A-01 · Advisory and engineering practice
Exactly as much architecture as needed.
ArchXS works by an architecture-on-demand method: architectural effort is limited to the decisions that cannot be cheaply reversed, and the time recovered goes into building the working system. This is how I advised on a bank's core system replacement. It is also how I now run a platform of around ten production systems, from production planning to document flow.
300+ IT staff
the scale at which I led an enterprise architecture practice and the architecture of a core banking replacement
237 migrations
of one long-lived system's schema, evolution instead of a grand redesign, every change numbered and reproducible
TOGAF · CGEIT · MBA
plus PMP, PRINCE2, MSP, treated as a library to draw from as needed, not as liturgy
Five convictions. Each defended in its own essay.
- 01
There should be exactly as much architecture as reduces risk.
A full-time architecture practice tends to produce artifacts that justify its own existence. I spend the effort where a decision is expensive to reverse, system boundaries, the data model, identity, and leave the rest to code and a decision log. The method has a pedigree, and it has hard limits; I write about both.
The argument → - 02
Most AI plans will not survive contact with production.
And that can be established before anything is signed. It takes a handful of questions a real plan can answer and a wishful one cannot: who owns the token cost at production volume, where the quality gate sits, and who carries the consequence when the model is wrong.
The argument → - 03
AI proposes, humans decide.
An architectural pattern with a concrete shape: deterministic gates alongside the model, personal data redacted before anything leaves the organisation, a decision trail that cannot be overwritten. I apply it in every system I build, and I know what it costs.
The argument → - 04
Architecture that is not in CI does not exist.
The architecture model lives in the repository and the validator returns an exit code, a change that breaks a standard stops in the pipeline, not in a review six weeks later. Deviations exist, but as dispensations with expiry dates, never as silent consent.
The argument → - 05
Identity is not a login screen.
It is the security boundary of the whole system. Sometimes that leads to writing your own identity-server extension, in my case, signature-based authentication with a single-use nonce against replay, and it still costs less than losing a single source of truth about the user.
The argument →
Seven kinds of problem I have stayed with long enough to know their usual breaking points.
There is no service catalogue here. Each area is described the same way: how I look at it, what I have actually built, and what follows, with named standards and numbers, because generalities carry no accountability.
- 01
Enterprise architecture
Architectural effort proportional to risk, the model in a repository, validation that returns an exit code, instead of documents that protect nobody from anything.
Evidence: EA practice at a bank with 300+ IT staff and a core banking replacement · own toolchain: ArchiMate 3.2 validated against the Open Group XSD, dispensations with expiry dates
- 02
Business processes
Measured losses in the as-is process first, then automation with a state machine and an auditable trail. The other order encodes the faults in code.
Evidence: Polish e-invoicing under FA(3) with whitelist checks and a JPK_V7M(3) generator · debt recovery filed with the e-court over SOAP · ISA-95 planning with a CP-SAT solver
- 03
Cybersecurity & identity
Trust boundaries drawn deliberately: isolation enforced in the database, an audit trail that cannot be overwritten, and a server that takes nothing on trust.
Evidence: Custom Keycloak 26 SPI: EIP-191 with an anti-replay nonce, passkeys · row-level security and a hash-chained audit trail · SBOM and artifact signing in CI
- 04
Applied AI
The model proposes, deterministic code rules, a person approves what goes out, with a known unit cost and a trail behind every decision.
Evidence: Six in-house MCP servers and a WhatsApp gateway for five applications · five verification layers · 2,827 photos from 7 markets → 26,864 observations
- 05
Physical AI
The loop from a teleoperated demonstration to a deployed policy, closing in days, on a staged path where every gate is a place at which stopping is a decision rather than a failure.
Evidence: ISA-95 planning with a CP-SAT solver · an OPC UA (IEC 62541) bridge and MQTT Sparkplug B into TimescaleDB · a four-gate robotics pilot path from simulation to a line cell
- 06
Blockchain & Web3
What must never need changing goes on the chain and stays immutable, everything else sits behind an upgrade boundary designed on purpose, and the buyer is not required to own a wallet in order to buy.
Evidence: A crypto stamp for a national postal operator with 80,000+ staff · an EIP-2535 diamond, 21 facets on Polygon · ERC-6220/7401/5773 composability · an MIT-licensed wallet connector
- 07
Software delivery
Systems built on the assumption that someone else will maintain them: a decision log with the rejected options, an environment reproducible from the repository, tests that actually exclude something.
Evidence: Two backend ecosystems (Java 21/Quarkus, Python 3.12/FastAPI) · OPC UA and MQTT Sparkplug B on the plant floor · golden tests and property-based tests
The principles cost more upfront and pay for themselves the first time the team changes.
As much architecture as reduces risk
Decisions that are expensive to reverse get analysis, a record and a review. The rest are made by the team in code and noted in the log. Risk draws the line, not a methodology template, at the bank that meant a full architecture board; on a product build, one decision log.
Decisions written down, not remembered
Every significant decision gets an entry: context, options considered, why the others were rejected. I also keep build-vs-buy tables with a verdict for each rejected option, a year later, that is the only way to understand a system without archaeology.
Proof instead of assertion
Conformance nobody checks automatically is an opinion. Validation belongs in the pipeline and returns an exit code; the audit trail is written to a structure a database trigger will not let anyone overwrite. Then conformance stops depending on memory.
AI proposes, humans decide
The model suggests, deterministic code rules, a person approves anything that leaves the organisation. Slower and less impressive in a demo, but it can be shown to an auditor together with the rationale for every suggestion.
Three engagements that show how the work is done.
Some are public by the nature of the project. Others are described by sector, without names, the ordinary price of working inside organisations that do not publish their architectures.
Development banking, public sector
Replacing a core banking system is an organisational problem
How to run the largest technology transformation in a bank's history when the difficulty lies not in the new system but in the volume of parallel decisions and cross-team dependencies.
Pet food manufacturing, B2B private label
Ten internal systems without ten separate stacks
How to build a dozen internal systems for a manufacturing plant and its sales operation without reaching the point where maintenance costs more than the build.
National postal operator
A postage stamp on a blockchain, for a buyer with no wallet
How to issue a philatelic release with an on-chain counterpart without losing the regulated status of a postage stamp, and without requiring the buyer to understand crypto.
Things that exist.
Instead of a wall of client logos: code you can read and products you can click.
Open tooling
Enterprise architecture toolchain
A model in git compiled to ArchiMate 3.2 Open Exchange validated against the Open Group XSD; standards with a lifecycle, dispensations with expiry dates, validation as a CI gate.
Identity server extensions
Custom SPI for Keycloak 26: authentication by cryptographic signature (EIP-191) with a single-use nonce, OTP, passkeys.
@archxs/keycloak-wagmi
npm package (MIT): a connector for IdP-managed EVM wallets, EIP-1193 and ERC-4337 smart accounts.
Accounting assistant for sole traders
A self-hosted alternative to SaaS: Polish e-invoicing under the FA(3) schema, tax filings, an LLM agent, around 180 tests.
Live products
- ticbottoe.lol ↗
An arena where language models and humans play on one Elo ladder. Every ranked game is replayed and validated server-side; the user's API key never leaves the browser.
- bindaro.io ↗
A digital collection platform: web and mobile, seven languages, multiple chains, an analytical agent.
- cryptocolony42.com ↗
The Colony Wars on-chain game and Henomorphs collection ecosystem: web and mobile, over 440 Solidity contracts on the Diamond pattern, ERC-4337 smart accounts.
Credentials
- TOGAF
- CGEIT
- PMP
- PRINCE2
- MSP
- Executive MBA
Written from the inside.
With the numbers, the costs and the parts that did not work. No sign-up and no paid continuation.
- Architecture
Architecture on demand
Architectural effort is a cost and needs a justification. The justification is risk: the measure of how much architecture is needed is the cost of reversing a decision, not the size of the project.
- Compliance
What KSeF rollout plans do not show
Integrating KSeF 2.0 is decided not by the FA(3) schema but by deduplication, idempotency and accepting that an invoice is a legal event rather than a file.
- Applied AI
An AI plan that survives production
Six questions a board can use to test its own AI rollout plan, or a vendor's proposal, before signing anything. A real plan has answers to all of them.
Questions that usually come first.
contact@archxs.com
I reply within two working days. A contact form is on the contact page, for those who need it.