// execution infrastructure for AI agents

Gustavo Schneiter

AI Infrastructure Engineer · Rust · Distributed Systems

The core of my work is CoreLink — a multi-tenant, content-addressed cache and execution fabric, live on Cloudflare's network across five production environments — where identical work is never repeated and compute is a disposable cursor over a shared store. The bill follows the structure: flat concurrency instead of metered minutes, zero egress instead of transfer fees. Rust, from edge workers to the kernel.

Open to systems / infrastructure / AI-engineering roles — remote or on-site, worldwide.
01 — selected work

What I've built.

Software re-does finished work, constantly: the same dependency compiled on a million machines, the same node_modules filling a million disks, CI re-testing code nobody touched. CoreLink is built on one bet — work is a pure function of its inputs, so give every piece of work a content address, do it once, share it. Watch it run below: the logs are real. No aspirational tense anywhere on this page.

corelink — the journey, in six acts
$ clw snapshot --name demo-journey .   # tree → content-addressed snapshot
$ clw hydrate /tmp/fresh --name demo-journey
$ clw -v run --input src -- cargo test # memoized: unchanged inputs never re-run
content-addressed on zero-egress R2 — identical work is stored once and shared across the org clients Bazel · Turborepo agents CoreLink Cache CAS + Action Cache isolation model-checked in TLA+ consumers Runners · Workspaces ephemeral compute · clw
01 · the storeCoreLink Cachedeployed

Identical work, stored once — for your whole org, and beyond.

Every artifact is addressed by what it is (BLAKE3), not where it lives — so the global cache holds one copy of everything. A teammate's build becomes your instant hit; CI's compile lands warm on your laptop. Public packages go further: a shared cross-tenant mirror fetches each wheel or bottle from upstream once, ever, while cryptographic tenant isolation — model-checked in TLA+ — walls every org's private work off. Your tools already speak it (Bazel, Turborepo, sccache; npm, pip, brew, OCI), and the store is zero-egress R2: pulling from the cache is free, exactly where S3-backed caches bleed.

48 TLA+ specs in CI · BYOK across 4 KMS · per-tenant $-ceiling, fail-closed · Ed25519 audit log, verified offline · no unsafe (one audited C-FFI exception)
02 · the computeCoreLink Runnersdeployed

CI that stops repeating itself — and stops billing by the minute.

Runners boot cache-warm: inputs are already local when the job starts, and memoized steps replay instead of re-running. Each job gets a fresh, fail-closed microVM, destroyed afterwards; images are digest-pinned and refused unless verified; boxes carry per-lease scoped tokens, never master credentials; every result returns as an Ed25519-signed attestation binding the full outcome. The bill changes shape — flat per parallel runner, unlimited minutes; modeled ~60–70% under hosted per-minute CI at typical use, before memoization zeroes the repeats.

cap-safety proven live · Postgres advisory-lock admission · recursive adversarial audit: 28 findings incl. real escape vectors → zero P0/P1
03 · the workspacesCoreLink Workspacesshipped

Your working tree stops being a place on a disk — it becomes an address.

clw snapshots a directory into the store and hydrates it on any machine in seconds — only the chunks that machine is missing travel. Heavy checkouts stop duplicating themselves across every laptop and runner; commands are memoized, so unchanged inputs never re-run; compute becomes a disposable cursor you point at work. The journey above ran these exact commands — install it and run them yourself.

shipped to Homebrew · five-target releases, minisign-signed · per-crate SBOM · local L1 cache

hugit free · closed source Rust

A git-compatible, LLM-native forge for agent fleets. Serves the real git wire protocol (push/clone) directly from content-addressed storage; a union-tested landing queue batches green branches and, on red, a bisect isolates the culprit in ≤⌈log₂ n⌉ probes — a bound the test suite proves. Refs are an append-only, hash-chained event log with compensating-event undo, so a force-push can't destroy history; the Ed25519 integrity spine is hardened through 13 adversarial security-review rounds.

  • 20 crates
  • 1,971 tests green in CI
  • cargo-deny clean · 250 pinned deps

HuGR Tools open source production-proven

An MCP tool-server fleet on Cloudflare Workers — 630 tools across 37 deployable workers on one frozen kernel: a 3-tier fail-closed auth chain, Durable-Object distributed rate limiting, one dispatch pipeline written once. An OpenAPI→MCP forge generated the AWS surface; the value is the handwritten composite tools — Datadog temporal root-cause correlation, Stripe multi-currency VAT reconciliation, Vercel deploy-failure triage proven on a real failed deploy. BYOK per request, zero stored secrets.

  • 630 tools · 37 workers
  • 8,538 tests · 0 failing
  • mutation-tested (Stryker)
02 — open craft

The open proof.

My personal developer portfolio: standalone open-source builds, put in public to be read and run — active works in progress, still under development. Clone them, run the benchmarks, read the ledgers.

Lightr open source

A daemonless, imageless container runtime in Rust — a from-scratch exercise in content-addressed, memoized execution — public and reproducible: no daemon, no images, memoized runs. On public CI it cold-starts rootless containers in 30.8 ms (4× rootless podman at identical isolation), replays memoized re-builds ~2,000× faster than Docker redoing the work, and its Kubernetes CRI backend runs at 9.32× smaller resident footprint than containerd. Every number traces to the CI run that produced it, in the repo's benchmark ledger.

  • 30.8 ms cold start
  • ~2,000× memo vs Docker
  • critest 34/34 · real backend

Datarail open source

An end-to-end-sealed data rail and Kafka-wire-compatible broker whose storage never sees plaintext (#![forbid(unsafe_code)]): per-cofre X25519 key-wrap, offline-verifiable Merkle delivery receipts, exactly-once into Postgres (CI-gated against real Postgres 16), FASP-style congestion control. An author-commissioned adversarial audit, run outside my own harness, measured the real broker binary at 3.0 ms cold start and 3.3 MB idle RSS through a 50,000-message cycle with zero loss — and grepped the data directory clean of plaintext.

  • 3.0 ms cold start
  • 3.3 MB RSS · 2 MB binary
  • 50k msgs · zero loss · disk = ciphertext
03 — how I think

Verified, not trusted.

One discipline runs through everything I build: a claim is worth only its evidence. A number carries the hardware and method that produced it, or it's labeled a target — never stated as fact. Limitations are named up front, prior art is cited, and nothing ships as "done" until a test says so. It's slower, and it's the only way I'd want my name on infrastructure.

// patterns I'll defend in an interview
Cache
Isolation in the keyspace itself, not in a lookup check
Every blob path is derived by HMAC-SHA256 over the tenant identity under a secret key the edge can't read — another tenant's path can't even be guessed, and a doc-block in the code explicitly forbids adding a test backdoor.
_public
The internet's packages, downloaded once
npm, PyPI, Homebrew and OCI served read-through from a content-addressed mirror: a public wheel or bottle is fetched from upstream once, ever, then shared across tenants from the _public namespace — the token gates access, the bytes are shared, and private packages never enter it. Every new customer leaves the mirror more complete for the next one.
OKF wiki
A wiki that can't drift from the code
The architecture is knowledge-engineered: 157 concepts in an Open Knowledge Format bundle, each naming the source files it explains and pinned to a commit. CI gates the drift — and when cited code changes, a pipeline dispatches an agent to reconcile the concept. Agents load a subsystem's concepts before touching it.
Lightr
PID 1 arms an FD_CLOEXEC pipe before execv: EOF means the workload is truly running, bytes mean a diagnosed failure — closing the false-"Running" window most runtimes just tolerate.
HuGR Tools
RS256 → HMAC → introspection, where a rejection by a configured local verifier falls through instead of failing — so signing keys rotate with zero downtime. The rate limiter fails open while auth fails closed, and both choices are argued in the code.
Datarail
The dedup watermark advances in the same Postgres commit that lands the records, collapsing the "landed but not deduped" crash window — with the honest scope gate stated up front: positional watermark ⇒ append-ordered sources only.
// the discipline, in public
essay
The design of a cross-tenant, content-addressed mirror for npm, PyPI, Homebrew and OCI — public bytes fetched from upstream once and shared across every customer — and, the part I care about, exactly where that stops being safe. Every claim traces to the code.
paper
A concept paper with a runnable artifact: every replica recomputes the causal-stability certificate from evidence it verifies itself instead of agreeing on one, so Byzantine writers are detected and fenced, not out-voted. Checked, not proven — a bounded model-checker and an independent TLA+/TLC model exhausted over 2,299,968 states — and I found three convergence bugs attacking my own claim. Every number regenerates from a clean clone. DOI ↗.
truth ledger
Every feature maps to the test that proves it, or the honest reason it isn't — including three times an audit reversed my own earlier claim. It's a Lightr artifact, but the same tense-law governs CoreLink.
method
ADR-gated design, a fleet in isolated worktrees, adversarial audits — how one person ships at fleet throughput without the claim-rot.
04 — about

Background.

I've spent the last two years at the front line of what's probably the fastest revolution any industry has been through — learning the limits of working with LLMs first-hand, and building the processes and methods that get production-grade software out of them.

Before infrastructure, I ran product and delivery: founding Product Owner then Project Manager of a B2B commodities marketplace across Latin America, and operations for a construction company in Melbourne. Trilingual — English, Portuguese, Spanish.

São Paulo, Brazil (UTC−3). Open to remote or on-site roles worldwide. gustavo@humangr.com