I build infrastructure for the agent economy — payment rails, service discovery, identity attestations, and audit trails for autonomous agents transacting with real money. Built with my cofounder, Monserrat Mendoza — UX/UI across every project below, and backend dev too: five merged PRs in Nirium, plus real fixes she's now shipped directly in Kumply and Vouch402 as well — full detail on her own profile.

Six projects, four chains, each for a specific reason:

Each one stays where it started until real demand justifies expanding it elsewhere. Contextio's mainnet is deliberately narrower than its testnet build, and Prova hasn't gone to mainnet at all yet — still Solana devnet only. Same reason for both: gated on evidence, not on a roadmap slide. If that expansion ever happens, the preference is to stay inside these same four networks first — where the tooling, the relationships, and the compliance homework are already done — over opening a fifth network cold. That's a stated preference, gated on both real demand and actual strategic fit, not a promise of when or whether it happens.

Most of my public work is either a protocol implementation I maintain or a bug I found in something I depend on and then sent a patch for. Everything below links to the actual issue, PR, or running service — no claim here that you can't click and check yourself. Where something is still open or unmerged, it's marked as such, not implied to be done.

I write it this dense on purpose. Every project below moves someone else's funds or blocks their transaction, so I'd rather you check the receipts than take my word for anything. If a claim here can't be clicked and verified, it doesn't belong here.

Skip the rest if you only have 90 seconds — this is the material that actually matters, each one a link, not a claim:

• Found and fixed a crash in x402's own official conformance suite, merged upstream the same week — x402-foundation/x402#3228.
• A skill PR survived ~16 real review rounds across 21 days before merging — stellar/stellar-dev-skill#97 — because I kept addressing feedback instead of abandoning it.
• When I was wrong, I said so and closed my own issue against myself: OpenZeppelin/stellar-contracts#839 turned out to be a construction bug in my own code, not a library gap — confirmed with the maintainer's help, not asserted.
• Kumply's compliance contracts are live and verified on Avalanche, Fuji testnet and mainnet C-Chain read-only beta — AttestationStore on Snowtrace, source at kumplyprotocol/Kumply — the one non-Stellar project in this profile with its own paper trail.
• Found a real security vulnerability in the exact library Vouch402 depends on for every attestation it emits — ethereum-attestation-service/eas-sdk#132: getUIDsFromAttestReceipt trusted a log's topic0 without checking the emitter address, letting a malicious resolver inject spoofed UIDs into a multiAttest() batch. Closed as completed by the maintainer (@lbeder) 2026-08-27, fixed in eas-sdk 2.10.0 — I verified the fix against that release myself before treating it as closed.
• A 32-day mainnet outage on a facilitator four other integrators also depend on got fixed, and I verified it myself before saying so — OpenZeppelin/relayer-plugin-x402-facilitator#47: a stale RPC URL on OZ's hosted pubnet facilitator silently broke sponsored x402 payments from ~2026-08-10 to 2026-09-11. Confirmed the fix with a real $0.05 mainnet payment, not just a 200 response — tx bf9a1ca6... on Horizon, successful: true, ledger 64382007. Also got two account addresses backwards in my first write-up and posted a public correction the same day instead of leaving it wrong.
• Real, currently active roles across all three ecosystems this portfolio touches beyond Stellar-native work — official Team1 LatAm collaborator (Avalanche, ecosystem-wide, not tied to Kumply specifically) and Based Developer Ambassador (Base, a real Discord role, not an application in progress) — plus the Starmaker Stellar Ambassador credential below that the Instawards themselves depend on. None of these are pending.
• Every contract I ship is non-custodial by construction — the client's own wallet signs, or a role that by contract design cannot move funds, never a key of mine that can. Detail and a real example under "How I work" below.
• 981 commits across these seven repos over 219 straight days (1 Feb – 8 Sep 2026), pulled from git log, not typed in: 20.8% of them land on a weekend, 12.1% between 10pm and 6am local time. There's a real gap from 3am–6am — not claiming literal around-the-clock, the data just doesn't say that.
• Two Stellar Community Fund Instawards, both delivered against real milestones, not just awarded — the track record the rest of this profile's execution claims actually rest on. These exist because of a real credential, not luck: Instawards require active participation in a local Stellar Ambassador Chapter — that's the program's own stated eligibility rule, not something I'm claiming on my own. I'm a Starmaker Stellar Ambassador; the program was recently restructured and tier confirmations are still going out, so I'm not citing a specific level until that settles.
• 3 hackathon wins outside this six-project portfolio, each with a public tweet confirming it — ActivaChain (ETH Uruguay 2025, with Monserrat), CreatorChain (1st + 3rd place, ETH Mexico Monterrey 2025), and BioShield Insurance (FDA Track, DeSci Builders Hackathon 2025, also with Monserrat). Full detail and links near the bottom.

Rendered live from the GitHub API by github-stats-extended — not typed in, moves on its own (checked live 2026-09-05, still serving).

Kumply, Vouch402, and Prova each stand on their own, one project per chain. Periplo, Nirium, and Contextio are three separate Stellar products, not three names for one thing — but they share real upstream dependencies (same protocols, sometimes the literal same bug), so the contribution tables further down attribute each fix to the specific project it came from instead of merging them into one undifferentiated pile. If a note says "this one's Nirium's, not Periplo's," that's the reason.

Kumply (Avalanche) — three open bug reports against a third-party community skills repo, Ayomisco/avaxskills, found while building on top of it: #2 (a subnet-deployment skill cites CLI commands that don't exist in the real ava-labs/avalanche-cli), #3 (a precompiles skill has the wrong genesis key name for TxAllowList), #4 (a wagmi skill cites an outdated version and a deprecated hook). All still open. I'm an official Team1 LatAm collaborator — an Avalanche-ecosystem-wide role, not something tied to a single project — which is why KUMPLY's application to Team1 Mini Grants went in through a real channel, not cold. Applied, decision still pending; not claiming an award that hasn't happened. Also shipped AgentHub Protocol for Avalanche's Hack2Build: Payments x402 hackathon — real x402 micropayment code (client, facilitator, middleware), on-chain agent reputation (the AgentRegistry contract's own docstring calls it "ERC-8004 compliant"), and real DeFi integration code for Trader Joe, Benqi, and Aave V3. SDK published on npm, contracts deployed to Fuji testnet — and dormant since January 2026, stated plainly rather than presented as active alongside Kumply. Its original hackathon description also claimed ERC-4337 smart accounts; no account-abstraction dependency or file exists anywhere in the repo, so that specific claim is dropped here rather than repeated unverified.

Vouch402 (Base) — base/skills#152, an open PR adding a Vouch402 plugin listing to Base's own community skills catalog, same genre as the stellar-dev-skill PRs below. Also eas-sdk#132 (closed, fixed — detail below) and foundry-rs/foundry#16209 (cast wallet new <name> failed with a bare account name — closed 2026-09-09, fixed by @riba2534 in #16219), both found auditing tooling Vouch402 depends on. Both KUMPLY and Vouch402 are currently in active review — Avalanche's Team1 Mini Grants and Base Batches respectively — decisions still pending on both, not claimed as awards here. Separately, I hold the Based Developer Ambassador role in Base's own Discord — a real, currently active role, not an application in progress.

Prova (Solana) — otter-sec/anchor#4960, an open PR bumping heck 0.3 → 0.5 to drop an unbounded edition2024 dependency landmine in the Anchor framework Prova's on-chain program is built on. Not merged yet. Separately, applied for a Superteam/Solana Foundation scholarship (flights, stay, event access, mentor access) to attend Breakpoint 2026 — decision pending, not claimed as confirmed attendance.

Snapshot below is a live re-check as of 2026-09-11; the search links at the bottom always supersede it. Full first-hand narrative with transaction hashes and reproduction steps lives in Eras256/Periplo's own README.

Separately, weighed in on x402#3134 — a PR by @Iam0TI defining the upto scheme for Stellar, where an independent implementor (@davedumto) asked whether a new convergence document (crediting rail402, this PR, #3098, Rialto, openx402, and LumenGate) should land as its own file, as edits inside #3134, or not at all. Recommended folding it into #3134 instead of fragmenting — same consolidation logic already used for UPTO-CONVERGENCE.md here — and added the concrete case for why scheme: "upto" alone won't distinguish contract vs smartAccount profiles once both exist on the same network.

• x402#3171 — paymentRequirementsMatchAccepted threw on a missing/null payload.accepted. I found and reported it; the code fix was written by @JasonColapietro in #3180, merged 2026-08-17. The merged patch is his work, not mine — my part was the report.
• x402#3169 — isValidRouteTemplate's traversal/scheme-injection checks decoded routeTemplate only once, so double percent-encoding bypassed both. I filed it 2026-08-15 with a full repro; fixed by @ygd58 in #3213, merged 2026-09-09. A duplicate attempt at the same fix, #3422, was closed in favor of #3213. Not my patch — my part was the report and the nudge.
• x402#3270 — HTTPFacilitatorClient.settle()/verify() decoded the EXTENSION-RESPONSES header and then discarded it. I fixed this on Periplo's own side the same day rather than waiting on upstream. Closed 2026-08-31 — not the way it first looked like it would close. The actual fix was the maintainer's own separate PR, #3306 (Python, @phdargen), introducing a dedicated extension_responses/extensionResponses field instead of reusing extensions — explicitly rejecting that shape (which my own workaround used, and so did the two community PRs this finding first prompted) as leaking a server-only sidechannel into buyer-facing data. #3278 (TypeScript, @Bartok9) was revised to match before merging separately; #3301 (Go, @wnjoon) and PhilBot402/x402#4 (Python, draft) remain open, likely needing the same adjustment. My own /settle still uses the old shape — migrating once @x402/core actually ships the new field (not yet: latest is still 2.24.0, predating this fix).
• eas-sdk#132 — getUIDsFromAttestReceipt trusted log topic0 without checking the emitter address, found while auditing the library Vouch402 calls for every attestation it emits. Vouch402 itself isn't affected (no resolver, no multiAttest() calls) — a library-level finding, not a gap in that project. Closed as completed by the maintainer 2026-08-27, fixed in eas-sdk 2.10.0.
• OpenZeppelin/stellar-contracts#839 — hit UnreachableCodeReached combining Signer::Delegated with a CallContract rule, and opened this not sure yet whether it was our construction or a real library gap. Closed 2026-09-02, resolution: ours. With help from the maintainer (@brozorec) clarifying execute()'s self-authorization is meant only for self-admin operations, hand-constructing both auth entries (the smart account's own plus the delegate's) authorizes and confirms correctly on-chain — no library fix needed, the trap was in how we were building the auth entry, not the library.

x402-foundation/x402 — #3121, #3148; stellar/js-stellar-sdk — #1681, #1683.

This is Nirium's own repo, so these are bounties Nirium posted, not upstream contributions Nirium made elsewhere. Full live audit as of 2026-09-05: 44 issues across three campaigns, 42 real bounty asks (2 unlabeled resource suggestions aren't bounties) — 20 delivered inside nirium itself, 2 delivered externally and still awaiting that project's own review, 4 closed and administratively recreated under a later campaign, 16 closed without delivery.

Contextio moved from a personal repo (Eras256/Contextio) to its own org, contextio — Eras256/Contextio now resolves to contextio/Contextio. The planner logic behind its treasury/payroll rebalance decisions was extracted into a separate private repo, contextio/contextio-agent-planner, consumed by the main repo as a private git dependency.

Contextio also runs a bounty-style program, though not GrantFox-labeled like Nirium's: five open issues in contextio/Contextio, all opened by this account, none delivered yet — two already have competing external PRs open and unreviewed.

Upstream, to stellar/stellar-dev-skill (not owned by Contextio): three merged PRs adding and refining the Contextio SDK's community-skill listing — #98, #101, and #102, all merged 2026-08-15.

Beyond that, I found no upstream contribution from this account to any other external repo specifically for Contextio. Said plainly rather than padded: Contextio's public footprint on this account is its own repo plus that one skill listing, not a wider trail of dependency fixes the way Periplo and Nirium have.

Found using these libraries for Periplo, Nirium, or Contextio, but not clearly attributable to a single one:

• Creit-Tech/Stellar-Wallets-Kit#105 — signMessage()'s JSDoc says SEP-43 hex, Freighter returns base64. Open.

Not part of the six-project portfolio above — separate weekend builds. No GitHub repo for any of the three — source isn't public. Two have the event's own announcement naming the winner directly; the third only has my own tweet from the time, not an organizer confirmation — disclosed as such rather than blurred together, same standard as everywhere else in this profile.

• ActivaChain — won ETH Uruguay 2025, built with Monserrat. Confirmed by the event's own tweet: "Felicitaciones @ActivaChain! Nos representarán en Devconnect" — the top prize was a ticket + travel to Devconnect (Nov 2025).
• CreatorChain — 1st place, "Creatividad y Economías de Creadores" track, and 3rd place, "Innovación en Arbitrum" track, both at ETH Mexico Monterrey 2025 (2025-11-13) — confirmed by the event's own announcement for the first and for the second. Solo build.
• BioShield Insurance — won the FDA Track at the DeSci Builders Hackathon (Gitcoin × Infinita City × Próspera, Honduras, 2025), built with Monserrat. Deployed across Solana, Base, and Optimism. Self-reported — my own tweet at the time, not an organizer announcement.

Protocols — x402, MPP (Charge and Channel), SEP-41 / SAC, SEP-43, SEP-53, CAP-71 delegated auth, MCP, EAS (Ethereum Attestation Service) Chains — Avalanche (Kumply), Base (Vouch402), Stellar/Soroban (Periplo, Nirium, Contextio), Solana (Prova)

• Small PRs, one root cause each, with the reproduction in the description.
• If I file a bug in a dependency, I try to open the fix alongside it when I can — #3187 → #3228. When someone else beats me to the fix, I say so and name them — #3171 → #3180 by @JasonColapietro, #3270 → #3306 by @phdargen — the maintainer's own fix, rejecting the field shape my own workaround used.
• When I'm not sure whether it's my bug or theirs, I say so in the issue rather than asserting a diagnosis I can't back (#839 is an example).
• Every contract I ship is non-custodial by construction: the client signs, or a role that by contract design can't move funds — never a key of ours that can.

Snapshot above is accurate as of 2026-09-11; these always supersede it: all my PRs · all my issues · nirium's full bounty board · Contextio's open issues

Open an issue on any repo above, or start with periplo.xyz · nirium.xyz · contextio.xyz

X: @vaiossx · Discord: vaiossx