Wardline

An embeddable guardrail evaluation library for Rust

open source · pre-alpha · Apache-2.0 / MIT · Aug 2026 — building

• ›Guards run inline in the request path — before an action is taken or an LLM response is released — and return a blocking verdict: allow, block, or modify.
• ›A library you call in-process, not a proxy you deploy: no separate service, no network hop, no async runtime.
• ›Guards are ordinary Rust implementing one trait, rather than entries in a YAML DSL, so a guard is testable like any other code.
• ›Fully synchronous by design — the core and built-in guards depend on nothing but std; the optional axum middleware is the single sanctioned async boundary.
• ›Four-crate workspace: core pipeline with panic isolation and a bounded audit trace, reference guards, an HTTP adapter, and an LLM wrapper.

Prompt Enhancement Engine

ISTVON framework — a security broker for LLM prompts

• ›Streamlit AI security engine that analyzes, enhances, and secures LLM prompts before they reach a model.
• ›Dual-layer security broker combining regex screening with metaprompts to block injection attacks and semantic threats.
• ›ISTVON JSON framework structures and sanitizes unstructured text, isolating malicious payloads.
• ›Audit trail plus unit-testing suite logs verdicts and keeps threat detection high-fidelity.

Automated Vendor Risk Assessor

Hierarchical multi-agent pipeline for third-party cyber risk

Kaggle Agentic AI Competition · Jun 2026

• ›Hierarchical agent pipeline on the Google Agent Development Kit: CVE and OSINT research agents run in parallel and feed a narrative synthesis agent.
• ›All external capabilities exposed through a Model Context Protocol tool server (FastMCP) over NIST NVD and web-search backends.
• ›Risk score computed deterministically in Python — the LLM writes prose, never the number.
• ›Interchangeable LLM back-ends per entry point via a model factory: Ollama locally for CLI, Gemini and Hugging Face for web, wrapped in LiteLLM.
• ›Ships both a FastAPI dashboard with SSE job streaming and a rich CLI, containerized with Docker Compose.

Telecom SOC Simulation

DFIR automation with RAG-backed ATT&CK mapping

• ›Python DFIR pipeline automating ETL and threat detection via MDE Investigation Packages.
• ›AutoAI for predictive threat scoring; LLMs for automated, structured incident reporting.
• ›RAG architecture maps simulated attack patterns directly onto the MITRE ATT&CK framework.
• ›Automated log parsing and visualization to cut manual investigation overhead.

Adaptive Triage Engine

Contextual-bandit RL for SOC alert prioritization

• ›Incident triage agent that optimizes response workflows and accelerates escalations.
• ›Contextual Bandit (RL) policy scores and triages alerts dynamically from forensic feature data.
• ›Data pipelines ingest, normalize, and parse raw security logs into structured real-time telemetry.
• ›Policy stability evaluated with reward distributions, confusion matrices, and precision-recall trade-offs.

roostorg/osprey — OSS Contribution

Fixed the Windows checkout path for Roost's safety rules engine

PR #451 · merged upstream · Aug 2026

• ›Osprey is Roost's high-performance trust & safety rules engine for real-time event processing at scale.
• ›Diagnosed why `docker compose up` failed on Windows: with Git's default `core.autocrlf=true`, `*.sh` files check out with CRLF, turning the shebang into `#!/bin/bash\r` and failing with a misleading `no such file or directory`.
• ›Traced the gap to enforcement timing — the repo's pre-commit hook fixes line endings at commit time, but nothing enforced LF at checkout time.
• ›Verified the blobs already stored LF (`git show HEAD:entrypoint.sh | od -c`), so a `.gitattributes` policy was the complete fix with zero content churn.
• ›Two added lines, merged upstream, unblocking the stock onboarding path for every Windows contributor.

Satellite Land-Use Classification

Three CNN architectures benchmarked on EuroSAT imagery

2026

• ›Land-use classification over EuroSAT satellite imagery, built as a head-to-head comparison rather than a single model.
• ›Custom CNN with Swish activation trained from scratch as the baseline.
• ›ResNet50 and VGG16 fine-tuned via transfer learning and evaluated against that baseline.
• ›Streamlit app wraps the trained models for interactive single-image inference.

Educational Feedback System

NLP analysis of student writing and code, with actionable feedback

2025

• ›Streamlit application that scores text and code, then explains what to fix rather than only grading it.
• ›Sentiment via both VADER and RoBERTa, plus Flesch/Kincaid readability, vocabulary richness, and structure metrics.
• ›Grammar and style checks for run-on sentences, passive voice, and weak words; subject-specific misconception detection.
• ›Python code path checks syntax, logic, efficiency, and PEP 8 compliance with improvement suggestions.
• ›Batch mode compares multiple submissions with Plotly visualizations and session-tracked history.

Retail Analytics Dashboard

Market basket analysis and RFM segmentation over a year of transactions

2025

• ›Interactive dashboard over the UCI Online Retail dataset — a year of transactions from a UK non-store retailer.
• ›Apriori association rules surface item combinations that co-occur, driving product recommendations.
• ›RFM analysis segments customers by recency, frequency, and monetary value to target promotional strategy.
• ›Country-level revenue, product, and customer performance drillable at monthly, weekly, and daily granularity.

Multi-Client Group Chat

Low-latency messaging over raw TCP/IP sockets

• ›Real-time messaging platform built on Java socket programming for low-latency communication.
• ›Multi-threaded server handles concurrent client connections with synchronized broadcasting.
• ›Asynchronous Swing/AWT GUI keeps chat sessions dynamic and lag-free.