I build in public and care about work that is readable, testable, and easy to trust.

This account is my GitHub lab: small repos, clean docs, checked-in proof, and practical assisted-coding workflows that stay grounded in real tests instead of big promises.

Right now the main public signal is simple: keep the lab Rust-first, keep the checks honest, and remove stale work instead of letting it blur the picture.

• test-project-tbd - a small Rust practice repo with CI, a Rust-native repository doctor, pinned workflow actions, secret/evidence guardrails, issue templates, and public repo hygiene.
• Open-source pull requests - scoped patches, green checks, and proof-first descriptions.
• This profile - the home base for current experiments, cleanup work, and public learning.

• clear first pages that make a repo easy to trust;
• boring public hygiene in the repos that need it: licenses, security notes, support paths, issue templates, and CI;
• guardrails that fail closed before secrets, private files, or sloppy workflows become public history;
• small patches with proof, not giant mystery drops;
• writing that feels human and useful;
• learning fast without making the workspace messy.

test-project-tbd is my public practice repo.

It is deliberately small: a Rust starter, GitHub Actions checks, issue templates, repo policy files, a Rust-native repository doctor, and documentation for how the project is organized. The point is not to look huge. The point is to make the basics clean enough that someone can open it and understand what is going on.

Twenty-three external pull requests have now merged across seven open-source projects:

• landing a merged documentation and accessibility-guidance pass for make-interfaces-feel-better (jakubkrehel/make-interfaces-feel-better#1), covering Codex installation, font-family scope, context-specific hit areas, and a machine-detectable MIT license;
• landing approved and merged GoalBuddy Codex-runtime patches: #28, #29, and #30;
• landing a merged GoalBuddy local-board rendering fix for multiple active tasks (tolibear/goalbuddy#34);
• landing a merged liteparse batch-output directory fix (run-llama/liteparse#313);
• landing a merged Snapzy macOS patch for Quick Access dismiss lag (duongductrong/Snapzy#256), included before the v1.23.0 release line;
• landing three approved and merged Markdown Preview improvements: Quick Look asset containment (pluk-inc/markdown-preview#152) and native trackpad pinch zoom (pluk-inc/markdown-preview#156), both included in release 0.0.29, plus reliable full-document selection in long edit-mode files and standard Shift-selection in read mode (pluk-inc/markdown-preview#185), credited in release 0.0.34;
• landing a merged Impeccable live-mode toast race fix (pbakaus/impeccable#271);
• shipping the Apple Mail MCP v2.8.10 hardening pass (sweetrb/apple-mail-mcp#97), covering account-bound IMAP operations, SMTP sender allowlisting, bounded inline attachments, and canonicalized attachment-save containment; the owner verified 392 unit tests, 47 integration tests, and a reproducible bundle before publishing release v2.8.10;
• completing Apple Mail MCP's dev-only brace-expansion remediation in two evidence-backed steps: API-compatible v1 hardening (sweetrb/apple-mail-mcp#119) without suppressing the advisory or forcing an incompatible major version through ESLint's dependency path, followed by the complete v1/v5 sequence bounds after the repository's supply-chain age gate (sweetrb/apple-mail-mcp#123); the owner credited the 10,000-zero reproduction as decisive proof, added an independent v5 floor, and explicitly credited the original finding while porting it to Apple Notes #113, Apple Numbers #49, and Apple Photos #60. The credit now appears in all four repositories' changelogs, and the downstream fix has shipped in Apple Numbers v1.1.12 and Apple Photos v2.1.6;
• merging nine August 14 Apple Mail MCP hardening and assurance contributions: the repository threat model (#158), atomic numeric batch scope (#159), ambiguous-message rejection (#160), fail-closed attachment overwrites (#161), bounded IMAP attachment fetches (#162), disabled-by-default new mail rules (#164), the Codex MCP runtime pin (#166), constrained outbound attachment reads (#168), and shared validation schemas (#169); the merged work is now in upstream main and release v2.10.31;
• making the profile itself a useful entry point instead of a billboard;
• keeping the main lab Rust-first instead of accidentally letting helper code define the repo;
• tightening repository structure checks, secret/evidence guardrails, and cleanup habits;
• keeping CI simple, pinned, and honest;
• documenting local setup and GitHub workflow habits;
• using assisted coding tools while keeping authorship, review, and verification explicit.

As of August 14, 2026, five authored external pull requests are open and tracked against their live upstream state. No authored Apple Mail MCP PRs remain open. The August batch is resolved as follows: #158, #159, #160, #161, #162, #164, #166, #168, and #169 merged upstream; #163, #165, and #167 closed without merge. #163 retained the deliberate documented empty-Trash expunge behavior; #165 was superseded by maintainer #171; and #167 was superseded by maintainer #170. They are not presented as open, pending, or maintainer-approved work. Upstream is at 3dee1ed89c27b968795fbbb9740d365ea06e255a and release v2.10.31 points to that revision. The current separate external upstream PR #174 is blocked by action_required with no check runs and is not authored work.

The remaining five external pull requests are:

• preventing a native macOS Transmission quit hang by moving blocking UPnP gateway validation off the session thread; the August 2 revision is rebased, narrowed to the single UPnP source file, and validated by 583 tests plus a universal arm64/x86_64 macOS build (transmission/transmission#8984);
• correcting IINA's Open URL failure message, playlist-relative paths, and plugin default-branch update checks (#6189, #6190, and #6191);
• extending Daytona's Sapat provider guide with current registry architecture, validation, and security boundaries (daytonaio/content#181).

I also keep evidence-bounded product reports current instead of treating issue filing as the finish line. As of August 14, three Codex reports remain open after focused July 22 routing requests to maintainers with demonstrated subsystem ownership:

• ChatGPT Desktop resetting the bundled Computer Use MCP server to disabled while the plugin remains enabled (openai/codex#34807);
• a completed Codex Security scan becoming impossible to close after its app-managed temporary artifacts disappear (openai/codex#33994);
• the official LinkedIn connector returning an upstream 403 IP not authorized and then masking it with a template-loading failure (openai/codex#33951);

The former mobile Remote Control report (openai/codex#22773) was closed as not planned on August 6, 2026 and is no longer counted as open.

None has received a maintainer response. The profile records that verified state and does not present routing requests as acknowledgements or fixes.

• I keep changes small enough to review.
• I run the checks that prove the claim.
• I would rather delete stale work than let it rot.
• I like clear docs, plain language, and boring reliability.

I like practical builders, careful reviewers, and people who enjoy turning messy first drafts into something shippable.

The best starting point is this GitHub profile: github.com/jjoanna2-debug. If the work here feels aligned, say hi through the contact path where you found me.