Projects
August 2026
varve
A local record lake over agent-session transcripts. Normalizes Claude Code, pi, and opencode session records into Parquet partitions and queries them with DuckDB. Files are canonical, the engine is disposable, and nothing leaves the machine.
July 2026
egress
A public, versioned catalog of every outbound connection a self-managed GitLab instance can make, built for administrators who have to write the firewall and allowlist rules for a controlled-egress or air-gapped environment.
July 2026
Evidence Factory
A worked demonstration of running a continuous ATO evidence pipeline for NIST 800-53 controls entirely inside GitLab: a policy plane injects a conformance stage no repository can edit, a released CI/CD Catalog runs the checks, and one Python driver turns each result into a merge gate and a control posture.
July 2026
Cairn
A sealed bootc estate: db-signed UKI boot under keys from an offline ceremony, composefs-pinned root, TPM2 unlock bound to a signed PCR11 policy. Images promote only after booting for real in CI.
July 2026
gitlab-contribution
Vendors GitLab's official AI-agent skills for Claude Code at a pinned commit, plus one authored skill for contributing to GitLab projects without a GitLab Development Kit.
July 2026
bulkhead
Least-privilege self-managed GitLab CI runners on a fixed set of AlmaLinux hosts: rootless Podman for ordinary jobs, ephemeral libvirt VMs for jobs that need root, and the cgroups v1 versus v2 trap that decides which release to build on.
June 2026
gitlab-simulation
A Claude Code plugin that provisions ephemeral self-managed GitLab instances on Google Compute Engine, so an LLM agent can reproduce airgap, Duo Agent Platform, Geo, and license-gated cases that never surface on SaaS, without touching production.
May 2026
bairn
Personal photo archive for households whose nursery or preschool uses Famly. Pulls images and videos to disk with full EXIF and XMP metadata embedded into each file. Optional Immich upload for households that already self-host one.
May 2026
Patinate
Render Strava activity into stylized heatmap posters and inline SVG. A single Rust binary keeps a SQLite activity cache, draws it over an OpenStreetMap basemap in one of four baked-in themes, trims every track inside a privacy circle before render, and can strip identifying attributes on the way out. The patina builds where you ride often: overlapping low-alpha strokes accumulate into brighter color the way actual patina builds on metal.
May 2026
Sveltia Identity Translator
Translated-identity proxy for Sveltia CMS. Editors authenticate against your IdP; a single bot does the API calls; commits attribute correctly via git's author/committer split.
April 2026
jig
An agent-shape harness that points a real agent at a real CLI and counts what happens: a battery declared in agent-shape.toml, a headless runtime spawned against the fixture, and an LLM judge scoring the transcript on a 4-point scale whose top mark is a first command that was real and worked. A companion check guards the rubric against drift in the tool's own help output.
Project · archived
kit
A tool-registry manager that resolved developer tool versions across git-based TOML registries, generated mise configuration from the result, and verified every install against a per-tool trust tier, from cosign down to a bare checksum. Three CI pipelines proposed and gated the bumps until mise covered the same ground.
Project · archived
rune
A Rust CLI that treated a git repository as the canonical home for an agent's skills, subagents, and rules, syncing them into each project's .claude directory behind a content-hash lockfile and a write hook that surfaced drift in the same turn as the edit. Retired once the portable SKILL.md layout made most of what it did a directory of markdown and a symlink.
April 2026
manifold
An API-only adoption profiler for self-managed GitLab: it reads activity through the REST API and renders a dashboard of adoption gaps and the enablement action that closes each one, entirely inside a customer's own network.
Project · archived
muxr
Harness session multiplexer for AI coding workflows. Owns the harness/campaign/session/segment address across tmux, the filesystem, and your AI runtime so a rename stays coherent in all three.
March 2026
kebnf
Converts the OMG's KeBNF text for KerML and SysML v2 into ANTLR4 and tree-sitter grammars from one AST, all 640 rules, recording the metamodel annotations it strips. A mechanically faithful tree-sitter emitter timed out parsing a one-line file; inlining shared prefix keywords took it to 0.15ms and cut LR conflicts from 335+ to 199.
March 2026
sysml
A single Rust binary that parses SysML v2 models into a queryable knowledge graph, exposed through a clap CLI for humans and CI and a stdio MCP server for agents, both over the same core. The open question is whether the CLI is the cheaper transport for an agent, and I have not measured it yet.
March 2026
sysml-bench
An evaluation harness asking whether giving a tool-augmented LLM more tools actually helps it answer questions about a SysML v2 engineering model. 88 tasks scored per field against published schemas, run across four tool sets and six public corpora, with a pre-registered replication whose frozen hypothesis did not survive the independent corpus.
March 2026
synthesist
A Rust CLI that records the process governing a body of code (what was planned, what was agreed, what phase the work is in) as an append-only claim graph an agent can query instead of inferring from a diff. Workflow state is a per-asserter JSON-LD log read back through a disposable index, under a phase machine that forbids every write until a human approves the plan.
February 2026
Pinboard
Ken Burns-style video generator that composites photos as vintage Polaroid snapshots on panoramic backgrounds, with smooth camera movement and music.
February 2026
Playbill
TOML-driven video program assembler: title cards, intros, episode pass-throughs, and credits rendered into a single concatenated video with fade-to-black transitions.
February 2026
Harness Explorer
Static analysis for the AGENTS.md, CLAUDE.md, and skills files that define how an agent behaves in a codebase. A single Go binary follows their references into a knowledge graph, scores it for redundancy, contradiction, and information density, and ranks where the next hour of harness editing saves the most tokens; whether that ranking approximates what matters is untested, since no calibration dataset exists.
November 2025
Immutable
FROM-scratch Fedora bootc images with source-built, MOK-signed ZFS and NVIDIA kernel modules. A homelab on an earned, verifiable supply chain.