Adam Reed

I wanted gRPC’s compile-time agreement without moving the platform onto gRPC. Our OpenAPI model contracts double as message contracts. One schema describes both the REST surface and what rides NATS. Client code in other languages generates from that same source.

In-house Roslyn analyzers fail the build on contract drift. A service that stops matching its contract does not compile.

An exporter derives OpenAPI 3.1 JSON Schema from the source-generated serializer types. That schema feeds a pipeline that generates a TypeScript SDK covering both HTTP and messaging.

CI runs a schema drift gate, and banned-API analyzers block competing OpenAPI stacks so nobody routes around the contract.

Services in C# and TypeScript now agree at build time, so drift never reaches production. W3C trace context rides NATS headers end to end, so one trace follows a call through every service and JetStream hop.

Cerebro is the identity and authorization plane for the whole platform. It mints RS256 JWTs for people and Ed25519-signed NATS credentials for services and devices, through a broker auth-callout.

Per-user subject grants live in the database and take effect immediately, no broker reload. Deny overrides allow. Device-fleet credentials expire in 30 minutes. Callout payloads are encrypted with NATS XKey.

The SOC 2 controls are enforced in code. An EF Core audit interceptor redacts sensitive fields before they reach a log line.

Four client SDKs ship with it: .NET, Blazor WASM, TypeScript, and a shared abstractions library. Wiring auth into a new .NET service is three lines. The browser SDKs refresh themselves before expiry.

RapidContact is Spire’s e-signature and outreach platform, and it started life at VTR, my previous company, one era down the page. The first build ran signing and correspondence workflows on Azure Durable Functions and Cosmos DB. I rebuilt it as about 14 cooperating queue workers over a staged MySQL queue.

ESIGN/UETA compliance sits in a gate that fails closed. If a document cannot prove compliance, it does not send.

Documents render at the Cloudflare edge, authenticated back to origin with time-windowed HMAC. Cache keys follow the document, so rotating a link still hits cache.

It has two outage modes. FILL prunes the service to a single webhook-capture endpoint with no database services registered and buffers everything into an Azure Storage Queue. DRAIN replays the backlog through the same code paths live traffic uses, so there is no second implementation to maintain.

Inbound webhooks decouple through a durable JetStream work queue with deterministic message IDs for dedup and a dead-letter queue for messages that repeatedly fail processing.

I own the production Asterisk/FreePBX itself. Roughly 200 agents make their living on that box, and 90M+ call records sit behind it.

Outbound caller ID comes from a Lua pool selector calling MySQL over ODBC. The selector, GetNextCID, picks the number live per call through a 7-tier geographic fallback. I assembled its NANPA and Census dataset myself. The lookup is deterministic. The first tier that matches wins.

Corsair, the inbound-call router, maps each dialed number (DID) to its destination in the dialplan. When the database is unreachable it falls back to a default route. A collections floor that cannot take calls is a stopped business, so this path fails open.

A native Android dialer (.NET MAUI, Telecom InCallService) runs on a physical 3-carrier device fleet and measures how carriers label our caller ID. Publish-before-ack JetStream with dedup gives exactly-once results and at-most-once billable calls.

Each capture runs under a hard wall-clock budget. One linked cancellation source caps both the capture wait and the ack heartbeat, so a hung PSTN call cannot wedge the consumer.