The portfolio

One primitive at a time.

Everything we ship answers the same question: which load-bearing component of software engineering is still improvised — and what does rock solid look like?

Product · in production P-001 v0.1.27

zegit

The verification primitive. A governance gateway in front of the Git host you already use: in production on GitHub and Gitea, with a hook installer for GitLab self-managed. The zg CLI validates locally and signs an attestation of validation; the gateway verifies it on push instead of re-running CI. Every release is a tag request approved by a passkey quorum, finalized into an evidence bundle you can verify offline, with a draft mapping to Annex I of the Cyber Resilience Act, pending expert review. Meerkat knows, zegit proves, watchsong discloses.

Visit zegit.dev →zegit.io · the control plane
$ zg validate
✓ AoV signed 9f3c1a2
$ git push
remote: DECISION: ALLOW
zegit governs its own repository
Product · read path live P-002 v0.0.16

watchsong

The disclosure primitive. Your CVE records become CSAF 2.0 advisories, checked against the CNA rules and the standard, then published from a distribution point that tools and customers can read: advisory pages, the CSAF provider tree and security.txt. API first, with the web UI on top. Self-host the container image; a subscription for CVE assignment under our CNA and API access to our database follows once our CNA scope is granted. The Cyber Resilience Act's reporting clocks run from the moment you become aware of an actively exploited vulnerability, and watchsong computes them.

Visit watchsong.io →Ask about a subscription →
$ watchsong cve validate
✓ CNA rules · CVE 5.2
$ watchsong csaf
✓ CSAF 2.0 · watchsong.io
watchsong publishes our own advisories
PracticeC-001

Consulting

Platform engineering and governance advisory: GitOps and SRE-based infrastructure, change and incident processes, supply-chain security under the Cyber Resilience Act, and agentic development with the evidence to show for it. We help organizations find their improvised load-bearing components — and replace them with solid ones.

Start a conversation →
In reviewB-001

Modern Platform Engineering

Three books — Principles, Practices, Patterns — on platform engineering as the missing production leg of software: owning the repeatable substrate so the teams above it can keep discovering. Complete first drafts, in review; reviewer editions are built per tagged release.

Ask for a reviewer draft →
§ next primitive · undisclosed