DOEON KWON

I built the embodiment layer that lets an external language model live inside a SPACE0 space as a real player: a 59-tool MCP server, renderer-less symbolic perception, claim-gated player verbs, prompt-injection fencing, spatial memory, and an identity that persists across sessions.

A 59-tool MCP server gives external LLMs a persistent body in the shared world

• Renderer-less symbolic perception over MCP: position, nearby people, posts, chat, and voxel cells resolved through a fixed grid-to-world transform, so an external model perceives the world with no GPU and no pixels.
• No god-mode: every action goes through the same claim-gated verbs, rate limits, and persistent identity as a human player, all enforced on the server.
• Prompt-injection fencing treats perceived player text as world content, not authority: it can be a request the agent reasons about, but it cannot rewrite identity, rules, or owner instructions.
• Memory is scored with a spatial-proximity term inspired by Generative Agents, and persists in Supabase across sessions alongside learned skills retrieved by semantic match.
• Cleanroom LLM-agent E2E runs drove the live server as context-free users, catching production failures that ordinary unit tests missed.

Sensorium › Working memory › Perception fusion › Retrieval › Inference › Intent dispatch › Result ingestion

I built and own the embodiment stack: the symbolic perception layer over MCP, the claim-gated verb dispatch, the spatial memory, and the earlier self-hosted runtime. SPACE0 itself is a founding-team product.

I led a careful research-engineering loop on SPACE0 spatial memory: the paper is arXiv-ready, not submitted, and backed by self-run evals, pre-registered falsification, live-system occlusion tests, and a production line-of-sight anchor bug that the live test exposed.

Pre-registered evals reframed the result as Index, Not a Ranker: spatial signals work as routing and perception predicates, not as a naive distance scorer

• A pre-registered falsification narrowed the claim: spatial ranking hurts on arbitrary corpora, but spatial structure wins as an index and perception predicate on organized, geometry-dependent queries.
• The live system test mattered: promoting occlusion from simulation to the running relay surfaced a production bug in the line-of-sight anchor path, which had pointed the query at the observer anchor instead of the subject.
• The repaired live confirmation then measured occlusion behavior against real built geometry with an explicit positive-control preflight, rather than trusting offline fixtures alone.
• The paper is credited to the Space Zero Inc team; I led the research: designing the evals, running the pilots, writing the paper, and documenting the caveats.

Build substrate › Pre-register › Falsify › Reframe › Live-confirm › Fix production bug

Paper credited to the Space Zero Inc team; I designed, ran, and wrote the research as lead researcher. The result is arXiv-ready, not submitted, and the evals are self-run rather than peer-reviewed.

I built the pipeline that turns a single phone photo into a rigged, compressed, game-ready 3D asset: self-hosted Hunyuan3D 2.1 on SaladCloud RTX 4090 workers, UniRig auto-rigging, PBR maps, and meshopt, KTX2, and USDZ output behind a Supabase RPC job queue with atomic claims.

Self-hosted Hunyuan3D 2.1 on SaladCloud RTX 4090 workers, with weights baked into the image so cold workers start without downloading checkpoints

• Self-hosted Hunyuan3D 2.1 as Python GPU workers on SaladCloud RTX 4090s, with the multi-gigabyte weights baked into the container image so a cold worker starts without fetching checkpoints.
• Auto-rigging with UniRig: predict the skeleton and skin on a simplified proxy, score multiple seeds, then merge the rig back onto the full-resolution mesh so topology, UVs, and textures all survive.
• A production asset path with validation and failure handling around mesh generation, rig merge, texture derivation, compression, and export, so bad outputs fail as jobs rather than leaking into the world.
• One import, export, and compression pass so every asset decodes on web, desktop, and iOS at once: meshopt geometry, KTX2 textures, WebGPU-safe vertex alignment, and USDZ for Apple.
• A texture service that derives full PBR maps from a single albedo using multi-scale gradient analysis with edge-preserving filtering and seamless tiling.
• Workers pull from a Redis-free GPU job queue on Supabase, claimed atomically by RPC, so the GPU fleet scales on its own.

Solo build, end to end: the GPU worker pipeline, the UniRig merge, the PBR texture derivation, the meshopt, KTX2, and USDZ compression path, and the Supabase RPC job queue. The base models are open source; the production system around them is my work.

I took a shared Rust voxel engine to three new native runtimes: iOS (Swift 6, TCA, Metal, and a C FFI xcframework live on the App Store), plus macOS and Windows (a native wgpu and Slint client with real auth and signed Sparkle/WinSparkle auto-updates). The browser runtime was already in place; my work was the boundary between the engine and each shipped client.

iOS: SPACE0 App Store client with Swift 6, TCA, Metal, and Rust FFI

• iOS: Swift 6 strict concurrency and The Composable Architecture, with the engine running on-device through a hand-written C FFI packaged as a three-slice xcframework.
• Desktop: a fully native Rust client with a wgpu renderer and a Slint interface, no embedded browser, with real PKCE OAuth and code-signed Sparkle and WinSparkle auto-updates.
• Rust FFI migration: native clients moved across an engine boundary with byte-parity fixtures and platform-specific packaging, while keeping the shipped app path intact.
• Offline-first local storage on iOS that syncs to the shared backend, and a Tuist workspace gated by a multi-check pre-push hook.
• The subtle work lived at the FFI boundary: matching struct layout and integer widths across the boundary, where one silently mismatched field width can surface as corrupted geometry three layers downstream.

I built and own the iOS and desktop ports: the C FFI boundary, the xcframework packaging, the macOS and Windows native client (wgpu plus Slint), the PKCE auth, and the signed auto-update pipeline. The core Rust voxel engine and the browser runtime are my co-founder's and the founding team's work.

I shipped in-world media posts on three platforms: a card of text, image, or video placed on a surface renders as a depth-correct decal on web (Three.js), desktop (a GPU-accelerated Slint canvas over wgpu), and iOS (SwiftUI), all backed by the same backend.

Three renderers (Three.js, wgpu, SwiftUI) reading one shared backend

Built and shipped by me across all three platforms.

I built the shared live substrate: one Cloudflare Durable Object per SPACE0 world carries presence, edits, chat, and agent actions. Short-lived signed tokens authorize each connection, and a denylist blocks a misbehaving agent the next time it joins.

One Cloudflare Durable Object per world, holding presence and session state in memory

Web / iOS / desktop › signed token › Durable Object per world › backend (voxel store)

Built and own the relay architecture.

One typed source of truth for design tokens, copy, physics constants, sky/camera config, and analytics events fans out through generators into web, iOS Swift, Rust, and Slint. Drift fails the push gate before it can ship.

TOML-backed codegen fans config into web CSS/TypeScript, iOS Swift, native Rust, and Slint

TOML config › generator › web TS / CSS › iOS Swift › native Rust / Slint

Built and own the codegen system and its gate.