Systems & infrastructure engineer · I build and run private AI
One idea runs through all of it: never trust a confident claim — human or AI — until it's checked against what's real. It's why my news engine corroborates instead of pronounces, why my story world pauses rather than invent, and how I catch an AI agent the moment it starts confidently making things up.
I'm Halfax — a senior infrastructure & automation engineer. By day: large-scale storage, cloud, and end-to-end automation. Off the clock I turn that same discipline loose on a lab where I own and control every layer, silicon to reverse proxy — and run it like production. No cloud LLMs in the loop — nothing I don't own, nothing that leaves the house.
Inside it: a multi-model LLM server running three models resident at once on a single GPU's 96 GiB — headlined by a 120-billion-parameter reasoner running on an integrated GPU the vendor's own AI stack won't even boot on, and it's fast. Plus an always-on AI-driven story world, a cross-source news engine that fact-checks itself against the sources it reads, and even a from-scratch operating system with its own kernel, TCP/IP stack, and windowed desktop. I don't just build these — I run them like real infrastructure: wired across a small private fleet, backed up automatically, and reproducible enough to rebuild the entire stack from scratch after a total loss — the backups even land on a machine in another room.
And lately, the fun part — and the genuinely hard part: getting specialized AI agents to work together as one — splitting a big problem across them, handing results between them, having them cross-check each other. Orchestrating them is the easy half. The real skill is the conducting: knowing my own systems well enough to catch an agent the moment it drifts — when it's confidently producing something that looks right but doesn't match what I know to be true — and pulling it back before it ships. That's the thesis up top, turned on the AI itself: a fast, capable partner that still needs someone who knows the ground truth to keep it honest. The back-and-forth is where the good work comes from. A few of these are live right now — go poke at them.
Live right now
Not demos, not screenshots — production services running on my own hardware right now, served to the public through a hardened reverse proxy. Go poke at them.
Chat with my private LLM server — the same model that drives my IDE extension and code tools, served over an OpenAI-compatible API on my own GPU. Nothing leaves the house.
Open the chat →Reads nearly 50 news sources — and actively searches the wider web for more — then reads how each one frames a story from the writing itself, and confirms a fact when sources that frame it differently still agree. No pronouncements, every claim quote-checked.
Open the Augur →An AI-driven story world that keeps running on its own across three machines — characters, factions, and arcs evolving in the background. The public World Browser reads straight from the canonical chronicle.
Open the World Browser →A narrative "interactive-book" RPG set in a state-run-reincarnation dystopia — death isn't a fail state, it's the loop. Branching, stat-gated choices with no hidden dice; your skills, memories, and convictions carry across every life toward one of ~30 endings. Runs entirely in your browser, saves locally, no account.
Play it →An always-on outdoor camera anyone can watch — no account, about three seconds behind live even on a phone. Its indoor sibling stays dark until armed behind a login + TOTP, and the privacy is engineered at the stream level, not a settings page: the public endpoint is hardcoded to the outdoor camera with no audio track in the stream at all.
Watch the birds →The hardware
Each host does what its hardware is good at, not what's convenient. They all talk over the same WireGuard mesh, so internal traffic stays internal even when machines are continents apart.
See the fleet live — real-time resource & workload stats →
mail.guywithgames.com), and the live World Browsershopmom.net), off the mesh, reached by direct SSHManaged WireGuard. Every host reaches the others directly over a private mesh address — SSH, the database, the vault API, the story pub/sub — none of it on the public internet.
An authoritative private zone gives every service a stable name; move a service and one DNS record changes — nothing is hardcoded to an IP.
Heavy compute on the GPU box, data/infra on Cygnus, always-on light work on the Pi, public entry points on the VPSes where uptime beats throughput.
Every public service uses free auto-renewing certs from Let's Encrypt (ISRG) — worth a donation to keep it free for everyone.
What makes it all work
The projects below aren't islands. They're held together by three things I built on purpose: a private AI server I fully own, a shared memory so every AI agent works from the same durable context instead of starting cold in its own vendor silo, and a governance layer that makes them all work my way — my written rules outrank the model's defaults. I don't just use these assistants; I direct them, and I know my own systems well enough to catch one the moment it drifts. This is what makes a one-person lab punch far above its size.
And none of it is theoretical. A capable AI will hand me something that looks right — several times a day — and the craft is catching it against the ground truth and writing the correction into the rulebook so no agent repeats it. The verification isn't a feature I bolted on; it's the discipline the whole lab runs on — including how this very page is kept honest.
Hal-AI is a private multi-model LLM server running on my GPU, behind an OpenAI-compatible API. Any tool that already knows how to talk to OpenAI — or to MCP — can point straight at it, so I'm never renting someone else's model to work on my own code. Two MCP bridges expose its inference, memory, file operations, and the whole homelab as plain tool calls, which is how an outside agent reaches my hardware at all.
I genuinely run Claude Code, Windsurf Cascade, GitHub Copilot, and my own Hal-AI extension on the
same codebase. Each ships its own per-conversation memory; left alone, they'd each learn my conventions
separately and forget them separately. So I gave them common ground: a single ADR-style rulebook
(DECISIONS.md) symlinked so every tool finds its own native convention —
.cursorrules, AGENTS.md, CLAUDE.md — plus a shared semantic memory
any client can search. One source of truth, written once, read by every agent.
The rule that ties it together: when any agent learns something load-bearing mid-session — a corrected approach, a hard-won invariant — it gets promoted from that tool's throwaway memory into the shared rulebook in git, and off-boxed like production data. So the knowledge survives a context reset, a harness change, or swapping the assistant entirely. The lesson a model learns on Tuesday is still there, for every agent, on Friday.
The shared rulebook isn't a suggestion — it's the top authority. When a rule I've written collides with a model's own instinct or a vendor's built-in default, my rule wins, whichever assistant is driving. It governs not just what the AI knows but how it works — verify before claiming, don't wave off a hard question, no AI watermarks in my git history. And the load-bearing ones aren't left to good faith: they're compiled into hooks that block the wrong action before it runs. I set the standard; the assistant meets it or gets stopped.
The current edge of the work: getting several specialized agents to act as one. I fan a big job out across them, hand each one's result to the next, and have them cross-check each other before anything lands — then synthesize the survivors. Wiring that up is the easy half; the real skill is the conducting — sequencing who does what, and knowing my own stack well enough to spot the one that's confidently wrong and pull it before it ships. A fast room of assistants is only as good as the person who can tell which one to trust.
It compounds. Every session makes the shared context sharper about my specific stack, so the agents behave consistently instead of relitigating the same decisions. There's no lock-in — I can switch tools tomorrow and the memory stays, because it lives in git and on my hardware, not in a vendor's account. And because the rules travel with the code and are recoverable, the same rigor I put into backups protects how my assistants think.
Honest about the lineage: ADRs (Nygard, 2011), mem0, MemGPT, and
.cursorrules all exist. What's mine is the synthesis — owned compute, portable
cross-tool memory, and a promote-to-durable discipline tied into one workflow — run as if it were
production infrastructure.
What I build
AI tooling, distributed systems, security research, an operating system from bare metal, and games — every one built end to end and run for real on the lab, not left as a weekend demo. Skim the headlines; expand what grabs you.
A persistent, AI-driven narrative world that runs unattended across three machines — closer to an MMO backend than a chatbot, and it will pause the entire world before it fabricates a single scene.
Generated beats run through a filter that rejects atmospheric-formula openings, cliché tension families, time-of-day contradictions, and any output that leaks the prompt template instead of writing prose; each rejection is fed back as a negative example with rising temperature, up to six tries, and a beat that still won't come back clean is skipped rather than persisted. Combined with grammar-constrained JSON decoding, parse failures dropped from ~51% of LLM calls to 0%.
A private multi-model AI server on my own hardware that runs a 120-billion-parameter model on an integrated GPU — fast — even though the vendor's own compute stack doesn't work on this chip. OpenAI-compatible, so any tool that talks to OpenAI talks to mine instead.
llama-server child; a watchdog restarts a dead one within seconds, and requests can target a slot or auto-failover.json_schema / grammar pass straight through to llama.cpp, which masks any token that would break the schema before it's sampled.Three opt-in memory layers: a SHA-256-cached RAG store (~99k chunks at ~4 ms median lookup), the shared ChromaDB semantic memory, and a two-tier personal memory (always-loaded CORE + cosine-retrieved archive). A separate Vulkan llama-server serves embeddings, since Python sentence-transformers hangs on HIP init on this GPU.
A news engine that fact-checks itself. It ingests ~50 editorial feeds — and searches the open web for coverage it doesn't even subscribe to — clusters every outlet's take on the same story, and confirms only the facts that survive differently-framed reporting. It cuts through the spin to the shared truth and refuses to hand you an opinion.
The first build asked the model to pronounce what events mean. Every model tried — up to the largest I run — over-read: confident, well-cited-looking significance manufactured from a single beat, and the bigger the model, the more persuasively it did it. The failure was the genre, not the model. So the verdict layer was removed and replaced with extract-then-corroborate: the model only reads and quotes; the source graph decides what's true.
A from-scratch IDE client — chat, autonomous edits, autocomplete, one-click apply — that talks to my GPU, logs to plain JSON I own, works with the internet unplugged, and auto-resumes its agent mid-task after a crash, exactly where it stopped — a resilience the mainstream AI-coding tools still skip.
A local image generator running entirely on the server's integrated GPU — no CUDA, no cloud, no account. A ground-up rebuild tuned for a bandwidth-bound integrated GPU, where nearly every image tool assumes an NVIDIA card and would simply refuse to run.
sd-server keeps weights in GPU memory across generations; supports SDXL, Flux, SD3.5, Chroma, AuraFlow, HiDream with on-demand weights and a browsable catalog.Glue that lets any MCP-capable AI inspect and operate the whole fleet in plain English — "is hera-pi healthy?", "which containers restarted?", "deploy this site."
The AI agent's web reach — behind a real SSRF wall. Typed web tools instead of letting the model shell out to curl, so a prompt-injected agent can't be turned into a request-forging weapon against my own network.
Content-Length. A per-domain rate limiter stops agent feedback loops; 31 tests cover it.The bridge that lets any MCP-capable agent reach my AI stack and hardware — 49 tools, with a command surface that's deliberately not a shell.
.ssh, .gnupg, cloud credentials, and shell histories stay unreachable even if the agent's roots are widened; writes are atomic, with timestamped backups, mtime conflict detection, and a dry-run.My AI assistants don't start cold, aren't locked to one vendor, and don't get to freelance: I treat their rules like Architecture Decision Records — the top authority for how any assistant acts on my systems, in flat markdown, off-boxed like production data.
DECISIONS.md is the durable layer — each rule in ADR shape (rule / why / how to verify), in a shared fleet-docs git repo every host pulls, off-boxed nightly in the encrypted archive.PreToolUse hooks that block the wrong move before it runs — governance with teeth, not a wish list.DECISIONS.md, .cursorrules, AGENTS.md, and CLAUDE.md via symlink, so Claude Code, Cursor, Windsurf, and my own extension all read the same rules.I didn't build GitLab — but the way I run it is the point: the entire stack rebuilds from compose files and secrets bundles in a single afternoon, no vendor in the loop. That's the property no hosted version gives you.
recoveryplan/ tree rebuilds this entire stack from compose files and secrets bundles in an afternoon, with no vendor in the loop.Not just backups — a recovery tree: the backups plus the runbook to use them, both off-boxed, both reproducible, with a drift guard that recently caught a service that had been silently dead for six months.
mongorestore → start KeySecrets → ks-get works → clone from GitLab with the PAT pulled from the freshly-up vault.Tor isn't my code — but I use it for things it wasn't built for. The country-pinned exits aren't about anonymity; they let the Augur read state media as a non-Western reader sees it (Cloudflare posture, GDPR splash, editorial blurbs all change by viewer country). Built reproducibly from GPG-verified source — no third-party image in the trust path — bound strictly off the public internet, with a health check that proves a real circuit rather than just checking the port.
SocksPolicy gate; a health check builds a real circuit each interval rather than just checking the port.Security recon that turns Tor into a free attacker's-eye view of my own network — a rotating IP on none of my allowlists, so a probe sees my public surface exactly as an outside scanner would. Its first runs found real holes I'd missed: a public dev server running as root over plaintext, a silently-expired TLS cert, and an orphan port-forward — each caught, fixed, and re-verified.
Most homelabs end up with five disconnected tools — nmap here, DHCP leases there, an audit log somewhere else. This joins them against one device identity — active scans, BIND9 records, DHCP leases, audit hits, mesh peer state — so a device shows up once, with everything any tool knows about it.
A hardware-telemetry platform fronted by a custom WDM (Ring 0) driver that reads MSRs, PCI config space, and SMBus/I2C directly — the same access level commercial tools like HWiNFO use, written from scratch. A driver that loads into Ring 0 is a different league than calling an API.
A 64-bit, capability-based operating system written entirely from scratch in C and assembly — no borrowed kernel code — that boots on VMware and real hardware. Most hobby "OSes" stop at a bootloader printing "hello"; this one has its own TCP/IP stack and a windowed desktop where the shell, terminal, and compositor are all Ring-3 programs, not kernel code. The largest single thing I've ever written — and every line is mine.
cap_dup() only attenuates, never escalates), and no syscall takes a raw user pointer — memory crosses the boundary only as a (region, offset, length) capability the kernel granted. Closer to seL4 than Unix, by design; same direction as Fuchsia and CHERI.An unusual question I couldn't find anyone else asking: when the internet itself misbehaves — a route leak, a cable cut, a country going dark — what happens to the people playing games on top of it? BGP routing analysis and Steam behavioral analytics are separate worlds; correlating them was the framing I went looking for and didn't find prior art on.
A self-hosted, end-to-end encrypted secrets vault — hybrid post-quantum by default (X25519 + ML-KEM-768), built before most vendors ship it at all. The server only ever sees ciphertext: steal the entire database and you get nothing — even an admin with full disk access cannot read a single password.
halfax-secrets: a tiny lib + ks-get CLI fetches credentials over the API at runtime, so programs hold no .env files; per-host service tokens authenticate unattended scripts.A desktop Usenet newsreader with a hand-rolled NNTP client written straight against RFC 3977 — Python 3.13 removed nntplib, so I reimplemented the slice I needed over raw sockets, TLS and all.
References headers, multi-server subscriptions, and full read + post + quoted reply.A data-driven narrative "interactive-book" RPG in a dark-satirical, state-run-reincarnation dystopia — vanilla JS, no build, no server, no dependencies; it runs entirely in the player's browser and is playable now at grace.guywithgames.com.
Story.scene(...), so writing a chapter never touches engine code. Versioned, checksummed, lightly-obfuscated saves live in localStorage with a copy-pasteable export code — and a node smoke test asserts scene-graph integrity plus a 500-run fuzz (no dead-ends, no loops) after every change.A from-scratch Angband-style roguelike, 100 levels deep — ported file-by-file from a ~8,900-line Python build to ~7,200 lines of Godot 4 GDScript. The standout isn't the game; it's the Borg, an autonomous agent that plays the whole thing by itself.
A Skyrim-inspired RPG built in pure HTML, CSS, and JavaScript — no framework, no build tools — with a parallel Godot 4 port scaffolded.
A SimCity-style city builder in pure Python + Pygame (~3,900 lines), grown up from an earlier Tkinter prototype — with a genuinely deep simulation under the pixel art.