Independent engineer available for small, bounded remote projects.

Engineering evidence / project resume

• visgl/react-google-maps#1023 — merged 2026-07-20 by the maintainer. The Google Maps JS API can hand back an invalid camera during a pinch-zoom; the library converted that into fallback state such as zoom: 0 and emitted a synthetic camera-change event, so a valid map could be knocked to a garbage viewport by a transient upstream reading. The fix drops the invalid snapshot instead of laundering it into state, and keeps the developer warning visible. 3 files, +173/−20 — of which 160 lines are tests and 13 are the fix. That ratio is deliberate: the correction is small because the diagnosis was specific.

• qBraid/qBraid#1358 — pyQuil gate parameters were reaching Cirq as pyquil.quilatom objects instead of sympy expressions, so cirq.is_parameterized returned False on a circuit that did have a free parameter, and both str(circuit) and unitary() raised. Traced from the symptom to the two lines responsible, fixed at the conversion layer, and covered with six tests — five of which fail without the change. This is the upstream cause of unitaryfoundation/mitiq#2687, open since March 2025, where an earlier attempt to patch Cirq's diagram formatter was declined; the analysis explains why that was the right call. (Open, awaiting review.)

• The Go parser bug that reserves memory for input it is about to reject — a defect class with a runnable demo, and why the obvious one-line fix is measurably a regression (a constant cap improved hostile input 6,463x while making a valid 1000-element list 2.36x worse; a proportional bound gives 7x with zero regression). Includes benchmarks against buger/jsonparser and miekg/dns.
• A green CI run is an input, not a conclusion
• How to build a dashboard that can say "I don't know"

• allocguard — a Go checker for the defect class in the writeup above: capacity reserved from untrusted input before that input is validated. Reports a site only when the count comes from outside the function and the fill loop can return early, so it stays silent on six of ten large Go repositories scanned. Verified against miekg/dns (2 findings) and silent on quic-go, hashicorp/hcl and pelletier/go-toml. Syntactic only — it cannot see who produces the counted value, and its low-precision recursion check is off by default. MIT, stdlib only, exits 1 on findings. pkg.go.dev

  go install github.com/tzh476/allocguard@latest
  

allocguard, packaged — USD 19, card or PayPal, instant download. The same MIT-licensed tool as above, as a versioned archive with install notes and the benchmark fixtures. The source is free; this is for buying the packaging and supporting the work.

Cash-First Opportunity Scorecard — USD 29, card or PayPal, instant download. A 15-minute scorecard for deciding whether a bounty, paid writing call, or fixed-price gig is actually worth starting. Advertised prizes are not income.

Available for one new bounded milestone. The fastest starting point is a USD 300 diagnosis-and-fix milestone: reproduce one backend, API, automation, or data-pipeline defect; deliver the smallest verified correction; add a regression test; and provide a concise handoff. Scope and payment terms are agreed in writing before work begins.

Open a structured milestone request or request a scoped estimate by email.

The exact price is agreed from a written scope before work starts. A first milestone should have explicit inputs, acceptance criteria, and a reproducible verification path. I can work asynchronously and disclose any AI-assisted tooling used during delivery.

For deployment work, the first milestone can cover diagnosis, corrected build and runtime configuration, a staging deployment, health and smoke checks, and a rollback/runbook handoff. Production access and infrastructure charges are not required for the initial diagnosis.

• Source-grounded diagnosis before implementation
• Small diffs, automated tests, and explicit failure handling
• No production secrets or customer data needed for an initial milestone
• Clear distinction between verified results, assumptions, and limitations

Public repositories below show work across Python, TypeScript, Go, C/C++, data systems, automation, model tooling, and infrastructure.

For a scoped inquiry, use the structured request or email link above, or contact tzh476@gmail.com. Include the repository or system, desired outcome, available fixtures, deadline, and budget range. Do not send passwords, tokens, private keys, or regulated personal data.