I build agentic systems the way you'd build any production system: deterministic cores, agentic edges. The predictable parts run as tested code with real contracts (exit codes, schemas, golden cases). The models handle judgment and ambiguity at the boundaries, and nothing they touch gets trusted without a gate.
Day job: AI Ops at a PIM/DAM SaaS company, where I run agentic automation across product data operations. Nights and weekends: the repos below :-)
| arkai | Rust orchestration kernel for AI workflows. Event-sourced, resumable pipelines with strict safety and cost controls. |
| gmail-mcp-server | Multi-account Gmail MCP server built security-first: macOS Keychain token storage, injection-safe process exec, attachment quarantine, and two-step confirmation before anything destructive. 69 tests green. |
| pangram-fit | An AI-detection fitness loop with a deterministic fabrication gate. The detector scores the rewrite; a red-teamed claims-diff flags invented facts before they win. 400+ tests, stdlib-only. |
| eval-factory | Evidence-backed improvement lifecycle for agent tooling: a real state machine (captured to promoted), fingerprint dedup, blind-eval gates, and hash-verified promotion receipts. Agents that modify their own tools need audit trails. |
| agent-skills | Nine skills and a command pack in daily use: tiered repo security scanning, LLM-output validators, agent-fleet safety guardrails, credential hygiene, and more. |
| rlm | MCP server implementing Recursive Language Model patterns: treat 10M+ token contexts as external variables instead of stuffing the window. Based on MIT research. |
- Contracts before vibes. Every pipeline node gets a verifiable interface: JSON schemas, typed exit codes, golden-case tests. If an agent performs the same transformation twice, it becomes a script.
- Adversarial by default. Multi-model review (Claude and GPT cross-checking each other), refute-first verification passes, and fabrication gates on anything an LLM claims.
- Security is a feature. Prompt-injection hardening, least-privilege tool access, quarantined untrusted input, and human approval gates on irreversible actions show up in everything I ship.