Computer Science student (COMSATS University Islamabad, Expected Jan 2027) and former Software Engineering Intern at Neuronix Technologies.

Specialized in architecting and shipping production identity-verification (KYB), transaction-screening, and citation-grounded LLM systems. Core engineering competencies include:

• Event-Driven Microservices & Concurrency: Asynchronous multi-service pipelines and concurrent transactional backends built with Go (Gin), Python (FastAPI), Apache Kafka, and PostgreSQL / SQLite with multi-process epoch lease fencing.
• Applied Generative AI & Retrieval (RAG): Citation-verified hybrid retrieval architectures combining dense embeddings (BGE) and sparse lexical search (BM25) with Reciprocal Rank Fusion (RRF) in Qdrant, strict confidence guardrails, Langfuse observability, and Ragas automated evaluation.
• Clinical AI & Hardware-Accelerated LLMs: Enterprise clinical diagnostic decision support systems, NVIDIA T1200 4-bit CUDA GPU hardware acceleration, fine-tuned LoRA v4 generative reasoning with LangGraph, Decimal physical quantity evaluation (zero-tolerance), and SHAP / LIME explainability.

Below is a detailed inspection of production systems engineered across enterprise internships and advanced implementations:

Repository: github.com/sultanriaz/FYP-Medmind (Enterprise Clinical Repo)  |  Stack: Python (FastAPI), PyTorch (CUDA 12.1), Transformers & PEFT (MedMind LoRA v4), BitsAndBytes (4-bit NF4 Quantization), LangGraph Orchestrator, Next.js 16 (React 19, TypeScript), SQLite Concurrency (WAL + Multi-Process Epoch Lease Fencing), Decimal Physics Evaluator

System Purpose: Enterprise-grade clinical diagnostic intelligence, fine-tuned medical reasoning, and longitudinal health record engine engineered under strict healthcare data-safety standards. Features fine-tuned MedMind LoRA v4 generative model accelerated via 4-bit NF4 quantization on an NVIDIA T1200 Laptop GPU, multi-stage LangGraph clinical reasoning, zero-leak upload boundaries, multi-process distributed epoch lease fencing (BEGIN IMMEDIATE, monotonic lease bumping, dead-worker takeover), zero-tolerance Decimal physical quantity evaluation (rel_tol=0.0, abs_tol=1e-6), safe clinical abstention on corrupted OCR values, and dynamic SQL query tracing with sub-10ms response times.

flowchart TD
    Doc["Clinical Report (PDF / Image)"] --> UploadGate["Zero-Leak Upload Boundary (FastAPI)"]
    UploadGate --> ACIDRollback["Atomic DB Staging & Storage Isolation"]
    ACIDRollback --> Parser["Medical Parser & Decimal Evaluator"]
    
    subgraph "Strict Evaluator & Safe Abstention"
        Parser --> BoundsCheck{"Physiologic Interval & Syntax Check"}
        BoundsCheck -->|"Valid Numerical Interval"| UnitNorm["Decimal Physical Quantity Normalization"]
        BoundsCheck -->|"Corrupted OCR / Anomaly"| Abstain["Safe Clinical Abstention (Route to Review)"]
    end
    
    UnitNorm --> Reconcile["Multi-Process Reconciliation Worker"]
    
    subgraph "Distributed Epoch Lease Fencing"
        Reconcile --> Fencing{"BEGIN IMMEDIATE Epoch Fencing"}
        Fencing -->|"Active Valid Lease"| WriteProjections["Atomic Projection Rebuild & Assessment Save"]
        Fencing -->|"Epoch Superseded / Stale"| FenceError["FencingViolationError (Fail-Stop Isolation)"]
    end
    
    WriteProjections --> LongitudinalDB[("Longitudinal Health Record Timeline")]
    WriteProjections --> ClinEngine["Clinical Diagnostic Intelligence & Early Warning"]
    
    subgraph "4-Bit CUDA Hardware Acceleration & Clinical Reasoning"
        LongitudinalDB --> LangGraph["LangGraph Clinical Orchestrator"]
        LangGraph --> CudaGPU["NVIDIA T1200 GPU (BitsAndBytes 4-Bit NF4)"]
        CudaGPU --> QwenLoRA["Qwen2.5-1.5B + MedMind LoRA v4 (1.17 GB VRAM)"]
        QwenLoRA --> GroundingCheck{"Numerical Grounding & Safety Filter"}
        GroundingCheck -->|"Evidence Grounded"| VerifiedAns["Grounded Natural Clinical Explanation"]
        GroundingCheck -->|"Emergency Signal"| LifeSafety["Instantaneous Emergency Protocol Escalation"]
    end

    ClinEngine --> Workbench["Next.js 16 Clinician Workbench & Audit Ledger"]
    VerifiedAns --> Workbench
    LifeSafety --> Workbench

• Trained LoRA v4 & Hardware Acceleration: Quantized fine-tuned Qwen2.5-1.5B (MedMind LoRA v4) with bitsandbytes NF4 onto an NVIDIA T1200 Laptop GPU (4 GB VRAM, Turing cc 7.5, PyTorch CUDA 12.1). Reduced model memory footprint to 1,169.57 MB VRAM (28.5% utilization), achieving 100% generative model primacy with 0% silent fallbacks across the 30-case clinical evaluation matrix.
• LangGraph Clinical Reasoning & Balanced Safety: Orchestrated multi-stage dynamic retrieval, numerical grounding, reflection, and context-aware emergency safety routing. Enforces strict ADA diagnostic criteria ($\ge 126\text{ mg/dL}$ fasting glucose) and instantaneous emergency escalation for acute events (anaphylaxis, stroke, severe hyperkalemia, severe thrombocytopenia) with zero prompt wrapping and zero fallback degradation.
• Multi-Process Concurrency Safety: Connection-level SQLite epoch lease fencing across longitudinal projections and clinical assessment write paths. Validated under genuine subprocess SIGKILL termination, mid-rebuild recovery, and monotonic epoch bumping with 0 cross-patient state leakage.
• Strict Clinical Evaluator v2.0: Dual-engine evaluation (Validated Decimal Physics & Strict Bipartite Matching) operating at zero tolerance (rel_tol=0.0, abs_tol=1e-6). Enforces safe clinical abstention rather than heuristic guessing when OCR boundaries are corrupted.
• Verified Clinical Corpus & Quality Gates: 309/309 full backend test suite passing (100%), 102/102 clinical corpus cases verified (186/186 measurements matched strictly), 30/30 GPU clinical evaluation matrix passed with zero degradations, 17/17 live negative upload tests with zero DB/filesystem orphan leaks, and dynamic SQL tracing reducing query counts by 99.6% at scale ($N=500$).

Repository: github.com/sultanriaz/citerator  |  Stack: Python (FastAPI), React 19 (TypeScript), Qdrant (Dense + BM25 Hybrid), BGE Embeddings, Cross-Encoder Reranking, Multi-Tenant BOLA/IDOR Security, Langfuse, Ragas, HMAC Audit Ledger

System Purpose: Enterprise-grade Question-Answering and regulatory research engine engineered for AML/KYC compliance analysts. Features cryptographically verifiable source citations, strict default-deny multi-tenant isolation, cross-tenant leak prevention at retrieval/rerank/citation layers, EU AI Act / ISO 42001 compliance controls, and calibrated zero-hallucination refusal guarantees.

flowchart TD
    User["Compliance Analyst / Auditor"] --> ClientUI["React 19 + TypeScript Web Console"]
    
    subgraph "Boundary 1: Server-Side Identity Gate"
        ClientUI --> AuthGate["API Key & Server-Side Tenant Registry"]
        AuthGate -->|"Reject Forged Header / Escalation"| Deny["403 Forbidden"]
        AuthGate -->|"Verified TenantContext"| RouteHandler["FastAPI Application Gateway"]
    end
    
    subgraph "Boundary 2: Scoped Semantic Cache"
        RouteHandler --> CacheLookup{"Tenant-Partitioned Cache (v1:tenant:hash)"}
        CacheLookup -->|"Exact / Semantic Hit"| CachedResponse["Instant Answer (<15ms)"]
    end
    
    subgraph "Boundary 3: Retrieval & Index Filtering"
        CacheLookup -->|"Cache Miss"| HybridEngine["Hybrid Retrieval Coordinator"]
        HybridEngine --> Dense["Dense BGE Embedder"]
        HybridEngine --> Sparse["Sparse BM25 Lexical Embedder"]
        Dense --> Qdrant[("Qdrant Vector DB")]
        Sparse --> Qdrant
        Qdrant -->|"Enforce tenant_id Payload Filter"| RRF["Reciprocal Rank Fusion (RRF)"]
        RRF --> PostDrop["Post-Retrieval Defense-in-Depth Drop Guard"]
    end
    
    subgraph "Boundary 4: Pre-Rerank Neutralization"
        PostDrop --> PreRerankAuth["Pre-Rerank Tenant Authorization Guard"]
        PreRerankAuth --> Reranker["Cross-Encoder Reranker (top-k=5)"]
    end
    
    subgraph "Boundary 5: Confidence Gating & Grounded Generation"
        Reranker --> SigmoidGating["3-Band Sigmoid Confidence Guardrail"]
        SigmoidGating -->|"Score < 0.60 (Insufficient)"| Refuse["Deterministic Rejection & Escalation"]
        SigmoidGating -->|"0.60 <= Score < 0.82 (Low)"| Hedged["Hedged Answer + Mandatory Disclaimer"]
        SigmoidGating -->|"Score >= 0.82 (Confident)"| LLM["Grounding Prompt + Gemini / Claude"]
        LLM --> CitationResolver["Citation Authorization & Excerpt Matcher"]
        CitationResolver --> CacheStore["Store Scoped Cache (v1:tenant:hash)"]
    end
    
    subgraph "Observability & Audit Ledger"
        LLM --> LangfuseTrace["Langfuse Distributed Tracing"]
        RouteHandler --> AuditLedger[("HMAC-SHA256 Tamper-Evident Audit Chain")]
    end
    
    CitationResolver --> FinalResponse["Verified Answer with Clickable Citations"]
    Refuse --> FinalResponse
    Hedged --> FinalResponse

• Retrieval Pipeline & Hybrid Indexing: Dense vector search (BAAI/bge-base-en-v1.5) and sparse lexical BM25 fused via Reciprocal Rank Fusion (RRF) in Qdrant, followed by cross-encoder neural reranking.
• Multi-Tenant Security & BOLA/IDOR Defense (Session 3): Server-side tenant registry preventing forged X-Tenant-Id / X-User-Role headers, mandatory Qdrant payload filters during HNSW walk, pre-rerank candidate drop guards (preventing foreign text from entering cross-encoder context), citation resolution tenant authorization, and tenant-partitioned semantic cache namespaces (v1:<tenant_id>:<hash>).
• Confidence Guardrails & Safe Abstention: 3-band calibrated sigmoid confidence mechanism (confident $\ge 0.82$, low_confidence $0.60 \le s < 0.82$, insufficient $< 0.60$) ensuring out-of-corpus questions are deterministically refused with escalation drafts.
• Regulatory Governance & Audit Chain: EU AI Act (Art. 12/14/15) and ISO 42001 automated compliance checks, forward-linked HMAC SHA-256 audit ledger, and GDPR Article 17 right-to-erasure scanning engine.
• Ragas Benchmark Results & Observability:
  • Mean Faithfulness: 0.97 across test batches.
  • Refusal Accuracy: 100% on adversarial out-of-domain compliance inquiries.
  • Telemetry: End-to-end token cost, retrieval latency, and score telemetry traced to Langfuse.

Repository: github.com/sultanriaz/company-intelligence-crm  |  Stack: Python (FastAPI), React 18 (TypeScript), PostgreSQL 16 (SQLAlchemy 2.x Async), Celery, Redis, Anti-SSRF Crawler, Playwright, Transactional Outbox, AES-256-GCM, HMAC-SHA256, Tailwind CSS

System Purpose: Enterprise-grade multi-agent platform designed to discover companies, crawl and parse corporate websites with defense-in-depth scrapers, synthesize company intelligence, automatically qualify sales leads, manage relationships via a custom CRM, and execute compliant, personalized outbound email campaigns with human-in-the-loop review and transactional outbox guarantees.

flowchart TD
    User["Sales Ops / Admin"] --> Dashboard["React 18 + TypeScript CRM UI"]
    Dashboard --> Gateway["FastAPI REST API Gateway"]
    Gateway --> Orchestrator["Supervisor Workflow Engine (12-State Machine)"]
    
    subgraph "Phase 1: Discovery & Extraction"
        Orchestrator --> Disc["Website Discovery Agent"]
        Disc --> Scraper["Web Scraping Agent (Anti-SSRF & Token Bucket)"]
        Scraper --> Parser["HTML & Metadata Content Normalizer"]
    end
    
    subgraph "Phase 2: Research & Verification"
        Parser --> ResAgent["Company Research Agent"]
        ResAgent --> VerAgent["Data Verification Agent (Grounding & Confidence >= 0.60)"]
        VerAgent --> InsAgent["Business Insights Agent (ICP Fit & SWOT)"]
    end
    
    subgraph "Phase 3: Qualification & CRM Sync"
        InsAgent --> QualAgent["Lead Qualification Agent (0-100 Scoring)"]
        QualAgent --> CRMSync["CRM Sync Agent (PostgreSQL Multi-Tenant DB)"]
    end
    
    subgraph "Phase 4: Outreach & Delivery"
        CRMSync --> DraftAgent["Email Content Agent (CAN-SPAM Tokens)"]
        DraftAgent --> Gate{"Human Approval Gate"}
        Gate -->|"Approved"| Outbox["Transactional Outbox (SHA-256 Idempotency)"]
        Gate -->|"Rejected"| Staging["Quarantined / Edit Draft"]
        Outbox --> DeliveryAgent["Delivery Agent (Mock, Resend, SendGrid, SES)"]
        DeliveryAgent --> TrackingAgent["Tracking Agent (HMAC-SHA256 Webhook & Auto-Suppression)"]
    end
    
    CRMSync --> CRMDB[("PostgreSQL 16 (30 Schema Entities)")]
    Outbox --> CRMDB
    TrackingAgent --> CRMDB

• 11-Agent State Machine & Deterministic Ownership: Autonomous execution through 12 formal states (CREATED ➔ DISCOVERING ➔ EXTRACTING ➔ RESEARCHING ➔ VERIFYING ➔ ANALYZING ➔ SAVING ➔ EMAIL_PREPARATION ➔ APPROVAL_PENDING ➔ SENDING ➔ COMPLETED). Deterministic Python code owns all database transactions, rate limits, outbox dispatches, and budget enforcement ($2.00 max cost, 300s timeout guardrails).
• Anti-SSRF Web Security & Scraping Engine: Hardened web crawling infrastructure enforcing pre-flight DNS checks against RFC 1918 subnets, IPv6 loopbacks, link-local IPs, and cloud metadata services (169.254.169.254, metadata.google.internal), coupled with custom HTTPX per-redirect validation hooks and robots.txt caching.
• Custom Multi-Tenant CRM Engine: 30 relational entities declared in SQLAlchemy 2.x async ORM with lazy="selectin" eager loading, automated Alembic migrations, explainable multi-dimensional lead scoring (0–100), and interactive Kanban pipeline management.
• Transactional Outbox & Delivery Safeguards: Double-send idempotency locks generated via deterministic SHA-256 keys, human approval gates (APPROVAL_PENDING), automatic CAN-SPAM physical postal address and unsubscribe token injection, and HMAC-SHA256 authenticated provider webhooks with instant bounce/complaint suppression.
• Automated Test Suite & Quality Gates: 37/37 automated tests passing (100%) across unit, integration, and full end-to-end acceptance scenarios, with a zero-warning React 18 production build (tsc && vite build).

Repository: github.com/sultanriaz/financial-ai-platform  |  Stack: Python (FastAPI), Apache Kafka, PyTorch, HuggingFace FinBERT, spaCy NER, asyncpg, PostgreSQL, WebSockets

System Purpose: Distributed sub-second streaming engine ingesting financial news headlines from major market wires, resolving named entity tickers, computing financial sentiment vectors, and broadcasting actionable insights via persistent WebSockets.

sequenceDiagram
    autonumber
    participant Feeds as Financial Wires (CNBC / Yahoo / MarketWatch)
    participant Scraper as Async Producer (aiohttp)
    participant Kafka as Apache Kafka Broker
    participant Worker as FinBERT / spaCy AI Consumer
    participant DB as PostgreSQL (asyncpg)
    participant Gateway as FastAPI WebSocket Gateway
    participant UI as Financial Dashboard (React/TS)

    Feeds->>Scraper: Polled Headlines & Tickers
    Scraper->>Kafka: Publish Raw Ingestion Event (news-raw-topic)
    Kafka->>Worker: Consume Event Batch
    Worker->>Worker: Extract Companies via spaCy NER -> Map to Tickers
    Worker->>Worker: FinBERT Sentiment Inference (Positive / Neutral / Negative)
    Worker->>DB: Upsert Analyzed Signals & Historical Trends
    Worker->>Kafka: Publish Enriched Sentiment Event (sentiment-enriched-topic)
    Kafka->>Gateway: Event Consumer Listeners
    Gateway->>UI: Real-Time WebSocket Push (< 850ms End-to-End Latency)

• Ingestion & Resolution: Concurrent asynchronous polling of news wires; automated mapping of corporate entity names to standard market tickers using customized spaCy NER.
• Inference Pipeline: Domain-adapted ProsusAI/finbert transformer models running batched GPU/CPU tensor inference to generate directional sentiment polarity and confidence scores.
• Distribution: Real-time event broadcasting over asynchronous WebSocket channels with sub-second end-to-end latency and indexed persistence in PostgreSQL via asyncpg.

Engineering Context: Software Engineering Internship at Neuronix Technologies  |  Stack: Go (Gin), Python (FastAPI), Apache Kafka, PostgreSQL, Docker Compose, Google Gemini, LangChain, JWT

System Purpose: Multi-service business identity verification (KYB) and transaction risk screening architecture automating commercial registry cross-referencing and AML compliance checks.

graph TD
    Client["Client / Merchant Admin"] -->|REST / JWT| GoGateway["Go (Gin) Gateway & Auth Service"]
    GoGateway --> KafkaIntake["Kafka Intake Bus (kyb-submissions)"]
    
    subgraph "Python AI Screening Service"
        KafkaIntake --> Consumer["Kafka Consumer Service"]
        Consumer --> DocParser["Corporate Document Extraction"]
        DocParser --> LangChainAgent["Multi-Agent Reviewer (LangChain + Gemini API)"]
        LangChainAgent --> SanctionScreen["Registry Cross-Match & Sanction Check"]
        SanctionScreen --> RiskModel["Risk Scoring & Anomaly Classification"]
    end

    RiskModel --> KafkaOutput["Kafka Results Bus (kyb-verified)"]
    KafkaOutput --> GoPersist["Go Service Consumer"]
    GoPersist --> Postgres[("PostgreSQL Multi-Tenant DB")]
    Postgres --> GoGateway
    GoGateway --> AuditTrail["Immutable Verification Audit Trail & Notification"]

• Dual-Engine Microservices: High-throughput intake routing and JWT security enforcement written in Go (Gin); AI agentic document comprehension and semantic extraction implemented in Python (FastAPI).
• Agentic Registry Matching: Google Gemini API orchestrated with LangChain for corporate registration document parsing, UBO (Ultimate Beneficial Owner) discovery, and sanction list verification.
• Isolation & Deployment: Strict multi-tenant row-level authorization boundaries; complete containerized topology orchestrated via Docker Compose.

• Email: khansultanriaz@gmail.com
• LinkedIn: linkedin.com/in/sultan-riaz
• GitHub: github.com/sultanriaz
• Location: Dera Ghazi Khan / Islamabad, Pakistan