AInovations LLC — AI systems studio
Custom operational software — geospatial, Android, locked Linux for the box — and source-code security audits that ship a patch. Reproducers and sealed oracles, not a scan PDF.
What we do
A locked Linux image for the appliance you ship — security screening, sensors, industrial boxes — with signed updates, rollback, and an SBOM. US company, US support.
Fixed-scope baseline, then a limited-seat retainer for CVE triage and scheduled image cuts.
Custom operational software: geospatial and OSINT consoles, Android field tools, and the web surface they share. Designed, visually locked, and shipped so nothing important leaves the machine you already trust.
A source-code security audit that includes the patch. AI-assisted adversarial review of attacker-reachable code — novel findings, a deterministic reproducer, a sealed oracle, a before/after gate. If we can't reproduce it, we don't report it.
Fixed-scope engagements. Vulnerability research on the repo you hand us, including previously unknown issues. Patch included.
Public and anonymized receipts
Receipts from source-code security audits — named public advisories beside anonymized sprint shapes. Each finding ships a deterministic reproducer, a sealed oracle, and a behavior-preserving patch you can run yourself.
Every finding ships with a reproducer and a passing-or-failing oracle — not a screenshot. Metrics are re-measured on pinned inputs; patches are behavior-preserving under sealed gates.
Coordinated disclosure against PyPI markdown (Python-Markdown): algorithmic-complexity denial of service on the default renderer. Superlinear growth proved on a sealed gate; the submitted patch is linear and byte-identical on a 3,000-document differential. ~126 million downloads last month. Patch included.
Quadratic big-integer accumulation on an attacker-reachable decode path — CWE-407 class CPU exhaustion. Growth curve proved superlinear; fix verified byte-identical against a reference implementation. Patch included.
CBOR bignum serialization rebuilt with native linear-time constructors. Sealed correctness oracle plus interleaved perf gate on the same entrypoint.
Decode-side bignum handling on a wire-format parser — optimization that doubles as hardening. Fix-carrying patch closes an attacker-reachable path.
Immutable-bytes concatenation in a loop — classic quadratic behavior on large inputs. Replaced with linear assembly; correctness oracle plus interleaved benchmark gate.
Naive division loop on an encoding path. Fixed-radix chunking with verified output against the project's own test suite.
Per-digit big.Int division replaced with fixed-radix peeling. Interleaved median benchmark; double independent re-audit before accept.
Selected work
Every licensed microwave path in the United States, drawn where the FCC says it is. 474,000 paths and 357,000 structures from the weekly ULS filing, with the evidence behind each one a click away — and it runs in the browser, so nothing you look at leaves your machine.
Android call-screening that puts a rules engine between you and the robocallers. Open source on GitHub.
Debian Stable with snapshots, rollback-safe upgrades, and first-party GTK tooling — the in-house proof behind appliance baselines, not a consumer distro pitch.
Studio method
Pin the outcome before touching the tools. What does done prove, and to whom?
Spec before code. Architecture, failure modes, and the oracle that will judge the result.
Small, verified increments. Every claim backed by a run, not a narrative.
Ship the image, sign the update, write the runbook. Rollback is a feature. Boring operations are the product.
The studio
A US studio for custom operational software and the appliances it runs on. Locked edge images, intelligence instruments, and source-code security audits — sealed oracles, reproducers, rollback-safe updates, and patches that survive independent re-audit.