Six years of software under 21 CFR Part 11
A thread rather than a single project: role models, audit trails, protected-action logging, and tamper-evident evidence, built into GMP software over six years.
This one is a thread rather than a single project. For six years at Cellares, compliance work showed up every year, and it taught me more about building trustworthy systems than most individual features did.
The arc, briefly, went like this. There was a role and permissions model in 2020, then the 21 CFR Part 11 audit trail UI in 2022, which I later pulled out into a reusable library, then protected-action audit logging in 2024 and 2025, and in 2026 there were append-only audit tables written in the same database transaction as the change they record, with SHA-256 hashing on evidence files so that tampering is detectable rather than theoretical.
The lesson. Audit and permissions work goes a lot better when it's part of the design from the start than when it's bolted on before an inspection. Retrofitting means chasing every write path in the codebase and hoping you found them all, while building it in means there is one path and it's already correct. I wrote up the audit-trail principle on its own here.
Smaller projects from the same years, each worth a line. There was an internal AI tool that drafts work items and test cases grounded in the product wiki and API specs, where I wrote 65 of its 67 commits, the team adopted it, and its product wiki is exposed as an MCP server that other AI tools can use. There was a reporting and audit-log application that I stood up from scratch. And there was the transfer-station operator app, where I set up CI and combined two projects into a single host.