AI engineer · Dhaka, Bangladesh (UTC+6)
I build LLM systems and the tooling around them, in Python and TypeScript. Three are installable from public registries. One is deployed, monitored and alerting right now. Three of them exist because I measured something and the measurement disagreed with my design.
Available for remote junior and intern AI engineering roles, and for scoped contract builds.
Four public checkpoints, each one cleared by somebody else: a registry accepted the package, a marketplace reviewed and listed the action, a platform hosts the Space, and an independent monitor reports the service up.
Approach / 01
Guardrails, mostly.
Three separate projects where the contribution is the thing that stops something bad happening: a CLI that intercepts destructive Git operations before they execute, a CI action that blocks non-compliant merges, and a daily gate that fails the build when the data stops making sense.
The other half is measurement — evaluation harnesses and query plans that tell you whether a system actually works, rather than whether it looks like it does.
Tool-calling agents where the interesting part is the interception layer — what the model is not permitted to do. Git Sensei blocks destructive repository operations before they execute rather than warning after.
RAG where the basis for a decision is an authoritative document, not a regular expression. The Data Guardian judges whether support-ticket content is sensitive by retrieving over the written data-governance policy, and logs every redaction to an ES|QL dashboard so the decision can be audited afterwards.
Three projects exist because I measured something and the result contradicted the design I had already written. retrieval-eval scored seven retrievers and published three negative results. guardian-analytics built, measured and dropped three candidate indexes. llm-lab disproved its own core hypothesis, then corrected its own headline number when a better measurement contradicted it.
All three, belowEvidence / 01
Eight projects, all public, all licensed. Three install or run from a public registry without cloning anything, and one is deployed right now with a status page you can check.
PostgreSQL · Fastify · deployed and operated
Live service · public status page
A five-table PostgreSQL model of a compliance-audit domain, filled by a dependency-free deterministic generator with 201,619 synthetic violations across 18 months. It answers six questions a flat search index cannot: repeat-offender intervals, month-over-month trends, top-N per department, p95 scan duration, a flagged-but-never-actioned anti-join, and cumulative load. Index choices are measured, not assumed — EXPLAIN (ANALYZE, BUFFERS) before and after, medians of five runs, and three candidate indexes built, measured and dropped with the numbers that disqualified them.
Deployed and operated as a read-only API
All load is synthetic — a scheduled generator, CI and the uptime monitor. No real users.
The interesting part
Both alarms were proven by drill rather than assumed. An induced anomaly fired the alert and recovered. Dropping a measured index regressed the repeat-offender query from 424 ms to 592 ms — its window sort lost the pre-sorted input and spilled 5,144 kB to disk. Diagnosed from the query plan, restored, and written up as a post-mortem.
Exact Mixture-of-Experts inference · measured on commodity hardware · MIT
The core hypothesis was measured and disproved
An exact Mixture-of-Experts inference pipeline, built to prove that a cheap, GPU-less PC — AMD Ryzen 5 5600G (6 cores, no discrete GPU), ~16 GB RAM, PCIe-3 NVMe — could run models far larger than its memory by streaming weights from disk. Careful measurement disproved the premise: the binder is compute and RAM bandwidth, not disk.
What survives
Streaming here is dormant, not dead: it would bind on a larger MoE or a higher-bandwidth tier. Findings are scoped to this box, this model, these workloads. Every number above traces to a committed command and its output.
The interesting part
Then a better measurement disproved my own headline number. 4.3 tok/s turned out to be a per-invocation cold-load artifact — each fresh process re-faulted the ~14 GB working set. Warm, sustained, in-process decode is ~9.2 tok/s, and during it the drive sits idle while all six worker threads peg. A prior-art check then closed the follow-on idea on evidence.
A natural-language Git assistant. You describe the outcome you want; it translates that into shell commands — and a guard layer intercepts destructive repository operations before they execute. Python with the OpenRouter API, packaged for PyPI so it installs with a single pip command.
The interesting part
The interception is the point, not the translation. “What stops the agent doing damage?” is the hardest question about LLM tool use, and it deserves a mechanism rather than a warning dialog.
GitHub Action · published on the GitHub Marketplace · MIT
Built for the Chrome Baseline Tooling Hackathon
A CI action that scans CSS against MDN Baseline compatibility data, posts an actionable policy report on every pull request, and blocks merges that break web-compatibility policy.
The interesting part
It is policy as code, in the merge path where it cannot be skipped. Structurally the same thing as an eval gate in an ML pipeline — take an external spec, turn it into a rule a machine enforces, then put the machine somewhere a human can’t wave it through.
Multimodal debugging agent · deployed on Hugging Face Spaces · MIT
Built for the Gemini 3 Hackathon
Give it a screen recording of a bug and the repository the bug lives in. It uses vision and a long context window to localise the fault, proposes a patch, and generates a Playwright regression test that verifies the fix visually.
The interesting part
Most demos stop at “proposes a patch”. This one closes the loop — perceive, localise, act, and then produce evidence the action worked.
Detects and redacts personally identifiable information in live support tickets. It judges sensitivity by retrieving over the written data-governance policy rather than pattern-matching alone, and logs every redaction to an ES|QL dashboard for audit.
The interesting part
Grounded decisions plus provenance. If you can’t show why something was redacted, you don’t have a compliance tool — you have a filter. The retrieval claims in this design are the ones retrieval-eval went on to test, and partly disprove.
Offline retrieval evaluation · three negative results · MIT
Runs locally on ONNX Runtime · the-data-guardian/retrieval-eval
An evaluation harness written to test retrieval claims that The Data Guardian’s design had asserted without a measurement behind them. A 300-document corpus from the public-domain NIST SP 800-53 Rev 5 OSCAL catalog, 36 graded queries across keyword, paraphrase and multi-document shapes, frozen before any retriever ran, and seven retrievers scored on nDCG@10, Recall@10 and MRR@10.
The useful output is the three things that did not work
Nothing deployed, no users. The point was the measurement.
The interesting part
Most portfolios show only what worked. These three results contradicted a design I had already written, which is exactly why they were worth publishing.
Renders live news and weather inside a strict 40×24 Teletext grid, with CRT shaders.
The interesting part
The aesthetic isn’t the problem — fitting arbitrary live content into a fixed 40×24 cell budget is. It’s a constraint-satisfaction engine wearing a UI costume.
Approach / 02
I'm looking for three things, in this order.
A junior AI/LLM engineering role or internship, fully remote. What I want most from a first job is real users and day-to-day code review.
Scoped contract builds — a defined deliverable with a defined end. The work I’m best at is turning a manual workflow into a tool that runs on its own.
Open-source collaboration. I contribute upstream as well as publish. Patches of mine are merged and shipped in an open-source developer CLI I use daily: a regression test across seven document templates, and a rendering feature that started as a one-word layout bug I hit myself. If something I’ve built is useful to you and it’s missing a feature, open an issue and I’ll read it.
Profile / 01
I'm Md. Rafi, a software engineering undergraduate in Dhaka, Bangladesh.
I started shipping LLM tooling in September 2025, and decided early that publishing to a registry — where installation is one command and anyone can read the source — is a different discipline from building a demo. It forces decisions you can skip otherwise: what happens on bad input, what the tool refuses to do, whether a stranger can run it without you in the room.
Four of these eight projects began as hackathon entries. The deadline is a feature: it's the constraint that decides what the project actually is.
I plan to transfer to Universiti Tun Abdul Razak in Kuala Lumpur in late 2026, pending visa. My location changes; my availability doesn't. That's why the work I'm looking for is remote.
“Rafi Automation Systems” is the name I publish my work under. It's a name for the work, not a company with staff.
Record / 01
B.Sc. Software Engineering · in progress · first year completed (3 semesters)
Continuing from the first year at Universiti Tun Abdul Razak, Kuala Lumpur (Q4 2026 intake)
Higher Secondary Certificate (Science) · October 2024 · GPA 4.92 / 5.00
Cambridge University Press & Assessment, 2026
Overall 186, CEFR level C1
Codecademy, 2025
Kiro AI, Devpost, 2025.
DIUSEC, Daffodil International University, 2025 · 5th overall, 4 problems solved
Native
Cambridge Linguaskill, overall 186 (CEFR C1)
Technical skills