Objective. Locate the vulnerability behind an on-chain exploit by replaying the transaction that caused it.

The problem. After a smart contract is drained, the evidence is a raw trace. Reading it by hand is slow, and a wrong conclusion is worse than none.

Architecture. Trace ingestion across EVM chains, a reentrancy detection engine, and a confidence calibrator that reports how much the verdict should be trusted.

flowchart LR
    S0("Trace")
    S1("Replay")
    S2("Detect")
    S3("Calibrate")
    S4("Verdict")
    S0 --> S1 --> S2 --> S3 --> S4

Carries a LaTeX survey paper alongside the code. The only repo of the seventeen with an outside fork.

Objective. Audit any GitHub repository or local codebase and return one health report.

The problem. Code review catches the diff. Nobody reviews the repository itself -- its secrets, its missing tests, its stale dependencies.

Architecture. Six skills run in sequence -- repo analysis, security scan, doc analysis, test analysis, dependency analysis, scoring -- producing a weighted score, ranked issues and quick wins as structured JSON.

flowchart LR
    S0("Clone")
    S1("Six skills")
    S2("Score")
    S3("Rank")
    S4("Report")
    S0 --> S1 --> S2 --> S3 --> S4

Audits itself in CI. Secrets are masked in every finding.

Objective. Detect a cluster incident, find the root cause, and remediate it without paging a human.

The problem. On-call exists because the diagnosis step is human. An agent that guesses the cause and acts on it is more dangerous than the outage.

Architecture. A LangGraph multi-agent root-cause pipeline over Kubernetes, instrumented with OpenTelemetry so the agent's own reasoning is observable, and benchmarked against deliberately injected chaos experiments.

flowchart LR
    S0("Detect")
    S1("Diagnose")
    S2("Plan")
    S3("Remediate")
    S4("Verify")
    S0 --> S1 --> S2 --> S3 --> S4

Self-observability is the point -- the agent is measured the way it measures the cluster.

Objective. Predict MPLS and SD-WAN fault precursors before they become an outage, and hand the operator a runbook, on a network with no internet connection.

The problem. Every network copilot assumes a cloud API. Carrier, defence and industrial networks are air-gapped, so a tool that phones home cannot be installed at all — and a tool that guesses at three in the morning is worse than no tool.

Architecture. Telemetry from a Containerlab and FRRouting testbed feeds a machine learning risk scorer that ranks fault precursors. The highest-risk incident is enriched by local FAISS retrieval over the runbook corpus, and a locally hosted LLM writes the root cause analysis. Nothing leaves the box.

flowchart LR
    S0("Telemetry")
    S1("Risk score")
    S2("Retrieve")
    S3("Diagnose")
    S4("Runbook")
    S0 --> S1 --> S2 --> S3 --> S4

The constraint is the design: if it cannot run offline, it cannot run here.

Objective. Recover revenue lost to failed payments, checkout drop-offs, lapsed subscriptions and overdue receivables, without letting an agent act on money unsupervised.

The problem. Dunning is usually a cron job with three email templates, and the agentic version of it is worse: an autonomous system near a payment rail needs a bound it cannot cross and a record a finance team can audit.

Architecture. A detector raises the recovery event. An adaptive agent decides the next action. A policy layer bounds what that action is allowed to be, execution is checked against verified payment proof, and every decision, attempt and outcome is written to a complete audit trail.

flowchart LR
    S0("Detect")
    S1("Decide")
    S2("Bound")
    S3("Execute")
    S4("Prove")
    S0 --> S1 --> S2 --> S3 --> S4

An agent allowed near money is only as good as the bound it cannot cross.

Objective. Upload PDFs, get summaries, and hold a conversation with your own notes.

The problem. A general chatbot will answer confidently about a document it has never read.

Architecture. React client, Node service, MongoDB store, JWT auth, Claude for summarisation and chat.

flowchart LR
    S0("PDF")
    S1("Index")
    S2("Retrieve")
    S3("Summarise")
    S4("Chat")
    S0 --> S1 --> S2 --> S3 --> S4

The earliest retrieval experiment. Everything in Division 02 is a stricter answer to the same question.

Objective. Teach, then measure whether the teaching worked, then adapt -- with every claim traceable to a source page.

The problem. A tutor that hallucinates does not merely fail to teach. It installs a misconception that has to be removed later.

Architecture. Next.js 16 standalone and FastAPI. Retrieval uses all-MiniLM-L6-v2 embeddings in ChromaDB with page-level attribution and a distance threshold that refuses to answer rather than guess. SM-2 spaced repetition schedules review; a mastery score combines accuracy, difficulty, recency and hint penalty; a deterministic, auditable classifier labels misconceptions. JWT, role-based access and tenant isolation across student, teacher, guardian and admin roles.

flowchart LR
    S0("Diagnose")
    S1("Teach")
    S2("Practise")
    S3("Measure")
    S4("Adapt")
    S0 --> S1 --> S2 --> S3 --> S4

The retrieval threshold is a refusal mechanism: below it, the system declines to answer.

Objective. Give a pet owner calm, step-by-step first aid during an emergency, with every step cited.

The problem. An owner searching during an emergency gets contradictory advice from strangers. A hallucinated instruction here can kill the animal.

Architecture. Streamlit interface over a LangChain and ChromaDB retrieval pipeline into Groq-hosted Llama 3.1. Species-aware filters for dog, cat and other; inline citations with expandable source evidence; conversational memory across follow-ups; indexes both the bundled manuals and user-uploaded PDFs.

flowchart LR
    S0("Symptom")
    S1("Filter")
    S2("Retrieve")
    S3("Cite")
    S4("Guide")
    S0 --> S1 --> S2 --> S3 --> S4

Ships a warning that it is not a substitute for a veterinarian. Knowing the limit is part of the design.

Objective. Detect potholes in a live camera feed, a video file, or a still image, and log every detection.

The problem. Road defect surveys are manual. A detector is only useful if it runs on the hardware a survey team already has.

Architecture. YOLOv8 inference behind both a Flask dashboard and a CLI, with webcam, video and image inputs and CSV export.

flowchart LR
    S0("Frame")
    S1("YOLOv8")
    S2("Detect")
    S3("Log")
    S4("CSV")
    S0 --> S1 --> S2 --> S3 --> S4

First perception experiment. Two interfaces over one model -- a pattern that repeats later.

Objective. Watch air quality and wildfire risk on one map, and forecast where the readings are heading.

The problem. Environmental data arrives from separate feeds at separate cadences, and none of them tell you what happens next.

Architecture. Next.js 16 and React 19 front end with Three.js, Leaflet and Recharts; FastAPI backend on SQLModel and Alembic over PostgreSQL; Gemini Vision for imagery, Prophet for PM2.5, CO2 and NO2 forecasting, Whisper for speech input, NASA FIRMS for wildfire coordinates.

flowchart LR
    S0("Feeds")
    S1("Ingest")
    S2("Prophet")
    S3("Map")
    S4("Forecast")
    S0 --> S1 --> S2 --> S3 --> S4

Ships its own design system rather than a component library.

Objective. Turn one photo of surplus into a matched, routed, tracked and impact-reported pickup.

The problem. Surplus is redistributed by phone calls and spreadsheets, so it expires before it reaches anyone.

Architecture. Vision, OCR and an LLM run in parallel on the uploaded photo to draft the listing. A weighted scorer ranks recipients on distance 30, urgency 25, category fit 20, storage 15 and availability 10. Three n8n workflows then orchestrate approval, dispatch and the post-pickup impact receipt. The AI layer is provider-agnostic and boots with no keys at all on a mock provider.

flowchart LR
    S0("Photo")
    S1("Vision + OCR")
    S2("Match")
    S3("Dispatch")
    S4("Receipt")
    S0 --> S1 --> S2 --> S3 --> S4

The only experiment with a public deployment, and the most committed-to of the seventeen.

Objective. Give a single machine the deploy-a-container-and-get-a-URL workflow of a hosted PaaS.

The problem. Managed platforms are the fastest way to ship and the fastest way to lose control of your own infrastructure.

Architecture. Go 1.22 API on the standard library with zero external dependencies, React and Vite dashboard, k3s for scheduling, a local Docker Registry v2, Nginx wildcard routing, and a JSON file as the database.

flowchart LR
    S0("Push")
    S1("Build")
    S2("Registry")
    S3("k3s")
    S4("URL")
    S0 --> S1 --> S2 --> S3 --> S4

Zero external Go dependencies. The whole API is standard library.

Objective. Play out a sequence of financial life decisions and see the compounded consequence.

The problem. Financial advice is abstract until you watch a choice compound against you.

Architecture. A deterministic rules engine with clamped effects and hidden traits runs the simulation locally; an optional AI mode narrates it. The rules engine is authoritative either way.

flowchart LR
    S0("Choice")
    S1("Rules")
    S2("Clamp")
    S3("Compound")
    S4("Outcome")
    S0 --> S1 --> S2 --> S3 --> S4

Clearest statement of the fallback pattern -- the model narrates, the rules engine decides.

Objective. Hold a green corridor ahead of a moving ambulance by predicting its trajectory and preempting the signals on its path.

The problem. An ambulance loses minutes at intersections it was always going to reach. The signals only react once it arrives.

Architecture. SUMO traffic simulation driven through TraCI, a FastAPI control service, and a React operations view -- the corridor is proven in simulation before any real intersection is touched.

flowchart LR
    S0("Trajectory")
    S1("Predict")
    S2("Preempt")
    S3("SUMO")
    S4("Corridor")
    S0 --> S1 --> S2 --> S3 --> S4

The strongest case for simulating first -- the failure mode here is measured in lives.

Objective. Detect a backdoor in a federated model, explain it, repair it, and cryptographically attest that the repair happened.

The problem. Federated learning hides the training data by design, which means it also hides the poison. Detection on its own is not a defence: the party consuming the model has no way to check that anything was actually fixed.

Architecture. Client updates arriving at the Flower aggregator are screened for the statistical signature of a backdoor. Flagged updates are explained down to the trigger, the poisoned contribution is repaired out of the global model, and the result is signed so a downstream consumer can verify the mitigation independently.

flowchart LR
    S0("Aggregate")
    S1("Detect")
    S2("Explain")
    S3("Repair")
    S4("Attest")
    S0 --> S1 --> S2 --> S3 --> S4

A defence that cannot be verified is a claim, not a defence.

Objective. Audit GitHub CI/CD and agentic AI workflows for security flaws, then open the pull request that fixes them.

The problem. CI is the softest target in most repositories: unpinned actions, over-scoped tokens, injectable inputs. Scanners find all of it and nobody acts, because a finding that arrives as a report is not a control.

Architecture. Workflow definitions are scanned, audited against zizmor and SAST rules, and triaged by severity and exploitability. The remediation engine then generates the patch and raises it as a pull request, so the fix lands in review rather than in a backlog.

flowchart LR
    S0("Scan")
    S1("Audit")
    S2("Triage")
    S3("Patch")
    S4("Pull request")
    S0 --> S1 --> S2 --> S3 --> S4

A finding that does not arrive as a diff does not get fixed.

Objective. Score the security of a repository's CI/CD and agentic AI workflows, report it in a form somebody will actually read, and gate the build on the result.

The problem. Security output rots inside build artefacts. If the report is not readable and is not allowed to fail the pipeline, the pipeline stays insecure and everyone stays comfortable.

Architecture. Workflow definitions are ingested and analysed against action pinning, permission scope and injection rules, the findings are scored, and the run emits interactive HTML and machine-readable JSON. The gate then fails the build when the score falls below the configured threshold.

flowchart LR
    S0("Ingest")
    S1("Analyse")
    S2("Score")
    S3("Report")
    S4("Gate")
    S0 --> S1 --> S2 --> S3 --> S4

The report is only a control when it is allowed to say no.

Every image on this page is an SVG generated by a Python script in scripts/. Nothing is hand-drawn, nothing is stock, nothing was downloaded. The facts all live in one file, scripts/repos.py, which is where every count, date, division and pipeline on this page comes from — so the words and the pictures cannot disagree.

python3 scripts/build_assets.py   # regenerates every asset on this page

A word on honesty. This page shows no star counts, no follower counts and no streak graphics, because those numbers are currently zero and dressing them up would undermine everything else here. The counts that do appear — seventeen repositories, five divisions, six months, one live deployment — are all verifiable from the repository list; the portfolio site is counted separately because it is not one of the repositories. One repository, foundry, is a fork of the Ethereum toolchain and is deliberately excluded from the seventeen.