Portfolio case study

I build the systems that make unclear requirements impossible.

NoPM is a live, hosted proof-piece for that thesis. It is a lite, API-first project management tool where governance — immutable audit, scoped tokens, four-eyes approval — is engineered into the data and API layer, not bolted onto the UI. Shipped solo in eight waves using an AI multi-agent workflow.

The thesis

Governance belongs in the data layer.

Most PM tools treat audit trails and change control as UI features — export logs, activity feeds, manual history. They can be bypassed by anyone with a database connection or a sufficiently permissive service key.

NoPM inverts that. Every mutation flows through the route() API wrapper and calls writeAudit() exactly once — fail-closed. Postgres triggers enforce append-only semantics. A service key cannot rewrite history. The UI is just a consumer of the same governed API your agent calls.

“The same surface a human uses — 61 documented endpoints, OpenAPI, an llms.txtindex, and scoped Bearer tokens — is the surface an AI agent uses. No special mode, no privileged bypass.”

The wedge

Three properties most PM tools can't claim simultaneously.

AI-native / agent-operable

Every action is a stable REST endpoint. Scoped resource:action Bearer tokens, an OpenAPI spec, an llms.txt discovery index, and a nopm CLI let any agent drive the tool over plain HTTP — identical to the web console.

Institutional governance

Every mutation writes exactly one append-only audit row. Destructive deletes need four-eyes: a maker requests, a different checker approves (enforced by Postgres CHECKconstraints). Even a service key can't rewrite history.

The whole triangle

Timeline, resource, and budget in one governed model — the gap most lite PM tools miss. Over-allocation surfaces as a clash; spend rolls up to EVM variance; a locked timeline forces a rebaseline sign-off.

What was built

8 modules + governed infrastructure — shipped solo in 8 waves.

governance is invisible to the operator — provable in audit

$ nopm tasks rm task_8f3a --reason "superseded by revised cutover plan"
⏸  delete requested — pending a checker's approval (four-eyes)

$ nopm approve req_2c91          # a different token: task:delete:approve
✓  approved & committed           # one immutable audit row written

$ nopm audit --limit 1
created_at            actor_label     action        target
2026-06-08T…          checker (agent) task.delete   task_8f3a

Workspace → Project → Milestone → Task (typed statuses, maker-checker delete)
Risk & Issue registers with severity/likelihood scoring
Clash engine — schedule, resource, and dependency conflicts (cross-project)
Resource, allocation, timesheets, cost-rate, and capacity
Budget: planned / committed / actual / EVM (CPI, SPI, EAC, VAC)

Governed Kanban (drag = audited mutation) + read-mostly Gantt with rebaseline gate
Trust Center — immutable audit stream, provenance, PAT management
BYOK governed assistant (user's own API key, AES-256-GCM at rest, ephemeral scoped token — NoPM ships no model key)
Documents & charter management with versioning and status workflow
Change-control pipeline, notifications, deck export (PDF / PPTX / HTML)

Proof metrics

Numbers that show the governance isn't hand-waving.

52traced requirements (R-IDs) in RTM

268governance-focused tests (vitest)

61documented REST endpoints + OpenAPI

1immutable audit row per mutation — no exceptions

0bundled LLM — governance ships without any model key

Every requirement has an R-ID, a status, and a traceability row. RTM verification runs in CI. Tests target the governance rules first: can a maker self-approve? Does a missing scope return 403? Does a delete without a four-eyes approval fail?

Stack & method

Production stack, shipped with AI multi-agent assist.

Technology

Next.js 16 App Router + TypeScript + Tailwind v4
Supabase — Postgres + RLS + Auth + Storage
Vercel deploy + Cloudflare DNS → stillnotbald.com
jsPDF / pptxgenjs — governed deck exports
vitest — 268 tests, governance-first coverage

Discipline

Requirement traceability matrix (RTM) — R-ID per feature, verified in CI
Sprint log per wave — plan, decisions, and a signed-off summary
Architecture decision records (ADRs) for irreversible choices
AI multi-agent workflow — sub-agents per domain, orchestrated by a wave planner
Solo build — no team, no PM, no sprint ceremonies

See the governance live.

Every endpoint is documented. Every mutation is audited. The console is open.