Maxwell Collins — Engineer code-rescue.com

Senior engineer. I build AI systems trustworthy enough to run a real business — and the control planes that keep them correct.

Seventeen years across the full stack — backend, frontend, mobile, data. I design the system, encode the rules that make wrong outcomes impossible, and direct AI to build against them — so the output moves fast and can still be trusted in production.

17 yrs building software 40+ systems shipped first code at age 12

Open to senior software, AI, and platform engineering roles — full-time or contract, on a team. · Tampa, FL · ET · remote

§ 01 · how i work

One thesis runs through everything I build.

Whether it’s a small internal tool or a million-line legacy estate, the same discipline applies — it’s how I move fast without breaking things, and the difference between code that works once and code you can trust in production.

— enforced the same way across 40+ systems

  1. R1

    Declare a fact once.

    Every other surface derives from it — schema, rules, UI, audit. No hand-synced copies that drift apart.

  2. R2

    The AI proposes; a deterministic verifier disposes.

    Nothing a model generates reaches a side effect — a write, a deploy, a sent message — without passing a mechanical check it can't talk its way around.

  3. R3

    Make the mistake impossible.

    Bad actions are blocked structurally, before they can happen — fail-closed gates over careful prompts. And the guard proves it fires, or the build fails.

  4. R4

    Append-only, evidence-first.

    A claim without a resolvable citation doesn't ship. Truth resolves to a real artifact, or it doesn't count.

§ 02 · selected work

How to read the tags: repo ↗ is public — click to verify the code yourself. private · by capability is client work, described by what it does, never by whose it is. Designed-but-not-yet-built work is labeled as such; nothing here is inflated.

01Event-booking platform · operated by AI agents private · by capability

A production event-booking platform, built to be run by AI agents

What
A complete event-booking and venue-management platform I built end to end — a real lead-to-deposit sales pipeline, bookings with full lifecycle state, tour scheduling, two-tier deposits, and production payments — 2,600+ tests across 209 suites, live and taking real money. On top of it: a phone agent and a web chatbot, one governed harness, that run the entire inbound funnel against it.
Hard problem
Building a booking platform that takes money is hard enough. Making it safe for an AI to operate end to end — quote a price, check real availability, book the date, take the deposit — without ever inventing a price, double-booking a date, or taking an action no one can audit, is the harder problem.
Approach
The agents can only act through a typed tool API — eight endpoints, every call authenticated with a constant-time key, recorded as an AI_AGENT actor in a before/after audit log, and idempotency-keyed against a 2,479-line written contract. A date can be claimed only once — the booking’s primary key is the event date, so a double-booking can’t compile. Money runs on production Stripe: a branded integer-cent type that refuses floats, signature-verified fail-closed webhooks, exactly-once handling, guarded refunds, dispute alerts. The phone agent (ElevenLabs voice on a real Twilio line) and the web chatbot hit the identical endpoints — provably one harness. A transcript-scored loop grades every call, clusters failures, and proposes prompt fixes behind a human gate.
Result
A real event-booking business that customers run themselves, by phone and on the web, through software that can’t be talked into a wrong price, a double-booking, or an unaudited action — every quote, booking, and deposit on a tamper-evident trail.
02Legacy estate · AI control plane private · by capability

Letting AI safely operate a million-line legacy estate

What
A federated control plane that lets AI agents read and reason over an 8-application, polyglot legacy estate (PHP/Laravel, Swift iOS, Kotlin Android — well over a million lines) without ever being able to break it.
Hard problem
Turning a multi-decade brownfield — the kind that defeats whole teams — into something an AI can work over safely, with a tamper-proof record of everything it touches.
Approach
The estate is exposed through ten MCP servers — eight of them code-graphs (~68k nodes / 120k edges, one per app) — behind a three-layer fail-closed boundary: typed tool denials, ~120 shell-command deny patterns, and SQLite triggers that make the audit log physically append-only. A 1,000-line doctor re-proves the boundary every run — it fires a forbidden UPDATE and DELETE at the audit log each time and passes only if both are blocked. Severity is a pure deterministic function, and a database trigger forbids any agent from attesting its own work — so no model grades itself.
Result
Agents operate a million-line estate safely, every action on an append-only, tamper-evident trail — proven by a self-checking harness with 1,300+ of its own passing tests, not asserted.
03Product SaaS · correctness by construction private · by capability

A property platform where illegal states can’t compile — and the running app proves it

What
A full-stack property platform (Next.js / tRPC / Drizzle / Postgres) — ~978 commits, 576 test suites, ~13,000 tests — built so whole classes of bug are structurally impossible to ship, and continuously re-checked by an LLM-driven QA harness that drives the real app in a browser and verifies every finding against the source.
Hard problem
In property and financial data a wrong value is a real liability; catching it with tests and hope isn’t enough. The goal was to make the bad state un-shippable and the regression un-hideable.
Approach
41 structural (ast-grep) rules run against the whole codebase on every build and fail it on a domain violation — float money, non-time-ordered IDs, naive timestamps, unaudited inserts, hard deletes. Money is integer cents end to end; property identity is a RESO-standard canonical URN; ownership disputes resolve through a state machine under REPEATABLE READ with row locks; corrections append to an immutable parcel-event ledger. An 18-step gate plus a documented QA harness — Playwright-driven, source-verified, with crash-safe finding capture — runs the real app and checks behavior, not just types.
Result
The bug is removed by construction, not caught by luck — domain law enforced like a compiler, and the live app re-checked in a real browser on every change. A companion 149k-line NestJS/DDD backend (distinct codebase, 52 sagas) applies the same discipline server-side.
04AI governance · self-proving private · by capability

A control plane that proves its own enforcement

What
A governance harness that wraps AI coding agents so type-safety violations and forbidden process actions are physically blocked, not discouraged — paired with a citation-gated AI memory layer built on the same frame.
Hard problem
An AI agent will confidently claim a guard is on. The system has to never take the claim at face value — and prove its own enforcement.
Approach
Bad code can’t compile — branded types plus a prove-illegal harness where every illegal example must fail the type-checker, so weakening a guard turns the build red and names the dead guard. Bad process fails closed — a hook runner where any outcome that isn’t an explicit allow is a BLOCK. Every control is paired with a contract whose must-block example is driven through the real hook entrypoint, and a bijection test fails the build if any control lacks a contract or any contract lacks a control. Every refusal lands in an append-only ledger guarded by abort triggers. The memory twin drops any recalled fact that can’t resolve to a real file:line or transcript turn.
Result
Tens of thousands of real, trigger-enforced block events recorded in an immutable ledger while building these systems — enforcement demonstrated by a self-proving test suite, never asserted.
05AI pipeline · hallucination firewall private · by capability

A document pipeline that cannot lie into its output

What
A six-stage pipeline that reads a directory of construction-bid PDFs and produces a citation-checked risk report — engineered so no AI finding reaches the deliverable unless its quoted evidence is a verbatim substring of the source page. Shipped with a full-stack intake-and-admin product around it.
Hard problem
A language model will confidently invent evidence that was never in the source.
Approach
The model is confined to one narrow stage, bracketed by deterministic code on both ends. Every finding survives only if its quoted evidence is a literal substring of the source page; on a miss it is permanently deleted — to a database table and an append-only forensic log — not flagged, not downgraded. Every stage transition is SHA-256 hash-chained and tamper-checked. A hallucination firewall written in code, proven by a test that injects a fabricated finding and asserts it is destroyed.
Result
Hallucinations are structurally unable to reach the result, proven by tests that pass in CI. The product around it — inbound-email bid intake with signature-verified webhooks, an operator admin, self-hosted behind a Cloudflare Tunnel — ships 832 passing tests across the two repos.
06AI evaluation · gated self-improvement private · by capability

AI that scores and improves AI — without dropping a safety rule

What
A multi-tenant backend that scores voice-agent calls with a hybrid deterministic + LLM engine, mines recurring failure patterns across organizations, and proposes prompt fixes behind a gate.
Hard problem
Letting AI evaluate and tune AI without ever silently shipping a regression or dropping a guardrail.
Approach
Each candidate prompt-fix runs a four-stage quality gate — a hash no-op check, a scope check, a coherence judge, and an instruction-preservation judge that rejects any revision dropping a core safety instruction — escalating to human review after repeated failures. Scoring blends a DeepEval sidecar, a Claude judge that escalates on low confidence, and deterministic voice-signal detectors. Every org is isolated; cross-org learning only ever touches flag strings, never transcripts.
Result
The pipeline ends at a gated proposal — auto-promotion is off by default, and even when opted in only advances a status; no shipped path takes an AI-suggested change fully live without a human.
07AI product · agentic private · by capability

AI-driven technical due diligence

What
A tool that points a fleet of AI agents at any codebase and produces an M&A-grade technical risk report — the kind a buyer’s engineers spend weeks on.
Hard problem
A single LLM pass over a large codebase is shallow and easy to fool; real due diligence needs breadth, correlation, and evidence.
Approach
A six-stage pipeline whose analysis stage fans out up to ten domain agents (security, architecture, tech-debt, dependency health…) in parallel — each a real multi-turn tool-use loop that reads the actual code under a path-traversal sandbox and emits schema-validated findings that are rejected without concrete evidence. A correlation pass surfaces compound risk where domains converge; scoring is fully deterministic and benchmark-calibrated.
Result
A 30–80 page, evidence-backed audit produced in hours instead of weeks — with real reports on disk for production codebases, and test code outweighing source.
08Autonomous daemon · sensor-verified habit-daemon ↗

habit-daemon — completion that can’t be gamed

What
An always-on daemon (~14k lines of TypeScript, running 24/7 under launchd) that refuses to take your word that you did something.
Hard problem
A self-report is worthless as evidence; the system has to verify against the real world.
Approach
Completion is checked against real sensor data — a Concept2 rower over OAuth2, Garmin sleep, and Claude vision on a proof photo. A cheap deterministic gate auto-completes from cached sensor data at zero LLM cost; the model is invoked only to escalate when proof is missing. Every dispatch is written to an append-only, hash-chained ledger (RFC 8785 + SHA-256) with triggers that forbid updates and deletes.
Result
Ships with a real, cited scar: a runaway retry loop once spawned ~370k dead sessions before a circuit breaker and exponential backoff went in — now schema-enforced and locked by tests. I harden after every failure; I don’t claim there are none.
more public work
  • lazyrecall ↗ a Rust TUI for browsing, searching, and resuming Claude Code sessions — clean multi-threaded SQLite/WAL design.
  • operator-doctrine ↗ the published theory the harnesses enforce — a taxonomy of how AI agents fail, and the countermeasures.
  • cc-guide ↗ an evidence-grounded Claude Code reference: 25 real agent failures, each tied to a primary source.
  • goalpost ↗ a Claude Code plugin with fail-closed hooks that stop an agent from drifting off task or claiming "done" before it is.
  • research ↗ a research-workspace harness with hook-enforced source vetting.
§ 03 · background

Seventeen years, many domains — one engineering instinct.

Software, construction, home inspection, environmental, real estate. The range isn’t drift — it’s the same way of thinking applied wherever I went.

B.A., Economics (financial applications) — Southern Methodist University

  1. 2025 — now

    Independent engineering — Code-Rescue

    AI control planes, correctness-enforced systems, and citation-verified pipelines — 40+ systems, public and private.

  2. 2024 — 2026

    Founder — environmental & home-inspection services

    Built and ran the engineering, marketing, and compliance solo. FL Home Inspector (HI-18109).

  3. 2019 — 2023

    Project Manager & Real Estate Analyst

    A $10M+ portfolio of 20+ projects — plus the company website, data work, and field operations. Many hats; one engineering instinct.

  4. 2016 — 2023

    Product & Project Manager — building-services SaaS

    Oversaw a multi-platform SaaS suite (web + iOS + Android) used by 200+ enterprise clients: product direction, an 8-person engineering team (Agile/SCRUM), QA, and releases. I owned the product and the process; the codebase was built by the team.

  5. 2009 — 2016

    Self-taught foundations

    First code at 12, reverse-engineering online games. By 15: Java, C++, JavaScript — 10+ game servers, 50+ freelance sites.