Reference architectures

Six systems, drawn all the way down.

Client systems stay private. These are how I'd build each kind of system today, all the way through: edge, network, security, data, delivery, and the parts that break at 3 a.m. They're sized for the second year of traffic.

How to read them: solid lines are synchronous calls, dashed lines are async events, and the moving dots are traffic. Dashed boxes are boundaries. On a phone, swipe sideways to see the whole drawing.

01 / AI platforms · reference

Multi-agent platform with an eval loop

Lots of agents, one engine running them, and every model or vendor behind an interface. Traces go to an eval runner, and its verdict decides whether a release ships, so changing a prompt gets the same care as changing a schema.

reference · one image, three runtimes · every provider behind a port · evals gate every release · WAF, private endpoints, CMK and rotation by default · OTel end to end

Load-bearing decisions

Providers are ports chosen by environment, never imported by feature code; swapping OpenAI for a private Azure endpoint is a config change.
Every model call emits an OpenTelemetry span with cost and latency; a sample is scored against golden sets and drift is a release blocker.
Guardrails run on the way in and on the way out of the router, not inside individual agents.
Tools execute in a sandbox with allowlists and TTLs; the agent never holds a credential.
One image runs on Cloud Run, AKS, or Container Apps; the WAF, private endpoints, and CMK are part of the Terraform, not a checklist.

TypeScript · NestJS · AI SDK · MCP · pgvector · Mem0 · OpenTelemetry · Terraform · Kubernetes

02 / Healthcare · reference

Clinical document intelligence, inside the PHI boundary

Faxes, HL7 v2, FHIR and portal uploads all land in one encrypted store. Temporal runs OCR, LLM extraction, validation and a human review before anything becomes a record. Analytics only sees de-identified data.

reference · PHI never leaves the boundary · CMK-encrypted object store with WORM audit · Temporal owns every retry · LLM extraction through a private endpoint, validated against a schema, reviewed by a human before it becomes a record · analytics only on de-identified data

Load-bearing decisions

PHI has one home: a CMK-encrypted, versioned object store with WORM retention. Everything else holds references.
Temporal owns retries, timers, and SLAs, so a stuck extraction is a visible workflow, not a lost message.
LLM extraction goes through a private endpoint and must satisfy a schema; a human signs off before a FHIR resource is written.
Authorization is ABAC with consent and purpose of use; every decision lands in an append-only audit log streamed to the SIEM.
No public IPs. Private AKS, bastion access, Key Vault-backed keys with rotation, geo-redundant backups with tested restores.

HL7 v2 · FHIR R4 · Temporal · Document AI · Azure OpenAI · NestJS · PostgreSQL · AKS · Terraform · Sentinel

03 / SaaS · CRM · reference

Event-driven CRM for many tenants

Web, mobile, mail add-ins and a public API all go through one GraphQL edge. Each service owns its schema. Data only leaves through an outbox into Kafka, and search, webhooks, integrations and the warehouse are rebuilt from there.

reference · one Postgres with RLS per tenant · outbox → Kafka is the only way state leaves a service · webhooks are signed and at-least-once with a dead-letter queue · search and warehouse are projections that can be rebuilt from the log

Load-bearing decisions

One PostgreSQL with row-level security per tenant and an outbox table; change data capture into Kafka is the only side channel.
Search and the warehouse are projections. If either is wrong, replay the log rather than patch the index.
Webhooks are HMAC-signed, at-least-once, retried with backoff, and parked in a dead-letter queue with a replay tool.
The GraphQL BFF federates services and batches with loaders; the API gateway handles OAuth2, quotas, and API keys before anything hits a resolver.
Feature flags are per tenant with gradual rollout; every rollout has a kill switch and a dashboard.

Next.js · GraphQL · PostgreSQL · Kafka · OpenSearch · Redis · Temporal · ClickHouse · Kubernetes · Terraform

04 / Cloud migration · reference

Azure CSP landing zone and multi-cloud migration

AWS, GCP and on-prem workloads move into an Azure CSP tenant in waves. The landing zone comes first, then identity, servers, containers, databases and storage. Both sides stay live until traffic shifts over through Front Door.

reference · AWS, GCP, and on-prem into an Azure CSP tenant · landing zone first (management groups, policy, hub-spoke, Entra), then waves · replication and CDC keep both sides live until a weighted Front Door cutover · sources are decommissioned only after cost and SLO proof

Load-bearing decisions

The landing zone ships before the first workload: management groups, policy as code, hub-spoke networking, Entra with PIM, and budgets, all from Terraform or Bicep modules.
Assessment produces waves, not a wishlist: dependency maps and TCO per wave decide what re-hosts, what re-platforms onto AKS or Container Apps, and what is retired.
Databases move with CDC and a rehearsed cutover; storage syncs continuously; nothing is switched on faith. Rollback is a DNS weight, not a war room.
Traffic cuts over gradually through Front Door with WAF in front, while Monitor and Sentinel already watch the new estate.
Sources are decommissioned only after cost and SLO proof; CSP billing, tags, and chargeback are in place from day one so the invoice has no surprises.

Azure Migrate · Site Recovery · DMS · ExpressRoute · Entra ID · AKS · Front Door · Sentinel · Terraform · Bicep

05 / Blockchain infrastructure · reference

Multi-chain node fleet with an indexing and RPC layer

Validators, relays and RPC nodes for Polkadot, Cardano, Avalanche and Midnight, built from Packer images and Terraform. A rate-limited gateway sits in front, alerts watch block height, and no person can ever read a hot key.

reference · validators and block producers in private subnets, only RPC reachable and only through the gateway · Midnight runs as a Cardano partner chain, so its nodes read the Cardano producer through db-sync and ZK proofs come from a stateless proof server · immutable Packer images per chain client · session keys in HSM/KMS, stake and governance keys offline · alerts on height lag, peers, finality, proof latency

Load-bearing decisions

Validators and block producers sit in private subnets behind sentries and relays; only RPC nodes are reachable, and only through the gateway.
Images are immutable: Packer plus Ansible per chain client, promoted by tag; a bad release is a rollback of an image, not an SSH session.
Session and signing keys live in an HSM or KMS with a separate cold path for stake and governance keys.
Indexers write to a database that the API reads; the chain is the source of truth and every table can be rebuilt from genesis.
Alert on what users feel: block height lag, peer count, finality delay, and proof-server latency, with runbooks linked from the alert.

Polkadot · Cardano · Avalanche · Midnight · Terraform · Packer · Ansible · Kubernetes · Prometheus · Grafana

06 / Custody · signing · reference

Policy-gated signing service for many chains

One API for wallets and transactions across chains. A policy engine decides, an HSM signs, chain-specific builders put the transaction together, and an append-only ledger records every decision.

reference · key material never leaves the HSM/KMS · every request is built, screened, policy-checked, and (above a threshold) approved by quorum before it is signed · nonce manager and idempotency keys make retries safe · append-only ledger streamed to the SIEM

Load-bearing decisions

Keys never leave the HSM or KMS; the service holds handles and derivation paths, not material.
Every request passes a policy engine: allowlists, velocity limits, and quorum approvals for anything above a threshold.
Chain adapters build and broadcast; a nonce manager per account and idempotency keys make retries safe.
mTLS between services, WAF at the edge, and an audit ledger that is append-only and shipped to the SIEM.
Rotation and recovery are rehearsed: sharded backups, tested restores, and a documented break-glass path.

TypeScript · HSM · KMS · secp256k1 · ed25519 · sr25519 · PostgreSQL · Redis · Kubernetes · Terraform · OpenTelemetry