I build infrastructure for the agent economy — payment rails, service discovery, identity attestations, and audit trails for autonomous agents transacting with real money. Built with my cofounder, Monserrat Mendoza — product and UX across every project below, expanding into marketing, and now shipping real code too (see the Nirium section for two merged PRs that are hers).

Six projects, four chains, each for a specific reason:

Each one stays where it started until real demand justifies expanding it elsewhere. Contextio's mainnet is deliberately narrower than its testnet build, and Prova hasn't gone to mainnet at all yet — still Solana devnet only. Same reason for both: gated on evidence, not on a roadmap slide. If that expansion ever happens, the preference is to stay inside these same four networks first — where the tooling, the relationships, and the compliance homework are already done — over opening a fifth network cold. That's a stated preference, gated on both real demand and actual strategic fit, not a promise of when or whether it happens.

Most of my public work is either a protocol implementation I maintain or a bug I found in something I depend on and then sent a patch for. Everything below links to the actual issue, PR, or running service — no claim here that you can't click and check yourself. Where something is still open or unmerged, it's marked as such, not implied to be done.

I write it this dense on purpose. Every project below moves someone else's funds or blocks their transaction, so I'd rather you check the receipts than take my word for anything. If a claim here can't be clicked and verified, it doesn't belong here.

Skip the rest if you only have 90 seconds — this is the material that actually matters, each one a link, not a claim:

• Found and fixed a crash in x402's own official conformance suite, merged upstream the same week — x402-foundation/x402#3228.
• A skill PR survived ~16 real review rounds across 21 days before merging — stellar/stellar-dev-skill#97 — because I kept addressing feedback instead of abandoning it.
• When I was wrong, I said so and closed my own issue against myself: OpenZeppelin/stellar-contracts#839 turned out to be a construction bug in my own code, not a library gap — confirmed with the maintainer's help, not asserted.
• Kumply's compliance contracts are live and verified on Avalanche, Fuji testnet and mainnet C-Chain read-only beta — AttestationStore on Snowtrace, source at kumplyprotocol/Kumply — the one non-Stellar project in this profile with its own paper trail.
• Every contract I ship is non-custodial by construction — the client's own wallet signs, or a role that by contract design cannot move funds, never a key of mine that can. Detail and a real example under "How I work" below.
• 981 commits across these seven repos over 219 straight days (1 Feb – 8 Sep 2026), pulled from git log, not typed in: 20.8% of them land on a weekend, 12.1% between 10pm and 6am local time. There's a real gap from 3am–6am — not claiming literal around-the-clock, the data just doesn't say that.
• Two Stellar Community Fund Instawards, both delivered against real milestones, not just awarded — the track record the rest of this profile's execution claims actually rest on. These exist because of a real credential, not luck: Instawards require active participation in a local Stellar Ambassador Chapter — that's the program's own stated eligibility rule, not something I'm claiming on my own. I'm a Starmaker-tier Stellar Ambassador; the program was recently restructured and tier confirmations are still going out, so I'm not citing a specific level until that settles.

Both cards are rendered live from the GitHub API by github-stats-extended, so the numbers move on their own rather than being typed in here (checked live 2026-09-05, still serving). If a number here looks off against my GitHub profile page or the tables further down, it's almost always scope, not error: this card counts my own repos and public commits over the last year, the profile page's contribution count adds PRs/issues/reviews and private activity on top of that, and the per-project tables below are all-time and repos-I-don't-own only — three different, narrower slices of the same activity, not three inconsistent counts of the same thing.

Periplo, Nirium, and Contextio are three separate Stellar products, not three names for one thing — but they share real upstream dependencies (same protocols, sometimes the literal same bug), so the contribution tables further down attribute each fix to the specific project it came from instead of merging them into one undifferentiated pile. If a note says "this one's Nirium's, not Periplo's," that's the reason.

Snapshot below is a live re-check as of 2026-09-05; the search links at the bottom always supersede it. Full first-hand narrative with transaction hashes and reproduction steps lives in Eras256/Periplo's own README.

• x402#3171 — paymentRequirementsMatchAccepted threw on a missing/null payload.accepted. I found and reported it; the code fix was written by @JasonColapietro in #3180, merged 2026-08-17. The merged patch is his work, not mine — my part was the report.
• x402#3270 — HTTPFacilitatorClient.settle()/verify() decoded the EXTENSION-RESPONSES header and then discarded it. I fixed this on Periplo's own side the same day rather than waiting on upstream. Closed 2026-08-31 — not the way it first looked like it would close. The actual fix was the maintainer's own separate PR, #3306 (Python, @phdargen), introducing a dedicated extension_responses/extensionResponses field instead of reusing extensions — explicitly rejecting that shape (which my own workaround used, and so did the two community PRs this finding first prompted) as leaking a server-only sidechannel into buyer-facing data. #3278 (TypeScript, @Bartok9) was revised to match before merging separately; #3301 (Go, @wnjoon) and PhilBot402/x402#4 (Python, draft) remain open, likely needing the same adjustment. My own /settle still uses the old shape — migrating once @x402/core actually ships the new field (not yet: latest is still 2.24.0, predating this fix).
• eas-sdk#132 — getUIDsFromAttestReceipt trusted log topic0 without checking the emitter address, found while auditing the library Vouch402 calls for every attestation it emits. Vouch402 itself isn't affected (no resolver, no multiAttest() calls) — a library-level finding, not a gap in that project. Closed as completed by the maintainer 2026-08-27, fixed in eas-sdk 2.10.0.
• OpenZeppelin/stellar-contracts#839 — hit UnreachableCodeReached combining Signer::Delegated with a CallContract rule, and opened this not sure yet whether it was our construction or a real library gap. Closed 2026-09-02, resolution: ours. With help from the maintainer (@brozorec) clarifying execute()'s self-authorization is meant only for self-admin operations, hand-constructing both auth entries (the smart account's own plus the delegate's) authorizes and confirms correctly on-chain — no library fix needed, the trap was in how we were building the auth entry, not the library.

x402-foundation/x402 — #3121, #3148, #3169; stellar/js-stellar-sdk — #1681, #1683.

This is Nirium's own repo, so these are bounties Nirium posted, not upstream contributions Nirium made elsewhere. Full live audit as of 2026-09-05: 44 issues across three campaigns, 42 real bounty asks (2 unlabeled resource suggestions aren't bounties) — 20 delivered inside nirium-sdk itself, 2 delivered externally and still awaiting that project's own review, 4 closed and administratively recreated under a later campaign, 16 closed without delivery.

Contextio moved from a personal repo (Eras256/Contextio) to its own org, contextio — Eras256/Contextio now resolves to contextio/Contextio. The planner logic behind its treasury/payroll rebalance decisions was extracted into a separate private repo, contextio/contextio-agent-planner, consumed by the main repo as a private git dependency.

Contextio also runs a bounty-style program, though not GrantFox-labeled like Nirium's: five open issues in contextio/Contextio, all opened by this account, none delivered yet — two already have competing external PRs open and unreviewed.

Upstream, to stellar/stellar-dev-skill (not owned by Contextio): three merged PRs adding and refining the Contextio SDK's community-skill listing — #98, #101, and #102, all merged 2026-08-15.

Beyond that, I found no upstream contribution from this account to any other external repo specifically for Contextio. Said plainly rather than padded: Contextio's public footprint on this account is its own repo plus that one skill listing, not a wider trail of dependency fixes the way Periplo and Nirium have.

Same standard as above, smaller footprint since these are newer:

Kumply (Avalanche) — three open bug reports against a third-party community skills repo, Ayomisco/avaxskills, found while building on top of it: #2 (a subnet-deployment skill cites CLI commands that don't exist in the real ava-labs/avalanche-cli), #3 (a precompiles skill has the wrong genesis key name for TxAllowList), #4 (a wagmi skill cites an outdated version and a deprecated hook). All still open. Same pattern as the Instaward one above: KUMPLY's application to Avalanche's Team1 Mini Grants program went in through a real channel, not cold — I'm an official Team1 LatAm collaborator. Applied, decision still pending; not claiming an award that hasn't happened.

Vouch402 (Base) — base/skills#152, an open PR adding a Vouch402 plugin listing to Base's own community skills catalog, same genre as the stellar-dev-skill PRs above. Also eas-sdk#132 (closed, fixed — detail above) and foundry-rs/foundry#16209 (cast wallet new <name> still fails with a bare account name, open), both found auditing tooling Vouch402 depends on.

Prova (Solana) — otter-sec/anchor#4960, an open PR bumping heck 0.3 → 0.5 to drop an unbounded edition2024 dependency landmine in the Anchor framework Prova's on-chain program is built on. Not merged yet.

Found using these libraries for Periplo, Nirium, or Contextio, but not clearly attributable to a single one:

• Creit-Tech/Stellar-Wallets-Kit#105 — signMessage()'s JSDoc says SEP-43 hex, Freighter returns base64. Open.

Protocols — x402, MPP (Charge and Channel), SEP-41 / SAC, SEP-43, SEP-53, CAP-71 delegated auth, MCP, EAS (Ethereum Attestation Service) Chains — Stellar/Soroban (Periplo, Nirium, Contextio), Avalanche (Kumply), Base (Vouch402), Solana (Prova)

• Small PRs, one root cause each, with the reproduction in the description.
• If I file a bug in a dependency, I try to open the fix alongside it when I can — #3187 → #3228, #840 → #844. When someone else beats me to the fix, I say so and name them — #3171 → #3180 by @JasonColapietro, #3270 → #3306 by @phdargen — the maintainer's own fix, rejecting the field shape my own workaround used.
• When I'm not sure whether it's my bug or theirs, I say so in the issue rather than asserting a diagnosis I can't back (#839 is an example).
• Every contract I ship is non-custodial by construction: the client signs, or a role that by contract design can't move funds — never a key of ours that can.

Snapshot above is accurate as of 2026-09-05; these always supersede it: all my PRs · all my issues · nirium-sdk's full bounty board · Contextio's open issues

Open an issue on any repo above, or start with periplo.xyz · nirium.xyz · contextio.xyz

X: @vaiossx · Discord: vaiossx