Proof, not sampling
Formal verification
Model checking establishes properties over all inputs in a bounded space. A test tells you about the cases you thought of.
AI engineer, designer, implementer · St. Paul, Minnesota
Ontomancer and Claw Fanatic.
AI engineer, designer, implementer — usually all three on the same project. I build ontologies and reasoning agents that keep language models honest, design the interfaces people actually touch, and write the proofs and evaluations that say whether any of it works.
Proof, not sampling
Model checking establishes properties over all inputs in a bounded space. A test tells you about the cases you thought of.
Measure what you cannot prove
Language models are probabilistic. Where proof does not apply, the answer is graded evaluation, determinism, and adversarial testing.
Structure a reasoner can traverse
Formal schemas turn tacit domain knowledge into something a reasoner can walk and a model can be held accountable to.
The loop is the product
An agent is easy to demo and hard to trust. The interesting engineering is the harness around it — what it is allowed to do, what grades it, and whether the same input twice gives the same answer.
Corpora nobody has built yet
Fine-tuning a model for a domain means first having the data for it, and for the domains I care about that data does not exist in a convenient form. So I go and build it.
Wireframe through to deploy
The verification work only matters if the thing ships. I build the whole path — schema, API, interface, pipeline, host — and I have run it in production for paying customers.
Formal verification
A statistical library is a poor fit for testing alone: the interesting failures are index arithmetic, float edge cases, and structural invariants that only break on inputs nobody thinks to write down. Kani model-checks these over every input in a bounded space.
resampling_permutation_is_bijection — A permutation resampler emits each index exactly once — it permutes rather than merely shuffling.resampling_kfold_test_sets_partition — K-fold test sets partition the dataset: no sample is held out twice, none is silently dropped.resampling_bootstrap_indices_in_bounds — Every bootstrap draw indexes inside the sample, for all sample sizes.resampling_loo_indices_partition — Leave-one-out splits cover the dataset exactly once each.Data science on the hot path
In-process statistical computing for Rust — distributions, hypothesis tests, and resampling — with zero runtime dependencies, validated against scipy.
An ontology as a type system
An ontological application builder for verified code generation. A TypeDB ontology is the source of truth; a zero-dependency generator compiles it into the Rust type layer that hand-written numerics are built against.
A small model that reads COBOL
A Qwen2 0.5B fine-tune for COBOL system understanding, trained with Unsloth and Hugging Face Transformers.
Measuring generated COBOL
A substantial rebuild of bloop's COBOL code-generation benchmark, adding JCL static analysis, an agentic orchestrator, and local inference.
July 31, 2026 · 6 min
Reading the docs for Google's Agent Gateway. Some of what it enforces is a genuine invariant. Some of it is a language model grading another language model, which the docs are refreshingly honest about.
July 31, 2026 · 9 min
Kani, Verus, Dafny, and Lean prove different things, and only one of them proves something about the binary you ship. A comparison written from the position of having used exactly one of them.
July 31, 2026 · 6 min
Verus erases proofs before compilation, which sounds like a metaphor until you go read the macro that does it. What I learned about ghost types from fixing a turbofish that fell off during expansion.