Important
Everything on this page is falsifiable. Every number was measured by execution, every patch links to a real diff, and the commands to reproduce all of it are in this README. Nothing here is aspirational.
Not a metaphor — the crash was real. The patch didn't survive review, and this section stays up as a record of the attempt, not a trophy. Here's the dump — and what happened.
Patch:
llvm/llvm-project#201443— closed by maintainer. My crash premise didn't hold up under review (callbris a terminator; my reproducer didn't prove otherwise) — claim retracted, lesson kept. Companion:#201612— closed by me per reviewer direction. The targeted X86 stopgap is being retooled into the general poison-flag mechanism they asked for.
Landed upstream. Not forked, not starred — merged.
| Project | Contribution | PR |
|---|---|---|
| OWASP · Agent Memory Guard | GitHub Action — agent-memory vulnerability scanner | #18 |
| OWASP · Agent Memory Guard | LlamaIndex integration adapter | #19 |
| OWASP · Agent Memory Guard | CrewAI integration adapter | #20 |
| OWASP · Agent Memory Guard | Prometheus metrics exporter | #21 |
| OWASP · Agent Memory Guard | Policy.tiered() preset + memory-class taxonomy |
#23 |
| OWASP · Agent Memory Guard | source_type provenance flag on SecurityEvent |
#24 |
| OWASP · Agent Memory Guard | Multi-turn delayed-attack category in benchmark suite | #42 |
| nexu-io · open-design | Legacy ~/.fnm path in toolchain resolution |
#1110 |
| Authora | OTP login hardening, legacy-code removal | #3 |
| HiveSofts · hive-app | Backend refactor | #37 |
| TaniCSS · Tani | v2.0 framework upgrade + full documentation | #1 · #2 |
| flappy-2048 | 9 bug fixes — save persistence in packaged builds, hitbox correctness | #1 |
Seven merged patches into one OWASP security project — integration adapters, an observability exporter, a CI scanner, and a threat-model extension to its benchmark suite. A body of work in a single codebase, not a drive-by.
Open PRs against projects where review cycles run in months. Listed because the diffs are public, not because they landed.
| Project | Contribution | PR |
|---|---|---|
| Go | cmd/compile: size cache in StdSizes — kills exponential compile time |
#79314 |
| Apache SeaTunnel | Reuse shared SinkWriter for same destination in multi-table sink |
#11077 |
| Meta · PyTorch tritonparse | Customizable labels in file-diff view | #407 |
| Sphinx | source_language config + lang attribute for untranslated text |
#14429 |
| Canonical | Migrate documentation wordlist to Vale accept.txt |
#197 |
| Academy Software Foundation · rawtoaces | Prefer std::filesystem error_code over exceptions |
#295 |
| Lightning AI · LitServe | Wait for worker setup completion in wrap_litserve_start |
#682 |
| bilibili · web-demuxer | Worker option for inline / main-thread runtime | #53 |
| Telegram Desktop | Accessible-name fallback for UI buttons | #31197 |
☠ Rejected patches — the ones that didn't make it
Listed because a record with no failures in it isn't a record.
| Project | Contribution | PR |
|---|---|---|
| Microsoft · TypeScript | Error on private property access in generic intersection types | #63548 |
| Microsoft · typescript-go | Same fix, native port | #4290 |
| Microsoft · typescript-go | Propagate module bindings to augmentation body | #4291 |
| NASA · Worldview | Service Worker tile caching for GIBS tiles | #6699 |
| NASA · Worldview | iOS Canvas memory leak on colormap threshold change | #6698 |
| Meta · tritonparse | Migrate zstandard → Python 3.14 stdlib zstd |
#405 |
| LLVM | [CodeGenPrepare] crash with asm goto — premise withdrawn, closed by maintainer |
#201443 |
| LLVM | [X86] NUW stopgap — closed by author per reviewer direction, general mechanism in progress |
#201612 |
| Apache Gravitino | Python View / ViewCatalog — closed by author, superseded by upstream implementation |
#11019 |
| Telegram Desktop | Context-menu focus announcement — closed, reviewer deemed unneeded | #31198 |
A statically typed language with a real type checker, a real optimizer, and a stack VM — 568 lines, no libraries. It runs live at hesam-oxe.github.io.
| System | Implementation | Measured |
|---|---|---|
| FORGE compiler | Lexer → Pratt parser → AST → type checker → constant folding + DCE → bytecode → stack VM | fib(20) → 6765 in 218,913 VM steps |
| Optimizer | Constant folding, algebraic identities, dead-branch and dead-loop elimination | 31 → 12 bytecode ops · 5 folds · 2 DCE |
| Type checker | Real inference and rejection, source-mapped carets | let x: int = true → type mismatch: 'x' declared 'int' but initializer is 'bool' |
| WebAssembly | Emitted byte by byte — hand-written LEB128, section headers, raw opcodes. No Emscripten, no wat2wasm |
253 bytes · validate() → true · fib(30) → 832040 |
| SHA-256 | Full FIPS 180-4: message schedule, 64 rounds, padding, big-endian length | All NIST vectors pass · 200/200 vs node:crypto |
| Regex engine | Recursive-descent parser → Thompson NFA → subset simulation with ε-closure | (a|a)*b × 40 in 0.66 ms |
| Raytracer | Analytic ray-sphere intersection, recursive reflection, Fresnel falloff, gamma correction | ~250k rays · ~2M rays/s |
| N-body | 200 bodies, 19,900 pair-forces/frame, velocity-Verlet symplectic integrator | Energy drift 0.0000% |
The whole point. Don't take a single number above on faith.
git clone https://github.com/hesam-oxe/hesam-oxe.github.io && cd hesam-oxe.github.io/engine
# 253-byte WebAssembly module, emitted by hand — validate and run it
node -e '
const b = Buffer.from(require("fs").readFileSync("core.wasm.b64","utf8").trim(),"base64");
console.log("bytes:", b.length, "valid:", WebAssembly.validate(b));
console.log("fib(30) =", new WebAssembly.Instance(new WebAssembly.Module(b)).exports.fib(30));
'
# → bytes: 253 valid: true
# → fib(30) = 832040
# SHA-256 against Node's OpenSSL binding, 200 random inputs
node -e '
const A = require("./forge.js"), c = require("crypto");
let ok = 0;
for (let i = 0; i < 200; i++) {
const s = c.randomBytes(32).toString("hex");
if (A.sha256(s) === c.createHash("sha256").update(s).digest("hex")) ok++;
}
console.log("match:", ok + "/200");
'
# → match: 200/200
# Compile and execute a program on the hand-written VM
node -e '
const F = require("./compiler.js");
const c = F.compile(`
fn fib(n: int) -> int { if n < 2 { return n; } return fib(n-1) + fib(n-2); }
fn main() -> int { print fib(20); return 0; }
`);
console.log(c.run());
'
# → { output: [ "6765" ], steps: 218913, result: 0 }If any of that fails on your machine, open an issue. I'd rather be corrected than believed.
Linear time by construction, not by luck. Most production regex engines — PCRE, Python's
re, JavaScript's built-in — will hang on this input. Thompson's 1968 construction won't,
and there's a button on the site that fires the bomb and times it.
graph LR
A[asm · silicon] --> B[C · Sinux kernel]
B --> C[LLVM · codegen]
C --> D[Rust · Go]
D --> E[WASM · bytecode]
E --> F[k8s · cloud]
style A fill:#0D1117,stroke:#DC143C,color:#fff
style C fill:#DC143C,stroke:#FF1744,color:#fff
style E fill:#00E5FF,stroke:#00E5FF,color:#000
BARE METAL
INTERFACE
BATTLEFIELD
| Project | Stack | What it is |
|---|---|---|
| Sinux | C · asm |
Operating system kernel — boot, memory management, scheduling · v1.0-alpha released |
| Phobos | Rust |
Native IDE, AGPL-3.0. Turbo-Pascal ergonomics, modern toolchain |
| FORGE | JavaScript |
Statically typed language, six-stage compiler, stack VM — 568 lines, zero dependencies |
| Tani | CSS |
Zero-JS utility-first framework with a component library |
| salon | Rust |
— |
| apollo | Python |
— |
☠ FILE 001 — HOW A 253-BYTE WASM MODULE GETS WRITTEN BY HAND
No toolchain. You write the bytes.
- Magic + version —
00 61 73 6D 01 00 00 00. Eight bytes before anything exists. - Type section (id
1) — encode each signature as60 <params> <results>, lengths in LEB128. - Function section (id
3) — map function index → type index. - Export section (id
7) — name length, name bytes, kind, index. Every string is length-prefixed. - Code section (id
10) — local declarations, then raw opcodes:20 00islocal.get 0,41isi32.constfollowed by a signed LEB128,6Aisi32.add,0Bends the body. - Every section carries its own byte length — which you only know after emitting it, so you emit into a buffer, measure, then prepend. Get one LEB128 continuation bit wrong and the whole module is rejected with no useful error.
Result: 253 bytes, four exports, and WebAssembly.validate() returns true.
🔥 FILE 002 — WHY THE OPTIMIZER ISN'T FAKE
Toggle it off on the site and watch the numbers move:
optimize=false bytecode=31 folds=0 dce=0 → 26
optimize=true bytecode=12 folds=5 dce=2 → 26
Same answer, 61% fewer instructions. Constant folding collapses 2*3 + 4*5 at compile time,
algebraic identity erases x*1 + 0, and dead-branch elimination removes if false { … }
and while false { … } from the emitted bytecode entirely. The disassembler is right there
— read the listing before and after.
👁 FILE 003 — RULES OF ENGAGEMENT
- No layer untouched. Assembly to cloud, and I can defend any level of it in an interview.
- Every claim falsifiable. If it can't be reproduced with a command, it doesn't go on this page.
- Failures are part of the record. Six rejected patches are listed above, by name.
- No borrowed credit. Forks aren't contributions. Stars aren't skill.
- 🔥
PushEvent@ hesam-oxe/web-demuxer — 2026-09-19 - 🔥
PushEvent@ hesam-oxe/hive-app — 2026-09-19 - 🔥
PushEvent@ hesam-oxe/tritonparse — 2026-09-18 - 🔥
PushEvent@ hesam-oxe/go — 2026-09-19 - 🔥
PushEvent@ hesam-oxe/sphinx — 2026-09-19
Tip
The proof continues outside GitHub. A compiler, a hand-emitted WASM module, a raytracer and SHA-256 — all executing in your browser at hesam-oxe.github.io. No backend. No frameworks. Open DevTools and read the source.
"I don't list technologies. I ship the implementations." "Assembly to cloud — and I can defend every layer." "Every claim on this page is falsifiable. That's the point."
Every number on this page was measured, not estimated. The commands to reproduce them are above.
