Overview

Software and security systems engineer focused on First-Principles Autonomous Decision Agents, Active Inference, and Google Cloud Security Operations (Chronicle SIEM/SOAR). Building cognitive systems that bridge probabilistic graphical models, neuro-symbolic reasoning, real-time streaming telemetry, progressive disclosure skills architectures, and deterministic security containment.

---

Flagship Systems and Open Source Projects

1. Active Inference SOC Decision Agent (soc_decision_agent)

First-principles cognitive decision architecture implementing active inference to drive autonomous detection, investigation, and containment across enterprise cloud environments.

• Streaming Bayesian Structure Learning: Continuous acyclicity projection using stochastic NOTEARS gradient optimization over live Cloud Asset Inventory (CAI) changes and Cloud Pub/Sub telemetry.
• Expected Free Energy (EFE) Minimization: Policy evaluation balancing epistemic value (ambiguity resolution) with pragmatic value (loss reduction) across multi-sensor precision dynamics.
• Socratic Epistemic HITL: Dynamic Expected Value of Information (EVOI) gating for high-impact containment, synthesizing disambiguating inquiries to human analysts.
• FastMCP Tool Server: Exposes 6 core cognitive tools (evaluate_policy_efe, generate_socratic_inquiry, simulate_digital_twin_mitigation, get_markov_blanket, trigger_abductive_sleep_cycle).
• Visual Topology Dashboard: Force-directed causal DAG topology dashboard, live Markov blanket visualizer, stacked EFE decomposition charts, and neural sleep consolidation diff views.

---

2. ADK Runbooks (adk_runbooks)

Comprehensive multi-agent cybersecurity operations platform built on Google's Agent Development Kit (ADK 2.x), featuring a Dual-Tier Progressive Disclosure Architecture.

• Live Documentation: https://dandye.github.io/adk_runbooks
• Tier 1 (Skills Progressive Disclosure): 62+ production security skills (SkillRegistry) across alert triage, incident response plans (IRPs), deep-dive IOC investigation, threat hunting, and standardized reporting.
• Tier 2 (Progressive MCP Discovery): Client-side progressive tool discovery (MCPToolRegistry) replacing static parameter schemas with lightweight discovery meta-tools (search_mcp_tools, get_mcp_tool_schema, execute_mcp_tool), achieving 60.5% token reduction vs static schemas and 94.0% reduction vs monolithic system prompts.
• Detection-as-Code (DAC): Dedicated Detection Engineer sub-agent integrated with Google SecOps 1P Agentic Detection Engineering MCP Server (70+ tools for TDO extraction, synthetic UDM events, coverage evaluation, and YARA-L rule generation).

---

3. Enterprise Agentic SOC Platform (agentic_soc_gemini_enterprise)

Scalable multi-agent orchestration engine grounded on Vertex AI Reasoning Engines and Google ADK v2.

• Vertex Code Execution Sandbox: Threat hunting agent configured with sandboxed Python analytics for high-volume Chronicle UDM logs, Shannon entropy calculations for DGA detection, and beaconing jitter analysis.
• Multi-Modal Knowledge Engine: Hybrid attack path navigation via Neo4j Cypher graphs, AlloyDB 768-dimension pgvector asset catalog search, and server-side Gemini RAG grounding for playbooks and CTI dossiers.
• CTI Neural Engine (nlp_capstone): In-process SecureBERT (pzryathzsdhc/cti-ner-securebert) for entity extraction, threat intel normalization, and MITRE ATT&CK TTP mapping.

---

4. AI Runbooks (ai-runbooks)

Foundational procedural runbook design and prompt optimization methodology for autonomous LLM agents.

• Principle of Maximum Weakness: Formulates minimal sufficient procedural constraints to maximize agent generalization and out-of-distribution robustness during real-time human analyst intervention.
• ASD-STE100 Simplified Technical English (STE): Controlled-vocabulary rule authoring and tabular decision logic reducing prompt token overhead by 40-80% while eliminating redundant multi-hop tool retrieval.

---

5. Google SecOps MCP Suite (secops-mcp on PyPI)

Comprehensive Model Context Protocol (FastMCP) ecosystem for Google Security Operations.

• Full API Parity: Published official secops-mcp package to PyPI (68 tools) covering Chronicle 1P Case/Alert REST services, UDM search, GTI threat intel, and SCC findings.
• GEPA Prompt Optimization (gusto-mcp-gepa): Systematic prompt tuning benchmarked across 200+ curated Chronicle search queries.
• OneMCP Action Connectors (secops-action-connector): Native action connectors for query-time tool execution and discovery engine ingestion.

---

Technical Capabilities

Domain	Technologies and Frameworks
Agentic AI & Cognition	Google ADK v2, Vertex AI Reasoning Engines, Active Inference, Progressive Disclosure Skills Architecture, ADK Runbooks, AI Runbooks (Maximum Weakness & STE), POMDP Policy Rollouts, FastMCP, Prompt Optimization (GEPA), Gemini 2.5 Flash / Pro
Security Operations & Detection	Google SecOps (Chronicle SIEM & SOAR), YARA-L 2.0 Detection Engineering, Chronicle UDM Analytics, Security Command Center (SCC), Google Threat Intelligence (GTI / VirusTotal), MITRE ATT&CK
Distributed Infrastructure & Data	Google Cloud Run, Cloud Pub/Sub Streaming, BigQuery Partitioned Telemetry, AlloyDB (pgvector), Neo4j (Cypher Graphs), Google Cloud Storage, Terraform
Engineering & Tooling	Python 3.12+ (FastAPI, Typer, Pydantic, PyTorch, Transformers, SecureBERT), Just Automation, Git Worktree Architecture, ggh

---

Mathematical and Theoretical Foundations

1. Active Inference & Expected Free Energy

Policies are selected by minimizing Expected Free Energy $G(\pi)$, trading off exploratory information gain against goal directed risk reduction:

$$G(\pi) = \underbrace{-\mathbb{E}_{Q}[ \ln P(o_\tau | s_\tau) ]}_{\text{Epistemic Value (Ambiguity Reduction)}} + \underbrace{\mathbb{E}_{Q}[ \ln Q(s_\tau | \pi) - \ln P(s_\tau | C) ]}_{\text{Pragmatic Value (Goal Alignment)}}$$

2. Continuous Causal DAG Acyclicity (NOTEARS)

Streaming Bayesian structure learning formulates DAG search as a continuous smooth optimization problem over parameter matrix $W$:

$$\min_{W} \mathcal{L}_{\text{Poisson}}(W; X) + \lambda |W|_1 \quad \text{subject to} \quad h(W) = \mathrm{tr}\left(e^{W \odot W}\right) - d = 0$$

3. Socratic Epistemic HITL & Expected Value of Information

Human-in-the-loop interactions are gated by calculating the Expected Value of Information ($\text{EVOI}$) prior to interrupting operators:

$$\text{EVOI}(q) = \sum_{a \in \mathcal{A}} P(a | q) \max_{\pi} \mathbb{E}[U(\pi | a)] - \max_{\pi} \mathbb{E}[U(\pi)]$$

---

Workflows and Automation

• Task Runner: just [command] for local execution, verification, and deployment.
• Worktree Layout: Multi-worktree convention with primary clone at <repo>__worktrees/main.
• FastMCP Transports: Stdio and Server-Sent Events (SSE) support for multi-agent interoperability.

---

_{Configured for Google Enterprise GitHub (depot.code.corp.goog) and public GitHub (github.com).}