6 AI-native products, built end to end and self-hosted.

Products

Each with its primary use and the thing that makes it different. Status is checked live from your browser.

1. Product · since 2024

   DataPilot

   ask, query, govern and automate enterprise data

   Demo on request14 scenes on film

   Full size

   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   8. 
   9. 
   10. 
   11. 
   12. 
   13. 
   14. 

   One analyst's afternoon on the demo: a question becomes a grounded answer with a table and a chart, the same question as SQL with its profile and plan, quality rules on the invoices table and a run that scores it and lists the failing rows, the assistant's assumptions vetted by a person, the knowledge graph behind it, a Weave flow quarantining bad rows, an agent pausing for approval, a coordinator investigating with SQL tools, faceted search, a narrated data story, and the access matrix that governs it all.

   The 14 scenes, in order

   1. Ask in plain words. The router picks an engine, finds the right tables, answers with a table and a chart
   2. Or write the SQL yourself: the join runs, then the profile and the query plan
   3. Quality rules on any result: forty rule types, here a custom expression that totals must add up
   4. Run Checks: a quality score, the rule that fails, and its 235 failing rows, every one a credit memo
   5. The assistant shows its assumptions and a confidence. A person vets or rejects them before the answer stands
   6. What grounded it: the connection's knowledge graph, 34 tables and 585 foreign keys as an ERD
   7. Relationships learned from the schema, abbreviations and golden queries, per connection
   8. A Weave flow runs: 1,500 invoices checked, 259 quarantined, 1,241 clean ones enriched and written to S3
   9. An agent checks whether the lakehouse is stale, then pauses: the refresh needs a person's approval
   10. In Monitor the run waits. One click approves it; the refresh flow runs and the workflow completes
   11. A coordinator agent investigates on its own: lists the tables, describes one, runs the SQL, answers
   12. Faceted search over 3,000 procure-to-pay documents: tick two facets and every chart re-cuts
   13. A data story plays itself: narrated scenes built from the same queries
   14. Who may see what: per connection, a role gets unrestricted, metadata-only, granular or blocked access

   Primary use. One platform to ask, query, govern and automate enterprise data. Chat streams answers over WebSocket through four engines — plain LLM, agentic (live tool calls), RAG (knowledge-graph-grounded SQL) and an auto-router that picks the engine per turn and shows why — with voice in/out, attachments, inline tables and charts, and per-response cost. A multi-tab SQL workbench (schema-aware autocomplete, database navigator, cache-backed grid) with analysis tabs for AI-to-SQL, pivot, profiling, execution plan and data-quality rules. A three-layer semantic catalog (physical → logical → canonical) with a schema graph. Weave: a visual data-flow builder — CSV/Parquet/Trino sources, joins, transforms, quality nodes, SQL/stored-procedure/API call-outs — run as scheduled tasks with parameters, variable sets, retries and notifications. Orchestrate: agentic workflows on the same canvas — manual, chat, cron or webhook triggers; LLM prompt, intent router and field extraction; SQL, HTTP, Slack and Weave steps; branching, loops and merges. A Monitor over every flow, task and workflow run; Projects and masked variable sets; Facets (faceted-search dashboards), data Stories, Notebooks and a control-room Home with KPIs, run feed and next scheduled runs. Connects 30+ database engines, REST APIs and files, plus a Trino data-lake admin. Ships as an 11-container Docker Compose stack.

   Differentiator.Grounded, not guessing — every connection carries its own knowledge graph (abbreviations, discovered relationships, golden question→SQL pairs) that RAG retrieves before writing SQL, and the assistant clarifies instead of guessing when a question is ambiguous.

   Agents that do work, with a human in the loop: a Coordinator Agent spins up dynamic sub-agents, delegates or fans out to other workflows, streams its run live, and pauses at a Wait for Approval step (suspend/resume) before anything consequential; any workflow can be exposed as an agent inside Chat. Governance built in: roles are data behind an auditable permission switchboard; every route declares its authorization check and coverage tests fail the build when one doesn't; object-level data access, per-role tool permissions (run / export / AI / share / DQ), SSO via Keycloak or Entra ID with ID-token verification, PKCE, back-channel logout and session revocation. External systems are chat tools over MCP — Jira/Confluence, GitHub, SharePoint (with RAG indexing) and any connected database as read-only SQL — each toggled per conversation.

   Governance. Built in, not bolted on. Auditable role permissions, object-level data access, coverage tests that fail the build when a route lacks an authorization check, and SSO via Keycloak or Entra ID.

2. Product · since 2025

   IDIA

   cross-system discovery, lineage, governance and operations for the enterprise data estate

   Demo on request11 scenes on film

   Full size

   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   8. 
   9. 
   10. 
   11. 

   Walking the demo estate: ask what a change breaks, find anything across four systems, trace lineage, read a Power BI report and hop into its semantic model and back, check health, work out run order, govern, and draft a mapping for a person to review.

   The 11 scenes, in order

   1. Ask across systems: what breaks if the vendor master changes?
   2. Find anything across four systems, then open it: owner, domain, tags, columns, quality, relations
   3. Lineage: what feeds a gold table, traced across every system
   4. A Power BI report, read by the app: findings per visual, which visuals a column change would touch, and every field one click from its model
   5. The model behind it: a star schema with its relationships, each table traced from lakehouse to report, and the report one click away
   6. A notebook, read by the app: its data flow drawn and its documentation written from the code
   7. The whole estate as one knowledge graph
   8. Is the data healthy? Rules, incidents, and what needs a person
   9. Autodependency works out the run order from what each job reads and writes
   10. Govern: owners, a glossary with approvals, classifications
   11. AI drafts the mapping; a person reviews before anything reaches IDMC

   Primary use. One place to find, understand, govern and run the data estate — a discovery and intelligence layer over Dynamics 365, Microsoft Fabric, Oracle EBS, Informatica IDMC, SharePoint and Azure DevOps. Automated metadata and end-to-end, column-level lineage extracted into a queryable knowledge graph; faceted search across enterprise systems (Meilisearch) by domain, owner, tag, tier, certification and quality; navigate an object's relationships, where its data comes from, what depends on it and what a change would affect; Fabric and D365 exploration; data-quality rules, incidents and escalating alerts; dependency-driven orchestration that derives run order from what each job reads and writes, then runs, holds and resumes it under policies — parallelism caps, retries, timeouts from the history, blackout windows, a freshness skip and a side-effect gate — with estimates and notifications; AI-drafted Informatica mapping specs as validated proposals, pushed through IDMC's own import API once reviewed; and conversational discovery backed by search, embeddings, RAG and graph relationships. Built after evaluating the platforms' own tools and finding none that gave cross-system discovery, navigation and dependency visibility.

   Differentiator.Ask questions across systems and databases as if they were one — federated, natural-language querying that spans sources never integrated into the data warehouse, using the knowledge graph to resolve where the data lives and how it joins.

   Turns lineage into living knowledge: documentation generated from the graph — full lineage, a data dictionary, flow diagrams, dependencies and plain-language explanations — with impact analysis (what feeds what, who depends on it, what breaks if it changes). Enough to hand over an unfamiliar estate without a meeting: the documentation is generated from the graph rather than maintained by hand, so a team can trace what feeds what and what breaks if it changes by reading it. Discovery, governance, quality and operations in one app under one permission model: single sign-on through Entra or Keycloak, role-based and object-level access, every action in an audit log. AI drafts, humans commit — drafted mappings are proposals, the administration agent holds writes as pending actions, and in demo mode writes are refused outright. Can run fully on-premises with local inference (Foundry Local / Ollama), local embeddings and a QLoRA fine-tuning pipeline, so no data need leave the environment.

   Governance. Owners, tiers and classifications; a glossary with hierarchy and an approval workflow; domains and subdomains; data products with contracts and health checks; certified business metrics with their inputs; and automations that apply or propose changes for a steward to review. Requests and an activity feed keep changes auditable. A governance dashboard tracks ownership, documentation and quality coverage across the estate rather than per system, and change-impact analysis shows every downstream report and pipeline before a source is altered. Quality is enforced rather than asserted: rules bind to assets, run against the table a pipeline writes to, and keep their result history, with incidents and escalating alerts when they fail.

3. Product · since 2024

   Aata

   AI-assisted testing platform for non-coder QA teams, built agent-first

   CheckingOpen honeyguide.ratl.dev14 scenes on film

   Full size

   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   8. 
   9. 
   10. 
   11. 
   12. 
   13. 
   14. 

   One QA lead's arc through the demo: a test starts as a sentence, runs for real with evidence per step, catches a visual change for a person to judge, runs on a phone, then goes beyond the screen into APIs, the database, accessibility, security, an authorized pentest and load, while the platform learns and answers questions from its own data.

   The 14 scenes, in order

   1. A test starts as a sentence. Describe the scenario; the AI proposes the cases
   2. It runs for real: a screenshot per step, and the one assertion that failed, with its call log
   3. The page changed. Baseline, this run, the diff; a person approves or rejects, not the AI
   4. The same spec on a real Android phone, through Appium
   5. Beyond the screen: every API endpoint discovered, and which ones have no test
   6. The database: 34 AI-drafted checks, not-null, unique, referential, freshness, run again live
   7. Accessibility: axe-core scans over time, a score per page, a floor not a certificate
   8. Security: a passive, defensive scan of a page you own, grouped by concern, scored over time
   9. An authorized pentest, non-destructive, with an AI executive summary and an exportable report
   10. Inside a scope that is deny-by-default: only an admin adds a target, proofs stay off unless opted in
   11. Under load: p50, p95, p99 and throughput over time
   12. Meanwhile it learns: a knowledge graph built from every run, heal and crawl, nothing hand-written
   13. So you can just ask. The assistant queries the database as a tool and answers from the data
   14. And everything lands in one index: results, findings and runs across 31 apps

   Primary use. Enterprise QA platform for non-coder testers, positioned against Katalon, Applitools, Xray and Azure Test Plans: a recorder (wraps Playwright codegen) whose click-stream an AI turns into a readable Test Spec with hardened selectors, suggested assertions and named cases; scenario-to-spec generation from plain English; suites that run identically from the dashboard or the CLI; visual regression with a human approve/reject queue; exploratory sessions (charter + timebox, or an automated crawl that records screenshots, console errors, failed requests and an accessibility pass); API discovery (incl. from HAR) that also reports which endpoints have no tests, with coverage kept per scan; database testing at Great Expectations / dbt / Soda parity, read-only; mobile on physical Android devices via Appium with a device agent that polls out through corporate NAT (the UiPath Robot pattern); security (ZAP-baseline passive scan and an authorized pentest runner with benign proof payloads), accessibility (axe-core) and performance (k6-style single-node load, p50/p95/p99); a report engine that turns any module's findings into an AI executive summary and a self-contained HTML deliverable. 272 API routes, 30 modules, 545 tests; OIDC SSO; deployed on Azure Arc-managed servers and at honeyguide.ratl.dev.

   Differentiator.Agents with explicit autonomy policy, not features with an AI button.

   Every AI output is checked before it counts: generated specs are linted for tests that cannot fail; self-healing locators score DOM fingerprints with Similo-weighted similarity (ACM TOSEM '23), verify the candidate visually with OpenCV, fall back to coordinates only as a last resort, and refuse to heal when unsure — the same fingerprint model on web and Android. A tool-using assistant (streaming, Anthropic or any OpenAI-compatible model) answers from the page's own context and can query the database or run a suite as tools; a per-app Knowledge Base accumulates from every recording, passing run, healed locator and crawl — nothing hand-authored — and a GraphRAG index grounds the assistant. Phoenix, the module through which the product changes itself: feedback → scan → backlog → stories, governed by ITIL-style risk tiers — low-risk changes are planned, coded on a branch and opened as a PR autonomously; medium waits for approval before the PR; high plans only; no tier can merge, touch control paths or exceed its file/line budget, and tests must pass. Prior art first: the recorder wraps codegen, healing follows Healenium/Similo/Applitools research, DQ checks are the industry parity set — parity is built before novelty.

   Governance. Treats data quality as a testable control. Rules written as Great Expectations, dbt and Soda-style checks run as repeatable suites against the database, and AI drafts new checks from the schema knowledge base, so quality requirements are verified with evidence on every run instead of asserted.

4. Product · since 2026

   HawkDeck

   self-hosted infrastructure control plane with an AI operator

   CheckingOpen hawkdeck.ratl.dev14 scenes on film

   Full size

   1. 
   2. 
   3. 
   4. 
   5. 
   6. 
   7. 
   8. 
   9. 
   10. 
   11. 
   12. 
   13. 
   14. 

   One operator's morning on a real estate: the overview says what needs a decision, the fleet is hypervisors, Linux, Raspberry Pis, a firewall, identity, two tailnets and the edge in one console, a machine is watched live down to its sensors, its containers and its security audit are a click away, alerts are one cause per device, exposure shows who is knocking from outside, the assistant answers from the stored observations, and every action waits for a person.

   The 14 scenes, in order

   1. Every device, its health and what needs a decision, worst first; capacity and risk below
   2. A mixed fleet: Proxmox hosts, Linux over SSH, Raspberry Pis, a firewall, Keycloak, two tailnets and Cloudflare
   3. One machine, live: 72 CPUs sampled every two seconds, 38 temperature sensors, memory, disks, network
   4. Its containers: image, state, ports, CPU and memory, with start, stop, restart, logs and remove
   5. Its security audit: CrowdSec, the findings trend, and each finding with its remedy written out
   6. Alerts: one cause on one device however often it is re-observed; open one, see the packages, act
   7. Exposure: what can be reached from outside, through what, and who has been trying
   8. The clients that were flagged, on a map, and how the risk score is made
   9. Every public hostname the edge publishes, what it leads to, and how much was blocked
   10. Ask in plain words, on any page. The assistant queries the estate, states its assumptions and confidence, and charts the answer
   11. Every action proposed, approved, rejected or expired, by whom, with its result: the human gate
   12. A terminal and a file explorer on the machine, for a person; an AI identity can never open one
   13. Underneath, a knowledge model of the estate: assets, relationships, evidence; the perimeter mapped
   14. Integrations are adapters behind one interface: servers, hypervisors, network gear, the edge, identity

   Primary use. One console to observe and act on a mixed fleet — Linux, Windows, Proxmox guests (noVNC console relayed through the backend), Redfish BMCs, SNMP switches and OPNsense firewalls — with health, services, processes, storage, Docker, terminal, file explorer, security audits and patching; a Cockpit-class control plane for multi-vendor infrastructure.

   Differentiator.An evidence-based infrastructure knowledge model (entities, relationships, collection runs, evidence, memories) that the AI assistant reasons over to propose actions — humans approve; AI identities can never approve, operate files or open terminals.

   Pluggable inference providers (Anthropic, OpenAI, Gemini, Ollama, custom) with Fernet-encrypted credentials.

   Governance. Least privilege and accountability by default. Devices are read-only until access is granted, OIDC SSO maps role claims to permissions, and every action leaves an audit record. Forensic snapshots and file-integrity checks preserve evidence, and the approval step is reserved for humans.

5. Product · since 2026

   Kite

   browser-based remote-access gateway (gateway + client)

   CheckingOpen kite.ratl.dev

   

   Primary use. One authenticated browser tab reaches every machine over RDP/SSH/VNC and every remote file store — replacing mstsc + PuTTY + WinSCP + a jump host; multi-session tabs, ⌘K catalog, SSO (Keycloak/Entra) + TOTP, RBAC, Guacamole-compatible import/export; embeddable via iframe + postMessage bridge (runs inside HawkDeck at /kite/).

   Differentiator.Built AI-first — the gateway sees every session, so AI providers, session summaries and command-risk rules are modelled in the server for a context-aware assistant that answers against the active surface (open file/grid/query, terminal scrollback, desktop screen) and a command-risk guard that holds destructive commands for approval (in progress).

   Governance. One controlled entry point to every machine and file store. Access is authenticated through SSO with TOTP and scoped by RBAC, and credentials and network reach never leave the server, so users work on remote systems without ever holding the secrets to them.

6. Product · since 2026

   Vitai

   the AI-assisted resume product this page runs on

   CheckingOpen resume.ratl.dev

   

   Primary use. A professional's history as structured facts with lineage, published as a living page: one record renders the resume, a 60-second Career Story, an Insights dashboard and a Beyond Resume view, with a grounded assistant that answers recruiters' questions from the record and shows its sources. The owner maintains it from a workspace — import the Word resume and review an AI-proposed, path-level diff before it becomes a revision; a knowledge base from documents; layout designer; visitor feedback and call scheduling (email or Microsoft sign-in verification, Teams links). Any candidate publishes at /u/<slug>.

   Differentiator.Not a document and not a network — every claim traces to a product, role or artifact, and everything generated (stories, answers, proposals) cites the record it came from; the assistant answers only from the record and says when it can't.

   Model-agnostic by the owner's choice: Anthropic, an OpenAI-compatible endpoint, or a local model via Ollama, configured in Settings — the import and assistant run fully on-premises on a 3B model. Voice in and out (Piper / Whisper) baked into the API image; built and shipped as a multi-tenant product, with the maker's own resume as the first tenant.

   Governance. Every claim traces to a product, role or artifact. Generated stories, answers and edit proposals cite the record they came from, the assistant answers only from the record and says when it cannot, and every change to the record is a revision with its reason. Runs fully on-premises on a local model when required.

Platform

Everything above runs on one 8-vCPU VM: Docker Compose per app, Caddy in front, a Cloudflare tunnel to the edge, local models on CPU where a key is not worth it.

• Single sign-on

  Keycloak, Entra ID as identity provider

  Checkingsso.ratl.dev
• Object storage

  S3-compatible (RustFS)

  Checkings3.ratl.dev
• Cloudflare tunnel, no open ports Ollama on CPU + Anthropic when configured Keycloak realm shared by the apps