# Subhan Zari Ghanvi — Exhaustive Technical Portfolio & Architectural Knowledgebase (llms-full.txt)

> Head of AI Engineering | AI-Native Orchestrator — Shifting Enterprise Delivery from Months to Days | Bank-Level Security & Compliance

- **Canonical Website**: https://me.intrepidtech.net/
- **Concise AI Manifest**: https://me.intrepidtech.net/llms.txt
- **Executive Resume PDF**: https://me.intrepidtech.net/cv_print_preview.pdf
- **Email**: subhan.z.g@gmail.com
- **Phone**: +92 322 3519556
- **Location**: Karachi, Pakistan
- **LinkedIn**: https://linkedin.com/in/subhanzg
- **Privacy Policy**: https://dev.intrepidtech.net/privacy-policy/

---

## 1. Executive Profile & Philosophy

Transitioned from a 20-year web veteran and SaaS founder to an AI-Native Orchestrator. I orchestrate agentic swarms to deliver secure, production-grade enterprise ecosystems in days, not months. Over 20 years of technical evolution—from bootstrapping a global framework to leading digital transformations for major financial institutions—I operate at the intersection of extreme speed, rigorous governance, and architectural ingenuity, guaranteeing the delivery of fully functional, production-ready systems within a standard 7-14 days.

### Core Engineering Pillars
#### 1.1 The 14-Day Production Mandate
If an architecture cannot be production-ready and fully audited in two weeks, it is over-engineered. We build modular, battle-tested foundations designed for rapid deployment.

#### 1.2 SaaS Disintermediation & Hybrid Scaling
Building enterprise platforms for 4,500+ users on a $0 incremental server budget by ingeniously pairing serverless execution with existing corporate cloud assets.

#### 1.3 Strategic Model Tiering
Utilizing highly optimized, cost-efficient, current-generation AI models for high-precision logic to keep operational costs near zero, reserving massive premium models for high-value reasoning anomalies.

#### 1.4 The 'Least-Effort' UX
User input is a design failure. I architect systems that listen, see, and predict using edge capabilities to reduce human operational friction to near zero-tap interfaces.

#### 1.5 Secure-by-Design (Day 1)
Injecting banking-grade compliance, multi-tier RBAC, and robust end-to-end encryption schemas into the first 24 hours of any system blueprint.

---

## 2. Technical Mastery Matrix

### AI Orchestration & Intelligent Systems
- **Autonomous Swarms & Workflow Orchestration** (98% proficiency)
- **Bilingual Urdu-English NLP Speech Parsing** (95% proficiency)
- **Structured JSON Schema Output Constraints** (96% proficiency)
- **AI Auto-Triage & Clinical/Statutory Guardrails** (95% proficiency)
- **Multimodal OCR & Scenario Extraction** (94% proficiency)

### Cloud, Infrastructure, & DevOps (SRE)
- **Sovereign VPS Hosting & Bridge Isolation** (96% proficiency)
- **Docker Socket Proxy & Jail Permissions** (97% proficiency)
- **Bun 1.1, Go 1.24 & Alpine Container Tuning** (96% proficiency)
- **WireGuard VPN & Raw TLS TCP Protocols** (95% proficiency)
- **CI/CD Automations (Fastlane & Google APIs)** (94% proficiency)

### Enterprise Stack & Interactive Web/Mobile
- **Next.js 15/16, React 19 & SvelteKit 5 (Runes)** (96% proficiency)
- **Flutter Cross-Platform Engines (Riverpod)** (95% proficiency)
- **Passkey Biometrics (WebAuthn/FIDO2) & AES-GCM** (95% proficiency)
- **Row-Level Security (RLS) & DB Context Poolers** (94% proficiency)
- **Chrome Manifest V3 Extensions & Canvas Editor** (93% proficiency)
- **Smart IoT Integrations, BLE GATT & Cast SDK** (94% proficiency)
- **WebUSB ESC/POS & WebSerial Binary Compilers** (92% proficiency)
- **Astronomical Math & Bidirectional LTR/RTL Guards** (93% proficiency)

### Ancillary System Competencies
- Next.js 16 (App Router)
- React 19 & SvelteKit 5
- Node.js (Fastify / Express)
- Go 1.24 & Python FastAPI
- SQLite WAL & PostgreSQL 16 RLS
- Docker Compose & Bridge Isolation
- Nginx Proxy & HSTS Hardening
- Google Apps Script V8 & GAM
- Firebase (Functions v2, Firestore, Auth)
- FIDO2 / WebAuthn Passkeys
- WireGuard & Linux Netlink
- BLE GATT (IEEE 11073)
- AMP for Email
- Apple TestFlight & Fastlane
- Schema.org JSON-LD & AI GEO

---

## 3. Complete Catalog of 30 Engineered Production Systems

### 3.1 AuraSpend (auraspend) — [Flagship #1]
- **Tagline**: Multimodal AI Expense Tracking & Family Sync App
- **Categories**: AI/ML, Mobile, FinTech
- **Live URL**: https://auraspend.intrepidtech.net
- **Case Study Document**: auraspend-technical-case-study.md
- **Executive Summary**: Offline-first mobile financial tracker capturing transactions via local AI receipt OCR, voice, and 24/7 notification sync.
- **Quantified Business Impact**: ROI: Reduced database server costs to $0/month via offline-first Google Drive family delta synchronization.
- **Key Engineering Parameters**:
  - **Total Codebase Size**: ~77,500 Lines
  - **Supported Currencies**: 177+ Countries
  - **Global Locales**: 17 Languages
- **Problem & Architectural Challenge**:
  Manual expense entry causes over 80% user drop-off within two weeks, while cloud-hosted financial aggregators expose sensitive banking history and incur recurring database hosting fees.
- **System Architecture & Technical Milestones**:
  - Architected a dual-mode native Android NotificationListenerService and iOS WidgetKit/App-Intents pipeline that ingests banking alerts locally in real time.
  - Engineered a multimodal Gemini 2.5 Flash-Lite pipeline for bilingual English/Roman-Urdu voice parsing and receipt OCR with a 0-100 confidence Smart Merge Engine.
  - Built a serverless multi-user family synchronization engine over Google Drive AppData using SHA-256 delta hashing and tombstone reconciliation.
- **Verified Outcomes**:
  - Eliminated 90% of manual bookkeeping effort across 177+ currencies and 17 localized languages.
  - Achieved $0/month backend database overhead while maintaining full user data sovereignty.
  - Shipped production Android Play Store and iOS TestFlight releases verified by 424 automated tests.
- **Technology Stack**: Flutter 3.41, Riverpod, Gemini 2.5 Flash-Lite, Hive Encrypted DB, Android Foreground Service, Google Drive Sync

### 3.2 VitalSync (vitalsync) — [Flagship #2]
- **Tagline**: Clinical AI & BLE Health Telemetry Ecosystem
- **Categories**: AI/ML, Mobile, IoT
- **Live URL**: https://vitalsync.intrepidtech.net
- **Case Study Document**: vitalsync-technical-case-study.md
- **Executive Summary**: Cross-platform clinical health super-app uniting BLE medical hardware, 9-parameter lab OCR, and 24-rule clinical guardrails.
- **Quantified Business Impact**: Clinical Safety: Sub-second deterministic triage across 24 vital thresholds before any LLM prompt executes.
- **Key Engineering Parameters**:
  - **Codebase Scale**: 59,200+ Lines
  - **Clinical Guardrails**: 24 Deterministic
  - **Lab Biomarkers**: 66+ Normalized
- **Problem & Architectural Challenge**:
  Fragmented consumer health apps fail to correlate glucometers, blood pressure cuffs, pathology lab PDFs, and renal/hepatic dietary limits—while relying on unverified LLM medical advice.
- **System Architecture & Technical Milestones**:
  - Designed a hybrid safety architecture where a deterministic 24-rule Clinical Triage Engine evaluates vitals (DKA, hypertensive crisis, hypoglycemia) before any LLM prompt executes.
  - Built a native BLE GATT protocol parser for IEEE 11073 16-bit SFLOAT medical frames alongside Health Connect (Android) and HealthKit (iOS) bridges.
  - Implemented a 9-parameter pathology lab OCR pipeline normalizing 66+ biomarkers with automated unit conversion and encrypted Google Drive caregiver sync.
- **Verified Outcomes**:
  - Delivered instant, offline-capable clinical safety alerts and drug-food interaction checks across 17 languages.
  - Unified 5 distinct health apps (vitals, meds, labs, hydration, nutrition) into a single zero-server mobile binary.
  - Verified clinical precision across 310+ automated unit and medical calculation tests.
- **Technology Stack**: Flutter 3.41, Riverpod, BLE GATT (IEEE 11073), Gemini 2.5 Flash, HealthKit / Health Connect, Hive Encrypted DB

### 3.3 Dictabill Invoicing (dictabill) — [Flagship #3]
- **Tagline**: Voice-First SaaS Solar & Commercial Invoicing
- **Categories**: AI/ML, Enterprise/SaaS, FinTech
- **Live URL**: https://dictabill.intrepidtech.net
- **Case Study Document**: dictabill-invoicing-technical-case-study.md
- **Executive Summary**: Voice-first SaaS billing and quotation CRM converting Romanized Urdu speech to catalog orders.
- **Quantified Business Impact**: Sales: Compressed quote creation cycle from 4 hours to under 2 minutes for field teams.
- **Key Engineering Parameters**:
  - **Voice Processing Speed**: < 2.0 Seconds
  - **Inverter Safety Limit**: 140% Overload Check
  - **Speech Simulator**: Waveform & Chips
- **Problem & Architectural Challenge**:
  Field engineering and solar sales teams spent up to 4 hours manually drafting complex multi-component quotations and frequently miscalculated DC-to-AC inverter sizing ratios.
- **System Architecture & Technical Milestones**:
  - Architected a voice-first React 19 and Node.js/PostgreSQL invoicing engine that parses bilingual English and Romanized Urdu utterances into structured catalog line items.
  - Engineered a deterministic electrical physics validation loop enforcing a 140% DC-to-AC solar panel-to-inverter safety ceiling before quote generation.
  - Secured executive approvals and account access with hardware-backed SimpleWebAuthn (FIDO2) biometrics and automated PDF quotation compilation.
- **Verified Outcomes**:
  - Compressed field quotation and invoice turnaround from 4 hours to under 2 minutes.
  - Eliminated costly hardware sizing errors across commercial solar proposals.
  - Delivered a self-learning product catalog that adapts to regional terminology.
- **Technology Stack**: React 19, Vite, Node.js, Express, PostgreSQL, SimpleWebAuthn, Gemini API, Docker

### 3.4 TaxSage (taxsage) — [Flagship #4]
- **Tagline**: Autonomous Pakistani Tax Law RAG & FBR IRIS Advisory Engine
- **Categories**: AI/ML, FinTech, Enterprise/SaaS
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: taxsage-technical-case-study.md
- **Executive Summary**: Bilingual Pakistani tax advisory and IRIS return compiler powered by statutory RAG and deterministic tax calculators.
- **Quantified Business Impact**: Compliance: Eliminated statutory hallucination risk via deterministic FBR Finance Act slab engines.
- **Key Engineering Parameters**:
  - **Statutory Chunks**: 4,200+ Indexed
  - **Math Precision**: 100% Deterministic
  - **Wealth Check**: Zero-Diff Audit
- **Problem & Architectural Challenge**:
  Generic LLMs hallucinate Pakistani tax slabs, Finance Act amendments, and SRO exemptions, while manual FBR IRIS filing frequently triggers audit notices due to unreconciled wealth statements.
- **System Architecture & Technical Milestones**:
  - Engineered a legal-hierarchy chunking pipeline in Python/FastAPI and PostgreSQL pgvector indexing the Income Tax Ordinance 2001, Sales Tax Act 1990, and Finance Act schedules.
  - Decoupled statutory citation retrieval from arithmetic by routing all tax liability, withholding, and slab computations through deterministic, versioned Python calculation engines.
  - Built an automated document OCR ingestion and Section 116 Wealth Statement reconciler that flags unallocated cash outflows before IRIS submission.
- **Verified Outcomes**:
  - Delivered 100% arithmetic accuracy across salaried, business, AOP, and capital gains tax scenarios.
  - Automated legal drafting of replies to FBR Section 122(5A) and 177 audit notices with verifiable citations.
  - Reduced complex annual tax return preparation and wealth reconciliation from days to under 25 minutes.
- **Technology Stack**: Python 3.12, FastAPI, Next.js 15, PostgreSQL 16, pgvector, Gemini 2.5 Pro & Flash, Docker

### 3.5 StoreVox ERP & POS (storevox) — [Flagship #5]
- **Tagline**: Multi-Tenant Business Management & Voice POS Engine
- **Categories**: Enterprise/SaaS, FinTech, DevOps/SRE
- **Live URL**: https://storevox.uk
- **Case Study Document**: storevox-technical-case-study.md
- **Executive Summary**: Multi-tenant SaaS retail engine with GAAP double-entry accounting and offline-resilient POS cash drawer syncing.
- **Quantified Business Impact**: Scalability: Powered multi-tenant merchant operations with zero cross-tenant query latency.
- **Key Engineering Parameters**:
  - **Tenant Scalability**: Zero-Overhead Clusters
  - **POS Offline Resilience**: 100% Native Sync
  - **Compliance Model**: GAAP Double-Entry
- **Problem & Architectural Challenge**:
  Retailers face high licensing costs for legacy POS terminals that lack offline resilience, real-time double-entry accounting, and rapid voice-driven billing for high-volume counters.
- **System Architecture & Technical Milestones**:
  - Architected a multi-tenant cloud ERP and POS isolating merchant databases on the fly with strict GAAP double-entry ledger enforcement.
  - Built a custom hardware bridge compiling raw ESC/POS binary byte streams over WebUSB and reading live weight frames from digital scales via WebSerial.
  - Integrated a bilingual English/Roman-Urdu voice POS checkout compiler with IndexedDB offline queuing and automated FIFO inventory reconciliation.
- **Verified Outcomes**:
  - Enabled sub-second barcode and voice checkout with zero local driver installations on standard browsers.
  - Guaranteed real-time balance sheet, P&L, and multi-warehouse stock accuracy across tenant branches.
  - Deployed on sovereign Docker bridge infrastructure with automated health checks and zero per-seat fees.
- **Technology Stack**: Go (Golang), Next.js, TypeScript, PostgreSQL JSONB, Redis, WebUSB, Docker Bridge Network

### 3.6 Orbit SRE Gateway (orbit-portal) — [Flagship #6]
- **Tagline**: Centralized Docker Web Management & Self-Healing SRE Gateway
- **Categories**: Security, DevOps/SRE, AI/ML
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: orbit-technical-case-study.md
- **Executive Summary**: Zero-footprint VPS reverse proxy management gateway isolating client containers, executing WebAuthn biometrics, and self-healing services.
- **Quantified Business Impact**: Security: Isolated Docker socket access and enforced discoverable WebAuthn credentials to prevent container escape exploits.
- **Key Engineering Parameters**:
  - **Docker Socket Proxy**: Secure Local Bridge
  - **Authentication Gate**: WebAuthn Passkeys
  - **Disk Scanning Loop**: 10-Minute Cycles
- **Problem & Architectural Challenge**:
  Operating 60+ production web apps, APIs, and databases on sovereign infrastructure requires continuous telemetry, container isolation, and rapid incident recovery without exposing the root Docker daemon socket.
- **System Architecture & Technical Milestones**:
  - Engineered a centralized cloud control plane streaming container CPU/memory/disk telemetry and Nginx vhost states via a least-privilege Docker Socket Proxy.
  - Enforced hardware-bound WebAuthn FIDO2 Passkey authentication and implemented base64 path encoding with dynamic UID fallback for container volume management.
  - Integrated automated 10-minute disk scanning loops, container health watchdogs, and AI-assisted log diagnostics.
- **Verified Outcomes**:
  - Eliminated root Docker socket exposure while empowering safe browser-based container lifecycle management.
  - Sustained 99.98% availability across 68 concurrent containers on a single sovereign VPS.
  - Replaced costly commercial control panels (cPanel/Plesk) with a <50MB RAM self-hosted gateway.
- **Technology Stack**: Node.js, Express, SQLite3, Docker Proxy, WebAuthn FIDO2, ApexCharts, Nginx

### 3.7 IntrepidVPN (intrepid-vpn) — [Flagship #7]
- **Tagline**: Zero-Log WireGuard VPN Data Plane & Sovereign Orchestrator
- **Categories**: DevOps/SRE, Security, Mobile
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: intrepid-vpn-technical-case-study.md
- **Executive Summary**: Sovereign WireGuard VPN platform with a Go netlink control plane, RAM-only zero-log nodes, and cross-platform clients.
- **Quantified Business Impact**: Privacy: Sub-50ms cryptographic tunnel provisioning with zero persistent connection logs.
- **Key Engineering Parameters**:
  - **Tunnel Setup**: < 50ms Netlink
  - **Disk Logging**: 0 Bytes (RAM)
  - **Crypto Suite**: ChaCha20-Poly1305
- **Problem & Architectural Challenge**:
  Commercial VPNs rely on opaque shared infrastructure and centralized key generation, whereas enterprise remote-access concentrators impose steep per-seat licensing fees.
- **System Architecture & Technical Milestones**:
  - Architected a high-throughput Go 1.24 control plane and kernel WireGuard data plane communicating directly via `wgctrl` netlink sockets with zero shell command injection surface.
  - Enforced strict client-side Curve25519 (X25519) keypair generation in the Flutter client, transmitting only public keys to the ephemerally peered RAM-backed server state.
  - Configured Linux nftables kill-switches, DNS-over-HTTPS leak prevention, and automated stale-handshake peer eviction.
- **Verified Outcomes**:
  - Provisioned encrypted ChaCha20-Poly1305 tunnels in under 50 milliseconds with near-line-rate throughput.
  - Guaranteed cryptographic zero-knowledge privacy where server nodes never possess client private keys.
  - Delivered a unified cross-platform VPN client across Android, iOS, macOS, and Windows.
- **Technology Stack**: Go 1.24, WireGuard Kernel, Linux Netlink / nftables, Flutter 3.41, ChaCha20-Poly1305, Docker

### 3.8 Inos ITSM (inos-itsm) — [Flagship #8]
- **Tagline**: High-Performance Collaborative Service Desk
- **Categories**: Enterprise/SaaS, AI/ML, DevOps/SRE
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: inos-itsm-technical-case-study.md
- **Executive Summary**: Collaborative ITIL service desk portal serving 5,000+ staff on a single-core VPS with under 80MB idle RAM and AI auto-triage.
- **Quantified Business Impact**: Efficiency: Achieved a 92% first-contact resolution (FCR) rate via auto-triage sorting and reduced runtime idle RAM below 80MB.
- **Key Engineering Parameters**:
  - **Idle RAM Footprint**: < 80MB Total
  - **First-Contact Resolution**: 92% AI Accuracy
  - **SLA Scan Frequency**: 60-Second Loop
- **Problem & Architectural Challenge**:
  Legacy enterprise ITSM suites suffer from bloated JVM/Node memory footprints, slow ticket routing, and expensive per-agent licensing that penalizes growing organizations.
- **System Architecture & Technical Milestones**:
  - Architected a low-footprint Bun 1.1 and SvelteKit 5 (Runes) monorepo backed by PostgreSQL 16 and Drizzle ORM, running in under 80MB of idle container RAM.
  - Engineered an asynchronous Gemini 2.5 Flash-Lite classification pipeline that polls support mailboxes and auto-triages incoming ITIL incidents.
  - Implemented a 60-second SLA scan loop with business-hour calendars, pause-on-pending state transitions, and immutable audit trails.
- **Verified Outcomes**:
  - Achieved a 92% first-contact resolution (FCR) routing accuracy across 5,000+ enterprise seats.
  - Eliminated recurring per-agent SaaS fees with a self-hosted Alpine Linux container deployment.
  - Sustained sub-100ms UI state transitions through Svelte 5 compile-time reactivity.
- **Technology Stack**: SvelteKit 5 (Runes), Bun 1.1, PostgreSQL 16, Drizzle ORM, Gemini 2.5 Flash-Lite, Alpine Linux

### 3.9 Aegis Auth (aegis-auth) — [Flagship #9]
- **Tagline**: Privacy-First Biometric 2FA Engine
- **Categories**: Security, Mobile, AI/ML
- **Live URL**: https://aegisauth.intrepidtech.net
- **Case Study Document**: aegis-auth-technical-case-study.md
- **Executive Summary**: Local-only browser extension and vault for TOTP token generation and hardware WebAuthn decryption.
- **Quantified Business Impact**: Security: Enabled local-only hardware key derivation protecting high-value corporate access keys.
- **Key Engineering Parameters**:
  - **Local Encryption**: AES-GCM-256
  - **Key Derivation**: PBKDF2 100K Iterations
  - **Import Support**: Native Protobuf Decoders
- **Problem & Architectural Challenge**:
  Cloud-synced 2FA authenticators create a catastrophic single point of failure when central databases or session tokens are compromised.
- **System Architecture & Technical Milestones**:
  - Built a zero-knowledge Chrome Manifest V3 extension using the Web Crypto API where TOTP seeds are encrypted locally with AES-GCM-256 and 100,000 PBKDF2 iterations.
  - Engineered hardware-bound WebAuthn PRF key derivation inside device Secure Enclaves for biometric vault unlock.
  - Implemented client-side Google Authenticator `otpauth-migration://` Protobuf stream decoders and `jsQR` optical scanning with zero network transmission.
- **Verified Outcomes**:
  - Published on the Chrome Web Store with mathematical zero-knowledge local storage.
  - Enabled 1-click migration from legacy mobile authenticators without exposing secrets to any server.
  - Hardened web companion portal with strict HSTS preload, CSP, and GEO discovery manifests.
- **Technology Stack**: WebAuthn / FIDO2, Manifest V3, Web Crypto API, jsQR Decoder, Tailwind CSS

### 3.10 Brooky Treats FinTech (brooky-treats) — [Flagship #10]
- **Tagline**: Cinematic 60fps D2C Commerce & Automated Raast Payment Engine
- **Categories**: FinTech, Enterprise/SaaS, Security
- **Live URL**: https://brookytreats.com
- **Case Study Document**: brooky-treats-technical-case-study.md
- **Executive Summary**: Artisanal D2C commerce platform pairing 60fps canvas scroll physics with zero-fee automated Raast/IBFT bank reconciliation.
- **Quantified Business Impact**: FinTech ROI: 0% payment gateway MDR fees via automated bank transfer email regex reconciliation.
- **Key Engineering Parameters**:
  - **Gateway MDR Fee**: 0% (Raast/IBFT)
  - **Visual Frame Rate**: 60fps Canvas
  - **Security Grade**: WebAuthn + HSTS
- **Problem & Architectural Challenge**:
  Pakistani D2C brands lose 3-4% of top-line revenue to credit card MDR fees or suffer high COD rejection rates, while heavy visual storefronts fail Core Web Vitals on mobile.
- **System Architecture & Technical Milestones**:
  - Engineered an automated FinTech payment reconciliation daemon that polls bank transaction emails, parses Raast/IBFT reference amounts, and transitions order states without third-party gateway fees.
  - Built a hardware-accelerated 192-frame AVIF scroll canvas with `requestIdleCallback` deferred sequence warming and single-AVIF preload optimization.
  - Secured the admin portal with WebAuthn Passkeys, magic-bytes upload verification, PII redaction on public tracking endpoints, and full Schema.org/GEO manifests.
- **Verified Outcomes**:
  - Eliminated 100% of payment gateway transaction fees while automating instant order confirmation.
  - Sustained 60fps visual storytelling and top Lighthouse LCP/CLS scores across mobile and desktop.
  - Protected customer PII and admin operations with enterprise-grade cryptographic controls.
- **Technology Stack**: Node.js, SQLite WAL, WebAuthn / FIDO2, HTML5 Canvas AVIF, IMAP Bank Parser, Schema.org GEO

### 3.11 InboxSync (inboxsync) — [Flagship #11]
- **Tagline**: Chronological SMS Archival to Gmail
- **Categories**: Mobile, Security, Infrastructure
- **Live URL**: https://inboxsync.intrepidtech.net
- **Case Study Document**: inboxsync-technical-case-study.md
- **Executive Summary**: High-reliability background Android utility archiving SMS text messages directly to Gmail folders via native IMAP SecureSocket injection.
- **Quantified Business Impact**: Data Integrity: Eliminated background race condition duplicates and established direct TLS connections bypassing OAuth.
- **Key Engineering Parameters**:
  - **Verification Security**: AES-256 Local Hive
  - **Transmission Protocol**: SecureSocket TCP 993
  - **Native Broadcast Sync**: 20s WorkManager Delay
- **Problem & Architectural Challenge**:
  Android background execution limits and Google OAuth verification bottlenecks break legacy SMS backup apps, causing missed financial OTPs and duplicate message threads.
- **System Architecture & Technical Milestones**:
  - Engineered direct RFC 3501 IMAP4rev1 protocol communication over `dart:io` TLS `SecureSocket` (Port 993) to inject RFC 2822 MIME-formatted SMS messages directly into Gmail.
  - Resolved Android BroadcastReceiver vs. content-observer race conditions using a deterministic 20-second delayed Kotlin WorkManager queue and SHA-256 message deduplication.
  - Encrypted local credentials and sync watermarks inside AES-256 Hive boxes backed by the hardware Android Keystore.
- **Verified Outcomes**:
  - Published on Google Play Store (`com.intrepid.inboxsync`) with 100% chronological archival accuracy.
  - Bypassed third-party cloud relay servers so SMS payloads travel strictly between the device and Gmail.
  - Localized across 17 global languages with automated Play Console release pipelines.
- **Technology Stack**: Flutter, Kotlin, WorkManager, Hive DB, Secure Sockets, IMAP Protocol, Android Keystore

### 3.12 The 300 (OS Migration) (the-300) — [Flagship #12]
- **Tagline**: Enterprise ChromeOS Transition Dashboard
- **Categories**: Enterprise/SaaS, Infrastructure
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: the-300-os-migration-technical-case-study.md
- **Executive Summary**: Google Apps Script web application tracking and auditing OS migrations from legacy systems to ChromeOS Enterprise.
- **Quantified Business Impact**: Logistics: Streamlined tracking across multiple lines of business with a zero-cost Google Sheets backend.
- **Key Engineering Parameters**:
  - **Directory Scope**: 4,500+ Accounts
  - **Search Index Speed**: < 10 Milliseconds
  - **Backup Cycle**: Daily at 2 AM
- **Problem & Architectural Challenge**:
  Coordinating a nationwide enterprise migration from legacy Windows endpoints to ChromeOS across 4,500+ directory accounts suffered from spreadsheet version chaos and Apps Script RPC timeouts.
- **System Architecture & Technical Milestones**:
  - Architected a real-time migration command center on Google Apps Script V8 and Google Sheets DB indexing 4,500+ employee accounts and hardware readiness states.
  - Reduced client-server RPC payload sizes by 85% and implemented an in-memory client search index achieving <10ms query filtering.
  - Engineered automated 2 AM daily snapshot backups and role-scoped readiness dashboards using ApexCharts.
- **Verified Outcomes**:
  - Accelerated nationwide ChromeOS Enterprise rollout tracking across all banking business units.
  - Delivered 100% real-time executive visibility at $0 incremental infrastructure or licensing cost.
  - Eliminated manual migration tracking errors and Apps Script quota timeouts.
- **Technology Stack**: Apps Script V8, Google Sheets DB, ApexCharts, Google Group Directory APIs

### 3.13 SchnittFlow (schnittflow)
- **Tagline**: Multi-Tenant POS & Saloon CRM
- **Categories**: Enterprise/SaaS, Security, Mobile
- **Live URL**: https://schnittflow.intrepidtech.net
- **Case Study Document**: schnittflow-technical-case-study.md
- **Executive Summary**: Multi-tenant SaaS beauty salon manager featuring a high-density split-pane checkout POS, commission split ledgers, and NFC stylist logins.
- **Quantified Business Impact**: Operational: Automated 100% of staff commissions and bypassed off-shift checking restrictions via clocked-in dynamic validation hooks.
- **Key Engineering Parameters**:
  - **Multi-Tenant Isolation**: PostgreSQL RLS
  - **Stylist Wedge Logins**: NFC Keyboard Wedge
  - **POS Interface Viewports**: Desktop & Tabbed Mobile
- **Problem & Architectural Challenge**:
  High-volume salons struggle with multi-stylist commission splits, shared counter terminal logins, and strict data isolation across franchise locations.
- **System Architecture & Technical Milestones**:
  - Architected a React 19, Express.js, and PostgreSQL multi-tenant SaaS enforcing database-level Row-Level Security (RLS) context switching on every request.
  - Engineered a global USB/NFC keyboard-wedge listener that identifies stylists in milliseconds at shared POS terminals without manual password entry.
  - Built a companion Flutter mobile app and OCR loyalty card onboarding pipeline.
- **Verified Outcomes**:
  - Automated 100% of complex multi-stylist service and tip commission calculations.
  - Eliminated cross-tenant IDOR risks through strict PostgreSQL RLS policies.
  - Cut counter checkout time in half during peak salon hours.
- **Technology Stack**: React 19, Express.js, PostgreSQL (RLS), Flutter, NFC Wedges, Docker Compose

### 3.14 GlassWords (Daily Vocab) (glasswords)
- **Tagline**: High-Fidelity Offline-First Vocab App
- **Categories**: Mobile, AI/ML
- **Live URL**: https://play.google.com/store/apps/details?id=com.vocablearner.daily_vocab_app
- **Case Study Document**: glasswords-technical-case-study.md
- **Executive Summary**: Offline-first mobile vocab tutor with glassmorphism design, native sine-wave audio synthesis, and spaced repetition.
- **Quantified Business Impact**: Engagement: Leveraged local speech synthesis and custom gamification to scale user retention across 12+ languages.
- **Key Engineering Parameters**:
  - **Visual Aesthetics**: Frosted Glass (M3)
  - **Audio Offline Efficiency**: 100% Native Sine-Wave
  - **RTL Support**: Arabic & Urdu Script-Aware
- **Problem & Architectural Challenge**:
  Language learning apps suffer from heavy asset downloads, poor RTL script rendering, and repetitive flashcards that fail to sustain daily user streaks.
- **System Architecture & Technical Milestones**:
  - Architected an offline-first Flutter and Riverpod vocabulary engine with adaptive spaced repetition and script-aware Arabic/Urdu RTL typography.
  - Built a zero-asset programmatic PCM/WAV sine-wave synthesizer in Dart that generates harmonic UI feedback chimes directly in memory.
  - Integrated Cloud TTS pronunciation caching and Firebase Remote Config for dynamic content updates.
- **Verified Outcomes**:
  - Published live on the Google Play Store with a 60fps frosted-glass Material 3 interface.
  - Eliminated audio asset bloat via in-memory mathematical waveform synthesis.
  - Supported seamless bilingual and RTL learning workflows completely offline.
- **Technology Stack**: Flutter, Riverpod, Cloud TTS API, Firebase Remote Config, Secure Local Storage

### 3.15 LendSync CRM (lendsync)
- **Tagline**: Real-Time Mortgage Pipeline & Matchmaker
- **Categories**: Enterprise/SaaS, AI/ML, FinTech
- **Live URL**: https://lendsync.intrepidtech.net
- **Case Study Document**: lendsync-technical-case-study.md
- **Executive Summary**: Real-time mortgage pipeline CRM automating 7-parameter lender matchmaking, AI deal audits, and passkey logins.
- **Quantified Business Impact**: Efficiency: Automated 100% of morning deal audits and follow-ups with secure passkey authentication.
- **Key Engineering Parameters**:
  - **Guideline Checks**: 7-Parameter Heuristics
  - **DDoS Resistance**: Cloudflare/Nginx Proxy
  - **Authentication**: WebAuthn Biometrics
- **Problem & Architectural Challenge**:
  Mortgage brokers lose deals when manually cross-referencing borrower credit/LTV profiles against dozens of shifting lender matrices and stalling follow-up cadences.
- **System Architecture & Technical Milestones**:
  - Built a real-time React, Node.js, and PostgreSQL mortgage pipeline engine featuring a 7-parameter heuristic matchmaker that pairs borrowers with eligible lending products.
  - Engineered an automated morning cron daemon that audits stale pipeline deals and drafts context-aware broker follow-up emails via AI.
  - Secured broker sessions with hardware-backed WebAuthn FIDO2 biometrics and real-time Socket.io pipeline sync.
- **Verified Outcomes**:
  - Automated 100% of daily morning pipeline audits and borrower follow-up drafting.
  - Protected sensitive borrower financial records with passwordless FIDO2 authentication.
  - Eliminated manual lender-guideline lookup bottlenecks.
- **Technology Stack**: React, Node.js, Express, PostgreSQL, WebAuthn, Socket.io

### 3.16 Harmain Solar Reporting (harmain-solar)
- **Tagline**: Bilingual Voice-First Field QC & Photographic Audit Compiler
- **Categories**: AI/ML, Mobile, IoT
- **Live URL**: https://reports.harmainsolarenergy.com
- **Case Study Document**: harmain-solar-reporting-technical-case-study.md
- **Executive Summary**: Voice-first field engineering and QA reporting portal converting Roman-Urdu/English site notes and photos into branded PDFs.
- **Quantified Business Impact**: Field Velocity: Compressed solar site commissioning and QA audit reporting from 3 hours to 90 seconds.
- **Key Engineering Parameters**:
  - **Report Compilation**: < 90 Seconds
  - **Voice NLP**: Urdu / English Hybrid
  - **Export Format**: Branded Vector PDF
- **Problem & Architectural Challenge**:
  Solar installation technicians struggle to type formal English quality-assurance reports on mobile phones under harsh rooftop site conditions.
- **System Architecture & Technical Milestones**:
  - Architected a mobile-first web reporting studio where field engineers dictate site findings in natural Urdu, Roman-Urdu, or English for instant Gemini structuring.
  - Implemented automated photographic evidence ingestion with client-side canvas compression and layout grid formatting.
  - Built a deterministic branded A4 PDF compiler for instant WhatsApp and client handover.
- **Verified Outcomes**:
  - Reduced site inspection report turnaround from hours of back-office typing to under 90 seconds on site.
  - Standardized professional engineering documentation across every solar installation crew.
  - Deployed at `reports.harmainsolarenergy.com` on hardened sovereign container infrastructure.
- **Technology Stack**: Node.js, JavaScript ES2022, Gemini 2.5 Flash, Canvas Image Pipeline, A4 PDF Compiler, Docker

### 3.17 Jamila Welfare Foundation (jamila-welfare)
- **Tagline**: Transparent Humanitarian Aid & Zakat Governance Platform
- **Categories**: Enterprise/SaaS, FinTech, Security
- **Live URL**: https://www.jamilawelfarefoundation.com/
- **Case Study Document**: jamila-welfare-foundation-technical-case-study.md
- **Executive Summary**: High-trust humanitarian platform featuring interactive Zakat/donation allocation, campaign telemetry, and GEO optimization.
- **Quantified Business Impact**: Donor Trust: 100% contribution transparency with 0% platform commission fees and sub-second LCP.
- **Key Engineering Parameters**:
  - **Platform Fee**: 0% Direct
  - **Search Visibility**: GSC + AI GEO
  - **Page Load**: < 1.0s LCP
- **Problem & Architectural Challenge**:
  Non-profit organizations struggle to build digital donor trust when platforms lack transparent program metrics, fast mobile load times, and direct zero-commission bank routing.
- **System Architecture & Technical Milestones**:
  - Built a high-speed, mobile-first web platform showcasing verified humanitarian programs across food security, medical aid, education, and clean water.
  - Integrated an interactive Zakat nisab calculator and direct bank/IBFT contribution workflows with instant receipt verification.
  - Implemented enterprise security headers, Schema.org NGO rich snippets, Google Search Console indexing, and `/llms.txt` AI discovery manifests.
- **Verified Outcomes**:
  - Achieved sub-second mobile page loads and verified Google Search Console & AI search discoverability.
  - Eliminated third-party crowdfunding commissions so 100% of donor funds reach beneficiaries.
  - Strengthened international and domestic donor trust through transparent impact reporting.
- **Technology Stack**: HTML5 / CSS3, JavaScript, Schema.org JSON-LD, Google Search Console, GA4, Nginx Hardened

### 3.18 Azan Alerts IoT & Mobile (azan-alerts)
- **Tagline**: Sub-Second Astronomical Prayer Engine & Google Cast TCP Orchestrator
- **Categories**: IoT, Mobile, Infrastructure
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: azan-alerts-iot-mobile-app-technical-case-study.md
- **Executive Summary**: Cross-platform mobile app driving automated Azan broadcasts to Google Nest speakers via raw TLS CASTV2 TCP sockets.
- **Quantified Business Impact**: Engineering: Bypassed proprietary Google Cast SDK restrictions via raw protobuf TLS sockets on Port 8009.
- **Key Engineering Parameters**:
  - **Cast Protocol**: Raw TLS TCP:8009
  - **Solar Precision**: Sub-Minute Math
  - **Languages**: 17 Bidirectional
- **Problem & Architectural Challenge**:
  Commercial smart speakers lack native reliable multi-room Azan automation, while mobile prayer apps drain batteries and monetize user location data.
- **System Architecture & Technical Milestones**:
  - Reverse-engineered the Google Cast V2 protocol in Dart using raw `SecureSocket` TLS connections on port 8009 and mDNS (`_googlecast._tcp`) discovery.
  - Implemented high-precision astronomical solar declination algorithms supporting 8 global jurisprudence calculation conventions entirely offline.
  - Built an adaptive 17-language UI with automatic RTL/LTR layout switching and native iOS/Android alarm scheduling.
- **Verified Outcomes**:
  - Delivered frame-accurate multi-room smart speaker broadcasts with zero cloud relay latency.
  - Guaranteed 100% location privacy with offline astronomical math.
  - Deployed across Android and iOS from a single unified codebase.
- **Technology Stack**: Flutter, Dart SecureSocket, CASTV2 Protobuf, mDNS Discovery, Astronomical Math, iOS / Android

### 3.19 Intelligent Home & Dual-Pump IoT (homeassistant-iot)
- **Tagline**: Hardware-Safe Dual-Tank Water Pump State Machine & Smart Home Core
- **Categories**: IoT, Infrastructure
- **Live URL**: https://github.com/subhanzg/homeassistant-automation
- **Case Study Document**: homeassistant-automation-technical-case-study.md
- **Executive Summary**: Mission-critical Home Assistant and ESPHome automation governing dual water pumps, dry-run protection, and cast audio.
- **Quantified Business Impact**: Hardware Safety: Prevented costly pump burnouts and tank overflows via deterministic state interlocks.
- **Key Engineering Parameters**:
  - **Safety Interlocks**: Dry-Run + Thermal
  - **Sensor Telemetry**: Ultrasonic ESPHome
  - **Cloud Dependency**: 0% (100% LAN)
- **Problem & Architectural Challenge**:
  Urban multi-tank water systems suffer from municipal supply fluctuations, dry-running pump motor burnouts, and roof tank overflows when managed manually or by naive timers.
- **System Architecture & Technical Milestones**:
  - Architected a deterministic state machine in Home Assistant and ESPHome correlating underground and roof ultrasonic tank sensors, line flow switches, and relay contactors.
  - Enforced strict hardware safety interlocks: dry-run amperage cutoffs, maximum continuous run-time limits, thermal cooldown windows, and sensor-unavailable failsafes.
  - Unified environmental sensors, UPS power telemetry, and multi-room Google Cast voice announcements on a local LAN.
- **Verified Outcomes**:
  - Achieved zero motor burnouts and zero tank overflows with 24/7 autonomous water management.
  - Operates 100% locally on LAN without cloud vendor lock-in or internet dependency.
  - Version-controlled with automated YAML validation and local backup pipelines.
- **Technology Stack**: Home Assistant, ESPHome / C++, YAML State Machines, Ultrasonic & Current Telemetry, MQTT, Google Cast

### 3.20 SnapRoll (snaproll)
- **Tagline**: Full-Page DOM Scroll Capture & Interactive Canvas Studio
- **Categories**: Enterprise/SaaS, Security
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: snaproll-browser-extension-technical-case-study.md
- **Executive Summary**: Manifest V3 Chrome extension stitching complex sticky-header pages into 32,000px+ canvases with built-in PII redaction.
- **Quantified Business Impact**: Privacy: Zero-cost client-side visual QA and PII redaction studio with zero external cloud uploads.
- **Key Engineering Parameters**:
  - **Max Canvas Height**: 32,000px+
  - **Sticky Duplication**: 0% (DOM Cloaked)
  - **Cloud Uploads**: Zero (100% Local)
- **Problem & Architectural Challenge**:
  Standard screenshot tools break on modern web apps with internal scroll containers, fixed navbars, and lazy-loaded assets, or upload sensitive enterprise screens to third-party servers.
- **System Architecture & Technical Milestones**:
  - Engineered a Chrome Manifest V3 capture orchestrator that detects nested scrollable viewports, pre-triggers lazy images, and cloaks `fixed`/`sticky` DOM nodes after frame 0.
  - Implemented a throttled `captureVisibleTab` stitcher that respects Chrome IPC quotas while assembling high-DPI multi-slice canvases.
  - Built an object-oriented HTML5 Canvas editor supporting vector callouts, arrows, and pixel-level PII blur destruction.
- **Verified Outcomes**:
  - Delivered seamless full-page captures on complex SPAs where commercial extensions fail.
  - Guaranteed 100% enterprise data privacy by processing all pixels locally in browser memory.
  - Accelerated UI bug reporting and compliance documentation workflows.
- **Technology Stack**: Chrome Manifest V3, JavaScript ES2022, HTML5 Canvas 2D, Service Workers, DOM Computed Styles

### 3.21 Sovereign Cloud VPS & Portfolio Compiler (sovereign-vps)
- **Tagline**: 68-Container Sovereign Infrastructure & Deterministic GEO/PDF Engine
- **Categories**: DevOps/SRE, Infrastructure, AI/ML
- **Live URL**: https://me.intrepidtech.net
- **Case Study Document**: sovereign-cloud-vps-and-portfolio-compiler-technical-case-study.md
- **Executive Summary**: Sovereign ARM64 cloud hosting 68 production Docker containers alongside a deterministic 30-project GEO and 2-page PDF compiler.
- **Quantified Business Impact**: SRE ROI: Hosted 68 concurrent production containers on a single 24GB ARM64 VPS at $0 incremental cost.
- **Key Engineering Parameters**:
  - **Active Containers**: 68 Concurrent
  - **Cataloged Systems**: 30 Case Studies
  - **PDF Gatekeeper**: Strict 2-Page A4
- **Problem & Architectural Challenge**:
  Operating 68 concurrent Docker containers on a single 24GB ARM64 VM risked kernel D-state I/O lockups and botnet CPU spikes, while keeping 30 case studies synchronized across Web, PDF, and AI manifests was impossible manually.
- **System Architecture & Technical Milestones**:
  - Re-engineered MySQL 8.0 memory footprints (disabling `performance_schema`, capping buffer pools and binlogs) and deployed Nginx map rules blocking combinatorial WooCommerce scraper botnets at the edge.
  - Architected a single-source-of-truth compiler (`scripts/build-portfolio.js`) reading `data/portfolio-data.json` to emit `index.html`, TSX, Schema.org `@graph`, `sitemap.xml`, `llms.txt`, and `llms-full.txt`.
  - Built a Headless Chrome and native Swift `PDFKit` gatekeeper in `deploy.sh` enforcing a strict 2-page A4 resume layout and rasterizing `cv_page_1.png` / `cv_page_2.png`.
- **Verified Outcomes**:
  - Reclaimed 10+ GB of RAM and 60+ GB of NVMe storage while eliminating kernel uninterruptible sleep lockups.
  - Achieved 100% automated synchronization across all 30 engineering case studies, live web portfolio, and 2-page PDF CV.
  - Hardened `me.intrepidtech.net` with A+ transport security headers, GA4 telemetry, and GSC indexing.
- **Technology Stack**: Docker Bridge, Nginx-Proxy, MySQL 8 / PostgreSQL 16, Node.js Compiler, Swift PDFKit, Schema.org GEO

### 3.22 Google Workspace & AI Enablement (gws-ai-trainings)
- **Tagline**: Enterprise Agentic AI & Digital Transformation Curriculum
- **Categories**: AI/ML, Enterprise/SaaS
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: google-workspace-ai-enablement-trainings-technical-case-study.md
- **Executive Summary**: Structured corporate and academic enablement program training 4,500+ banking staff, KCCI leaders, and scholars in Agentic AI.
- **Quantified Business Impact**: Transformation: Upskilled 4,500+ enterprise employees and 400+ external leaders in governed AI workflows.
- **Key Engineering Parameters**:
  - **Workforce Trained**: 4,500+ Staff
  - **External Cohorts**: KCCI & Scholars
  - **License ROI**: 100% Native GWS
- **Problem & Architectural Challenge**:
  Organizations underutilize existing cloud licenses and struggle to transition employees from manual legacy habits to governed, audit-ready AI workflows.
- **System Architecture & Technical Milestones**:
  - Engineered a multi-tier training and change-management framework spanning Google Workspace native AI, Gemini structured prompting, NotebookLM grounded RAG, and Apps Script automation.
  - Embedded banking-grade compliance, PII redaction rules, and human-in-the-loop verification into every practical lab.
  - Adapted specialized curriculum tracks for commercial banking executives, KCCI industrialists, and academic institutions.
- **Verified Outcomes**:
  - Maximized ROI on existing Google Workspace licenses across 4,500+ corporate seats without third-party add-on spend.
  - Empowered non-technical departments to build self-improving, auditable automation workflows.
  - Successfully transitioned educational faculties to resilient digital classrooms.
- **Technology Stack**: Gemini for Workspace, NotebookLM, Agentic AI Workflows, Google for Education, Apps Script

### 3.23 JS Bank AI Champions Portal (jsbl-champs)
- **Tagline**: Gamified Process Discovery, Gemini Live Voice & Transformation Hub
- **Categories**: AI/ML, Enterprise/SaaS
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: jsbl-champs-technical-case-study.md
- **Executive Summary**: Enterprise process discovery and gamified AI transformation platform featuring Gemini 3.1 Flash Live bidirectional voice interviews.
- **Quantified Business Impact**: Adoption: Automated departmental bottleneck discovery and SOP re-engineering across banking divisions.
- **Key Engineering Parameters**:
  - **Voice Streaming**: 24kHz/16kHz PCM
  - **Compliance**: SBP BPRD Aligned
  - **Platform Stack**: React 19 + Node 22
- **Problem & Architectural Challenge**:
  Traditional business process re-engineering relies on slow consultant interviews and static questionnaires that fail to capture ground-level operational bottlenecks across a 4,500-person bank.
- **System Architecture & Technical Milestones**:
  - Architected a React 19 and Node.js 22 platform integrating Gemini 3.1 Flash Live WebSockets with a custom Web Audio API (16kHz input / 24kHz output) voice interview agent.
  - Engineered an autonomous synthesis pipeline using Gemini 3.8 Flash to convert employee pain-point interviews into quantified automation blueprints and PRD specifications.
  - Enforced State Bank of Pakistan (SBP BPRD) security controls, role-based access, and gamified departmental leaderboards.
- **Verified Outcomes**:
  - Transformed passive employees into active AI Champions identifying high-ROI automation targets across the bank.
  - Compressed business-analyst discovery and PRD drafting from weeks to a 10-minute conversational session.
  - Deployed on hardened Docker container infrastructure with full auditability.
- **Technology Stack**: React 19, Node.js 22 LTS, Gemini 3.1 Flash Live, Gemini 3.8 Flash, Web Audio API, Docker

### 3.24 JS Bank Email Signature Suite (jsbl-emailsignature)
- **Tagline**: SignForge™ Visual Studio, AI Banner Synthesizer & 6,000-Seat Fleet Deployer
- **Categories**: Enterprise/SaaS, AI/ML, Security
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: jsbl-emailsignature-technical-case-study.md
- **Executive Summary**: Centralized banking email identity platform with SignForge™ visual studio, Gemini AI micro-banners, and blast-radius safety.
- **Quantified Business Impact**: Cost Avoidance: Saved $36,000+/yr in third-party signature SaaS fees across 6,000+ banking mailboxes.
- **Key Engineering Parameters**:
  - **Fleet Scale**: 6,000+ Mailboxes
  - **Annual SaaS Saved**: $36,000+ / Year
  - **Image Pipeline**: 300 DPI Lanczos3
- **Problem & Architectural Challenge**:
  Commercial email signature managers charge steep per-user recurring fees for 6,000+ seats and require routing confidential bank emails through external cloud SMTP relays.
- **System Architecture & Technical Milestones**:
  - Architected a Fastify, TypeScript, and React 18 platform that injects compliant HTML signatures directly into Gmail settings via Google Workspace domain-wide delegation—with zero external mail routing.
  - Built the SignForge™ Visual Studio featuring Gemini 3.1 Flash-Image promotional micro-banner generation, Sharp 300-DPI Lanczos3 downsampling, and Tesseract.js OCR legibility verification.
  - Implemented strict blast-radius safety controls including OU-scoped dry runs, canary batch progression, and 1-click fleet-wide signature rollback.
- **Verified Outcomes**:
  - Eliminated $36,000+ in annual third-party SaaS licensing while keeping 100% of mail flow inside Google Workspace.
  - Enabled marketing and communications teams to launch bank-wide campaign banners in minutes with zero broken layouts.
  - Achieved full SBP BPRD regulatory and security compliance.
- **Technology Stack**: Node.js 22 / Fastify, TypeScript, React 18, Gemini 3.1 Flash-Image, Google Workspace SDK, Sharp & Tesseract.js

### 3.25 Mama Parsi School Email Admin (mamaparsi-admin)
- **Tagline**: Scoped RBAC Identity Intermediary for Google Workspace Education
- **Categories**: Enterprise/SaaS, Security
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: mamaparsi-email-admin-technical-case-study.md
- **Executive Summary**: Delegated Google Apps Script web app allowing designated faculty to manage student accounts without Super Admin access.
- **Quantified Business Impact**: Security & Speed: Eliminated central IT password-reset bottlenecks while protecting Google Admin Console keys.
- **Key Engineering Parameters**:
  - **Access Model**: Branch-Scoped RBAC
  - **Admin Exposure**: 0% Console Access
  - **Hosting Cost**: $0 (Serverless)
- **Problem & Architectural Challenge**:
  Giving school teachers full Google Admin Console access poses a severe security risk, but routing every student password reset through central IT creates massive classroom bottlenecks.
- **System Architecture & Technical Milestones**:
  - Architected a serverless Google Apps Script web application acting as a tightly scoped security intermediary over the Google Workspace Admin Directory API.
  - Enforced strict server-side organizational unit (OU) and email-pattern guardrails so authorized faculty can only manage students within their assigned branch.
  - Recorded every credential reset, suspension, and provisioning action into an immutable audit log.
- **Verified Outcomes**:
  - Resolved classroom login and password issues in seconds without central IT intervention.
  - Maintained zero exposure of Google Workspace Super Admin privileges.
  - Operates at $0 infrastructure cost inside the school's existing Google for Education tenant.
- **Technology Stack**: Google Apps Script, Admin Directory SDK, Scoped RBAC, Google SSO, Audit Logging

### 3.26 KhanqahBD Mobile (khanqahbd-mobile)
- **Tagline**: Astronomical Timings & Streaming Client
- **Categories**: Mobile, Infrastructure
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: khanqahbd-mobile-technical-case-study.md
- **Executive Summary**: Islamic timings and lecture streaming client featuring geolocated countdowns, a 3x3 Explore overlay grid, and bidirectional Unicode guards.
- **Quantified Business Impact**: User Experience: Prevented double-notch UI clipping and isolated bidirectional layout number flips programmatically.
- **Key Engineering Parameters**:
  - **Timings Engine**: Karachi Coordinates
  - **Dynamic Viewports**: Custom Safe-Area Grid
  - **Typography System**: Nastaliq & Ligature Fonts
- **Problem & Architectural Challenge**:
  Multilingual spiritual apps frequently suffer from broken RTL Nastaliq number rendering, safe-area notch clipping, and inaccurate sunset Hijri date transitions.
- **System Architecture & Technical Milestones**:
  - Architected a cross-platform Flutter and Riverpod mobile client calculating astronomical prayer and sunset Hijri rollover timings locally.
  - Applied programmatic Unicode directionality isolators (`U+2066`..`U+2069`) across mixed Urdu/Arabic and English strings to prevent bidirectional layout corruption.
  - Integrated resilient live and archival audio streaming with lockscreen media controls.
- **Verified Outcomes**:
  - Delivered pixel-perfect Nastaliq typography and safe-area responsive grids across Android and iOS.
  - Synchronized Hijri calendar transitions accurately with local sunset times.
  - Provided seamless low-bandwidth audio lecture streaming to a global community.
- **Technology Stack**: Flutter, Riverpod, Adhan Calculations, SharedPreferences, Unicode Isolators, Live Audio Player

### 3.27 KhanqahBD Web (khanqahbd-web)
- **Tagline**: Laravel & React Media Archive Portal
- **Categories**: Enterprise/SaaS, Infrastructure
- **Live URL**: https://khanqahbd.com
- **Case Study Document**: khanqahbd-technical-case-study.md
- **Executive Summary**: Multi-aspect ratio digital media archive portal showcasing spiritual lectures and publications with automated Intervention/Image processing.
- **Quantified Business Impact**: Infrastructure: Standardized a server-side media compression pipeline and synced asset cleanup lifecycles with cloud S3.
- **Key Engineering Parameters**:
  - **Database Metric Size**: 31 Restored Tables
  - **Responsive Grid Model**: Dense CSS Grid Mosaic
  - **Image Scale Quality**: 75%-85% Compression
- **Problem & Architectural Challenge**:
  Decades of multi-language publications, varied-aspect-ratio event posters, and audio discourses suffered from orphaned cloud storage blobs and slow gallery rendering.
- **System Architecture & Technical Milestones**:
  - Engineered a Laravel 9.5, React, and MySQL digital archive backed by 31 relational tables and Amazon S3 object storage.
  - Built an automated Intervention/Image compression pipeline (75%-85% quality optimization) paired with a dense CSS Grid auto-flow mosaic layout.
  - Implemented Eloquent model lifecycle hooks to automatically purge orphaned S3 thumbnails and banners upon record deletion.
- **Verified Outcomes**:
  - Eliminated orphaned S3 storage bloat while accelerating gallery page loads.
  - Unified web browsing and mobile API syndication under a single headless-ready backend.
  - Preserved thousands of archival recordings and books in a high-availability sovereign deployment.
- **Technology Stack**: Laravel 9.5, React 15, Redux (Saga), MySQL, Intervention/Image, Amazon S3, Docker

### 3.28 JSBL Digital Memo (digital-memo)
- **Tagline**: AMP-Powered Enterprise Approval System
- **Categories**: AI/ML, Enterprise/SaaS, Security
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: jsbl-digital-memo-technical-case-study.md
- **Executive Summary**: Multi-level digital approval workflow engine featuring Gmail inline actions via AMP for Email.
- **Quantified Business Impact**: Efficiency: Compressed approval times by 70% and reduced Firebase storage costs by 95% using hybrid storage.
- **Key Engineering Parameters**:
  - **Active Bank User Base**: 4,500+ Accounts
  - **API Timeout Cap**: 300 Seconds
  - **Weekly Storage Growth**: < 50 MB
- **Problem & Architectural Challenge**:
  Multi-stage executive memo approvals across 4,500+ banking staff stalled when approvers had to open external portals, while storing heavy attachments in cloud NoSQL databases drove up costs.
- **System Architecture & Technical Milestones**:
  - Architected a hybrid serverless workflow engine combining Google Apps Script, Firebase Functions v2, and dynamic AMP for Email payloads.
  - Enabled executives to approve, reject, or comment on memos directly inside their Gmail inbox without opening a separate browser tab.
  - Engineered a hybrid storage topology keeping lightweight state metadata in Firestore while offloading heavy document blobs to corporate Google Drive.
- **Verified Outcomes**:
  - Compressed inter-departmental executive approval turnaround times by 70%.
  - Reduced Firebase storage expenditure by 95% across a 4,500+ user banking footprint.
  - Maintained a tamper-evident, regulator-ready audit trail for every sign-off.
- **Technology Stack**: Google Apps Script, Firebase Functions v2, AMP for Email, Firestore, Google Drive API

### 3.29 Digital Marketing Hub (marketing-hub)
- **Tagline**: Centralized Growth Automation & GA4 Compliance
- **Categories**: Enterprise/SaaS, DevOps/SRE, Security
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: digital-marketing-hub-technical-case-study.md
- **Executive Summary**: Centralized marketing operations hub automating workspace audits, custom subagent creation, and GA4 anti-duplication verification.
- **Quantified Business Impact**: Growth: Automated multi-project readiness auditing and blocked duplicate GA4 properties via OAuth validation hooks.
- **Key Engineering Parameters**:
  - **ASO Languages**: 17 Localizations
  - **GA4 Verification**: Anti-Duplication Loop
  - **Audit Scan Domain**: Local Workspace ~/dev
- **Problem & Architectural Challenge**:
  Managing SEO, ASO across 17 languages, Google Analytics 4 streams, and Google Search Console properties across 30+ products risked duplicate telemetry streams and missed compliance pages.
- **System Architecture & Technical Milestones**:
  - Architected a centralized Python and shell automation suite scanning all local `~/dev` repositories for sitemaps, privacy policy links, and 17-language Play Store metadata.
  - Engineered an anti-duplication verification loop against the Google Analytics Admin API (`v1beta` / `v1alpha`) and Search Console API before provisioning new streams.
  - Automated administrator access delegation and multilingual release-note publishing via Google Play Developer APIs.
- **Verified Outcomes**:
  - Eliminated duplicate GA4 properties and unverified Search Console domains across the entire portfolio.
  - Standardized 17-language App Store and Play Store ASO rollouts in a single command.
  - Enforced 100% privacy-policy and technical SEO compliance across all shipped apps.
- **Technology Stack**: Python, Google Analytics API, Google Search Console API, Play Developer API, Docker Compose, Shell Scripting

### 3.30 Nero Partner Chatbot (nero-chatbot)
- **Tagline**: Self-Hosted Vector RAG E-Commerce Chatbot
- **Categories**: AI/ML, Enterprise/SaaS, DevOps/SRE
- **Live URL**: Internal / Sovereign Enterprise Deployment
- **Case Study Document**: Built-in Enterprise Case Study
- **Executive Summary**: E-commerce customer service bot using self-hosted Qdrant vector database querying and automated site crawlers.
- **Quantified Business Impact**: Performance: Achieved sub-2s query resolutions and optimized free-tier limits using hard spending guards.
- **Key Engineering Parameters**:
  - **Cached Query Speed**: 50-100ms
  - **AI Message Cost**: $0.001 per message
  - **Spending Safeguard Limit**: $1 monthly cap
- **Problem & Architectural Challenge**:
  Third-party AI support widgets charge steep monthly subscriptions and expose merchant API keys to uncontrolled token-drain attacks.
- **System Architecture & Technical Milestones**:
  - Architected a self-hosted TypeScript/Node.js RAG microservice backed by Qdrant Vector DB, PostgreSQL, and Redis semantic caching.
  - Built an automated web crawler and product catalog indexer achieving 50-100ms cached query responses.
  - Enforced hard monthly token-spend circuit breakers ($1 cap), AES-256-GCM API key vaults, and Argon2id admin authentication.
- **Verified Outcomes**:
  - Delivered sub-2-second grounded customer support responses at $0.001 per uncached message.
  - Protected merchant budgets with deterministic token-cost circuit breakers.
  - Deployed as an isolated multi-container Docker Compose stack behind Caddy/Nginx TLS.
- **Technology Stack**: Node.js (TypeScript), Qdrant Vector DB, PostgreSQL, Redis, Caddy, Docker Compose

---

## 4. Professional Experience & Career Chronology (13 Roles)

### 4.1 Founder, CEO & Principal Architect — Intrepid
- **Tenure**: June 2013 - Present (13 Years 1 Month)
- **Overview**: Founded and currently lead Intrepid, an engineering firm specializing in AI-native mobile applications, enterprise web platforms, and sovereign cloud infrastructure ecosystems.
- **Key Accomplishments**:
  - AI-Native Mobile & Clinical Systems: Architected and deployed cross-platform applications (Flutter/Riverpod) including AuraSpend (~77.5k LOC multimodal financial tracker), VitalSync (59.2k+ LOC clinical telemetry & BLE health ecosystem), and GlassWords.
  - Enterprise Web, FinTech & SaaS Engineering: Engineered 30 production-grade ecosystems across Next.js, React 19, SvelteKit 5, Go, and Python—including StoreVox ERP, Dictabill, TaxSage RAG, SchnittFlow, Brooky Treats FinTech, and Inos ITSM.
  - Sovereign Cloud SRE & DevOps: Designed and managed a zero-incremental-cost sovereign cloud on Oracle ARM64 VPS hosting 68 concurrent Docker containers, IntrepidVPN (WireGuard/Go netlink), and the Orbit SRE Gateway.
  - Product & Technical Governance: Established strict '14-Day Production Mandate', zero-knowledge WebAuthn/AES-256-GCM security, and Generative Engine Optimization (Schema.org @graph, llms.txt) across all properties.

### 4.2 AI Solutions Architect & Digital Transformation Leader — Instec Digital Systems
- **Tenure**: March 2025 - Present (1 Year 4 Months)
- **Overview**: Architecting and deploying enterprise-grade Generative AI solutions and automated code-generation frameworks to optimize internal and client development lifecycles.
- **Key Accomplishments**:
  - Strategic Roadmap & AI Vision: Partner with cross-functional leadership and enterprise clients to define the strategic roadmap for next-generation digital transformations, LLM integrations, and AI adoption.
  - Generative AI & Code Gen: Design and build custom AI pipelines and workflow engines (including JS Bank AI Champions Portal and Centralized Email Signature Suite) to accelerate development times and automate legacy IT operations.
  - Agentic AI Enablement & Training: Designed and delivered comprehensive workshops tracing the evolution from generative AI to Agentic AI and multi-agent platforms. Taught corporate executives and departmental leaders how to build progressively trained autonomous agents to handle daily routines with detailed audit trails, governance, and complete compliance intact.
  - Intelligent Operations (AIOps): Architected and deployed natural language AI agents integrated directly into existing enterprise monitoring and logging stacks (including SolarWinds, Elasticsearch, and Kibana), converting complex system querying into simple conversational streams.

### 4.3 Principal Cloud Solutions Architect & Enterprise Migration Lead — Instec Digital Systems (Google Cloud Practice / JS Bank)
- **Tenure**: August 2023 - March 2025 (1 Year 8 Months)
- **Overview**: Spearheaded nationwide digital transformation for a major private-sector commercial bank to Google Cloud, Workspace, and ChromeOS Enterprise. Handled end-to-end cloud infrastructure while independently architecting cross-departmental automation systems.
- **Key Accomplishments**:
  - Directory & License Optimization: Audited and restructured a fragmented directory of 4,500+ accounts (segmenting contract/active/resigned staff) to map data profiles and secure massive licensing cost savings.
  - Coexistence & Split Delivery: Architected split-delivery email routing for Workspace/M365 coexistence (retaining Microsoft for offline Excel power users) utilizing secure DKIM/SPF protocols.
  - Google Workspace & License AI Enablement: Led training for corporate departmental leaders on Google Workspace optimization. Educated teams to leverage the built-in AI integrations and collaboration features included in their basic Workspace licenses, maximizing software assets and ensuring a seamless, hiccup-free transition.
  - Self-Initiated Automation & Team Enablement: Independently championed cross-functional workflow optimization, building custom, secure automation engines using AppScript, Google Cloud, and GAM to bridge disparate databases, compressing manual tasks down to minutes.

### 4.4 Co-Founder, CEO & Lead Developer — Charts 4 PHP
- **Tenure**: March 2015 - Present (11 Years 4 Months)
- **Overview**: Bootstrapped and developed Charts 4 PHP (chartphp.com), an enterprise-grade PHP component that enables developers to build interactive, data-driven dashboards and charts with minimal code.
- **Key Accomplishments**:
  - Product Engineering & Architecture: Architected the entire framework from scratch, creating a seamless low-code solution that bridges complex backend database queries with dynamic, responsive HTML5/JS front-end rendering.
  - Business Leadership & Strategy: Managed the complete software lifecycle from initial ideation to a profitable SaaS business. Directed product strategy, global customer acquisition, and long-term feature roadmapping.
  - Technical Support & Enablement: Authored comprehensive technical documentation and provided direct, high-level support to global developers, ensuring seamless integration of the component into diverse, legacy, and modern PHP stacks.

### 4.5 Senior Cloud Solutions Engineer & Full-Stack Web Architect — Instec Digital Systems
- **Tenure**: April 2014 - July 2023 (9 Years 4 Months)
- **Overview**: Delivered high-performance cloud, infrastructure, and full-stack web solutions for a diverse portfolio of corporate, enterprise, and educational clients. Served as technical lead for complex legacy migrations, web engineering, and enterprise enablement.
- **Key Accomplishments**:
  - Cloud Infrastructure Management: Designed, managed, and optimized AWS environments, including Amazon Lightsail instances and secure Amazon S3 storage structures to host high-traffic client platforms.
  - Google for Education Emergency Mobilization: Designed and executed training programs for school teachers, faculty, and administration to adopt Google for Education. Created comprehensive guides and transition manuals during the pandemic, enabling schools to successfully move to remote learning without operational hiccups.
  - Legacy Migrations & Web Engineering: Orchestrated zero-downtime website and database migrations from outdated legacy hosting providers to secure AWS environments.
  - Custom Web Development: Engineered custom-coded digital solutions and enterprise-grade content management systems (CMS) including WordPress, Magento, and Drupal.

### 4.6 Head of IT & Web Infrastructure — AzCorp Entertainment Private Limited
- **Tenure**: June 2015 - February 2025 (9 Years 9 Months)
- **Overview**: Led the IT department and digital infrastructure for a premier comic publishing and entertainment company, managing internal enterprise environments and public-facing e-commerce platforms.
- **Key Accomplishments**:
  - Enterprise Cloud Migrations: Orchestrated the secure, organization-wide data migration from Dropbox to Google Drive. Led the complete transition to Google Workspace, serving as the primary administrator.
  - E-Commerce & Digital Product Engineering: Architected and maintained the primary e-commerce storefront (azcorpentertainment.com). Engineered a custom-tailored digital comic reader with secure, purchase-gated access rights.
  - DevOps & Brand Portfolio Management: Managed end-to-end DevOps, hosting environments, and DNS/email configurations for an extensive portfolio of domains.

### 4.7 Co-Founder — VoodWorx
- **Tenure**: September 2018 - August 2023 (5 Years)
- **Overview**: Co-founded VoodWorx and served as the lead carpenter and builder, physically crafting custom woodworking and DIY projects from scratch while sharing the build process on our YouTube channel.
- **Key Accomplishments**:
  - Hands-On Woodworking & Carpentry: Executed all physical building, from milling raw lumber to final finishing, handling structural planning, prototyping, and safe operation of power tools and workshop machinery.
  - Content Production & Brand Growth: Filmed and edited our hands-on building processes, growing the VoodWorx digital brand across YouTube, Facebook, and Instagram to share our craftsmanship with an online maker community.

### 4.8 Web Ninja — KnowledgeJump
- **Tenure**: August 2014 - 2023 (8 Years 6 Months)
- **Overview**: Delivered custom front-end components, user experience designs, and responsive web platforms to support client educational systems and interactive online portals.
- **Key Accomplishments**:
  - Engineered interactive web interfaces maximizing user engagement and content accessibility across diverse client desktop and mobile viewport configurations.

### 4.9 Founder — BisDezine
- **Tenure**: January 2014 - August 2015 (1 Year 8 Months)
- **Overview**: Responsible for BisDezine’s day-to-day operations, leading the company’s product development, customer relationship management, and technology strategy.
- **Key Accomplishments**:
  - Designed custom branding schemas and delivered performant web layouts tailored to startup business models and regional enterprise marketing goals.

### 4.10 IT&S Service Desk Support — United Energy Pakistan
- **Tenure**: July 2012 - March 2014 (1 Year 9 Months)
- **Overview**: Delivered comprehensive IT&S Service Desk operations and Desktop/Applications Support at United Energy Pakistan, ensuring infrastructure reliability and minimizing downtime for enterprise users.
- **Key Accomplishments**:
  - IT Service & Incident Management: Spearheaded incident management using the BMC Remedy IT Service Management suite, prioritizing and resolving technical tickets in adherence to corporate SLAs.
  - Identity & User Access Management: Administered enterprise user lifecycles, user access provisioning, and directory maintenance using ManageEngine.
  - Enterprise Asset Procurement: Streamlined the end-to-end procurement, configuration, and deployment of enterprise mobile devices (Blackberry infrastructure).

### 4.11 Marketing & Sales Head — PhpGrid.org
- **Tenure**: August 2010 - January 2013 (2 Years 6 Months)
- **Overview**: Led marketing and sales initiatives for PHPGrid, driving customer acquisition and retention through zero-cost Gmail-based CRM workflows.
- **Key Accomplishments**:
  - Custom CRM Architecture: Designed and deployed a customized Gmail-based CRM to segment lead stages (free, pending, purchased) and optimize the customer sales funnel.
  - Priority Support & Ticketing: Engineered a ticket tracking system within the CRM, isolating premium customers to ensure fast SLA delivery.
  - Targeted Email Marketing: Executed strategic email marketing campaigns on potential leads, leveraging localized, language-specific marketing to improve conversion rates.

### 4.12 IT Service Desk Coordinator — British Petroleum
- **Tenure**: July 2010 - June 2012 (2 Years)
- **Overview**: Orchestrated comprehensive IT&S Service Desk operations and Desktop Support across all British Petroleum (BP) sites throughout Pakistan.
- **Key Accomplishments**:
  - IT Service & Incident Management: Spearheaded incident management utilizing the BMC Remedy IT Service Management suite, resolving complex technical tickets under corporate SLAs.
  - Cross-Functional Coordination: Directed critical offsite communications and collaborated closely with global/regional IT teams to facilitate technical approvals and secure compliance.
  - Enterprise Asset Procurement: Streamlined procurement and deployment of enterprise mobile devices (Blackberry infrastructure), managing the complete hardware lifecycle.

### 4.13 System Engineer — IBEX | Global
- **Tenure**: September 2009 - June 2010 (10 Months)
- **Overview**: Joined the IT Support team, providing desktop and system administration support for over 400 machines across active campaigns.
- **Key Accomplishments**:
  - Support Operations: Handled hardware/software troubleshooting, campaign-specific application environments, and overall call center platform reliability.
  - Asset Management: Conducted inventory audits, tracking, and vendor negotiations for all IT accessories and hardware requirements.

---

## 5. Education, Certifications & Enterprise Enablement

### Education
- **Virtual University**: BS, Computer Science

### Professional Certifications
- Google Certified Professional ChromeOS Administrator
- G Suite Administration Specialization
- Programming for Everybody (Python)

### Enterprise AI & Workspace Enablement Programs
- AI Enablement: Agentic AI & Autonomous Workflows
- Google Workspace & AI Standard License Optimization
- Google for Education Remote Learning Architectures