Blog¶
I build security infrastructure for AI agents and accountless privacy tooling. My work spans three theme arcs: tools that help agents reason about sources and route payments, privacy primitives for people who want to operate without accounts or central operators, and network and DNS-layer defenses for the environments agents run in.
This is where I write about what I'm building, document lessons learned, and explore the intersection of security, privacy, and practical software engineering.
Recent Posts¶
November 2026¶
more eyes: Open Is Not the Same as Looked At - November 2, 2026
more eyes is a set of sourced, versioned notes. Each one takes a common claim about software or bitcoin custody, states what evidence would support it, and reads the public record against that. Nine notes so far, on custody, multisig, releases, packages, confidential AI, fallbacks, vulnerability reports, and custodians. CC BY 4.0, and corrections are wanted.
tokenstats: The Market Feed Behind arbstr's Routing - November 1, 2026
tokenstats watches the AI inference market across Routstr nodes, OpenRouter, and OrcaRouter, and prices every model in USD and sats. An October round added reliability and latency that survive restarts, a healthy signal on every quote, same-model price comparison across sources, capability flags, and a security pass that fixed a reflected XSS in the dashboard.
October 2026¶
cipherpost v2 alpha: Every Share Gets Its Own Key - October 31, 2026
cipherpost v2.0.0-alpha.1 publishes each share and each receipt under its own derived key on the Mainline DHT. That removes the one-share-at-a-time limit, makes receipts harder to enumerate, and passed a live round trip on the real DHT.
Chat Signal 2.1, Almost Two Months In: On-Device AI and No Network Calls - October 31, 2026
In September I moved Chat Signal's AI onto the device. Summaries run on Chrome's built-in Gemini Nano, the clustering model ships in the package, and the extension makes no external network connections. Here is why, and how it has held up.
Sealedge 6.1 and 6.2: What an External Review Changed - October 31, 2026
An external review of Sealedge found four critical issues. Fixing them turned into a content-encryption redesign with forward secrecy, a hash-linked device chronicle, key rotation and revocation, and a round of custody hardening.
arbstr node 1.0: The Whole Stack, Pinned to Released Images - October 31, 2026
arbstr node 1.0 runs the arbstr routing engine, the arbstr vault treasury, Lightning, and a Cashu mint with one docker compose up, every service on a pinned, released image. Follow-up releases through node 1.3 lock internal services to localhost, tighten payment and key handling, and sharpen routing.
oshi-mcp: Letting an AI Agent Near Bitcoin Rewards, Read-Only by Default - October 31, 2026
oshi-mcp is a small Rust MCP server for Oshi API Rewards. An agent can look up campaigns, rewards, and users out of the box. Anything that spends sats, voids a reward, or mints a wallet sign-in link stays hidden until you turn it on by name, then needs your approval on every call and leaves an audit record.
May 2026¶
Eight Months of Security Infrastructure for AI Agents - May 22, 2026
A thematic survey of what I built across eight months of silence: trust registries, accountless privacy tooling, Bitcoin payment rails for AI inference, and DNS-layer defenses for agent networks.
3goodsources: A Trust Registry for AI Agents - May 22, 2026
3goodsources is an MCP server that delivers exactly three curated, cryptographically-signed sources per topic, giving AI agents a quality signal the open web can't provide.
cclink: Accountless Claude Code Session Handoff over DHT - May 22, 2026
cclink lets you resume a Claude Code session on any machine (encrypted, signed, no accounts, no relay) using your Ed25519 key and the Mainline DHT as the rendezvous.
arbstr: LLM Routing with Bitcoin Settlement - May 22, 2026
arbstr is a three-part ecosystem (routing proxy, treasury service, and deployment layer) that automatically picks the cheapest qualified AI inference provider and settles costs in Bitcoin over Lightning.
cipherpost: Serverless Cryptographic Material Handoff - May 22, 2026
cipherpost is a CLI tool for handing off SSH keys, certificates, and secrets over the Mainline DHT: end-to-end encrypted, signed receipt included, no server required.
blindjoin: CoinJoin with Blind Signatures - May 22, 2026
How I built a Bitcoin CoinJoin coordinator and client that uses RSA blind signatures so the coordinator cryptographically cannot link inputs to outputs.
PKTap: NFC Contact Exchange Without Servers - May 22, 2026
An Android app that lets two phones tap over NFC to swap encrypted contact info (no accounts, no servers, no cloud) using Ed25519 key exchange, XChaCha20-Poly1305 encryption, and Mainline DHT.
HoneyPrompt: AI Agent Compliance Testing - May 22, 2026
A terminal-first tool that generates honeypot web pages with hidden prompt-injection canaries, giving security teams measurable, graduated evidence of how AI browsing agents behave in the wild.
agent-dns-firewall: In-Process Domain Blocking for AI Agents - May 22, 2026
An npm library that adds a synchronous domain-level blocklist check before fetch() (no DNS server, no proxy, no infrastructure) so AI agents can drop known-bad destinations before they make the call.
September 2025¶
TrustEdge Goes Professional - GitHub Organization, Live Audio Capture, and Universal Backend System - September 5, 2025
TrustEdge moves to TrustEdge-Labs GitHub organization with live audio capture, Universal Backend system, mutual authentication, format-aware processing, and 93-test comprehensive suite.
August 2025¶
TrustEdge Milestone 1 Complete: Network Stack, Key Management, and Production-Ready Format - August 28, 2025
TrustEdge reaches a major milestone with a complete network stack, three binaries, comprehensive documentation, enhanced key management, and production-ready security features.
TrustEdge Major Update: Envelope Format, Manifest, and Streaming Security - August 25, 2025
TrustEdge now features a robust encrypted envelope file format, per-chunk Ed25519 signatures, authenticated metadata (AAD), and improved CLI/key management for secure streaming workloads.
TrustEdge: Trustable Edge AI (Rust) - August 19, 2025
Announcing my latest project: TrustEdge! A public learning journey in Rust, focused on privacy-preserving, trustable edge AI pipelines. Phase 1: chunked file read, per-chunk AES-256-GCM encryption/decryption, and immediate verification.
July 2025¶
BIP Namer: From Cryptocurrency Standards to Creative Project Naming - July 27, 2025
Building a fun project name generator using the BIP-39 cryptocurrency wordlist to create military-style operation names. Exploring the intersection of blockchain standards and creative tools.
Building a Bitcoin Real-World Converter: FastAPI, Live APIs, and Financial Precision - July 27, 2025
Deep dive into building a comprehensive Bitcoin price converter that transforms BTC/sats into real-world goods using multiple financial APIs, FastAPI backend, and vanilla JavaScript frontend.
Summer 2025 Development Sprint: Major Updates Across Portfolio - July 6, 2025
A comprehensive update on recent development activity including major enhancements to QwikUp Signs, Privacy Lockscreen, Vacation Time Optimizer, and other projects.
Building a Smart Vacation Optimizer: React, TypeScript & International Holidays - July 4, 2025
Creating a comprehensive vacation planning application using React 18, TypeScript, and multiple international holiday APIs to maximize time off efficiency.
Privacy Lockscreen Generator: From Simple Idea to Full Web App - July 4, 2025
Evolution of a privacy advocacy tool into a comprehensive web application with device-specific templates, advanced color systems, and social media integration.
Introducing QwikUp Signs: Smart Sign Cleanup Platform - July 4, 2025
Revolutionary civic technology platform transforming sign cleanup into community-driven initiative using GPS tracking, QR codes, and automated bounty payments.
Building QwikUp Signs: A Full-Stack Marketplace Platform with Next.js, Supabase & Stripe - July 4, 2025
A technical deep dive into building QwikUp Signs, a three-sided marketplace platform for urban sign cleanup, using Next.js 13 App Router, Supabase, and Stripe with GPS tracking and automated bounty payments.
June 2025¶
Building HypeCrew: A Marketplace for Hype Performers on Bolt.new - June 29, 2025
Learn how to build a two-sided marketplace connecting hype performers with event clients using Bolt.new, TypeScript, React, and Supabase.
ExitPal: Social Anxiety Meets Innovation at Bolt.new Hackathon - June 28, 2025
Building an exit planning application for awkward social situations using TypeScript, modern UI design, and practical problem-solving approaches.