🤝 Top Collaborators
.png&w=640&q=75)
🤓 Latest Submissions
SIPA OS: Pocketful Dark Factory
SIPA OS — Dark Factory is an autonomous multi-agent software engineering system designed to architect, implement, and rigorously verify production-grade microservices without human intervention during development. For the WeAreDevelopers x BAND Dark Factory Hackathon, our team (Aelin AquaSoul) deployed this factory against the Pocketful track to build a secure, high-concurrency financial wallet and payment processing service. Multi-Agent Architecture: The factory operates via three specialized, non-overlapping seats governed by strict system mandates: sipa-os-core (Planner/Architect): Analyzes project specifications, breaks down requirements into sequential work items with explicit done criteria, and coordinates task distribution. sipa-os-dark-v4 (Builder/Implementer): Implements code using the exact mandated tech stack and executes baseline checks. sipa-os-v3 (Verifier/Reviewer): Independently runs container builds and executes rigorous security and invariant attack suites without trusting builder claims. Technical & Security Highlights: Thread-Safe In-Memory Storage: Custom state management backed entirely by Python dictionaries guarded by threading.Lock(). Strict Balance Invariants (I1 & I2): Enforces money conservation (sum of balances always equals the seeded total) and prohibits negative balances/overdrafts, returning a 422 error on violations. Cryptographic Security: Secure password hashing using pre-hashed SHA-256 wrapped into salted bcrypt digests to prevent silent 72-byte truncation vulnerabilities. Idempotency & Validation: User-scoped idempotency keys across all mutating financial endpoints and strict regex-based handle derivation (^[a-z0-9_]{1,20}$). Dockerized Containerization: Fully containerized with dynamic $PORT support and verified using automated pre-flight testing harnesses.
6 Oct 2026
Bob, Verified
Bob does the code review. This project asks the next question: how do you know it actually did what it says? AI coding agents are usually graded on whether their summary sounds right, not on whether it matches what happened on disk. For a review tool, that gap is the whole product failing at its one job — you end up trusting the reviewer's word about the review, with no way to check it. This harness wraps Bob's Agent mode with two small, zero-dependency Python libraries built for exactly this: sipa-trace turns every tool call Bob makes into a hash-chained, risk-classified record. The classifier is deterministic and rule-based — it looks at tool capability (does this write, delete, touch the network, touch credentials), never at Bob's own judgment of its own action. An unrecognized tool falls through to the lowest risk tier by design, so it gets flagged for a human instead of silently waved through. verify() walks the whole chain afterward and confirms nothing was edited after the fact. sipa-signal runs Bob's own written explanation through a deterministic filter before a human reads it, stripping hedging and filler language. It's pattern-based, not another model summarizing Bob's summary — a second LLM in that role would just relocate the trust problem. The tool→risk mapping is generic on purpose: it classifies what kind of action a call is, not the domain of the task, so the same harness works on any repo Bob is pointed at. We ran it for real: Bob reviewed a sample file, made one tool call (read_file), correctly classified as no-risk, hash chain verified clean, and Bob's own review text passed the filter as CLEAN with 0% filler in that run. Task ID and exact numbers are in the repo. Impact: this turns "the AI said it worked" into something with a paper trail — a small, cheap step toward AI-assisted code review a team can actually rely on.
27 Sep 2026
