YSYash Shah

Lower ECAM · system pages

Hangar

Seven things I've built, drawn the way an aircraft draws its own systems: what goes in, what happens to it, and what comes out. Press a demo where there is one. Every figure on these pages comes from the project itself — its README, its benchmark run, or its package index — and says where.

STATUS

Fleet

Seven systems. Four are shipped and reachable; three are research you can read.

Select a system below, or press its ident on the control row
IDENTSYSTEMDOESSTATE
DOCROTdocrotFinds the lines in your docs that your code stopped supporting.PUBLISHED
SEAMSseamgraphMaps the string-typed joins where full-stack repos actually break.PUBLISHED
CTRACTrepo-contractMachine-checkable rules an AI coding agent has to pass before it edits.PUBLISHED
GUARDSecond OpinionListens to a suspicious call and interrupts the scam before the money moves.IN BUILD
SIGNALNSE / BSE strategy signalsRule-based Nifty 50 baskets, recomputed every weekday after the close.LIVE
VSRCHVector template matchingSwaps a pixel-by-pixel template scan for nearest-neighbour search over embeddings.RESEARCH
FORGEForgery detection frameworkFour independent tests on one document, fused into a verdict and a heatmap.RESEARCH
DOCROT

docrot

PUBLISHED

Finds the lines in your docs that your code stopped supporting.

docrot: how it worksProse files — README, docs and CLAUDE.md — feed a reference extractor that pulls out symbols, file paths and build targets. Each reference is checked twice: against the current tree by an AST resolver, and against git history for provenance. Every reference ends up resolved, skipped as unknown, or reported as a finding carrying the commit where the claim was written.DOC → CODE RESOLUTIONREADME.mddocs/*.mdCLAUDE.mdreference extractorsymbols · file pathsmake / tox / npm targetsAST resolverdoes it exist now?git historywritten when? broke when?resolvedunknownfindingprovenance on every findingwritten at 3faa4a8 (2024-02-14)and the commit where it brokeNO LLM IN THE LOOP — STATIC ANALYSIS AND GIT HISTORY ONLYUNKNOWN REFERENCES ARE SKIPPED, NOT GUESSED AT
$ docrotdocs/advanced/transports.md:178:53  PY003 error  `httpx.Mounts` is documented but has never existed    written at 3faa4a8 (2024-02-14)docrot: 187 references | 82 resolved | 85 unknown (skipped) | 1 findings (1 error)

Real output, quoted from the project's README — its first run against httpx.

Documentation rots quietly: a symbol is renamed, a path moves, a make target disappears, and the prose referencing it keeps claiming otherwise. Coding agents now read AGENTS.md and CLAUDE.md as ground truth on every run, so one stale path silently misdirects every session.

docrot resolves every reference in your prose against the codebase using static analysis and git history — no LLM anywhere in the loop — and reports what no longer resolves, with the commit where the claim was written and the commit where it broke.

PKG
PyPI · docrot 0.1.0source: pypi.org/project/docrot
PY
3.10+source: package metadata
LLM
none — deterministicsource: README
FIELD
found a documented class that has never existed, on its first run against httpx (~14k stars)source: the project's README
PRIOR
28.9% of the top-1000 GitHub projects document a code element that no longer existssource: DOCER, Empirical Software Engineering 2023 (arXiv 2212.01479), cited by the README
  • Python
  • AST analysis
  • git history
  • CLI
pypisource
SEAMS

seamgraph

PUBLISHED

Maps the string-typed joins where full-stack repos actually break.

seamgraph: how it worksSeven kinds of string-typed seam, each joining a call site in code to a declaration in config, templates, CI or settings: route, env var, template, URL name, task, script and setting. Indexed across twenty real open-source repositories: 118,520 files produce 25,690 anchors and 16,048 seams, answering a reference query with a median of 14.8 times less context than grepping and reading every match.STRING-TYPED SEAMS — THE JOINS NO COMPILER CHECKSCODE SIDECONFIG · INFRA · TEMPLATE SIDEROUTEfetch("/api/users/" + id)@app.get("/api/users/{user_id}")ENVprocess.env.STRIPE_KEY.env · compose · Dockerfile · CITMPLrender_template("checkout.html")templates/checkout.htmlURL{% url 'order-detail' %}path(…, name="order-detail")TASKsend_task("app.tasks.send_email")@shared_task(name=…)SCRIPTCI run: make buildMakefile target build:SETTINGsettings.STRIPE_API_KEYSTRIPE_API_KEY = … in settings.pyMEASURED OVER 20 REAL OSS REPOS118,520 FILES25,690 ANCHORS16,048 SEAMS14.8× LESS CONTEXT

The seven seam kinds, each one a string no compiler checks.

Every code-graph tool models code calling code: imports, symbols, call trees. But real breakages live in the seams between languages — a fetch path against a route decorator, an env var against a compose file, a template name against a file on disk. Those joins are strings, so no compiler checks them and no import graph sees them.

seamgraph indexes seven kinds of seam deterministically and serves them to agents over MCP, so "what references this route?" is one call instead of a grep-storm.

PKG
PyPI · seamgraph 0.1.0source: pypi.org/project/seamgraph
CORPUS
20 real OSS repos — saleor, redash, cal.com, dify, label-studio and moresource: BENCHMARKS.md
INDEX
118,520 files → 25,690 anchors → 16,048 seamssource: BENCHMARKS.md
KINDS
7 seam kinds; 242 seams corroborated by git co-changesource: BENCHMARKS.md
TOKENS
14.8× median reduction against grep-then-read-every-matchsource: scripts/measure_token_story.py, counted byte for byte
  • Python
  • MCP server
  • static indexing
  • git co-change
pypisourcebenchmarks
CTRACT

repo-contract

PUBLISHED

Machine-checkable rules an AI coding agent has to pass before it edits.

repo-contract: how it worksAn agent proposes a plan, which the plan gate checks before any file is touched — planned paths against safety boundaries, and scope against file-count limits. The agent then edits, and the diff gate checks the patch before it lands: forbidden imports, missing tests, undeclared dependencies and refactors spanning unrelated modules. Either gate can refuse, deterministically and with a reason.TWO GATES AROUND THE AGENTagent proposes a planPLAN GATE — before any file is touchedplanned paths vs safety boundaries · scope and file-count limitsagent edits the codeDIFF GATE — before the patch landsforbidden imports · missing testsundeclared dependencies · unrelated refactorsmergeREFUSEDwith a reasonyou can readTHE SAME VALIDATORS ARE EXPOSED TO AGENTS OVER MCP · 100% DETERMINISTIC

What the engine refuses, and at which gate.

Agents generate good edits and bad boundaries: they refactor adjacent subsystems, import a database handler into a view controller, change behaviour without touching a test, or wander into .env. Asking them to understand the architecture does not reliably stop any of it.

repo-contract takes the opposite approach — declare the negative constraints in YAML, validate the plan before the agent edits and the diff afterwards, and refuse deterministically with a reason a human can read.

PKG
PyPI · repo-contract 0.2.1source: pypi.org/project/repo-contract
PY
3.11+source: package metadata
GATES
plan (pre-edit) and diff (post-edit)source: README
CATCHES
forbidden imports · unsafe paths · missing tests · undeclared dependencies · unrelated refactorssource: README's feature list
ENGINE
100% deterministic, JSON-RPC outputsource: README
  • Python
  • YAML/TOML contracts
  • AST import resolution
  • MCP server
pypisource
GUARD

Second Opinion

IN BUILD

Listens to a suspicious call and interrupts the scam before the money moves.

Second Opinion: how it worksAudio from a speakerphone or a shared meeting tab is captured by an AudioWorklet as 16 kHz PCM and sent to Gemini Flash-Lite in eight-second slices, where a classifier looks for the coercion pattern rather than any particular script. A video frame is checked every fifteen seconds. A detection raises an alert carrying signals, quotes and a whisper, which the Case Agent turns into Firestore state: the session, a cool-off hold, and a drafted cybercrime complaint cited to official advisories, with a guardian console on a family member’s phone able to approve the hold.CALL GUARD — SIGNAL PATHspeakerphone / Meet tabframe check · every 15 sscreen-share coercionAudioWorklet16 kHz PCM, 8 s slicesGemini Flash-Litecoercion pattern, not scriptraise_alertsignals · quotes · whisperCase Agentfunction callingFirestoresession · alerts · holdguardian consoleapprove the holdcybercrime complaintdrafted, with citationsofficial advisoriescited in the reportNO SERVER — THE BROWSER TALKS TO GEMINI THROUGH FIREBASE AI LOGIC, ON THE FREE PLAN
Call Guard interrupts mid-call with the pattern it recognised.

Call Guard interrupts mid-call with the pattern it recognised.

Fake-police "digital arrest" scams work by isolating an older person and holding them on a call under manufactured authority. The decisive window is the few minutes before a transfer, and in that window the victim is alone.

Second Opinion listens on speakerphone, recognises the coercion pattern rather than any particular script, warns the person calmly in English or Hindi, pulls in a family guardian, asks for a cool-off hold, and drafts the cybercrime complaint. There is no server — the browser talks to Gemini through Firebase AI Logic on the free plan.

BUILT FOR
AI Builder Cup 2026, Google Cloud JAPAC — Social Goodsource: README
AUDIO
16 kHz PCM in 8-second slices to Gemini Flash-Litesource: README's architecture graph
VISION
a frame check every 15 seconds for screen-share coercionsource: README's architecture graph
LOSSES
India 2024 — ₹1,935 crore to digital-arrest scams across 1.23 lakh complaintssource: the project's Impact page (shared/stats.json)
LOSSES
Japan 2025 — ¥142.3B to special fraud; people aged 65+ bore 59.2% of lossessource: the project's Impact page (shared/stats.json)
  • Gemini 3.8 Flash
  • Firebase AI Logic
  • AudioWorklet
  • Firestore
  • App Check
source
SIGNAL

NSE / BSE strategy signals

LIVE

Rule-based Nifty 50 baskets, recomputed every weekday after the close.

NSE / BSE strategy signals: how it worksA scheduled GitHub Actions run at 19:00 IST each weekday, or a manual run, executes the signal engine and publishes a static site to GitHub Pages — there is no server. Six sleeves feed it: four monthly rank-based baskets and two event sleeves, merged into one combined portfolio with a capital calculator. The project states plainly that this is not investment advice: Sharpe around 0.5 to 0.8 with drawdowns of 30 to 50 percent.WEEKDAY CYCLEcron · 19:00 IST, weekdaysmanual runGitHub Actionsbuild_site.pyengine + market datastatic site on Pagesno server to runNSE / BSE price toggleSIX SLEEVESchampion blendlow-vol + reversalmomentum + crash guardvolume-weightedvolume spike + inside daydeep-oversold RSIFOUR MONTHLY RANK-BASED BASKETS · TWO EVENT SLEEVEScombined portfolio + capital calculatorNOT INVESTMENT ADVICESharpe ~0.5–0.8 · DD 30–50%

The live site, embedded. Nothing loads until you press it.

A backtesting study over 107,000+ strategy configurations, survivorship-corrected and replicated across independent data, left a handful of rules standing. This publishes what those surviving rules say today.

GitHub Pages only serves static files, so the computation runs in GitHub Actions at 19:00 IST each weekday and the site displays its latest result. The panel below is that site, live.

STUDY
107k+ configurations, survivorship-corrected, replicated on independent datasource: README
SLEEVES
6 — four monthly rank-based baskets, two event sleevessource: README's view table
CYCLE
regenerates 19:00 IST every weekday, and on demandsource: .github/workflows/pages.yml
CAUTION
Not investment advice. The honest point-in-time edge is modest — Sharpe ~0.5–0.8, drawdowns of 30–50% — and past results don't predict future returns.source: the project's own README disclaimer
  • Python
  • GitHub Actions
  • static site
  • Flask (local)
open the live sitesource
VSRCH

Vector template matching

RESEARCH

Swaps a pixel-by-pixel template scan for nearest-neighbour search over embeddings.

Vector template matching: how it worksA query image is encoded by ResNet-101 into feature maps, flattened to a vector, and matched in Qdrant, which returns the ten nearest templates. The lower panel is a schematic of why: a pixel-by-pixel scan does work proportional to the number of templates, while an embedding lookup stays close to flat as the set grows. It shows the shape of the two curves, not measured timings.QUERY PATHquery imageResNet-101feature mapsvectorone per templateQdrantnearest neighbourstop 10 matchesWORK PER QUERY AS THE TEMPLATE SET GROWSpixel-by-pixel: every template, every queryembedding + nearest-neighbour lookupworktemplates →SHAPE, NOT MEASUREMENTS

Where the cost goes when the template set grows.

Comparing a query image against a template set pixel by pixel costs more with every template you add. Encoding each template once as a feature-map embedding turns the same question into a nearest-neighbour lookup, which barely notices how large the set has grown.

ResNet-101 extracts the feature maps, they go into Qdrant as vectors, and a query returns its ten closest matches.

ENCODER
ResNet-101 feature maps → vectorssource: README
INDEX
Qdrant vector search enginesource: README
QUERY
returns the top 10 most similar imagessource: README
  • ResNet-101
  • Qdrant
  • vector search
  • PyTorch
source
FORGE

Forgery detection framework

RESEARCH

Four independent tests on one document, fused into a verdict and a heatmap.

Forgery detection framework: how it worksOne document is put through four unrelated tests at once: metadata analysis of ISO value and timestamps, weighted ten out of a hundred; Error Level Analysis through a CNN initialised with SRM high-pass filters acting as a dense patch descriptor; a two-stream RGB and DCT analyser that catches double compression and produces a pixel heatmap; and SSIM template matching against a ground truth that boxes what was added or removed. Their features are fused into a single real-or-fake verdict with a confidence.FOUR TESTS, ONE VERDICTdocument under testmetadataISO · timestampsweighted 10/100Error Level AnalysisSRM high-pass CNNdense patch descriptorRGB + DCT streamsdouble compressionpixel heatmapSSIMvs ground truthboxes what movedfeature fusion → real / fake, with a confidencemanipulation heatmap+ bounding boxesNO SINGLE SIGNAL IS TRUSTED — EACH TEST FAILS DIFFERENTLY

Four tests, four failure modes, one fused score.

No single signal catches a forged document: metadata can be stripped, compression artifacts can be hidden, and a clean-looking crop can still be missing a clause. So this runs four unrelated tests and fuses them.

Metadata analysis, Error Level Analysis through a CNN with SRM-initialised high-pass filters, a two-stream RGB + DCT analyser that outputs a manipulation heatmap, and SSIM template matching against a ground truth to box what was added or removed.

STAGE 1
metadata — ISO value, creation against modified timestamps (weighted 10/100)source: README
STAGE 2
ELA — an SRM-initialised CNN as a dense patch descriptor, with feature fusionsource: README
STAGE 3
RGB + DCT two-stream analyser → manipulation heatmap, catches double compressionsource: README
STAGE 4
SSIM against ground truth → bounding boxes on what changedsource: README
  • CNN
  • SRM high-pass filters
  • DCT / Fourier analysis
  • SSIM
read the case studysource

Everything else — coursework, experiments and older notebooks — is on GitHub.