UNDER THE HOOD

A portfolio that
practices its principles.

The linked applications show independent delivery. This codebase makes architectural choices inspectable—without exposing an employer’s systems.

Three layers. Real boundaries.

Contracts define models, DTOs, and ports. Business implements policies and use cases. Modules provide the web interface, PostgreSQL adapters, and worker. Presentation references contracts, not storage implementations.

Presentation → application ports
Business → repository ports
Adapters → contract implementations

Publication is a controlled transition.

A public page points to a sealed, approved revision. Foreign keys enforce project ownership. Database triggers reject edits to sealed content. New content requires a new revision, not an unreviewed mutation.

Draft → seal → approve → publish
No draft data on public read paths.

State and events commit together.

Publication and inquiry events are persisted in the same PostgreSQL transaction as their business changes. A separate worker records publication activity and delivers private owner-inbox notifications.

Commit state + outbox → worker
At-least-once delivery. Idempotent effects.

Security without a demo backdoor.

Administrative actions require OIDC and server-side Publisher or Operator roles. Until identity is configured, access remains locked. Forms use anti-forgery validation, bounded input, parameterized queries, and contextual HTML encoding.

Missing identity ≠ administrator.
Missing storage ≠ mock success.

THE STACK IN THIS REPOSITORY

Less infrastructure.
More intention.

Server-rendered HTML works without JavaScript. PostgreSQL provides normalized storage and durable messaging. No additional broker or frontend runtime is needed for this workload.

C# / .NET 10 LTSApplication, business services, and worker
ASP.NET Core / Razor PagesSemantic HTML and progressive form workflows
PostgreSQL / NpgsqlParameterized repositories and transactional delivery
xUnit / real PostgreSQL testsRules, concurrency, constraints, and HTTP boundaries

HONEST OPERATING BOUNDARIES

Designed is not the same as measured.

This is a synthetic, independently authored showcase. There are no invented customer totals, throughput claims, uptime guarantees, or financial outcomes. OIDC provisioning, managed backups, external monitoring, and production domain configuration must be verified in the actual hosting environment.

The event worker’s current side effects are PostgreSQL-local. External email or payment delivery would require a separately persisted intent, provider-side idempotency or reconciliation, and explicit retry semantics.

Request repository access or discuss a decision