Public technical projects | Murillo Consulting

Platforms & Cloud Security HCL

Kube Aegis Forge

A reproducible Kubernetes GitOps platform secured end to end.

CI Apache-2.0

Pull request CI & supply chain Argo CD Kubernetes

KubernetesOpenTofuArgo CDKyvernoCosignSBOM

Engineering intent

Shows how delivery, admission policy, signed artifacts, observability and rollback connect in one operable chain.

What the project explores

CI, CodeQL, OpenTofu tests, IaC scans, hardened images, SBOMs, Cosign signatures, provenance and local kind-cluster verification.

Declared boundary

The AWS extension is validated offline; no real AWS deployment is claimed.

Platforms & Cloud Security HCL

BastShield

A sovereign Kubernetes foundation for cloud, local virtualization and disconnected environments.

CI Apache-2.0

OpenTofu Talos Linux OpenBao & Flux Cloud / air gap

Talos LinuxOpenTofuFluxOpenBaoCiliumAir gap

Engineering intent

Makes the boundary between infrastructure bootstrap, secret management and long-term GitOps reconciliation explicit.

What the project explores

OpenTofu modules, immutable Talos nodes, OpenBao, Flux, policies, backups, architecture documentation and operating procedures.

Declared boundary

The Scaleway path remains experimental and requires operator review before deployment.

Platforms & Cloud Security TypeScript

Fortplane

A secure Kubernetes baseline for connected, limited-egress and air-gapped environments.

CI AGPL-3.0

Zarf & bundles Identity & networking Pepr policies Observability & recovery

KubernetesZarfPeprIstioKeycloakAir gap

Engineering intent

Shows how identity, admission policy, service networking, observability, backup and runtime security compose into replayable packages.

What the project explores

Zarf packages, Pepr controls, Keycloak, Istio, observability, backup, runtime detection and versioned unit tests.

Declared boundary

Cluster validation and offline assembly require Zarf and a dedicated Kubernetes environment.

Platforms & Cloud Security HCL

Labz

A disposable AWS cyber range for training, attack simulation and detection.

CI Apache-2.0

Make & OpenTofu Isolated VPC Attack & targets Detection

AWSOpenTofuTerraformInSpecVagrantSecurity lab

Engineering intent

Demonstrates how to structure offensive and defensive labs with isolation, safeguards and controlled teardown.

What the project explores

Segmented networks, Terraform scenarios, InSpec controls, mocked AWS-provider tests and secret checks.

Declared boundary

AMIs depend on account and region; real deployment can be billable and intentionally vulnerable.

Secure & auditable systems Rust

Gate

A local LLM gateway with DLP, multi-provider routing, budgets and signed audit records.

CI Apache-2.0

AI client DLP & policies Routing & budgets Providers & audit

RustAxumDLPLLM routingOpenTelemetryHelm

Engineering intent

Centralizes data protection, cost control and provider failover without changing compatible clients.

What the project explores

Canonical Anthropic and OpenAI pipeline, DLP, policies, fallback circuits, budgets, metrics, traces and signed audit journals.

Declared boundary

Live keys remain runtime-injected; deployment examples require production hardening.

Secure & auditable systems TypeScript

ControlLoom

A Git-native workspace connecting security controls, implementation evidence and reviews.

CI Apache-2.0

Control catalogue Versioned YAML Evidence mappings Pull-request review

SvelteKitTypeScriptYAMLGitControlsEvidence

Engineering intent

Turns catalogues, narratives and evidence mappings into readable files whose history and review trail live in Git.

What the project explores

Catalogue imports, YAML controls, source mappings, pull-request impact analysis and a local SvelteKit interface.

Declared boundary

Sensitive evidence and private audit reports must not be stored in a public workspace.

Secure & auditable systems Python

LangGraph Resilient Agent

A durable agent with human approval, idempotent effects and redacted audit data.

CI MIT

Typed API Policy Approval Effect & audit

LangGraphFastAPISQLiteIdempotencyHuman approval

Engineering intent

Treats approval, interrupted-run recovery and side-effect uniqueness as testable application invariants.

What the project explores

LangGraph checkpoints, idempotency keys, uniqueness constraints, tenant isolation and audit events without sensitive payloads.

Declared boundary

Header identity and SQLite are local adapters that must be replaced for production.

Secure & auditable systems Java

Spring AI Secure RAG

Tenant-isolated RAG with verified citations and deterministic abstention.

CI MIT

Identity ACL filter VectorStore Cited answer

Spring AIJava 21VectorStoreACLCitationsMicrometer

Engineering intent

Shows that authorization must filter retrieval before any content can enter model context.

What the project explores

Immutable server filter, idempotent ingestion, score threshold, server-built citations and a negative cross-tenant test.

Declared boundary

The in-memory index and header identity are explicitly limited to the local demonstration.

Secure & auditable systems Rust

Impôts France MCP

A French tax MCP with a Rust/Wasm engine and versioned official rules.

CI MIT

MCP client OAuth Worker Rust / Wasm engine

MCPRustWebAssemblyTypeScriptCloudflare WorkersOAuth

Engineering intent

Demonstrates an approach where results, data versions, sources and assumptions remain auditable behind a protected MCP interface.

What the project explores

62 sourced tools, deterministic calculations, a dated registry, Cloudflare OAuth and reference functional tests.

Declared boundary

No shared endpoint is guaranteed and outputs remain simulations, not tax advice.

Engineering tooling Shell

cli-skills

Portable skills for auditing, documenting and designing with coding agents.

CI MIT

Request Versioned skill Audit / forge Reviewable artifact

CodexClaude CodeAgent skillsShellPythonDocumentation

Engineering intent

Makes engineering methods inspectable, versioned and portable across several command-line assistants.

What the project explores

A structured catalogue, shared conventions, installation scripts and CI validation of published skills.

Declared boundary

Skills assist the work; they do not replace human review or target-project tests.

Technical projects, available when useful.

10 projects, one engineering thread.

Kube Aegis Forge

BastShield

Fortplane

Labz

Gate

ControlLoom

LangGraph Resilient Agent

Spring AI Secure RAG

Impôts France MCP

cli-skills