Web software for the hard requirements.

Our strongest area. Offline is not a cache bolted on late — it is the baseline the application is designed against, with connectivity treated as the optional extra.

• Durable local storage — IndexedDB through Dexie, with tests running against fake-indexeddb so the offline path is covered in CI rather than assumed.
• Application shell — Workbox via vite-plugin-pwa, installable to a home screen; elsewhere a hand-rolled service worker and web manifest with no tooling at all.
• Multi-device convergence — a conflict-aware operation-log merge, explicitly not last-write-wins, default-off and gated behind a PIN-protected admin panel.
• Deployment realism — one image, two profiles: a VPS with PostgreSQL and automatic TLS, or a field kit on Raspberry Pi class hardware with SQLite and LAN TLS.

Fifteen years of accessibility work across Government of Canada programmes — Common Look and Feel and WCAG 2.0 from 2011, GCWeb 17 and WCAG 2.1 AA today — and, less commonly, decisions that show how individual assistive technologies actually behave rather than knowledge of the success criteria alone.

• Screen readers in the test plan since 2012 — at Natural Resources Canada, test cases were run through a screen reader to confirm a visually impaired user could finish the task, rather than checking the markup validated. Migrating departments off legacy Common Look and Feel onto WCAG was a repeated brief.
• Assistive-technology-specific judgement — native <details> disclosure chosen over a scripted tree because it is keyboard and screen-reader correct with zero libraries, and an ARIA role deliberately not added because it would change NVDA's mode.
• Four AT stacks verified — NVDA and JAWS on Windows, VoiceOver on macOS and iOS, TalkBack on Android.
• Automated where automation is honest — axe-core assertions inside the browser end-to-end suite, with manual verification for everything it cannot see.
• Programme-level remediation — led accessibility and usability remediation for a public portal serving thousands of users, aligned to Canada.ca and WCAG.

English, French, Arabic, Spanish, Farsi, Swahili and Urdu — three right-to-left. Bilingual English and French delivery under the Official Languages Act is routine; the multilingual RTL work goes well past it.

• Right-to-left throughout, not merely mirrored — full RTL interfaces, and generated PDFs where Arabic is shaped and bidirectional text is resolved by the text engine.
• Translation that survives disconnection — an in-house context-based i18n layer chosen over a library specifically so it works offline, with English fallback.
• Localised media — narrated walkthroughs produced in three languages with captions delivered as separate .vtt tracks, so Arabic shaping can be switched off if it renders wrongly.
• Multilingual static delivery — a six-language site with hreflang alternates in the sitemap and per-language canonical pages.

Around 500 TypeScript and TSX files across the product line, organised so the boundaries mean something. React 18 with Vite in three separate products — and no state-management library, no UI kit and no router package, because context and composition are sufficient here.

• Deliberate layering — domain model and standards mapping live in a framework-free package, reusable unchanged by a future native client or the server.
• Ports and adapters — a provincial health-record gateway written as an implementation of a port interface, not as calls scattered through the interface layer.
• Bundle separation as a security boundary — a public portal built as a distinct bundle so the internet-facing surface ships less code and less data.
• Type checking as a gate — tsc --noEmit across the root and every workspace before a build is allowed to proceed.

Django 5.2 and Django REST Framework carrying a genuinely complex domain, with fifteen years of database design behind it — logical and physical models, ERDs, Oracle and SQL Server, migration and reconciliation.

• Domain decomposition — twenty applications, 185 migrations, PostgreSQL in production and SQLite for local development, each concern owning its own tables and rules.
• Rules in the model, not the screen — separation of duties, role-scoped visibility and retention schedules enforced where they cannot be bypassed.
• Unattended work that reports itself — scheduled jobs with a health board that surfaces what failed to run, and a restore check that proves the backup.
• Legacy migration — SSIS packages moving legacy datasets into Dataverse with source-to-target mapping, transformation, validation and reconciliation.

The commercial core of the practice, and where the web skills above get applied under real constraint — a platform that renders your HTML for you, restricts what JavaScript may do, and still has to meet federal accessibility and official-languages obligations.

• Public-facing portals — multi-step bilingual intake with conditional logic, file upload, CAPTCHA and full screen-reader support, on Liquid web templates over Dataverse.
• A productised scaffold — a console script that extracts a form's schema straight from the maker environment, plus a generic controller and template, taking a Power Apps form to a compliant portal against a written checklist.
• Integration beyond the defaults — Dataverse Web API and OData, FetchXML, custom APIs, Power Automate flows, and OpenAPI contracts authored for downstream consumers.
• Custom interface controls — Power Apps Component Framework grid and field controls in TypeScript and React where the platform has no answer.

Not a security practice by title, but the security code shows the habits of people who have thought about failure modes: standards-conformant primitives, documented parameter choices, and a written argument for anything that could be got subtly wrong.

• At-rest encryption — WebCrypto AES-256-GCM with PBKDF2-SHA-256 at the OWASP-recommended iteration floor; the derived key is non-extractable and memory-only.
• Second factor written to the RFC — TOTP proved against the specifications' own published test vectors, with constant-time comparison, refusal of a replayed counter and a deliberately narrow drift window.
• Tamper-evident audit — a hash-chained audit log with a verification command and a retention and destruction schedule.
• Supply chain — CodeQL, secret scanning and a generated CycloneDX SBOM in CI, and a dependency count kept deliberately small.

Complete business applications in a single HTML file, running from the file system, with no build, no server and no dependencies. A real engineering constraint, chosen because the users are counter staff who should not have to install or maintain anything.

• Defensive parsing — point-of-sale exports consumed as-is, with title blocks, repeated page headers, subtotal rows and pagination lines detected and discarded.
• Print as a first-class output — A4 layouts reproducing the source system's own report, headers repeating per page, and the document title set so "Save as PDF" suggests a sensible file name.
• Domain encoding — shop search tags decoded into product sizes, malformed tags audited, and corrections suggested back to the counter.
• Local persistence and safe merge — retention across sessions, and multi-year imports merged by reference so re-importing overlapping exports cannot duplicate.

Testing is not decorative. The largest product carries 223 test files plus around forty browser end-to-end specifications, and exposes one command that runs the identical sequence CI runs — type check, every workspace's tests, the build, then the browser suite.

• Layered suites — Vitest for unit and integration, Testing Library for components, Playwright for browser flows, in-memory PostgreSQL for service tests.
• Nine GitHub Actions workflows on a single product — CI, end-to-end, CodeQL, secret scan, image publish, Pages deploy and automated code review.
• Environment-aware deployment — staging and production shipping different server configuration, one cache-disabled and no-index, the other cached with security headers.
• Builds with no install step — a hand-written static site generator using Node built-ins only, paired with smoke tests that run against the deployed URL.