I build software that can prove what it did — supply-chain evidence, agent accountability, and payment infrastructure. Solo, end to end.
Open to contract and full-time engineering work → 📫 tjagodka@gmail.com · 🌐 tonyjagodka.com
- A fix approved into CPython.
http.clienthung forever reading a 204 or 304 response that carriedTransfer-Encoding: chunked— no timeout, no error, just a stall. Found it, reported it, fixed it in 20 lines → python/cpython#157952 (approved, awaiting a core dev) - 19 pull requests merged into repos I don't own, across 8 organisations — sigstore, Hugging Face, Anchore, the x402 standard (Linux Foundation), OpenMed, Nodle, Tessera, probityai. Someone else's maintainer decided each one was worth carrying, which is the only review that counts. → the full ledger
- Source Review Coverage on the GitHub Marketplace. One line of CI that makes "two people approved this" something a stranger can recompute offline. Validated against 810 production merges with zero false positives. Apache-2.0
- Eight upstream projects audited in a day — CPython, pydicom, attohttpc, feedparser, Ersilia, purldb, plus two private security reports. One is now fixed and public: NLnet Labs fixed all four bugs I found in their Rust DNS library, a soundness bug among them, and RUSTSEC-2026-0310 credits me by name. Since then, a fuzz target on syft's SBOM decoder showed that a valid SPDX file could crash Anchore's grype scanner → anchore/syft#5326 (merged). → every finding, and the method
Python · TypeScript · Go · Rust · Swift · Solidity / Move — CI and release engineering, in-toto and Sigstore provenance, protocol spec work, and production services I keep running.
An x402 facilitator settling on Sui mainnet (independent,
non-custodial) · por-sdk on npm · a signed and notarized macOS
desktop agent · three agent-accountability tools —
rv · ev ·
xv · and text adopted verbatim into a published
IETF Internet-Draft, credited under
my legal name, Antoni Jagodka.
→ The long version, with the full engineering record
📫 tjagodka@gmail.com · 𝕏 @DrVelvetFog · 🌐 portfolio · 💖 sponsor the OSS
Lines I don't cross: no custody · no token-for-money sales · no PII capture · honest labeling (testnet/unaudited stated plainly). The fourth wall, on the other hand, is fair game.