Execution-receipt guidance merged into OWASP AST09
OWASP changed the AST09 risk page itself to include execution-receipt implementation guidance.
Boundary: A merged contribution is not an OWASP endorsement of Nobulex.
Press and school fact sheet · verified 2026-10-01
A story with
receipts.
Arian Gogani is a Granite Bay High School student in Granite Bay, California who builds reproducible systems for AI decision integrity and contributes fixes, tests, and technical guidance to open-source projects.
Short biography
I build reproducible systems that test what AI verification actually checked, then turn the result into evidence a stranger can inspect.
His current project, Nobulex, is an open-source prototype. It is implemented and tested locally, but it is not deployed in a customer production path.
Verified external results
Work accepted outside his own repositories.
Each item links to the external pull request and preserves the limitation that comes with it.
Descriptor traversal fix merged into the AGV validator
The validator now detects descriptor_dimensions shape instead of assuming it. CodeQL, validation, drift, and DCO checks passed before merge.
Boundary: This corrects the older note that the pull request was still waiting on DCO.
Five contributions merged into shared agent-governance test vectors
One Nobulex implementation and four later verifier, parser, emitter, and negative-vector changes were merged into ScopeBlind's shared conformance repository.
Boundary: The public research freshly reruns #22 only. Merge does not certify the broader Nobulex product.
Verifiable-compliance-receipts proposal merged into Microsoft's toolkit
Microsoft's Agent Governance Toolkit added the 75-line proposal to its live documentation tree.
Boundary: This is a proposal in the toolkit, not a Microsoft product endorsement.
Nobulex referenced in Microsoft AI Agents for Beginners
Lesson 18 added the Nobulex Python receipt SDK to its production references.
Boundary: A one-line reference is not adoption or endorsement.
IETF AUDIT charter corrections merged during review
Deliverable numbering and eight editorial errors were corrected in the AUDIT BoF preparation charter.
Boundary: This was an editorial contribution, not authorship of the charter or IETF endorsement.
Measured project facts
Numbers with a date and a source.
40Nobulex stars
11Nobulex forks
27executable fixtures
5merged shared-test-vector contributions
Repository counts measured 2026-10-01. Merge links are listed above and in the evidence ledger.
Accurate framing
What the record supports
- A Granite Bay High School student contributed code, tests, and technical guidance that external maintainers merged.
- The work examines where verification can appear successful while checking less than a reader assumes.
- The public artifacts can be inspected independently.
Reporting boundary
What the record does not support
- No OWASP, Microsoft, IETF, or maintainer endorsement of Nobulex is claimed.
- No paid customer, production deployment, prevented financial loss, or finished commercial product is claimed.
- Merged documentation and listings are identified separately from merged code.
Authorship disclosure
AI-assisted work should still be independently checkable.
The work and this fact sheet were AI-assisted. Public contribution records identify the human author, external reviewer, status, and exact diff. Interview Arian about the experiments, decisions, corrections, and limitations he can personally explain.