Full-stack engineer · AI coding-agent internals
I work on the parts of developer tools that fail quietly — sandbox policy, tool harnesses, streaming edits, and agent orchestration.
Code shipped into production open-source projects.
| Project | Stars | Contribution |
|---|---|---|
| oh-my-pi | 23.7k | #7853 — roll back extension providers after a load failure, so a partially-registered extension cannot leave the registry inconsistent |
| oh-my-pi | 23.7k | #7536 — bound fuzzy-find to the top-K scored matches instead of retaining the full candidate set |
| oh-my-pi | 23.7k | #7515 — auto-detect Ungoogled Chromium on Linux in the browser tool |
| oh-my-pi | 23.7k | #7849 — enrich discovered model limits for Alibaba Token Plan in the catalog |
Open work in review across openhuman (36k★), graphify (105k★), prime-agent (13k★) and forgecode (7k★).
Agent safety and sandboxing. Most agent bugs are not crashes — they are guards that fail open. A permission check that returns 0 on an unreadable file reads as "clean." A Math.max(0, NaN) passes every threshold. I audit for the failure mode where a system reports success while doing nothing.
Tool harness correctness. Command interception that blocks grep when it is a legitimate pipeline stage. Shell sessions that never deterministically close. Fallback selectors resolved twice in parallel. These are the defects that make an agent feel unreliable without ever producing an error.
Retrieval and grounding. Claim extraction, evidence verification, and the reranking logic that decides whether a generated answer is actually supported by its sources.
An autonomous CLI development environment built on a dual-model split — a reasoning model that plans and a fast model that executes — with an organ-based internal architecture and a gated policy layer between the agent and the host machine.
Focus areas: workspace path confinement, single-use consent tokens for privileged operations, command allowlisting, and a response-path gate that verifies generated claims against retrieved evidence before they reach the user.
Currently private. Happy to walk through the architecture.
Ongoing upstream work on oh-my-pi, openhuman, graphify and prime-agent — mostly correctness fixes in extension loading, memory and embedding resolution, parser edge cases, and concurrency.
- Auditing agent security boundaries: sandbox escape paths, path traversal in workspace policy, and fail-open guards in permission checks
- Building retrieval-grounding verification that catches unsupported claims before they are returned
- Contributing fixes upstream to open-source coding agents
Open to collaboration on developer tooling and AI agent infrastructure.