/now

What I'm working on right now

Last updated:

Current focus

  • Studying for an MSc in Computer Science at the University of Greenwich, London — software quality, cloud and HPC, network design and cyber security this term.
  • Hardening rubica's AI platform ahead of the AU finserv pen-test — supply-chain gates, CodeQL coverage, signed commits, CycloneDX SBOMs on release.
  • Native Anthropic regression work — fixing unsupported-content-format edge cases across our multi-provider message converter.
  • Security research across OSS AI infrastructure — MCP server implementations, LLM-app middleware, and agent SDK rendering paths, reported through coordinated disclosure. CVE-2026-44429 was the first one through.
  • Upstreaming fixes to the tools I depend on — recent merges in the MCP conformance suite (#476), the MCP Registry (#1436), the AWS SDK for JavaScript (#8281) and the Sentry JavaScript SDK (#24030, #24070, #24233).
  • Drafting the Lessons series — long-form essays from rubica war stories: token-budget pruner, MCP 64-char outage, cache_control TTL drift, supply-chain hardening. Each piece a production decision and the trade-offs behind it.

Recently shipped

  • webhook-hmac-kit 2.1 — webhook signature library on npm with SLSA provenance, and the companion post on why two different bodies can share one valid signature.
  • CVE-2026-44429 — disclosed and fixed a stored XSS in the MCP Registry catalogue UI.
  • Token-budget pruner— pre-flight guard that physically removes MCP tools from the per-turn payload when overhead crosses 60 % of the model's context window.
  • Signed-commits enforcement on main across all rubica engineering repos (SSH signing path, not GPG).
  • CalVer release pipeline for rubica-content-hosting — independent of the rubica-chat stream.

Reading / following

  • Model Context Protocol spec changes — particularly tool-name length and content-block schema drift between providers.
  • Anthropic engineering posts on Claude Code subagents + skills — building out my own dev-team locally.
  • APRA CPS 234 control mappings — incident response playbooks aligned to NIST 800-61 lifecycle.

Location

London, United Kingdom. Remote for rubica (Hobart / Sydney).