thomas.sprayberrylabs.com / CHANGELOG.md

Thomas Sprayberry

All notable changes to one engineer's career are documented here. Versions are years. I build the controls that let AI agents touch production systems, after fifteen years running those systems myself.

[Unreleased]

Wanted: a senior agent-infrastructure, agent-security or platform role. Greater Atlanta, GA, or remote.

hello@sprayberrylabs.com Résumé

2026 · Agent security, in production

### Added

  • redstamp, an offline action firewall for AI agents. One gate governs CrewAI, LangGraph, OpenAI's Agents SDK and Microsoft AutoGen from the MCP layer, with no framework patches. It scores 100% recall at 100% precision on the 298-sample arena benchmark, and it runs in enforce mode on the agent fleet I operate. code ↗ · write-up · arena ↗
  • truecopy, a supply-chain gate for agent skills and MCP servers. 68,560 skills poison-scanned, including all of ClawHub, and the official Claude Code plugin directory re-verified every day at pinned commits. code ↗ · the scan · the daily watch
  • dario hardening: OpenSSF Scorecard 9.4/10 and a 100% OpenSSF Best Practices badge, with signed, SLSA-attested releases published from CI with no stored token. live score · badge ↗
  • The engineering log: 43 write-ups of systems I built, broke and fixed, with the numbers and the misses left in. It moved here from sprayberrylabs.com in September 2026. read it

### Fixed

  • huggingface_hub #4546: on Windows, downloads into deep directories crashed in a 248 to 255 character path gap. I tightened the long-path guard and added a parametrized regression test, and the maintainer merged it on the first pass. PR ↗
  • A four-day silent outage: an embedding model vanished and nothing paged anyone. Restoring it was the easy part; a model-presence guard now turns the next one into a ten-minute alert. write-up

### Removed

  • strongroom and agent-security-stack, archived in September 2026. The code and the write-ups stay public. strongroom cut a live fleet's 132 standing secrets to 13 before it went. archive ↗

2025 · Sprayberry Labs

### Added

  • askalf, a self-hosted agent fleet that runs a software studio end to end: intake, tickets, specialist agents, pull requests, with shared memory, budget controls and human approval gates. I designed it and operate it daily. github ↗ · the studio ↗
  • dario, an OAuth LLM proxy with a self-healing release pipeline: it watches its upstream for drift, rebakes, runs full CI and ships a new release. MIT, 500+ stars. code ↗ · case study

2019 · Century Solutions Group still running

Solutions architect and Tier 3 team lead at a managed-services provider. Architecture from data-center builds to user endpoints, and technical lead on every SAN, switching, wireless, firewall and server install.

2018 · Hanes Brands, contract

Lead migration engineer. Planned and ran the move of Alternative Apparel's servers, workstations and applications into Hanes' data center after the acquisition, with a team of 22 engineers.

2016 · CorrectHealth

Systems engineer and IT architect. Led a data-center migration and built the full IT infrastructure for a new 400+ user subsidiary, from blueprint to install.

2012–2015 · IT Authorities, Orion, Providyn, OnsiteRIS

Built an HA public vCloud stack. Co-designed a service-provider data center for 2,032 tenants across 8 locations. Tier 3 for 100+ MSP clients, and a PCI project for a major restaurant chain.

2005 · Initial release

IT intern at the Coweta County School System. Then MyrtleTech (70+ client networks) and Century's network and systems support desk. Full résumé