coilyco
coilyco

Your agent is about to run a command.

A coding agent's terminal. It has typed a git commit that skips the repository's checks, and has not run it yet.

Which command, and who said it could? I'm Kai Ase Siren, and coilyco is my platform engineering practice. I build the layer that answers both questions, on more than ten years of infrastructure, Kubernetes, observability, and compliance work.

kai@coilyco.ai How an engagement is shaped

Start where you sit.

01 // umbra

The command is checked before it starts.

umbra reads a spec you commit beside your code. It names each verb an agent may run and each flag that verb may take. Anything else is refused before a process exists. Arguments are checked too, so an allowed verb cannot carry a pipe into a shell.

umbra ↗ MIT, on brew and scoop.

umbra refuses the commit because the skip-checks flag is denied, exits with code 2, and writes the refusal to its audit log.

wrap ward git {
    exec git
    can run commit { deny-flag "--no-verify" }
    never run "reflog expire"
}
The refusal text and log format are umbra's own. This session is a sample, and the log line is shortened.

The agent can still commit. It cannot skip the checks to do it. Every refusal lands in the same log as every command that ran.

02 // housecast

Last week, this agent could not touch dependencies.

Here is the commit that changed that. The role and the case that tests it changed together, in your repo. The agent answers the new case, and housecast puts that answer in front of a person, with the target beside it. Name who may grade, and the agent that wrote the case cannot grade its own answer.

housecast ↗ MIT, in preview.

One commit edits two files. The role gains permission to change its own site's dependencies, and the test case changes from adding a toggle to removing an unused package.

Shortened from a real role change. Your repo holds the cases, and housecast grades the answers.
housecast's grading page for one evaluation case. The header reads in pass, out pass, and the boundary holds. Two answers sit side by side, labelled IN and OUT, each with its prompt, its target, and the agent's answer, and both are graded pass. A side rail shows 105 of 105 scorable answers graded, and a map of passing and failing cells for each agent role. housecast's grading page, cropped to one evaluation case. The header reads in pass, out pass, and the boundary holds. Below it, the IN half shows the prompt, the target, and the agent's answer, graded pass.
A real run on housecast's grading page. A model wrote the answers, and I graded them.

This is the layer I build for your team.

One agent, one command, one role change. Your team has more of each. I set up umbra and housecast for you, and the platform work underneath them. Neither tool ships or calls a model of its own, so neither adds a model-provenance question to your procurement review.

Hire me

Two ways to work together

  • Hourly

    Platform and agent engineering by the hour

    $150 an hour, the same rate whichever contract shape your procurement prefers. That covers eval harnesses that catch an agent regression before a user does, setting up umbra or housecast for your team, and the platform work underneath: infrastructure as code, Kubernetes, observability, networking across clouds, and SOC 2 and NIST 800-53 remediation.

    See how an engagement is shaped →

  • $1

    Collab or consult call

    Talk it through before you join a team or have someone join yours. About umbra, housecast, or the agent you're shipping. The $1 keeps the calendar for people who mean it.

    Open the booking calendar (loads Calendly)

Contracting

This is the detail behind the hourly rate. The work I take on is platform engineering first, the infrastructure work a team already has a line in the budget for. The agent work comes last, because it is the specialism I bring to that work rather than a separate offer.

The work

Platform engineering, more than ten years of it.

Each entry below is work I have already done in production. The resume is the full record, with where and when.

Infrastructure as code
Terraform, CloudFormation, Pulumi, and Ansible across AWS, GCP, and Azure. I have brought deployment tooling that had fallen behind back to current standards, and moved internal systems onto production-grade managed services.
Kubernetes and containers
Services on Kubernetes, container platforms on AWS ECS, and the Docker work underneath both. Most recently that included making a Dockerized Python service start about twice as fast.
Observability
OpenTelemetry, Datadog, Prometheus, Grafana, and New Relic. I have migrated a company's monitoring onto a customized Datadog and Fluent Bit system.
Networking across clouds
Azure OpenAI deployed through a multi-cloud BGP VPN into AWS.
Compliance work
SOC 2 control remediation and the tooling that supports it, and NIST 800-53 remediation on a government site for the US Department of Health and Human Services.
Developer tooling
Internal tools and automation that speed up daily engineering, and a maintainer stint on urfave/cli, a Go CLI framework with broad downstream use.

How an engagement is shaped

Contract shape
Every shape is open. Direct contracting through coilyco, consultancy, embedded delivery, staffing-agency W-2, contract-to-hire, and agency-mediated C2C all work. Use whichever one your procurement finds easiest.
Rate
$150 an hour. One rate covers every shape above, agency arrangements included, so the paperwork you prefer does not change the price.
Availability
I plan at about 70 percent utilisation rather than trying to fill every hour, so there is room for the work to overrun without the next thing suffering for it.
Where I am
East Bay, California. Remote works, and I can be in a Bay Area room when being in the room is the thing that moves it.

The specialism

Constrain what an agent can do, and prove what it did.

Agents are the newest consumer of the platform underneath them, and this is the layer I build for them. That's one offer with two proofs rather than two services: umbra bounds what an agent can do, and housecast checks what it did. Both ship, both are open source, and each has its own site with its own documentation, so you can decide whether an hour on a call is worth it before you spend the hour.

umbra
You gave an agent a shell. Now name every command it can run. umbra validates argv before execve, refuses any verb you did not grant, gates outbound HTTP requests too, appends every call to an audit log, and publishes an exit-code taxonomy that separates a policy refusal from a tool failure. MIT, on brew and scoop, Linux, macOS, and Windows.
housecast
You changed what a role is allowed to do. The evaluation that checked it did not notice. housecast is the grading half of an evaluation. You bring the cases and the runner, and it puts each answer in front of a person with its target beside it, then records the grade. Grading stays separate from running, so you can regrade a board without rerunning it, and a named grader list keeps the agent that wrote the cases from grading them. MIT, preview, Python.

Neither ships or calls a model of its own. They bound and record what an agent does, whatever is running underneath, so they carry no model-provenance question into a procurement review.

Setting either one up for your team is billed the same way, by the hour.

kai@coilyco.ai Read the resume

Tell me what your agents run.

Start with the command you would least want one of them to run.

A few lines is plenty.

Prefer to talk first? Book a $1 collab or consult call ↗

Chat

There's no mailing list. If you want to talk, join chat.coilyco.ai, my own Zulip, and message me directly. You don't need an invite.

Sign in with GitHub or Google. Email signup isn't open yet.

Once you're in, your messages come straight to me, and I usually answer within a few days. Members can't message each other, so nobody else can reach you there.

Join chat.coilyco.ai ↗

Privacy

Kai Ase Siren runs coilyco.ai. Write to kai@coilyco.ai about anything here.

To count visits, and to see which pages people read, where they arrive from, and which countries they are in, the server writes one line per request. The line holds the time, the page and query string, the page you came from, your browser's user agent, your country and network, and details of the response. It holds no IP address and no cookie. The site sets no cookies and runs no tracking script, and nothing you type in the form above reaches it.

The booking calendar is Calendly's, not this site's. It loads only when you open it, and from then on Calendly sets its own cookies, including for analytics and marketing, under its own privacy policy. If you would rather avoid that, book at calendly.com directly or write to kai@coilyco.ai.

The legal basis is legitimate interest, under Article 6(1)(f) of the GDPR. The raw logs sit in a private storage bucket at Amazon Web Services, which hosts the site, and are deleted after 30 days. I use them to count visits by page, country, and referrer, and any counts I keep hold no individual requests and stay on systems I run myself.

You can ask to see or delete data about you, or object to its use, and you can complain to your data protection authority. The logs hold no IP address, so I may not be able to tell which lines are yours, but write and I will check.

A Do Not Track signal changes nothing here, because there is no tracking to switch off. The log line is written for every request.