Work

Rust replacements for GNU coreutils, with a focus on secure filesystem operations and cross-platform POSIX infrastructure.

• —Patched TOCTOU race conditions in install, ln, and tac during the private-disclosure window of a Canonical-funded Zellic security audit.
• —Built fd-anchored primitives including mkdir_at, open_file_at, and copy_file_safe for race-resistant filesystem operations.
• —Expanded safe_traversal protections from Linux to macOS and FreeBSD; the work is cited as the remediation for CVE-2026-35356 and CVE-2026-35362.
• —Rewrote expr’s recursive-descent parser as an iterative parser, eliminating stack-overflow faults on deeply nested input.

A CLI that provisions real Git linked worktrees backed by copy-on-write storage across APFS, Linux reflinks, and overlay filesystems.

• —Achieved 8.0× lower physical disk usage than plain git worktree for eight concurrent worktrees on a 300 MiB repository: 301 MiB versus approximately 2.5 GiB.
• —Added process launch, stale-session garbage collection, overlay repair, baseline pruning, and structured --json output for orchestration.
• —Measured a 2.1–2.2× cold-setup cost in exchange for the storage savings.

An OpenAI-compatible gateway that schedules model instances across heterogeneous workers using live runtime capabilities and availability.

• —Models hardware targets, runtime configuration, vision support, reasoning modes, placement policy, context limits, and availability as scheduling constraints.
• —Separates inference scheduling and execution from higher-level agent planning.
• —Coordinates multi-worker llama.cpp backends with systemd lifecycle management and streaming responses.

Backend and voice infrastructure for a consumer financial platform evolving from financial tracking toward action-oriented assistance.

• —Built a WebRTC voice pipeline with LiveKit, VAD-based interruption handling, conversational state, and SIP-based outbound telephony.
• —Implemented AES-256-GCM field-level encryption for Plaid access tokens and PII, HMAC-verified webhooks, and scoped secrets management.
• —Deployed per-service backends on Azure Container Apps with separate databases, virtual networks, and staging and production environments.

A correctness fix in the Zed editor’s Git staging interface.

• —Resolved a synchronization issue between the text buffer and diffing engine that caused invalid hunk evaluations to propagate to the UI.