Jinx was here.

Systems architect. I build the tooling that makes AI coding agents safe to let loose: a review gate run by other vendors' models, a credential broker that never hands over a credential, retrieval engines that ship with their measurements. .NET 10 Native AOT, Rust, TypeScript. Spain.

_{Under the hood: .NET 10 / C# 14 — Native AOT, ASP.NET Core minimal APIs, Aspire, Blazor WebAssembly, EF Core, Roslyn, the MCP C# SDK, Serilog · Rust — axum, tokio, ONNX Runtime through ort (DirectML / CUDA / MIGraphX-ROCm), fastembed, tokenizers · TypeScript — VS Code Extension API, esbuild, ESLint, vitest; zero runtime dependencies in the shipped extension · Model Context Protocol over stdio and HTTP/SSE · Postgres, Qdrant, Neo4j, SQLite · BGE-M3, bge-reranker-v2-m3, Ollama / vLLM; Codex, Antigravity (Gemini), Claude and DeepSeek CLIs as reviewers; Microsoft.Extensions.AI.Evaluation · AES-256-GCM, scrypt, HKDF, X25519, Shamir over GF(2⁸), YubiKey (WebAuthn) unlock, JWT with Entra ID / Google sign-in, OS keychain, WireGuard / OpenVPN · Docker (chiseled images, multi-arch buildx, ghcr.io), Docker Compose, nginx + certbot, GitHub Actions, semantic-release, SonarCloud, CodeQL, CodeRabbit · xUnit v3, FluentAssertions, bUnit, Testcontainers.}

code --install-extension remsoftdev.connect-other-ais

Your AI cannot see its own assumptions. Other vendors' models can. So before the code is written, Codex, Antigravity (Gemini), a second Claude or DeepSeek read the plan — and after it is written they read the diff — in rounds, until the findings that matter drop under a threshold or a human is called. In the repo's own words: "The value is not 'more review'. It is review by a model that cannot see the author's reasoning."

• A Native-AOT .NET 10 MCP server over stdio. The extension is the face; the engine is a process your MCP client starts.
• The plan is gated before the code exists: review_code refuses until a plan round reached proceed. Skipped stages are impossible, not discouraged.
• Findings de-duplicated — same file, lines within ±5, same remark → one — and gated per role. Every accept and every reject, with its reason, is kept locally: the shape of your own AI's blind spots.
• A model on your own machine, over Ollama or vLLM, can sit in the same chair. It is measured per stage and told where it earns its place.

Measured — one commit, three hosted models, 19 findings, each judged by reading the code it cites: taking the repository checkout away made every model find more useful defects — 4→8, 6→10, 6→7 — at a half to a third of the input tokens, with no wrong finding from any of them (the raw table). The gate also reviewed itself and found nine real defects. All fixed; every fix watched fail first.

code --install-extension remsoftdev.creds-for-devs

SSH hosts, keys, VPN configs, database connections and passwords, in VS Code — with an optional self-hosted server so a team can share them without anyone running a vault they have to trust. The one idea worth knowing, in the repo's words: "The server cannot read anything it stores."

• Secrets live in the OS keychain. What syncs is AES-256-GCM under a random 256-bit master key; scrypt (N = 2¹⁷) only ever wraps the PIN — cryptoUtils.ts. The server holds ciphertext and has no code path that could acquire a key.
• An AI agent gets a capability token, never a credential. The broker's response protocol has no field a secret could occupy — brokerProtocol.ts says so in its first ten lines, and the compiler holds it to that. Every single call still asks you, in your editor, showing the real entry and the real command.
• Agent access is a six-switch ladder, off by default, in which "may edit but not view" is unrepresentable — mcpAccess.ts.
• Zero runtime dependencies in the extension. A YAML/TOML/INI validator, a Shamir split, an SSH agent and a QR decoder each had an obvious package and were written instead.
• Sizes, stated honestly: the Native-AOT creds CLI is 6.8 MB on disk, 2.3–3.1 MB to download; the server image is 50 MB, chiseled, no shell.

Security reviews are dated and public. The one from 2026-08-27 found a HIGH — output masking keyed on field names, so a renamed field could echo a freshly rotated password back to the agent — and fixed it the same day, red test first.

• Zero leaks by construction. A protocol with no field for a secret beats a policy that asks a model not to leak one. The compiler does not get tired.
• Native AOT, because startup is the user-visible cost. An MCP client waits for the handshake before it can list a single tool. If a CLI needs a 200 MB runtime to bridge IPC, the architecture failed.
• Every number ships with its sample size — including the ones that refuted me. A measurement that cannot change a setting is decoration.

The numbers I trust are the ones that argued with me. Each row below refuted an intuition, and each links to the public file holding the raw data.

• dew_flow_sidecar_rust — a single-binary Rust embedding + reranking service: BGE-M3 dense and sparse in one forward pass, bge-reranker-v2-m3, on whatever GPU is present — DirectML, CUDA, MIGraphX/ROCm or CPU as compile-time features. A wedge detector for the forward pass ONNX Runtime cannot cancel; a cosine canary gating every freshly compiled engine, because a crash mid-compile leaves a cache that loads fine and answers wrong.
• dew_flow_benchmark — measure any code repository, at any commit, through any retrieval engine — and get an answer that survives being asked ten thousand times. A selection/held-out split in the contract itself, and one wall-clock budget per leg, because a per-call timeout under a 25-turn agent loop is four hours of one leg.
• dew_flow_mcp — one tool catalog over stdio and HTTP/SSE, plus a bridge that hands the same tools to a local LLM in-process. The public repo cannot know retrieval exists — architecture tests on both sides of the boundary enforce it. Tool descriptions are runtime configuration, because wording turned out to be the biggest lever in the system (see above).
• dew_flow_conventions — one copy of every cross-repository rule for AI-agent sessions, mounted as a git submodule in five repositories; CI fails when a consumer's pin is behind. Written after an audit found three consumers two commits behind and one missing a rule entirely.
• dew_flow_rag_qln [private] — the retrieval product behind all of the above: a .NET 10 daemon indexing C# repositories into Postgres + Qdrant + Neo4j, RRF or weighted fusion, a cross-encoder rerank. Indexed dotnet/aspnetcore: 10,813 files, 52,545 members, 76,137 points, 16,223 types / 59,401 edges — a full pass in 18 min 39 s; a repeat pass with nothing changed in 1 min 24 s, 0 written. The repository is not public; the numbers are from its architecture record.

• dew_flow_connect_other_ais · extension-v0.31.2 — 2026-09-07
• dew_flow_connect_other_ais · extension-v0.31.1 — 2026-09-07
• dew_flow_creds_for_devs · extension-v1.1.0 — 2026-09-06
• dew_flow_connect_other_ais · mcp-v0.18.7 — 2026-09-06
• dew_flow_connect_other_ais · mcp-v0.18.6 — 2026-09-06
• dew_flow_connect_other_ais · mcp-v0.18.5 — 2026-09-06
• dew_flow_connect_other_ais · mcp-v0.18.4 — 2026-09-06
• dew_flow_connect_other_ais · mcp-v0.18.3 — 2026-09-06

_{The eight newest across the public repositories; the full list is in releases.md. Refreshed daily by a workflow in this repo — bot-authored, and silent on days nothing shipped.}

Install them, break them, tell me what you found. Or hire me to build the next one.

oleksandrdubyna88@gmail.com · Telegram @sashnetdev · Spain