Ten personal projects, ordered by what they prove: first the runtime validated against an external oracle, then endpoint security, then measurement methodology. Six run today exactly as they are; acheron is deliberately still blocked and red-team-adventures lives as a public demo. None of them leans on a dependency to do the hard part.
Inference runtime for Qwen3-30B-A3BB+B{B_DEC }}}^_}# 0^A #]<CA->B#-+FB
A local runtime written in plain C with one rule above all others: correctness first. Own BPE tokenizer, QXF1 tensor format, 48-layer forward pass with quantisation and MoE routing. Every numeric block is compared against an external llama.cpp oracle with pinned goldens, and whatever is untested is documented as untested. Anyone can write tests that confirm what their own code already does; checking against someone else's reference implementation is the only way to find out you have been consistently wrong.
llama.cpp oracleown BPE tokenizerQXF1 format48 layersMoE routingprobe timings, not throughput
qx-mini-c · visual simulation · illustrative data, not a benchmark
$ cc -O2 -std=c11 -o qx qx.c -lm
$ ./qx --model qwen3-30b-a3b.qxf1 --bench
[qxf1] header ok tensors=579 quant=q8_0
[bpe ] vocab=151936 merges ok
[moe ] experts=128 top_k=8
layer 00 .... 0.198s moe hit 8/128
layer 01 .... 0.203s moe hit 8/128
layer 02 .... 0.201s moe hit 8/128
...
layer 47 .... 0.199s moe hit 8/128
total 48 layers 9.62s
parity vs llama.cpp max |dz| = 3.1e-4
PASS numerical parity within tolerancesuper-nandoPrivate repositoryPython · Rust · C · Tauri
A desktop EDR, written end to end by him* ]A-ED?[ *<F, =D1*^B_ 0?_ ^E 1[[ 0? [B[
Endpoint detection and response, the CrowdStrike or SentinelOne category, built for Windows and offline at runtime. An async Python core watches processes, computes SHA-256, runs YARA rules and a rule engine of its own; the interface is Tauri with React; an ETW bridge in Rust and a C driver provide kernel visibility; the installer is per-user NSIS. Three rules that never bend: it does not touch the network (it alerts or suspends, it never cuts connectivity), it never logs command lines because they can carry passwords, and IPC lives only on 127.0.0.1 behind a token with origin validation. Quarantine is AES-256-GCM with the key in the Windows Credential Manager, and updates are Ed25519 signed.
user-mode EDRYARA + SHA-256Rust ETW bridgeAES-256-GCM quarantineEd25519 signed updatesdocumented limits
acheronPrivate repositoryPython · Rust · fail-closed
A measurement bench that refuses to publish a number it cannot proveF !_BC+!A#{=- F/E<0 F/C[ ={]^/*] 1\ A11#=#A [ !_?*D{ E_ DE}/!\ =^+^=
A performance measurement layer for LLM runtimes built on one rule above the rest: no number ships unless it is proven. Python collectors and a typed contract in Rust (edition 2024, unsafe_code forbid, clippy at deny across the workspace). A collector may return PARTIAL or UNAVAILABLE, but it is never allowed to replace a missing measurement with an estimate. Every JSON artifact is checked against its digest before it is deserialised, and so are the paths and digests of the raw evidence; the target model is pinned by its local bytes, not by a file name. The system is fail-closed: while evidence or explicit human authorisation is missing, the measurement campaign does not start. That is where it sits today, waiting for that authorisation, which is exactly what it was designed to do.
fail-closeddigest verifiedno estimates allowedRust edition 2024unsafe_code forbidcampaign not run yet
red-team-adventuresPrivate repositoryTypeScript · platform
Teaching offensive security by playing!?*BF>^> =]D}10>>= -+/+0?E/ }+ >/{*?/D
A gamified learning platform covering Python, C/C++, cybersecurity, Rust and AI. Private repository, with a live public demo. It is also where the decrypting text on this page comes from: the technique you just watched belongs to a platform he built, not to a template.
TypeScriptPython · C/C++ · Rustoffensive securitypublic demo
Local durable memory for somebody else's agent!*+?B ]{!#<BA /!C=-A -]] #B=E=^D1 [>D}'_ 1=-{D
A local-first memory provider for Hermes Agent: a Rust data plane that stores complete turn snapshots in SQLite with FTS5, plus a thin Python plugin that hooks into the public memory-provider lifecycle. SQLite is canonical; JSONL and Markdown are rebuildable projections. The transactional installer never patches the agent checkout, secrets are redacted before anything is indexed, and recalled content is always treated as untrusted historical data, never as instructions.
SQLite WAL + FTS5transactional installerfail-closed recall5 releases
3v3 arcade hockey locked at 120 Hz[B_ DAD>D? A\[DC> B\/=#C ^? =-= ^\
NHL 94/98-style arcade hockey with 100 % procedural audio. There is not a single sound file: everything is synthesised in Web Audio at runtime. The six players are driven by a finite state machine. Zero external dependencies: open it in a browser and it runs.
locked 120 Hzprocedural Web AudioAI state machineno assetsno depsMIT licence
Game Boy-style creature collector/[^C //E-C0=]+ D//A/*>D *F\_?*F{A
Three maps, six creatures with evolution lines, turn-based combat and saves in localStorage. The sprites and the music are original: nothing comes from an asset pack, everything is drawn and synthesised in code. Open it in a browser and play.
original spritesprocedural music3 maps6 creaturesplays in the browser