# Protoworks

> A boutique engineering studio in Cape Town building event-sourced backends, the graphs and models that read them, and the compliant cloud they run on.

Infrastructure as craft. Operated by Protoworks Group (Pty) Ltd (registration 2026/556877/07). Contact: rpeters@protoworks.dev. Security reports: security@protoworks.dev.
Content last updated: 2026-10-12.

## The architecture, in five parts

- [01 · Architecture](https://protoworks.dev/architecture): Pure cores, adapters at the seams. A decider takes state and a command and returns events. No clock, no IO, nothing to mock.
- [02 · Events](https://protoworks.dev/events): Nothing happens once. An append-only causal ledger where every reaction cites its cause, so history is a graph you can replay and audit.
- [03 · Graphs](https://protoworks.dev/graphs): The edges were always there. Ownership, control and money as typed graphs: beneficial owners, circular structures and communities, found by algorithm.
- [04 · Models](https://protoworks.dev/models): Transformers at the seams. Small specialised encoders extract and link, constrained decoders relate. Text in, typed statements out, appended to the ledger.
- [05 · Platform](https://protoworks.dev/platform): Compliance as code. GCP landing zones evidenced against CIS, ISO/IEC 27001:2022 and SOC 2, detections mapped to MITRE ATT&CK, shipped by GitOps.

## What the studio builds.

- Backend systems: Event-sourced services with clean cores. Pure logic at the centre, adapters at the edges, illegal states designed out. (rust · services · apis · ledgers)
- Graphs and entity resolution: Typed entity graphs derived from the ledger, never written around it. Resolution that merges what is the same and keeps apart what only looks it. (memgraph · clickhouse · followthemoney)
- Applied transformers: Small encoders where they win, large decoders only where they must, both held to a schema. Recorded fixtures in every test, never a live API. (gliner · onnx · qdrant · vllm)
- Devops and landing zones: Reproducible cloud foundations. Environment isolation, composable modules, changes applied in dependency order, every control traced to the line that sets it. (opentofu · terramate · gcp)
- GitOps and delivery: Every change is a pull request. Plans on the PR, applies behind a gate, drift checked nightly. No long-lived keys, no hand patches on live clusters. (argocd · github actions · wif)
- Build, monorepo and tooling: Task graphs that survive large multi-language monorepos without ceremony, and the internal CLIs that pay back their build cost in the first quarter. (moonrepo · remote cache · clis)

## What the studio is building.

- [Protoworks Defence](https://defence.protoworks.dev): Live · pre-seed. Live-ops capability for defence and security operators: ISR, GeoINT, force management and sensor fusion, presented as a command surface rather than a brochure. (next · cloud run · terraform)
- [Panoptes](https://secops.protoworks.dev): Live · pre-seed. Protoworks Defence's security-intelligence census of the South African internet: hosts, services, certificates and vulnerabilities, resolved to entities in an investigative graph on the FollowTheMoney ontology. (rust · next · cloud run)
- [Aegis](https://aegis.protoworks.dev): In build. Identity verification and verifiable credentials: configurable KYC flows across many verification providers, a PII vault, privacy rights and a fraud graph, with an OpenID4VCI and OpenID4VP credential stack (SD-JWT VC, ISO/IEC 18013-5 mdoc) and a holder wallet app. (rust · event-sourced · openid4vc)

## Links

- [Protoworks](https://protoworks.dev/): the studio
- [Security contact](https://protoworks.dev/.well-known/security.txt): RFC 9116 security.txt
- [Code](https://github.com/protoworks-dev)