Engineering
The engineering behind a multi-surface software platform - native C++20 plugins, web services, desktop tooling, validation infrastructure, and architecture visualization - built and maintained solo.
Platform at a Glance
Native plugins, web services, a desktop client, shared C++ modules, and a layered validation stack - all inside a single engineering system.
VST3, AU, AAX, CLAP, and Standalone plugin formats
One C++ codebase, every host on the market: VST3, AU, AAX, CLAP, Standalone.
30+ shared C++ modules
DSP, UI, RT-safety, testing, licensing, telemetry. Built once, consumed by every plugin.
10 web & desktop apps
Next.js services and an Electron client in one workspace, one build graph.
230+ plugin test files, 140+ web/E2E specs
Catch2 for DSP internals, DawDreamer for plugin-as-host, Vitest for web, Playwright for journeys.
40+ CI workflows
Plugin validation, security baselines, drift detection, supply-chain audit, release gates.
115+ pre-push gates in ~20s
Type strictness, secret scan, architecture drift, reproducibility. Caught before CI ever sees it.
System Architecture
The platform is organized as a modular monorepo. Products, apps, cloud services, shared modules, and validation systems evolve inside one engineering system. For the product-facing side, see the company context and the plugin catalog.
Native Products
Pressure
Dynamics processor
Barometer
Metering & analysis
Stratus
Convolution reverb
Ceiling
Limiter
Flux
Earned saturation clipper
Equilibrium
Spatial processor
Web & Desktop
Website
Next.js 16 - product site + auth gate
Weather Station
Electron 42 - desktop app
Cupola
Three.js architecture viz
Observatory
Hosted VST3/AU release-gate
Bellweather Cloud
backend-api
Node service on AWS ECS Fargate (revenue runtime)
Ground Control
Licensing & update API
Mission Control
Admin dashboard & dispatch
Neon PostgreSQL
Serverless database
CloudFront CDN
cdn.bellweatherstudios.com
Upstash Redis
API rate limiting
Native Shared Kernel
Domain layer
Zero-dependency canonical types - compile-time boundary enforced
DSP layer
Native biquads, FFT, smoothing - no framework lock-in
RT-safety layer
Audio thread guards, allocation tracking, scope enforcement
Adapter boundary
Framework confined to one module - everything above speaks stdlib
Plugin infrastructure
Shared UI, licensing, state, presets, testing across all plugins
Validation & Observability
BPTS
Plugin testing suite (Catch2)
DawDreamer
Python integration tests
BOL Probe
Black-box binary validator
Format-native validators
pluginval / auval / clap-validator / DigiShell
Playwright
E2E journey tests
Observatory
Hosted release-gate + proof artifacts
Through-lines
Shared schemas, native modules, validation tooling, release workflows, and system documentation connect these surfaces. The design token pipeline, RT-safety enforcement, and contract boundaries keep them coherent as one system.
How It's Built
Each one cuts across the entire platform and defines how products, services, and tooling stay coherent.
Python generators emit C++ constexpr headers, TypeScript modules, and CSS custom properties from one JSON. Chosen over per-surface theming because of drift. Color and spacing can look fine in isolation but broken side-by-side. That gap spans the plugin UI and the marketing site. Trade: any token change recompiles every consumer, so drift detection costs more than recompilation.
RtGuard makes audio-thread allocations and locks a build error, not a regression caught after a customer report. Sanitizer-backed validation lanes (ASan/UBSan/TSan/RTSan) cover the runtime side. Chosen over "test for it after it ships" because audio dropouts under host pressure are invisible in normal play and unrecoverable at the customer site.
Catch2 for plugin internals. DawDreamer for plugin-as-DAW-host integration. Vitest for web units. Playwright for cross-surface journeys. That is 230+ plugin test files and 140+ web/E2E specs. Chosen over a single monorepo runner because each layer's failure mode is distinct. A DSP regression and a checkout-flow break are not the same question.
115+ gates run locally in ~20s before push: type strictness, secret scan, architecture drift, reproducibility, public-API exposure. CI then catches escapes, not first-line violations. Chosen over branch-protection-only because a failed merge is a 10-minute round-trip; a failed pre-push is 30 seconds. Trade: every contributor's machine runs the full suite.
Shared kernel admits only code identical across consumers: stable, and free of app-specific knowledge. It is a three-question rubric, not a "best practices" wave. API route safety, error-format consistency, and forward-compatibility are predeploy gates, not conventions. Chosen over architectural decision records alone because docs decay and gates fail loudly. Gate scope is declared by manifests co-located with the source they govern.
The website is the auth gate and frontend shell. Revenue-side routes proxy through it to a backend service on AWS ECS Fargate, over signed internal envelopes. Each route opts into the backend per-flag. Any route rolls back with one env flip and a redeploy: no data migration, no DNS change, no customer-visible difference. Trade: per-route shadow-comparison and dual-secret rotation, paid as a standing discipline.
Enforcement Signals
Tests, package boundaries, validation flows, and reproducibility rules guard the architecture at its seams. Public-facing versions of that validation story live in the Testing Suite and Research Notes.
Orchestration routes are guarded by seam tests that prevent transport code from absorbing command logic. Contract schemas are shared across surfaces via workspace packages.
Binary hardening tests verify compiler flags and symbol stripping. A security audit suite covers malicious state injection, buffer boundary attacks, and RSA credential verification.
Format-aware plugin release-baseline orchestrator wraps native validator lanes per format. Each format gets its own: pluginval for VST3, auval for AU, clap-validator for CLAP, DigiShell / AAX Validator for AAX. Hosted qualification via the JUCE-based Observatory app covers VST3 and AU. Named CI workflows run on top: daily contract smoke tests, weekly security and functional baselines, release-candidate gates, and production smoke tests.
Environment pins, doctor checks, deterministic JUCE provisioning, and SHA-256 verified distribution artifacts reduce drift between dev, validation, and release.
Validation Pipeline
Each stage must pass before the next begins. Early stages are cheap and fast; later stages are exhaustive. The full pipeline is documented in the Observatory.
Characterize
Auto-discover modes, channels, parameter ranges across all plugin formats
Topology
Behavioral identity: latency, tail, silence, bypass coherence
Spec Validate
Hardware-derived assertions: THD, IMD, noise floor, frequency response across every engine type
Gauntlet Fuzz
Assertions covering NaN, Inf, DC offset, denormals, and rapid parameter automation
Mutation
Inject faults into DSP path, verify detection, confirm kill rate before release
Stack
| Layer | Technologies |
|---|---|
| Native | C++20, JUCE, CMake, Catch2, LibFuzzer - VST3/AU/AAX/CLAP/Standalone, universal binary (ARM + Intel) |
| Desktop | Electron 42, Vite, electron-builder |
| Web | Next.js 16, React 19, TypeScript, Tailwind 4, Zod |
| Data | PostgreSQL (Neon), Prisma 6 |
| Visualization | Three.js, React Three Fiber, React Spring |
| Infrastructure | AWS ECS Fargate, ECR, Docker, ALB, S3 / CloudFront, Vercel, GitHub Actions, pre-push quality-gate system |
| Shipping | Apple Developer ID signing, notarization, Gatekeeper validation, S3/CloudFront warehouse, SHA-256 verification |
| Quality | Sanitizer-backed validation lanes (ASan/UBSan/TSan/RTSan), DawDreamer integration tests, format-native validators (pluginval/auval/clap-validator/AAX Validator), Playwright, BPTS pipeline |
| Codegen | Python - cross-language token pipeline (JSON → C++ constexpr, TypeScript, CSS) |
| CI / Tooling | Bash (CI, hooks), GitHub Actions |
Public Surfaces
These surfaces expose parts of the platform directly. The same thread continues through the blog and the Bellweather philosophy.
Public licensing and API surface. Useful for seeing the operational side of the platform.
Open Ground Control→Architecture visualization surface. Useful for seeing how the platform is modeled and presented publicly.
Open Cupola→The main product site. Useful for seeing how the engineering system is expressed at the product layer.
Open main site→Open-source C++ audio-core library with BS.1770 / EBU Tech 3341 tests, RT-safety primitives, and Barometer as a source-built JUCE reference plugin.
Open Audio Core→View source→Open-source, headless C++ audio-regression proof layer: bless a known-good render into a signed reference, then verify later renders against it in CI.
Open Audio Attest→View source→Public profile-level context and links into the broader Bellweather engineering story.
Open GitHub→Architecture In Motion
Boundaries, validation flows, and shell-versus-domain seams are explicit and test-enforced. Research notes, bug postmortems, and architecture documents track every structural decision as the system evolves.
The architecture keeps moving because the products and delivery surfaces keep moving. Legibility is the constraint - every decision gets documented, tested, or both.
Numbers on this page are floored from a build-time scan of the repo. Last verified ; a predeploy gate fails the build if they drift.