All work
11Live / Production

Momentum PM

Not a demo — real district staff log in daily to a zero-knowledge vault and a personal AI coach.

  • Next.js 16
  • React 19
  • Drizzle
  • Neon
  • Better Auth
  • shadcn
  • AES-256-GCM
  • Opus 4.8
  • Vercel
FIG.11crystallize

A production project-management platform for a real government cohort: MS-Project-grade Gantt, Sankey budgets and burn-down, a no-backdoor encrypted vault, and a per-user-isolated AI coach — shipped, live, and used every day.

Role
Architect & lead engineer
Status
Live / Production
Access
Live / public
Problem

A real government innovation cohort needed a project-management tool they would actually use daily — with finance-grade rigor and the ability to store secrets that even the platform operator could never read.

Architecture

A Next.js 16 / Drizzle / Neon stack behind Better Auth, with an MS-Project-grade Gantt, Sankey budget flows, and burn-down telemetry. The Momentum Vault derives an AES-256-GCM key from the user’s password (scrypt N=2^17) so secrets are decryptable only in the browser — no backdoor, no recovery, by design. Mini Mich layers a per-user-isolated Opus 4.8 coach with hard tenant boundaries.

Role

Architect and lead engineer — schema design, the cryptographic vault, the single-front-door access-control model, the AI coach isolation, and the live regression suite.

Security

All access flows through one front door; GDPR Art. 15/17 export and erasure endpoints are implemented; 192-bit share tokens are protected by per-IP and global lockout; a 29/29-green live regression runs against production.

Outcome

Live in production with real district staff onboarding and using it daily — the proof that this is shipped software, not a portfolio mock.

What it took

Technical proof.

  • Momentum Vault: password-derived AES-256-GCM, scrypt N=2^17, no-backdoor / no-recovery by design.
  • 192-bit share tokens with per-IP and global brute-force lockout.
  • Mini Mich: a per-user-isolated Opus 4.8 coach with strict tenant boundaries.
  • GDPR Art. 15 / 17 endpoints, single-front-door access control, 29/29 green live regression.