I build systems where the money has to add up.

Users hold a USDT balance, trade, and take positions on event outcomes. The requirement that shaped everything: the books have to balance at any moment, including mid-trade and mid-withdrawal.

I put the accounting core in its own reusable module — double-entry postings, accounts, HD wallets, deposits and withdrawals across four networks, on-chain reconciliation, fees, compliance screening. The order book and prediction market sit on top of it. Private keys never live in the application: signing is isolated in a separate service.

The same core now backs a second, unrelated product. That's the test of whether a ledger was built properly: it survives being reused.

Fig. A-1Wallet — balance split into available and locked, so a hold is visible rather than a surprise at withdrawal.

Multiple receiving addresses with source attribution, balance accounting, batches of payouts as the central object, recurring debits, screening on the way in. Six coins across eight coin-and-network pairs, because a currency without its network is an incomplete quantity — that rule lives in the data model, not in a convention people are asked to remember.

The part I'd point at first: a batch runs as a dry run before it sends. Every row comes back with its fee on top of the amount and the exact debit that will hit the account. Nobody discovers the cost of a two-hundred-line payout after the money has left. Built on the ledger core above rather than from scratch — which is why it reached 48 endpoints and a full batch lifecycle in weeks, not quarters.

Fig. A-2The dry run before anything is sent: 487 rows out, recipients receive 12,480.25 USDT, 12,967.25 leaves the account fees included, 13 rows held with a reason each. Test network — amounts are not real.

Fig. A-3Receiving with source attribution — every source gets its own address per network, so money identifies itself by where it lands. The import key never changes; that is what makes the total per source add up across renames.

Ingesting, parsing and generating bank statements in a national exchange format, analytics over transactions, client and counterparty registries. A team uses it every working day. A chat bot as the fast interface, a 301-endpoint web API, background workers so heavy processing never blocks a user, progress on long jobs over WebSocket and server-sent events.

Money is Decimal and NUMERIC, never float — a project rule, not a preference. The web client was rewritten from Vue to Next.js with types generated from the backend's own OpenAPI spec, so a contract change breaks the build instead of the user's screen. Three years in daily production with a single engineer maintaining it. The 7,195 tests are why that was possible.

Account managers were reading PDF credit reports from three different bureaus by eye and retyping the figures into spreadsheets and deal records. The brief was to remove the manual step entirely, not to speed it up.

A CRM webhook lands in a queue, workers pull the PDFs from cloud storage, parse three unrelated report formats, merge them into one picture, fill seven blocks of a working spreadsheet and write the result back onto the deal. Some documents are scans, so recognition is part of the pipeline rather than a prerequisite for it. This is the second generation — the first had almost no tests and was hard to change without fear, so I pulled the pipeline out and rebuilt it, tests first. The 3,690 tests exist because a misparsed credit figure is not a cosmetic bug — that lesson cost me a rewrite.

One place in the system issues user tokens, so no other service has to store a password or a piece of personal data. Sessions, EdDSA-signed tokens with a published key set for neighbouring services to verify, passwordless keys via WebAuthn, one-time codes, Argon2 hashing, profiles and roles, and the mapping between identity and money accounts.

Fresh dependency releases sit in a one-week quarantine before they can be installed. A compromised package is most dangerous in the hours after publication, before it's pulled; a week closes that window without delaying real security fixes.

When several AI agents work on one system across separate repositories, they need a way to agree — otherwise each fixes the boundary its own way. An MCP server with a shared mailbox: messages addressed to roles, threads with a lifecycle and work status, machine-readable agreement on decisions, and shared contracts held as pinned, versioned entries. Two transports: local, and hosted with isolated channels and token auth.

This is the one piece of my work you can open and read yourself. If you want to judge how I write code before hiring me, start here.