BENJAMIN HONG@benjamin_hong753

SIPA OS — Dark Factory is an autonomous multi-agent software engineering system designed to architect, implement, and rigorously verify production-grade microservices without human intervention during development. For the WeAreDevelopers x BAND Dark Factory Hackathon, our team (Aelin AquaSoul) deployed this factory against the Pocketful track to build a secure, high-concurrency financial wallet and payment processing service. Multi-Agent Architecture: The factory operates via three specialized, non-overlapping seats governed by strict system mandates: sipa-os-core (Planner/Architect): Analyzes project specifications, breaks down requirements into sequential work items with explicit done criteria, and coordinates task distribution. sipa-os-dark-v4 (Builder/Implementer): Implements code using the exact mandated tech stack and executes baseline checks. sipa-os-v3 (Verifier/Reviewer): Independently runs container builds and executes rigorous security and invariant attack suites without trusting builder claims. Technical & Security Highlights: Thread-Safe In-Memory Storage: Custom state management backed entirely by Python dictionaries guarded by threading.Lock(). Strict Balance Invariants (I1 & I2): Enforces money conservation (sum of balances always equals the seeded total) and prohibits negative balances/overdrafts, returning a 422 error on violations. Cryptographic Security: Secure password hashing using pre-hashed SHA-256 wrapped into salted bcrypt digests to prevent silent 72-byte truncation vulnerabilities. Idempotency & Validation: User-scoped idempotency keys across all mutating financial endpoints and strict regex-based handle derivation (^[a-z0-9_]{1,20}$). Dockerized Containerization: Fully containerized with dynamic $PORT support and verified using automated pre-flight testing harnesses.

Bob does the code review. This project asks the next question: how do you know it actually did what it says? AI coding agents are usually graded on whether their summary sounds right, not on whether it matches what happened on disk. For a review tool, that gap is the whole product failing at its one job — you end up trusting the reviewer's word about the review, with no way to check it. This harness wraps Bob's Agent mode with two small, zero-dependency Python libraries built for exactly this: sipa-trace turns every tool call Bob makes into a hash-chained, risk-classified record. The classifier is deterministic and rule-based — it looks at tool capability (does this write, delete, touch the network, touch credentials), never at Bob's own judgment of its own action. An unrecognized tool falls through to the lowest risk tier by design, so it gets flagged for a human instead of silently waved through. verify() walks the whole chain afterward and confirms nothing was edited after the fact. sipa-signal runs Bob's own written explanation through a deterministic filter before a human reads it, stripping hedging and filler language. It's pattern-based, not another model summarizing Bob's summary — a second LLM in that role would just relocate the trust problem. The tool→risk mapping is generic on purpose: it classifies what kind of action a call is, not the domain of the task, so the same harness works on any repo Bob is pointed at. We ran it for real: Bob reviewed a sample file, made one tool call (read_file), correctly classified as no-risk, hash chain verified clean, and Bob's own review text passed the filter as CLEAN with 0% filler in that run. Task ID and exact numbers are in the repo. Impact: this turns "the AI said it worked" into something with a paper trail — a small, cheap step toward AI-assisted code review a team can actually rely on.

AI infra logs are prose. To notice that a pipeline's risk jumped between two steps, someone has to read both log lines in full and hold the first in working memory while reading the second — slow under time pressure, and structurally hostile to anyone who processes information mechanically rather than narratively. Worse: most "audit trails" just trust whatever the log says, with nothing stopping a tampered entry from looking valid. sipa-trace fixes the shape, not the content. Every pipeline event becomes a TraceCard with a locked schema (stage, action_type, risk_class, reversible, state_delta). Risk is assigned by a fixed rule table, not by asking a model to grade its own step. Two cards in a row diff field-by-field — the diff IS the alert, not a paragraph you have to parse. Every card is hash-chained, and a real verifier recomputes each entry's hash from its actual payload and compares it — so content tampering (not just chain-linkage) is caught. Core (sipa_trace/): TraceCard schema, RiskClassifier (NONE→CRITICAL), hash-chained TraceLog, diff_cards() with risk_escalated/became_irreversible flags, verify() — 29 tests green, runs with zero API keys. Instrumentation: a real MCP-server / FastAPI middleware wraps tool calls with @traced, classifying real actions (e.g. credential_access → CRITICAL) automatically as they happen. Dashboard: React + FastAPI live view polling the trace stream — trace feed, live diff panel, and a Verify badge that flips Verified → Invalid the moment a card is tampered on disk, re-checked on demand.

AI infra logs are prose. To notice that a pipeline's risk jumped between two steps, someone has to read both log lines in full and hold the first in working memory while reading the second — slow under time pressure, and structurally hostile to anyone who processes information mechanically rather than narratively. Worse: most "audit trails" just trust whatever the log says, with nothing stopping a tampered entry from looking valid. sipa-trace fixes the shape, not the content. Every pipeline event becomes a TraceCard with a locked schema (stage, action_type, risk_class, reversible, state_delta). Risk is assigned by a fixed rule table, not by asking a model to grade its own step. Two cards in a row diff field-by-field — the diff IS the alert, not a paragraph you have to parse. Every card is hash-chained, and a real verifier recomputes each entry's hash from its actual payload and compares it — so content tampering (not just chain-linkage) is caught. Core (sipa_trace/): TraceCard schema, RiskClassifier (NONE→CRITICAL), hash-chained TraceLog, diff_cards() with risk_escalated/became_irreversible flags, verify() — 29 tests green, runs with zero API keys. Instrumentation: a real MCP-server / FastAPI middleware wraps tool calls with @traced, classifying real actions (e.g. credential_access → CRITICAL) automatically as they happen. Dashboard: React + FastAPI live view polling the trace stream — trace feed, live diff panel, and a Verify badge that flips Verified → Invalid the moment a card is tampered on disk, re-checked on demand.

Trading bot with the following STRATEGY: - Identifies bullish/bearish gaps between candles not filled by price action - Enters long when gap forms ABOVE VWAP - Risk: 2% account per trade, 1:3 minimum reward-to-risk - Stop loss: VWAP ± 1 ATR - Max 3 losses/day stops trading - Market orders only FEATURES: - FastAPI backend with 6 REST endpoints (equities + options) - React dashboard with live account balance, positions, PnL - Options trading support (mandatory requirement) - Paper trading integration via Alpaca API - Deployed to Render (production-ready) TECH: Python (FastAPI, Alpaca SDK), React/Vite, REST API, Alpaca Paper Trading

Six Matches. One leaderboard. Build on AMD, earn points and compete for prizes.

🌎 Hybrid Hackathon | 💻 Online Build: 3–8 November 2026 | On-site Phase: 8 November 2026 📍 On-site Venue: Pierpont Place 163 W Pierpont Ave, Salt Lake City, UT 84101, USA ✨ Please note that travel and accommodation are not covered.

🌎 Hybrid Hackathon | 💻 Online Build: October 16–19, 2026 | 📍 On-site: October 19–20, 2026 The official hackathon of AI & Big Data Expo Europe, organized by TechEx Events and lablab.ai. Build AI applications and agents across AI, cybersecurity, cloud, IoT, automation, edge computing, digital transformation, and data infrastructure, then showcase your project live at one of Europe's largest enterprise technology events. 📍 On-site Venue (October 19–20): RAI Amsterdam Europaplein 24, 1078 GZ Amsterdam, Netherlands 📍 If approved for the on-site experience, you'll also have the opportunity to showcase your project live. Travel and accommodation will not be covered.

🌎 Hybrid Hackathon | 💻 Online Build: 12-17 October 2026 | On-site phase: 17-18 October 2026 To participate in the hackathon, simply click Sign up with AMD. If you are not already a member of the AMD AI Developer Program (ADP), you will need to create an account. The AMD Developer Hackathon: ACT III is a hands-on event for developers, founders, engineers and builders who want to push what’s possible with AI on real infrastructure. 📍 If approved for the on-site experience, you'll also have the opportunity to showcase your project live. Travel and accommodation will not be covered.

🌎 Online Hackathon | 💻 Online Build: Sept 26 - Oct 5, 2026 A virtual, global hackathon. Build from anywhere in the world. Dark Factory is the official hackathon of WeAreDevelopers World Congress North America, presented by BAND, but you don't need to be in San Jose to take part. For one week, you build a software factory in BAND Desktop: a band of coding agents that plans work, implements it and checks its own results. 🎟️ Bonus for sign-ups: you are eligible for a free ticket to WeAreDevelopers World Congress North America in San Jose (Sep 23–25). If you do go, stop by the BAND booth: a surprise is waiting for you.