Gustavo Widman

Gustavo Widman

Software Engineer II (Rust) at Azion, edge/CDNSão Paulo

systems under load. rust on the hot path. infrastructure that doesn't drift.

I build fast, measurable systems in Rust. By day I work on Azion's edge/CDN platform. On my own time I write network stacks from raw sockets up, benchmark my reverse proxy against nginx and HAProxy, and research how far autonomous coding agents can take program optimization. I care about the number, not the claim.

gustavowidman@gmail.com
Fig. 0Latency by percentilems, lower is better
upstreamernginx, 1 worker (next best)other proxiesbackend, no proxyoha · 50 conns · 500k req · one 14-core macOS host, loopback · x log-spaced

PreprintAn empirical study of unattended multi-agent program optimizationWidman, Ribeiro SilvaSSRN, Oct 2026doi:10.2139/ssrn.7610439

01

Selected work

Three builds where the number is the point. Every figure is measured and carries its condition.

W-01

upstreamer

L7 reverse proxy · hyper + tokio

Lang
Rust
Target
Kubernetes
Write-up
2026-04-27
Source

Routes by host and path, balances on EWMA latency, rate-limits each client IP with a token bucket, discovers upstreams from Kubernetes and swaps its whole config lock-free through ArcSwap without dropping a connection. Benchmarked against the proxies people actually run. A bimodal 40 ms tail turned out to be Nagle meeting delayed ACK: six attempts to find, one line to fix.

  • Active + passive health checks
  • Prometheus metrics, separate port
  • jemalloc, ~6% CPU was in malloc
  • Per-IP token buckets
ParameterConditionValue
Throughput50 conns, 500k req50 conns, 500k req76,663req/s
Latency, p99.99lowest of all proxies testedlowest of all proxies tested3.81ms
p99.99 before fixNagle + delayed ACKNagle + delayed ACK41ms
Concurrency cap100% 2xx, same as backend100% 2xx, same as backend4,800conns
Fig. 1.1Throughputreq/s, higher is better
upstreamer76,663
HAProxy70,503
nginx, auto69,477
nginx, 1 worker68,637
Caddy66,195
Apache57,518

Same harness as Fig. 0. Backend alone, no proxy: 154,998 req/s.

Fig. 1.2p99.99 per attemptms, from the write-up
041
141
241
341
441
541
64.15

Attempts 1–5 (jemalloc decay, metrics thread, CPU pinning, ArcSwap removal, string alloc) left the tail at 41 ms. Attempt 6 was one line: set_nodelay(true).

W-02

udp · tcp · http

Network stack from scratch

Lang
Rust
Target
raw sockets · TUN
Write-up
udptcphttp
udp-impltcp-implhttp-impl

Written bottom-up. UDP over raw sockets with hand-built headers and checksums. A userspace TCP over a TUN device, on Linux and macOS utun, that interoperates with the kernel's own nc. Then HTTP/1.1, client and server, on top of that homemade TCP.

ParameterConditionValue
TCP state machineRFC 793RFC 793happy path
Closesimultaneous closesimultaneous closehandled
InteropLinux TUN, macOS utunLinux TUN, macOS utunkernel nc
DNSown client
HTTP crates0
Fig. 2Block diagrameach layer built on the one below
http-implHTTP/1.1 client + serverchunked transfer · own DNS client
tcp-implTCP, userspaceRFC 793 state machine · RFC 1071 checksums
udp-implUDPhand-built headers + checksums
devTUN · utunLinux · macOS
devraw socket
kernelhost network stackinterop verified against nc

Hatched blocks are written from scratch.

W-03

based-kernel

x86-64 kernel

Lang
Rust no_std · asm
Target
x86-64, bare metal
Write-up
2026-03-04
Source

A kernel in no_std Rust. A hand-written assembly bootstrap builds the four-level page tables, identity-maps 1 GiB with 2 MiB pages, enables PAE and jumps to long mode. Rust takes over from there: a heap allocator, interrupt-driven keyboard input and VGA output.

ParameterConditionValue
Boot pathhand-written asmhand-written asmPAE → long mode
Page size4-level tables, PS=14-level tables, PS=12MiB
Identity map512 × 2 MiB512 × 2 MiB1GiB
Driverskeyboard via interruptskeyboard via interruptskeyboard, VGA
Fig. 3Page-table walk at bootbuilt in assembly
  1. L4PML4512 GiB per entry
  2. L3PDPT1 GiB per entry
  3. L2PD2 MiB per entry, PS=1
  4. map512 × 2 MiB= 1 GiB, identity

Boot sequence

  1. asm bootstrap
  2. page tables
  3. PAE on
  4. long mode
  5. Rust, no_std

With 2 MiB pages the walk stops at the page directory; no L1 tables are needed.

02

Research

How far unattended agents can push program optimization, and the systems underneath.

PreprintSSRN, Oct 2026

Volund An empirical study of unattended multi-agent program optimization

Gustavo Widman, Laiza Ribeiro Silva

Three unattended multi-agent campaigns on a synthetic C++20 range-statistics engine finished 2.24×, 4.55× and 5.45× faster than the seed. One of them also showed about 9.7% higher latency on a shifted sparse-query workload, and the paper keeps that regression in view.

Fig. 4Volund, final program vs seedspeedup, ×
campaign 12.24×
campaign 24.55×
campaign 35.45×
sparse-query shift+9.7% lat.

Dashed line: the untuned seed (1×). The hatched row is the regression the paper reports: one campaign had about 9.7% higher latency on a shifted sparse-query workload, drawn at 1 / 1.097.

Under reviewno public code yet

FerriSync rsync, redesigned for multi-gigabit links

rsync's 1996 algorithm is CPU-bound on multi-gigabit links. FerriSync redesigns delta computation around content-defined chunking, cache-aware lookup and multiple cores.

modernizing rsync for the multi-gigabit era

In progresspaper forthcoming

gungnir Does the language matter to a coding agent?

A benchmark of coding agents across ~8 programming languages, model families and reasoning-effort levels.

03

More work

Two embedded builds, then the smaller things, one line each.

W-04

glassjaw

Acoustic glass-break detector

Target
ESP32 · FreeRTOS
Source

I2S microphone to log-mel spectrogram to an int8 CNN, as a FreeRTOS pipeline over a lock-free ring buffer. The ONNX runtime is written from scratch, because the real one does not fit in 520 KB of RAM.

ParameterConditionValue
Weightsint8 CNNint8 CNN14KB
AUCint8, 14 KB modelint8, 14 KB model0.93
Inferenceon deviceon device787ms
ONNX runtimeown, fits 520 KB RAMown, fits 520 KB RAM~700lines
Fig. 5On-device budgetESP32

Weights vs RAM14 / 520 KB

int8 weights 2.7%rest of RAM

Compute time833 ms

log-mel spectrogram 46 msint8 CNN inference 787 ms

W-05

iris

Matter-to-Bluetooth bridge

Target
ESP32-S3
Write-up
2026-10-29
Source

Puts cheap Bluetooth LED strips into Apple Home over Matter. The strip's BLE frame was reverse-engineered, and the color correction was validated over the whole RGB cube, not a sample of it.

ParameterConditionValue
Inputs validatedevery 24-bit RGB valueevery 24-bit RGB value16,777,216
BLE framereverse-engineeredreverse-engineered7bytes
Home protocolMatter
Fig. 6BLE color framereverse-engineered
+0+1+2+3+4+5+6
69960502RGB
fixed headercolor, 8 bit each

Color correction checked against all 16,777,216 RGB inputs.

Smaller builds

ProjectWhatFigureContext
pantheonAlways-on agent harness in Rust, shipped as a NixOS module: durable memory, background sub-agents, crash recovery, MCP over stdio and HTTP.48releaseslatest v0.21.3
nixOne flake for 6 machines, servers to a headless Mac mini for agents: agenix secrets, mesh VPN, mail, DNS, a self-hosted Tailscale DERP relay.779commits
1brcOne billion rows aggregated with mmap, memchr and fixed-point parsing. No platform intrinsics.~1.4sM3 Max
rinha-de-backendPostgres replaced by tuned SQLite inside a 1.5 CPU / 550 MB limit.2,917req/s~8.6× the target
rnn-rustZero-dependency RNN with const-generic shapes; the win came from removing allocations.~60×vs PyTorch, small dataset
crates.iorig-dyn and easy-config-store, published crates.~4.9kdlcombined downloads

04

Writing

Long-form, lowercase, with the numbers left in.

  1. bringing cheap bluetooth leds into apple home

    i wanted my existing led strip in apple home. that turned into a Matter bridge, a webcam experiment, and a very opinionated color correction.

    5 min
    • esp32
    • matter
    • bluetooth
    • embedded
    • reverse-engineering
    • apple-home

    16,777,216 RGB inputs checked

  2. i want to stop babysitting the loop

    FerriSync got me attached to an optimization problem. Volund got me thinking about what happens when trying the next hypothesis no longer needs me at the keyboard.

    8 min
    • ai
    • agents
    • optimization
    • software-engineering
    • volund
    • ferrisync

    2.24–5.45× final programs vs seed

  3. building a reverse proxy in rust: the "doing it properly" version

    what started as a quick weekend project turned into a reverse proxy that beats nginx, haproxy, caddy, and apache in both throughput and tail latency.

    12 min
    • rust
    • networking
    • hyper
    • kubernetes
    • systems-programming
    • reverse-proxy
    • load-balancing

    41 → 4.15ms p99.99, one-line fix

All 14 posts

05

About

B.S. Computer Engineering, Inteli (Instituto de Tecnologia e Liderança), São Paulo. Graduating December 2026.

Experience

PeriodRole
2026-04now

AzionSoftware Engineer II (Rust)

Rust systems for edge/CDN workloads: throughput, latency and operational reliability; CDN internals on performance-sensitive paths.

2025-042025-12

CamelSecTechnical Lead, Security Infrastructure

Led infrastructure, tooling and security operations for a security consultancy: penetration tests and red-team engagements for enterprise clients, a reproducible NixOS fleet (10+ machines), WireGuard networks for isolated client workloads.

2021-012025-04

MW APP IT ConsultingSoftware Engineer

Led teams delivering systems for CESP, Hunter Douglas and CETESB; up to 2.43× faster database queries across MS SQL, MySQL and SQLite.

2023now

EchoSecPresident, cybersecurity student league

Runs CTFs and workshops; mentors on Linux, binary exploitation and offensive security.

Open source