01 / Release intelligence
Web Scraper turns fragmented vendor sources into one catalog.
Fault-tolerant parallel discovery collects release metadata, normalizes it and preserves individual source failures for review instead of hiding them.
Public case study · architecture and implementation
Ready for staging
Systems / Software delivery
Enterprise software management, end to end.
An enterprise-level application for managing macOS software across a fleet, from release discovery and catalog publication to installation, deferral and recovery.
System path
- Vendor sources
- Web Scraper
- Validated release catalog
- Staging policy
- Software Manager
- Managed fleet
02 / Fleet application
Software Manager owns the device-side lifecycle.
A generic multi-format installer, inventory checks and explicit execution results provide one managed path across different application packaging formats.
Sanitized system view
A release before fleet promotion.
Representative workflow using no vendor credentials or fleet data.
Release / Promote
Release readiness
Review artifact integrity, rollout scope and recovery state before a release enters the managed fleet.
Release artifact
Universal package + SHA-256
Promotion scope
Pilot ring + deferral policy
Preflight checks
- Metadata is normalized
- Checksum is verified
- Mutation lock is available
- Recovery path is recorded
Inside the delivery system
A small set of technologies with explicit boundaries.
Discovery
Python, Requests and bounded concurrency
ThreadPoolExecutor workers collect vendor APIs, Homebrew metadata, redirects, HTML, appcasts and GitHub releases, then produce deterministic catalog output.
Catalog contract
Validated, architecture-aware JSON
Universal, Intel and Apple Silicon routes keep URL, SHA-256 and size metadata together. Entries are validated before enrichment and again before publication.
Managed fleet
Python agent delivered through Jamf Pro
Partial downloads, trusted checksums, app-bundle signature checks, multi-format handlers, mutation locks and staged promotion protect device-side execution.
Enterprise controls
Controls for running at fleet scale without hiding failure.
Artifact integrity
Release URLs, SHA-256 checksums, artifact size and available signing evidence are checked before catalog publication.
Atomic locking
A self-healing lock subsystem prevents overlapping installs and recovers abandoned execution state.
Controlled rollout
Staging, promotion and deferral keep a new release from appearing everywhere at once.
Explicit recovery
Failures remain visible and recoverable instead of becoming silent device state.
Management experience
The catalog and management interface expose available releases, policy state and execution outcomes without asking a person to reason about every packaging format.
Proof in the build
Discovery state, staged releases, user deferrals, installation outcomes and recovery state remain visible through one managed workflow.
System boundary
Web Scraper discovers and publishes release data. Software Manager evaluates and executes device-side work. Jamf provides the managed fleet delivery context.
Proof in the build
Release discovery emits validated architecture-aware catalog data, while the fleet agent owns checksums, signature checks, locking and installation execution.
Fleet-wide outcome
One controlled lifecycle for heterogeneous applications, fleet-wide execution, concurrent-run protection, staged promotion, operational visibility and recovery.