Projects

What I’m working on now, and a few things from before.

Bow & Bridge

Visit bowandbridge.com

Bow & Bridge is a reference on American violin and bow makers. I’m rebuilding it maker by maker from old city directories, catalogs and books. Every fact links back to where I found it, and when the trail goes cold, I leave it blank.

• bb-library, a WordPress plugin of 60 classes that holds the maker records, the source pages and the search over transcribed lines, with its own WP-CLI command set, wp bb.
• bb-mcp, an MCP server that lets an AI assistant query and work the records through a fixed set of tools.
• A pipeline of 127 tools: a harvest loop that runs every 15 minutes, OCR on a model running locally, mention mining, identity joins, claim verification, a hash-chained changelog, and a deploy gate whose guards must pass before anything ships.
• Wants: a record can say what it is missing, and the want closes itself when a claim with a source fills the hole.

Rocheport Times

Visit rocheporttimes.com

A platform for small-town newspapers, built first for Rocheport, Missouri. Five other town papers run the same code. I started the Rocheport Times in October 2022 and wrote and ran it by hand. In July 2026 I started rebuilding it from the ground up.

• One platform plugin of 81 modules: invite-only membership, an editorial desk, letters to the editor, events with self-healing listings, and games.
• An MCP newsroom connector that lets an AI assistant work the review queue: read tickets, request changes, draft articles. Publishing always needs the editor to say yes, and every action is logged.
• An MR340 tracker for the Missouri River race, live during the race and as a replay after it, drawn in 3D with MapLibre. I paddled the race solo in 2024 and volunteered with Missouri River Relief at the 2025 and 2026 races. I built the tracker in July 2026, the week before the race, and fixed it on race day.
• Outdoor data: a trails explorer covering 20 Missouri trails, and river gauge readings.

Noble Strings

Visit noblestrings.com

My violin shop in Rocheport, Missouri. I sell, rent and repair stringed instruments, mostly American-made, one instrument at a time. The site is a small WordPress build I wrote and keep up myself.

• Noble Instruments, a plugin that shows what’s for sale as a photo-first plate gallery: one plate per instrument, showing all four photographed sides, front, back, bass side and treble side, at once.
• Source marks for my Reindahl research: I am writing about Knute Reindahl, a violin maker who worked in Chicago and Madison a century ago. Much of what is repeated about him has no source. I built a way to mark each statement in the article, so a reader can see at a glance which facts are backed by a document and which are only hearsay.
• A weekly violin news roundup: a plugin that gathers new articles and videos from violin-world news sites and YouTube channels, lets me pick the ones worth sharing, has Google Gemini draft a short summary of each, and saves the week’s roundup as a draft post that I check before it goes out.
• A child theme with the site’s own CSS tracked in code instead of left sitting only in the database.

Earlier work

The first version of Bow & Bridge, which I wrote in .NET in December 2025. My older websites, going back to 1999, are on the Work page.

Purfle

Visit github.com/clarksonr/purfle

A desktop runtime for AI agents. I built it alone over nine days in the spring of 2026, 136 commits from 27 March to 4 April. It installs agents from signed manifests and runs them on a schedule in a sandbox. Network hosts, environment variables and filesystem paths are declared up front, and the runtime enforces them, so an agent cannot grant itself more. It’s public and open source at github.com/clarksonr/purfle; the manifest spec is at spec/SPEC.md.

• Signed manifests: every agent is signed with ES256 over a canonical JSON form and checked against a live key registry before it loads. If the signature is expired or tampered with, the agent does not load.
• Capability enforcement: an agent declares what it needs, network hosts, environment variables, filesystem paths, and gets nothing else. The sandbox blocks and logs anything outside that declared scope.
• 202 xUnit tests and 90 Jest tests, plus an integration suite that runs the full loop together: load, sandbox enforcement, multiple agents at once, cross-agent sharing, a deliberately tampered manifest, and a token limit.
• One codebase, three desktops: the same agent runtime ships a MAUI app for Windows and macOS and an Avalonia build for Linux, backed by a marketplace, a key registry and an identity hub running on Azure.