VST3, AU, AAX, CLAP, and Standalone plugin formats
One native C++ codebase targeting VST3, AU, AAX, CLAP, and standalone applications.
Loading page.
Engineering
The engineering behind a multi-surface software platform - native C++20 plugins, web services, desktop tooling, validation infrastructure, and architecture visualization - built and maintained solo.
Platform at a Glance
Native plugins, web services, a desktop client, shared C++ modules, and a layered validation stack - all inside a single engineering system.
One native C++ codebase targeting VST3, AU, AAX, CLAP, and standalone applications.
DSP, UI, RT-safety, testing, licensing, and telemetry modules shared across the products that need them.
Next.js services and an Electron client in one workspace, one build graph.
Catch2 for DSP internals, DawDreamer for plugin-as-host, Vitest for web, Playwright for journeys.
Plugin validation, security baselines, drift detection, supply-chain audit, release gates.
Type strictness, secret scan, architecture drift, reproducibility. Caught before CI ever sees it.
System Architecture
The platform is organized as a modular monorepo. Products, apps, cloud services, shared modules, and validation systems evolve inside one engineering system. For the product-facing side, see the company context and the plugin catalog.
Pressure
Shipped dynamics processor
Barometer
Shipped metering and analysis
Stratus
Convolution reverb in development
Ceiling
Shipped true-peak limiter
Flux
Saturation clipper in development
Equilibrium
Spatial processor in development
Website
Next.js 16 - product site + auth gate
Weather Station
Electron 42 - desktop app
Cupola
Three.js architecture viz
Observatory
Hosted VST3/AU release-gate
backend-api
On-demand Lambda revenue runtime with retained rollback
API Gateway
Signed streaming ingress for product and payment traffic
Ground Control
Licensing & update API
Mission Control
Admin dashboard & dispatch
Neon PostgreSQL
Serverless database
CloudFront CDN
cdn.bellweatherstudios.com
Upstash Redis
API rate limiting
Domain layer
Zero-dependency canonical types - compile-time boundary enforced
DSP layer
Native biquads, FFT, smoothing - no framework lock-in
RT-safety layer
Audio thread guards, allocation tracking, scope enforcement
Adapter boundary
Framework confined to one module - everything above speaks stdlib
Plugin infrastructure
Shared UI, licensing, state, presets, testing across all plugins
BPTS
Plugin testing suite (Catch2)
DawDreamer
Python integration tests
BOL Probe
Black-box binary validator
Format-native validators
pluginval / auval / clap-validator / DigiShell
Playwright
E2E journey tests
Observatory
Hosted release-gate + proof artifacts
Shared schemas, native modules, validation tooling, release workflows, and system documentation connect these surfaces. The design token pipeline, RT-safety enforcement, and contract boundaries keep them coherent as one system.
How It's Built
Each one cuts across the entire platform and defines how products, services, and tooling stay coherent.
Python generators emit C++ constexpr headers, TypeScript modules, and CSS custom properties from one JSON. Chosen over per-surface theming because of drift. Color and spacing can look fine in isolation but broken side-by-side. That gap spans the plugin UI and the marketing site. Trade: any token change recompiles every consumer, so drift detection costs more than recompilation.
RtGuard makes audio-thread allocations and locks a build error, not a regression caught after a customer report. Sanitizer-backed validation lanes (ASan/UBSan/TSan/RTSan) cover the runtime side. Chosen over "test for it after it ships" because audio dropouts under host pressure are invisible in normal play and unrecoverable at the customer site.
Catch2 for plugin internals. DawDreamer for plugin-as-DAW-host integration. Vitest for web units. Playwright for cross-surface journeys. That is 250+ plugin test files and 210+ web/E2E specs. Chosen over a single monorepo runner because each layer's failure mode is distinct. A DSP regression and a checkout-flow break are not the same question.
170+ gates run locally in ~20s before push: type strictness, secret scan, architecture drift, reproducibility, public-API exposure. CI then catches escapes, not first-line violations. Chosen over branch-protection-only because a failed merge is a 10-minute round-trip; a failed pre-push is 30 seconds. Trade: every contributor's machine runs the full suite.
Shared kernel admits only code identical across consumers: stable, and free of app-specific knowledge. It is a three-question rubric, not a "best practices" wave. API route safety, error-format consistency, and forward-compatibility are predeploy gates, not conventions. Chosen over architectural decision records alone because docs decay and gates fail loudly. Gate scope is declared by manifests co-located with the source they govern.
Measured traffic showed that fixed ECS, load-balancer, and public-address charges dominated a low-volume revenue backend. The production path moved to Lambda and API Gateway only after payment, licensing, export, authentication, streaming, and reverse-route behavior passed against an immutable candidate. Comparable runtime and ingress cost fell by more than 99% in the first complete post-cutover month and now scales with actual demand, while the predecessor task definition remains reconstructible for rollback. Trade: cold-start, signed-envelope, and lifecycle qualification became standing operational work.
Enforcement Signals
Tests, package boundaries, validation flows, and reproducibility rules guard the architecture at its seams. Public-facing versions of that validation story live in the Testing Suite and Research Notes.
Orchestration routes are guarded by seam tests that prevent transport code from absorbing command logic. Contract schemas are shared across surfaces via workspace packages.
Binary hardening tests verify compiler flags and symbol stripping. A security audit suite covers malicious state injection, buffer boundary attacks, and RSA credential verification.
Format-aware plugin release-baseline orchestrator wraps native validator lanes per format. Each format gets its own: pluginval for VST3, auval for AU, clap-validator for CLAP, DigiShell / AAX Validator for AAX. Hosted qualification via the JUCE-based Observatory app covers VST3 and AU. Named CI workflows run on top: daily contract smoke tests, weekly security and functional baselines, release-candidate gates, and production smoke tests.
Environment pins, doctor checks, deterministic JUCE provisioning, and SHA-256 verified distribution artifacts reduce drift between dev, validation, and release.
Validation Pipeline
Each stage must pass before the next begins. Early stages are cheap and fast; later stages are exhaustive. The full pipeline is documented in the Observatory.
Auto-discover modes, channels, parameter ranges across all plugin formats
Behavioral identity: latency, tail, silence, bypass coherence
Contract-derived transfer, timing, THD, IMD, noise-floor, and frequency-response checks; hardware comparison only where qualified reference data exists
Assertions covering NaN, Inf, DC offset, denormals, and rapid parameter automation
Inject faults into DSP path, verify detection, confirm kill rate before release
Stack
| Layer | Technologies |
|---|---|
| Native | C++20, JUCE, CMake, Catch2, LibFuzzer - VST3/AU/AAX/CLAP/Standalone, universal binary (ARM + Intel) |
| Desktop | Electron 42, Vite, electron-builder |
| Web | Next.js 16, React 19, TypeScript, Tailwind 4, Zod |
| Data | PostgreSQL (Neon), Prisma 6 |
| Visualization | Three.js, React Three Fiber, React Spring |
| Infrastructure | AWS Lambda, API Gateway, retained ECS/Fargate rollback, ECR, Docker, S3 / CloudFront, Vercel, GitHub Actions, pre-push quality-gate system |
| Shipping | Apple Developer ID signing, notarization, Gatekeeper validation, S3/CloudFront warehouse, SHA-256 verification |
| Quality | Sanitizer-backed validation lanes (ASan/UBSan/TSan/RTSan), DawDreamer integration tests, format-native validators (pluginval/auval/clap-validator/AAX Validator), Playwright, BPTS pipeline |
| Codegen | Python - cross-language token pipeline (JSON → C++ constexpr, TypeScript, CSS) |
| CI / Tooling | Bash (CI, hooks), GitHub Actions |
Public Surfaces
These surfaces expose parts of the platform directly. The same thread continues through the blog and the Bellweather philosophy.
Public licensing and API surface. Useful for seeing the operational side of the platform.
Open Ground Control →Architecture visualization surface. Useful for seeing how the platform is modeled and presented publicly.
Open Cupola →The main product site. Useful for seeing how the engineering system is expressed at the product layer.
Open main site →Open-source C++ audio-core library with BS.1770 / EBU Tech 3341 tests, RT-safety primitives, Barometer as a source-built JUCE reference plugin, and bounded diode-circuit and G384 hardware-gain examples.
Open Audio Core →View source →Open-source, headless C++ audio-regression proof layer: bless a known-good render into a signed reference, then verify later renders against it in CI.
Open Audio Attest →View source →Public profile-level context and links into the broader Bellweather engineering story.
Open GitHub →Architecture In Motion
Boundaries, validation flows, and shell-versus-domain seams are explicit and test-enforced. Research notes, bug postmortems, and architecture documents track every structural decision as the system evolves.
The architecture keeps moving because the products and delivery surfaces keep moving. Legibility is the constraint - every decision gets documented, tested, or both.
Numbers on this page are floored from a build-time scan of the repo. Last verified ; a predeploy gate fails the build if they drift.