The portfolio

One primitive at a time.

Everything we ship answers the same question: which load-bearing component of software engineering is still improvised — and what does rock solid look like?

Product · in production P-001 v0.0.173

zegit

The verification primitive. A governance gateway in front of the Git host you already use — GitHub, GitLab or Gitea. The zg CLI validates locally and signs an attestation of validation; the gateway verifies it on push instead of re-running CI. Every release is a tag request approved by a passkey quorum, finalized into an evidence bundle you can verify offline, mapped to Annex I of the Cyber Resilience Act. Meerkat knows, mongoose works, zegit proves.

Visit zegit.dev →zegit.io · the control plane
$ zg validate
✓ AoV signed 9f3c1a2
$ git push
remote: DECISION: ALLOW
zegit governs its own repository
Product · building P-002

watchsong

The disclosure primitive. Coordinated vulnerability disclosure as a service: CVE assignment for vulnerabilities in your own products, a disclosure timeline that advances as the mitigation work proceeds, and the Cyber Resilience Act's reporting obligations met in a controlled way — every submission signed and publicly attestable. For SMBs with no disclosure infrastructure yet, and for larger organizations that want theirs provable.

Ask about early access →
! report received · embargoed
⏱ early warning · ENISA · 24 h
✓ advisory published · signed
watchsong stands guard over disclosure
PracticeC-001

Consulting

Platform engineering and governance advisory: GitOps and SRE-based infrastructure, change and incident processes, supply-chain security under the Cyber Resilience Act, and agentic development with the evidence to show for it. We help organizations find their improvised load-bearing components — and replace them with solid ones.

Start a conversation →
In reviewB-001

Modern Platform Engineering

Three books — Principles, Practices, Patterns — on platform engineering as the missing production leg of software: owning the repeatable substrate so the teams above it can keep discovering. Complete first drafts, in review; reviewer editions are built per tagged release.

Ask for a reviewer draft →
§ next primitive · undisclosed