Open source engineer — developer tooling, CI/CD, and AI agent infrastructure. Available for remote roles and contract work · hamodywe.github.io · iosapk.org@gmail.com
I work on the seam where a system reports success and is wrong. A test suite that stays green while half its files were never collected. A cache saved on every run and read on none. A deploy gate that quietly stopped being attached to anything. These do not raise errors — they report success, which is why nobody finds them.
24 pull requests across 17 projects totalling ~388,000 stars, in Rust, Go, Python and TypeScript. Each one traced to a root cause in the source and covered by a test that fails without the change.
| Project | What was wrong |
|---|---|
| oxc · Rust · 22k★ | Language server deadlocked permanently once four diagnostic refreshes were outstanding — a circular wait with no timeout |
| pnpm · TypeScript · 36k★ | audit signatures silently dropped lockfile entries it could not resolve; the audited count shrank and the exit code stayed 0 |
| SQLAlchemy · Python · 12k★ | A failed bulk call left the Session permanently unable to flush — adopted by the project's lead maintainer |
| gitleaks · Go · 29k★ | Unreadable files were skipped while the secret scan still reported a clean run |
| act · Go · 71k★ | A race between artifact cache upload and commit could delete a directory another request was writing into |
| Weaviate · Go · 17k★ | Cluster middleware and gRPC routing were dropped whenever Sentry was enabled — reported by a co-founder |
| Qdrant · Rust · 34k★ | values_count counted an explicit JSON null as zero values, contradicting the documented contract |
| semgrep · Python · 16k★ | Join-mode rules crashed on Windows on a temp-file handle that POSIX allows and Windows does not |
TeleGraphite · Python · 276★ — a fast, reliable Telegram channel scraper that exports to JSON, for people who need the archive rather than the app.
Claude Code Mastery Handbook · 85★ — agent-driven development written down properly: real workflows, planning, and the habits that separate a session that ships from one that wanders.
26 static analysers, TypeScript, zero runtime dependencies, 1,831 tests — each one catching a single silent failure:
skillsonar— the routing collisions that stop AI agent skills from firingpromptfence— where attacker-controlled text reaches an AI agent in CI, and what that agent may do with itciledger— what a pull request adds to the GitHub Actions bill, before you merge italwayspass— LLM eval suites that cannot go redunenforced— JSON Schema constraints no model provider ever checkspreempted— concurrency settings that cancel the deploy they were meant to protect
Every tool ships with a fixture it is supposed to stay silent about, because a finding that is always present is a finding nobody reads. Every upstream fix is revert-checked: the test has to fail without the change, or it is not proof of anything. Deterministic, offline by default, no runtime dependencies.
Rust · Go · Python · TypeScript · Docker · Kubernetes · GitHub Actions
📩 iosapk.org@gmail.com · 🌐 hamodywe.github.io (English / العربية)