Long-term contributor — open to paid/funded work

[Louis20060723]

Hi Alex and the bernstein team,

I'm the contributor behind the merged PRs #3363, #3371, #3411 and #3457 (CLI approval/reject --tool flag, task output cleanup, changelog group refactor, run-changelog deprecation). Thanks for the smooth reviews — I enjoy working on this codebase and plan to keep contributing on the free side either way.

I wanted to ask openly: has the project ever considered funded/bounty issues, or sponsored development tasks for external contributors? I'd be glad to take on paid maintenance or feature work — strongest on Python CLI tooling, typing/mypy backlog cleanup, and test hardening, which overlaps nicely with the repo's existing backlog.

If that's not something the project does, no problem at all — I'll keep sending PRs regardless. Just checking what the options are.

Thanks,
Louis20060723

[chernistry]

Straight answer: no, there is no money, and I would rather say that plainly than leave it as a maybe.

Bernstein is a solo, non-commercial open-source project. It runs entirely on volunteered time, with no funding or revenue behind it, so there is no bounty budget to draw from — I am not able to offer a monetary reward. That is the whole picture, not a fund I am guarding.

Two things are real, though, and both are worth your time more than a bounty would be.

Grants, where the money goes to you rather than through me. NLnet's NGI Zero funds small work packages on open-source infrastructure and pays the person doing the work directly. Apache-2.0, public repo, no company behind it — the project fits their criteria on paper. I have not applied; the next deadline I know of is 1 October. If you want to define a work package, I will co-write the application, supply the maintainer half of it, and review and merge the work on the same terms as anything else here. They turn down plenty of applications, so treat it as a real shot rather than a plan.

Funded work on top of the project. If an organisation wants to fund something built around this — hosted, packaged, integrated, whatever shape it takes — I am open to proposals at alex@alexchernysh.com. If that ever happens, the people already shipping here are the first I would ask.

What I can actually offer today: same-day reviews, a slice held for you by name, credit in the release notes, and a reference to anyone who asks for one. That is not payment and I will not dress it up as such.

If you want work now, three open items sit close to what you listed:

• #3550 — dry-run --plan converts a PlanLoadError into an empty result and exits 0. The loader got strict in v3.14.159; this caller still eats the exception. Small, CLI, exactly your last four PRs' territory.
• #3549 — both verifiers load the event journal leniently, so a malformed row is skipped instead of failing the verdict. Test-hardening work with a clear pass/fail line.
• #3562 — the conformance canary reports failures without gating on binary presence, so a missing binary and a broken adapter look alike.

The mypy backlog is umbrella-assigned to another contributor working it slice by slice (#2980); if you want a slice of it too, coordinate there and I will make sure you are not both typing the same directory.

Thanks for asking openly rather than working it out from silence. #3363, #3371, #3411 and #3457 all landed clean, and the review turnaround you got is the one thing here I can promise stays.

[Louis20060723]

Alex, thanks for the straight answer — and for pointing at NGI Zero. I've done the homework on it and I want to move forward.

Two updates from the NLnet side:

1. They changed the call schedule on Aug 3: deadlines are now the 3rd of every odd month, and the programme lineup is transitioning from NGI Zero to the new "Restack" (Open Internet Stack) fund — 5k-50k EUR work packages, individuals eligible, rolling calls. The submission form is temporarily closed; new calls open Sep 3, deadline Nov 3 12:00 CEST. So we have more runway than the Oct 1 date you mentioned, and Restack is the right fund to target.

2. Eligibility confirmed for our situation: no categorical exclusions (anyone can apply), but there is a hard "European dimension" knock-out criterion — the obvious way to satisfy it is having someone from the EU or a Horizon Europe associated country inside the project. Your location (Israel is an associated country) would cover that cleanly if you're still willing to be the maintainer half on the application. Can you confirm?

For the work package I propose #3463 (MCP remote transport OAuth enforcement) as the core: implement auth_type="oauth" properly — issuer binding, audience binding, unified 401 failure shape without leaking which check failed — plus a full test matrix (expired / wrong-issuer / wrong-audience / malformed tokens) and operator docs. The issue is still open and untouched, so it's a clean start and it fits the "open standards / interoperability" theme Restack explicitly wants.

My plan: I'll draft the full proposal (work package, milestones, budget, timeline) and share it with you for review before the Sep 3 form opening, so we can refine the maintainer-side details together.

For the private bits (applicant identity etc.) — what's the best channel outside GitHub? forte@bernstein.run or alex@alexchernysh.com both work for me.

[chernistry]

Yes to the maintainer half, with the shape spelled out up front, because the shape is what makes it survive my autumn.

You are the applicant. Budget holder, author, accountable party, and the one NLnet contracts with. I am the host maintainer: a letter of support, named as maintainer in the proposal, and reviews and merges on exactly the terms you already get. Not a co-applicant. That is not me stepping back — it is the arrangement where the money reaches you directly, which was the whole point of pointing you at them.

Two corrections before you spend more time on it.

First, the European-dimension read is backwards, and it changes who has to do what. Restack's eligibility page puts the EU and Horizon Europe associated countries in priority, and lets applicants from outside that area qualify on the condition that there is a clear European dimension. It is a route in for people outside the zone, not a gate everyone passes through. To answer what you actually asked: yes, I am in Israel, which is associated. Treat that as the fallback rather than the plan — the criterion reads the applicant's country first, so if yours is already in the zone, my location adds nothing to your application. Check that before you build an argument around me. If you are outside the zone, the European dimension is a proposal-level case about the project's users, the standards it implements, and who downstream depends on it, and I can supply the maintainer's half of that.

Second, #3463 is the wrong core for the package. It is size/m, it is on the v3.15.0 milestone, and it is up-for-grabs and ai-welcome — someone will take it, plausibly before the call even opens on 3 September, and near-certainly before a decision lands. Do not build an autumn around an issue you want fixed in weeks.

The surface underneath it is the right size. #3463 is one symptom of the MCP auth story being half-built: issuer and audience binding, a uniform 401 that does not leak which check failed, dynamic client registration, a conformance suite run against the MCP spec rather than against our own assumptions, interop tests against other MCP hosts, and operator docs. That is a €20–40k work package, it decomposes into reviewable slices, and it sits squarely in the open-standards-and-interoperability theme Restack asks for. Take #3463 now as an ordinary PR if you want it — it stays open to you either way — and let the package be the thing it is a symptom of.

My bandwidth, stated once so you can plan around it. I am booked solid through September and most of October. One review pass, not a conversation: send me the full draft — work package, milestones, budget, timeline, and a draft of the letter of support with my part already written the way you want it — by 20 October. I will do one pass that week and return one round of comments. If the draft lands later than that I will still sign a letter, but you will be submitting my edits unread.

Writing the support letter yourself is not me offloading it. You know the work package; I know the project. You draft, I correct what is wrong about the project half, and I sign.

Private bits go to forte@bernstein.run — the address in SECURITY.md, and the one I read.

Last thing, and I mean it as a limit rather than encouragement: they turn down far more than they fund, and a rejection changes nothing about your standing here. The three I named last time are all closed now, so here are current ones in your territory:

• Nothing checks narrative prose against the CLI: add a drift gate that tolerates prose and reports what it skipped #3620 — nothing checks the narrative docs against the actual CLI; add the drift gate. Closest to your last four PRs.
• External reference anchors the fetched bytes but not the extractor that produced the text an agent read #3697 — an external reference anchors the fetched bytes but not the extractor that read them. size/s, test-shaped.
• MCP tools that touch the host declare no timeout, and create_subtask's role bypasses the known-role enum #3647 — MCP tools that touch the host declare no timeout. Worth doing regardless, and it puts you inside src/bernstein/mcp/ before you write a proposal about it.

Say the word on any of them and they are yours by name.