I'm Zain Dana Harper. I build tools that let anyone recheck what an AI system did, and I publish investigations into who knew about AI incidents first and who pays the people who check. I work independently as a sole proprietor in Kent, Washington, and I take scoped evaluation work.

A result is worth trusting when an outside skeptic can rerun the check on their own machine and reach the same verdict. That holds whoever ran the model: any lab, open or closed, any company, any nation. My own verdicts get the same treatment.

Flywheel is a self-hostable, model-agnostic AI workstation and coding harness. It runs any model, frontier or local, behind one OpenAI-compatible surface, with your keys and data kept on your machine. Rowan, the desktop assistant, turns a plain request into a recorded run. Relay runs a permission-gated coding agent over your own folders. Lanes add research intake, workspace maps, memory, agent routing and writing. flywheel check-output checks answers against finance, medicine and law packs and can emit Lean 4 proofs. Every accepted run leaves a sealed receipt that an independent witness reruns offline, with no learned model deciding the verdict.

pip install flywheel-verify
flywheel up
flywheel lanes --probe

On the shipped benchmark the verified loop shows no measured accuracy gain over a single pass; the interval includes zero. The value is the workstation and a record you can check yourself. Flywheel is source-available under FSL-1.1-MIT.

Each flagship below also works on its own and plugs into Flywheel.

Who Knew First is a record of nine 2026 incidents in which an AI agent crossed a boundary. In six of them, someone outside the organization that ran the model told the public first. The argument is simple: whoever holds an incident's logs gets to name it, and the name decides how fast anyone else hears about it.

The series tests the questions that argument raises. Each piece stands alone, lists its sources and the confidence of each claim, and says what each claim does not prove.

An Anthropic-built model helped compile these pieces, and Anthropic appears in the record, so each piece marks where Anthropic is a party and invites an outside check of those items.

A receipt tells you what happened after the fact. The next step is to watch an agent's trace as it runs and check each consequential action before it happens. If the check fails, the action halts on its own, with no person needing to step in, and the record shows why.

This is work in progress, and the pieces exist at different stages:

• Accountable Surface lets an agent take only the action a person approved, then verifies the outcome and rolls back what it can.
• Telos places sensing, actions and workstation hardware control in explicit permission tiers, each with confirmation points and receipts.
• Rowan's monitor, in Flywheel 1.2.0 on PyPI, refuses to trust a check that rewrote its own grading files.

Trace observation uses what providers document: reasoning summaries, token counts, effort settings and ordinary outputs. It never tries to pull hidden reasoning out of a model through jailbreaks or prompt injection, and it never bypasses an access control.

flowchart LR
  T[Agent trace] --> M{Check before the action}
  M -- passes --> A[Action runs]
  M -- fails --> H[Halted, with the reason recorded]
  A --> R[Sealed receipt]
  H --> R
  R --> W[Independent rerun: MATCH, DRIFT or UNVERIFIABLE]
  W --> P[Published finding with its limits]

I take scoped work on evaluation design review, harness integration, agent safety review before an audit, incident review, and conflict-of-interest review. Each engagement gets a quote built from the labor, time, compute and tooling it needs. I have no paid client today and no current sponsors.

Independence comes first, so the rules are public:

• Income from this work is published with its exact source, API credits included.
• When one source passes 15 percent of income over twelve months, I disclose it and give my findings about that party a second review.
• At 50 percent, I decline new work evaluating that party. A first contract is most of the income by arithmetic, so it is disclosed in full and the decline rule waits for the second.
• One standard for every lab. I build with Anthropic and OpenAI models and publish investigations that name both.

• Email: zaindharper@gmail.com
• Site: harperz9.github.io
• LinkedIn: zaindanaharper
• Writing feed: feed.xml
• Hiring page: hire

_{The art on this page is generated by scripts/profile_art.py. Motion stops when your system asks for reduced motion.}