Zyric.

Foundation is Zyric's flagship product: one control plane and source of truth for the software a company runs. It orchestrates the software that already works (Docker, Postgres, Redis, Caddy, Git and SaaS) rather than replacing it. Every project, repo, service and database becomes a typed resource with a desired spec, an observed status and typed edges, and level-triggered controllers converge what is running toward what was declared: you change desired state instead of clicking through consoles. On top sits Repository Intelligence, deterministic static analysis first and AI on top of the facts it produces. Every actor, human or AI, goes through the same authorized, audited API, so an agent has no privileged path, and an MCP server exposes that API to any MCP client. It is in active development and already runs my own production infrastructure, including this site.

Tessika reads documents the way a person would, straight from the image rather than through OCR: PDFs, scans, phone photos, handwriting in many cases, Word and Excel files, and plain text. It finds the personal data on the page (names, dates of birth, addresses, ID and account numbers, and on the strict setting faces, signatures and the machine-readable zone of a passport), masks it, then re-reads the masked page and covers anything still legible. What comes out is one canonical record per fact, with a confidence and a trail back to its source, in the shape the system above it asks for. Health, legal, finance, insurance and identity documents run through the same engine; a new domain is a plugin, not a rebuild. It runs in the customer's own environment on an open-source model that can be swapped, so no document has to leave for a third-party AI service, and it ships with its own audit: documents with known planted personal data, and a leak check that reads the masked output back.

An autonomous AI security-audit pipeline that reviews critical code the way a specialist team would, invariant by invariant, across smart contracts, bridges, light clients, ZK circuits, and the web2 systems that guard identity, authentication, and access-control. To date: 100+ targets reviewed across 30+ ecosystems against 200+ vulnerability classes, with 20+ confirmed findings, every one human-triaged and severity-calibrated by a human, not the model alone. That calibration is the point: in a live cross-chain bridge that has moved $100M+ across its routes, the pipeline flagged real consensus-verification gaps in the non-flagship light clients as critical; human review downgraded the severity to conditional, but the gap between the bridge's marketed trustless verification and what those clients actually check still stood (responsibly and privately disclosed). Detection-only: it finds and reports, never exploits. One engine spanning EVM, Solana, Move, Cosmos, Substrate, Bitcoin, ZK circuits, and web2 access-control.

A free, MIT-licensed scanner for the person a suspicious take-home task was sent to. Fake-interview campaigns hide a payload in a postinstall hook, an obfuscated config, or a dependency pinned deep in a lockfile, and it runs the moment you type npm install: browser passwords, SSH keys, cloud tokens and wallets, gone before you have read a line. RepoCanary never clones, installs, executes or evaluates the target. It reads a bounded set of files as plain text through the GitHub API and matches signatures, so pointing it at malware is exactly as dangerous as reading it in a browser. Detection is measured against a corpus of the techniques these campaigns actually use, and the evasions it cannot catch are written into the threat model rather than hidden. Green means nothing known matched, never safe, and the tool never says anything stronger. One command, zero runtime dependencies, and one shared engine behind the CLI, the website and a GitHub Action. The code is open-source on GitHub.

Agents fail in ways a green build never catches: a final answer that promises work nothing will ever do, an invented "I can't access that" with no tool tried, "saved a memory" when no memory was written, a count quoted from memory instead of from the listing that was just made, a list cut short without anyone being told. None of those are model bugs; they are bugs in the loop around the model. looptape records a real session as a tape (every completion, tool call and result, exactly as the model saw it), replays it into your own harness in place of the model, with no model and no network, and runs its checks over what happened. Every check comes from a real incident, and its origin is kept on the check. A recording proxy for the Anthropic and OpenAI APIs, a deterministic player, zero dependencies, and nothing in it needs an API key. The code is open-source on GitHub.

The complete digital surface of a Vietnamese street-food restaurant in Schwäbisch Gmünd, built end to end and shipped solo. The public site carries the menu (allergens, vegan and vegetarian markers, spice levels, sold-out for today), opening hours, online ordering with pickup slots, reservations, and events. Behind it sits an eleven-tab dashboard where the owners edit all of it themselves, with no deploy and no developer in the loop: dishes, prices, opening hours, holidays, the editorial copy, and the FAQ. Orders and reservations arrive by mail and Telegram and stay in the dashboard, with each path standing on its own: if the database is down the mails still go out, and if the mail provider is down the order is still in the dashboard. Next.js 16, React 19, Tailwind v4, Drizzle and Postgres.

nimimo is a non-custodial crypto identity layer. One link (nimimo.com/@chris) receives Bitcoin, Ethereum, Solana, and USDC, abstracting wallet complexity away from the user. The architecture deliberately separates access, identity, ownership, and recovery, with keys remaining fully on-device. Built for security-critical flows, cross-chain usability, and reducing friction in real-world crypto transactions, with no app, no exchange, and no KYC. Ships with a lightweight, no-API-key developer SDK.

OneHealth is the system of record for a person's health, with a navigator built on top of it. Every input (lab document, wearable export, clinician's note, pharmacy slip, image) is normalised into one lifelong, source-agnostic record, where each value carries its unit, reference range, timestamp, source and quality flag, and nothing is ever overwritten. The product sits on that record: you set a destination (lose fat, lower cardiovascular risk, sleep deeper, age slower), the system computes a ranked, reasoned route, a licensed clinician approves it, and it recalculates every time your data changes. The system proposes; a human stays accountable. Built on an event-sourced canonical layer, an AI agent council, and a clinician review loop.

A solo worldbuilding project exploring procedural generation, persistence, and discovery. Every world is generated deterministically from a single seed, producing its geography, climate, weather, life, and sky. A seed is a place rather than a session, meaning worlds can be revisited, shared, and explored together while remaining identical for everyone who visits. Build a homestead, light a watchfire, plant your standard, and leave a mark on the world. Time passes, weather changes, moons drift overhead, and every world develops its own character from the same underlying rules. Built with React, TypeScript, React Three Fiber, and a fully procedural audio system. No accounts, no downloads, and no backend required.

Foundation runs the servers; Zyric Console runs the company. It is the private app behind zyric.de, installed on my phone's home screen and signed in with a passkey. It edits this website (projects, texts and skills, with every save kept as a revision), collects contact requests from the site and from the /k contact card, and sends mail from my own address with its delivery status. The Ablage keeps every file in private storage, with time-limited share links and AI actions that file, describe or transcribe a document on request. The business side writes offers, order confirmations and invoices ready to send; a customer accepts an offer online with a signature, and the signed copy is filed automatically. The tax view computes income and expenses by the day the money actually moved and runs fixed checks over them, and a model only phrases the advice on top of those numbers. Everything that happens reaches me as a push notification, with Telegram as the fallback, and Foundation's server reports arrive the same way. Built solo, used every day, and not for sale.

A solo multiplayer world for the Christmas season. You arrive at dusk in a village in Lapland, and it stays the blue hour: a 40-metre fir hung with string lights on the square, snowed-in log cabins with warm windows you can step into, a Christmas market with a Ferris wheel, a railway through the forest, and the northern lights overhead every evening. Every visitor comes in as an elf, and you meet the others in the same village: chat, whisper, throw snowballs, bake gingerbread and give it away. The terrain measures 2.4 by 2.4 kilometres, and places are only built as you come near them and taken down again behind you. It grew out of A Million Years and runs on the same engine: React, TypeScript, React Three Fiber, three.js and Vite, with a Node.js server whose WebSocket relay connects the players. The village is still being built.