Software and security systems engineer focused on First-Principles Autonomous Decision Agents, Active Inference, and Google Cloud Security Operations (Chronicle SIEM/SOAR). Building cognitive systems that bridge probabilistic graphical models, neuro-symbolic reasoning, real-time streaming telemetry, progressive disclosure skills architectures, and deterministic security containment.

First-principles cognitive decision architecture implementing active inference to drive autonomous detection, investigation, and containment across enterprise cloud environments.

• Streaming Bayesian Structure Learning: Continuous acyclicity projection using stochastic NOTEARS gradient optimization over live Cloud Asset Inventory (CAI) changes and Cloud Pub/Sub telemetry.
• Expected Free Energy (EFE) Minimization: Policy evaluation balancing epistemic value (ambiguity resolution) with pragmatic value (loss reduction) across multi-sensor precision dynamics.
• Socratic Epistemic HITL: Dynamic Expected Value of Information (EVOI) gating for high-impact containment, synthesizing disambiguating inquiries to human analysts.
• FastMCP Tool Server: Exposes 6 core cognitive tools (evaluate_policy_efe, generate_socratic_inquiry, simulate_digital_twin_mitigation, get_markov_blanket, trigger_abductive_sleep_cycle).
• Visual Topology Dashboard: Force-directed causal DAG topology dashboard, live Markov blanket visualizer, stacked EFE decomposition charts, and neural sleep consolidation diff views.

Comprehensive multi-agent cybersecurity operations platform built on Google's Agent Development Kit (ADK 2.x), featuring a Dual-Tier Progressive Disclosure Architecture.

• Live Documentation: https://dandye.github.io/adk_runbooks
• Tier 1 (Skills Progressive Disclosure): 62+ production security skills (SkillRegistry) across alert triage, incident response plans (IRPs), deep-dive IOC investigation, threat hunting, and standardized reporting.
• Tier 2 (Progressive MCP Discovery): Client-side progressive tool discovery (MCPToolRegistry) replacing static parameter schemas with lightweight discovery meta-tools (search_mcp_tools, get_mcp_tool_schema, execute_mcp_tool), achieving 60.5% token reduction vs static schemas and 94.0% reduction vs monolithic system prompts.
• Detection-as-Code (DAC): Dedicated Detection Engineer sub-agent integrated with Google SecOps 1P Agentic Detection Engineering MCP Server (70+ tools for TDO extraction, synthetic UDM events, coverage evaluation, and YARA-L rule generation).

Scalable multi-agent orchestration engine grounded on Vertex AI Reasoning Engines and Google ADK v2.

• Vertex Code Execution Sandbox: Threat hunting agent configured with sandboxed Python analytics for high-volume Chronicle UDM logs, Shannon entropy calculations for DGA detection, and beaconing jitter analysis.
• Multi-Modal Knowledge Engine: Hybrid attack path navigation via Neo4j Cypher graphs, AlloyDB 768-dimension pgvector asset catalog search, and server-side Gemini RAG grounding for playbooks and CTI dossiers.
• CTI Neural Engine (nlp_capstone): In-process SecureBERT (pzryathzsdhc/cti-ner-securebert) for entity extraction, threat intel normalization, and MITRE ATT&CK TTP mapping.

Foundational procedural runbook design and prompt optimization methodology for autonomous LLM agents.

• Principle of Maximum Weakness: Formulates minimal sufficient procedural constraints to maximize agent generalization and out-of-distribution robustness during real-time human analyst intervention.
• ASD-STE100 Simplified Technical English (STE): Controlled-vocabulary rule authoring and tabular decision logic reducing prompt token overhead by 40-80% while eliminating redundant multi-hop tool retrieval.

Comprehensive Model Context Protocol (FastMCP) ecosystem for Google Security Operations.

• Full API Parity: Published official secops-mcp package to PyPI (68 tools) covering Chronicle 1P Case/Alert REST services, UDM search, GTI threat intel, and SCC findings.
• GEPA Prompt Optimization (gusto-mcp-gepa): Systematic prompt tuning benchmarked across 200+ curated Chronicle search queries.
• OneMCP Action Connectors (secops-action-connector): Native action connectors for query-time tool execution and discovery engine ingestion.

Policies are selected by minimizing Expected Free Energy $G(\pi)$, trading off exploratory information gain against goal directed risk reduction:

$$G(\pi) = \underbrace{-\mathbb{E}_{Q}[ \ln P(o_\tau | s_\tau) ]}_{\text{Epistemic Value (Ambiguity Reduction)}} + \underbrace{\mathbb{E}_{Q}[ \ln Q(s_\tau | \pi) - \ln P(s_\tau | C) ]}_{\text{Pragmatic Value (Goal Alignment)}}$$

Streaming Bayesian structure learning formulates DAG search as a continuous smooth optimization problem over parameter matrix $W$:

$$\min_{W} \mathcal{L}_{\text{Poisson}}(W; X) + \lambda |W|_1 \quad \text{subject to} \quad h(W) = \mathrm{tr}\left(e^{W \odot W}\right) - d = 0$$

Human-in-the-loop interactions are gated by calculating the Expected Value of Information ($\text{EVOI}$) prior to interrupting operators:

$$\text{EVOI}(q) = \sum_{a \in \mathcal{A}} P(a | q) \max_{\pi} \mathbb{E}[U(\pi | a)] - \max_{\pi} \mathbb{E}[U(\pi)]$$

• Task Runner: just [command] for local execution, verification, and deployment.
• Worktree Layout: Multi-worktree convention with primary clone at <repo>__worktrees/main.
• FastMCP Transports: Stdio and Server-Sent Events (SSE) support for multi-agent interoperability.