Software Engineer — Rust · protocol security · compiler correctness · Python

Systems analyst in the Brazilian federal court system (15+ years), now working on protocol security, quantum-compiler correctness, and Rust tooling. I care about the difference between software that looks right and software that is right: real tests, validation against references, and honesty about a program's limits.

Qiskit issue #16594 — CommutativeCancellation cancelled a three gate sequence that equals an X down to an empty circuit at optimization level 2 and above, silently changing measured results. No error, no warning.

I found it with a differential fuzzer I wrote, reduced it to three gates, characterized the fault surface across thousands of angles and pointed at the failing line. Confirmed by a core maintainer, milestone 2.5.1, fixed in PR #16599. I got the root cause wrong on the first try and said so in the thread.

Authentication attached to a message gets silently removed when a conformant intermediary parses that message and rebuilds it from the fields it understood. No attacker at the moment of removal, no error, no warning. I characterized the class, then measured it against real software: MAVLink relays, DDS bridges, CAN / ISO-TP gateways, SOME/IP gateways, gRPC-JSON transcoders (Envoy, grpc-gateway, ConnectRPC), and DICOM de-identification. Several runs argued against my own thesis, and I kept the ones that did.

Two IETF Internet-Drafts, a CWE submission, threat-catalogue entries written to paste into ISO 21434 and FDA 524B files, and a preprint (doi:10.5281/zenodo.21840073). Latest write-up: DICOM de-identification silently strips image provenance.

• CleitonForge — the differential fuzzer that found the bug above. Weighted generator aimed at the numeric thresholds a compiler actually branches on, a shrinker that reduces a failure to a minimal witness, and an oracle layer that cross-checks every verdict against the exact operator before calling anything a bug.
• nqf-lint — pre-flight linter for quantum-chemistry setups. Rust core + Python bindings (PyO3), published on both registries. cargo install nqf-lint · pip install nqf-lint
• CleitonQ — post-quantum authentication for embedded systems: no_std Rust implementing FIPS 203/204/205, protocol formally verified in ProVerif and Tamarin, written up as two individual IETF Internet-Drafts.
• async-graphql-dataloader — DataLoader for async-graphql in Rust, for the N+1 problem. 1,100+ downloads.
• validation-gate — a gate that refuses the shortcuts behind irreproducible ML-for-science claims: hash-sealed pre-registration, a mandatory trivial baseline, a blind holdout counted in a ledger. I ran it on my own research first and it failed 0 of 5. pip install validation-gate

Quantum Rust: Complete Bundle (Leanpub) — Quantum Circuit Benchmarking in Rust and Quantum Computing for Rust Developers.

Languages: Rust · Python · Java · SQL / PL-SQL Rust: async · unsafe · PyO3 · no_std · published crates Testing: differential and property-based testing · fuzzing · shrinking Backend: REST APIs · FastAPI · Docker · CI/CD · Linux Java stack: Spring · Hibernate · Maven · JBoss / WildFly Databases: Oracle · Adabas

Guitarist & pianist.

• Email: augusto.cleiton@gmail.com
• GitHub: @cleitonaugusto
• Writing: dev.to/@cleiton_augusto_
• LinkedIn: Cleiton Augusto Corrêa Bezerra

_{Open to fully remote work — Rust, compiler and correctness tooling, backend, and scientific/technical software.}