WholeTroutMedia · Open-Source Bounties & Engineering Foundry
Public open-source engineering and verification ledger for WholeTroutMedia and Inception Engine Systems, architected and reviewed by Justin Aharoni (@jaharoni) (justinaharoni.com · Calendar & Intake · contact@jaharoni.com).
-f59e0b?style=flat-square){kind=icon}
Live Cross-Platform Engineering Portfolio & Contact Directory
| Engineering Channel | Live Verified Status | Proof & Direct Access |
|---|---|---|
| Upstream Open-Source Pull Requests | 6 Merged · 9 Open in Review (16 Tracked) |
100% Codecov patch coverage across InvenTree, OpenHMD, Uvicorn, Advanced Alchemy, Mergo, Ecosyste.ms, Obsidian (CASE_STUDIES.md) |
| Google AI Developer Forum | 14 Published Solutions |
2086 Developer Views · 78 Profile Visits across Antigravity, Gemini API, AI Studio & Stitch (discuss.ai.google.dev/u/CORTEX) |
Hugging Face Hub (@jaharoni) |
2 Live Interactive Spaces · 1 Portfolio Card |
Interactive Engineering Portfolio & Open-Source Bounties Space (huggingface.co/jaharoni) |
| Verified Engineering Vault | 105 Root-Cause Case Studies |
Standalone deterministic reproduction & regression suites (verify_fix.py exiting 0 in LEDGER.md) |
| Enterprise Sprints & Upwork Escrow | 6 Fixed-Price Sprint Packages ($450 to $15,000) |
48-Hour Milestone 1 Reproducer Guarantee + 30-Day Post-Merge Regression Warranty via Upwork Escrow or Direct Stripe Sprints |
| Personal Website & Direct Contact Hub | Justin Aharoni (@jaharoni) |
Portfolio: justinaharoni.com · Calendar & Intake: justinaharoni.com/contact · Email: contact@jaharoni.com |
Verified Upstream Merges & Active 100%-Covered Track Record
We focus on clearing long-standing, high-complexity open-source issues with 100% patch test coverage, strict static typechecking, and concise peer-to-peer engineering communication so maintainers can review and merge in <= 2 turns:
| Upstream Repository & Issue | Pull Request | Stack & Domain | Verification & Maintainer Outcome |
|---|---|---|---|
inventree/InvenTree#7064 |
PR #13166 | Python / React |
MERGED by @SchrodingersGat (100% Codecov patch coverage + API v569) |
OpenHMD/OpenHMD#260 |
PR #370 | C / XR Drivers |
MERGED by @ChristophHaag (HTC Vive Pro 2 USB ID & 32-byte HID feature report initialization) |
ecosyste-ms/packages#431 |
PR #1943 | Ruby / Rails |
MERGED by @andrew (Surgical 2-file license parser fix + RSpec suite) |
coollabsio/coolify |
PR #9651 | PHP / Laravel |
MERGED upstream (Clean v4.x orchestration fix) |
kaiiiz/obsidian-raindrop-highlights-plugin#99 |
PR #103 | TypeScript / Zod |
MERGED by @kaiiiz in 1 turn ("LGTM. Thanks!" + unit test suite) |
litestar-org/advanced-alchemy#117 |
PR #836 | Python / SQLAlchemy |
100% Codecov Patch Coverage (Sync, Async, Mock & Service repos + mypy/pyright) |
Kludex/uvicorn#1151 |
PR #3250 | Python / ASGI |
100% Coverage (Lifespan state-machine guard + CancelledError propagation) |
gyroflow/gyroflow#1227 |
PR #1276 | Rust / OpenCL+WGSL |
CLA Verified & Passing (OpenCL & WGSL lens distortion shader parity) |
HDInnovations/UNIT3D#3818 |
PR #5643 | PHP / Livewire 4 |
Review Addressed (@Roardom development branch Livewire 4.4.6 verification) |
darccio/mergo#233 |
PR #324 | Go |
All Checks Passing (CodeRabbit + HoundCI slice-pointer reflection fix) |
Our Maintainer-First Contribution Charter
- Strict 1-PR-Per-Org Pacing:
- We never flood a repository or organization with multiple concurrent Pull Requests. We submit one focused, atomic fix at a time and respect maintainer review bandwidth.
- 100% Patch Coverage & Pre-Flight Static Verification:
- Every modified branch, fallback path, and async counterpart is tested locally against upstream CI workflows (
mypy --strict,pyright,ruff,phpstan,prek,golangci-lint,CodSpeed, andCodecov) prior to opening a PR.
- Every modified branch, fallback path, and async counterpart is tested locally against upstream CI workflows (
- Stealth Pre-Submission Staging & Zero Target Leakage:
- While a fix is in internal review, its upstream repository name, issue number, and unified diff remain sealed inside our private vault (
WholeTroutMedia/bounty-solves-vault) with a blinded SHA-256 commitment (WTM-SEAL-XXX) so third-party scraper bots cannot spam upstream maintainers.
- While a fix is in internal review, its upstream repository name, issue number, and unified diff remain sealed inside our private vault (
- Community Etiquette & Competing-PR Audit (
COMMUNITY_ETIQUETTE.md):- Before touching any issue, our workflow inspects assignees, linked Pull Requests (
CROSS_REFERENCED_EVENT), and maintainer comments (SKIP_CLAIMED/EXTEND_STALLED/CLAIM_OPEN).
- Before touching any issue, our workflow inspects assignees, linked Pull Requests (
Active Blinded Commitment Ledger
| Commitment ID | Target Hash (Blinded Until PR Submission) | Tier | Language | Etiquette Gate | Merkle Commitment Root | Status |
|---|---|---|---|---|---|---|
WTM-SEAL-001 |
sha256:fbbc6c8f53033dbf... (Blinded Pre-PR) |
Easy |
Python |
SKIP_CLAIMED |
sha256:169caaa4fa248567... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-002 |
sha256:95a68a242fb47e42... (Blinded Pre-PR) |
Medium |
Scala |
SKIP_CLAIMED |
sha256:72b616fcad3dec30... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-003 |
sha256:875fe0700b6e6615... (Blinded Pre-PR) |
Hard |
Python |
EXTEND_STALLED |
sha256:9bf5e8d04afb7cb5... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-004 |
sha256:c261bd6d961bbde9... (Blinded Pre-PR) |
Medium |
Ruby |
CLAIM_OPEN |
sha256:b4bae4dada1329ad... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-005 |
sha256:4d99092841ea0a6c... (Blinded Pre-PR) |
Medium |
Go |
EXTEND_STALLED |
sha256:d096d1840626bafb... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-006 |
sha256:fd5c85e5748c52a9... (Blinded Pre-PR) |
Medium |
PHP |
EXTEND_STALLED |
sha256:647e0020d6a5b45d... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-007 |
sha256:0d63a2c234974746... (Blinded Pre-PR) |
Hard |
Python |
SKIP_CLAIMED |
sha256:e743b50074641985... |
SEALED_IN_PRIVATE_VAULT |
WTM-SEAL-008 |
sha256:054750d0120906f0... (Blinded Pre-PR) |
Hard |
Rust |
SKIP_CLAIMED |
sha256:50eeb879cf73d5bc... |
SEALED_IN_PRIVATE_VAULT |
Free Open-Source Internet Defense & Anti-Bot Scrambler Kits (kits/ & templates/)
We publish and maintain 6 free, zero-dependency open-source defense kits to help maintainers, researchers, forum moderators, and website owners protect the internet from autonomous AI spam rings, dataset scrapers, and supply-chain bots:
| Free Defense Kit | Who It Protects | How It Works | Direct Link |
|---|---|---|---|
1. GitHub Maintainer Bot-Shield (v2.0) |
GitHub Repository Maintainers | Drop-in GitHub Action that auto-fetches our live SHA-256 spam-bot blocklist (16+ caught bots, 459+ spam PRs exposed) and auto-closes spam PRs in < 2s. |
templates/open-source-bot-shield.yml |
| 2. 1-File Website & Docs AI-Scraper Shield | Blogs, Docs Sites & Small Businesses | Drop-in llms.txt + .well-known/agent-card.json that leaves humans and search engines untouched while routing rogue AI scrapers into our conformance quarantine. |
kits/website-llms-shield/ |
| 3. Hugging Face Dataset Anti-Theft Shield | AI Researchers & Dataset Creators | Injects and verifies 20 self-rotating HMAC-SHA256 canary rows in JSONL datasets to expose unauthorized dataset cloning. |
kits/huggingface-dataset-shield/ |
4. Bounty Platform Pre-Check SDK (Py & JS) |
Algora, Polar, Opire, Gitcoin & Maintainers | Zero-knowledge SHA-256 contributor pre-check (verify_contributor.py / .mjs) that blocks verified sockpuppet rings without exposing plain-text usernames. |
kits/bounty-platform-precheck/ |
| 5. PyPI & NPM Fake-Package Early Warning Radar | Python (pip) & JS (npm) Ecosystems |
Monitors deterministic canary package identifiers across PyPI and NPM (canary_package_radar.py) to catch dependency-confusion squatters early. |
kits/package-registry-canary-radar/ |
| 6. Forum Moderator Anti-Slop & Code Auditor | Discourse, GitHub Discussions & HF Mods | Verifies code snippets actually compile (ast.parse) and flags robotic AI-slop boilerplate (forum_slop_auditor.py). |
kits/forum-moderator-anti-slop/ |
| 7. 3D Mesh & Media Provenance Watermarker | 3D Artists, CAD Engineers & Studios | Embeds invisible HMAC-SHA256 provenance commitments into .obj/.gltf meshes and media assets (watermark_asset_shield.py). |
kits/media-and-3d-watermark-shield/ |
Priority Issue & Enterprise Backlog Sprint Intake (For Maintainers & Engineering Leads)
Read our detailed Engineering Case Studies (CASE_STUDIES.md), Enterprise Backlog Sprints (ENTERPRISE_SPRINTS.md), and Security Charter (SECURITY.md).
If you maintain an open-source project or lead an engineering team and want us to clear a hard bug, a pre-release backlog sprint, or ongoing maintenance with 100% patch test coverage:
- Unlock the $4.99 Wednesday 9:23 PM Builder Pass · Book a 48h Surgical Bug Fix ($450 / $250 minor) · Email Issue Details
- Book a 5-Issue Priority Backlog Sprint ($1,500) · Book a Custom AI Agent / 10-Issue Release Burn-Down ($3,500)
- Book a CI/CD & 100% Patch-Coverage Hardening Pass ($750) · Subscribe to Monthly Principal Systems Pod Retainer ($4,500/mo / $2,500 lite)
Repository Structure
open-source-bounties/
├── README.md # Overview, verified merges & blinded commitment table
├── CASE_STUDIES.md # Deep root-cause & maintainer collaboration case studies
├── ENTERPRISE_SPRINTS.md # Turnkey 5-Issue / 10-Issue Backlog Sprints & Retainers
├── SECURITY.md # Coordinated vulnerability disclosure & zero-leakage charter
├── COMMUNITY_ETIQUETTE.md # Maintainer-first contribution & review charter
├── LEDGER.md # Synchronized blinded commitment & settlement ledger
├── registry/
│ └── bounties.json # Blinded machine-readable commitment state
├── commitments/
│ ├── WTM-SEAL-001/ # Blinded SHA-256 Merkle commitment & verifier
│ ├── WTM-SEAL-002/ # Blinded SHA-256 Merkle commitment & verifier
│ └── WTM-SEAL-003/ # Blinded SHA-256 Merkle commitment & verifier
├── bounties/
│ ├── asgi-proxy-header-401/ # Reference ASGI proxy verification suite
│ └── stream-quorum-flush-402/ # Reference async stream quorum verification suite
└── .github/
└── workflows/
└── verify-bounties.yml # CI runner verifying commitments/*/verify_commitment.py
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support