Things I have built: command-line and platform tools shipped in the open, the same class of work as my day job in platform and security engineering. Not everything is here. My largest professional work is internal, and some of my own projects are not public.
Every link below goes straight to the source. Read it, clone it, run it, and judge the work before you talk to me. All of it lives at github.com/dcadolph, along with the smaller things that did not earn a section here.
Platform and systems
The work closest to what I take on for clients.
cipher
Programmatic SOPS for Go. One library and one CLI to encrypt, decrypt, rotate,
walk, edit, and audit secret files, drop-in next to your existing sops files.
Backends for age, AWS KMS, GCP KMS, Vault Transit, Azure Key Vault, and PGP. Edit
encrypted files in $EDITOR and they re-encrypt on save, rotate keys on demand or
by age, add or drop recipients without re-encrypting the payload, and walk a whole
tree in parallel. It also gives you a git pre-commit hook that blocks plaintext,
net/http middleware, and OpenTelemetry traces. Every release is exercised end to
end against real Vault Transit, AWS KMS through LocalStack, and a fresh PGP
keyring.
Source · Go
fleetsweeper
Multi-cluster Kubernetes drift detection. The cluster that drifted is the one that pages you at 3am. Fleetsweeper finds it first. It makes the fleet its own baseline, using a modified z-score across your clusters, so there are no rules or thresholds to tune. One scan returns a 0-to-100 Fleet Score, the cluster least like the rest with the exact fields that flagged it, and ranked fixes that rate a change touching ten clusters above the same change on one. It ships an optional admission webhook that denies pods deviating from the fleet’s actual norm, and folds AlertManager, Falco, Trivy, and Kyverno/Gatekeeper reports into one signal stream.
Source · Go
jwtmint
JWTs for Go, batteries included. A JWT library wrapping golang-jwt/jwt/v5
with a daemon, a Kubernetes controller, an admission webhook, and HTTP/gRPC
middleware. It adds context propagation, configurable clock skew, multi-key
rotation, JWKS publishing, revocation, and an opt-in OIDC discovery endpoint. Sign
and verify benchmarks sit beside the code, across every supported algorithm.
Source · Go
Other work
Built because I wanted them. Different problems, same standard.
slop-chop
Strip the AI tells out of text. Paste in writing and get back something that reads like a person wrote it. A fast, deterministic rules pass swaps the giveaway characters, cuts the stock phrases, fixes spelling to one dialect, and tidies punctuation, all markdown-aware so fenced code blocks pass through untouched. An optional model pass handles the rewrites rules can’t, like reworking a sentence toward a voice you picked. Bring your own list of things to cut.
Source · Go
kibble
Dogfood your docs. Kibble runs a repository’s documented install steps and examples in a clean container, as a reader with nothing installed would, so a broken install fails in CI instead of in a user’s terminal. It reads the whole doc set, not just the README, checks drift in both directions between the docs and the binary, and knows whose fault a failure is: a hardened container, a status taxonomy that separates a broken document from a limit of the sandbox, and a pinned corpus of real repositories that fails the build if its judgment ever drifts. Verifies Go, Rust, Node, and Python installs today. Ships as a CLI, a GitHub Action, and an MCP server.
Source · Go
preen
A messy working tree into clean commits. Point it at a pile of uncommitted changes and it splits them into ordered, atomic commits instead of one dump labeled “wip”. It can also absorb a run of unpushed commits and redo them properly. It hashes your content before and after and rolls back if a single byte differs, so it provably cannot lose your work. A single Go binary, with a Claude Code plugin if you want it inside the assistant you already use.
Source · Go
vamoose
Calendar workflows, minus the tedium. Route time off through an approval chain and fan it out to the team without touching a scheduling tool by hand. One workflow engine drives four calendar backends, Microsoft Graph, Google, Apple iCloud, and any CalDAV host, so you switch providers and change nothing. The approval rides the calendar invite itself, so there is no second tool to check. It cuts both ways: the same yes that clears your time off can fire the manager’s own follow-on steps, posting an alert, logging a note, or handing off coverage, since guards, delays, branching, and notifications are plain JSON you can read and share. Drive it from the CLI, Claude over MCP, or Slack with Approve and Decline buttons.
Source · Go
midden
A journal that lives in your terminal. A personal journal kept as plain markdown: append timestamped entries from the terminal or through a Claude Code skill, then search across years with grep, semantic recall, or a plain-language question. Your history stays in files you own.
Source · Go
cinatlas
Quick movie facts from the command line. Point it at a movie or a person and get the one answer you wanted, without opening IMDB or asking a voice assistant. It reads as “cinema atlas”: filming locations resolve to real places you can map.
Source · Go
battlesight
An interactive visual encyclopedia of human conflict, from 3000 BC to today. Pre-release and iterating fast, with breaking changes landing on every commit.