Blake Medulan / builder & writer
A credential broker whose operator can't read the secrets. Compliance evidence that exists before the auditor asks for it. An evaluation that checks whether the French answer is as good as the English one. Each one comes with a way for you to check it yourself.
# vault.melx.buzz: Sepulchre $ bash tools/verify-policy.sh ==> operator-scoped token reading inbound DENIED # osfi.melx.buzz: osfi-gate $ osfi-gate verify ./evidence ==> signed evidence bundle OK # open-articles: every number, reproduced $ make reproduce && make test ==> no credentials, no provider calls PASS █
Each screenshot scrolls through its page. Click one to open the live site.
“Don't trust us. Verify us.”
A credential broker for the secrets that pass between people. The operator who runs it can't read what flows through it: an explicit Vault deny policy blocks access no matter what other permissions exist. A script you can run yourself checks that promise against the live system.
“The audit evidence is written before anyone asks for it.”
For Canadian banks, insurers and credit unions. osfi-gate runs in the build pipeline on every change. It maps scanner findings to controls anchored in OSFI guidance, applies the policy the risk team keeps in Git, and files a signed record of every decision. Anyone can verify those records offline.
“Is the French answer as good as the English one?”
A bilingual quality harness. It runs the same corpus, questions and metrics through an AI content pipeline in English and in Canadian French, then reports the gap between the two. It also tracks Canadian-specific failures: Quebec forms replaced by France equivalents, and valid Canadian French "corrected" into something else.
“A collection of architectures.”
Interactive architecture and concept diagrams across the Score Anything Loyalty platform, independent open-source projects and reference studies. The thread running through them is AI architecture: hosted multi-agent systems, on-box constrained decoding, computer vision, and how to choose between them based on the constraints that bind.
The Score Anything Loyalty platform I build at 3 Halves Labs.
SCORE is an open, modular fan engagement, loyalty and AI platform for sports clubs, music artists, venues and agencies. It brings fan engagement, marketing and operations together so organizations own their fan data, replace point solutions, and open new revenue streams.
Trade athletes like stocks.
The Athlete Loyalty Exchange runs itself and is governed by AI agents. Fans buy and sell athlete coins with loyalty points, and prices move in real time with demand and performance. There are no drafts, salary caps or season-long commitments. It runs on loyalty points only, so it stays a closed, non-cash ecosystem.
A neutral, open standard for describing sports schedules, constraints and optimization goals, for traditional sports, esports and competitive events.
Sports scheduling is fragmented because every vendor describes the problem in its own way. OSSS standardizes the description of the problem and leaves the solution to whoever solves it, so scheduling rules stay portable and schedules can be audited and explained.
Authorization for MCP tool calls. For each call it allows, denies or holds for human approval, using per-argument Cedar policies and an audit trail.
A governed MCP server for ISO 20022 payment operations. AI agents can initiate and validate payments, and every action goes through an audit layer first.
ISO 20022 messaging for Odoo 18: pain.001, pain.008, pacs.008 and camt.053, in SEPA and generic variants.
A regression harness that measures whether a language model keeps Quebec French or normalizes it toward Metropolitan French.
An AI architecture review board on AWS Bedrock Agents. Several agents cover risk, compliance, security and FinOps.
Runnable companion code for eight essays. No credentials needed. Every number in the essays comes from make reproduce.
For thirty years every scam needed one thing: your attention. Then we outsourced it.
He passed the interview, the background check, the video call, and probation. He is also in Pyongyang.
The most expensive word in banking law may be “authorized.” When AI makes fraud this convincing, who pays?
Agents Are Distributed Systems With a Non-Deterministic OrchestratorWe spent twenty years building safeguards for unreliable remote calls, then handed the caller role to a language model.code
Embeddings as InfrastructureFour invariants your index depends on, and why every one of them fails silently.code
Deploying a Prompt Is a Production ChangeThree things that make it unlike deploying code, and what each one costs.code
Testing What Will Not Sit StillYour 200 AI tests each pass 99% of the time. Your suite passes 13% of the time.code
RAG as an ArchitectureThe retrieval layer is the system. The model on the end is a formatting step.code
When Not to Use an LLMA benchmark, and the one property that decides it.code
FinOps for TokensInfrastructure cost used to be a provisioning decision. Now it is a runtime variable.code
Code Review When Half the Diff Was Machine-WrittenWhat maintaining a scheduling standard taught me about a review process that stopped scaling.codeYour Assistant Answers the DoorFor thirty years every scam needed one thing: your attention. Then we outsourced it.
The math doesn’t have an opinion about QuebecWhy language models substitute Metropolitan French for Quebec French, derived from the mechanism.codeThe New HireHe passed the interview, the background check, the video call, and probation. He is also in Pyongyang.
When French isn’t FrenchIf a model is good at French, is it good at your French?AuthorizedWhen AI makes fraud this convincing, the question becomes: who pays?
Three SecondsYour voice used to prove you were you. Used to.
The Answer Was Already in the TableNotes from building a local content-generation pipeline.
Ten Minutes on a LaptopThe safety features came off in the time it takes to boil pasta.05 — Contact
