Projects
Hardware & security
3A USB hardware security module on an STM32U585 — bare-metal firmware with signed boot, an encrypted key store and a tamper-evident audit log, plus a PKCS#11 provider, CLI, SSH agent and OpenBao auto-unseal.Raspberry Pi Pico (RP2040) firmware for a USB vendor-class device that hands a host an Ed25519 public key baked in at build time.A fully local, terminal-based password manager in Rust — XChaCha20-Poly1305 and Argon2id, a three-pane keyboard-driven UI, no network, no telemetry.
FreeBSD from Go
9FreeBSD network interface control for Go — interfaces, bridge, epair, VLAN, VXLAN, LAGG, TAP/TUN, addresses and routes — through ioctls and routing sockets, not ifconfig.FreeBSD jail management for Go with native libjail bindings — create, update, remove, list, exec, VNET networking and jail.conf parsing.Manage the FreeBSD PF firewall from Go through /dev/pf ioctls — rules, tables, states, anchors and atomic transactions, without pfctl.Go bindings for ZFS on FreeBSD through libzfs and libnvpair — pools, datasets, snapshots, clones, vdevs and properties, without zfs or zpool CLI calls.Go bindings to FreeBSD's vmm(4) hypervisor through libvmmapi — VMs, vCPUs, guest memory, registers, typed VM exits, interrupt injection and PCI passthrough. No bhyve, no shelling out.Run and supervise FreeBSD bhyve virtual machines from Go — a typed config rendered to bhyve_config(5), the bhyve(8) process lifecycle, and exit statuses decoded into what actually happened.Go bindings for FreeBSD's netgraph(4) — control sockets, token-matched control messages, the generic node operations, hook data and ASCII conversion. Every receive has a deadline.A FreeBSD netgraph kernel node for fast, stateless, identity-aware policy enforcement on Ethernet frames — precompiled endpoint rules, swapped in atomically as policy generations.A Prometheus exporter for FreeBSD jails — inventory, processes, RACCT resource usage and ZFS datasets — through native bindings. No shell commands are executed.
BFC & filesystems
4Binary File Container — an append-only, single-file container format with a C17 library and CLI. POSIX metadata, fast random access, optional ZSTD and ChaCha20-Poly1305, CRC32C everywhere.An out-of-tree Linux kernel module that mounts BFC containers read-only through the VFS — no FUSE, so ls, cat and cp just work.A FreeBSD 14.3+ kernel module that mounts BFC containers read-only — files, directories and symlinks, with optional CRC32C verification.Node.js bindings for BFC (@bfc-node/core) with prebuilt N-API binaries — ZSTD and libsodium statically linked, no compiler or node-gyp required.
Languages & frameworks
3O²L is an object-oriented programming language with an interpreter in C++23 — everything is an object, no null, immutable objects, practical control flow.An annotation-driven, compile-time application framework for Go — Spring Boot–style DI, HTTP, config and SQL repositories, generated as plain, readable Go with no runtime reflection.A small reflection-based dependency injection container for Go — register by name, inject into tagged struct fields.
Terminal software
5A cross-platform terminal audio player in Go — MP3 playlists with play, pause, next, previous and volume controls.A terminal dashboard for GitHub — repositories, open pull requests and your review inbox across orgs and users, in Rust with ratatui and the GraphQL API.A declarative terminal animation generator — describe a terminal scene in YAML, render deterministic WebM, MP4 or PNG sequences for stream overlays.A Rust library and CLI that turns one high-resolution transparent PNG into Twitch-ready emote and badge sizes — trimmed, padded, fringe-free and validated.A terminal text editor in C++20 — modal editing, file explorer, tabs and split panes, global search, UTF-8 and Lua configuration.
Host monitoring
2A cross-platform filesystem integrity monitor in Zig. Baselines files with BLAKE3 and detects content, permission and metadata changes — on demand or in real time.A Zig library and CLI that snapshots listening ports and connections, maps them to processes and binaries, and alerts on drift via webhooks.