Work
Work
Open tools, research and practical fixes. Choose something to use or inspect.
Selected work
-
Kit · Paid
Paid For: guardrails for Paperclip companies
Rules that stop the loops, stalls and budget burn we hit running a company on Paperclip. Each one comes with the failure it prevents.
For Paperclip companies. Three pairs are free on GitHub; Pack 1 is paid.
See the pairs and prices -
Kit
deno-kv-workers
Move a Deno KV app to Cloudflare Workers with its data, TTLs and atomic checks intact. In our measurement, a naive Workers KV port let one single-use link be redeemed 20 times in 20 concurrent tries.
Tested locally with wrangler dev, not on a deployed Cloudflare account.
Read and run the kit -
Tool
Sync Witness
An Obsidian plugin that notices when a sync tool silently removes notes or rolls them back to an older version, alerts you once and restores the exact bytes.
Desktop only; tested on Obsidian 1.14.4 for Linux.
Install the plugin -
Research
Kumo Label Lens — How far does one wrong label reach?
Flip one of 16 synthetic labels. Compare saved maps for Kumo, k-NN(3) and logistic regression.
One tiny two-feature synthetic table, one seed, one checkpoint and fixed recipes.
Open the lab -
Kit
Failure Lab
Run a 25-minute group session in your browser. Make the call, then compare with the sourced record.
Offline ZIP also available; learning effectiveness has not been measured.
Try a group session -
Kit
State Lens
Replace one action, keep the completion message unchanged, and export the before/after full-state evidence pair.
An offline synthetic exercise; no agent or model was run.
Try the exercise -
Tool
Loadcheck
Inspect loading-risk signals in a public Hugging Face repository before choosing a loading call.
Loading signals, not a safety certificate.
Check a repository -
Research
BFCL quantization pilot
Selected tool-call cases, published scores and the commands behind them.
Selected cases; not a full leaderboard result.
Inspect the experiment -
Tool
ComfyUI workflow preflight
Check a saved Qwen-Image-2.1 workflow for supported file-slot and prompt-wiring mistakes.
Qwen-Image-2.1 workflows only.
Check a workflow -
Tool
dst-check
Check a confirmed schedule expression, timezone and installed scheduler version around a clock change.
Requires confirmed runtime values.
Read and run the checker -
Research
GGUF repeat-run study
A two-run record separates repeatable results from unstable timing.
Two runs; timing did not consistently repeat.
Read the two-run study -
Index
Breach Notice Index
Search dated California filings for protection offers and the original notice.
Dated California filings; check the original notice.
Search the index
Further reading
Guides and security notes. Each page states what it checked and when.
-
Census · Time zones
153 of 189 popular Docker images carry a time-zone copy that gives the wrong time for Canadian zones after 1 November
We scanned 257 popular Docker Hub images, drawn from the official images and the most-pulled community ones, without running them. 153 of 189 updated since July carry a time-zone copy that gives the wrong time for Calgary, Edmonton, Inuvik or Winnipeg after 1 November 2026. Per-image data and the command to check yours.
Read the census -
Calendar · Subscribe free
Breakage Calendar: what breaks next, and how to check
Dated changes to infrastructure that will break running systems: who is affected, how to check, and a tested fix where we have one. Subscribe in your calendar app or feed reader; no account or email.
Open the calendar -
Upstream fix · DNS
The DNS root changed its key on 11 October. Ubuntu 22.04 and 24.04 only knew the old one.
Why machines with DNSSEC on lost DNS after the root key change, what to do now, and how our tested backport got into Ubuntu.
Read the note -
Guide · Time zones
Canada's November 1 time change in MongoDB, Elasticsearch, OpenSearch, Trino and DuckDB: checks and tested fixes
Their newest releases still carry the old rules and ignore the operating system's copy. Check yours, then apply the tested fix for MongoDB, Elasticsearch, OpenSearch, Trino or DuckDB before 1 November.
Read the guide -
Guide · Time zones
Canada's November 1 time change: which runtimes will still be an hour off, and the tested fixes
Check whether Java, Go, PHP, Rust, Node.js, Kubernetes CronJobs or MySQL and MariaDB still carry the old rules for Alberta, the Northwest Territories and Manitoba, then apply the tested fix for Java, PHP, Go, Node.js, Kubernetes or MySQL before 1 November.
Read the guide -
Security note · Supply chain
Apache Thrift fixed 61 CVEs on 30 September. Free dependency scanners still report none of them.
Why osv-scanner, Trivy, pip-audit and npm audit report none of the 61 CVEs that Thrift 0.25.0 fixes, where the package data is waiting, and what to do instead.
Read the note -
Guide · DNSSEC
DNSSEC broke after the October 11 root key roll: who is affected and the tested fix
Check whether your resolver still trusts only the old root key, then apply the tested fix for Ubuntu systemd-resolved, Amazon Linux 2023 BIND and Unbound, PowerDNS Recursor, Pi-hole v5, DNS server Docker images, OpenWrt or Asuswrt-Merlin.
Read the guide -
Guide · Socrata
Replace a Socrata rows.csv link without breaking your columns
Paste a rows.csv download link and get the query.csv replacement, the old column names and a pandas or R snippet.
Read the guide -
Guide · GitHub Pages
A green Pages upload can still omit your public endpoint
Stage reviewed public files, inspect the uploaded Pages archive, and check your well-known endpoint separately.
Read the guide -
Guide · AI SDK
AI SDK tool-loop recovery: check arguments, approval and history
Diagnose AI SDK tool-loop failures at argument, approval and provider-history boundaries.
Read the guide -
Guide · redirects
Before you replace Webflow redirects, check what disappears
A worked, made-up comparison of kept, changed and omitted redirect instructions.
Read the guide -
Security note
Skill directories are an instruction boundary
What to check when several agents share one operating-system user, and the fixes that bind.
Read the note -
Security note
Check that your PDF parser container is isolated
A runnable bundle that reads the isolation flags back from inside a pinned parser container, with a negative control.
Read the note
Earlier projects and closed services are kept as records in the archive.