latency heat map of my photozoom 0 → raw events

Animated portrait drawn as a latency heat map: time runs left to right, latency up, and each column fills with requests whose counts come from my photo, so my face appears as heat. When the window is complete the chart zooms into the raw events and holds on my avatar.

zoom 0 career · the whole picture, then zoom in

    · ·

    roles and records active each yearzoom in by layer ↓

      Each cell counts the roles and decision records I had active that year, by my own reading of them; The brackets are the only results I quantify, on the same axis.

      · ·

      zoom 1 years · where in the stack the work happened

      Down the stack, year by year

      Read it like a density plot over time: years run across, one step per year, and each band is a layer of the stack, from product features at the top to isolation and virtualization at the bottom. The higher a band rises, the more of my roles and records touched that layer that year; you can watch the work move down the stack. The classification is mine, made from the roles and records below. Choose a year to see what is in it; it also zooms the commit calendar below to that year.

      or click a year on the chart

        zoom 2 months, then the days inside one

        When the commits land

        Read the shape, not the trend. A sample, not my history: each repository I own contributes only its most recent commits, so recent months run hot, and work for employers is not here at all.

        Loading the sample…

        One monthone cell per day

        zoom 3 events · the raw records behind the heat

        Records, ranked by evidence

        Each row is a decision record or project, with its outcome and its commit count in the sample. They open ranked by quantified result. Rank them by commits instead and the order flips: the hottest repositories are not where the biggest results are, because production work for employers leaves no commits in my own repositories.

        Rank by

          Black cells are results measured in production; employer code is not public, so those records have no commits here. * 200 is the sample's cap per repository: those cells are saturated, as a heat map's top bucket is. A count is evidence of activity, not of quality.

          outside the window what no commit sample can see

          Stack, community and habits

          Stack

          Community

            Habits

              zoom 4 the raw event behind every cell

              Reach me

              Full resolution: the avatar every heat map on this page was summarising. The small portrait in the ruler sharpens as you zoom in.

              Why this design

              Concept: Brendan Gregg's latency heat maps show what averages hide; the first screen makes my face the heat map's subject, built from requests and zoomed into the raw events, and an analyst reads one by zooming from the summary into the raw events; this page reads my work the same way, from where it happens to what it was.

              Information architecture: sections are zoom levels ordered by resolution, career, years, days, events, and the sticky ruler is the navigation; the commit calendar is one view that opens a month's days in place rather than a second grid.

              The years view is a density plot, one band per layer of the stack, built from my own classification of my roles and records; choosing a year there zooms the commit calendar to that year, and the months and days maps use the commit sample exactly as collected, with its caveat beside it; the events list ranks records by that evidence and then by result, so you can see that heat is not impact.

              Honesty: the sample is capped at 200 commits per repository and skewed to recent work, saturated cells are marked, and employer work is shown as absent from the sample rather than imputed.

              Type: Atkinson Hyperlegible Next and Mono, drawn for legibility, because heat maps are read at a glance and axis labels must survive small sizes.

              Colour: one sequential ramp from pale peach to oxblood, the skin's own hue family; every cell also carries its number, so colour is never the only channel.

              Motion: the portrait collects left to right because time does, and starts part-way so the first frame is already a heat map; every chart below is complete at rest, and only a month you select fills in, day by day.

              Accessibility: the "Pause animation" button stops everything and then reads "Resume animation"; reduced motion shows each map complete; cells are buttons with written labels, months can be stepped with buttons or a menu, and nothing about you is stored.

              Complete profile

              Senior backend & platform engineer · Porto, Portugal

              I build platforms that hold up in production: moving fleets to the cloud, turning batch into event streams, and, on my own time, execution platforms and safety tooling for coding agents.

              Open to senior backend or platform roles, remote or hybrid

              Nine years in production (since 2017)

              Decision records

              2023–2025 · At work · Platform · Delivered

              200+ instances to cloud local zones, with autoscaling

              Compute cost fell by ~70% across 200+ instances.

              ~70% lower compute cost — 200+ instances moved from on-prem and edge sites to cloud local zones, with autoscaling

              200+ instances migrated — with autoscaling, for live sporting-event peaks

              Context and decision

              Context. A real-time platform for live sporting events ran its workloads on on-prem and edge environments.

              Decision. Lead the infrastructure modernization: migrate the workloads to cloud local zones and enable autoscaling, with multi-region load tests before peak events.

              Stack. Cloud local zones · Autoscaling · Go · Python · Locust

              2022–2023 · At work · Payments · Delivered

              Payment settlement, from batch to event-driven

              Processing success rose from 60% to 90%+.

              60% → 90%+ processing success — payment settlement moved from batch to event streams with change data capture

              Context and decision

              Context. A legacy payment and settlement platform ran as batch processing on a monolith.

              Decision. Move the core components to Java and Go, replace batch with streaming and change data capture, containerize on Kubernetes, and centralize logs and dashboards for the SLAs.

              Stack. Java · Go · Streaming · CDC · Kubernetes

              2026 · Own time · Platform · Working system

              Horus: remote execution for builds and agent jobs

              A changed worktree is a new job, never a silent retry; a worktree without a data class never leaves the machine.

              Context and decision

              Context. Builds and coding-agent jobs start on a workstation but need the CPU, isolation and uptime of a remote fleet, without leaking a private worktree or losing work halfway.

              Decision. A local daemon with a socket API and a written durability contract; content-hash sync so a job runs on exactly the bytes submitted; recovery bound to that content; a versioned accounting ledger; gVisor sandboxes on VPS runners behind a data-class gate.

              Stack. Go · Rust · gVisor

              2026 · Own time · Virtualization · Spike

              Firecracker microVMs as a sandbox compute driver

              A failure-injection suite on a KVM host (kill mid-create, simulated reboot, duplicate RPCs, kill points 0–50 ms, a leak counter) and 23 security probes on a 22-item adversarial matrix. An unimplemented check reports SKIP, never PASS. Proposed upstream as OpenShell#4351.

              Context and decision

              Context. Can Firecracker microVMs, with the jailer, back an open-source agent sandbox runtime (OpenShell) through the whole lifecycle, and stay correct when things crash?

              Decision. A compute driver with its own guest kernel, images from a verified catalog, reclamation of the previous run's VMs at start-up, and a guest flush before Stop.

              Stack. Go · Firecracker · KVM

              2026 · Own time · Platform design · Accepted

              Retire my own agent platform; keep the native clients

              Far less to operate; contribution rules now refuse new routers, schedulers and dashboards.

              Context and decision

              Context. My agent-workflow repository had grown a router, a scheduler, a coordinator hierarchy, a provider dispatcher and a dashboard in front of three coding-agent clients.

              Decision. Retire it (19 October 2026). Each client runs natively; the repository keeps shared skills, a small configuration, standalone safety tools and 26 dated decision records.

              Stack. Python · Bash

              2026 · Own time · Platform safety · Accepted

              Safety tools fail closed

              Documented as a tripwire, not a sandbox, so nobody mistakes it for isolation.

              Context and decision

              Context. Coding agents run shell commands in real repositories from three clients with three hook systems; secrets once reached a model through process arguments.

              Decision. One command-safety hook for all three clients; output redaction; long-lived credentials kept out of worker reach; a missing safety dependency refuses instead of being caught and allowed.

              Stack. Python

              2026 · Own time · Distributed systems · Lab

              Course labs on microVMs, behind an mTLS control plane

              A lab's user id stays reserved until its cleanup has succeeded; CA rotation cannot be bypassed by session resumption.

              Context and decision

              Context. A course platform gives every learner a disposable lab machine, created and destroyed constantly by many people at once.

              Decision. A microVM lab runtime with a chaos test that kills VMs mid-session; idempotent resets by key; mutual TLS on a control-plane CA with reload without restart; pinned keyless signing that fails closed.

              Stack. Go · Kotlin · protobuf

              2026 · Own time · Storage & consensus · Study

              A relational database, from storage to Raft

              Built layer by layer as a study; each phase is a commit history.

              Context and decision

              Context. The fastest way to understand a distributed database is to build its layers in order and see where each guarantee comes from.

              Decision. Disk manager, buffer pool, B+ tree, heap file and write-ahead log; SQL parser, planner and Volcano executor; 2PL then MVCC; Raft, Multi-Raft with range sharding, Percolator-style transactions, SSI with hybrid logical clocks, an S3 backend and the PostgreSQL wire protocol.

              Stack. Rust

              2026 · Own time · Sync & security · Working system

              Offline-first sync with signed form-fill

              The extension never fills a form the owner did not approve.

              Context and decision

              Context. A personal job-search tool runs on several desktops plus a browser extension; data must sync without a central source of truth.

              Decision. Tombstones pruned only once every active desktop has applied them; fill tokens signed on the desktop with a P-256 key from the OS keyring; an encrypted vault export; an LLM judge measured against blind readings.

              Stack. Go · Rust

              2025–2026 · Own time · Developer tooling · Shipped v2.1.1

              gitshift: many Git identities, one machine

              Switching on a directory change went from about 3.8 s to about 0.5 s.

              3.8 s → 0.5 s directory switch — gitshift identity switch on directory change, release v2.1.x

              Context and decision

              Context. Several GitHub and GitLab accounts on one machine means juggling keys, identities and signing by hand.

              Decision. One command switches Git author, SSH key, commit signing and the GitHub CLI account, by alias or automatically by directory; releases through GoReleaser and a Homebrew tap.

              Stack. Go · GoReleaser · Homebrew

              Project source

              Experience

              1. Software engineer, core call control

                2025–2026 · Cloud contact-centre platform

                Load tests to inform cost optimization and Kubernetes autoscaling; graceful shutdown and connection draining in a shared Helm chart; CI repaired with quality gates; codebase rules for agentic coding, shared with the team.

              2. Software engineer, platform / backend

                2023–2025 · Real-time platform for live sporting events

                Led the move of on-prem and edge workloads to cloud local zones with autoscaling (AC-001); real-time, event-driven services on serverless and containers; Go and Python automation; Locust multi-region load tests for peak events; CI/CD across GoCD, GitHub Actions, Jenkins, Buildkite, Ansible and Packer; metrics, logs, traces and alerts.

              3. Software engineer, payments / settlement

                2022–2023 · Payment and settlement platform (consulting)

                Led the modernization of a legacy payment and settlement platform to event-driven streaming and CDC (AC-002).

              4. Software engineer, post-purchase

                2021–2022 · E-commerce marketplace, several countries

                Backend services in Go, Java, Node.js and Groovy for post-purchase and payment workflows; faster claim and dispute resolution.

              5. Software engineer

                2019–2021 · Core banking, Brazil

                Monoliths and mainframe-based systems modernized into Java and Spring microservices; migration of microservices to the public cloud under regulatory SLAs.

              6. Associate software engineer, CRM & integrations

                2018–2019 · Fintech CRM

                Real-time CRM features integrated with banking services such as loans, OTP and account management.

              7. Associate software engineer

                2017–2018 · Software house

                CRM and warehouse management systems in PHP and JavaScript.

              How I work

              Also built

              Drover

              Watch and approve agent sessions from any device: a Rust core over UniFFI, pairing scopes bound to the consumed token.

              Rust

              JVM performance labs

              Eleven on-heap versus off-heap lock-free scenarios with JMH, and 13 serialization frameworks behind one endpoint. Numbers not quoted until re-run with raw output.

              Java · JMH

              graphql-federation

              Federation 2 across Java, Go and TypeScript subgraphs, gRPC between services, SLO burn-rate dashboards.

              Java · Go · TypeScript · gRPC

              Ponte

              A management system for tutoring schools: live lessons with recording and consent, TOTP and lockout, a finance ledger ported to Go and checked by replaying a shared corpus.

              TypeScript · Go · PostgreSQL

              deep-engineering-knowledge-base

              An LLM pipeline that writes and checks engineering lessons, with an independent critic that excludes the author.

              Python

              techish-visual

              An engine for animated technical diagrams: a ThorVG WASM renderer and performance budgets in CI.

              TypeScript

              keyframe

              A Linux studio for recording and editing technical videos, with cuts snapped to silence.

              Rust

              java-workflows

              Reusable GitHub Actions for Java teams: a Java 11 to 25 matrix, security scanning and SBOMs.

              GitHub Actions

              Upstream

              OpenShell#4351

              Firecracker compute driver proposal, from AC-004 (open source). · open

              OpenShell#4591

              A gateway reporting "database is locked" under two concurrent clients. · open

              Orca, 10 pull requests

              SSH OAuth forwarding, pairing-offer rotation without restart, security events, isolation from external agent config. · 9 open, 1 closed

              Stack

              Languages
              Go · Java · Python · TypeScript · Node.js · Rust · Kotlin
              Cloud & runtime
              Kubernetes · GKE · GCP · AWS · Helm · Serverless · Firecracker · KVM · gVisor
              Data & messaging
              Kafka · RabbitMQ · Streaming & CDC · PostgreSQL · MongoDB Atlas · Raft · MVCC
              Delivery
              GitHub Actions · GitLab CI · GoCD · Jenkins · Buildkite · Ansible · Packer · Terraform · Locust
              Observability
              OpenTelemetry · Grafana · Loki · Tempo · Mimir · Datadog · Dynatrace · ELK
              Earlier
              Spring · gRPC · Istio · Akka / Pekko · GraalVM · PHP

              Community

              Tech.ish Thoughts, a collaborative tech blog and GitHub organization (actors, JVM serialization and off-heap work, reusable CI, gitshift).

              The Actor Model, at a DevOps community meetup in Porto.

              Mentors Brazilians entering software engineering through an NGO.

              Background

              Associate's degree, Systems Analysis and Development (2016–2018).

              Portuguese (native), English (full professional, C2), Spanish (limited working).