Work

What it is. Security scanners find problems faster than teams can fix them, and most of the fixes are repetitive. On a cross-team initiative, we built agents that take a static-analysis finding all the way to a merge request and through the project’s pipeline. They now open merge requests for teams across the organization, and another team built them into its own agent platform.

My part. I was one of the lead engineers. I built the remediation agents and shaped how they stay safe and how their work gets checked. Every finding is sorted first: the agent may fix it, a developer gets guidance for the fix, or it’s outside what the agent may touch. The security owners carry the risk, so we agreed with them what the agent may do on its own. The model has no credentials and can’t push code; plain, deterministic code does those steps. Tool checks and a separate verification agent look at every fix, and a failed check guides the next attempt. Then a second loop works on whatever breaks in the project’s own CI.

“The challenge was not simply to have AI generate a fix, but to build a workflow that engineering and security could trust.”

Stack: AI agents, static analysis, merge requests, CI pipelines.

What it is. My department’s services used to check security in different places: in proxies in front of them, and in small services that did nothing but validate requests. Every fix had to be made more than once. Now one library inside each service does it, with an annotation for each kind of authentication, from OpenID Connect with enterprise identity providers to HMAC between services, device validation and role checks. The same endpoint can serve clients that send different kinds of tokens.

My part. With a colleague, I rewrote the library and integrated the identity providers into it. I led the work on the SDK around it, which puts security, auditing, error handling and secrets in one place, with a shared bill of materials so dependency upgrades happen once for every service. I proposed moving the checks out of the proxies and into the services, then delivered the change and removed the proxy layer. The rewrite helped close findings from penetration tests and let us retire the validation services. Separately, I built a proof of concept for securing Java applications with OAuth, and another part of the company adopted it for all of its Java applications.

“Excellent work rewriting the Security Library covering multiple authentication and authorization needs in a single library which can be integrated to any application to secure the endpoints.”

Stack: OAuth 2.0, OpenID Connect, JWT, HMAC, Vault for secrets, a shared bill of materials.

What it is. Agents in front of an internal platform, so teams can ask for what they need in plain language. The platform has many capabilities, each behind its own API, and every team that used it had to learn them one at a time. This was the first multi-agent setup in that stack.

My part. I built it: MCP servers in front of two of the platform’s services, a worker agent for each, and an orchestrator agent that keeps the session and coordinates them. Calls are authenticated, with tokens checked against the identity provider’s published keys, and audit-logged. On my own initiative I also built a desktop tool for the Kubernetes clusters our services run on: sign-in across clusters, the logs of every pod in a deployment in one filtered view, AI agents to help read them, and a read-only mode. It does the work of two tools developers used to switch between.

Stack: MCP, multi-agent orchestration, JWT and JWKS, audit logging, Kubernetes.

What it is. When generative AI arrived, a few people in my department tried it on the side. Some worried it would replace them. Others didn’t trust AI-written code in production. Both worries were fair. Today spec-driven development is the department’s standard way of building software with AI.

My part. I was given the role of driving the move. Before I asked anyone to adopt spec-driven development, I proved it on a real modernization project, with Specmint and later Kluris. I made it a one-command install, answered questions in a channel set up for them, and gave talks and hands-on demos, tailored to other teams’ applications when they asked. I also wrote a skill, tested by its own evaluation suite, that teaches coding agents the company’s design-system components, and curated knowledge bases for the systems we own. When the whole department had to pick up Go, I set up a coding dojo and we learned it together.

Stack: Specmint, Kluris, spec-driven development, agent skills with evaluation suites.

• Consulting
• The AI-native guide

What it is. The services I work on send software and files out to devices in the field. When something goes wrong there, customers feel it, and issues used to be fixed one at a time as they came in. We rebuilt the services on a simpler architecture with clearer, reusable API contracts. They’re now simpler to run and to change.

My part. I analyzed the components and recommended the rebuild, then built many of the new services myself: access, upload, retrieval, audit, email and antivirus scanning, several with reusable clients. I moved the gateway from Zuul to Spring Cloud Gateway, with caching and a Spring Security upgrade, added pagination where consumers needed it, and retired old endpoints in stages so no consumer broke. Along the way we moved the services to the company’s Kubernetes platform, and I helped build a shared OpenTelemetry logging framework. I also worked on modernizing a log-processing suite and helped design a multi-year migration of stored data between storage platforms.

Stack: Spring Cloud Gateway, Spring Security, Kubernetes, OpenTelemetry, Angular, Python, Kafka.

What it is. Two earlier roles, in 2020 and 2021.

My part.

• In 2020, at the same technology company, we built tools for configuring enterprise storage systems and delivered one in time for its product’s launch. I brought its data import down from 40 minutes to under 40 seconds with careful Hibernate and JPA work.
• In 2021, at a financial-services company, I rebuilt the microservice template that new services started from, with modern patterns, standard configuration and tests built in, and wrote a generator that set up a new service in minutes. I also re-engineered two troublesome services, including a move to a different database.

Stack: Java, Hibernate and JPA, microservices.

What it is. An enterprise chat assistant built on retrieval-augmented generation, with multi-stage retrieval.

My part. It’s one of my own products. I built it end to end.

Stack: Google Agent Development Kit for the agents, Qdrant for vector search, Keycloak for sign-in.

What it is. A platform for regular wellbeing check-ins, burnout risk tracking and follow-up support at work. Employees answer short questionnaires and get scores, a color-coded risk level and personal recommendations. When the risk is high, it can suggest or start a structured support plan with activities over a set period. Managers see risk levels and trends for their direct reports, and HR sees teams and the organization as heatmaps. Those views show scores and risk levels, without individual questionnaire responses. An in-app assistant answers questions about the platform and burnout from a curated knowledge base, with access scoped to the person’s role.

My part. It’s my product. I designed it, built it end to end and run it in production, and I make its product and engineering decisions. I designed it around separate company tenants, with tenant-scoped queries, database constraints, and privileged-role checks against both the token and the database. The evaluation flow includes backend checks for explicit employee consent. I designed the assistant to stay within its source material, say when it doesn’t know, and avoid diagnosis. It’s live at burntheburnout.ro, in Romanian and English.

Stack: Kotlin, Spring Boot 4, PostgreSQL, Next.js 16, React 19, Keycloak, a small TypeScript service for the assistant, Testcontainers.

• Visit burntheburnout.ro

What it is. A presentation and intake site for a psychotherapy and psychiatry practice, in Romanian and English. Visitors find the practice and send an intake or contact request, which reaches the practice by email. There is no application database.

My part. We built it at ZeeSpire.

Stack: Astro, as a static site on Cloudflare Pages, with forms sent through Resend.

• Visit inyourmind.ro

What it is. Talks and workshops, from “what is an LLM?” all the way to AI-native companies, software factories and AgentOS, and hands-on training for developers.

My part. I give them myself, on-site or remotely, and I can join a team and set it up in its own repositories.

• Consulting
• The AI-native guide

What it is. Coding agents lose their plan when the session ends. Specmint keeps it. It researches your codebase, interviews you, then writes a spec with phases, tasks, a decision log and resume context into .specs/. The next session picks it up, in whichever tool you open.

My part. I wrote it. It comes as four skills: core and test-first, each writing specs as Markdown or HTML. The test-first variants work red, green, refactor.

Stack: Agent Skills. Works with Claude Code, Codex, Cursor, Windsurf, Cline and Gemini CLI.

Install:

npx skills add ngvoicu/specmint-core -g

Three more variants

• npx skills add ngvoicu/specmint-tdd -g

  Test-first.

• npx skills add ngvoicu/specmint-core-html -g

  Specs as HTML, with diagrams, diffs and mockups.

• npx skills add ngvoicu/specmint-tdd-html -g

  Test-first, as HTML.

• specmint.ngvoicu.dev
• The article
• The video

What it is. Agents start every session knowing nothing about your team. Kluris gives them one shared brain: a git repository of Markdown notes, organized as lobes, neurons and synapses, that agents search with ranked keyword search. Agents propose new knowledge, and a person approves every write.

My part. I wrote it. It’s a Python CLI that installs a skill for each brain in nine coding agents, among them Claude Code, Codex, Cursor and Copilot.

Stack: Python, Markdown in git, BM25 keyword search.

Install:

pipx install kluris

• kluris.ngvoicu.dev
• The article
• The video

What it is. A desktop app that runs a team of AI coding agents on your project. You talk to a Chief of Staff, which plans the work and puts tasks on a board. Workers do the tasks, advisors answer questions, reviewers check the work and testers run it, each in its own terminal of Claude Code, Codex, OpenCode, Pi or Devin. It works with your own logins, stores no passwords and needs no API keys. You can make every message between agents wait for your approval.

My part. I wrote it. It started in July 2026 as a Claude Code plugin and a Pi extension that let your agent ask a different model for a second opinion. It’s now this desktop app.

Stack: Rust, Tauri, xterm.js. Runs on a Mac with Apple silicon (macOS 13.5 or later) and on Windows 10 or 11, 64-bit.

• consensflow.ngvoicu.dev
• Download for Mac or Windows
• Source on GitHub