Thomas Loth

Selected Work

Self-directed engineering, built on personal time. The through-line is autonomous multi-agent orchestration – the same architectural problem approached from four angles, with the cost, rate-limit, and reliability discipline that running agents unattended actually demands.

Where something was built but never deployed, it says so below.

  1. Autonomous manuscript pipeline

    auto-graph

    Six agent roles – outliner, chapter planner, writer, editor, reviser, continuity checker – run as Fargate workers behind a single dispatcher. Each chapter goes through up to five revise rounds before it merges, and a separate agent audits continuity across the assembled manuscript. Hardened against the failure modes that only show up in production: 14 per-agent-type FIFO queues consolidated into one dispatcher once volume proved them costlier and worse at back-pressure, phantom in-flight stall recovery, and a Contents-API fallback for GitHub Git-Data races on freshly created repos.

    Three manuscripts completed end to end – 194 chapters, 255,239 words – with no human writing intervention.

    TypeScript · AWS CDK · ECS Fargate · SQS FIFO · DynamoDB · ~28K LOC

  2. Second-generation agent orchestrator

    telos

    A clean-slate rebuild of the same orchestration problem, designed around the lessons of the first one. A single state machine routes a kickoff issue through architecture, planning, development, review, revision, rebase, and merge, with a reconcile loop wrapped around the whole thing. Six worker modes – architect, planner, developer, reviewer, reviser, rebaser – share one Docker image behind a task-type entrypoint router. HMAC-SHA256 webhook validation and SSM-backed GitHub App keys throughout; scoped from the first commit as something that could survive an audit.

    Architecture and integration suite are complete. It has never been run end to end.

    TypeScript · AWS CDK · Step Functions · ECS Fargate · DynamoDB

  3. Self-hosted identity gateway

    SovereignID

    A headless OIDC and SAML engine built for the case where multi-tenant identity providers are off the table – data residency rules, regulated environments, anything that has to stay inside a customer VPC. No bundled UI; configured entirely through environment variables. Deterministic claim-to-role mapping, SCIM 2.0 user and group lifecycle, break-glass tokens, and preconfigured presets for Okta, Azure AD, and Google Workspace.

    Deployed and in use: it now authorizes the private dashboards on this site, mapping Cognito claims to roles and gating each page on the role it requires.

    TypeScript · PostgreSQL · Redis · AWS API Gateway · Vitest with testcontainers

  4. Private bridge to a home machine

    gemini-home-bridge

    Lets Google Gemini run commands on a home PC from anywhere: Cloud Run service, Tailscale tunnel, SSH. The container runs a Tailscale userspace sidecar, so it joins the private network without privileged networking or a persistent inbound hole. Identity-Aware Proxy in front, secrets in Secret Manager, modular Terraform behind it.

    Python · FastAPI · Firebase Genkit · asyncssh · Terraform · GCP Cloud Run

Also built: a storefront over the manuscript pipeline with KMS-signed rights-transfer PDFs, an RSS-to-Bedrock pipeline that drafts social posts behind a human approval gate, and an offline-capable static reader for the generated books.