DevLog

When seeking university internships to take a qualitative leap as an engineer, the premise was clear: join a company with an exemplary engineering culture and a product I already used and believed in:

• Culture of Radical Transparency & Technical Rigor: Indexa Capital stands out as Spain's leading independent automated manager, guided by radical transparency, sustainably low fees, and mathematical automation of index portfolios.
• High-Reliability Backend Engineering: Managing hundreds of millions of euros across thousands of clients requires unwavering reliability, transactional consistency, and architectural robustness where every line of code matters.

Preparing and advancing through each interview round coincided directly with my intensive stay at the Google/UMA Cybersecurity Bootcamp in Málaga:

• Balancing Intensive Training with Technical Rounds: Between lectures, security labs, and networking events in Málaga, I dedicated late hours to deeply study the business model, architecture, and fintech challenges, tackling every technical stage with preparation and ambition.
• Transparency & Human Connection in Interviews: Every conversation with the technology team was transparent, direct, and centered on software engineering fundamentals, problem-solving, and sound technical reasoning, confirming the high caliber of the team.

On September 9th, I officially joined the technology team as a Software Engineer Intern:

• Backend Systems & Scalability: Deep dive into the platform's backend ecosystem, learning design patterns for fault-tolerant financial services, query optimization, and automated continuous deployment pipelines.
• Integrating Agentic AI into Daily Workflows: Exploration and adoption of modern workflows powered by agentic AI and intelligent assistants in daily programming, refactoring, and automated verification, accelerating engineering velocity and precision.
• Warm Welcome & Mentorship: Deeply grateful for the warm welcome, mentorship, and support from all teammates, making every day an enriching and fast-paced learning experience.

Eager to deliver tangible engineering value and make the absolute most of this chapter:

• Delivering Value from Day One: Commitment to actively contribute across backend tasks, incident resolution, service optimizations, and deploying new user-facing functionality for Indexa clients.
• Synergy with Final Thesis & Graduation: This experience marks the culmination of my Computer Science degree at UGR, balancing production engineering with the upcoming thesis defense.

Transforming Organizator into a collaborative multi-tenant workspace with strict tenant isolation and optimistic concurrency control:

• Multitenant Relational Schema & Strict Isolation: Normalized relational schema (organizations, organization_departments, organization_projects, organization_tasks, and organization_members). Enforced organization_members.user_id uniqueness and mandatory organization_id parameterized SQL queries ensuring airtight tenant isolation.
• Optimistic Concurrency Control (HTTP 409 Conflict): Incremental versioning on organization tasks that rejects concurrent mutations from stale client sessions with HTTP 409 Conflict, preventing silent data loss.
• Fractional Ordering Algorithm & In-Memory Store: Symmetric fractional positioning algorithm in backend and frontend (tablero.ts) verified against float precision loss. useEmpresaStore (Zustand) remains strictly in volatile memory, resets on logout, and syncs via WebSockets.
• Corporate Views & Kanban Drag-and-Drop: Enterprise Overview dashboard with metrics and 4-state segmented department progress bars (EmpresaOverviewView), interactive Kanban boards powered by dnd-kit (EmpresaDepartamentoView), member directory, and Admin Panel tooling.

Complete overhaul of the Enable Banking integration, eliminating technical jargon while safeguarding API usage quotas:

• Zero-Jargon Flow & Direct Bank Discovery: Eliminated manual entry of UUIDs and tokens. Users now search an active ASPSP bank catalog (Santander, BBVA, CaixaBank, Revolut, Sabadell, ING...), redirect to official banking OAuth/PSD2 portals, and map accounts into Organizator pockets.
• Modular Opt-In & API Quota Protection: The bank-sync module is now opt-in across all subscription tiers (including full plans). Only accounts explicitly enabled by administrators consume Enable Banking API quotas, protected by an idempotent migration for existing admins.
• Endpoint Rate Limiting & 24h ASPSP Cache: Hardened banking endpoints with rate limiting on /api/finances/* (60 req / 15 min), in-memory 24h caching for ASPSP institution lists, and one-click account unlinking with direct confirmation.

Replacing manual temporary passwords with cryptographic onboarding links and invite-only beta requests:

• 32-Byte SHA-256 Cryptographic Tokens: Secure 32-byte cryptographically signed tokens with a strict 7-day expiration. Users land on InvitacionView, set their password with real-time validation, and auto-login atomically.
• Transactional Email Pipeline via Native Resend API: Invitations dispatched via native fetch with an AbortController (10s timeout) directly to the Resend API, keeping the backend bundle lean without bulky external client packages.
• Closed Beta Access Modal with Invisible Honeypot: Private beta banner on LoginView with an access request modal protected by an invisible honeypot (empresa_confirmacion) and backend proxy routing to sovereign contact infrastructure.

Ergonomic mobile refactor for touchscreens and resolving geometric clipping on the official brand emblem:

• Horizontal Gesture Swipe Navigation: Fluid gesture switching across [Account] ↔ [Calendar] ↔ [Money]. The banking card carousel remains isolated to prevent unintentional view transitions, while vertical scrolling and pull-to-refresh stay buttery smooth.
• Dedicated Mobile «My Account» Hub: Replaced the header bell with a dedicated user hub in the bottom nav: profile avatar with role and tier badges, Web Push toggle with Safari iOS guidance, company affiliation, password updates, and safe logout checks.
• Maskable Safe-Zone Logo Geometry: Diagnosed tight corner clipping in Login (60x60px, r:14px) and Sidebar (32x32px, r:8px) caused by a 94% full-bleed asset. Replaced with icon-512-maskable (~68% central footprint), restoring proper visual breathing room without touching CSS.

Hardening development standards and continuous automated verification on production pipelines:

• Strict pnpm Enforcement & Centralized AI Hub: Strict deprecation of npm documented in CLAUDE.md and README.md for dependency integrity. Centralized Gemini 3.6 Flash integration in aiConfig with secure x-goog-api-key headers and redacted client error payloads.
• CI/CD Deployment Health & Migration Probe: GitHub Actions deploy workflow now asserts /api/health responds with ok: true and migraciones: 'ok' before completing rollout on the Hetzner VPS.
• Comprehensive Test Verification: 482 Passing Tests: 482 unit tests across 37 suites passing cleanly (TZ=UTC), 41 integration tests on ephemeral PostgreSQL testing multitenancy and 409 Conflict logic, with 0 TypeScript and ESLint errors.

Introducing the new official logo of Organizator, designed as a modular circular wheel integrating the 5 core facets of personal management:

• The 5 Productivity Dimensions: Time and daily schedules (clock), operational tasks (coral checkmark), projects and milestones (golden radar waves), documentation and knowledge (slate note icon), and finances & life streams (emerald wave).
• Native Icon for PWA & App Docks: Crafted with squircle geometry and balanced contrast over deep teal (#183e4b), optimized for high-definition rendering on macOS Dock and mobile home screens.

Restructuring the UI starting from the mobile viewport to maximize speed and clarity during daily tracking:

• Clean Access Gateway ('Entrar al Cerebro'): Full redesign of the welcome portal featuring refined serif typography, delicately outlined inputs, soft ambient blur, and the new emblem anchoring access to the workspace.
• Swift & Ergonomic Touch Interactions: Streamlined layouts and navigation menus for effortless one-handed use, cleaner card spacing, and eliminated visual clutter so logging tasks and checking finances is immediate.
• Warm & Professional Design Language: Adoption of warm cream backgrounds combined with understated deep teal and slate accents, delivering a modern, humane, and distraction-free visual environment.

Diagnosing and fixing cross-device state drift between mobile and desktop clients when updating tasks and calendar schedules:

• Persistent Pending-Push Markers: Client-side pendingSync was kept exclusively in volatile memory; if a mobile browser reloaded or closed mid-debounce, pending mutations were lost. Markers are now persisted in local storage until an explicit HTTP 200 acknowledgment from the backend.
• Multi-User Session Switch Guard: Implemented a strict boundary preventing queued mutations from a previous session from syncing into another user account after a logout/login switch, securing multi-user data integrity.
• Bidirectional State Reconciliation on GET /api/state: Resolved race conditions when fetching server state, ensuring clients reconcile remote changes without overwriting local mutations pending transmission.

Hardening the invoicing suite and visual cleanup of core operational components:

• PDF Engine & Edge-Case Handling: Validated the integrated side-panel PDF viewer and fixed edge-case regressions for lump-sum single-item invoices without line breakdown, preserving VeriFactu and audit compliance.
• Clean & Professional UI Polish: Removed noisy decorative elements (such as generic clock emojis in task lists) in favor of clean technical typography aligned with professional daily workflows.

Refactoring financial cashflow projections by retiring a simplistic abstraction that triggered false overdue warnings:

• The Static Recurring Cashflow Flaw: Modeling monthly freelance billing as a fixed recurring flow (dueDate pinned to day 1 of the worked month) triggered false '32 days overdue' alerts. In professional services, worked hours (e.g. August) are billed next month (September) and collected 30 days later (October), with totals fluctuating based on overtime.
• Invoice as Source of Truth & Distinct Projections: Shifted to a paradigm where realized cashflow is strictly governed by issued invoices (holding exact amounts and due dates). Unbilled future months display clearly marked provisional estimates without polluting official accounting ledgers.
• Zero-Friction Overtime UI & Form Fixes: Radical streamlining of the billable overtime card removing clutter fields, alongside a form validation fix resolving a collapsed description input that blocked submission.

Radical replacement of third-party form processors (Formspree, Typeform, Google Forms) with a self-hosted microservice ensuring customer data never leaves sovereign infrastructure:

• Sovereign Stack & Deployment: Lightweight microservice deployed on a Linux VPS via Docker behind Caddy reverse proxy with automatic TLS at POST https://api.pablorejon.com/contacto.
• Zero-Friction Honeypot Anti-Spam: Instead of conversion-killing CAPTCHAs, a hidden decoy field ('web') with display: none and tabindex="-1" silently drops bot submissions on the server side.
• Strict CORS & Transactional Audit Trail: Strict origin whitelisting in deploy.env (ALLOWED_ORIGINS) and rich transactional emails with client Reply-To headers and audit metadata (exact timestamp, language, IP, and User-Agent).

Interaction engineering focused on frictionless usability, accessible keyboard navigation, and graceful degradation:

• Semantic Pricing Tabs (role='tablist'): Replaced binary toggles with semantic role='tablist' / role='tab' buttons supporting native keyboard navigation (Arrow keys) and progressive degradation (both panels readable if JS is disabled).
• Smart Count-Up & Scroll Geometry: Price counter starting at 72% of target value to animate smoothly without misleading on quick scans, and scroll-margin-top: 5.5rem ensuring sticky header clearance on anchor jumps.
• iOS Safari Mobile Optimization: Inputs styled at 16 px (text-base) to prevent mobile Safari auto-zoom, 48 px touch targets (min-h-12) for ergonomic thumb taps, and responsive 1-to-2 column grids.

Transparent communication tailored for technical trust and regulatory differentiation:

• Proof-Backed Pricing & Production Track Record: Eliminated fluff in favor of concrete proof and transparent pricing right in the Hero ('Websites from €1,500. Monthly care from €45/mo, optional with no lock-in. 1 custom e-commerce in production, 2+ years systems administration with zero downtime, and 1 business day response time').
• GDPR Art. 28 Guarantees & Real Deliverables: Dedicated compliance section (#datos) featuring Data Processing Agreements (Art. 28 GDPR), verified backup restores, and real downloadable monthly PDF report samples.
• Dual-Market Bilingual Strategy (ES vs EN): Spanish (/) tailored for full-service local business IT (workstations, servers, web in Granada); English (/en/) tailored for international startups seeking high-speed custom web engineering.

Technical and operational impact following production deployment:

• 100/100 Core Web Vitals & Lighthouse: Flawless 100/100 Lighthouse scores across Performance, Accessibility, Best Practices, and SEO with Tailwind CSS v4 minified into a single ultralight bundle.
• Zero-Tracking Privacy & Direct Channels: Zero invasive tracking scripts or third-party cookies, empowering clients with flexible direct contact channels (custom API, WhatsApp direct, phone, or email).

Architecture and design of regulatory tax ledgers compliant with Spanish Order HAC/773/2019 with reactive synchronization between income tax and VAT:

• Three Distinct Official Tax Ledgers: Sales Invoices Ledger (income with immutable SHA-256 chaining), Income Tax Expenses Ledger (featuring the 11 official income tax categories and non-invoiced Social Security deductions), and a reactively derived Purchase Invoices VAT Ledger preventing duplicate entries.
• Accurate Form 303 VAT Computations: Tuned box [28] calculations to compute exclusively the taxable base subject to deductible VAT, correctly excluding non-VAT charges and reverse-charge B2B operations (e.g. foreign services like Cloudflare or Anthropic).

Advanced bookkeeping automation for periodic expenses and split billing obligations:

• Inverse VAT Breakdown on Expenses: Recurring flows marked as 'Freelance expense' with vendor, Tax ID, and rate (21%, 10%, 4%, 0%), calculating net base and exact VAT down to the cent from total paid.
• Multi-Charge Cumulative Matching: Support for obligations billed across multiple bank debits under a single mandate (e.g. split Social Security charges). The cycle remains open accumulating charges until matching the expected total (±€1 tolerance), generating an idempotent consolidated record.
• Overdue Recurring Charges Banner: Persistent top banner in Finances with quick actions ('Link to charge', 'Generate entry', 'Hide') and automatic reset on every monthly cycle change.

Platform evolution to support multiple real active users managing their personal finances on the application daily:

• Finance Module Opened to Standard Users: The full personal finance module (pockets, budgets, projections, recurring expenses, and ledger transactions) is now fully available to all registered users.
• Secure Isolation & Zero-Data Cold Start: Open Banking live sync (via Enable Banking) is strictly isolated to admin role. Users operate in secure manual mode with zero credential risk, receiving automatic provisioning of base categories and pockets on first login.

The event notification selector stored values in the database but relied exclusively on ICS calendar alarms. The goal was true background Web Push delivery with the app closed, uncovering three layered silent bugs that produced no error logs:

• Bug 01: Unpropagated Calendar Token in State: Client state was sanitized with a whitelist that omitted calendarToken (resulting in undefined). The sync URL silently hit a safety endpoint returning an empty calendar (0 events). Fixed by declaring the key across the 4 client lists.
• Bug 02: Docker Container Operating in UTC: All-day event notifications anchored to midnight used new Date(), inheriting the container's process zone (UTC). In Madrid (UTC+2), a '30 mins before' alarm ran at 23:30 UTC (01:30 local). Fixed by strictly parsing Europe/Madrid via Intl.DateTimeFormat independently of host TZ.
• Bug 03: PostgreSQL State Blob Overwrite: The client periodically saved application state via SET data = $2. Every 600ms debounce cycle completely wiped server-managed keys (push subscriptions, notification logs, calendar tokens). Fixed by ensuring the backend preserves internal keys against client payloads.

From the initial UTC container discovery at 23:04 to verified delivery at 12:00:17 with registered idempotency keys:

• Silence is Indistinguishable from Inaction: A missing push notification throws no red exceptions or failed HTTP requests: it yields silence. Only inspecting PostgreSQL tables and network payloads revealed that subscriptions were being wiped.
• Guaranteed Notification Idempotency: Every alert is dispatched with a unique deterministic key (ev:id:date:offset) logged in the database during minute sweeps, preventing duplicated alerts across container restarts.
• Verified Production Delivery: Test v3 delivered to iOS PWA at 12:00:17 (17s sweep cycle latency), validating the full stack: React PWA, Express, PostgreSQL, VAPID Web Push, and Docker VPS.

After stabilizing the push notification pipeline, we expanded the engine to cover project milestones with a noise-free alert policy, while synchronizing warning banners and events directly into the Calendar and Daily Planner:

• Milestone Alerts: Pre-Deadline & Overdue: Zero per-milestone selector friction: pre-deadline alert the day before at 12:00 (shared event anchor) and uncompleted overdue milestone warnings bundled into the 9:00 AM morning summary (capped at 3 to prevent noise). Strictly filtered for active projects (1_Proyectos/).
• Overdue Calendar Banner & Cross-View Navigation: Inspired by the finances warning banner, the calendar now features a persistent banner (non-dismissible until resolved) listing overdue milestones with a direct 'Go to milestone' action. It routes across views and mounts the edit modal safely after project load.
• Highlighted Events in Daily Planner: The Daily Planner top banner now showcases both milestones and scheduled events side by side, unifying daily operations on desktop.
• Centralized Logic & Test Suite: Eliminated duplication by extracting eventOccursOn into lib/events.ts. 30 new unit tests (20 backend, 10 calendar) validate pre-deadline alerts, chronological sorting, timezone isolation in UTC, and archived project exclusion.

A proposition designed to handle small business web presence with rigor, transparency, and full legal guarantees.

• Public & Transparent Pricing: Fixed, publicly listed rates on the website without opaque agency estimates. Custom websites from €1,500 (one-off) and optional monthly managed care from €45/mo with zero lock-in.
• Written Contracts & GDPR: Every engagement includes a formal contract with GDPR data protection compliance and regular written reports detailing completed tasks.
• No Lock-in Guarantee: Domains, SSL certificates, and credentials are always registered under the client's name. If we part ways, full technical handover and documentation are provided.

Comprehensive services backed by hands-on experience running production infrastructure and live e-commerce platforms.

• Tailor-made Web Development: Exclusive mobile-optimized design: corporate presence sites, self-manageable websites with intuitive dashboards, and full custom e-commerce stores with payment gateways.
• Managed Hosting & Security Care: High-performance hosting, periodic tested backup restores, security updates, issue resolution, and written quarterly service reports.
• Direct Support Channels: Same-day response commitment for critical incidents, with direct email and priority communication at servicios.pablorejon.com.

Restructuring catalog rendering so Googlebot autonomously indexes every artwork without relying on client-side JavaScript execution.

• Real Semantic Links: Replaced JavaScript onClick triggers with semantic <a href="/obra/{slug}"> links with client-side click interception, preserving modal smoothness without breaking crawler discovery.
• Schema.org Structured Data: Dynamic injection of VisualArtwork, Product, Offer (EUR pricing, InStock status), CollectionPage, ItemList, BreadcrumbList, and Organization schemas in SeoController.java.
• Pre-rendered HTML & Real HTTP Codes: Injected baseline headers and artwork data inside #root before React mounts, enforced real HTTP 404 status codes (preventing soft-404s), and added permanent 301 redirects for canonical slugs.

Maximizing load speed and visual discovery on Google Images search and Cloudflare Web Analytics.

• Enriched Google Images Sitemap: Dynamic generation in /sitemap.xml with image:image tags (image:loc, image:title, image:caption) to index each painting directly in Google Images search.
• Bundle Size Reduction (-55%) & Fonts: Lazy-loading admin panels, checkout, and user profile routes with React.lazy(), shrinking main bundle from 655 kB to 297 kB (90 kB gzipped). Asynchronous Google Fonts with preconnect for optimal LCP.
• Production Live Verification: Validated live on acamachoart.com with 200 OK responses, verified JSON-LD rich schemas, active Cloudflare beacon analytics, and sub-second load times.

Strict accounting domain modeling compliant with freelance tax requirements under direct simplified taxation.

• 4 Integrated Accounting Books: Implemented regulatory registries: Issued Invoices (revenue), Received Invoices / Deductible Expenses, Investment Assets (with depreciation schedules), and Retainers / Disbursements.
• Secure PostgreSQL Persistence: Backend extended with hasMeaningfulStateData and getInitialState guards to protect the fiscal state tree against accidental hydration race conditions in PostgreSQL.

Client-side standard invoice generation reducing embedded font bundle size from 1 MB to 281 KB with ReportLab-identical typography.

• Helvetica AFM Metrics: Fixed pdfmake font metrics issues via deep import of build/standard-fonts/Helvetica.js, generating pure 5.1 KB vector PDFs with exact kerning and WinAnsi encoding for special glyphs (€, ñ, accents, and 0x97 em-dashes).
• Watermarks & Corporate Styling: Conditional 'BORRADOR' (Draft) watermark rendering on non-issued invoices, paired with a matching corporate palette (#E4F1E8, #1F3A5F, #EAF0F6).

Automating the invoicing workflow directly from completed client projects without transaction duplication or treasury desync.

• Correlative Draft Instantiation: When marking work as billable, the bridge instantiates a draft invoice automatically assigning the next correlative series number (e.g. 2026/003), client metadata, and tax breakdowns.
• Transaction Immutability: The bridge resolves state race conditions, ensuring issued invoices link to existing treasury transactions without double-counting balances or mutating ledger totals.

Preparing the platform for the regulatory requirements of the Spanish VeriFactu billing system (immutability, hash chaining, and QR verification).

• SHA-256 Hash Chaining: Every issued invoice generates a 64-character hex SHA-256 cryptographic hash calculated from document tax fields and the preceding invoice's hash, enforcing tamper-proof ledger continuity.
• PDF Verification QR Code: Automatic QR code injection into the generated PDF containing the verification endpoint URL and fiscal fingerprint for instant audit validation.

Real-time financial visibility to project VAT and Personal Income Tax liabilities and eliminate tax quarter surprises.

• Automatic Tax Form Computation: The dashboard dynamically computes boxes for Form 303 (collected vs deductible input VAT) and Form 130 (20% net income estimation minus client withholding taxes).
• Git Privacy & Security Hardening: Strict isolation of test suites (scratch/, design-autonomo/) via .gitignore and regex audits to ensure zero leaks of NIFs, IBANs, or sensitive tax data into GitHub repositories.

On the gym floor, every superfluous interaction competes with workout fatigue: we strictly decoupled the high-velocity mobile flow from deep desktop analytics.

• Daily Planner Integration: On mobile, workouts sync directly into the Daily Planner as a first-class time-block (e.g. 8:00 AM) checked off with a single tap, eliminating tedious on-the-floor form entry.
• Deep Desktop Analytics: The desktop view centralizes reusable routine design, longitudinal progressive overload analysis, and anthropometric tracking where high information density adds true value.

A bidirectional bridge between athletic periodization and personal calendar management, breaking down isolated application silos.

• Microcycles & Weekly Distribution: Rather than isolating training in a silo, the weekly planner structures microcycles (e.g. Mon: Push, Wed: Pull, Fri: Legs) wired directly into the global timeline and system-wide priorities.
• In-situ Editing & Rapid Rescheduling: When unforeseen events force a schedule change, session dates and times adjust directly from the Calendar card or session editor, reactively propagating to the Daily Planner without breaking historical records.

Heuristic target calculations so athletes never have to recall past personal bests or consult spreadsheets between sets.

• Pre-filling Target Sets & Reps: Upon instantiating a routine for the day, the engine queries the last successful log for each exercise and pre-populates sets with suggested target weights and rep ranges.
• RPE & Dynamic Adjustments: During live workouts, the user simply validates the set with one tap or overrides weight if progressive overload was achieved, eliminating tedious manual typing with tired hands.

Expanding Organizator's P.A.R.A. engine and reusing lightweight visual primitives without bloating the application bundle with third-party chart libraries.

• PROJECT_TEMPLATES Extension: Integrated a dedicated TypeScript-typed gym template alongside existing presets (software, study, travel), structuring persistence schemas and reactive hooks for routines and workout logs.
• Lightweight Native SVG: Reused hand-crafted declarative SVG primitives (FinProjectionChart, FinAnnualBars) to plot training volume, attendance consistency, and 1RM progressions without third-party chart bloat.

Why a truly unified Second Brain vastly outperforms a fragmented stack of four dedicated niche applications.

• Elimination of App-Switching: Training within Organizator eradicates the friction of toggling between Hevy/Strong for lifting, Google Calendar for schedules, Notion for notes, and banking apps; the entire personal workflow lives in the same reactive data tree.
• Real-World Mobile Learnings: Daily dogfooding under real conditions (sweaty hands, busy gym sessions) proved that top-tier mobile UX is not about adding more inputs or complex controls, but engineering systems where 90% of the data computes itself.

We transformed the 1500+ line monolithic component into a decoupled ~225-line orchestrator, isolating pure clinical logic into specialized hooks and reusable card components.

• Architecture & Hooks: State separation into useTriageForm.ts (60s auto-save, escalations, and mutations) and pure clinical logic in useClinicalAssessment.ts (NEWS2, SIRS, PEWS scoring and automatic beta-lactam allergy detection).
• Componentization: Creation of atomic cards under workspace/ (PatientData, PatientVoice, ClinicalTriage, VitalSigns/Glasgow, TestsAndExam, Differential, Disposition, and ActionBar).
• State Bug Fixes: Score recalculation now respects live user-edited patient age, discharged records enforce strict read-only lockouts, and auto-save is consistent across all cards.

We designed a realistic emergency workflow tailored to hospital roles, establishing clear boundaries between waiting-room triage and the hospital's central HIS.

• Reverse Isolation & Glasgow: New 'Reverse / Protective' isolation type with dashboard badge, contextual tooltips on all Glasgow Scale buttons (Motor, Verbal, Eye), and a collapsible guide with coma alert threshold (≤8).
• 7 Triage Dispositions & Nursing Role: Implemented 7 dispositions (Discharge, Priority, Beds, Observation, Critical, General Waiting, External Transfer). Only Discharge and Priority close the encounter; others re-queue the patient. The new NURSING role is barred from discharging (enforced via server HTTP 403).
• Scope Delimitation: Removed bloated medical evolution features to avoid duplicating the HIS, retaining the Diagnostic Tests & Physical Exam card and immutable re-triage history.

We equipped TriajIA with hospital interoperability capabilities through secure, asynchronous webhooks compatible with global standards.

• triage.disposition Webhook: Asynchronous dispatch with hospital-configurable HMAC-SHA256 signatures. Highly resilient: if the HIS endpoint is down, disposition completes in 37 ms without blocking the clinician.
• Standards Mapping: Documented direct mapping to HL7 v2 messages (ADT^A02 and ADT^A03) and FHIR R4 resources (Encounter and Observation) in docs/integracion-his.md.

We hardened the platform against cross-tenant data leaks and stabilized the infrastructure for continuous deployments.

• Cross-Tenant Leak Patched: /api/triage/* and administrative endpoints now strictly enforce requireTriageAccess. Superadmins are completely restricted from viewing patient health records.
• Idempotent Seed & Ports: Set a deterministic HOSPITAL_ID in prisma/seed.ts, preventing re-seeding from invalidating active JWT sessions. Unified local environment on port 3000.
• Soft-Locks & Cleanup: Automatic 30-minute soft-lock expiration for abandoned sessions, elimination of legacy Math.random Manchester fallbacks, and purging of sensitive debug logs.

We implemented comprehensive test coverage with Vitest and organized technical documentation in docs/ as a robust foundation for the thesis defense.

• Vitest Suite (31/31 Tests): 24 unit tests (NEWS2/PEWS clinical scoring, lock expiration, HMAC signing) and 7 integration tests on live database (collision-free concurrent queueing and RBAC isolation).
• docs/ Documentation: Structured docs/ with security audits, AI evaluation protocols (clinical vignette benchmark & confusion matrix), architecture, HIS integration, and master reading index.
• Code Quality: 0 lint errors, 0 strict TypeScript errors, and flawless Next.js production compilation.

We decided to decommission the Football Manager project from production due to its high RAM and disk storage footprint, prioritizing active applications.

• Resource Footprint: The monolithic Java 21 app and its database consumed over 370 MiB of constant RAM. Alongside two other apps and three Postgres instances, this saturated the 3.7 GB VPS.
• Deletion & Space Recovery: Destroyed containers/volumes and cleaned images/Maven build layers (docker system prune -af), recovering 2.13 GB of disk space and removing source code and Caddy routes.

We configured and deployed the Art Gallery (Bramasole) under the commercial domain acamachoart.com, enabling routing, HTTPS, and secure CORS.

• Routing & Certificates: Caddy performs permanent 301 redirects from old domains (sslip.io and galeria.lab.pablorejon.com) to acamachoart.com with active Let's Encrypt SSL certificates.
• CORS & Env Variables: Updated allowed CORS origins in SecurityConfig.java, the base URL in application.properties/docker-compose, and injected APP_BASE_URL into the VPS .env.
• Compilation & Verification: Corrected missing imports in PictureRestController.java that caused minor package packaging errors, rebuilding the image cleanly. The site is live at acamachoart.com.

I purchased the pablorejon.com domain via Cloudflare Registrar for its fair pricing and control panel, consolidating my DNS resolution for my entire infrastructure.

• Domain Registration: Registered the pablorejon.com domain through Cloudflare Registrar, securing Whois privacy protection and direct control.
• DNS Management: Configured A records to point to my Hetzner VPS, along with CNAME wildcards to route my projects' subdomains.

Reconfigured the Caddy web server on my VPS to route all projects and sub-applications under the new domain with automatic HTTPS.

• Routing Rules: Modified the Caddyfile to replace the old host, mapping individual subdomains (e.g., repon.pablorejon.com) to their respective Docker containers.
• Vessel Integration: Updated the VESSEL_BASE_DOMAIN variable in my container orchestrator to automatically provision subdomains under the new DNS zone.
• Football Manager (fm.lab.pablorejon.com): Migrated to the new fm.lab.pablorejon.com subdomain with a permanent 301 redirect in Caddy, removed plaintext credentials from the documentation (README), and validated caddy-register fail2ban rules.
• Art Gallery (galeria.lab.pablorejon.com): Migrated the gallery app to galeria.lab.pablorejon.com by updating CORS allowed origins in SecurityConfig.java, the base URL in application.properties / docker-compose, and setting up a 301 redirect in Caddy.

Established my custom professional email address by linking the domain to Zoho Mail using verification and security records.

• MX & TXT Records: Added Zoho's MX records for email delivery along with the TXT verification key to prove domain ownership.
• Email Security (SPF/DKIM/DMARC): Set up SPF records, DKIM signatures, and DMARC policies to guarantee email deliverability and prevent spam classification.

The production system suffered a complete wipe. The root cause analysis revealed a Docker volume misconfiguration and a flaw in our state synchronization protocol.

• Ephemeral Docker Postgres: The docker-compose.yml failed to link the 'postgres_data' host volume, writing data inside the container's ephemeral storage. Recreating the container reset the database.
• The Sync 'Wipe Effect': When the database started blank, a clean client (with empty localStorage) logged in and sent a 0 KB POST. The server accepted this empty state, wiping the user's real remote data.

We recovered a database dump from June 9, but to save the data from June and July, we conducted a forensic extraction from Brave's local storage files.

• Consistent Dump Restore: Restored the latest consistent database state (June 9) from the local 'database_dump.sql' backup file and recreated the user row in Postgres.
• LevelDB Forensic Extraction: Located Brave's compressed SSTable files on the local disk and used a Python script (with Snappy decompression) to extract the 'second-brain-storage' JSON blob up to July 1st.
• Merging & Full Rescue: Merging the dump and LevelDB recovered 119 transactions (90 dump + 29 Brave), 6 recurring flows, 3 active debts, and 132 tasks, habits, and projects progress.

To immunize the system against future incidents, we designed and implemented a three-tier protection architecture across the backend, database, and external backups.

• Sync Anti-Wipe Guards: The backend rejects empty /api/state payloads with a '409 Conflict' if remote data exists. In the frontend, Zustand (localWins) forces remote download if the browser cache is blank.
• DB Versioning Trigger: Table 'app_state_history' and a 'BEFORE UPDATE' Postgres trigger that archives the last 30 state versions per user, enabling instant rollback to the exact second.
• Automated Encrypted Backups: Daily cron job 'setup_backups.sh' at 04:00 AM performing pg_dump, zipping .md files (PARA), and uploading to Google Drive via rclone with symmetric encryption (gdrivecrypt) and 60-day retention.
• Manual Frontend Export: Added an 'Export my data' button in the sidebar that downloads a complete local JSON backup of your digital life in one click.
• Recovery Drill & Takeaway: Experiencing this incident early on was a blessing in disguise, forcing us to harden the system before growing. We performed a complete restore simulation from the encrypted Google Drive backup, and it worked flawlessly in minutes.

I have defined the project structure and the development plan split into three incremental phases to achieve a functional MVP.

• Tech Stack: Go 1.22+ (native net/http), CGO-free SQLite (modernc.org/sqlite) for an ultra-lightweight binary, and HTMX for SPA-like responsiveness.
• NFC Flow & Security: Physical scan opening a URL with an HMAC-SHA256 signed token to prevent malicious data injection. Duplicate tap increases quantity.
• Real-Time & Offline-First: SSE events for live sync and Service Worker to keep the PWA working offline inside the supermarket, queuing checkmarks.
• Roadmap (3 Phases): Phase 1: local core functionality. Phase 2: SSE + offline PWA. Phase 3: deployment with Vessel (Hetzner) behind Caddy and writing NTAG213 tags.

The project is now fully developed! We overcame a critical networking hurdle during production deployment with Vessel, and we are now just waiting for the physical NFC stickers to arrive for pantry placement.

• Docker Network Conflict (Caddy API): Caddy secured its admin API (port 2019) to localhost. When vessel-core tried to register Repón via http://caddy-caddy-1:2019, the connection was refused, resulting in an ERR_SSL_PROTOCOL_ERROR.
• Admin API Solution: Modified the global configuration block in the main Caddyfile (admin 0.0.0.0:2019) to allow admin requests from other containers sharing the VPS private docker network.
• Base Domain Sync: Adjusted VESSEL_BASE_DOMAIN in the server's .env to the real domain (pablo-server.178.105.2.24.sslip.io), allowing Vessel and Caddy to dynamically provision HTTPS automatically upon deployment.
• Next Steps: App 100% finished. The PWA is installable and works offline. Pending only the delivery of physical NTAG213 tags to write them and perform the final physical setup.

While trying to access Repón's admin panel, we found that the configured ADMIN_PASSWORD was not being injected. This led us to debug and enhance Vessel, our custom PaaS, resolving issues on both client and server sides.

• Client CLI Issue (vessel.sh): The local CLI script ignored the env block when serializing the deployment JSON payload. We fixed it using a Python inline command inside vessel.sh to correctly map and inject the env field into the POST request.
• Vessel Backend (vessel-core): The Go API lacked mapping for Env in its AppRequest struct and failed to pass it to the Docker container setup (Config.Env). We added native support to parse and inject env vars when spawning the container.
• Compilation Path Cache (VPS): Recompiled in vessel-core, but the VPS docker-compose targeted the root path instead. Moving the fixes to the actual root solved the cache and applied the new Go executable.
• Global PaaS Enhancement: With these changes, Vessel now natively supports and dynamically injects any environment variables into containers, making the platform much more robust and versatile.

We added two critical enhancements for usability and security: an interactive checkout flow that atomically clears the database and dynamic secret interpolation in Vessel.

• Smart Clearing (Checkout Flow): Replaced automated scheduled tasks with an interactive flow. Once shopping is done, the user clears checked items (checked = 1) in SQLite via HTMX (POST /items/clear-checked), broadcasting the deletion live via SSE.
• Secret Interpolation: To avoid exposing credentials in version control, we set up vessel.json with variables like ${FAMILIAR_PASSWORD} and implemented dynamic interpolation using os.ExpandEnv(...) in the VPS Go orchestrator.
• Secure Production Injection: Vessel now reads the actual secrets from the VPS host .env file and injects them into the Docker container during deployment, keeping the application repository clean of credentials.

To solve this challenge, I designed and integrated a real-time banking synchronization system using the Enable Banking API (AISP - Open Banking / PSD2) to securely connect Organizator's backend with Revolut.

• Secure Authorization Flow (OAuth2 / PSD2): Implemented the official bank redirection flow. The backend requests a temporary link, redirects the user to Revolut to authorize accounts, and a callback exchanges the code for long-lived access tokens.
• Security & Cryptography: Requests signed via JWT (RS256) using a private .pem key mounted on secure Docker volumes. Strictly read-only access (AISP) with zero transaction risk.
• Background Sync: Automated service in Node.js/Express that runs if more than 4 hours have passed since the last sync when opening the app.
• Deduplication Algorithm: Filters transactions via deterministic hash and dynamic similarity (dates, exact amounts, text patterns) to avoid duplicating manual entries, featuring auto-cleanup in PostgreSQL.
• Frontend Consistency: Balance normalization on React (Vite) to update the user's financial pockets instantly.

To boost the utility of the bank sync, I designed and implemented a Reconciliation Module for Shared Expenses (Bizums / Shared Costs) to manage pending refunds automatically without duplication.

• Heuristic Smart Matching: Analyzes expenses marked as 'To be refunded' and automatically looks for equivalent incoming transactions (Bizums/transfers) with the same amount in a +/- 7 day window to suggest linking in one click.
• Category Decoupling: Eliminated UX friction (where incoming Bizums default to 'Other') by allowing the manual search engine to list all income from any category over the past 30 days.
• Dynamic Auto-Categorization: Upon confirmation, the background state updates linking records with reconciliation flags and automatically applying the 'To be refunded' category to the income.
• Clutter Reduction: Designed the '✓ Refunded' visual badge and hid resolved movements by default, adding a 'Show refunded' toggle filter for auditing.

To solve the issue of shared expense tracking (Bizums inflating income and distorting expenses), I designed and implemented a flexible 1-to-N reconciliation engine and an optimized mobile UX.

• Category Decoupling (toReturn Flag): Expenses retain their original category (e.g., 'Parties') while activating an interactive 'Wait for refund?' flag. Stats now compute the actual net spending of that category.
• Net Spending Engine Algorithm: Computes in real-time: Net Spending = max(0, Original Expense - sum(Bizums Received)). If it reaches 0.00 €, it is automatically hidden from the main feed to eliminate visual noise in category charts and Sankey diagrams.
• Smart Reconciliation Assistant: Scans transactions within a ±15-day range to suggest automatic matches. If ignored by the user, it reveals a manual selector with search capabilities extended to the last 45 days.
• Mobile-First Consistency (MobileDevoluciones): Migration of complex flows to the dedicated MobileDevoluciones view, adapting container heights dynamically via elastic padding to prevent text clipping in Safari iOS and Android.

We performed a deep restructuration of Organizator's financial module, simplifying the UI, implementing a future net worth projection engine, and refining transaction reconciliation & amortization.

• UI Simplification & Cleanup: Removed redundant tabs (Balance/Budgets). Directly integrated debts and Net Worth into the main sidebar. Relocated the asset Donut Chart to the Annual tab in a two-column grid alongside insights.
• Net Worth Simulator: Predictive engine (useMemo) projecting 6, 12, or 24 months of pocket balances by accounting for recurring flows, debt amortization, and temporary manual simulated events. Displayed via SVG trend chart (FinProjectionChart) and monthly breakdowns.
• Smart Reconciliation & Conversion: Allows linking recurring flows with real bank records. Automatically converts bank expenses/income into internal Movements (like transfers to TradeRepublic or Indexa) under the same unique ID to prevent duplicates in bank synchronization.
• Live Amortization & Actions ⋯: Amortizes the actual balance of debts in real time upon confirming linked transactions. Reduced visual noise by hiding mass actions behind a tidy dropdown ⋯ menu with click-away auto-close and ellipsis text truncation.