• impeccable · Add Arabic-script specifics to hardening reference. Merged: the hardening guide now covers Arabic-script text: keep zero-width non-joiners, handle the Persian and Arabic forms of Yeh and Kaf, and format digits and calendars by locale.
• impeccable · audit: add RTL checks to Responsive Design dimension. Adds right-to-left checks to the audit's responsive score: on pages declared RTL, physical CSS such as margin-left becomes something to verify in the render, with the cases where it is still correct.
• Go · cmd/go: clarify test cache behavior for file metadata. Documents that, for files a test opens, the test cache checks size and modification time, not content.
• XcodeGen · Warn on unrecognized keys in target dictionaries. Warns about a mistyped target key, such as resources for sources, instead of ignoring it.
• Coraza · Document skip/skipAfter limitations under multiphase evaluation. Documents how skip, skipAfter and allow can leave a variable uninspected in the firewall's multiphase mode.
• MISP · Return proper REST response from auth key pin endpoint. Makes the endpoint answer API callers with JSON instead of a browser flash message.
• OpenCTI · Fix SMTP configuration margin and empty value display. Merged: an empty setting shows the platform's plain dash instead of a dash in a chip.

The source is private, so this chapter shows the apps and marks every number as my word. GitHub counts the work without showing it, as the figure above.

SHOWN _{iPhone app · Swift · SwiftUI · Go backend · in development}

An iPhone app and Go backend that make audio hosted on the Internet Archive feel like a music app: mixes built by stated rules, a home feed that learns from listening on the device, and a note on each recording's history.

Status: in development, not in any app store; STATED 629 commits as of 2026-10-16. Pictured: the iPhone app.

SHOWN _{macOS app · Swift · SwiftUI · Vapor · Kotlin · alpha}

One live map for teams working where connectivity ends: drones, vehicles, traffic cameras, aircraft, weather and mesh radios, with mission planning and dispatch. Offline-first: map packs, a sync queue that drains on reconnect, and a status bar that says what is connected. It speaks Cursor-on-Target over an embedded TAK relay, MQTT and HLS.

_{The basemap is blurred, and the camera's agency badge and state obscured, because the console is pointed at a real place.}

The failure worth designing for is the invisible one. An elevation lookup cached network failures as "no data", so an operator could plan offline, reconnect, and never get the terrain warning back. The fix separates checking from could not check from no conflict: an absent answer that renders as "clear" fails in the dangerous direction. The lookup also sends planned coordinates to a third party, so it is opt-in.

Status: alpha; STATED v0.193.0-alpha as of 2026-10-16. Pictured: the macOS app; the iOS app, Vapor service and Android companion are not. No claim of field use.

A check that cannot go red is not a check. A mutation test of mine passed a test that never ran against the mutant: go test without -count=1 can replay a cached result. I now watch a check fail against the broken state before I trust it to pass. My Go pull request is the public trace.

Detectors stop defect classes. Rules do not. Of thirteen recurring defect classes in my build process, the only two that stopped were stopped by an automated check. I build the detector first.

Replace the proxy with the act. git check-ignore -v exits 0 even for a file a negated rule keeps; git add --dry-run is the operation itself:

$ git check-ignore -v keep.log; echo "exit $?"
.gitignore:2:!keep.log	keep.log
exit 0
$ git add --dry-run keep.log
add 'keep.log'

Audit by computation, not by eye. I checked a design system against WCAG AA by computing every contrast ratio instead of trusting the documented ones. One token passed by 0.0008; another failed outright and was unused, so I deleted it.

Measure before you claim. "It builds" means it ran just now and exited 0. Reading is a hypothesis, running is a finding, and I say which one I have.

My day-to-day development runs through roughly thirty specialised Claude Code agents: builders, QA, composition review, release. The agents were the easy part. The work was building the instruments that keep them honest: detection for two agents about to write the same file, for gates that cannot fail, and for records claiming more certainty than they have.

• Languages: Go · Swift · Python · Kotlin
• Apple: SwiftUI · Xcode
• Delivery: Docker · GitHub Actions
• Security tools I contribute to: OpenCTI · MISP · Coraza (interface, API and documentation fixes)
• Background: B.S. Cybersecurity · B.S. Electrical Engineering (in progress)
• Certifications: Security+ · CySA+ · PenTest+ · Associate of ISC2

Everything that moves or updates comes from a script in gen/; only the source footage, three Google Flow clips, is not committed. The daily workflow refreshes the numbers and the ops log. Every band has a reduced-motion still.

flowchart TD
  F["Footage generated with Google Flow<br/>(not committed)"] --> A["gen/ascii_film.py<br/>every frame in 0/1 glyphs"]
  A --> T["gen/title_cards.py<br/>titles, cursor, loops, stills"]
  T --> B["Opening film and chapter bands"]
  S["App captures"] --> W["gen/work_shots.py<br/>framing, location blur"]
  W --> P["Screenshots"]
  G["GitHub's API"] --> C["gen/stats_cards.py<br/>daily at 06:17 UTC"]
  C --> L["Status panel, private count,<br/>ops log"]

• Run it. HelloGitty installs with one go install and runs on your machine.
• Follow it upstream. My pull requests to other people's projects, live on GitHub, newest first, closed ones included.
• Read the code. My public repositories, with forks hidden.
• Watch the whole shot. The uncut 15.7-second film (4 MB); the top of the page runs a 4.7-second cut.