How this portfolio builds itself

Most of the interesting engineering I do lives in private client repos: real channel data, real names, real numbers. None of that can ever be public, and it shouldn't be. But "trust me, I built something good" is a worse portfolio than actually showing the work. The resolution isn't picking one side. It's a repeatable process that takes a private, client-specific tool and produces a public, client-free one that is still honestly the same engineering, run every day by an agent instead of by hand.

Every port follows the same four steps, in order, and no file skips the queue: scope every file in the source as code that generalizes, documentation that needs rewriting, demo data that needs inventing from scratch, or output that never leaves the private side at all. Convert what's left: rename anything identifying, rewrite every doc top to bottom rather than find-and-replacing a name, and write a README that tells a stranger in under a minute what the tool does and what it honestly doesn't do yet. Gate it. Then, only if the gate passes, it ships.

The gate is three separate passes, and all three have to come back clean before anything public happens. One pass is purely mechanical: grep every banned term, check for secrets, check file sizes, confirm tests pass. It is fast and it is exhaustive, but it can only catch what it was already told to look for. A second pass assumes the first one missed something, on purpose. Its only job is to ask: could a motivated reader work out who the client is, or recognize a real person, from this repo alone? That's a different kind of check than a keyword search, since it catches a shape, a combination of ordinary-looking facts, or a demo value that just happens to echo something real, not a banned word. A third pass ignores sanitization completely and asks the question a hiring manager actually cares about: is this real, finished work, explained plainly, worth the reader's five minutes?

Any one of the three can block the push by itself. More than once, the adversarial pass has caught something the mechanical one is structurally unable to see, not a banned word, but a pattern specific enough to narrow down who the work was really for, and sent it back for a rewrite before a single public commit happened.

The second and third passes only mean something if they don't already know what the first one concluded. So each one runs as a separate, fresh pass with nothing but the candidate content and its own brief: no shared notes, no "here's what already got flagged." A check that already knows the answer it's supposed to be checking for isn't a check.

The agent that runs this daily has one hard rule above all the others: never guess through a sanitization doubt. If a gate fails twice on the same thing, or a question has no safe default answer, it writes exactly what it needs down in a private, running log and moves on to something it can actually finish that day. A person reads that log and decides. Guessing wrong here isn't a bug to fix later, it's the one mistake this whole process exists to prevent.

Running daily since late July, this process has shipped and now maintains 14 public repos (plus the profile page tying them together), each one a client-free rebuild of something that started as real, paid engineering work. The private originals, and the log of every decision made while converting them, stay private forever. What's public is never the client's work with the names swapped out, it's the same engineering problem, solved again from scratch, for anyone to read.