Jacob Stephens

Platform engineer building production systems, developer tools, and safe AI automation.

I work across application code, databases, infrastructure, and operations. At Educational Travel Adventures, I lead a two-engineer team and remain hands-on with the reservations platform that supports a multi-million-dollar specialty-travel business. My work spans modernizing a legacy PHP / MySQL stack, improving reliability and performance, and building tools that let people use coding agents with clear boundaries and human review.

Portfolio · LinkedIn · Contact · Resume

My focus is platform reliability, developer experience, and practical AI tooling, with technical leadership grounded in hands-on engineering.

Production impact

• Removed ~80% of measured database query time with three online indexes, guided by production measurements and verified with query plans.
• Cut manifest load time from 5–7 seconds to ~1 second and SQL statements per request from 2,650 to 183, while preserving byte-identical HTML.
• Shipped 14 manager-prototyped features through engineering review and hardening. Managers prototype in Docker sandboxes; a human reviews changes before production.
• Instrumented 14 hosts with Prometheus, Grafana, and Alertmanager, covering host metrics, database replication, uptime, and TLS expiry.

Most of this code is private. The ETA platform case study documents the problems, decisions, and measured outcomes; infrastructure-patterns shares sanitized architecture decisions, threat models, and operational review practices.

Selected engineering work

Project	What to look for
infrastructure-patterns	Production architecture decisions and their trade-offs: tenant isolation, agent identity, deployment, and human review.
Tracewake	Coding-agent orchestration from a labeled issue to a draft PR, with isolated execution, bounded runs, and human-controlled merges. v0 in development. Design · Decisions
vaulted-agent	Rust launcher that resolves vault secrets into agent processes, with per-agent secret manifests and optional prompt authentication. Product
muxboard	Python dashboard for tmux sessions across a host or fleet, with browser attach, default-deny authentication, and a documented threat model. Product

Product engineering

• Chart35 — Offline-first charting with end-to-end encrypted sync across web, iOS, and Android. The public showcase explains the architecture and privacy boundaries. Product
• Cascade — A waterfall sound player with one headless Rust core and six platform shells: web, Android, macOS, Windows, iOS, and watchOS. Architecture · Apps

Upstream contributions

• Merged: MySQL 8.4 authentication fix in php-mysql-replication, enabling binlog readers to connect without downgrading server authentication.
• PR submitted: Kimi Code credential-resolution fix for headless runs that ignored environment-provided credentials.
• Diagnosed and reported: Herdr / Muse stale working-state bug; the Muse team shipped the idle-report fix in Muse Code 1.2.1.

Published libraries and more projects

TypeScript and Go libraries with cross-language test fixtures:

Library	TypeScript	Go
HMAC webhook verification	webhook-verify · npm	webhook-verify-go
AES-256-GCM encryption envelopes	webcrypto-envelope · npm	webcrypto-envelope-go

• Drome — Local-first iOS challenge tracker with a Rust rules engine, SwiftUI, and WidgetKit.
• k3s-demo — A separate, non-production Kubernetes learning environment with probes, resource limits, ingress, and kustomize.

---

St. Carlo Acutis, pray for us.