Arcane Labs / portfolio index
I'm Jayesh Sudhakar, a systems engineer and technology consultant in Australia. I work from the core implementation through to the product experience: AI systems, security tooling, browser-native 3D and personal software. I care about the work that makes a system trustworthy in practice — clear boundaries, resilient architecture and a deliberately simple experience. I take on systems-engineering roles, AI integration work, and consulting and selected builds through Arcane Labs.
01 Selected work
A private, macOS-first AI system that works across projects with native OS-level access — without sending work through someone else’s server.
The hard part: giving a model useful reach into an operating system without giving it unrestricted control. Sage is being built around scoped permissions, sandboxing and an audit trail, so capable automation remains accountable.
An AI-driven personal organisation system for the moving parts of everyday life: academics, scheduling, finance, meals and career planning. Named after the Roman goddess of the hearth, Vesta is designed to be a calm center that stays in step with the life around it.
The hard part: personal systems only earn trust when they are useful enough to return to and clear enough to stay in control of. Vesta combines structured planning with machine-learning-assisted insights, while keeping important actions reviewable.
An in-development private-networking system for Android and macOS: a self-hosted WireGuard mesh, optional exit-node routing, LAN-device monitoring, tracker filtering and connection diagnostics.
The hard part: each capability normally arrives as a separate product. Numen keeps them under one trust model, with a shared Rust core and thin platform layers rather than five disconnected tools.
A shipped Python command-line scanner for web applications you own or are authorised to test. It crawls pages and forms, then runs a focused set of OWASP-aligned checks across headers, TLS, cookies, CORS, redirects, traversal, XSS and SQL injection.
The hard part: useful findings need context. Argus captures baselines before testing, reports severity and evidence, exports JSON, and returns CI-friendly exit codes rather than treating every signal as equally urgent.
A live, playable early-build 3D open world that runs entirely in a browser tab. There is no launcher or download: follow a link and enter the experience.
The hard part: the frame budget. The world uses instanced rendering for dense asteroid fields and keeps its game loop lean, because a browser has nowhere to hide a slow load or uneven frame time.
A direct-to-consumer storefront for an organics brand — catalogue, cart, a four-step checkout, server-side payment session creation, pincode validation, and consignment tracking through a serverless proxy. A partial build is deployed; it isn't taking orders yet.
The hard part: not the storefront — the loyalty economics behind it. Any rewards scheme can be modelled into insolvency. This one was costed per product category, with the loss cases written down before a line of it shipped.
02 Voidpath — playable
Browser-native 3D
A 3D open world that opens from a link. No launcher, no download, nowhere to hide a slow load — so every asset and every frame is budgeted, and the renderer instances dense fields rather than drawing them twice.
03 Argus — demo replay
Eight OWASP-aligned check modules, run from one command against a target you own. Every check captures a baseline first, so a payload only becomes a finding when the response actually changes. The output below is a recorded replay against a deliberately vulnerable demo host — not a live scan, and not your machine.
04 PureHarvest — in development
A D2C storefront for an organics brand — catalogue, cart, a four-step checkout, server-side payment sessions and consignment tracking. The loyalty economics were modelled to the point of failure before a line of it shipped.
05 What I bring
Six places I am useful, and the work that proves each one. Not a list of tools — the judgement that decides which tool belongs, what the thing costs to run, and what happens when it fails at three in the morning.
Most failures do not live in the components. They live in the seam between them.
Numen runs one shared Rust core under thin Android and macOS layers, so a change to the trust model lands once rather than three times. The architecture is the thing that decides whether the second year of a project is cheap or impossible.
In practice — Numen
Capability without boundaries is not intelligence. It is unaudited risk.
Sage gets scoped permissions, sandboxing and an audit trail before it gets broader operating-system reach. On placement at Digital Technology Solutions I design the system prompts that govern an agent's logic, tone and safety limits — the part that decides what a model is allowed to be wrong about.
In practice — Sage · DTS
A finding costs hours before release and weeks after it.
Argus runs eight OWASP-aligned check modules, captures a baseline before every payload so a response has to actually change to count, gates on severity and returns CI-friendly exit codes. I also do vulnerability research on Bugcrowd and similar platforms, which is where you learn what real targets actually look like.
In practice — Argus · bug bounty
Speed is not a polish phase. It decides what the thing is allowed to be.
Voidpath is an open world running in a browser tab with no launcher to hide a slow load behind, so every asset and frame is budgeted and the renderer uses instancing for dense fields. If the experience is expensive, the experience has to earn it.
In practice — Voidpath
A build that was never deployed is a prototype with good intentions.
This site runs on Cloudflare Workers with D1 behind a static front, its own telemetry, origin checks and a content security policy. Deployment, hardening and the boring operational edges are part of the work, not a separate job handed to someone else afterwards.
In practice — ARC-1 · this site
A feature can work perfectly and still lose money on every order.
PureHarvest's loyalty scheme was costed per product category and modelled to the point of insolvency before a line of it shipped. I ran my own e-commerce store before that, which is where the difference between a working checkout and a profitable one stops being theoretical.
In practice — PureHarvest · Stella's Toy Garden
06 How I work
Most engagements die in the part before the building — scope that keeps moving, decisions nobody owns, a demo that never becomes a deployment. This is the shape I work in, and the tools underneath it.
01
02
03
04
JavaScript & TypeScript · Python · Rust · WebGL & Canvas · Cloudflare Workers & D1 · serverless APIs · Git & CI · native platform integration · OWASP-aligned testing · threat modelling · WireGuard mesh networking · AI integration & agent permissioning · private model workflows · payment gateways & checkout systems · unit-economics modelling
07 Services
Client work runs through Arcane Labs, my independent studio. Early-stage teams rarely need a specialist for every layer — they need someone who can carry a problem from the business case through to something deployed, and say honestly which parts are worth building at all.
Before the build: what to make first, what to cut, what it will cost to run, and whether the thing earns money once it works.
Built it first — PureHarvest, Stella’s Toy Garden
Local-first AI, capable agents connected to the tools you already use, and automation that removes repetitive operational work.
Built it first — Sage, Vesta
Finding meaningful security risks early, then helping build the systems and tooling that address them.
Built it first — Argus, Numen
Product and brand experiences with real-time browser graphics, designed to stay fast and accessible on everyday devices.
Built it first — Voidpath
A storefront with payments, logistics and tracking, supported by unit economics that are modelled before incentives go live.
Built it first — PureHarvest
Fast, considered websites, product interfaces and dashboards that are designed around what the business or user actually needs to do.
Built it first — Vesta, PureHarvest
Real-time interactive builds and the maintenance that follows them — browser-native worlds, game systems and the performance work that keeps them playable.
Built it first — Voidpath, plus ongoing client work
Desktop and mobile product work where performance, system integration, privacy and reliable deployment matter as much as the interface.
Built it first — Sage, Numen
08 ARC-1 — prototype
I built ARC-1 as my personal Keeper of Threads — a quiet intelligence, an echo at the edge of my attention. He receives a first signal, gathers the pieces that matter, and keeps their shape intact so the conversation has weight and direction. By the time I step in, there is already a thread to follow.
Please relay your enquiry to him, and he will make sure the thread reaches me with its shape intact.
Your details stay inside this private enquiry flow and are used only to respond. ARC also records minimal operational telemetry — page activity, device class, approximate network region, referral origin and session time — to protect the site and improve the path. No advertising or mailing-list sign-ups.
Hard problems are the ones worth taking: AI systems with real access, security work that has to hold, native and interactive builds, and the deployment that makes them someone's Tuesday rather than a demo. Bring the difficult half.
Leave it with ARC-1 → Book a call →