AI Systems Engineer — Agent Runtimes, Secure Execution & Reliability

I build the systems underneath AI agents: durable execution, secure tools, recovery, evaluation, and distributed-system correctness.

The model proposes, the runtime decides. A model choosing a tool name is a suggestion. Whether it executes, under what authority, and whether its effect can repeat, are properties of the system around it — not of the model.

310 runtime tests · 15/15 sandbox attacks blocked · 96 preregistered research episodes · 28 idempotency tests

Every figure is reproduced from a fresh clone of the pushed state, and each repository maps its claims to a command and an artifact you can run yourself.

Agent Runtime Lab. Model proposals are compiled into a validated execution graph the runtime owns; one unauthorised step rejects the whole plan. Python runs in a network-less, non-root, resource-capped container attacked by a 15-case adversarial suite. Runs survive the process that started them — a scheduler that has just started is indistinguishable from one that has run for an hour, because neither holds anything the other lacks. A controlled ablation found the tested supervisor pattern used 4x the model calls and 3.2x the tokens without improving tool-call recovery; the negative result is published because that is what the measurement says.

Workflow-to-Agent. A screen recording becomes a process model, an SOP and a decision tree, then a guarded agent behind human review gates. Every external capability sits behind an SPI with deterministic stub adapters, so the pipeline runs offline with no API key. Its original verification reported a perfect equivalence score it could not fail — it compared strings derived from the same source as the artefact under test. Those numbers were withdrawn, and CI now fails the build if they return.

Agent Reliability Lab. Preregistered interventions for multi-agent coordination failure, with fixed seeds, judge-free deterministic detectors and frozen preregistration hashes. A detector audit found one detector inverted — firing on healthy runs and never on real failures. The correction is versioned alongside the original rather than replacing it. Submitted to DAI 2026 (AI Paper Track), under review.

Idempotency Engine. Stripe-style idempotency keys over PostgreSQL: a recovery-point state machine where each phase commits in its own transaction and the external call sits outside any transaction. The interesting test is the one where the provider has already charged and the process dies before the commit lands. The guarantee is stated precisely — at most once per key within the TTL, not a generic "exactly once".

Controls proven by attack, not inspection. Asserting that --network none appears in an argv is necessary; launching a container and failing to reach the network is the evidence.

Negative controls. A gate that has never been shown to fail is not a gate. Every one here has a case proving it catches a real defect.

Precise guarantees, visible limitations. Exactly-once across a network boundary is not achievable. Docker is not a microVM. A denylist is not a sandbox. An unmeasured number is not a result.