Jeffrey Monica

@DeadPineapple

Sviluppo applicazioni mobili, sistemi backend e strumenti di sicurezza. Qui raccolgo codice, test, problemi riprodotti e le decisioni tecniche dietro le soluzioni.

Chi sono GitHub

In costruzione

ZombieMutex

Analisi di sicurezza, laboratori interattivi e aggiornamenti a questo diario di ingegneria.

Registro delle modifiche

Dal banco di lavoro

Codice, appunti e vita

Weekly noteWeek of 2 nov 2026

Weekly experiment

Making this page feel less like a changelog and more like a workbench: real code activity, screenshots, small bugs, and the occasional life detour.

What I'm trying

The fiddly bit is knowing what belongs in public. Public commits should link to the actual changes, private builds should stay private, and a photo only goes up if I actually took it. Also trying to keep the whole thing from turning into an airline cockpit.

My current projects

DeadPineapple from the workbench

9 nov 2026

Security engineering

Put the proof next to the code

Captured fresh Rust and Go test output and a live browser policy trace, then put each next to the implementation it actually tests.

ELFGuard's six tests and the bounded mutation regression remain local static-analysis evidence. AuthRace's 24 competing HTTP mutations show 120 units in the deliberately vulnerable handler versus 5 with atomic idempotency. For agent security, the browser trace demonstrates a denied tool request; it is not a Linux sandbox attestation.

Rust parser and evidence Go replay reproduction Agent policy trace Open project

DeadPineapple from the workbench

9 nov 2026

Architecture notes

The boundary is not just a diagram box

Mapped three actual implementation paths: bytes into the ELF parser, identity through the API mutation ledger, and agent intent into a policy decision.

A box marked 'secure' doesn't help anyone review a system. The useful parts are where untrusted input crosses into authority, what stops it, and what the implementation cannot prove. The Go container runner stays documented as a local reference; no end-to-end Linux kernel isolation claim.

Read the architecture and failure paths Open project

DeadPineapple published a post

9 nov 2026

Writing

I built a tiny neural audio codec. Then I listened to the results.

A trained nonlinear encoder, vector-quantized codebook and decoder are interesting. An idealized low bitrate is not the sa…

A trained nonlinear encoder, vector-quantized codebook and decoder are interesting. An idealized low bitrate is not the same thing as good reconstructed speech.

Full post / page

DeadPineapple published a post

9 nov 2026

Writing

Audio ML engineering: what the numbers actually mean

I built five small speech and audio implementations and measured their behavior. ASR errors, turn detection, codecs, proso…

I built five small speech and audio implementations and measured their behavior. ASR errors, turn detection, codecs, prosody and classifier ablations each have different ways to mislead you.

Full post / page

DeadPineapple published a post

9 nov 2026

Writing

Mobile voice agents: keep the backend in charge

How I connected Swift and Kotlin clients to agent workflows, built Core ML and TensorFlow Lite integration boundaries, and…

How I connected Swift and Kotlin clients to agent workflows, built Core ML and TensorFlow Lite integration boundaries, and kept authorization on the backend.

Full post / page

DeadPineapple published a post

9 nov 2026

Writing

Voice agents are distributed systems with microphones

Building an agent that talks is the easy demo. The harder work is authenticated tools, retries, evaluation, telemetry, CRM…

Building an agent that talks is the easy demo. The harder work is authenticated tools, retries, evaluation, telemetry, CRM synchronization and the people who have to operate it.

Full post / page

DeadPineapple published a post

7 nov 2026

Writing

Retry storms: when resilience multiplies a failure

Retry logic looks harmless in isolation. When a gateway, application service and SDK each apply their own retry policy, a…

Retry logic looks harmless in isolation. When a gateway, application service and SDK each apply their own retry policy, a single failed operation can multiply into a dependency outage. That interaction is the starting point for my retry-storm analysis.

Full post / page

DeadPineapple from the workbench

7 nov 2026

Security lab

A lab that lets you break the assumptions

The device-trust lab is a lot more useful when you can flip the inputs and watch the decision change.

A real capture of the live lab below. Try a replay, a forged integrity signal, or an unauthorized object request. The server is still the one that has to make the authorization decision. The client can be very persuasive; it doesn't get a vote.

Screenshot of ZombieMutex's actual device-integrity decision lab running in a browser — The live device-trust lab, captured from ZombieMutex.

Try the device-trust lab Open project

DeadPineapple shared a life note

5 nov 2026

Life

A place for work, life, and everything in between

Why this corner of the internet isn't going to be only about code.

Full post / page

More updates → RSS

Site & activity

Refreshes every 2 min

Checking site…Checking public GitHub…

Tests & demos Try a lab Project updates

Jeffrey Monica / Progetti, codice e appunti

Costruisco sistemi. Poi metto alla prova le loro ipotesi.

Sviluppo applicazioni mobili, sistemi backend e strumenti di sicurezza. Qui raccolgo codice, test, problemi riprodotti e le decisioni tecniche dietro le soluzioni.

Ingegneria Esplora i progetti Leggi gli articoli La vita fuori dal codice

Jeffrey Monica / Progetti, codice e appunti

Progetti concreti, con prove verificabili.

Rust, Go e sicurezza degli agenti: implementazioni indipendenti, test riproducibili e limiti dichiarati.

Rust / ELF hardening

ELFGuard

Ho realizzato in Rust un analizzatore ELF64 offline per PIE, stack eseguibile, RELRO e segmenti W+X senza eseguire il binario.

6 tests / 10,000 mutated inputs

Architettura e test Vedi il codice

Go / API authorization

AuthRace

Ho riprodotto in Go errori di autorizzazione tra tenant e scritture concorrenti duplicate, quindi verificato la correzione idempotente.

24 requests: 120 vulnerable / 5 fixed

Architettura e test Vedi il codice

TypeScript + Go / agent policies

Agent Security

Ho costruito un simulatore di policy per strumenti degli agenti, tenant, destinazioni di rete e replay. Il runner Go è separato.

7 policy scenarios / Go race tests

Architettura e test Vedi il codice

Implementazioni indipendenti testate localmente. Non sono deployment di clienti né sandbox di produzione certificati.

Le note tecniche dettagliate e il codice originale sono disponibili in inglese.

Esplora i progetti