Reference architectures

Six systems, drawn all the way down.

Client topologies stay with the client. These are the systems I would build in each domain today, end to end: edge, network, security, data, delivery, and the parts that fail at 3 a.m. Each one is scaled for the second year, not the demo.

Hairline drawings: solid edges are synchronous calls, dashed edges are async or events, dots are traffic. Boundaries are dashed. On a phone, drawings scroll sideways at full size.

01 / AI platforms · reference

Multi-agent platform with an eval loop

Many agents, one turn engine, every model and vendor behind a port. Traces feed an eval runner whose verdict gates the release, so a prompt change is treated like a schema change.

reference · one image, three runtimes · every provider behind a port · evals gate every release · WAF, private endpoints, CMK and rotation by default · OTel end to end

Load-bearing decisions

Providers are ports chosen by environment, never imported by feature code; swapping OpenAI for a private Azure endpoint is a config change.
Every model call emits an OpenTelemetry span with cost and latency; a sample is scored against golden sets and drift is a release blocker.
Guardrails run on the way in and on the way out of the router, not inside individual agents.
Tools execute in a sandbox with allowlists and TTLs; the agent never holds a credential.
One image runs on Cloud Run, AKS, or Container Apps; the WAF, private endpoints, and CMK are part of the Terraform, not a checklist.

TypeScript · NestJS · AI SDK · MCP · pgvector · Mem0 · OpenTelemetry · Terraform · Kubernetes

02 / Healthcare · reference

Clinical document intelligence, inside the PHI boundary

Fax, HL7 v2, FHIR, and portal uploads land in one encrypted store; Temporal drives OCR, LLM extraction, validation, and human review before anything becomes a record; analytics only ever sees de-identified data.

reference · PHI never leaves the boundary · CMK-encrypted object store with WORM audit · Temporal owns every retry · LLM extraction through a private endpoint, validated against a schema, reviewed by a human before it becomes a record · analytics only on de-identified data

Load-bearing decisions

PHI has one home: a CMK-encrypted, versioned object store with WORM retention. Everything else holds references.
Temporal owns retries, timers, and SLAs, so a stuck extraction is a visible workflow, not a lost message.
LLM extraction goes through a private endpoint and must satisfy a schema; a human signs off before a FHIR resource is written.
Authorization is ABAC with consent and purpose of use; every decision lands in an append-only audit log streamed to the SIEM.
No public IPs. Private AKS, bastion access, Key Vault-backed keys with rotation, geo-redundant backups with tested restores.

HL7 v2 · FHIR R4 · Temporal · Document AI · Azure OpenAI · NestJS · PostgreSQL · AKS · Terraform · Sentinel

03 / SaaS · CRM · reference

Event-driven CRM for many tenants

Web, mobile, mail add-ins, and a public API meet one GraphQL edge; domain services own their schemas; state leaves only through the outbox into Kafka, where search, webhooks, integrations, and the warehouse are rebuilt as projections.

reference · one Postgres with RLS per tenant · outbox → Kafka is the only way state leaves a service · webhooks are signed and at-least-once with a dead-letter queue · search and warehouse are projections that can be rebuilt from the log

Load-bearing decisions

One PostgreSQL with row-level security per tenant and an outbox table; change data capture into Kafka is the only side channel.
Search and the warehouse are projections. If either is wrong, replay the log rather than patch the index.
Webhooks are HMAC-signed, at-least-once, retried with backoff, and parked in a dead-letter queue with a replay tool.
The GraphQL BFF federates services and batches with loaders; the API gateway handles OAuth2, quotas, and API keys before anything hits a resolver.
Feature flags are per tenant with gradual rollout; every rollout has a kill switch and a dashboard.

Next.js · GraphQL · PostgreSQL · Kafka · OpenSearch · Redis · Temporal · ClickHouse · Kubernetes · Terraform

04 / Cloud migration · reference

Azure CSP landing zone and multi-cloud migration

AWS, GCP, and on-prem estates move into an Azure CSP tenant in waves: landing zone first, then identity, servers, containers, databases, and storage through a migration factory, with both sides live until a weighted Front Door cutover.

reference · AWS, GCP, and on-prem into an Azure CSP tenant · landing zone first (management groups, policy, hub-spoke, Entra), then waves · replication and CDC keep both sides live until a weighted Front Door cutover · sources are decommissioned only after cost and SLO proof

Load-bearing decisions

The landing zone ships before the first workload: management groups, policy as code, hub-spoke networking, Entra with PIM, and budgets, all from Terraform or Bicep modules.
Assessment produces waves, not a wishlist: dependency maps and TCO per wave decide what re-hosts, what re-platforms onto AKS or Container Apps, and what is retired.
Databases move with CDC and a rehearsed cutover; storage syncs continuously; nothing is switched on faith. Rollback is a DNS weight, not a war room.
Traffic cuts over gradually through Front Door with WAF in front, while Monitor and Sentinel already watch the new estate.
Sources are decommissioned only after cost and SLO proof; CSP billing, tags, and chargeback are in place from day one so the invoice has no surprises.

Azure Migrate · Site Recovery · DMS · ExpressRoute · Entra ID · AKS · Front Door · Sentinel · Terraform · Bicep

05 / Blockchain infrastructure · reference

Multi-chain node fleet with an indexing and RPC layer

Validators, relays, and RPC nodes for Polkadot, Cardano, Avalanche, and Midnight, built from Packer images and Terraform, fronted by a rate-limited RPC gateway, watched by block-height alerts, and never holding a hot key that a person can read.

reference · validators and block producers in private subnets, only RPC reachable and only through the gateway · Midnight runs as a Cardano partner chain, so its nodes read the Cardano producer through db-sync and ZK proofs come from a stateless proof server · immutable Packer images per chain client · session keys in HSM/KMS, stake and governance keys offline · alerts on height lag, peers, finality, proof latency

Load-bearing decisions

Validators and block producers sit in private subnets behind sentries and relays; only RPC nodes are reachable, and only through the gateway.
Images are immutable: Packer plus Ansible per chain client, promoted by tag; a bad release is a rollback of an image, not an SSH session.
Session and signing keys live in an HSM or KMS with a separate cold path for stake and governance keys.
Indexers write to a database that the API reads; the chain is the source of truth and every table can be rebuilt from genesis.
Alert on what users feel: block height lag, peer count, finality delay, and proof-server latency, with runbooks linked from the alert.

Polkadot · Cardano · Avalanche · Midnight · Terraform · Packer · Ansible · Kubernetes · Prometheus · Grafana

06 / Custody · signing · reference

Policy-gated signing service for many chains

One API for wallets and transactions across curves and chains: a policy engine decides, an HSM signs, chain-specific builders assemble, and an append-only ledger remembers every decision.

reference · key material never leaves the HSM/KMS · every request is built, screened, policy-checked, and (above a threshold) approved by quorum before it is signed · nonce manager and idempotency keys make retries safe · append-only ledger streamed to the SIEM

Load-bearing decisions

Keys never leave the HSM or KMS; the service holds handles and derivation paths, not material.
Every request passes a policy engine: allowlists, velocity limits, and quorum approvals for anything above a threshold.
Chain adapters build and broadcast; a nonce manager per account and idempotency keys make retries safe.
mTLS between services, WAF at the edge, and an audit ledger that is append-only and shipped to the SIEM.
Rotation and recovery are rehearsed: sharded backups, tested restores, and a documented break-glass path.

TypeScript · HSM · KMS · secp256k1 · ed25519 · sr25519 · PostgreSQL · Redis · Kubernetes · Terraform · OpenTelemetry