flowaxon / hub
/llms.txt
Le Duc Tam

Le Duc Tam

Systems Engineer & AI Agent Architect • 11+ Yrs Infrastructure

Bridging 11+ years of enterprise IT infrastructure with autonomous AI agent harnesses and deterministic governance.

"I don't build systems to impress — I build them to quietly endure. Solid systems begin with steady hands, zero-trust boundaries, and physical evidence."

11+
Years Enterprise Ops
Zero-WAN
Default-Deny Ingress
< 2s
LogSQL Fleet Triage
Engineered Systems GitHub Profile LinkedIn
telemetry@tamld:~
zsh • active
// System ready. Click commands or execute below:
guest@tamld:~$ tamld --status
• Node: Proxmox VE (i5-8500, 16GB Hard Budget)
• Gateway: MikroTik RouterOS (DHCP Authority)
• Ingress: Traefik v3 + CrowdSec (Zero-WAN)
• Agent Harness: g8s Subagent Capability Sandbox
$
BA LENS Select your stakeholder role to tailor proof points:
CTO / VP OF ENGINEERING LENS
Zero-Quota-Burn AI Delegation + Deterministic Production Governance

See how g8s eliminates frontier F0 Brain quota waste (0% coordinator burn via 9router worker fan-out) while Aegis enforces HMAC-SHA256 human-in-the-loop blast doors on production infrastructure.

Inspect 3D Constellation Rig ↓
Operating Substrate & Toolchain
Proxmox VE
MikroTik RouterOS
Go / Golang
Python 3.11
Ansible IaC
Traefik v3
Tailscale Mesh
VictoriaLogs
Interactive 4-Layer System Anatomy Rig

Zero-Trust Constellation Architecture (Edge ➔ g8s ➔ Aegis ➔ Pull-GitOps)

DUAL-PLANE SUBSTRATE // ZERO-WAN EXPOSURE // 16GB HARD BUDGETFLOWAXON-RIG-01 // PVE-NODE-01 // 770KB-RSS-GO-ENGINEL1 EDGE mTLSTRAEFIK v3ROUTEROS DHCPL2: g8s HARNESS (F0/F1/F2)L3: AEGIS AST + 2FA HITL
Active Containment Core (g8s / Aegis)Cloudflare mTLS Ingress StreamWriteReceipt Verified PathAST Risk / HITL 2FA InterceptEvery incoming request traverses Cloudflare Full-Strict mTLS into Traefik v3 and MikroTik RouterOS (Single DHCP Authority), routing isolated workloads into g8s (WriteReceipt worktrees) and Aegis (Shell AST + Telegram 2FA).

Product Constellation & Engineered Systems

Dedicated product portals on *.flowaxon.com, physical codebases, reproducible receipts, zero ghost capacity.

v0.21.0 • Pure Go • Live Subdomain Portal Launch g8s.flowaxon.com ↗

g8s (The Gatekeepers) — Zero-Trust Agent Harness

A lightweight, zero-trust process execution & capability harness for AI Agent CLI Workers. "k8s orchestrates your compute containers; g8s orchestrates your AI subagents."

// Authority Delegation Flow (Interactive Playground on g8s.flowaxon.com):
F0 Brain (S2 Governor)
│ issues single-use path-scoped WriteReceipt
▼ [g8s Harness: F1 Worker Worktree + Orthogonal Strata S0..S3]
│ enforces E_S1_DIRECT_MUTATION_FORBIDDEN + DLP
▼ F1/F2 Worker Executed ➔ Sealed Evidence Delivered
▶ Interactive WriteReceipt Playground (g8s.flowaxon.com) ↗ github.com/tamld/g8s ↗
Bare-Metal SRE

AI-Assisted Infrastructure Platform (IaC)

Production-inspired reference architecture for bare-metal homelabs: Traefik v3, CrowdSec, Rootless Podman, Tailscale Mesh, and VictoriaLogs.

• Dual-Plane WAN vs LAN isolation
• Single RouterOS DHCP lease authority
Ansible • Proxmox github.com/tamld/IaC ↗
🔒 Architecture Case Study Private SSoT

Governed Second Brain (Epistemic Physics Engine)

Deterministic Second Brain with physical note physics (wiki.py). ADLC finite state machines, Gate D deep-why audits, and an epistemic claim ladder (Hypothesis ➔ Proven).

• 3-Layer Map Protocol (Global ➔ Architectural ➔ Behavioral)
• Pre-commit and commit-time hard git hooks
Python 3.11 • Physics Engine Read Case Study ↗
v1.4.0 • Live Subdomain Portal Launch aegis.flowaxon.com ↗

Aegis (defense-in-depth) — Shell AST & Telegram HITL

Layered runtime guardrail for AI-driven shell execution: L1 AST risk scoring, L2 HMAC-SHA256 signed Telegram HITL approval cards, and L3 pre-commit DLP.

• Cryptographic one-click approval / reject callbacks
• Zero accidental blast radius on live nodes
▶ Interactive AST & HITL Playground (aegis.flowaxon.com) ↗ github.com/tamld/defense-in-depth ↗
Live Verified Security & Agentic Standards:
✓ SecurityHeaders A+ ✓ Hardenize 100% Green ✓ DNSSEC + CAA + DANE/MTA-STS ✓ RFC 9116 security.txt ✓ 15-Yr Origin mTLS ✓ W3C WebMCP Active
Career Evolution & Invariants

The Journey: 11 Years to Symbiosis

Click chapters below • 2014 → Present
Machine-Readable Discovery Endpoint • llmstxt.org & W3C WebMCP

AI agents can ingest Tam's verified technical profile via raw Markdown or invoke live W3C WebMCP tools (navigator.modelContext).

/llms.txt /llms-full.txt /api/v1/products
$ curl -sL https://flowaxon.com/llms.txt