Production applications, developer and security tools, applied AI research systems, and experimental systems engineering. Each project carries the status it has actually reached and the evidence that supports it.
Enterprise field issue-reporting platform for a field-sales organization. Staff report outlet problems from a mobile app; each issue is geo-matched to the nearest outlet, routed through the org role hierarchy, and driven to resolution with push notifications and an auditable trail. A web dashboard gives management oversight.
Problem
Field staff had no reliable way to report outlet problems, and management had no view of what was outstanding.
My contribution
Sole engineer — mobile app, web dashboard, backend and database design.
Verified remediation for npm vulnerabilities. Scans a project, applies candidate fixes inside a sandbox, proves the vulnerability is eliminated and the fix is safe, then emits an audit-grade evidence report.
Problem
Dependency auto-fixes are applied on trust: nothing proves the vulnerability is gone or that the fix did not break the project.
Network isolation is bridge-level, not domain-level: during the install phase the container has general egress, so the real defence against a malicious postinstall is that lifecycle scripts are disabled, not the network boundary.
A confidence verdict reflects the project's own build and test commands exiting successfully, not whether those checks are honest. The re-scan independently confirms the vulnerability is gone; it does not re-verify the project's test assertions.
Docker containers share the host kernel, so a container-escape vulnerability in the runtime itself is outside what this can mitigate.
Verification and update replay fixes with npm; yarn and pnpm projects are refused rather than risking lockfile corruption.
A controlled study asking whether a RAG system can tell how its retrieved evidence is deficient — missing, insufficient, conflicting, outdated, or absent from the corpus — and whether that diagnosis carries actionable information for selecting a repair action.
Problem
Every published method for handling deficient retrieval evidence is developed and evaluated on a corpus containing exactly one deficiency mode by construction. But the correct repairs diverge, and some are opposites: escalating retrieval helps when evidence is missing and actively harms when it is contradictory. No detector has ever been required to tell those cases apart, because no benchmark presented them together with labels — so neither their detectability nor their usefulness had been measured.
My contribution
Sole researcher. Benchmark design and construction, experimental design and pre-registration, analysis, and the forensic re-analysis that produced the published correction.
An AI software-security engineer that understands, verifies, fixes, and secures code. Runs a multi-scanner and agent pipeline with a closed verification loop rather than reporting unverified findings.
Problem
A static analyser can tell you a dangerous pattern appears in your code. It cannot tell you whether that line is reachable, whether attacker-controlled data gets to it, or whether the finding is exploitable at all — so teams drown in findings they cannot triage. An LLM can reason about the code but cannot prove anything about it.
My contribution
Sole author and architect. Domain model, Code Property Graph engine, scanner adapters, agent pipeline, reporters and the evaluation harness.
Pre-alpha. Six of eleven phases are partially built and the v1.0 phase has not started.
The verification pipeline reaches the taint rung. Dynamic proof-of-concept and differential-test verification are not built: the sandbox adapter exists but nothing in the agent pipeline calls it, and no component produces proof-of-concept evidence yet.
Verification and patch-quality metrics are left unpopulated because they need evidence at rungs the pipeline does not yet produce.
A distinct false-positive-reduction capability, contamination-controlled evaluation splits and broader benchmark datasets remain unbuilt.
The summary at the top of the repository README describes the verification loop as closed to the dynamic rung; the per-phase roadmap records that wiring as not yet built. This page follows the roadmap.
Turns a JSON manifest of HTML/CSS/JS scenes into a single MP4, scene by scene. Headless Chrome renders frames, FFmpeg composes them, and a React/Monaco editor drives it. Runs entirely locally — no cloud APIs, no uploads.
Problem
Producing short motion graphics from code normally means either a heavyweight editor or a cloud rendering service. Neither lets you write a scene as ordinary HTML, CSS and JavaScript and get a video file back on your own machine.
My contribution
Sole engineer. Backend render pipeline, manifest model and validation, editor frontend, and the composition layer between them.
JavaScriptReactFFmpegHeadlessNode.js
Limitations
Rendering is CPU-heavy and single-job; the documentation is explicit that it needs a queue in front of it before more than a handful of users use it.
The editor preview never executes scene JavaScript, so animation and dynamic behaviour are only visible after a full render.
The character engine is vendored as a pinned build because its published package fails to install, so updates are manual and can drift from upstream.
No render artifact is published with the project, and the documentation states no test counts, rendering benchmarks or determinism guarantee.
Smaller tools and experiments that still stand on their own.
Emergency Mesh
Active Development
Offline emergency communication. Phones exchange messages directly over Bluetooth Low Energy, relaying for each other, with no internet, no cell service and no server anywhere in the path.
Protocol, routing, crypto and BLE transport built and tested; UI just starting. Not yet installable as a finished product, and not suitable for real emergencies. Repository private.
AI-powered computer science education engine — an interactive automata theory (DFA/NFA) visualizer with step-by-step simulation and gamified mission progression.
Browser-based 3D floor planner. Draft walls, add furniture, and export a layout, with save/load and undo/redo. Built with Next.js and React Three Fiber.
This site. A content layer with an integrity gate that fails the build on a bad reference, a WebGL engineering core that degrades to a real 2D fallback, and a Supabase-backed client enquiry flow.
University research, represented at the stage it has actually reached.
SCAR-OS
Research
Integrating voice and intent-driven interaction into a developer-oriented operating environment. Final-year project, currently at the research and architecture stage — no implementation yet.
Current FYP — Research & Architecture Stage.
ResearchOperating SystemsVoice InteractionHCI
Private repository
Earlier Work
4
Older projects, kept for the record rather than as current evidence.
Upstream Contributions
7
Pull requests into codebases maintained by other people, shown with their current status.
6 merged into repositories maintained by other people, 1 still open. Each one is shown with the problem it addressed, the change made, its test evidence and its current status.