DrawingAbhinav Rana
Open

Fig. 3 — Personal projects

Things I build

All of this is mine — designed, built and operated end to end, outside any employer or client. Some repos are private because the product isn’t launched.

Sheet 01 · ProductFastAPI · React · Postgres · Redis · Go research service

chotu.studio

A React and FastAPI studio that turns a brief into a finished short. Generation runs as a deterministic graph, not an agent loop, so output stays cacheable and reproducible. Context, spend and tenancy are enforced in CI: three of four agent call sites had drifted into sending no project context before a test started failing the build on it.

The interesting part isn’t the generation — it’s keeping a non-deterministic pipeline honest.

Open chotu.studio
Scope
Multi-repo, built solo
Tests
~4,850, CI + staging CD
Decisions
68 ADRs, written down
Status
In development, not launched

01

The pipeline is a deterministic DAG, not an agent loop

The obvious move in 2026 is to let a model plan the pipeline. I decided against it. There is exactly one graph — script → speech → images → assemble → caption — and a “skill” is declarative data that varies prompts and model preferences. A skill may switch stages off; it may never fork the graph. The payoff is that output quality compounds as genres are added without anyone touching the engine, and the whole thing stays predictable and cacheable. An LLM planner would have traded that away for flexibility the product does not need yet.

02

Crash survival before a workflow engine

The pipeline used to await provider generation in-process, so a restart mid-run orphaned the work: nothing to resume from, and no guard against billing someone twice for work that had partly run. The fix shipped first as a durable run ledger — persist the run, sweep for orphans on startup, mark them interrupted rather than losing them silently. Converging on a Postgres-backed queue came second. Build the seam, adopt the infrastructure later.

03

Two security bugs I found by attacking my own code

A scene identifier was used raw as a filename, so a crafted value wrote outside the project root — reproduced, then fixed before the first paid call in that path. Separately, a recorded manifest path could copy any server file into a generation brief; a secret landed in one during testing. The rule that came out of it: never follow a recorded path. Both were found in adversarial review rounds, not by users.

04

The quote has to be the bill

A price shown to someone must come from the same function that charges them. It wasn’t, in six places — the estimate and the charge had drifted apart as the pricing grew. They all read one function now, and a test generates a real clip and asserts that what the ledger took equals what was quoted.

Also building

In progress

Smaller, and honestly still in motion.

  • theCollectorGoAn agentic research service in Go: multi-engine search, guarded fetch and extraction, then synthesis with citations that are validated rather than trusted.

Coursework, experiments and the things I am still being taught live on Courses & academia.