coilyco
coilyco

Your agent is about to run a command.

A coding agent's terminal. It has typed a git commit that skips the repository's checks, and has not run it yet.

Which command, and who said it could? I'm Kai Ase Siren, and coilyco is my harness engineering practice. I build and maintain the harness around the coding agents your engineers already run: what they may run, and how a person checks what they did. It sits on more than ten years of infrastructure, Kubernetes, and observability work.

kai@coilyco.ai How an engagement is shaped

Start where you sit.

01 // umbra

The command is checked before it starts.

umbra reads a spec you commit beside your code. It names each verb an agent may run and each flag that verb may take. Anything else is refused before a process exists. Arguments are checked too, so an allowed verb cannot carry a pipe into a shell.

umbra ↗ MIT, on brew and scoop.

umbra refuses the commit because the skip-checks flag is denied, exits with code 2, and writes the refusal to its audit log.

wrap ward git {
    exec git
    can run commit { deny-flag "--no-verify" }
    never run "reflog expire"
}
The refusal text and log format are umbra's own. This session is a sample, and the log line is shortened.

The agent can still commit. It cannot skip the checks to do it. Every refusal lands in the same log as every command that ran.

02 // housecast

Last week, this agent could not touch dependencies.

Here is the commit that changed that. The role and the case that tests it changed together, in your repo. The agent answers the new case, and housecast puts that answer in front of a person, with the target beside it. Name who may grade, and the agent that wrote the case cannot grade its own answer.

housecast ↗ MIT, in preview.

One commit edits two files. The role gains permission to change its own site's dependencies, and the test case changes from adding a toggle to removing an unused package.

Shortened from a real role change. Your repo holds the cases, and housecast grades the answers.
housecast's grading page for one evaluation case. The header reads in pass, out pass, and the boundary holds. Two answers sit side by side, labelled IN and OUT, each with its prompt, its target, and the agent's answer, and both are graded pass. A side rail shows 105 of 105 scorable answers graded, and a map of passing and failing cells for each agent role. housecast's grading page, cropped to one evaluation case. The header reads in pass, out pass, and the boundary holds. Below it, the IN half shows the prompt, the target, and the agent's answer, graded pass.
A real run on housecast's grading page. A model wrote the answers, and I graded them.

This is the layer I build for your team.

One agent, one command, one role change. Your team has more of each. I set up umbra and housecast for you, and the platform work underneath them. Neither tool ships or calls a model of its own, so neither adds a model-provenance question to your procurement review.

Hire me

Two ways to work together

  • Hourly

    Harness and platform engineering by the hour

    I build and maintain the harness around a model you host yourself, or around Claude Code, Codex, goose, or opencode, on the system you already have, and keep it working as those tools change every month. $150 an hour, the same rate whichever contract shape your procurement prefers. That covers eval harnesses that catch an agent regression before a user does, setting up umbra or housecast for your team, and the platform work underneath: infrastructure as code, Kubernetes, observability, and networking across clouds.

    See how an engagement is shaped →

  • $1

    Collab or consult call

    Talk it through before you join a team or have someone join yours. About umbra, housecast, or the agent you're shipping. The $1 keeps the calendar for people who mean it.

    Open the booking calendar (loads Calendly)

Contracting

This is the detail behind the hourly rate. The work I take on is harness engineering, the layer around the coding agents your team already runs. The platform engineering underneath is the ten years that make the harness hold.

The work

Platform engineering, more than ten years of it.

Each entry below is work I have already done in production. The resume is the full record, with where and when.

Agent infrastructure
Built and maintained the entire MCP stack at a company.
Infrastructure as code
Terraform, CloudFormation, Pulumi, and Ansible across AWS, GCP, and Azure. I have brought deployment tooling that had fallen behind back to current standards, and moved internal systems onto production-grade managed services.
Kubernetes and containers
Services on Kubernetes, container platforms on AWS ECS, and the Docker work underneath both. Most recently that included making a Dockerized Python service start about twice as fast.
Observability
OpenTelemetry, Datadog, Prometheus, Grafana, and New Relic. I have migrated a company's monitoring onto a customized Datadog and Fluent Bit system.
Networking across clouds
Azure OpenAI deployed through a multi-cloud BGP VPN into AWS.
Developer tooling
Internal tools and automation that speed up daily engineering, and a maintainer stint on urfave/cli, a Go CLI framework with broad downstream use.

How an engagement is shaped

Contract shape
Three shapes are open: direct contracting through coilyco, consultancy, and embedded delivery. Use whichever one your procurement finds easiest.
Rate
$150 an hour. One rate covers all three shapes, so the paperwork you prefer does not change the price.
Availability
coilyco runs alongside a full-time role, so I take a small number of engagements and scope each one to fit.
Where I am
East Bay, California. Remote works.

The specialism

A harness is everything around the model: what the agent may run, and how you check what it did. umbra bounds what an agent can do, and housecast checks what it did.

Agents are the newest consumer of the platform underneath them, and this is the layer I build for them. That's one offer with two proofs rather than two services: umbra bounds what an agent can do, and housecast checks what it did. Both ship, both are open source, and each has its own site with its own documentation, so you can decide whether an hour on a call is worth it before you spend the hour.

umbra
You gave an agent a shell. Now name every command it can run. umbra validates argv before execve, refuses any verb you did not grant, gates outbound HTTP requests too, appends every call to an audit log, and publishes an exit-code taxonomy that separates a policy refusal from a tool failure. MIT, on brew and scoop, Linux, macOS, and Windows.
housecast
You changed what a role is allowed to do. The evaluation that checked it did not notice. housecast is the grading half of an evaluation. You bring the cases and the runner, and it puts each answer in front of a person with its target beside it, then records the grade. Grading stays separate from running, so you can regrade a board without rerunning it, and a named grader list keeps the agent that wrote the cases from grading them. MIT, preview, Python.

Neither ships or calls a model of its own. They bound and record what an agent does, whatever is running underneath, so they carry no model-provenance question into a procurement review.

Setting either one up for your team is billed the same way, by the hour.

kai@coilyco.ai Read the resume

Tell me what your agents run.

Start with the command you would least want one of them to run.

A few lines is plenty.

Prefer to talk first? Book a $1 collab or consult call ↗

Privacy

Kai Ase Siren runs coilyco.ai. Write to kai@coilyco.ai about anything here.

To count visits, and to see which pages people read, where they arrive from, and which countries they are in, the server writes one line per request. The line holds the time, the page and query string, the page you came from, your browser's user agent, your country and network, and details of the response. It holds no IP address and no cookie. The site sets no cookies and runs no tracking script, and nothing you type in the form above reaches it.

The booking calendar is Calendly's, not this site's. It loads only when you open it, and from then on Calendly sets its own cookies, including for analytics and marketing, under its own privacy policy. If you would rather avoid that, book at calendly.com directly or write to kai@coilyco.ai.

The legal basis is legitimate interest, under Article 6(1)(f) of the GDPR. The raw logs sit in a private storage bucket at Amazon Web Services, which hosts the site, and are deleted after 30 days. I use them to count visits by page, country, and referrer, and any counts I keep hold no individual requests and stay on systems I run myself.

You can ask to see or delete data about you, or object to its use, and you can complain to your data protection authority. The logs hold no IP address, so I may not be able to tell which lines are yours, but write and I will check.

A Do Not Track signal changes nothing here, because there is no tracking to switch off. The log line is written for every request.