Run by Ned Wolpert — coding since 1981, coding for businesses since 1994. Open-source since 1998, and Codehead Systems since 2005.
The most recent five projects, each with its own discipline — passkeys, password-less cryptography, a teachable identity suite, deterministic decision logic, and the small Java tools in between.
A production-grade, passkeys-first authentication template for the JVM.
Ships as a reusable library set you can drop into a Spring Boot, Dropwizard, or Micronaut application. The core is framework-neutral; the host's user and credential storage is a plug-in SPI.
OPAQUE PAKE — a server that never sees your password.
An implementation of the OPAQUE password-authenticated key exchange, written directly from its RFC specifications. Built on OPRF and elliptic-curve cryptography. The server authenticates the client without ever receiving — or being able to derive — the password.
Java implementation via Bouncy Castle, with a TypeScript client library bundled. Rust, Go, and C# implementations are next, alongside a cross-language test suite.
A readable, educational family of auth & identity services.
A monorepo of six small, deployable services and two shared libraries — each one intentionally small enough to read end-to-end. Real cryptography wired into a single token plane and policy engine, runnable in a homelab.
Envelope-encryption key management.
Machine identity via OAuth2 client-credentials.
Human SSO & OpenID Provider with passkey support.
Forward-auth gateway for reverse proxies.
Identity source of truth.
Internal CA for mTLS workload identity.
Shared token plane & JWKS management.
Authorization decision engine.
Built to teach: a concepts-first course, a code-first reading order, and labs that build and verify tokens by hand. Uses vetted, production-grade cryptographic constructions — though the project itself is unaudited.
A forward-chaining rule engine for services where the rules change more often than the code deploys.
An in-process, JVM rule engine that replaces nested conditionals with declarative rules written in YAML or JSON, validated against a published schema, and compiled once at startup into an immutable, thread-safe structure. The same facts in the same order produce the same firings, on any host, in any year, because the engine owns no clock — decisions stay explainable and reproducible long after they're made.
Working memory, matchers, and session management.
Rule validation and network compilation.
YAML / JSON rule-file parsing — the recommended entry point.
Optional Common Expression Language integration.
Optional fact schema validation.
Tracing, diagnostics, and match explanation.
Test fixtures and verification harnesses.
Pattern matching supports joins, negation (notExists),
universal quantification (forAll), and aggregations
(accumulate) as first-class constructs. Three
independent matchers — a naive oracle, an indexed Rete-style
network, and a streaming matcher — are required to agree on
identical firing sequences.
Small, sharp Java libraries — the things I keep reaching for.
A growing collection of well-scoped tools, extracted from real services so they stay practical rather than aspirational.
Lightweight A/B testing & feature toggles, inspired by an internal Alexa tool.
Test utilities for Jupiter, Immutables, and Jackson. Small, easy to consume.
Test helpers for Cassandra and unique-string generation.
Dropwizard / Micrometer integration with Dagger support and unit-test helpers.
Out-of-process mocking for functional tests — a spiritual successor to Amazon's Chameleon.
A KISS state machine. Import/export, games and services. The simpler successor.
In-process queueing primitives.
These libraries started life inside of other service, then got cleaned up enough to live on its own.