Software engineer · AI developer tools · Backend systems · Cross-platform software
Website · LinkedIn · Email · Repositories
I build software across AI tooling, APIs, full-stack applications, and native systems. My work spans shipping interfaces and backend services, integrating local language models, debugging production environments, and contributing fixes to other teams' open-source projects.
What I optimize for: reproducible setup, observable behavior, clear failure handling, tests that catch regressions, and code that another engineer can review and maintain.
LeaseLedger is an original, single-host durable job queue built with Python and SQLite WAL. It tackles real backend consistency problems: fencing stale workers, recovering crashed leases, idempotent producer requests, transactional audit events, bounded retries and dead-letter jobs. Four independent processes compete for work in its integration tests, and a killed worker's lease can be reclaimed safely. All 54 tests pass across Python 3.11–3.13 in CI (40 queue, eight publication and six benchmark tests). A one-command offline demo also proves stale-ACK rejection and backup recovery using a real SQLite database. Version 0.1.3 was published by a workflow gated on tests, packaging, benchmark smoke, lint and CodeQL. The writer-contention fix rejects leases that expire while waiting for SQLite, with six regressions and verified Kali/macOS runs. A 60-trial workload study records 18,000 completed jobs, 1,800 retries, operation p95/p99s, worker contention and actual handler delays across Kali and macOS. It preserves all trials and documents a large scheduling discrepancy instead of claiming production capacity. Version 0.1.2 adds seeded fault-injection tests and fixes a verified queue-starvation bug where 100+ exhausted leases concealed runnable jobs. Version 0.1.1 introduced online WAL-safe backups and integrity verification.
Run the verified offline demo · View its machine-checked JSON output · Read the architecture · Why fencing tokens matter · See verified CI · v0.1.3 release · Reproduced claim starvation and fix · Online backup and recovery
Scope is explicit: at-least-once processing on a single host, not exactly-once external effects or a multi-region distributed queue.
Try the tested previews: PatchPilot v0.4.0 — a local AI coding-agent workflow, with Docker isolation requirements and limits; RepoPilot v0.1.0 — ZIP/source exploration that works without Ollama. Both link to reproducible CI and setup instructions.
|
Local-first AI developer agent · Python · Git Takes a repository task through code inspection, change planning, edits in a separate local workspace, test execution, and reviewable Git diffs. Engineering focus: fail-closed Docker test isolation, loopback-only API with optional bearer authentication, protected workspace operations, staged-secret commit refusal, filtered model context, bounded model-provider transfers, 116 backend tests, 4 MiB capped host-Git output and process-group timeout cleanup, five real Chromium scenarios for result/error state, and live isolation CI. Download v0.4.0 preview → · Give technical feedback → · Source and architecture → · HTTP security model → · Commit safety and limits → · AI context privacy → · Provider limits and integration tests → · Bounded Git runner and evidence → |
Native audio integration · C++ · PipeWire · CoreAudio Unofficial community ports retaining the upstream DfxDsp processing engine while adapting audio transport to Linux and macOS. Engineering focus: platform boundaries, native builds, audio processing, installer workflows, and platform CI. Status: alpha software; see the README for platform-specific limitations. |
|
Offline repository security review · Python · GitHub Actions Inventories known first-run execution hooks in unfamiliar repositories—npm lifecycle scripts, VS Code tasks, devcontainers, Cursor and Claude Code hooks, and local MCP launch commands—without executing repository code. Engineering focus: bounded, passive reads, symlink protections, SARIF reporting, reviewed baselines, 64 automated tests, and an actual reusable-action CI matrix on Linux, macOS, and Windows. v0.5.0 release → · GitHub Action quick start → · Threat model → |
Local codebase exploration · Python · FastAPI · React · Ollama Clones or imports repositories, indexes source, exposes file trees and code search, and supplies relevant context to a local language model for questions about the code. Engineering focus: validated and bounded ZIP extraction, atomic import reservations, credential-free HTTPS Git cloning, a local-only API security boundary, 95 backend tests, aggregate import-storage admission, scoped rollback after failed analysis, bounded pre-parser HTTP upload admission, cross-process import/AI work admission, supervised Git clone process-group cleanup with per-process resource limits, an event-loop-responsive ZIP API, frontend health-contract tests, Python 3.11–3.13 CI, and a real-browser regression proving repository-scoped search/answer isolation under a delayed API response. Download v0.1.0 preview → · Cross-platform first run → · Give technical feedback → · Source → · Reproducible HTTP walkthrough → · Real browser demo and isolation evidence → · Verified fix PR #25 → · Storage budget and limitations → · Import recovery regression and review → · HTTP upload limits and evidence → · Concurrency limits and tests → · Git child-process budgets and limitations → · Import security model → · Local-only API threat model → · ZIP threat model → |
Alongside source code, I maintain engineering case studies showing the problems, design decisions, tests and trade-offs behind my work: lease fencing, agent isolation, ZIP/Git import boundaries, SQLite data preservation, full-stack CI recovery, and native Linux/macOS portability. Each case links to verifiable PRs and CI results.
Recent reliability work: PsychologyOS PR #15 binds admin cookies to current account credentials and revokes them on password rotation/deletion. PR #16 makes quiz/exam writes atomic and verifies rollback plus concurrent XP accounting through 13 real HTTP scenarios. Both passed CI and CodeQL. In PR #14, I reproduced a curriculum reseed erasing student history, preserved legacy resource IDs, and added real SQLite rollback/retry tests. CI now verifies the production build. PR #13 also resolved the remaining dependency audit findings with a scoped, regression-tested patch. Read the design and limitations.
As of 15 October 2026, I have 25 merged pull requests across 9 repositories owned by other developers/organizations. These include bug fixes, tests, developer tooling, and documentation. Browse the merged PR history.
| Project | Accepted work |
|---|---|
| Hebbian-Robotics/hflow | 9 merged PRs involving data validation, artifact handling, tests, and examples |
| Internet Archive / Open Library | Corrected out-of-date developer documentation |
| ChurchCRM | Fixed floating controls overlapping modal dialogs |
| StaveIndustries / woo-pay | Improved WooCommerce error reporting and payment-failure persistence |
| pranjalparmar/fastdocparse | Simplified CLI errors and grounding logic |
PR acceptance and code review are more informative than a raw count of opened PRs. Current status and diffs are available via the links above.
Recent maintainer review follow-through: On ChurchCRM PR #10484, I corrected the translation-extraction configuration in response to maintainer feedback, verified that the requested string appeared in the generated catalog without committing it, and passed lint plus independent security checks. The PR was merged on 14 October 2026 and is included in the verified merged-contribution count.
Ongoing review: Poetry PR #11135 now preserves PATH executable aliases when source directories share their names, following a reviewer's reproduction. The follow-up passed 97 local environment tests (four platform skips) and real disposable CLI checks. Upstream CI passed; it remains open for maintainer review, and is not counted as accepted work.
Maintaining community contributions: WhatsApp bot PR #40 incorporated a correction from lucaslokchan's earlier PR #19, preserved verified co-author credit, and added privacy tests that prevent raw chat messages and provider exceptions from reaching logs. Both Node 20 and Node 22 CI checks passed. Historical unmerged credential-exposing PRs were closed with rotation notices; closing them does not erase the old public diffs.
My earlier Telegram/WhatsApp bot projects attracted independent stars and forks. The original Telegram AI Bot has since been upgraded to the OpenAI Responses API, with tested abuse controls in v2.1.0. The other older examples are not evidence of a current production architecture.
| Repository | GitHub stars · forks (13 Oct 2026) |
|---|---|
| chatgpt-bot-telegram — v2.1.0 | 141 · 148 |
| ChatGPT-Telegram-Bot | 72 · 371 |
| whatsapp-chatgpt | 68 · 168 |
Verified maintenance (17 October 2026): PR #13 introduced process-local per-user hourly usage admission, bounded concurrent paid requests and image-output validation. Its 16 regression tests include real Telegraf command handling with offline provider stubs. Node.js 20/22 CI, the production dependency audit and JavaScript CodeQL passed, including the versioned release PR #14. Limits reset per process and are not guaranteed account-wide monetary caps or verified live-bot deployment. Engineering writeup.
| Area | Technology |
|---|---|
| Backend & AI | Python, FastAPI, Node.js, APIs, local LLMs, Ollama, agent workflows |
| Frontend | TypeScript, React, Next.js, JavaScript |
| Systems | C++, Linux, macOS, SQLite WAL, fencing tokens, crash recovery, native audio |
| Delivery | Git, GitHub Actions, Docker, integration tests, VPS deployment, observability |
I publish reproducible engineering work, clear failure analyses, and maintenance-focused open source rather than maximizing commit counts. See the public portfolio quality roadmap and recent work on fenced leases and isolated AI-agent test execution.
ClonePeek provides a standard-library-only, offline scanner to inventory execution-capable repository configuration and a reusable GitHub Action for PR checks. It reports trigger → command → file/line → review action without running untrusted repository scripts. The scanner also examines bounded first-hop local shell-script references and hardened Git diff inspection, with explicit gaps for dynamic or transitive execution.
The v0.5.0 release has 64 Python tests and passing CI across Windows, Linux and macOS, including actual reusable-action integration tests. Its 51-case synthetic evaluation is deliberately labeled as non-representative; findings are heuristic review prompts, not malware verdicts or proof of repository safety.
The verified separate-repository consumer workflow also exercised the released GitHub Action against two immutable public config snapshots: seven Cursor hooks and two VS Code folder-open tasks. See the engineering case study and reproduction details. This does not imply independent external adoption.
I enjoy tackling concrete bugs, building useful developer tools, and working through edge cases with maintainers. For engineering opportunities, architecture discussions, or collaborations:
harshitethic.com · LinkedIn · contact@harshitethic.com
Evidence first: source code, reproducible examples, tests, PR discussions, and the trade-offs behind implementation.