The big item this week: OxideAV — a pure-Rust
media transcoding and streaming framework. It started the week as a workspace
monorepo; by the 17th I had extracted it into 45+ per-format crates, one
repository each, under the OxideAV/ organisation. First v0.0.3 / v0.0.4
releases went out the same day via release-plz, and the cycle has kept
running since.
The scope is broad on purpose:
oxideav-core (Packet / Frame / Timestamp), oxideav-codec
and oxideav-container (traits + registries), oxideav-pixfmt (conversion
matrix, quantisation, dither), and oxideav-job — a JSON-driven transcode
graph executed by a pipelined multithreaded runtime.The rule: no C dependencies anywhere in the tree. No ffmpeg, no
libav, no *-sys crates, direct or transitive. Every codec is implemented
from the spec. There's a CLI (oxideav-cli) and a reference SDL2+TUI player
(oxideplay).
It's early — v0.0.x across the board, coverage is uneven, some codecs are decode-only, others have encoders landing week by week, a few are still register-but-refuse scaffolding reserving codec ids. The intent is to build toward something you can drop into a real pipeline without pulling a gigabyte of C along with it.
H.264 got the heaviest push of the week — 134 commits closing out
4:2:2 / 4:4:4 CABAC decode, MBAFF P/B slice data, SI/SP primary slice decode,
separate_colour_plane_flag=1, plus a first-pass CAVLC P-slice encoder
(P_L0_16x16 + P_Skip, integer motion estimation). AAC got short-block
emission with a real state machine and per-channel TNS analysis. Plenty left
to do in both.
KarpelesLab/libwallet shipped
0.3.14 and 0.3.15. The headline is a multi-chain swap API — Jupiter Ultra
and dFlow on Solana, 1inch on EVM — exposed through a single
provider-abstracted surface with approval detection (the wallet tells the UI
when an ERC-20 allowance is needed before a swap can run). Solana priority
fees now route through proper ComputeBudget instructions, and displayed
Solana balances finally exclude the rent-exempt reserve instead of
double-counting it.
strtotime(): timezone-aware natural-language date parsing, RFC 2822,
ISO 8601, relative dates. Landed in a single day on April 13.Continued work on OxideAV across the board.
]]>So: starting again, on my own domain this time, with a plan to keep things small. Short posts. One idea at a time. No schedule to fall off of.
The topics will drift, but the shape I'm aiming for is roughly this:
If nothing ends up here for a while, assume I'm building rather than talking about building. Both are fine.
]]>KarpelesLab/goro is a
reimplementation of PHP in pure Go, tested against PHP's own test suite.
This week it went from roughly 256 failing tests to ~199, across
82 commits: $arr[] .= … compound-assignment double-append bug,
readonly-property error messages matching upstream exactly, DateTime
serialisation rejecting >4-digit years, createFromFormat null-byte
handling, multibyte-UTF-8 in EXPECTF regex fixtures, and a proper
SKIPIF → skipTest path in the test runner.
A lot of it is error-message text and edge-case conformance rather than "big features", but that's what narrows the gap with real-world PHP — the whole point is to get PHP code to run on goro without noticing. The parallel Rust port, goro-rs, got 35 commits the same week.
I started litertlm-ios
on the 6th and shelved it by the 10th. The goal was running Google's
LiteRT-LM on iPhone with Metal GPU acceleration. It compiles, it runs,
it produces a working LiteRTLM.xcframework — but Google's GPU
accelerator for LiteRT-LM is proprietary, and the open-source path only
exists if you bridge LiteRT-LM's accelerator-plugin interface to
TFLite's Metal delegate. It works as a workaround, not as a foundation
for production.
The repo README has a full post-mortem and a comparison table pointing to the runtimes you should probably use instead today — MLX Swift, SwiftLM, llama.cpp, MLC-LLM. If Google ever open-sources the real LiteRT-LM GPU path (there's an upstream issue), the build infrastructure here is ready to pick back up. Until then: better to write down what I learned and move on.
anyhash — a Go hashing
library that selects from 60 algorithms by name, not by import.
New("sha256") instead of sha256.New(). Case-insensitive name
matching, Clone() to snapshot hash state mid-computation, continue
writing after Sum(), HMAC and HKDF, and PHP-compatible state
serialisation — a hash started in PHP can finish in Go and vice
versa. No external dependencies; all algorithms use only the Go
standard library.
pktkit — zero-copy L2/L3
packet handling for Go. Frame and Packet are []byte aliases with
typed header accessors — no wrapper allocation, no copies on the hot
path. Building block for virtual network topologies: devices, hubs,
adapters, tunnels, with IPv4 + IPv6 support throughout. Nine commits
this week filling out the API surface. (The repo itself is from
April 4; this was its first full week.)
regexp
uses RE2 for guaranteed linear time and deliberately omits these
features — but PHP's preg_* family relies on them, so goro
needs them too.compress/bzip2 is decompression-only; goro needs PHP's
bzcompress to work, hence both directions implemented from the
bzip2 1.0.8 reference.io.Reader in a single pass
and stores only headers and byte offsets, no body buffering.
Backs the PHP mail-handling surface in goro, and is designed to
stay efficient when the messages it's indexing are very large.tzdata. Deliberately under the standard time
package's abstraction, because goro's date/timezone machinery
needs the underlying data directly to match PHP's semantics.Frame and Packet are []byte aliases
with typed header accessors — no wrapper allocation, no copies on
the hot path. Seeded on April 4 and ran up 35 commits by the end
of the week laying down IPv4 + IPv6 primitives. Separate thread
from goro, but fits the same "pure Go, no cgo" rule.Two networking-adjacent projects that fit together more than the topic suggests:
bnpm — "Bubble NPM" —
sandboxes package-manager commands inside Linux namespaces. Mount
namespace with pivot_root restricts the filesystem to the project
directory (read-write) plus read-only system paths. An empty network
namespace gives build/test commands zero network access; install
commands go through a userspace TAP proxy that filters DNS and IPs
to allowed registries only. No root required — unprivileged user
namespaces do the work. The goal is to make a malicious install
script physically unable to reach outside the project tree.
slirp — user-mode NAT
and IP stack in Go, 28 commits this week. Same intent as the
original SLIRP: give a process TCP/IP connectivity without root,
CAP_NET_ADMIN, or a TUN device. Useful for VM networking,
containers, network testing, and anything that wants a protocol
stack that runs fully in userspace.
goro got 128 commits and the parallel Rust port goro-rs got 50. Both continuing the slow grind toward full PHP test-suite conformance.
teamclaude — 52
commits on a new project, seeded the 24th. Multi-account Claude
proxy with automatic quota-based rotation. Sits transparently
between Claude Code and the Anthropic API, managing multiple Claude
Max (or API key) accounts and switching to the next when one
approaches its session (5h) or weekly (7d) quota limit (default
threshold 98%). Auto-retry on 429 with retry-after, failover on
persistent errors. The point is: you can actually finish the thing
you were working on instead of hitting a wall at the quota edge.
blindsig — 7 commits on a library of five blind-signature schemes in Go. A blind signature lets a signer sign a message without learning what the message is, and lets a holder present the signed token later without the signer being able to link it back to the signing session. Useful for anonymous credentials, privacy-preserving attestations, and voting. The five schemes span different assumptions, quantum-safety profiles, and verification cost profiles so you can pick the one that fits the threat model.
lnp22 — 5 commits seeding
a self-contained Go implementation of the LNP22 lattice-based NIZK
proof system (Lyubashevsky, Nguyen,
Plançon, CRYPTO 2022). Proves knowledge of short vectors satisfying
linear relations over polynomial rings — building block for range
proofs and proof composition in post-quantum systems. No external
cryptography dependencies beyond golang.org/x/crypto/sha3.
goro took 249 commits, goro-rs took 67. Slow, steady convergence toward the same failing-tests target from both directions.
goro took 281 commits and goro-rs took 275 — the Rust port, only a week old, has already caught up to the Go side in commit velocity. Both grinding toward the same PHP test-suite target, from different languages.
mpcegosign — 13
commits on a new prototype. EGo's ego sign normally relies on a
single RSA-3072 private key to sign SGX enclaves; this explored
replacing it with t-of-n threshold RSA: any t of n parties can
sign, no single party can sign alone, interactive group-chat keygen
(shares protected with X25519 ECDH + AES-256-GCM), MRENCLAVE
computation delegated to ego-oesign for compatibility.
The build works, but after living with the shape of it we decided it wasn't something we actually wanted to depend on. The repo stays up as a reference implementation of the concept — not as part of the production toolchain.
goro took 187 commits and the new goro-rs (seeded the 14th) took 75 on its first two days. Same target — a PHP 8.5 implementation that passes the PHP test suite — in Rust this time. goro is nearing completion; goro-rs is me taking another pass at the same problem in a different language, because why not. There's no grand strategy behind running both; both should eventually pass the same tests.
psql was originally a
single repo. This week it moved into a dedicated portablesql/ org
so the driver layer could split out into separate repos —
psql-sqlite,
psql-pgsql,
psql-mysql, plus a
shared psql-test
integration-test harness that runs the core against every driver
together. The move to its own org was the whole point: drivers
needed to live separately, and a single-repo layout couldn't
accommodate that. 23 commits on the core this week on top of the
reorganisation.
Quieter milestone: bfe001 — the repo behind this site — got its first commits on the 13th. 45 of them by the end of the week setting up the Amiga hardware section, memory-map layout, multi-language plumbing, and the initial timeline. It'll be a while before the site is worth pointing at, but the bones are in.
portablesql/psql — 20 commits on the Go SQL library: object binding, query builder, hooks, associations, vector column support. The pitch is "GORM, but focused on modern Go (generics, 1.23 iterators) with a lighter footprint", targeting MySQL, PostgreSQL, CockroachDB, and SQLite through a pluggable driver layer.
fes-analysis — seeded on the 7th. Independent security analysis of the "Fractal Encryption Standard" by Portalz PTY LTD, which claims to "replace quantum vulnerable AES encryption". Despite the fractal branding, FES reduces to a stream cipher that XORs the plaintext with a keystream generated by iterating the Mandelbrot set as a PRNG. Predictably, the result is weaker than AES — the opposite direction from its marketing. The write-up lays out the cipher's structure and the concrete attack paths.
The one thing worth noting:
chiefburner seeded
on the 26th — another Solana program, this one a burn-or-delete
instruction unified into a single call, with remaining-accounts
batching for efficiency. Sibling to chiefstaker; part of the same
on-chain toolkit.
Otherwise: 2 commits on cterm and 2 on wgnet. That's it.
Some weeks the work shows up elsewhere — design, reading, thinking — and doesn't leave a trail on GitHub.
]]>vpdotnet/wgnet — 14 commits on a new Go library that abstracts the WireGuard protocol behind a simple interface: feed it UDP packets, get back decrypted network packets, and vice versa. All the cryptography (X25519, ChaCha20-Poly1305), handshakes, session state, rekeying, and replay protection are handled internally. You wire it into whatever data source you want — a TUN device, a userspace NAT, a test harness — and it stays agnostic about transport.
22 more commits this week rounding out chiefstaker after last week's heavy push — mostly hardening around edge cases: pool lifecycle, reward-claim math, and parameter-change semantics on already-staked positions.
On-chain code gets verbose fast: every instruction needs account validation, rent calculation, overflow checks, and tight size constraints. This week was mostly that — closing out the core staking flows, the SOL reward distribution, and the exponential weighting curve with enough test coverage that the next person to read it doesn't have to reverse-engineer it.
Also: 10 commits on cterm (polish + fixes), and single commits on integration-docs and replvar.
]]>chiefstaker — a
new Solana program, created on the 8th. It lets anyone create a pool
to stake Token 2022 tokens and receive time-weighted SOL rewards.
Staking weight grows over time along an exponential curve —
weight = stake_amount × (1 − e^(−age / tau)) — so the longer a
position sits, the more of the reward it earns, with tau
configurable per pool. Pool creation is permissionless; creators
pick their own parameters.
Only 6 commits this week, but the program structure is there; the push comes next.
37 commits on cterm — the steady-state rate you'd expect from a three-week-old project that's been taking 70–120 commits per week. Rounding off edges more than building new subsystems.
Quiet outside that. Four commits on outscript and one on AzusaOS/azusa-opensource-recipes.
No promises this is the last cterm-heavy week.
]]>Nothing ships in a terminal emulator without grinding through a long list: rendering pipelines, input handling quirks, platform clipboard APIs, scrollback, search, configuration, tabs, splits, window restoration, accessibility glue, keyboard-layout edge cases. Most of that is invisible from outside. The target is to make day-to-day work with Claude — and with a normal shell — a bit smoother than it would be in a stock terminal.
Small trickles elsewhere: Shells-com/linux-scripts (5 commits), AzusaOS/azusa-opensource-recipes (1), and rest (1). Nothing to write home about individually.
]]>cterm — a new terminal emulator, seeded on the 13th, 74 commits in five days. It's a terminal emulator built for Claude users. Pure Rust with platform-native UI (AppKit + CoreGraphics on macOS, GTK4 on Linux, Win32 on Windows), custom VT100/ANSI engine with 24-bit color, proper wide / combining / emoji characters, regex-searchable scrollback. Plenty of small features that make day-to-day life with an AI coding assistant in a terminal a bit smoother. This week is mostly the foundation — VT engine, buffer management, platform shells.
algoc — 26 commits on the repo's first full week. The goal is simple to state: make some algorithms available cross-platform. Write the algorithm once in a DSL, get implementations in multiple target languages. It's still early — this is the kind of project that takes time, because the DSL, the type system, and the target-language back-ends all have to grow together before any of it is trustworthy. Worth watching, not worth depending on yet.
echeck — 42 commits
polishing the SGX certificate checker: a utility and library that
extracts Intel SGX quotes embedded in X.509 certificates (OID
1.3.6.1.4.1.311.105.1), parses them, and does full chain-of-trust
verification. Ships as both a C library with CLI and a Go library.
Swift ports for the KLB stack. Two new Swift repos opened this week: swiftrest (Swift REST client using async/await actors, OAuth2 + Ed25519 API-key signing, chunked uploads) and swiftbottle (Swift implementation of the Bottle secure message container — multi-recipient AES-256-GCM, multi-signer Ed25519 / ECDSA / RSA, CBOR + JSON, interoperable with gobottle and pybottle).
qemuctl — a new Go library for managing QEMU processes, seeded on the 29th.
Smaller pokes on klbfw, atonline-flutter, and gobottle.
]]>