I build software that can prove what it did — supply-chain evidence, agent accountability, and payment infrastructure. Solo, end to end.
Open to contract and full-time engineering work → 📫 tjagodka@gmail.com · 🌐 tonyjagodka.com
- A fix approved into CPython.
http.clienthung forever reading a 204 or 304 response that carriedTransfer-Encoding: chunked— no timeout, no error, just a stall. Found it, reported it, fixed it in 20 lines → python/cpython#157952 (approved, awaiting a core dev) - 21 pull requests merged into repos I don't own, across 9 organisations — sigstore, Hugging Face, Anchore, the Zcash Foundation, the x402 standard (Linux Foundation), OpenMed, Nodle, Tessera, probityai. Someone else's maintainer decided each one was worth carrying, which is the only review that counts. → the full ledger
- Source Review Coverage on the GitHub Marketplace. One line of CI that makes "two people approved this" something a stranger can recompute offline. Validated against 810 production merges with zero false positives. Apache-2.0
- Eight upstream projects audited in a day — CPython, pydicom, attohttpc, feedparser, Ersilia, purldb, plus two private security reports. One is now fixed and public: NLnet Labs fixed all four bugs I found in their Rust DNS library, a soundness bug among them, and RUSTSEC-2026-0310 credits me by name. Since then, a fuzz target on syft's SBOM decoder showed that a valid SPDX file could crash Anchore's grype scanner → anchore/syft#5326 (merged), and a round-trip target caught syft writing SBOMs it couldn't read back → #5349 (merged). → every finding, and the method
Python · TypeScript · Go · Rust · Swift · Solidity / Move — CI and release engineering, in-toto and Sigstore provenance, protocol spec work, and production services I keep running.
An x402 facilitator settling on Sui mainnet (independent,
non-custodial) · por-sdk on npm · a signed and notarized macOS
desktop agent · three agent-accountability tools —
rv · ev ·
xv · and text adopted verbatim into a published
IETF Internet-Draft, credited under
my legal name, Antoni Jagodka.
→ The long version, with the full engineering record
📫 tjagodka@gmail.com · 𝕏 @DrVelvetFog · 🌐 portfolio · 💖 sponsor the OSS
Lines I don't cross: no custody · no token-for-money sales · no PII capture · honest labeling (testnet/unaudited stated plainly). The fourth wall, on the other hand, is fair game.