I'm an AI-enabled product engineer. I start from the business problem, not the tool. Then I ship the fix end to end: data, back end, AI and UI.
- 🎯 How I work: find where the workflow hurts, pick the simplest tech, measure the result.
- 🏗️ Full stack: 5+ years of C# / .NET and Python, with React, Angular and Vue front ends.
- 🌍 Open source: 60 PRs, including Microsoft, JetBrains, Vercel and healthcare AI (MONAI, OHIF, OpenEMR, dwv, PyHealth).
- 🧭 Product: certified AI-native Product Manager (Pendo). I work AI-native with Claude Code.
- 🎓 Teaching: mentor for the World Bank-backed Edge Program. Also lead small teams and mentor juniors.
| 🧩 Agentic copilots Build apps, forms & workflows from chat · MCP server + client |
🧪 Code agents LangGraph · runs code in gVisor / Firecracker sandboxes |
| 📚 RAG & memory Embeddings · semantic search · knowledge-graph memory |
🔀 Multi-model routing LiteLLM · OpenAI + Claude · reasoner & verifier models |
| 🛡️ Safety & evals Guardrails · approval gates · replay tests · LLM-as-a-Judge |
💸 Cost & context Prompt caching · context compaction · per-call cost tracking |
| 📄 Document & media AI PDF & image vision · field extraction · transcription |
🏛️ Legacy modernization Agents read COBOL, PL/I, RPG, VB6, Delphi → rebuild specs |
PR status badges below update live from GitHub.
| Project | What I fixed | PR |
|---|---|---|
microsoft/agent-framework  Python boto3 Gemini SDK pytest |
Bedrock: a boto3 session set to eu-west-1 was sent to us-east-1 when BEDROCK_REGION said so. No error was raised. The session's region now wins. |
 |
Mistral: service_url now reports the endpoint of the injected SDK client, not the default URL. |
 |
|
Gemini: with an injected genai.Client, a bad env value such as GOOGLE_GENAI_USE_ENTERPRISE still crashed construction. Those settings are now skipped. |
 |
|
HKUDS/DeepTutor  Python LLMs |
Lesson prep broke on reasoning models when <think> blocks or prose wrapped the JSON. It now finds the JSON and retries once at the right effort level. |
 |
Responses API: strict gateways rejected status on replayed items such as function_call. It is now stripped from every item. |
 |
|
| Workspace: a failed probe-file delete escaped the request. Cleanup is now best effort. |  |
|
| Claude Code: system prompts over 32K characters failed on Windows with a misleading "not found" error. Long prompts now go through a file. |  |
|
crewAIInc/crewAI  Python pytest |
Files: expired-upload cleanup never called the provider's delete, because the lookup had already dropped expired entries. Expired files are now deleted. |  |
Telemetry: strings, numbers and None at the depth limit became repr() strings. Primitives are now kept unchanged. |
 |
|
A2A auth: a comma inside a quoted WWW-Authenticate value split the challenge. Parsing now respects quotes and escapes. |
 |
|
| Planning: replanned steps restarted at 1 and clashed with completed steps. Clashing steps are now renumbered. |  |
|
| CLI: after an upgrade, a cached yanked flag from the old version showed a false warning. The cache is now tied to the installed version. |  |
|
| Executor: every batch after a replan asked for another replan over failures already handled. Handled failures are now skipped. |  |
|
calesthio/OpenMontage  Python ComfyUI FFmpeg |
The ComfyUI video tool reported request defaults as output metadata. It now reports the real values probed from the file. |  |
tryAGI/LangChain  C# .NET RAG |
AddDocumentsFrom* helpers now take several data sources in one call for RAG ingestion. |
 |
| Project | What I fixed | PR |
|---|---|---|
Project-MONAI/MONAI  Python PyTorch pandas |
Data loading: CSVIterableDataset with shuffle=True returned every item twice per epoch on stream sources. The unshuffled pass now runs only when shuffle is off. Added a regression test. |
 |
OHIF/Viewers  TypeScript React Jest DICOM |
DICOM viewer: the segment stats card kept stale L/W values and eye state until re-hover. The React Compiler cached the service reads. The card now holds them in state and refreshes on SEGMENTATION_MODIFIED. |
 |
| Docs: the FocalLoss alpha docstrings did not describe per-class weights. They now match the merged behaviour. |  |
|
| Scrollbar: an inactive viewport's scrollbar kept a white focus ring. It now takes focus only when keyboard navigation is on. |  |
|
sunlabuiuc/PyHealth  Python ML EHR |
StageNet: nested visits longer than the fitted width were not truncated correctly. The processor now logs one warning per processor. |  |
ivmartel/dwv  JavaScript DICOM |
Charset: Korean DICOM strings coded as ISO 2022 IR 149 failed to decode. They now decode as EUC-KR. |  |
Performance: canvases read back with getImageData now use willReadFrequently, mainly for video frames. |
 |
|
| Tests: added a regression test for sequences that mix defined and undefined length items. |  |
|
Loading: URL loads take new timeout and timeoutRetries options. |
 |
|
Units: lengths from raw Imager Pixel Spacing now read mm (detector), not plain mm. |
 |
|
openemr/openemr  PHP EHR |
Errors: HTTP error responses carried no useful body. They now send the status text, and exception detail only when error display is on. |  |
🛠️ Developer tools · orca, thinkrail, nanocoder, next.js, claude-buddy, Crow
| Project | What I fixed | PR |
|---|---|---|
stablyai/orca  TypeScript Electron React Zustand |
Sidebar: a new bindable command collapses or expands every project at once. Before, each chevron had to be clicked. |  |
Jira: several connected sites all showed the same profile name. Each site now shows its host, like Ada (acme.atlassian.net). |
 |
|
Mobile: "Jump back in" rows showed only the branch, so two main rows looked the same. The repo name now shows on every row. |
 |
|
| Browser: an opt-in setting loads terminal links in the open browser tab instead of a new split pane. |  |
|
JetBrains/thinkrail  TypeScript Node.js WSL |
Windows: "Reveal in file manager" opened Explorer in a hidden window, with no error. The folder window now shows. |  |
Performance: editor lookup scanned a slow WSL PATH on the event loop and froze the host for seconds. It now pre-filters folders with async readdir. |
 |
|
Nano-Collective/nanocoder  TypeScript VS Code API DOMPurify |
Security: the VS Code chat webview now sanitizes markdown and blocks remote images. This closes an XSS and tracking-pixel path. |  |
| MCP: only the first content block of a tool result was read. Every block is now formatted, in order. |  |
|
Edit tool: string_replace missed matches in CRLF files. It now matches and keeps CRLF line endings. |
 |
|
vercel/next.js  TypeScript Node.js |
App Router-only builds returned 500 for client errors Next.js raised itself, such as a bad param or a bad Range. They now keep the 4xx status. |
 |
handsome-rich/claude-buddy JavaScript Electron PowerShell |
10 PRs for a Claude Code desktop companion. A floating pet with status badges, tool-permission allow/deny, Windows autostart and a packaged-exe fix. | #3–#13 |
Pienteger/Crow C# .NET PowerShell |
4 PRs for a build-cleanup CLI. --ig now protects removal targets, paths with spaces work, test teardown no longer fails, and a one-line installer. |
✅ #2–#5 merged |
🕌 Community & Islamic tech · quran.com, DeenTime, Ansari, Mihrab
| Project | What I fixed | PR |
|---|---|---|
quran/quran.com-frontend-next  TypeScript Next.js React |
Security: .env.example turned off TLS checks by default. New setups now keep TLS verification on. |
 |
DeenTime JavaScript adhan-js |
The prayer-time engine gave NaN or times hours off. I restored the solar math and checked it against adhan-js. |
 |
Fixed three tests that failed on main. |
 |
|
| a11y: calendar month buttons now hide decorative icons, name the grid they control and announce the new month. |  |
|
a11y: the 99 Names dialog now closes with Escape in browsers without showModal(). |
 |
|
| Search: 99 Names search now ignores diacritics and Arabic harakat. |  |
|
| a11y: the Tasbih counter announces when the target is reached. |  |
|
| Reset: the Tasbih display now refreshes after settings are reset. |  |
|
Ansari TypeScript Node.js PostgreSQL |
The API's Postgres pool had no error listener. A dropped idle connection became an uncaught exception. It is now logged and the dead client is discarded. |
 |
Mihrab TypeScript React Native Kotlin |
Arabic home-screen widgets were not RTL. I traced it to widget rows following the phone's locale, not the app's language. The maintainer shipped a fix based on it. |  |
CloudApper AI (a division of M2SYS Technology) — Senior Software Engineer · Jun 2026 – Present
- Built an AI app-builder copilot. It plans and builds apps, forms, workflows and dashboards from a chat, then checks its own work. Serves its tools over MCP and calls external MCP servers with per-user auth. (TypeScript, Fastify, Angular, Postgres, Redis)
- Built a sandboxed code agent on LangGraph. It writes and runs code in gVisor / Firecracker sandboxes, with human approval, web search and resumable runs. (Python, FastAPI, Angular)
- Set up multi-model routing through a LiteLLM gateway across OpenAI and Claude. Reasoner and verifier models review risky changes. Prompt caching, context compaction and per-call cost tracking keep spend in check.
- Building a dynamic agent engine in Python on the Claude Agent SDK, LangGraph and LiteLLM. It turns a plain instruction into an agent with its own skills, tools and code sandbox. A router agent picks the simplest path.
- Added per-user shared memory across the Marketing, Lead Gen and Sales agents. Customer context carries from one agent to the next.
- Shipped a run-deliverables API with SSE streaming and REST retrieval. Users see live progress, and dropped streams recover cleanly.
- Moved agent permissions into the tool layer: pre-scoped tool wrappers and human approval on destructive actions. Also blast-radius limits, self-evaluation, policy guardrails and replay tests.
- Built AI connectors for the no-code platform: RAG knowledge bases, semantic search, field extraction, media transcription and a code-agent plugin. (.NET)
- Architected Legacy → CloudApper Transform. A Director agent, 4 domain Supervisors and specialist agents read COBOL, PL/I, RPG, VB6 and Delphi code. They produce validated SRS documents. (.NET 10, Python, Kafka, LiteLLM, GCP)
- Red-teamed a multi-tenant MCP platform for prompt injection, tool-result poisoning and cross-tenant access. Findings led to sandbox isolation, read-only DB fallback, query sandboxing and workload identity.
- Designed A2A agent swarms and serverless agents such as OpenClaw for HIPAA, SOC 2 and GDPR customers. Agents spawn with least-privilege tools, retry on failure, then hand off to a human.
Vivasoft Limited — Software Engineer, Level 2 · Aug 2021 – May 2026 (4 yrs 10 mos)
- Built AI agent microservices with LLMs, RAG, auto SQL generation and vector DBs. They plug into C# .NET Core platforms via gRPC.
- Engineered .NET Core microservices (SOA, Clean Architecture, CQRS) for healthcare and HR platforms.
- Built Python FastAPI services and Azure Functions ETL pipelines. They turn messy documents and third-party data into clean records, with retries and clear errors.
- Automated a workflow across several services, cutting manual effort by over 70%.
- Built a central SSO service with Redis for 60K+ users.
- Built eval and test setups: golden datasets for LLM evals, k6 load tests, Grafana dashboards.
- Cut latency ~20% with Redis caching and SQL tuning. RabbitMQ background jobs gave 30% faster responses.
- Ran CI/CD, Docker and Kubernetes (ACA/AKS) with least-privilege IAM.
- Led small project teams and mentored juniors on agent orchestration and back-end design.
|
Multi-agent code modernization
|
Agent safety · red-teaming
|
|
Agentic workflows · HIPAA, SOC 2, GDPR
|
Human-in-the-loop extraction
|
|
HIPAA-regulated · production
|
🧠 Self-Orbit — Personal intelligence platformOpen source
|
|
Enterprise · 800+ companies
|
Open NLP research
|
|
|
|
|
Languages
Back end & front end
Data, AI & ML
Cloud & DevOps
Tools
Full tool list
| Area | Tools |
|---|---|
| 🧑💻 AI-native workflow | Claude Code, custom Claude skills, MCP servers, AGENTS.md-driven repos, AI-assisted specs and code review |
| 🤖 Agent frameworks | Claude Agent SDK, Microsoft Agent Framework, OpenClaw (serverless agents), LangGraph (checkpointers, interrupts), LangChain (Python & C#), OpenAI SDKs (Python, .NET), MCP TypeScript SDK |
| 🔌 Agent protocols | MCP (servers, clients, per-user auth, tool tiers, deferred tool loading), A2A |
| 🧠 LLMs | OpenAI, Azure OpenAI, Claude, Gemini, Hugging Face Transformers, mT5, PyTorch |
| ⚙️ LLM ops | LiteLLM gateway (routing, fallback, caching), multi-model tiers (reasoner, verifier), prompt caching, context compaction, token budgets, cost tracking, SSE streaming |
| 🏃 Agent runtime | gVisor and Firecracker sandboxes, E2B, tool calling (parallel), human-in-the-loop approvals, resumable runs, thread memory, knowledge graphs, web search (Tavily) |
| 🔎 RAG & search | Embeddings (Jina, OpenAI), hybrid search, semantic search, OpenSearch, Solr, Milvus, vector DBs, Neo4j graph DB, Postgres full-text search, auto SQL generation |
| 📄 Document & media AI | Azure Document Intelligence, OCR, Gemini extraction, PDF and image vision, Office file parsing, audio and video transcription, structured output |
| 🛡️ AI safety & evals | Approval gates, least-privilege tools, policy guardrails, red-teaming, PHI scanners, LLM-as-a-Judge, self-evaluation, replay tests, golden datasets |
| 📡 Observability | OpenTelemetry, Langfuse, Azure App Insights, Grafana |
| 🟣 .NET | ASP.NET Core, Web API, EF Core, Dapper, gRPC, YARP, Hangfire, plugin-based connectors |
| 🐍 Python | FastAPI, Pydantic v2, LangGraph, SQLite, pytest, pytest-asyncio, Jupyter |
| 🟩 Node.js | TypeScript, Fastify, Zod, pnpm, Turborepo, Vitest |
| 🎨 Front end | React, Next.js, Angular, Vue, TypeScript, Tailwind CSS, Framer Motion, Radix UI, Nx monorepos |
| 📨 Messaging | RabbitMQ, Kafka, event-driven systems |
| 🔗 Integrations | Webhooks, ETL batch and stream pipelines, partner data ingestion, Gmail API, no-code plugin connectors |
| 🗄️ Databases | PostgreSQL, SQL Server, SQLite, MongoDB, Redis, Upstash |
| ☁️ Cloud | Azure (ACA, AKS, Functions, App Insights), AWS (S3), GCP (GKE), Vercel |
| 🚢 DevOps | Docker, Kubernetes, Terraform, GitHub Actions, GitLab CI, Jenkins |
| 🏛️ Architecture | Microservices, SOA, Clean Architecture, CQRS, DDD, event-driven design |
| 🧪 Testing | xUnit, NUnit, Moq, TDD, pytest, Vitest, k6 load testing, contract tests, LLM replay tests |
| 📜 Governance | OWASP Top 10 for Agentic Apps, NIST AI RMF, EU AI Act, HIPAA, SOC 2, GDPR |
- 🧭 Pendo Learning Lab (Nov 2026): Becoming an AI-native Product Manager · Product Judgment.
- 🎤 Industry Expert & Mentor, Edge Program (World Bank / Govt. of Bangladesh). Taught Python, GenAI and back-end deployment.
- 🎓 Aspire Leadership Program, Harvard University.
- 🏆 Top 5% in C# and OOP on LinkedIn (1M+ people).
- 📜 HackerRank: Problem Solving, C#, SQL, Java.
- 📜 KodeKloud: Docker, Jenkins · Coursera: Machine Learning.
- 🧩 800+ problems solved on online judges.
- 🎓 B.Sc. in Software Engineering, Shahjalal University of Science & Technology (CGPA 3.61 / 4.00).
