02 / Technical stack
Layers that
talk to each other.
Tools follow constraints, not fashion. Below is the full surface — from retrieval pipelines and Rust services down to the observability that tells you when any of it drifts.
Frontend
Interfaces that stay fast under real production data.
- React
- Next.js 16+ (App Router)
- TypeScript
- JavaScript (ES2024)
- Tailwind CSS
Backend
Explicit contracts, observability and the right concurrency model.
- Node.js
- Rust (Axum, Actix Web, Tokio)
- Python
- Django
- FastAPI
AI / LLM
RAG you can measure, secure and defend in an audit.
- RAG pipelines (hybrid retrieval, RRF)
- Cross-encoder reranking
- pgvector
- Embeddings (multilingual-e5)
- LLM evals & golden test sets
- Prompt-injection hardening
- Structured output
- Agentic workflows (human-in-the-loop)
- Anthropic SDK
- AWS Bedrock
- OpenAI API
Cloud / Infra
Infrastructure is part of the product, from threat model to rollout.
- AWS EC2
- ECS
- RDS
- S3
- CloudFront
- Lambda
- Cognito
- Bedrock
- Cloudflare
- Terraform
Databases
Data models designed for consistency and easy diagnosis.
- PostgreSQL (pgvector, RLS, FTS)
- Redis (BullMQ, arq)
- SQLite
- Supabase
Messaging / Async
Delivery guarantees that survive an unreliable receiver.
- Webhooks (HMAC signing, retries, DLQ)
- BullMQ
- SSE
- Event-driven architectures
Payments
Billing wired into the product, not bolted on.
- Stripe
- Elavon
- PayPal
Dev Tools
The feedback loop matters as much as the code.
- Git
- Docker Compose
- Sentry
- Highlight.io
- Turborepo
- pnpm
- Grafana
- Datadog
Security by architecture
Non-negotiableAccess control cannot be an afterthought.
Row-Level Security, ACL filtering before content ever reaches a model, HMAC-signed webhooks, append-only audit logs and deliberate handling of model uncertainty form a single security contract — enforced by the database and the protocol, not by the application layer remembering to behave.