I build the layer underneath an agent: the part that has to be fast, cheap and correct when nobody is watching.
CNCF · Hyperledger · Sugar Labs | Go · C++17 · Java · Python · TypeScript | BITS Pilani '27 · Bengaluru
I don't have a portfolio. I have a changelog of things that got measurably better.
BENCHMARK BEFORE AFTER DELTA
────────────────────────────────────────────────────────────────────────────────────────
besu · uint256 mul (EVM hot path) ████████████████ ████ 3.9x faster
besu · div / addMod / mulMod ████████████████ ████████ 28-78% faster
musicblocks · total blocking time ████████████████ █████ 66% lower
musicblocks · bundle size ████████████████ ███████████ 3.8 MB lighter
musicblocks · startup delay █████ · 5.0s -> 0s
mandate · agent attack success ████████████████ · 80% -> 0%
deception-gym · detection accuracy █████ ████████████████ 32.7% -> 96.7%
deception-gym · sycophancy ████████████████ █ 17x lower
────────────────────────────────────────────────────────────────────────────────────────
all numbers reproducible from the linked repos
Production codebases, no onboarding, every change fenced by a test that fails on master first.
| Project | What it is | Lang | Merged |
|---|---|---|---|
| Music Blocks + v4 | Sugar Labs · nonprofit education software · maintainer, GSoC '26 | TypeScript | 86 |
| Kubescape | CNCF · Kubernetes security & admission control | Go | 39 |
| WasmEdge | CNCF · WebAssembly runtime, loader/validator/executor | C++17 | 9 |
| Besu | Hyperledger · Ethereum execution client & EVM | Java | 6 |
Kubescape · 39 PRs in three weeks, mostly by deleting things Go
- Found a scan that passed by scanning nothing. Resource plurals were guessed by appending
s, so a policy scoped tosandboxesnever matched aSandboxand the run reported a clean pass over zero resources. (#3355, #3177) - Per-resource scoping and multi-action support for generated
ValidatingAdmissionPolicybindings, which previously matched every resource the bound policy did and could not target a CRD at all. (#3283, #3295) - Speed came from caching the right things and deleting the wrong ones: cached per-file work in the SARIF writer, indexed a scope's resources once instead of once per rule, replaced a full directory walk with an ancestor lookup.
- Hardened live-cluster discovery: kind filtering before collection, dedup when several API versions serve one resource, correct handling of an undecided access review. (#3411, #3297, #3446)
Hyperledger Besu · made the EVM stop allocating Java · JMH
- 256-bit opcodes on a flat
long[]operand stack, zero heap allocation.ADDwith carry propagation across four 64-bit limbs,SUBwith borrow, plusMUL,DIVand bitwise ops, ~3.9x faster than the boxed path. This is the arithmetic under every EVM opcode. - Power-of-two fast paths for
UInt256.div,addMod,mulMod: Knuth Algorithm D replaced with a shift or a mask, 28-78% faster, verified under JMH with property-based differential tests againstBigInteger. - Enabled NullAway null-safety analysis across
datatypesandethereum:rlp.
WasmEdge · post-quantum crypto and the Component Model C++17 · CMake
- ML-KEM post-quantum key encapsulation merged into the
wasi_cryptoplugin with FIPS 203 known-answer tests. Plus ECDSA and EdDSA public-key verification. - Component Model value-section loader, value-linearity enforcement, and core global/table type checks at instantiation, rejecting malformed components before they execute.
- Enabled three official spec suites in CI: naming, invalid, memory64.
Music Blocks · maintainer, and the reason it loads now TypeScript · React
- Total Blocking Time down ~66% and a five-second startup delay deleted, by lazy-loading 17 modules (3.8 MB off the bundle), held in place with Lighthouse CI budgets.
- Designed the brick-rendering engine: stroke-width-aware SVG outline paths with rounded corners and connector notches, so bricks snap together at any scale. Path geometry is unit-tested.
- Rebuilt the Brick Palette as a declarative system where one schema object determines what renders and how it groups.
- Review and merge community pull requests as a maintainer.
|
A deterministic enforcement kernel for agent actions
Keeps the model off the safety path, so the check costs zero tokens and returns the same answer every time. Nine deterministic checks, fail-closed on any store failure, and a CI test that fails the build if the kernel ever imports the model client. Two-phase idempotency with a recovery scan, so a crash mid-capture and a duplicate webhook each leave exactly one debit. Content-addressed cache over every model call, so a whole eval run replays byte-identically with no API key.
|
An OpenEnv-spec RL environment for deception detection
Trained a model to stop believing confident liars, on a single A10G.
A JIT compiler for integer expressions
lexer → recursive-descent parser → AST → IR gen → O2 pass pipeline → ORC JIT. Variables resolve to array slots up front, giving one A PostgreSQL schema migration runner
Per-migration transactional apply with rollback, advisory locking so concurrent deploys cannot race, dry-run and plan previews, one static binary per platform. |
performance hot-path profiling, allocation-free data paths, caching strategy,
cold-start and bundle reduction, JMH / Lighthouse CI
ai systems Anthropic API, structured output, response caching, deterministic
replay, RL fine-tuning (GRPO), programmatic eval oracles
cloud native Kubernetes API discovery, CRDs, RBAC, ValidatingAdmissionPolicy,
CEL, OPA, client-go
compilers LLVM IR generation, pass pipelines, ORC JIT, AOT/JIT, WebAssembly
note: the contribution graph below is generated by GitHub and cannot be disabled. It counts days I pushed to a non-fork repository, a strictly smaller set than days I did work, which is a strictly smaller set than days I suffered. The table above is the honest one.