Thomas Sprayberry

Self-hosted AI workforce platform & agent infrastructure · Greater Atlanta, GA / remote

• Designed and operate askalf, a self-hosted AI workforce platform — an autonomous agent fleet (intake → tickets → specialist agents → pull requests) that runs a software studio end-to-end, with shared memory, trigger-based dispatch, budget controls, and human-in-the-loop approvals.
• Built and govern an agent control plane that sits below the framework: put one firewall (redstamp) in front of four unrelated agent frameworks — CrewAI, LangGraph, OpenAI's Agents SDK, and Microsoft AutoGen — and governed each end-to-end (poisoned-tool strip, destructive-call block, tamper-evident audit) with no framework patches.
• Shipped the Own Your Stack agent-security stack: redstamp (deterministic offline action firewall — risk-tiered, blocks secret-exfil and prompt injection), strongroom (short-lived single-use secret leases; cut a live fleet's 132 inherited secrets to 13), truecopy (skill/MCP supply-chain gate), and fieldpass (governed agent browser). redstamp + strongroom run in enforce mode in production; the stack publishes to npm from tokenless CI via OIDC trusted publishing.
• Ran the supply-chain research behind the stack: poison-scanned 68,560 skills — all of ClawHub (66,541; the registry whose incident started the poisoned-skills panic), the full official Claude Code plugin directory, and nine community marketplaces — and stood up a daily CI tripwire re-verifying the official plugin directory (280 plugins at the August 2026 run) at pinned commits; built arena, an open agent-firewall benchmark scoring four rival firewalls on recall, precision, and determinism in CI.
• Built dario, an OAuth LLM proxy with a self-healing autonomous release pipeline (300+★, MIT), and deepdive, a research agent built on deterministic source-trust scoring.
• Hardened the open-source supply chain end to end: took dario to an OpenSSF Scorecard of 9.4/10 (14 of 18 checks a perfect 10, scored 2026-08-14) with a 100% OpenSSF Best Practices badge — signed, SLSA-attested releases, tokenless npm publishing from CI via OIDC trusted publishing, fuzzing in CI, zero open security alerts — then rolled weekly Scorecard runs, signed releases, and hardened branch rulesets across every public code repository.
• Contributed a fix upstream to huggingface_hub — the client library the Hugging Face ecosystem (transformers, datasets) depends on: diagnosed a Windows long-path bug where the extended-length-prefix guard engaged only above 255 characters while directory creation already fails at 248, closed the 248–255 gap, and added a parametrized Windows regression test; merged by the maintainer on the first pass (PR #4546).
• Diagnosed and fixed real production incidents: a four-day silent embedding-model outage (added a model-presence guard); a class-level shell command-injection fix; an LLM proxy silently corrupting code in transit, proven with a live A/B. Author a public engineering blog (30+ posts), every claim linked to a real PR.

Managed-services provider · Tyrone, GA

• Solutions Architect for all client systems installs and upgrades — full-service architecture from data-center builds to user endpoints.
• Technical lead for all project-based installations: SAN, switches, wireless, firewalls, and servers.
• Tier 3 team lead across the service and project teams, providing escalation support and root-cause resolution.

Enterprise IT infrastructure migration · Atlanta, GA

• Architected the complete IT-infrastructure migration of Atlanta-based Alternative Apparel after its acquisition by Hanes — researched, scoped, timelined, and coordinated the full plan.
• Managed a team of 22 engineers to migrate all servers, workstations, and applications from a Peak 10 data center to Hanes' proprietary data center; primary lead for all technical and logistical issues; completed the full Office 365 tenant migration.

Healthcare services · Atlanta, GA

• Evaluated the infrastructure for survivability, security, accessibility, and performance, then built an IT roadmap aligning business and IT strategy (costs, lifecycles, processes).
• Led a data-center migration end to end, and architected + implemented the full IT infrastructure for a new 400+ user subsidiary (blueprinting, construction, procurement, install, test).
• Streamlined operations with ticketing, monitoring, spam/AV, patch management, and backups; provided Tier 3 support with root-cause analysis and change management.

Managed-services provider · McDonough, GA

• Level 3 support of server, virtualization, storage, network, and firewall for 100+ clients (5 to 5,000+ user environments).
• Led planning and implementation of a large-scale PCI-compliance project for a major restaurant chain; ran growth-coaching sessions to level up Tier 1/2 engineers.

Service-provider data center · Atlanta, GA

• Co-designed a service-provider data center supporting 8 locations and 2,032 tenants — pod design for resource optimization with full mobility, HIPAA/PCI compliance, and tenant isolation.
• Designed a low-cost storage platform: 270 TB raw in a 4U form factor with inline compression, dedup, and encryption at rest. Helped architect a deployment system upgrading 2,000+ XP machines (1,000 VDI sessions in VMware).

Hosting & cloud services · Tampa, FL

• Engineered and implemented hosting and cloud services — built an HA public vCloud stack (vCloud Director, clustered vCenter with heartbeat, MS-SQL cluster, AD, internal CA, load balancers, Orchestrator automation, Chargeback, vShield Manager).
• Led the migration from vSphere 4.x to 5.5.