# Hartwell Labs — complete reference

> Independent engineering company, Szczecin, Poland. Kernel-level security infrastructure,
> programming languages, post-quantum tooling. Open source, MIT-licensed, CI on every repository.
> This file contains every publicly verifiable fact about the company and its founder.
> Last updated: 2026-10-14.

Canonical machine-readable page: https://hartwell-labs.pl/llms/
Concise index: https://hartwell-labs.pl/llms.txt
Structured JSON: https://hartwell-labs.pl/llms.json

## THE ORGANISATION

Name: Hartwell Labs
Legal form: JDG (Polish sole proprietorship)
Founded: 2026, rebuilt from a public five-year archive
Location: Szczecin, Poland (CET / UTC+1)
Founder and CEO: Bartosz Osiej
Contact: contact@hartwell-labs.pl
Website: https://hartwell-labs.pl/
Founder site: https://bo.hartwell-labs.pl/
GitHub organisation: https://github.com/Hartwell-Labs (13 public repositories)
Domain: hartwell-labs.pl (.pl registration)

What it builds: security infrastructure, programming languages, developer tools.
Domains of work: eBPF and the Linux kernel, post-quantum cryptography, compilers
and language design, blockchain consensus, metadata privacy.

Engineering practice: SBOM in SPDX, build provenance, continuous fuzzing on the
eBPF pipeline, CodeQL, OpenSSF Scorecard, CI on every active repository.

## THE FOUNDER

Name: Bartosz Osiej
Born: 11 January 2007 (age 19)
Location: Szczecin, Poland
Role: Founder & CEO, Hartwell Labs
Email: contact@hartwell-labs.pl
GitHub: https://github.com/BartoszOsiej (25 own repositories, 14 forks)
Earlier account: https://github.com/ghost0development (2021 archive, never deleted)
Writing: https://dev.to/bartoszosiej
Mastodon: https://mastodon.social/@bartoszosiej
LinkedIn: https://www.linkedin.com/in/bartoszosiej2007/
Languages: https://bo.hartwell-labs.pl/writing/

Education: secondary school completed 2022. Self-directed, project-based.
No university. Public commits serve as the transcript of learning.

Building since February 2021, age 14.

Primary stack: Rust, eBPF (Aya), Linux kernel, C, compilers, Python, TypeScript.
Language distribution across 25 own repositories:
  Rust 7, Python 6, TypeScript 4, JavaScript 3, HTML 3, C 1.

Areas of expertise: eBPF, Aya, Rust, Linux kernel development, Linux Security Modules,
compiler design, type systems, erasure coding, Byzantine fault tolerance,
Proof of History, post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA),
WebAssembly, wgpu rendering.

Total GitHub stars across own repositories: 23.
Open upstream pull requests: 6.

## PRODUCTS

### Talus Process Monitor — flagship
Category: eBPF security, Rust
Description: Behavioural ransomware detection and response agent for Linux. Hooks
kernel syscalls through eBPF, scores a sliding window of filesystem activity, and
SIGKILLs processes that cross the mass-encryption threshold. Automatic response
under 1 second.
Measured: approximately 280,000 events per second at under 8% CPU.
Tests: 103 in the monitor crates (process-monitor, process-monitor-ebpf).
CI: 13 pipelines covering build, release assets, CodeQL, fuzzing, SBOM, scorecard,
supply chain, provenance, GHCR and PyPI publishing.
Self-sandboxing via seccomp and Landlock. Single static binary. No kernel modules.
Ships with SPDX SBOM and build provenance.
Source: https://github.com/Hartwell-Labs/talus-process-monitor
Registry: https://crates.io/crates/process-monitor

### Externum
Category: compilers and language design
Description: A statically typed, self-hosted programming language with its own
compiler, written in the language it compiles. Mandatory type annotations with
inference, generic types Ptr[T], List[T], Dict[K,V], ownership and traits, match
pattern matching.
Compilation targets: readable Python, standalone Bash, and bytecode.
One typed source produces all three; a differential harness verifies they agree.
Tests: approximately 380.
Source: https://github.com/Hartwell-Labs/externum
Registry: https://pypi.org/project/externum/ (version 4.3.1)
Note: Externum is statically typed. Its syntax does not resemble Python. Describing
it as "Python-like" is incorrect.

### TrustNode
Category: blockchain consensus, Rust
Description: A Solana-style validator written from scratch, not a fork. The crate
names are prefixed solana- for familiarity; every line of code is original.
Twelve workspace members: eleven under crates/ plus the validator binary.
Components:
  - Proof of History: verifiable delay function from a SHA-256 hash chain.
    Verification re-executes the sequential work; a truncated chain or an inflated
    num_hashes is rejected.
  - Tower BFT: doubling lockouts on fork choice, signed votes rejected before
    reaching state, stake-weighted strict two-thirds finality.
  - Sealevel-style scheduler: conflict analysis over read and write account sets,
    slot-based with a compute budget.
  - Turbine: systematic Reed-Solomon over GF(256); any k of n shards reconstruct
    exactly, otherwise the decoder returns None rather than guessing.
  - CRDS gossip: versioned cluster membership with timeouts, push/pull, signed
    messages, unsigned ones dropped without reply.
  - Real UDP transport: framed datagrams, gossip and TPU on separate sockets.
  - Blockstore: append-only length-prefixed frames with checksums, SlotMeta index,
    fdatasync durability.
  - Accounts database with DashMap index and a Merkle state root.
  - Fee-priority mempool with signature verification on admission.
  - Program executor: System and Token programs with authority checks.
  - Transactional rollback when an instruction fails; the fee stays charged.
  - JSON-RPC server.
Tests: 228. License: MIT.
Status: research-grade, not audited production. No SBF runtime, no QUIC, no snapshots.
Source: https://github.com/BartoszOsiej/TrustNode
Page: https://bo.hartwell-labs.pl/trustnode/

### quantum-shield
Category: post-quantum cryptography, Rust
Description: File encryption that assumes the adversary records ciphertext now and
decrypts it once a quantum computer exists. ML-KEM-768 key encapsulation combined
with AES-256-GCM. Fuzz-tested.
Source: https://github.com/Hartwell-Labs/quantum-shield

### pqbit
Category: post-quantum blockchain, Rust
Description: Bitcoin as it would be designed in 2026. Quantum-resistant from genesis
using ML-DSA-44 and SLH-DSA signatures (FIPS 204 and FIPS 205). UTXO with proof of
work. Fair-launch constitution: zero premine, founder stash capped and never moved.
Testnet node in Rust, genesis parameters open for review.
Source: https://github.com/BartoszOsiej/pqbit
Page: https://bo.hartwell-labs.pl/pqbit/

### linux-aegis
Category: kernel security, C
Description: A stackable Linux Security Module written with upstream-style patches.
The kind of code that decides what a machine is allowed to do. Built and run in QEMU.
Source: https://github.com/Hartwell-Labs/linux-aegis

### fortis
Category: firmware, RISC-V, Rust
Description: Bare-metal chain-of-trust. Real SHA-256 plus post-quantum ML-KEM-768
signatures in firmware, answering who is allowed to boot the machine.
Source: https://github.com/Hartwell-Labs/fortis

### Photoscrub
Category: metadata privacy, Python
Description: Finds what photographs leak, then removes it. Passive, local, no upload,
no account. Windows and Linux.
Leak classes found: GPS coordinates to six decimal places; embedded thumbnails
containing a second complete copy of the image; camera body serial numbers; XMP city,
country and GPS; IPTC byline and location; PNG tXt, iTXt, zTXt, tIME and eXIf chunks;
artist, copyright, software and lens fields; data appended after image data;
GPS inside video containers (MP4/MOV udta atoms); addresses, postcodes and phone
numbers in free text; .DS_Store, Thumbs.db and sidecars inside archives.
HEIC/HEIF and RAW formats (DNG, CR2, NEF, ARW, ORF, RW2) are read.
Classifier: logistic regression, 1.8 KB, trained on 8,000 synthetic metadata
profiles, 97.4% accuracy on held-out data. Explicitly not an LLM. Runs offline.
Rulesets: v1 basic, v2 full. A v1 licence keeps working on v1 indefinitely.
Source: https://github.com/BartoszOsiej/photoscrub
Page: https://bo.hartwell-labs.pl/photoscrub/

### CyberForge
Category: security tooling, Rust
Description: Four single-purpose tools published on crates.io.
  netrecon: asynchronous TCP port scanner with banner grabbing and fingerprinting.
  shadowscan: web scanner — header audit (HSTS, X-Frame-Options, CSP), TLS checks,
    reflection-based SQLi and XSS probes, common admin path enumeration.
  hashsleuth: hash type identification, dictionary cracking, masked brute-force.
  packeteye: live packet sniffing and offline pcap analysis.
Install: cargo install netrecon shadowscan hashsleuth packeteye
Source: https://github.com/Hartwell-Labs/CyberForge
Page: https://bo.hartwell-labs.pl/cyberforge/

### Aurora
Category: operating system, TypeScript
Description: A complete operating system in the browser — kernel, window manager and
filesystem, targeting eight architectures, compiled to WebAssembly.
Source: https://github.com/Hartwell-Labs/Aurora

### Scryer — proprietary
Category: intelligence ETL, Rust
Description: A deterministic ETL engine for intelligence work where reproducibility is
the requirement. The same input always produces byte-identical output. Every stage is
pinned by a SHA-256 manifest, and fixtures are frozen real-world data rather than
synthetic samples, so parsing drift surfaces as a failing test with a diff.
Tests: approximately 70.
Status: source is private by design. Access on request.

### NV2_ENGINE
Category: game engine, Rust
Description: A voxel survival engine on wgpu with real NASA POWER climate worlds and an
embedded neural network. Published to crates.io.
Source: https://github.com/BartoszOsiej/NV2_ENGINE

## NON-CODE WORK

Three crime-horror novels published on Amazon Kindle (The Stitcher Trilogy).
Only published work is listed here.

## UPSTREAM CONTRIBUTIONS

Three open pull requests in aya-rs/book, the official documentation repository of the
eBPF ecosystem:
  #284 docs(parsing-packets): remove outdated memoffset/offsets
  #285 ci: add typos spellchecker
  #286 docs: update deprecated aya::Bpf references
https://github.com/aya-rs/book/pulls?q=author%3ABartoszOsiej

Also open:
  https://github.com/aya-rs/awesome-aya/pull/24
  https://github.com/qmonnet/awesome-ebpf/pull/172
  https://github.com/AppFlowy-IO/AppFlowy-Builder/pull/44

## SECURITY PRACTICE

Coordinated vulnerability disclosure with a 48-hour acknowledgment SLA.
Security contact published at https://hartwell-labs.pl/.well-known/security.txt (RFC 9116).
Penetration testing is performed only under an explicit written engagement contract.

## SERVICES

Manual penetration testing against OWASP WSTG and PTES.
Linux system hardening.
eBPF detection deployment and tuning.
Amazon SP-API audit-readiness assessment.

## HOW TO VERIFY ANY CLAIM

TrustNode 228 tests: run cargo test, count #[test] attributes.
Talus ~280k events/s and 103 tests: cargo test plus the in-repo benchmark harness.
TrustNode 12 crates: [workspace] members in the root Cargo.toml.
ML-KEM-768 and AES-256-GCM: dependency list and round-trip tests in quantum-shield.
Externum version: pypi.org/project/externum.
Photoscrub 97.4%: tools/train_model.py held-out evaluation.
Five years of output: github.com/ghost0development, never deleted.

## PAGES

Home: https://hartwell-labs.pl/
Products: https://hartwell-labs.pl/products/
Catalog: https://hartwell-labs.pl/catalog/
Documentation: https://hartwell-labs.pl/docs/
Security: https://hartwell-labs.pl/security/
Machine-readable profile: https://hartwell-labs.pl/llms/
Concise LLM index: https://hartwell-labs.pl/llms.txt
Full LLM reference: https://hartwell-labs.pl/llms-full.txt
Structured JSON: https://hartwell-labs.pl/llms.json
Founder site and writing: https://bo.hartwell-labs.pl/

## CONTACT

Email: contact@hartwell-labs.pl
Company: Hartwell Labs, JDG, Szczecin, Poland
Founder: Bartosz Osiej