Open Source

Projects

Things I have built. The open-source work is on GitHub; the commercial systems are described here rather than linked, because the clients are confidential. Mostly infrastructure software: telephony, energy tooling, trading and risk.

Telephony Platform

GOPBX

A FusionPBX-class PBX rebuilt in Go, with a SvelteKit front end and FreeSWITCH underneath.

Active · MIT

FusionPBX has been the default open-source PBX management layer for years, and it works, but it is PHP on top of FreeSWITCH, with an admin interface that shows its age. GOPBX is my answer to a simple question: what would that platform look like if you wrote it today?

The control plane is Go 1.25. The frontend is SvelteKit with shadcn-svelte, so the admin UI behaves like a modern application rather than a series of form posts. FreeSWITCH stays where it belongs, handling media and signalling, driven through ESL and generated XML. Configuration lives in Postgres and is exposed over a REST API, which means the same operations are available to the UI, to scripts and to other systems without three separate code paths.

Go 1.25 SvelteKit shadcn-svelte FreeSWITCH ESL PostgreSQL REST API MIT licence

The intended surface

A business PBX has a fairly fixed feature shape, and this is it, organised the way an operator thinks about it rather than the way the database is laid out. Implementation status varies by area, see the note below.

Call handling

  • Extensions and extension summary
  • Inbound and outbound call routing
  • Call forward, transfer and call waiting
  • Blind and announced transfer
  • Call pickup and call parking
  • Ring groups and follow-me
  • Do not disturb
  • Call block

Routing intelligence

  • IVR menus and auto attendant
  • Time conditions
  • Call flows for day and night mode
  • Dialplan management
  • Caller ID handling
  • Dial by name
  • Direct inward system access

Queues and centre

  • Call queues
  • Call centre agent handling
  • Music on hold
  • Announcements and phrases
  • Paging and intercom
  • Barge, eavesdrop and whisper

Voicemail and recording

  • Voicemail with per-extension boxes
  • Voicemail to email
  • Call recording
  • Recording management
  • Call monitoring

Administration

  • Multi-tenant domains
  • Users, groups and permissions
  • Authentication and session handling
  • Gateway and provider setup
  • Device provisioning
  • Contacts
  • REST CRUD across all objects

Visibility

  • Call detail records
  • Live channel and registration view
  • Extension status
  • XML configuration generation
  • Event socket command console
Status, honestly. GOPBX is an active reimplementation of the FusionPBX workflows I needed, not a certified drop-in replacement for a production cluster. Some surfaces are complete and some are scaffolded, and the list above is the intended feature shape rather than a claim that every item is production ready. The repository is the accurate answer, and it is public under MIT.
GOPBX on GitHub Read the write-up
Developer Workflow

DevLoop

An AI-assisted development loop: report, fix, review, ship.

Internal

DevLoop connects the parts of a development cycle that usually live in separate tools. A bug gets reported from inside the running application, an AI pass proposes a fix against the real codebase, the change is reviewed in context, and it ships. The point is not to remove human judgement but to remove the handoffs around it, the copy-pasting between issue tracker, editor, review tool and deploy pipeline that eats most of the time in a small team.

AI-assisted development Workflow automation Code review
Energy Software

Energy Operations Platform

The full stack an electricity retailer runs on: customers, metering, market messaging, billing, telephony and dispatch.

Commercial

This is the largest body of work. It is commercial and under confidentiality, so I describe what the systems do rather than who runs them. Together they cover what it actually takes to run an electricity supplier: acquiring a customer, moving them onto a contract, reading their meter, sending and receiving the regulated market messages that make a supplier switch legal, billing them correctly, and answering the phone when something goes wrong.

They share one architecture. A SvelteKit frontend with a shadcn component system, a backend-for-frontend layer that holds the browser-facing credentials and proxies to the services that own database access, Rust and Go services underneath for the parts that have to be fast or exact, and PostgreSQL as the system of record. No frontend talks to a database directly, anywhere.

The systems

Customer and sales platform

A CRM built for energy rather than adapted to it. Deal pipelines, contract lifecycle, tariff and product catalogue, quoting, e-signature, onboarding, churn handling. Integrated dialler and softphone so an agent works a list without leaving the record, with AI drafting summaries and next actions from the call itself.

Market messaging and metering

The regulated layer: structured message exchange with grid operators and other suppliers for supplier switches, move-ins and move-outs, metering-point registry lookups, hourly and quarter-hourly consumption series, corrections and re-reads. Message-level validation and reconciliation, because a rejected switch that nobody notices is a customer that silently never arrives.

Billing and settlement

Multi-tenant invoicing over spot, fixed and hybrid products, with pass-through of grid fees, taxes and levies. Price lists, subscriptions, credit notes, reminders, ledger export. Settlement against actual measured volumes rather than estimates, and an audit trail that survives being asked why a specific line on a specific invoice looks the way it does.

Telephony and communications

A browser softphone over WebRTC, outbound dialling, call recording, queues, and the routing logic that connects an inbound number to the right team with the customer record already open. Email and messaging on the same backend so the conversation history is one thread rather than four systems.

Balance responsibility and reporting

The balance-responsible-party side: aggregating positions per balance area, submitting and reconciling the volumes that settlement is calculated on, and closing the loop between what was traded, what was delivered and what was invoiced. Imbalance is where a retailer quietly loses money, so this is mostly about catching discrepancies early.

EV charging and flexibility

Balancing software for charging infrastructure: shifting load across a site or a fleet to respect a grid connection limit, following a price curve, and bidding aggregated flexibility into balancing markets. A charger that waits twenty minutes is worth more than one that starts immediately, and the software is what turns that into revenue rather than an inconvenience.

SvelteKit Svelte 5 runes shadcn-svelte Rust Go Node.js PostgreSQL Backend-for-frontend WebRTC Linux
The performance case study
Trading & Risk

Trading Systems

Power markets, crypto and derivatives. Different assets, one recurring problem: sizing risk correctly and surviving the tail.

Commercial

Trading software is where forecasting, latency and risk management stop being separate concerns. The markets differ, but the requirements repeat: ingest market data, act on it under uncertainty, cap the position so a bad run cannot end the strategy, and reconstruct afterwards exactly why every order was sent.

Nordic power trading

Day-ahead bidding, intraday position management and balancing-market participation for the Nordic exchange. Price and volume forecasting, portfolio hedging against physical delivery, automated order placement, and post-trade reconciliation. The market clears whether or not your forecast was right, which makes the discipline around position sizing more valuable than the forecast itself.

Latency-sensitive crypto execution

Execution against multiple venues: order book ingestion, signal generation, order routing and inventory management, with the path tuned against p99 rather than the mean. Rust on the hot path where it earned its place, and a kill switch that does not depend on the strategy being healthy enough to stop itself.

Futures and options

Derivatives tooling that tracks delta, gamma, vega and theta alongside directional exposure: volatility surface handling, scenario and stress analysis, defined-risk structures and systematic roll logic. Most of the work goes into what the book does when volatility doubles overnight.

AI in the loop

Machine learning applied where it earns its keep: forecasting, regime classification, anomaly detection on the execution path, and parameter optimisation over historical data. Walk-forward validation throughout, because lookahead leakage produces a backtest that looks excellent and loses money.

On risk. Every one of these systems is built risk-first rather than return-first. Position limits, drawdown stops, exposure caps and kill switches are part of the architecture, not a configuration screen added afterwards, because a trading system does not usually fail over a bad quarter. It fails inside a single hour.
Rust Python Go PostgreSQL Time-series data Quantitative research Risk management Low latency
AI Security · Co-founder

Kistora

Access control for AI agents: decide before the action, keep the proof afterwards.

Company

Kistora sits between an AI agent and the systems it wants to touch: it decides before the action and keeps the proof afterwards. There is a fuller description on the about page and at kistora.ai.

Agent governance Policy enforcement Ed25519 signed ledger Secret management
kistora.ai
Open-source work on GitHub