Engineering writeups on Pedro Balbino

SLSA L2 + Sigstore keyless: a solo-dev supply-chain canon for OSS plugin repos

Wed, 13 May 2026 10:00:00 -0300

A 9-line GitHub Actions canon — actions/attest-build-provenance + cosign keyless OIDC + dual-format syft SBOM — applied verbatim across six Claude Code plugin repos. SLSA L2 attestations and gh attestation verify smoke tests, no per-plugin overhead, zero rotated secrets.

Compliance-grade RAG for tier-1 LATAM banking

Sat, 25 Apr 2026 00:00:00 -0300

Building an LLM agent for tax-compliance document review under LGPD, internal audit gates, and controlled deployment windows. Pattern: retrieval pipeline + citation extractor + auditable decision log + human-review gate. Stack: Python + Azure OpenAI + Postgres + Terraform.

Privacy

Sat, 25 Apr 2026 00:00:00 +0000

This blog runs as a static site behind Cloudflare and self-hosted infrastructure (dokku on ProxMox). The architecture intentionally minimises personal-data collection. This page documents what is collected, by whom, why, and how long.

What this site stores in your browser

Nothing. No first-party cookies, no localStorage, no sessionStorage, no IndexedDB writes, no fingerprinting attempts. You can verify with your browser’s dev-tools → Application panel.

The only state your browser keeps is the standard HTTP cache (managed by Cache-Control headers — immutable for fingerprinted assets, short-TTL for HTML).

About

Thu, 23 Apr 2026 00:00:00 -0300

Senior SWE — AI-native automation. Ships Claude Code plugins, Chrome/macOS workflow tooling, and WhatsApp/LinkedIn copilots for high-leverage operators.

Recent work: AI agents for compliance-heavy domains (Python/Go backend, Azure OpenAI, multi-cloud Terraform). Maintains a 4-host NixOS fleet with SLSA L2 supply-chain hardening.

Public artifacts

Project	Stack	Purpose
wa	Go, whatsmeow, SQLite, JSON-RPC	WhatsApp daemon with append-only safety + crash resilience
claude-mac-chrome	Bash, AppleScript, TS	Multi-profile Chrome automation for Claude Code on macOS
linkedin-chrome-copilot	TypeScript, Anthropic SDK	Chrome automation for LinkedIn workflows — per-locale forms + isTrusted bypass
kokoro-speakd	Python, ONNX	Persistent Kokoro TTS daemon — model loaded once, serves many
claude-classroom-submit	Python, Google Classroom API	Autonomous Classroom submission — bypasses Drive Picker iframe
fand	Rust, launchd/systemd	Apple Silicon thermal daemon — temperature curves, SIGHUP reload

Stack experience

Backend: Go, TypeScript/Node, Python (FastAPI, Playwright), Rust (learning)
AI/Agents: Claude API, Azure OpenAI, AWS Bedrock, RAG patterns, LangChain, vector stores
Cloud: AWS (ECS, Lambda, Bedrock), Azure (App Service, AKS, OpenAI), GCP (Cloud Run, Cloud SQL)
Infra-as-Code: Terraform (multi-cloud module library), Helm, NixOS (4-host declarative fleet)
DevSecOps: GitHub Actions matrix CI, Sigstore + SLSA L2 attestations, CodeQL, OSV, gitleaks

Contact

GitHub: phsb5321 and yolo-labz
LinkedIn: balbinopedro
Email: pedrobalbino@proton.me