Don Johnson @copyleftdev

Contract-first anomaly detection across ~30 formats — logs, security telemetry (syslog, CEF/LEEF, EVTX, Suricata EVE, osquery, CloudTrail), network (pcap, NetFlow, DNS), observability (OTLP, Prometheus, journald), data (CSV/JSON/Parquet/SQLite/Avro/ORC). Deterministic Rust CLI; 9 detectors / 7 classes; NIST-validated, mutation-tested.

Deterministic crawl kernel in Rust — same seed, identical crawl, identical replay. BoringSSL TLS impersonation (JA3/JA4), 17-patch CDP stealth mode, BLAKE3 content-addressed storage, WARC++ format, distributed crawling, RAG extraction. 288 tests, 15 crates, 10K pages proven.

Agent-first Linux packet-path tracing with Rust/eBPF: bounded evidence, deterministic replay, and packet routes with receipts.

Systems-level software engineer building security tools, developer infrastructure, and AI-native systems in Rust, Go, and Zig. 560+ open source repositories.

Detect C2 beacons in network traffic using Floquet spectral analysis from quantum chaos theory. Fast, 274KB Zig binary. Reads pcap, live capture, or OpenTelemetry JSONL.

Operation Long Shadow · Forensic investigation of a four-cluster GitHub repo-laundering operation that buries fabricated commits in 2037 to bubble laundered repos to the top of every AI-built-code search.

Forensic dataset + live dashboard for the 2026-04-29 'A Mini Shai-Hulud has Appeared' npm supply-chain worm by TeamPCP. 1,117 dropbox repos, 22 compromised accounts, 47 IOCs across 14 kinds. Trojaned: @cap-js, mbt, @bitwarden/cli. C2 attribution to AS209101 IP Vendetta Inc. JSONL data · kinetic dashboard · CC-BY-4.0.

Zero-trust proxy network — nodes prove hardware identity via TPM 2.0 remote attestation before receiving ephemeral mTLS certificates. Written in Rust.

Production-grade Claude Code artifacts (hooks, agents, commands, gates, sweeps, drifts) wrapped around an axum + sqlx + sqlite todo API. Tutorial.

Backend-less internet health and flux monitoring tool (Zig)

Open threat-intelligence and IP-reputation ETL for phishing and abuse screening, with BGP and Arrow/Parquet releases

Local-first deterministic IP intelligence CLI with auditable evidence and policy-grade JSON

Touch every layer of Git and GitHub—from first commit to platform engineering.

A complete, safe JSONata implementation in Rust — JSON query, transform, and expression evaluation

Independent Rust implementation of SOLVE v0.5, Irregular's rubric for scoring vulnerability-discovery and exploit-development difficulty. Reproduces all 16 published DownUnderCTF calibration assessments.

Trust-scheduling execution fabric: run untrusted workloads in tiered disposable sandboxes (Firecracker microVM / gVisor / Xen) and emit host-sourced, tamper-evident evidence.

Security-hardened, allocation-free no_std HOTP/TOTP for Rust with strict RFC 4226/6238 behavior and constant-time verification.

Focused, offline-first vulnerability intelligence CLI — CVE & package-version checks with typed evidence, from verified data releases

Deterministic data pipeline for VulnGraph — ingests 11 vulnerability sources, publishes reproducible checksummed graph releases

Live system cognition engine. Reimagines tail from "show me lines" to "what's happening, what matters, and why?" Auto-detects log formats, groups patterns, detects anomalies, reconstructs traces, outputs structured JSON for AI agents. 144 KB. Zero config. 69K events/sec.

Multi-pattern fixed-string matcher. Aho-Corasick + SIMD on mmap'd files. NDJSON output for AI agents and pipelines.

Distributed attested CI mesh — property-tested at every layer

Specification-first developer portal: modular OpenAPI 3.1 + AsyncAPI 3.1 sharing one domain model, an enforced error registry, and CI that can actually fail.

Break noise. Preserve truth. A deterministic semantic reduction engine for structured data — JSON, YAML, CSV, NDJSON, Markdown, PDF. Fingerprinting, entropy, anomaly detection, schema drift, clustering, and AI-ready essence generation. Built in Rust.

Why prompts are just the surface. Depth comes from the system you build. — Don Johnson

A convention-safe genome-variant kernel: normalization + VCF/HGVS/VRS boundaries + liftover, validated byte-for-byte against bcftools, vrs-python, and biocommons hgvs.

AI-first Unix primitives, clean-room reimplemented in Zig under one self-describing, machine-checkable contract

A forensic instrument for codebases. A quantifiable way to tell the truth.

A cartographic browser survey for entropyx: streaming scans over SSE, a printable plain-language brief, and the scoring kernel in WebAssembly.

Care Compass: Gemma 4 healthcare navigation demo with Aion signed-policy decision evidence

Single-binary webhook inbox — capture, inspect, and debug HTTP webhooks with zero dependencies. Embedded SQLite, live dashboard, cross-platform. Just scp and run.

super top secret

Hands-on exercises for forgotten Linux pipe & stream commands — sample data, real exercises, Claude Code skill included.

A modern, extensible, high-performance CI/CD engine written in Rust.

Cost-optimized 10-inch Raspberry Pi cluster rack builds (–). Four verified BOMs with PoE+ switch, DeskPi RackMate, and UPS. MILP-optimized pricing.

Ask a TLA+ specification about a state, and get an answer. A parser and evaluator for TLA+ in Rust — not a model checker.

Official Go SDK for the TokenTip API — tips that buy AI inference credit. Zero dependencies, stdlib only.

Official TypeScript SDK for the TokenTip API — tips that buy AI inference credit. Zero runtime deps.

Official Python SDK for the TokenTip API — tips that buy AI inference credit. Sync + async, typed.

AI-native adversary-emulation & breach-and-attack-simulation (BAS) instrument in Rust — atomic MITRE ATT&CK techniques an LLM can orchestrate, behind Ed25519-signed authorization scopes, emitting typed tamper-evident evidence.

What actually matters across N files: consensus, drift, outliers and variant families — for configs, JSON, YAML, XML, PDF, even executables (SSDeep-class fuzzy analysis). Deterministic, evidence-backed, zero-dependency Zig.

Self-hosted ngrok alternative in Rust. Development in progress - check out the issues for detailed specs.

AI-native exact calculator and contract-first Rust CLI for typed JSON math, symbolic reasoning, property tests, and mutation-tested agent workflows.

OpenAPI testing and deterministic API fuzzing for AI agents—catch contract bugs before unsafe calls with local-first sealed plans, MCP, and replayable evidence.

Voice typing that never leaves your machine. Local NVIDIA Parakeet transcription, Rust + iced, for Linux.

AI cost, with the vibes removed. Exact-rational models + a live calculator for the 8 LLM inference-cost decisions every agent builder faces — model choice, routing, self-host, the reasoning-token tax, cascades, caching, and the O(K²) agent loop. Every number reproducible.

A curated, living directory of open-source AI tools that run on inference — and how to fund the people who build them. Published by TokenTip.

High-performance decentralized coordination protocol for multi-agent LLM systems. Plant-inspired signal diffusion with sub-microsecond processing, QUIC P2P networking, and unified LLM backends (Ollama + Claude).

SCGP reference implementation in Rust: compile large codebases into verified semantic graphs, deterministic glyphs, and token-budgeted AI context.

High-performance MCP agent mail server — lock-free message routing, NRT search, Git audit trail. Built in Rust.

Formally verified spreading activation primitives for the Co-Wiki architecture (Shomo, 2026). 7 Rust crates, 113 tests, 0 unsafe.

Defensive Claude Code scam-baiting agent harness with personas, stall tactics, anti-detection, session state, intel extraction, and call QA.

Unofficial portable Claude Code and Codex skill for NASA/JPL Power of Ten code reviews.

Nim implementation of TOON (Token-Oriented Object Notation): compact, human-readable JSON serialization and parsing for AI and LLM prompt workflows.

The skills of the gods, encoded for mortals. Legendary engineer coding philosophies as Anthropic-compatible Skills.

MCP control plane kernel — routes intents through policy, federates upstream MCP servers, and reasons with Claude Opus 4.7. Named after IBM Project Stretch (IBM 7030, 1961).

An adversarial certification environment for agentic RPA: does the agent respect its authorization envelope and commit exactly once under ambiguity? Scores conduct, not just correctness.

The Agentic MCP Server for Emacs. Multi-agent orchestration and autonomous coding tools in Zig.

One Go HTTP server. Five isolation runtimes. gVisor, Kata, Firecracker, and WASM benchmarked.

EMV 3-D Secure 2.x (3DS2) protocol — AReq/ARes/CReq/CRes messages, transaction state machine, ECI/CAVV helpers, and full EMVCo spec serialization for payment authentication (SCA/PSD2)

High-performance Rust kernel for the TAK (Team Awareness Kit) ecosystem — drop-in replacement for the messaging core of the Java TAK Server. Cursor-on-Target (CoT) over mTLS, single-node firehose at 10k+ concurrent clients. Compatible with ATAK, iTAK, WinTAK.

Composable, rigorously verified load-balancing primitives for Rust

ClaimZen — evidence-backed denial recovery. Marketing site.

Unofficial Effect-native TypeScript SDK for the Humana Data Exchange APIs (Apigee + FHIR R4).

Marketing site for invariantd.com — video-first landing

Lock-free delta-xDS control plane for Envoy. Incremental updates, zero-copy fan-out, content-addressed versioning — the performant Rust alternative to go-control-plane.

Seuil Proof of Rigor — WASM benchmark visualization

Unity Simple 3D Shooter

An essay about abstraction, engineering judgment, and why AI changes the burden of proof—not the need for engineering.

Executable essay on AI system boundaries, property-based testing, and mutation testing

Hands-on exercises for forgotten git commands — crafted history, real bugs, real bisect targets.

A robust, over-engineered "Hello World" Go application demonstrating: DDD, CQRS, and event sourcing Redis and file-backed event bus Plugin system (ASCII, TTS, LED, etc) Prometheus & OpenTelemetry observability Property-based and integration tests Automated test reporting and coverage

Mathematically serious Rust crate for a deeply unserious Silicon Valley tip-to-tip efficiency empire.

FAFO as a Service — an event-driven homage to FOAAS and a working masterclass in spec-first engineering: AsyncAPI 3 + MCP, polyglot codegen, derived contract tests, a generated conformant server, 98/98 mutation score. Consequences: eventual.