Stateless password manager — derive, never store.

A deterministic password manager that derives unique credentials from a single master secret using Argon2id and HMAC-SHA256 — there is no stored vault to breach; the master secret is the one thing to protect. One specification drives five implementations plus an end-to-end-encrypted sync server, all producing byte-identical output verified against shared cross-platform test vectors.

• Standard primitives, no home-rolled crypto: Argon2id (RFC 9106), HMAC-SHA256, AES-256-GCM end-to-end sync, and Ed25519
• Five implementations from one spec: Python CLI, Go sync server, Kotlin/Android, a Chrome/Firefox extension, and an offline Web PWA
• Also derives SSH keys, BIP-39 mnemonics with BIP-32/44 HD derivation across 9 chains, and RFC 6238 TOTP seeds
• Reproducibility enforced by machine-readable cross-platform test vectors and a checksum-gated specification
• Published on the Chrome Web Store, Firefox Add-ons, and PyPI

Email deliverability & security analysis platform.

A self-hosted service that scores email deliverability and security: send a test message or scan a domain and get a detailed report across authentication, reputation, transport security, and spam signals — with remediation guidance. Built on a deliberately dependency-light Python stack.

• Crypto-native anti-abuse: SHA-256 proof-of-work and HMAC-SHA256 capability tokens gate a keyless public API
• Analyzes SPF, DKIM, DMARC, ARC, DNSSEC, DANE, MTA-STS, TLS-RPT, and BIMI, with 46 blacklist zones and dual spam engines (SpamAssassin + Rspamd)
• 19-operation REST API (OpenAPI 3.0.3) and a 6-language UI including right-to-left Arabic
• 4000+ automated tests plus 218 Playwright end-to-end tests, with adversarial suites for SSRF, authorization bypass, and injection
• Dependency-light stack: Python standard-library HTTP server, SQLite, Postfix, and nginx

Protocol correctness enforced at the database layer.

A framework for AI agents to collaborate over a shared SQLite database, where the coordination protocol is enforced mechanically by database triggers rather than by agent behavior. It supports two topologies: an asymmetric driver/observer pair and a competitive distributed mode for 2–10 agents.

• 17 SQLite triggers enforce read-before-write, one-outstanding-message, immutability, and race detection — SQLite's serialized writes act as a natural mutex
• Distributed mode for 2–10 agents with a first-round barrier and configurable starvation prevention
• Deadlock elimination driven by real observed failures: a speak-only model removes listen/speak deadlocks, with orphan detection via process reparenting
• Real-time Node.js monitoring dashboard (REST + WebSocket) over an ~866-line Python messaging core