The vision was the CTO's. Turning it into an architecture that holds — the stack, the standards, the details — is where I worked.
Pempem — market access powered by transparency. An Indonesian agri-commodity marketplace connecting smallholder farmers to mills and buyers, with field agents, payments, credit, rewards and a data backbone. I am one of its founding engineers: six years, reporting directly to the CTO, in the weeds on the technology day to day.
HR calls it Senior Engineer. In practice I shape the platform's architecture alongside the CTO, and I keep its cloud bill steady and predictable by design. The systems a Series A is being raised on are ones I helped build.
~6 years
since Oct 2020
4 surfaces
one market, four front doors
A dozen
separate systems, each with an owner
24/7
the market never closes
Near real time
market intelligence
Day one
traceability, before the market
Transparency, in practice
Pempem buys fruit from smallholder suppliers and connects them to buyers in a model that only works because everyone trusts Pempem completely. That trust is earned, not assumed. Two things earn it, and I built both.
You can trace it
Every load carries a verifiable history: where it grew, whose hands it passed through, deforestation-aware provenance handed to the buyer. It was the first system I built, because without it nothing else is credible.
You get paid
Paying the farmer quickly, reliably and correctly. In this business a payment isn't a transaction, it's someone's livelihood — the most precious cargo on the platform. Speed and certainty of payment are the trust.
Chain of custody, drawn
Suppliers across Sumatra, the routes their loads travel, and the mills that receive them. Every load arrives with its own history attached.
Coastline from public-domain Natural Earth data. Plots, routes and mills are illustrative — no real suppliers, buyers or coordinates.
One market, four front doors
Supplier app
Market access and fair, transparent prices for smallholder farmers.
Sarana
The operations platform: onboarding, review, releases, oversight — the backbone operators run the market from.
Field agent app
On-the-ground operations: farmer onboarding, verification and field data capture where the network touches the ground.
Niaga Enterprise
The dedicated bids platform where mills and buyers set and manage prices.
Step inside it
Three of the four doors, as short scripted walk-throughs. Fake names, fake prices, fake places — the shape of the work, not the data.
Accepted bid
Mill Sinar Tani · Rp 2,310/kg
73 minutes from drop-off to money in hand.
12
deliveries to review
7
KYC pending
3
bank checks
5
payout queue
Supplier Ibu Sari · Plot B-07 · 4.2 t
Rp 9,702,000 queued to the payment broker
Released by an operator, written once, append-only. The gate can be opened but never un-logged.
Price tiers
Quality terms
Niaga Enterprise is in design, not shipped. Shown at the state the platform is actually in.
· scripted screens, nothing here computes.
Surface to substrate
Tap a layer for what I built and the call I made. Diagrams are role-level by policy: no real service, schema or topic names.
Rp 2.240
▲ per kg
Illustrative composite. Not a real product screen.
Every farmer, operator and buyer enters through one guarded entrance. Who you are is settled once, at the door, and trusted everywhere inside — no service re-derives it and no service can be reached around it. One way in is one thing to keep safe.
The call: decide trust once and carry it inward; never re-litigate it downstream.
Behind the single app sit a dozen separate systems — pricing, contracts, payments, identity, the field network — each with a clear owner. Only that owner writes its facts; everyone else reads through a contract. That is what let the platform grow for years without the parts tripping over each other.
The call: give every part one owner, and the whole keeps moving as it scales.
Role-level only — real capability names withheld.
Prices move around the clock, and the instant one changes, everyone who should know is told — no trading windows, no waiting on a nightly batch. An event backbone carries price movements, settlements, notifications and aggregation; a message that fails has a home to land in rather than disappearing.
The call: an always-open market only works if nothing is ever silently dropped, so every message has a home even when it fails.
A supplier drops off fruit and is paid quickly and correctly, and that speed is the relationship. Money never sloshes around inside the app: one small, deliberately boring system moves it exactly once, and cannot double-pay even if it is asked twice. Its record is append-only.
Paid once, and only once — exactly-once settlement behind a broker.
The call: the system that touches a farmer's livelihood is the most careful one we own — it pays fast, and it pays once.
Every load carries its own history — where it grew, whose hands it passed through. Origin is captured at the plot, custody is recorded at every hop, and what the buyer receives is provenance they can verify rather than a claim they have to trust. Deforestation-aware from the first version, because that was the point of building it first.
The call: transparency is a data structure, not a slogan.
Everything the platform does is recorded as plain facts and refined into the numbers the business runs on. A separate watchdog re-checks all of it every night and wakes a human the moment the numbers don't add up. It reports to nobody inside the pipeline it is checking.
The call: a report you can't audit is a rumor; the last stage exists only to catch the others lying.
A fleet of always-on agents watches the market in near real time and flags the moment conditions shift — changes that used to be spotted hours late, if at all.
near real time
Not a nightly report. The market shifts and the platform knows within the same breath.
On top of that runs Temana: a full analytics-and-AI pipeline that learns the market and helps it adapt, and a recommender that proposes the right trade — an approach to this business no competitor is attempting. It is disciplined rather than decorative: a dependable baseline it can always fall back to, models that only ship when they beat that baseline on measured results, and a clear trail behind every recommendation.
The call: the honest result wins — a dead-simple baseline out-predicted the fancy models, so it became the floor every cleverer model must beat before it's trusted with a real decision.
I don't own the budget, but I work hard to keep the cloud bill flat and predictable, because a surprise infrastructure cost is its own kind of risk. Serverless that scales to zero when idle, incremental work instead of nightly full rebuilds, and heavyweight tools turned down when a documented cheaper path exists.
The call: "will it scale?" and "what will it cost?" are the same question — and the answer should never be a surprise.
The platform grew fast into one tangled shared database. I'm leading the rework into a clean core where adding the next commodity is a plug-in rather than a rewrite — shipped live, old and new coexisting, with no big-bang cutover.
BEFORE
AFTER
The call: you earn the third commodity by how cleanly you shipped the second.
How it was built, in order
Years are editable placeholders.
By day, the architect who makes a CTO's vision hold at scale. On my own time, the one who conceives and builds the whole thing.
Nightwatch — an automated trading platform I conceived, designed, and have built and run solo since early 2022. It runs unattended against 24/7 markets, on a schedule, with real money behind three independent safety gates. Every decision below was paid for in production, not in a design doc.
What follows is the machine, never the money: no strategies, signals, parameters, thresholds or returns. Trading edge decays the moment it's disclosed.
The hardest thing here isn't the execution path. It's the machinery that decides whether I'm allowed to believe my own results.
It has two halves. A walk-forward harness that re-runs the selection procedure on windows it has never seen — not just the winning configuration — because a config that won one search is a coin that came up heads. And a live audit that scores every closed trade against the frozen backtest's own stated expectation, and escalates when reality drifts away from it.
The harness disqualified one of my own strategies: excellent on the window it was tuned on, decayed to nothing on unseen data. It is still not in production.
The call: I built the instrument whose only job is to prove me wrong — and then I obeyed it.
4 years
solo, product + architecture
~$0 / mo
free tiers by design
2 jobs + 1
scheduled, plus a scale-to-zero service
~400
instruments, discovered not listed
Try to make it trade
Same shape as Act I's demo — a scripted click-through, nothing computed. The difference is the technique: every field that would carry market meaning is blacked out, not faked. You can see the entire machine and learn nothing about the money.
redacted
Refused — simulation mode.
Refused — live trading is not enabled on the service.
Refused — halted from the phone.
Armed — without ever having done anything.
Three deliberate acts to go live; forget any one of them and it stays off.
No control here starts a trade. Two buttons, both of them answers.
Working the entry…
The card rewrites itself in place with the outcome — it never leaves the approval flow to tell you.
Already handled.
Approved again — the double-tap loses cleanly instead of executing twice.
It answers questions; it can't ask new ones.
Strategy · window it was tuned on
LOOKS GOODTwo lanes, no axes, no numbers — only verdicts.
Same strategy · a window it has never seen
FAILS THE RULEThis actually happened — one of my own strategies is still not in production because of this step.
Live audit
One alert fired — then quiet, as further trades land.
It warns once, then shuts up. A monitor that nags gets muted, and a muted monitor is worse than none.
"Conditions eased through the week, and positioning followed with it."
The model writes only the prose — every figure is deterministic, and blacked out here.
"Volatility fell. Exposure was reduced accordingly."
Not one redacted figure moved — because none of them ever came from the model.
· no market data, no strategy, no numbers.
Nine layers, all engineering
One path from data to order, and every interesting decision on it is a refusal. The control surface hangs off the side of the flow rather than sitting inside it, so nothing on a phone can originate a trade.
The call: no arrow labelled "new trade" enters from the phone.
A chat bot on a phone sends a card — instrument, direction, reference levels, sizing, the reasoning in one line — and offers two answers: approve at a preset size, or reject. Plus one read-only page: system health, open position, pending decisions, deployment ladders, a live equity trace. The bot has no command that originates a trade and none that accepts an amount. Origination lives in a CLI on my own machine; the dashboard has zero mutation routes and is reachable only through a short-lived, single-purpose sign-in link minted by the same identity that guards approvals.
The call: the most exposed surface is the one that must not be able to invent anything.
A normalization layer over multiple venues and sources across several timeframes, collapsed into one time-ordered series with a single cache identity per instrument, resolution, source and window. The still-forming bar is trimmed on every run, so a decision can only see closed data. Renamed instruments have their pre-rename history stitched back on. A feed that quietly stops is refused past a staleness bound and dropped from the boards rather than scored on stale bars.
The call: a feed that fails is loud and harmless; a feed that stops is silent and expensive. Ingestion's real job is refusing data, not fetching it.
The universe is discovered from the venue itself — aged past a history requirement and a liquidity floor, then promoted automatically. Nothing is hand-listed. Multiple independent strategies run as passes behind one interface, isolated so an exception in one can never suppress the others; partial results ship flagged rather than silently truncated. Every tuned parameter lives in a frozen, versioned config file loaded at runtime.
The call: the engine is generic, the strategies are plug-ins, and what runs in production is a file under version control.
A non-bypassable layer between decision and execution. Three independent gates, each of which must be actively opened. Above them: one open position and one pending decision at a time; per-asset deployment budgets checked twice, a fast-fail before the tap does anything and a re-check under compare-and-swap at fill time; and a drift guard that refuses if the market moved adversely past a bound since the signal. Every one of those is a refusal, never an adaptation.
Drawn in their off position. All three must be actively opened.
The call: a system that trades when you forget to configure it is not a system.
A proposal state machine with an explicit transition table: illegal transitions are rejected, not merely unlikely. Every write is compare-and-swap against object storage, so a double-tap loses cleanly instead of executing twice. The proposal is persisted before the notification is sent, so an outage can lose the message and never the decision. Entry works the book passively first, then falls back to a slippage-capped aggressive order for the remainder — measuring that turned out to matter more than I expected: execution style, not strategy, was a first-order term. The instant a fill lands, protection is placed at the venue itself, exchange-native and reduce-only. Every cycle reconciles tracked state against exchange truth; the journal is append-only.
The call: the venue is the authority on what happened; my state is the authority on what I intended.
One shared trade-lifecycle simulator serves the backtest and the day-by-day replay alike, so hypothetical outcomes can't diverge between tools — gap-aware, conservative when a single bar is ambiguous, and modelling the same cost structure the live executor pays. On top of it, a walk-forward harness with train/test folds that re-runs the whole selection procedure per fold, plus a parameter-plateau check asking whether a configuration sits on a broad shelf or a lucky spike. The deploy rule is written in advance, and it has teeth.
The call: a backtest tells you what a strategy did. Walk-forward tells you whether your way of choosing strategies is worth anything — and only the second is a real question.
An independent stage records, per closed trade, the realized outcome normalized against the risk actually taken, plus slippage measured against the original reference price and the true cost paid. It compares the rolling live distribution against the frozen backtest's stated expectation, one-sided, and grades itself: warming while there isn't enough evidence to say anything, then green, watch, red. It escalates once, on the transition into red — never a nagging repeat.
The call: an audit that reports to the thing it audits isn't an audit.
Scheduled jobs wake on the bar close, do their work and exit, alongside a single scale-to-zero service for the control surface. State is JSON objects in cloud storage with generation-match compare-and-swap; there is deliberately no database, because the state is small and bounded and an idle managed database is a cost and a failure mode bought for nothing. Credentials live in a secret manager, scoped so withdrawal and transfer are impossible by permission rather than by intention. Resilience is ordinary and paranoid: retries with backoff, a second venue as fallback, a region chosen around a geographic block on the primary source, a per-run heartbeat, and a stale-state guard that speaks up if the scheduler ever stopped firing.
The call: the worst failure in an automated system isn't a crash, it's a silent miss. Every silence has to be a decision something made.
The laws I design by
Ten, spanning both acts. Each one is a decision I have had to defend more than once.
Senior, staff or principal work, architecture reviews, or a conversation about either platform.
Placeholder slots for two or three public repositories worth linking. Send me the names and one line each and they drop straight in. The trading platform's repository is deliberately not listed.
Link the exported PDF here.
Or leave your details
Thank you — I'll come back to you shortly. (Prototype: nothing was sent.)
Quantified claims are rounded and defensible. Diagrams are role-level: no internal service, schema or topic names appear anywhere on this page.