• 🔭 I’m currently working on "artist-safety", a clinical decision support AI project, and building a deep learning application for fake object detection.
  * 👯 I’m looking to collaborate on Multi-Objective Reinforcement Learning (MORL) research and developing generalist RL agents across practical sectors.
  * 🤝 I’m looking for help with optimizing model training environments and scaling complex reward functions.
  * 🌱 I’m currently learning advanced Deep Learning techniques, Reinforcement Learning frameworks, and working towards publishing SOTA-advancing research papers.
  * 💬 Ask me about Python, ARMv7 Assembly, Deep Learning, and my absolute fascination with modern wooden furniture design.
  * ⚡ Fun fact I manage to balance training complex AI models with taking care of a chaotic three-month-old kitten.

A privacy-preserving fraud-detection network for commercial banks — targeting duplicate financing and trade-based money laundering, the fraud class that lives between institutions where no single bank's controls can see it.

Banks will never share customer data — and they don't need to. A SHA-256 hash of an invoice number matches across institutions without revealing the invoice to anyone. Share signals, never data.

What it does, end to end: multimodal AI extraction (Gemini) with per-field confidence → a fail-safe confidence gate (missing confidence fails, never passes; the model can never approve itself) → accountable human review with authenticated reviewer identities → cryptographic anonymization at the node boundary → scored cross-institution signal matching with explainable, regulator-defensible reasoning → one-click compliance exports.

Engineering signals: 200+ automated tests across the product and its reference implementation · 6 additive-only migrations with defensive-read deployment ordering · token-governed design system (WCAG AA) · full verification bar (type-check + tests + build + post-deploy production probes) on every push.

🎯 Try it without signing up: the public demo runs the actual production gate function and real SHA-256 hashing in your browser — drag a confidence score below the bank's threshold and watch the system fail safe.

Consortium AI is a commercial B2B platform whose codebase, schemas, and architecture are the core IP (Copyright © 2026, All Rights Reserved). I keep the source private the same way the product keeps bank data private — by policy, enforced consistently. What I publish instead:

• 📖 A deep-dive case study — problem, architecture, and security properties an evaluator can verify from outside the codebase
• 🔍 A public security architecture page with boundary behaviors anyone can probe (try POSTing a raw identity field to the consortium inbox — the API rejects it)
• 🧪 The live product and in-browser demo

Source review is available under NDA for enterprise evaluation and serious technical conversations — email with subject NDA.

• Zero-data-exposure, hash-based architecture — identities cross trust boundaries only as SHA-256 hashes, enforced at the receiving API and verified end-to-end against source documents
• Accountable multi-tenant systems — Postgres row-level security as the isolation floor; rank-based roles where corrupt data coerces down, never up; entitlements always server-resolved
• Immutable actor-attributed auditing — append-only trails where every event names the human, the authenticated reviewer, or the API key that caused it
• Fail-safe AI engineering — LLM output treated as untrusted in both directions: injection-guarded prompts in, defensively normalized and re-gated data out; provider-resilience layers (model-retirement-proof aliases, backoff, capacity failover) so upstream chaos never reaches users
• Honest software — designed empty states, capability-derived status (never a decorative "all systems operational"), and errors that tell the truth

TypeScript Next.js 15 React Node.js Python FastAPI PostgreSQL + RLS Supabase Stripe Turborepo Tailwind Gemini / LLM integration Vitest pytest Vercel

Live in production: devidentity.fabbythemes.com · Deep-dive case study: DevIdentity Public Case Study

An autonomous, privacy-preserving aggregation network that pulls a developer's work from 10+ platforms (GitHub, Kaggle, Hugging Face, LeetCode, arXiv, Google Scholar, …), normalizes it into one universal identity model, runs evidence-based AI analysis, and publishes a living, recruiter-verifiable portfolio — including a Judge Console that lets recruiters check code authenticity, not just take it on faith.

Engineering signature — the patterns the platform is built on:

• 🛡️ Defensive Server-Side Gating — middleware as the single page gate with an explicit public allowlist; every API route independently re-verifies the session and resolves entitlements from the database. Client-side gates are presentation; the server gate is the law.
• ⏱️ Automated Token-Backed Rate Limiting — per-user, per-endpoint daily quotas with full usage attribution (endpoint, tokens consumed, model used), where the same metering table doubles as the admin analytics source. One mechanism, two features.
• 🔏 Immutable Actor-Attributed Verification — commit-authorship checks graded against GitHub's public contributor statistics and fork-provenance badges cached with timestamps on the records they describe. Graded, neutral, evidence-backed signals — never accusations.
• 🔀 Provider-Agnostic AI Fallbacks — a single generation layer (Gemini-primary, Groq automatic fallback, Claude for premium tasks) where feature code never imports a vendor SDK, every persisted output is stamped with its concrete model ID and prompt version, and a JSON repair ladder salvages malformed model output instead of failing the request.

Under the hood: Next.js 16 App Router · TypeScript · Turborepo + pnpm monorepo · Supabase (Postgres, strict RLS, PKCE auth) · Stripe tiered billing (webhook as the sole writer of paid state) · Sentry · Vercel, custom-domain routed.

DevIdentity is a commercial product, not a portfolio exercise — the parsing engines, prompt systems, verification logic, UI system, and database schemas are core IP, held privately under a strict all-rights-reserved license.

What's public instead is deliberately chosen to be more useful for evaluation than raw source:

Enterprise evaluation, licensing, or a guided code walkthrough under NDA: abuahmad105116@gmail.com.

What I'm strongest at:

• Enterprise SaaS architecture — monorepo discipline, pure-logic/I-O separation, universal normalization layers, additive zero-downtime schema evolution
• Security engineering — RLS-first data access, defense-in-depth auth, signature-verified webhooks, hardened CSP, two-direction prompt-injection guarding
• Applied AI systems — evidence-only prompting, prompt versioning, defensive output normalization, cost engineering (content-hash diffing, precondition gates, hard input caps)
• Product operations — Stripe billing lifecycles, OAuth/domain cutovers, launch runbooks, observability wired-but-inert until activated

1. Trust is the standing decision filter. Anything that would show fake data, trust client input, or skip a server guard doesn't ship — regardless of how fast it would.
2. Degrade gracefully, always. Live data when the source is reliable; an honest, polished fallback when it isn't. A broken zero is never rendered as real data.
3. Runbooks over memory. Every manual operational step gets written down as a numbered runbook section the day it's discovered — launches are executed, not improvised.