Selected work

Five questions,
made executable.

Each project makes a boundary visible: between claimed assurance and available evidence, identity and personhood, permission and action, ambient behavior and explicit capability, and agent confidence and an executable verdict.

What does the evidence establish?

Proofbound

An assurance compiler for Proof-Driven Development that keeps tests, bounded checks, theorems, assumptions, and production linkage distinct.

Mechanism: Strict manifests bind claims to exact subjects and typed evidence; the compiler derives formal standing, production linkage, and assumption burden, then emits independently verifiable receipts.
Boundary: A proof can be correct while the released program is wrong. Proofbound connects the two only after checking that the source matches the proved behavior, or that the proof names the exact bytes being shipped.

Who acted?

Auths

Decentralized identity and signing for developers, software supply chains, and budgeted agents.

Mechanism: KERI key-event histories, Git-carried attestations, and signed receipts make identity state and agent spend independently verifiable.
Boundary: Verification establishes continuity from deliberately trusted roots; it does not reveal or require a legal identity.

What were they allowed to do?

Auths Proof

A strictly offline reference kernel for proof-carrying authorization.

Mechanism: A sealed, effect-free pipeline turns untrusted bytes into a non-constructible VerifiedAction while every authority dimension can only attenuate.
Boundary: Time, trust anchors, status, registries, and resource limits are explicit inputs; the kernel deliberately owns no ambient effects.

What can the code do?

capsec

Behavioral safety for Rust through auditing, capability types, and runtime control.

Mechanism: Zero-sized proof tokens expose permissions in signatures; static analysis finds ambient I/O; runtime capabilities can expire or be revoked.
Boundary: Direct standard-library calls, unsafe code, and FFI remain explicit escape hatches surfaced by auditing rather than wished away.

What makes a claim trustworthy?

recurve

A framework that turns promises into falsifiable claims and drives agents behind an executable gate.

Mechanism: Every probe must reject a retained known-bad trap before it may certify work; GREEN, RED, and BROKEN remain distinct verdicts.
Boundary: Assurance is graded by the strength of each probe and its underlying oracle, never by the confidence of the agent.