Staff Engineer · Agentic AI · AppSec · Observability
I build the conditions for squads to make good decisions without depending on my memory.
I lead AI enablement across squads. I've worked in tech since 2006 and today apply Harness Engineering, Agentic AI and AppSec: architecture before code, scoped agents, a human in the loop, and evidence you can reproduce.
Right model for every subagent. No LLM in the loop.
A single Go binary that sits in your coding agent's hooks, scores each delegated task and picks the model and effort. Unsure? The spawn keeps the model it asked for.
$ downshift try "rename the userId variable"
→ small: opus → haiku (~75% cheaper) (est., list prices)
why: trivial task, no risk, confident
curl -fsSL https://raw.githubusercontent.com/tiagovilasboas/downshift/main/install.sh | sh && downshift setup- Deterministic model routing: mechanical work (renames, test runs, listings) is downshifted; auth, payment and secrets keep risk floors.
- Cache hygiene (
cache-tax): prices a cold prompt cache before you pay for it. - Code intelligence (opt-in): reverse call graph and only the relevant symbols packed under a byte cap.
- Output compaction: noisy terminal output is compacted; errors, diffs and stack traces stay verbatim.
Works with Claude Code, Cursor, Codex and OpenCode. Fail-open: any doubt or error leaves the spawn untouched. Prompts never leave memory.
Honest numbers: up to ~12% list-price saving on mechanical delegated work in a controlled A/B, nothing attributable on natural use yet. Every claim has a rung on the evidence ladder.
🌐 Website · Try it · Architecture · Discussions · ⭐ Star it
- A domain knowledge base in internal Git, used as context by agents in code review: business rules leave the heads of whoever remembers them and get checked in the PR.
- +10% checkout sales in a month, after finding why the campaign broke at the moment of payment.
- A frontend observability contract adopted by the squads: the same error and personal-data protection pattern in every front, with an open guide any squad can copy (sentry-golden-path). (Articles in Portuguese.)
|
antigravity-operator Outer harness for coding agents on Google AI Pro: scoped, evidence-backed, recoverable sessions. 
|
sentry-golden-path Staff guide to the Sentry golden path: errors, tracing, releases, alerts and AI/LLM monitoring. 
|
|
ai-code-review Agentic code review toolkit: skills, runbooks and AppSec guardrails for PR pipelines.
|
dev-to-mcp MCP server for the Forem/DEV.to API in a single binary. Go + stdio, no cold start.
|
|
react-layered-boilerplate Production-ready React + Vite starter with strict layering, TypeScript, tests and CI. 
|
montanha-zero-day Platformer game as an offline PWA on your phone (play).
|
| Resource | What's inside |
|---|---|
| agyo: architecture | Where the Go runtime sits between the agent and the OS, and where session state is written |
| ai-code-review: runbooks | A PR review in about 15 minutes: one skill per pass, a HIGH AuthZ/IDOR or CRITICAL secret becomes BLOCK, findings without path:line are dropped |
I send small, tested fixes to projects I use. Some examples:
- lefthook #1566: fail_on_changes no longer breaks the hook when a submodule is staged.
- goose #12629: first-time CLI configure asks for the goose mode and saves it.
- laya #968: fine-tune warns when predictions collapse to the class prior.
- openai-agents-python #4961: the session history limit is no longer sent as the Conversations API page size.
- rspack #15900: lightningcss-loader stops mutating user options, so child compilers build again.
- gosec #1760: G102 now flags binding to the IPv6 unspecified address.
- nanostores #437: listenKeys fires for deep keys changed through a parent key.
- OmniRoute #15800: flags combo steps pinned to models that disappeared from the synced catalog.
- OmniRoute #15925: optional cleanup of those steps after a model sync.
- OmniRoute #17101: cleanup of a locked snapshot is retried instead of crashing the background task.
- TanStack Query #11679: queued scoped mutations start again while the window is unfocused.
- Currently pursuing a Bachelor's in Cyber Defense at Faculdade Impacta.
- Agentic AI with LangChain and LangGraph (IBM/Coursera), completed September 2026.
- Security Hardening (Google/Coursera), completed September 2026.
- Claude Code: Engineering with AI Agents (Vanderbilt/Coursera), completed September 2026.