Now playing
How the work got here.
Nine scenes, from coursework in C to an OAuth 2.1 server written because nobody sold one. Under thirty seconds.
How the work got here
Every number in it is on the record.Three acts, nine scenes
Read it instead — same film, with the numbers left in.
Practice.
Four years of theory, two internships inside a single summer, and a first job spent underneath the product rather than on top of it.
- 012021—25Pandit Deendayal Energy University
Four years of theory.
B.Tech in Computer Science, 2021 to 2025, out at 8.26. The public trail starts in May 2024, when the coursework went up in one batch — cryptography algorithms in C, a hostel manager in Python, a macromolecular classifier in a notebook.
None of it was a product. All of it was practice.
- 02May—Jul 2024Woosong University · Superior Exports
Two internships, one summer.
May to July 2024 ran twice over. One half was research: AI/ML for smart buildings at Woosong University in South Korea, predictive models in TensorFlow at 85% accuracy, energy optimisation validated at 25% across ten-plus building systems, written up as a paper. The other half was delivery: a MERN B2B platform for the diamond trade at Superior Exports, 40% faster after query tuning, lazy loading and caching.
- 03Dec 2024AppArrow Infotech
The first job was infrastructure.
Terraform, Python and Bash on GCP — automated deployments, CI/CD pipelines, IAM under least privilege. Build errors down 15%, build times down 25%. Alongside it, a multi-tenant School ERP in Next.js and PostgreSQL with custom subdomain routing and role-based auth. A year spent underneath the product before building on top of one.
Scale.
The title still said infrastructure. The work had already become 35 terabytes, agent infrastructure, and an authorization server that had to be written because nobody sold one.
- 04The turnInfrastructure → product
Then the work changed shape.
The resume still said GCP Developer. The work had already stopped being infrastructure and become product engineering — backend, data pipeline, frontend, and the agent layer sitting above all three. The title was running about a year behind what was actually shipping. Closing that gap is most of what the last year has been.
- 052026DevX AI Labs · Music Tribe
Thirty-five terabytes.
35 TB across 5.6 million files moved from Alibaba Cloud OSS to Google Cloud Storage. Zero downtime, a 100% verification match, no errors, and deduplication reclaiming 8.85 TB at zero egress cost. The finding that mattered was counter-intuitive: 50 concurrent workers failed 26 of 58 transfers where 20 workers failed 5 of 38.
More parallelism was worse — measured, not assumed.
- 062026MCP server · Emissary
Writing the auth server nobody sold.
Pulse MCP exposes a delivery-governance platform through 35 RBAC-scoped tools across 13 domains. MCP clients require Dynamic Client Registration and no managed provider offered it, so the OAuth 2.1 Authorization Server was written from scratch — RFC 7591, PKCE, RS256/JWKS, Google Workspace federation. Above it sits an ADK agent built on the same refusal to trust a model with identity: it never states who it is, and the product re-derives role and project scope on every single call. It started as a router with three specialists, until tracing showed the handoff cost 2.8 seconds a session and bought nothing, so it collapsed to one agent.
The layer that brokers access is allowed to decide nothing.
Everything at once.
Three engagements on one calendar, two security findings nobody asked for, and a way of building that had turned up in four projects before it had a name.
- 07Jun—Aug 2026CarryScore · GlideTech
Three engagements at once.
June added tech lead on CarryScore — around 4,500 products scored 0–100 against 15,291 analysed reviews, gated so a score is suppressed entirely below ten. August added the whole AI subsystem of a live trading platform at GlideTech, with an LLM compliance classifier standing over every model output. TradingLogic AI went from nothing to a shipped product inside one week, sole author.
Three engagements, one calendar.
- 08Sep 2026TradeScanner Pro
The week the malware showed up.
On 11 September a routine merge from origin pulled in a payload hidden in next.config.js — 41 injecting commits, all 54 remote branches, live for about eleven weeks. Its string decoder was reimplemented in Python so the payload could be read without ever being run. Eleven days earlier came a second, unrelated finding: a JWT bypass across all eight WebSocket endpoints.
Both were written up. Neither was the job.
- 09TodaySurat, India
Today.
Around half a million lines across the projects, sole author on eight of them, production systems on four clouds, two independent security findings, thirty-odd written deliverables. Underneath all of it sits one idea that turned up independently in four separate projects before it had a name.
The model decides what. The code decides how. And a system refuses before it guesses.