Architecture Practice & Domains

I treat the frontend as a distributed-systems client - not a thin view layer. Every surface is modelled as an explicit state machine with normalized stores, contract-typed BFF aggregation, and deterministic caching boundaries, so UI behaviour stays predictable under failure. Governance is enforced through versioned design-token contracts, WCAG 2.2 AA accessibility budgets, and performance SLOs (INP < 200ms, zero CLS), with component islands and selective hydration used to buy back runtime cost where it matters most.

Enterprise architecture is coherence under constraint: aligning capability roadmaps, funding, and team topologies to boundaries that can actually evolve. I decompose estates around business capabilities using Domain-Driven Design, expose them as TM Forum ODA-style components with versioned Open APIs, and govern change through ADRs, fitness functions, and strangler-fig migration plans. The stance is Clean Core by default - customise at the edge, keep the core upgradeable - with explicit technical-debt ledgers and remediation tranches tied to risk, not fashion.

Integration fails at the contract, not the wire - so I design contracts first and defend them with process. Every API ships with OpenAPI/AsyncAPI schemas, compatibility rules (additive-first, never breaking without a version gate), idempotency keys, and explicit rate-limit and backoff envelopes. A gateway mesh handles auth mediation, protocol translation (REST/GraphQL/gRPC), and telemetry injection, while the transactional outbox guarantees reliable publication from services that cannot afford dual-write drift. Multi-tenancy is mediated, metered, and quota-isolated by design.

Events decouple lifecycles but concentrate complexity in ordering, evolution, and observability - that is where I put the rigour. Producers publish to a schema-registry-validated log with deterministic keys for ordering; consumers are idempotent, checkpointed, and replayable through dead-letter pipelines with explicit redrive budgets. Schema evolution follows compatibility-checked versioning with deprecation headers, and every hop carries trace correlation so an async flow reads like a single transaction in the observability plane. Sagas with compensating actions replace distributed luck.

I treat Salesforce as a governed node in the mesh - a system of record with streaming hooks - never as a closed black box. The operating model is Clean Core: declarative-first, custom code pushed to versioned packages and event-driven extensions outside the core, so upgrades stay boring. Governor-limit defence is architectural (selective SOQL, bulkified triggers, queueables over synchronous chains), sync is CDC/event-led with conflict-resolution rules, and LWC surfaces are decoupled through contract-typed APIs with full CI/CD, scratch-org pipelines, and static analysis gates.

Generative capability only earns production trust inside deterministic boundaries - I wire AI as a bounded tool, never as the control plane. Retrieval grounds every answer in tenant-scoped, cited context with explicit window budgets; outputs are schema-enforced to deterministic JSON envelopes with validation retries and eval-harness regression gates. Routing is model-agnostic behind a gateway with token budgets, PII redaction, and tenant isolation, and agent autonomy (including MCP tool calls) is allow-listed, audited, and reversible - hallucination surface is treated as a failure mode to be engineered out, not prompted around.