Muhammad Salman
Contact

backendai / llmdevopsfull stack

I build backend services and fix the pipelines nobody wants to touch.

Software engineer at 9D Technologies. I build backend services in Python and FastAPI, the pipelines that ship them, and the telemetry that explains them when they break.

GSoC 2025 at FOSSology: one monolith became 10+ services on Kubernetes, and builds got 40% faster. My code ships in official Jenkins releases, OWASP made me a collaborator on Nest, and lately I build LLM agents that are only allowed to do what they can prove.

See the work Résumé
salman@env: ~interactive · type help

salman@env:~$ whoami

software engineer · backend, ai, devops · 9D Technologies · Lahore

salman@env:~$ kubectl get contributions -n open-source

NAMESCOPESTATUSRELEASE
jenkins/dockerenv-var-substshippedLTS 2.568.1
jenkins/corea11y, kbd-navmergedweekly
fossology19 PRsmergedGSoC 2025
owasp/nesta11y, securityactivecollab
sktimeforecastingreviewopen

salman@env:~$ cat now.json

{
  "shipping": "auth + reporting services in FastAPI @ 9D",
  "building": "Ezvor: judge-verified readiness scores",
  "in_review": ["sktime#10316", "jenkins#26418", "jenkins#26321"],
  "open_to": "backend · platform · AI engineering"
}
01 · experience

The road so far

Laid out like a trace in Jaeger, because that’s how I read systems. Every role is a span. Open one for its attributes: what I owned, what shipped, and what it ran on.

salman.careertrace_id 5a1ma9c0de4320
uafbs.cs
3y 10mo

BS Computer Science

University of Agriculture, Faisalabad · Sep 2022 → Jun 2026

Graduated with a 3.37/4.0 CGPA on an 80% PEEF merit scholarship. Won 1st place university-wide at the Byte & Battle hackathon.

span.kind
education
cgpa
3.37
scholarship
PEEF 80%
duration
3y 10mo
hywizintern
5mo

Software Engineer Intern

Hywiz Technologies · May 2023 → Sep 2023

Shipped product modules and REST APIs with React, Node.js and Express. Replaced a manual daily data export with MongoDB aggregation pipelines.

span.kind
work
stack
react, node, express, mongodb
duration
5mo
fiverrfreelance
1y 4mo

Freelance Software Engineer

Fiverr and direct clients · Oct 2023 → Jan 2025

Shipped full-stack apps and the delivery plumbing behind them for 8 to 10 clients: Jenkins and GitHub Actions pipelines, Docker images, AWS deploys on EC2 and S3.

span.kind
work
stack
react, node, docker, jenkins, aws
clients
8-10
duration
1y 4mo
fossologygsoc.k8s
8mo

Software Engineer (Open Source), FOSSology

Google Summer of Code · Remote · Feb 2025 → Sep 2025

Revived a microservices branch that had been frozen since 2021 and made it run on 2025 infrastructure. FOSSology went from one monolithic deployment to 10+ services on Docker and Kubernetes.

  • Moved the build from Make to CMake. Builds got 40% faster, and a CI pipeline that had been red for the team went green.
  • Traced a scheduler crash loop through PostgreSQL schema limits, container networking and init ordering, then fixed it.
  • Wrote a Kustomize base with dev and prod overlays across 26 manifests.
View evidence ↗
span.kind
open source
stack
kubernetes, docker, kustomize, cmake, postgres
weeks
13
duration
8mo
linux-fdnlift.scholar
2mo

LiFT Scholar

Linux Foundation · Jul 2025 → Aug 2025

Full scholarship for the Kubernetes for Developers (LFD259) course and certification exam.

span.kind
award
cert
LFD259
track
kubernetes
duration
2mo
jenkinscontrib
9mo · live

Open Source Contributor

Jenkins project · Jan 2026 → present

Contributor to Jenkins core, the official Docker images and the theme manager plugin. Five PRs merged; two of them ship inside every official Jenkins container.

  • Closed an issue open since 2017: opt-in env var substitution for containerized Jenkins.
  • Brought the same feature to Windows containers in PowerShell, with Pester tests.
  • Fixed keyboard traps and added ARIA roles in the core UI. I found and reported most of these bugs myself.
View evidence ↗
span.kind
open source
repos
jenkins, docker, theme-manager-plugin
shipped
2.565, LTS 2.568.1
duration
9mo
owasp-nestcollab
9mo · live

Collaborator, OWASP Nest

OWASP Foundation · Jan 2026 → present

Earned collaborator access after finding and helping fix broken keyboard focus indicators. Listed as a GSoC 2026 mentor. Reported a security issue to the maintainers through private disclosure.

View evidence ↗
span.kind
open source
repo
OWASP/Nest
access
collaborator
duration
9mo
9d-technologiesbackend
2mo · live

Backend Software Engineer

9D Technologies · Lahore · Aug 2026 → present

Own backend services end to end: Python and FastAPI APIs, the database work behind them, and the CI/CD that tests and ships them.

  • Built an authentication service in FastAPI: request validation, error handling, secure endpoint design.
  • Wrote the REST endpoints for a task management platform’s reporting module, so reports generate themselves instead of being assembled by hand.
  • Set up GitHub Actions pipelines that test and deploy the backend services on every change.
  • Shipped PDF Scanner Web: 31 document tools that run entirely in the browser, zero server uploads.
span.kind
work
stack
python, fastapi, postgres, github actions
status
active
duration
2mo
02 · contributions

Code I got merged

I go after the bugs people have learned to live with: an issue open since 2017, keyboard traps nobody reproduced, a build nobody wanted to migrate. Reproduce it, write it up, ship the fix upstream. Every row links to the PR.

28merged PRs across 7 orgsevery PR on GitHub ↗
merged PRs / monthmesherytypo3numfocusfossologyjenkinsowasp
Oct 24
Jan 25
Jan 26
Sep 26

Jenkins

Core, the official Docker images, and the theme manager plugin.

Shipped in Weekly 2.565 and LTS 2.568.1
Full history ↗

Python, data & AI

Time series ML, an LLM analysis engine, and the NumFOCUS community guide.

03 · ai engineering

LLMs on a short leash

I put models where judgment helps and keep them out of where correctness matters. Rules handle what’s known. The LLM gets read-only tools for what isn’t. Whatever it proposes goes through the same guard a human would. Pick a failure and watch the loop run.

  1. worker-servicethe thing that breaks
  2. SigNozalert rules · query API
  3. watcher · diagnose()never calls the worker
  4. tier 1 · rulesplain if / else
    tier 2 · LLM2 read-only tools
  5. guardrailsallowlist · safetyCheck · 10s timeout
  6. control-plane3 switches in Postgres
  7. incident logwritten every time
watcher-service · logs
LLM_PROVIDER=

    replays the real control flow of signoz-ai-sre · timings compressed, logic unchanged · “prompt-inject” is a what-if

    1. 01

      Deterministic first

      Known failures take a plain if/else. The model only sees what the rules can’t explain, so the common path stays fast, free and testable.

      diagnose.js, tier 1 ↗
    2. 02

      Guardrails live outside the model

      A three-key action allowlist, two read-only tools, a hard 10 second timeout, and the same safety check humans go through. Safety comes from a small action space, not from trusting the output.

      guardrail table ↗
    3. 03

      Every model call is a span

      Model name, input and output tokens, and each tool call land in the trace next to the infra they investigated. Cost per investigation is a query, not a guess.

      gen_ai.* spans ↗
    4. 04

      Fallbacks are part of the contract

      No key, a timeout or a bad answer resolves to a safe “needs a human”. In FailureTwin I put the live model path in front and kept the deterministic engine behind it.

      failuretwin-ai#12 ↗
    ask(resume, q)bm25 · runs in your browser · cited

    // ask something. the index loads on first question.

    retrieval only, no model call: every answer is a cited line from this site’s own data, so there’s nothing to hallucinate.

    where AI shows up in my work

    ai sdk · gemini · claude · gpt · langchain · embeddings · bm25 · opentelemetry gen_ai.*

    04 · main project

    Ezvor, the one I’m proudest of

    Preparing for internships, I had three job boards open, a roadmap I never finished, and a problem site that knew nothing about either. None of it could tell me whether I was hireable. Ezvor puts it in one place and scores only work a judge has verified.

    From first commit to offer letter.

    1. 01

      Only the judge counts

      A problem counts only after the sandboxed execution backend accepts it. The client has no way to report its own progress.

    2. 02

      The score is a pure function

      The readiness engine makes no network calls and uses no AI. Same evidence, same score, so it can be tested and can’t be gamed.

    3. 03

      Deadlines come from the source

      GSoC, LFX and Outreachy status is scraped from their own pages, so a closed program never shows as open.

    TanStack StartReact 19TypeScriptSupabasePostgres + RLSMonacoFirecrawlGeminiRAG
    Open live app ↗Read the code
    readiness(evidence) → scoretry it

    biggest next move

    Raise DSA by 10 for +3.5 points

    same input → same score, every time

    • Readiness Engine

      A score broken into pillars, with the next moves that would raise it most.

    • DSA Arena

      3,977 auto-graded problems in a Monaco editor, with hidden tests and runtime and memory feedback.

    • Opportunities

      Open source programs and internships, each marked Open, Closed or Rolling.

    • Roadmaps

      Interactive graph roadmaps with free resources on every node.

    • AI Advisor

      A chat advisor behind a model gateway with a Gemini fallback, for questions a score can’t answer.

    • Compiler

      A standalone compiler for quick throwaway code.

    05 · pdf scanner web

    PDF Scanner, shipped at 9D

    The web side of PDF Scanner, an Android app with 50M+ installs and a 4.8★ rating. It covers what people usually open iLovePDF or CamScanner for, except every byte stays on the device: no account, no upload, no conversion server to pay for.

    31tools
    50M+app installs
    4.8★Play rating
    0server uploads
    React 19TypeScriptTanStack StartViteTailwindWeb WorkersIn-browser OCR
    Try it live ↗Source
    • Organize5

      Merge, split, reorder, extract, remove

    • Optimize5

      Compress, repair, OCR, flatten, PDF/A

    • Convert5

      Images, JPG, Word, Excel, PowerPoint

    • Edit & sign5

      Sign, watermark, edit, page numbers, crop

    • Security5

      Lock, unlock, redact, compare, metadata

    • Scan & OCR6

      Scan, searchable PDF, cleanup, receipts, rename

    06 · projects

    More things I’ve built

    Every one of these exists because something broke, or was slow, or lied to me, and I wanted to see why. The first one is running below: move the sliders.

    GSoC 2026 proof of concept−81% trace data

    PoS-OTel: OpenTelemetry for Jenkins CI

    During GSoC 2025 I spent whole afternoons matching container logs by hand. This is the tool I wanted then. Jenkins exports traces over OTLP to a collector that tail-samples them: every failed build and every build over 30 seconds is kept, plus 20% of the rest. Jaeger stores the traces, span metrics feed Prometheus and Grafana, and alert rules ship with it.

    noteBuilt as the proof of concept for my GSoC 2026 proposal to Jenkins. The project wasn’t selected this year, but the stack stands on its own with one docker compose up.

    OpenTelemetry CollectorJaegerPrometheusGrafanaPythonDocker Compose
    View repository ↗Jenkins community thread
    otel-collector · tail_samplingsimulated jenkins traffic
    0traces seen
    0kept
    0/0errors kept
    0%fewer traces stored
    measured on real Jenkins runs: 81% less trace data, no failed or slow build lost
    Self-healing infra · LLM agentsee it run ↑
    SigNoz AI SRE
    A watcher that never calls the service it protects. It reads SigNoz alerts, fixes known failures with plain rules, and hands unknown ones to an LLM with two read-only tools. Every model call is a span; every action lands in an audit log.
    OpenTelemetrySigNozVercel AI SDKGemini · Claude · GPTNode.jsPostgres
    code ↗
    GSoC 2025−40% build time
    FOSSology microservices
    Scheduler, database and agents split into 10+ Kubernetes services, with a Kustomize base and overlays. The repo holds all 13 weekly reports and the final report.
    KubernetesDockerKustomizeCMakePostgreSQL
    code ↗
    Web app
    Stremo
    Streams public domain and Creative Commons films from the Internet Archive, from film noir to the silent era. SSR, Supabase auth, no copyrighted content hosted.
    TanStack StartTypeScriptSupabaseBun
    code ↗live ↗
    Browser extension
    RevealX
    Shows what’s typed into a password field. Toggling the input’s type breaks on React and Vue, which re-render it back, so this reads the value instead. Handles shadow DOM and asks for zero permissions.
    JavaScriptManifest V3Shadow DOM
    code ↗
    Chrome extension
    AutoAccept
    One-click Accept All on Facebook’s friend requests page, and it keeps working as infinite scroll loads more.
    JavaScriptChrome Extension
    code ↗
    All repositories on GitHub ↗
    07 · changelog
    The changelog
    Append-only, newest first. Every merge, ship and win, with the link that proves it.
    $ git log --oneline --graph
    1. 06ddd582026-09feat:PDF Scanner Web: 31 document tools, all in the browser, for 9D Technologies
    2. 094c45c2026-08-09merge:Live LLM analysis path with the deterministic engine kept as fallbackfailuretwin-ai#12
    3. 61edd8f2026-08chore:Joined 9D Technologies as a Backend Software Engineer
    4. 8f793342026-07-20feat:SigNoz AI SRE: self-healing loop with a guarded LLM tier
    5. f4e7e8b2026-07-07feat:Ezvor: career platform scored only on judge-verified work
    6. d35f0f22026-06-10merge:Env var substitution for Windows containers, shipped in LTS 2.568.1jenkinsci/docker#2365
    7. 580fdd92026-05-18merge:Closed a 2017 issue: env var substitution in the official Jenkins imagejenkinsci/docker#2250
    8. 1c5c4772026-03-17feat:PoS-OTel: OpenTelemetry pipeline for Jenkins CI, 81% less trace data
    9. caa98c42026-03-04merge:Keyboard navigation scrolling in Jenkins core dropdownsjenkinsci/jenkins#26358
    10. e97c4682026-03-03merge:Keyboard navigation for the Jenkins theme pickertheme-manager#350
    11. 479b4202026-01-27chore:OWASP Nest collaborator, added to the GSoC 2026 mentor listOWASP/Nest#3605
    12. 010d8472026-01-07merge:Copyright agent URL regex fix in FOSSologyfossology#3212
    13. 92550842025-12-17merge:First merge into the Jenkins projectjenkins.io#8629
    14. bf624242025-09win:Completed Google Summer of Code 2025 at FOSSology
    15. da4a1372025-07win:Linux Foundation LiFT scholarship for Kubernetes LFD259
    16. d28f4eb2025-06-03docs:My Google Summer of Code 2025 journey
    17. 665efa62025-05-29merge:Four FOSSology fixes merged before GSoC began: nomos, tests, regex, loggingfossology#2947
    18. 05cbb292025-05win:Selected for Google Summer of Code 2025, under 5% acceptance
    19. 13023272025-03win:Byte & Battle hackathon: 1st university-wide, 3rd at district level
    20. 043c2e12024-12-26merge:NumFOCUS DISCOVER Cookbook editsnumfocus#73
    21. da665052024-10-06merge:Hacktoberfest: first merges into other people’s codeTYPO3/tea#1480
    22. 04e5b1a2023-10chore:Started freelancing: full-stack apps and CI/CD for 8 to 10 clients
    23. 0df80a42023-05chore:Software Engineer Intern at Hywiz Technologies
    08 · skills
    Skills, with proof
    A skill list is a claim. Click any one to see where I actually used it.
    Backend
    APIs, data, and the boring correctness that keeps them up.
    AI / LLM
    Models where judgment helps, rules where correctness matters.
    DevOps & infra
    Containers, pipelines, and telemetry that tells you why.
    Full stack
    Interfaces that are fast, accessible, and do the work client-side.
    $ grep -r "Tool-calling agents" ./work
    also used: C++ · Express · MySQL · Redis · JWT · Socket.io · LangChain · OpenAI API · Embeddings · Postman · JMeter · PHPUnit · Linux · Bash · Tailwind
    09 · writing
    Notes & write-ups
    All posts →
    Open to backend, platform and AI engineering roles · remote or relocation
    Say hello
    Email is the fastest way to reach me. I usually reply within a day (PKT, UTC+5).
     Email me Résumé