Public evidence snapshot, generated deterministically from the manifest by the validator. A merged change is not presented as maintainership; an owner-controlled counter is not presented as adoption.
Electrical Engineering PhD researcher at CUHK. I maintain public tools for reproducible engineering, Python packaging diagnostics, local-first data work, and explainable security evidence.
I try to make each claim inspectable: public releases, runnable entry points, documented limits, and direct links to upstream work. A download counter or a self-submitted project listing is not presented as independent adoption.
The six repositories pinned above are the current featured set: BenchLineage, VulnFuse, WillItBreak, FrontierTrials, TermScope and ColdShelf.
| Project | What it does | Verifiable entry points |
|---|---|---|
| BenchLineage | Records experiment provenance, calibration, uncertainty and evidence, with portable ELN import/export. | PyPI · v0.3.8 · five accepted ELN contributions |
| VulnFuse | Correlates findings from SARIF, Trivy, Grype, Snyk, CycloneDX, OSV and CSV without hiding merge blockers or scanner disagreement. | browser workbench · v0.4.24 · security model |
| WillItBreak | Diffs a package's public API between two versions and reports only the breaking changes that reach your call sites, with file and line numbers. Zero dependencies. | README |
| FrontierTrials | Runs capability trials against frontier models behind one config and compares the runs, privately. | try it · study report |
| TermScope | Plots Arduino, ESP32 and STM32 telemetry in a terminal over serial, pipes or SSH, with CSV record/replay. | PyPI · v0.4.1 · hardware reports wanted |
| Project | What it does | Verifiable entry points |
|---|---|---|
| ColdShelf | Builds a private searchable catalog of unplugged drives, including snapshots, duplicate evidence and physical-location notes. | latest release · quick start · limitations |
| contextcost | Measures how much LLM context a repository costs to read, identifies the generated/vendored/data files that waste it, and re-measures after a proposed cut so the saving is real, not estimated. | PyPI · v0.5.3 · GitHub Action · MCP server |
Experimental projects — useful, but not yet stable or broadly validated.
| Project | What it does | Verifiable entry points |
|---|---|---|
| OhmJudge | Answer-free, auditable electrical-engineering model evaluations — no API key required. | README |
| DidYouLearn | Outcome-based evaluation for AI tutors — which one actually helps you understand. | README |
| EvalInt | Lint your LLM eval set: reliability, items scored against a reference. | docs |
| ResearchBench | A working researcher's running comparison of AI systems on real research tasks — no API keys, no synthetic datasets, judgment by the person who needed the answer. | design doc |
See all repositories and published Python packages. The projects above are the small set I currently use to represent my maintenance work.
What actually landed in each repository lately — the newest release or substantive commit per project, newest first, drawn from each repository's own git log. Where only dependency or CI upkeep moved since a release, that is what the row says. Refreshed 2026-08-26.
| Project | Latest | What landed |
|---|---|---|
| contextcost | v0.5.3 · 2026-08-26 | PyPI project page now mirrors the repository README — the 17-repo hero table and recalibrated ±23% error bound are live on PyPI, not just GitHub. Prior release v0.5.2 fixed the estimator breaching its own printed bound on lockfile-heavy repos (exact cl100k_base study across real repos). |
| BenchLineage | v0.3.8 · 2026-08-26 | One _version.py source now feeds --version and every bundle, ELN and report stamp — v0.3.6's wheel had shipped internally inconsistent metadata; new tests pin the consistency (f035b14). A zero-install trial followed: uvx benchlineage demo my-bench --seed 20260804 then verify, with the expected "valid": true stated up front (81ee19a). |
| VulnFuse | v0.4.24 · 2026-08-12 | Preserved scanner image identity when correlating Trivy SARIF findings. Since the release: a synthetic three-scanner demo so the CLI can be tried with no scanner output at all (90c9d42), and a README worked example walking that demo end to end — five findings become four explainable clusters, with the evidence scores and scanner-agreement numbers quoted (38a95b7). |
| WillItBreak | v0.1.3 · 2026-08-12 | --ascii now escapes Unicode report content instead of emitting it raw (#5). |
| FrontierTrials | v0.4.1 · 2026-08-26 | Bulk capture: paste every product answer once (separated by === name lines) or drop a .txt/.md file — manual per-product pasting is now the fallback (f60d00a). |
| TermScope | v0.4.1 · 2026-08-12 | Fixed token boundaries in labelled telemetry output (#8). |
| ColdShelf | v0.1.7 · 2026-08-12 | Version-agnostic installation verification (#16). |
| EvalInt | v0.2.30 · 2026-08-12 | Promptfoo ingestion audited end to end: named metrics, test-case identity, and errors kept out of scores (#55, #57, #59). |
| DidYouLearn | v0.1.1 · 2026-08-12 | Release and package-publishing pipeline hardened; attestations moved to the current GitHub action. Only dependency upkeep since (#9). |
| OhmJudge | v0.3.0 · 2026-08-11 | Answer-free blind response collection (#1). Only dependency upkeep since (#5); CodeQL workflow hardening noted earlier still stands. |
| ResearchBench | v0.1.0 · 2026-08-21 | Landscape research batch 2: PaperQA2, SciCode-Verified and MLAgentBench compared, with a synthesis note (2026-08-22). |
Upstream contributions (fixes, reviews and triage in other projects) are
tracked in COMMUNITY_FOOTPRINT.md — 22 merged, 65 open across 34 upstream organisations (live GitHub counts). Latest:
yq#2840, a docs fix that replaces a dead
Snapcraft confinement link in the README (the old docs.snapcraft.io/snap-confinement/6233
URL now 404s; it now points at the live snapcraft.io/docs/snap-confinement page —
first contribution to mikefarah/yq);
dask#12560,
an exact-head verification review of the fix for str.split(expand=True)
silently reporting object/str metadata while computing string columns:
a pandas-vs-meta-vs-computed matrix across three input dtypes and two
convert-string settings shows every probe internally consistent at head,
the full dask-expr suite passes 4329 tests with zero failures, the red
nightly CI job is attributed to unrelated scipy-sparse deprecation fallout,
and the review documents a pre-existing hash-seed-dependent metadata leak on
main with a minimal reproducer;
zarr-python#4290,
which honors explicit rectilinear chunk-grid requests whose edges happen to be
uniform: since 3.3.0 a nested-sequence spec like [[10, 10, 4]] was silently
collapsed to a regular grid, and the two diverge under resize — the regular
grid extends the uniform pattern while the rectilinear grid appends an edge, so
append-only workloads got a chunk-rewriting layout they never asked for; and
rclone#9823, a
fix for a nil-ETag panic in S3 multipart uploads (#9822): an UploadPart
success without an ETag header is now treated as retryable so the chunk is
resent instead of crashing the transfer.
Three things, all publicly inspectable:
- Build tools I use. Reproducible-engineering, Python-packaging diagnostics, local-first data and explainable-security tooling, maintained openly with releases and runnable entry points (above).
- Fix things where I am a user. 22 accepted pull requests across 12 upstream projects — eLabFTW, TheELNFileFormat, SampleDB, Astropy, CycloneDX, Keycloak, Plotly.js, rclone, Syft, tox, regl-line2d and argoproj/argo-workflows. I reproduce each issue locally and ship a test with the fix.
- Help maintainers decide. Root-cause analyses on upstream issues and tested reviews of third-party changes in the same communities.
The full, dated log with per-PR detail is in CONTRIBUTIONS.md.