering and added a purchase-time guard rather than a point patch. (Project A -- payments subsystem "money integrity" findings)

Alarm hygiene as a continuous practice, not a one-time cleanup.

Identified a month-long unacknowledged AWS CloudWatch alarm and a flapping false-positive alarm caused by an internet-facing AWS Application Load Balancer (ALB) left running against a scaled-to-zero backend, then fixed the underlying cause instead of muting the noise. (Project A -- operations log on alarm cleanup)

Closed a schema/behavior gap that had already caused a production incident.

After a widened application-level enum without a matching PostgreSQL constraint change broke a live payment webhook, added a dedicated schema-parity pytest test class specifically so that category of gap could not silently recur. (Project A -- data-model notes on the Alembic migration-autogenerate guard)

Ran a repeatable credential-elevation runbook as standing operational practice.

For schema migrations against a PostgreSQL database with no administrative access path, executed a temporarily-repoint-credentials (AWS SSM Parameter Store) / migrate / revert procedure four times, each run timed, verified, and reverted, and separately flagged the one component never brought into the pattern as an open finding rather than assuming coverage. (Project B -- infrastructure notes on the migration privilege-bracket procedure)