01
tongs ↗Creator
A terminal-native code review inbox for GitHub and GitLab. Review diffs, follow discussions, and investigate CI without losing your place.
ANDRE LUSTOSA / ENGINEER & TEAM LEAD
Engineering
the foundations.
I build reliable software platforms, lead engineering teams, and work in the open.
01 / Writing
Selected writing
Testing the Package Beyond the Source Tree
Several upstream fixes point to one packaging rule: exercise built artifacts, disabled paths, and dependency boundaries directly.
5 min read
AI Agents in CI/CD: Security, Robustness, and Productivity
A graduate-level study of agentic CI/CD: authority and prompt injection, bounded verification, distributed recovery, test oracles, and causal measurement of productivity.
Build Pipelines Should Explain Their Decisions
A pipeline becomes more useful when each stage records the evidence behind release, rejection, and later maintenance decisions.
Bounded Autonomy Requires Separate Control Planes
Agentic automation remains governable when model choice, execution, policy, and evidence are separate interfaces with independent owners and tests.
Hermetic Builds Begin at the Acquisition Boundary
A build becomes explainable when every network-dependent input is acquired explicitly, recorded, and separated from the steps that construct the artifact.
A Linux Updater Is a Deployment Transaction
Safe self-updates preserve a compatible installed set through staging, validation, privileged activation, startup checks, and recovery.
02 / Projects
Selected projects
02
agentic-ci ↗Maintainer
Run coding agents in sandboxed CI environments. My contributions span forge APIs, telemetry, runtime integration, and versioning.
03
OpenShell midstream ↗Midstream Maintainer
Red Hat's maintained midstream of NVIDIA OpenShell for secure downstream builds. My work spans packaging and release automation, alongside a separate fix proposed to NVIDIA's upstream project.