Works
Build · Selected Essays · Signal
Open-source tooling and field-tested patterns from shipping governed agentic systems in production. The Orion tools are part of Cosmocrat OS, with independent releases, installation identifiers and support boundaries.
Start here
Proctor
QA for non-deterministic AI automations. UiPath AgentHack 2026 finalist.
Cosmocrat OS
Independent Orion tools and a pinned Starter preview for handing over development evidence.
The Knowledge Graph My Agents Stopped Asking
Build: Open Source & Tooling
failclosed
Fail-closed merge admission control for agent-written code, runs an LLM reviewer, then refuses to report MERGE_READY when the output is unparseable, schema-invalid, or self-contradictory. Enforcement precedes the merge decision; the reviewer is a configurable command seam. Python 3.9+, self-contained.
orion-phone
Android phones (emulators) that AI agents drive through an MCP server or a CLI: Claude Code, Codex, or any MCP client. An agent leases a phone, reads its screen as text, taps, types and opens apps, and every action leaves an audit record with a screenshot. A phone in the locked tier does nothing until its owner unlocks it by hand, and orion-phone never sees the PIN. Linux and WSL2.
orion-skills
A curated collection of Orion-authored and adapted agent workflow skills: read-only mode, scope guarding, completion checks, incident documentation and session handoffs. Follow each skill’s source, notices and documented host support.
orion-browser
A local Chrome pool for cooperative AI agents. Each identity gets a persistent profile and virtual screen; each agent leases a browser, connects its existing CDP driver, and releases it when finished. CLI and MCP tools coordinate ownership and session handoff on a trusted Linux host.
orion-pm
Local task coordination for cooperating agents: exclusive claims, generation guards, durable task revisions and scoped evidence. Use the CLI independently or compose it with tools that keep their own resource leases and action permissions.
orion-on-the-clock
Turn yesterday's AI coding agent work into a daily YouTube Short. Agent logs and merged PRs become an allowlisted ledger, a script behind fourteen fail-closed checks, your cloned voice and a 9:16 render, uploaded privately unless you flip a switch.
orion-handoff
Carry bounded task context between local agent sessions. Explicit stores and immutable revisions keep task matching, observed recency and acceptance claims separate. Ambiguous pickup refuses selection; every result carries no authority.
orion-results
Capture complete text in a private local session, pass a byte-bounded snapshot and recover exact results by reference. Explicit storage, quotas and visible uncertainty keep a small selected view tied to a dependable original.
orion-worktree-report
Observe registered Git worktrees and exact shared uncommitted paths in repositories you select. Explicit coverage keeps missing checkouts, limits and uncertainty visible. The report grants no ownership or merge authority.
mcp-context-budget
A local-first CLI that keeps your MCP tool surface from eating the agent context budget, it scans tool schemas and response fixtures for token bloat, selects the smallest relevant tool set for a given task, emits a budget lockfile, and fails CI when a config regresses. Self-contained: no external services, runs from a fresh clone against fixture data.
schemafit
A local-first CLI that lints a JSON Schema, structured-output spec, or tool definition against the constraint surface of each major LLM provider (OpenAI, Anthropic, Gemini, Mistral, Cohere) and fails CI before the schema 400s in production, naming the exact JSON-Pointer path, the violated keyword, and the reason, plus a repair pass that emits a provider-valid variant. Static and offline: no API calls, runs from a fresh clone. v0.5 adds automatic rule-pack drift detection, an opt-in live-verify run that rejects a schema the static pack passed flags the pack as lagging the provider’s docs.
agent-demo-video
A headless pipeline that turns a Markdown DEMO_SCRIPT and a running web app into a finished, narrated, captioned MP4, and a Claude Code plugin that drives it. Audio-first: narration is generated first and paces both the screen recording and the captions, so audio, video, and captions stay in sync. Narrate with ElevenLabs or your own text-to-speech, check every render, and iterate keyless with FAKE_TTS.
localfiscal
Local-first private receipt + invoice + ledger intelligence for solopreneurs and small businesses. Ingest receipts locally (heuristic + optional Ollama vision), maintain a private sqlite ledger, generate clean invoice PDFs, produce P&L and category reports, export CSV/OFX for accountants. One-command Docker. Everything stays on your machine.
Build: Applied Agent Projects
Proctor
Behavioral regression testing for AI agents. Proctor learns a per-agent contract from sample runs, re-checks it on every model or prompt change, and classifies drift as real regression, legitimate evolution, or flaky. Consequential changes pause a durable workflow for human approval; approved evolution versions the contract. Verified live against a real UiPath tenant. Built for UiPath AgentHack 2026 (Track 3: UiPath Test Cloud); named a finalist.
Fork Around & Find Out
A fail-closed decision gateway for agent tool-calls. Instead of reading a proposed action and guessing whether it is dangerous, it runs the action in a disposable Daytona sandbox, measures the actual blast radius (files touched, network egress, honeytoken reads even when the secret leaves in a request body), and returns ALLOW, QUARANTINE, or BLOCK. If the run cannot be measured, the action is blocked. Built solo at Daytona HackSprint #5.
Codex Rule Ledger
Evidence-bound audits for Codex runs: it reconstructs the instruction chain from a launch capture and reports whether the supplied evidence supports, contradicts, or cannot decide each rule (SUPPORTED, CONTRADICTED, NOT_EVIDENCED, NOT_APPLICABLE), never confusing missing evidence with compliance or failure. GPT-5.6 proposes semantics; deterministic TypeScript alone owns evidence sufficiency and final ledger states, ending in a hash-bound JSON export. The public demo is deliberately recorded-case-only (two disclosed synthetic fixtures, keyless), and verification runs all 77 unit and contract tests plus five Chromium E2E flows. Built for OpenAI Build Week (Developer Tools).
algorithm.reviews
The Agent Trust Layer, a governed review agent that fans out across the live web, decides which sources are admissible (fail-closed), forms a verdict grounded only in admitted evidence, and ships a signed, verifiable review receipt: per-claim confidence, timestamped citations, dissent, and an ECDSA signature anyone can check. Built at the DeveloperWeek New York 2026 Hackathon.
Notary
The context lie detector for data catalogs: an agent that cross-examines a catalog's claims (units, freshness, completeness, enums, deprecation) against the warehouse with deterministic SQL, adjudicates each as CONFIRMED, CONTRADICTED, or UNVERIFIABLE with evidence, and writes what it learned back to DataHub as a trust ledger, evidence dossier, and provenance-labeled correction. The evaluation table is published verbatim, misses included: 9 of 12 planted lies caught and 0 of the 6 adjudicated controls misclassified, because for a trust product a wrong CONTRADICTED is worse than a declared miss. Built for the DataHub Agent Hackathon (Category 1: Agents That Do Real Work).
Invisible Hand
An agent economy where real on-chain settlement, not a simulated score, decides which AI agents survive and breed. Seller-agents earn Base Sepolia testnet USDC behind x402 paywalls, adversarial buyer-verifiers cross-check every answer against the live source, cumulative net profit is fitness, insolvency delists to HTTP 410, and profitable sellers breed through a six-rule fail-closed guild gate. The frozen run produced 731 on-chain settlements. Its first headline claimed the next generation earned several times the unit economics while verified accuracy fell, and a post-release errata retracted that reading: the comparison is largely survivorship of a hand-seeded price band, the accuracy decline is confounded and unsized, and four of six model ids were mispriced through a fallback. What survives is structural and is the point: fitness carries no accuracy term, so selection could only ever see profit. Built solo in one day at SwarmHack SF, and shipped with the errata that corrects it.
Engram
A memory engine for AI agents: typed memories with LLM-scored importance, recall greedily packed under a hard token budget, Ebbinghaus-style forgetting that retires stale memories without deleting them, and contradiction adjudication that supersedes old facts with an audit pointer. Pure TypeScript engine with 67 unit tests, an MCP server so any agent can adopt it as a memory backend, deployed on Alibaba Cloud Function Compute with Qwen Cloud models end to end. Built for the Qwen Cloud Global AI Hackathon (Track 1: MemoryAgent).
Impact Lens
Blast-radius and change-impact analysis for code, 'what does changing this break, and what must I re-test?', built as a GitLab Duo Agent Platform skill and flow over the GitLab Orbit knowledge graph, and published to the GitLab AI Catalog. Built for the GitLab Transcend Hackathon (Showcase Track).
Quorum
Decision-memory agent for Slack, detects when a thread reaches a decision, drafts a structured Decision Record, waits for human approval, files it to a canonical Decision Log, and answers 'what did we decide about X?' with sourced, permalink-cited replies. Built for the Slack Agent Builder Challenge.
Reprise
A reuse-first gateway for generative media. It answers one question per request: did we already generate this? An exact or near-exact match is served straight from Backblaze B2 with the saving booked, the ambiguous band routes to a human, and only genuinely new work reaches the pipeline. Every decision lands in an Object-Lock ledger under GOVERNANCE retention, so the savings scoreboard is recomputed from records nobody can edit while retention holds.
Standing Questions
Ask the Bluesky firehose a question once and get a living chart instead of a paragraph; pin it, and a scheduled agent keeps re-evaluating, reopening the thread in a public feed with a visual before/after delta card when the picture materially changes. Every turn runs as a durable Trigger.dev chat.agent() session, and the model never touches the database: it emits a JSON plan that a deterministic SQL gate validates before anything executes (single SELECT, allowlisted tables, re-validated at pin time and in the re-eval cron). 59 unit tests, with the honest limit stated up front: ingest is a sampled stream, a bounded 25 second Jetstream capture every 5 minutes, not the full firehose. Built for the ClickHouse and Trigger.dev Virtual Summer Hackathon 2026.
Plainspeak
AI that reads the fine print, paste any dense document (a lease, a medical letter, terms of service) and get it back in plain words, the clauses that affect you ranked by severity, and the exact questions to ask before you sign. A single structured Claude call with a strict JSON contract, a not-legal-advice guardrail, and a defensive parser that keeps the UI clean. Built for the FutureAI Global Hackathon 2026.
Rekindle
Paste a dormant GitHub repo and get three things: an honest diagnosis of why the flame died, read from commit cadence and the gap between README ambition and reality; a three-step plan whose first step fits in fifteen minutes tonight; and a roughly ninety-word cornerman speech about your project by name, spoken out loud. Model output runs at temperature 0 and is parsed defensively and clamped server-side.
Whisperways
Noise-aware flight corridor planning for advanced air mobility: pick two Los Angeles vertiports and it returns the direct route and the quiet route, showing how many people can hear an eVTOL overhead under each, then has Claude draft the community impact brief a vertiport operator could hand a neighborhood council, grounded only in the engine's numbers. Real US Census population, published eVTOL flyover acoustics, and a population-noise Dijkstra router, with the first-order acoustic model honestly labeled a planning heuristic, not certification. Built for the HTCJ Aviation Futures Innovation Challenge.
Selected Essays
- The Authority Gate, Made Runnable: Fail-Closed Merge Admission for Agent-Written Code
- Pre-Execution Authority Gates: Why Governance Must Be Evaluated Before State Mutation
- The Merge Is a State Mutation
- Why Enterprise AI Fails at Runtime, Not Capability
Signal
Available for staff/principal AI-systems roles and speaking.
Running agents in production? I do a five-day readout on your own logs: cost per verified success, and what a quality floor would have caught.