Adam Reed

Our OpenAPI model contracts double as message contracts. One schema describes both the HTTP surface and what rides NATS. Client code in other languages generates from that same source.

In-house Roslyn analyzers fail the build on contract drift. A service that stops matching its contract does not compile.

An exporter derives OpenAPI 3.1 JSON Schema from the source-generated serializer types. That schema feeds a pipeline that generates a TypeScript SDK covering both HTTP and messaging.

CI runs a schema drift gate, and banned-API analyzers block competing OpenAPI stacks so nobody routes around the contract.

I wanted gRPC’s compile-time agreement without moving the platform onto gRPC. Services in C# and TypeScript now agree at build time, so drift never reaches production.

Cerebro is the identity and authorization plane for the whole platform. It mints RS256 JWTs for people and Ed25519-signed NATS credentials for services and devices, through a broker auth-callout.

Per-user subject grants live in the database and take effect immediately, no broker reload. Deny overrides allow. Device-fleet credentials expire in 30 minutes. XKey encrypts the callout payloads.

The SOC 2 controls are enforced in code. An EF Core audit interceptor redacts sensitive fields before they reach a log, so a log line cannot leak what it never sees.

Four client SDKs ship with it: .NET, Blazor WASM, TypeScript, and a shared abstractions library. Wiring auth into a new .NET service is three lines. The browser SDKs refresh themselves before expiry.

RapidContact is Spire's e-signature and outreach platform, and it started life at VTR. The first build ran signing and correspondence workflows on Azure Durable Functions and Cosmos DB. I rebuilt it as about 14 cooperating queue workers over a staged MySQL queue.

ESIGN/UETA compliance sits in a gate that fails closed. A document that cannot prove compliance does not send.

Documents render at the Cloudflare edge, authenticated back to origin with time-windowed HMAC. Cache keys follow the document, so rotating a link still hits cache.

In FILL mode the service prunes itself to a single webhook-capture endpoint with no database services registered, buffering everything into an Azure Storage Queue. DRAIN replays the backlog through the same code paths live traffic uses, so there is no second implementation to maintain.

Inbound webhooks decouple through a durable JetStream work queue with deterministic message IDs for dedup and a dead-letter queue for messages that refuse to process.

I own the production Asterisk/FreePBX itself. Roughly 200 agents make their living on that box, and 90M+ call records sit behind it.

Outbound caller ID comes from a Lua pool selector calling MySQL over ODBC. GetNextCID picks the number live per call through a 7-tier geographic fallback built on a NANPA and Census dataset I assembled myself. Same inputs, same answer, and the first tier that matches wins.

Corsair resolves inbound DIDs to dialplan destinations. When the database is unreachable it falls back to a default route instead of erroring. A collections floor that cannot take calls is a stopped business, so this path fails open.

A native Android dialer (.NET MAUI, Telecom InCallService) runs on a physical 3-carrier device fleet and measures how carriers label our caller ID. Publish-before-ack JetStream with dedup gives exactly-once results and at-most-once billable calls.

Each capture runs under a hard wall-clock budget. One linked cancellation source caps both the capture wait and the ack heartbeat, so a hung PSTN call cannot wedge the consumer.