# Muhammad Salman

> Software Engineer in Lahore, Pakistan. Software engineer at 9D Technologies. I build backend services in Python and FastAPI, the pipelines that ship them, and the telemetry that explains them when they break. GSoC 2025 at FOSSology: one monolith became 10+ services on Kubernetes, and builds got 40% faster. My code ships in official Jenkins releases, OWASP made me a collaborator on Nest, and lately I build LLM agents that are only allowed to do what they can prove.

Availability: Open to backend, platform and AI engineering roles · remote or relocation.
Contact: chsalmanramzan422@gmail.com
Resume: https://salman-ch.netlify.app/resume.pdf

Now: shipping auth + reporting services in FastAPI @ 9D; building Ezvor: judge-verified readiness scores; exploring agent guardrails: bounded tools, allowlists, traced calls. (updated 2026-09-28)

Retrieval corpus of this site, as JSON: https://salman-ch.netlify.app/rag.json

## Experience

- **Backend Software Engineer**, 9D Technologies (2026-08 to present): Own backend services end to end: Python and FastAPI APIs, the database work behind them, and the CI/CD that tests and ships them.
- **Open Source Contributor**, Jenkins project (2026-01 to present): Contributor to Jenkins core, the official Docker images and the theme manager plugin. Five PRs merged; two of them ship inside every official Jenkins container.
- **Collaborator, OWASP Nest**, OWASP Foundation (2026-01 to present): Earned collaborator access after finding and helping fix broken keyboard focus indicators. Listed as a GSoC 2026 mentor. Reported a security issue to the maintainers through private disclosure.
- **LiFT Scholar**, Linux Foundation (2025-07 to 2025-08): Full scholarship for the Kubernetes for Developers (LFD259) course and certification exam.
- **Software Engineer (Open Source), FOSSology**, Google Summer of Code (2025-02 to 2025-09): Revived a microservices branch that had been frozen since 2021 and made it run on 2025 infrastructure. FOSSology went from one monolithic deployment to 10+ services on Docker and Kubernetes.
- **Freelance Software Engineer**, Fiverr and direct clients (2023-10 to 2025-01): Shipped full-stack apps and the delivery plumbing behind them for 8 to 10 clients: Jenkins and GitHub Actions pipelines, Docker images, AWS deploys on EC2 and S3.
- **Software Engineer Intern**, Hywiz Technologies (2023-05 to 2023-09): Shipped product modules and REST APIs with React, Node.js and Express. Replaced a manual daily data export with MongoDB aggregation pipelines.
- **BS Computer Science**, University of Agriculture, Faisalabad (2022-09 to 2026-06): Graduated with a 3.37/4.0 CGPA on an 80% PEEF merit scholarship. Won 1st place university-wide at the Byte & Battle hackathon.

## Open source

### Jenkins (Shipped in Weekly 2.565 and LTS 2.568.1)
- [shipped] Env var substitution for reference config files. The issue had been open since 2017.: https://github.com/jenkinsci/docker/pull/2250
- [shipped] Same feature on Windows: Invoke-EnvVarSubstitution plus 3 Pester tests: https://github.com/jenkinsci/docker/pull/2365
- [merged] Off-screen dropdown items lost focus feedback during arrow-key navigation: https://github.com/jenkinsci/jenkins/pull/26358
- [merged] Keyboard navigation for the theme picker, requested by the maintainer: https://github.com/jenkinsci/theme-manager-plugin/pull/350
- [merged] Broken contributor profile link on jenkins.io: https://github.com/jenkins-infra/jenkins.io/pull/8629
- [open] ARIA roles on dropdown menus for screen readers: https://github.com/jenkinsci/jenkins/pull/26321
- [open] Double-clicking the search placeholder blocked input: https://github.com/jenkinsci/jenkins/pull/26418

### FOSSology (5 code PRs + 14 GSoC reports merged)
- [merged] Copyright agent URL regex matched invalid characters: https://github.com/fossology/fossology/pull/3212
- [merged] PHPUnit agent tests updated for the CMake build: https://github.com/fossology/fossology/pull/3037
- [merged] Debug logging for version control commands: https://github.com/fossology/fossology/pull/2958
- [merged] False positives on example domains and reserved TLDs: https://github.com/fossology/fossology/pull/2955
- [merged] nomos CLI opened a DB connection it never used: https://github.com/fossology/fossology/pull/2947

### OWASP Nest (Collaborator since Jan 2026)
- [private] Security issue, reported privately to the maintainers: 
- [merged] Added to MENTORS.md for GSoC 2026: https://github.com/OWASP/Nest/pull/3605
- [issue] Focus outlines clipped and inconsistent across Header and Footer: https://github.com/OWASP/Nest/issues/3561
- [issue] Search hint text could be selected with mouse and keyboard: https://github.com/OWASP/Nest/issues/5602

### Python, data & AI
- [merged] Live model-driven analysis, deterministic engine kept as the fallback, no secrets in the client bundle: https://github.com/kaulastudies/failuretwin-ai/pull/12
- [open] BoxCoxBiasAdjustedForecaster threw sporadic optimization bracket errors: https://github.com/sktime/sktime/pull/10316
- [merged] Tone and typo fixes in the DISCOVER Cookbook: https://github.com/numfocus/DISCOVER-Cookbook/pull/73
- [closed] Re-enabled RDSTRegressor and RISTRegressor tests after verifying Ubuntu CI: https://github.com/aeon-toolkit/aeon/pull/2599
- [closed] Example notebook: aeon distances with sklearn clusterers: https://github.com/aeon-toolkit/aeon/pull/2511

### Earlier work
- [merged] Reworked the testing framework docs and removed deprecated Nimut references: https://github.com/TYPO3BestPractices/tea/pull/1480
- [closed] LMPOP command with unit tests, in C++: https://github.com/dragonflydb/dragonfly/pull/3925
- [merged] Contributor profile for the Meshery community: https://github.com/meshery/meshery/pull/12248

## How I build with LLMs

- **Deterministic first.** Known failures take a plain if/else. The model only sees what the rules can’t explain, so the common path stays fast, free and testable. Proof: https://github.com/SalmanDeveloperz/signoz-ai-sre#7-the-ai--agent-layer-in-full
- **Guardrails live outside the model.** A three-key action allowlist, two read-only tools, a hard 10 second timeout, and the same safety check humans go through. Safety comes from a small action space, not from trusting the output. Proof: https://github.com/SalmanDeveloperz/signoz-ai-sre#guardrails
- **Every model call is a span.** Model name, input and output tokens, and each tool call land in the trace next to the infra they investigated. Cost per investigation is a query, not a guess. Proof: https://github.com/SalmanDeveloperz/signoz-ai-sre#94-llm-cost-concretely
- **Fallbacks are part of the contract.** No key, a timeout or a bad answer resolves to a safe “needs a human”. In FailureTwin I put the live model path in front and kept the deterministic engine behind it. Proof: https://github.com/kaulastudies/failuretwin-ai/pull/12

## Projects

- [Ezvor](https://ezvor.lovable.app): Preparing for internships, I had three job boards open, a roadmap I never finished, and a problem site that knew nothing about either. None of it could tell me whether I was hireable. Ezvor puts it in one place and scores only work a judge has verified. Code: https://github.com/ezvor/ezvor
- [PDF Scanner Web](https://docs-scan.netlify.app/): The web side of PDF Scanner, an Android app with 50M+ installs and a 4.8★ rating. It covers what people usually open iLovePDF or CamScanner for, except every byte stays on the device: no account, no upload, no conversion server to pay for.
- [PoS-OTel: OpenTelemetry for Jenkins CI](https://github.com/SalmanDeveloperz/PoS-OTel): During GSoC 2025 I spent whole afternoons matching container logs by hand. This is the tool I wanted then. Jenkins exports traces over OTLP to a collector that tail-samples them: every failed build and every build over 30 seconds is kept, plus 20% of the rest. Jaeger stores the traces, span metrics feed Prometheus and Grafana, and alert rules ship with it.
- [SigNoz AI SRE](https://github.com/SalmanDeveloperz/signoz-ai-sre): A watcher that never calls the service it protects. It reads SigNoz alerts, fixes known failures with plain rules, and hands unknown ones to an LLM with two read-only tools. Every model call is a span; every action lands in an audit log.
- [FOSSology microservices](https://github.com/SalmanDeveloperz/GSoC-2025): Scheduler, database and agents split into 10+ Kubernetes services, with a Kustomize base and overlays. The repo holds all 13 weekly reports and the final report.
- [Stremo](https://stremo.lovable.app): Streams public domain and Creative Commons films from the Internet Archive, from film noir to the silent era. SSR, Supabase auth, no copyrighted content hosted.
- [RevealX](https://github.com/SalmanDeveloperz/revealX): Shows what’s typed into a password field. Toggling the input’s type breaks on React and Vue, which re-render it back, so this reads the value instead. Handles shadow DOM and asks for zero permissions.
- [AutoAccept](https://github.com/SalmanDeveloperz/AutoAccept-Facebook-Friends): One-click Accept All on Facebook’s friend requests page, and it keeps working as infinite scroll loads more.

## Awards

- Jul 2025, Linux Foundation LiFT Scholar: Full scholarship for the Kubernetes (LFD259) course and certification exam.
- May 2025, Google Summer of Code 2025: Selected for FOSSology in a program that accepts under 5% of applicants.
- Mar 2025, Byte & Battle Hackathon: Speed programming. Won the university round, then placed 3rd against teams from across the district.
- 2022–26, PEEF Scholarship: 80% fee scholarship from the Government of Punjab, on merit.

## Skills

- Backend: Python, FastAPI, Node.js, PostgreSQL, MongoDB, REST design
- AI / LLM: Tool-calling agents, Guardrails, Provider-agnostic LLMs, Deterministic fallbacks, LLM observability, RAG & retrieval
- DevOps & infra: Kubernetes, Docker, Jenkins, OpenTelemetry, Prometheus + Grafana, Kustomize, GitHub Actions, CMake, AWS, PowerShell
- Full stack: React + TypeScript, TanStack Start, Supabase, Accessibility, In-browser processing, Browser extensions, Astro
- Also: C++, Express, MySQL, Redis, JWT, Socket.io, LangChain, OpenAI API, Embeddings, Postman, JMeter, PHPUnit, Linux, Bash, Tailwind

## Changelog

- 2026-09 [ship] PDF Scanner Web: 31 document tools, all in the browser, for 9D Technologies https://docs-scan.netlify.app/
- 2026-08-09 [merge] Live LLM analysis path with the deterministic engine kept as fallback https://github.com/kaulastudies/failuretwin-ai/pull/12
- 2026-08 [role] Joined 9D Technologies as a Backend Software Engineer
- 2026-07-20 [ship] SigNoz AI SRE: self-healing loop with a guarded LLM tier https://github.com/SalmanDeveloperz/signoz-ai-sre
- 2026-07-07 [ship] Ezvor: career platform scored only on judge-verified work https://ezvor.lovable.app
- 2026-06-10 [merge] Env var substitution for Windows containers, shipped in LTS 2.568.1 https://github.com/jenkinsci/docker/pull/2365
- 2026-05-18 [merge] Closed a 2017 issue: env var substitution in the official Jenkins image https://github.com/jenkinsci/docker/pull/2250
- 2026-03-17 [ship] PoS-OTel: OpenTelemetry pipeline for Jenkins CI, 81% less trace data https://github.com/SalmanDeveloperz/PoS-OTel
- 2026-03-04 [merge] Keyboard navigation scrolling in Jenkins core dropdowns https://github.com/jenkinsci/jenkins/pull/26358
- 2026-03-03 [merge] Keyboard navigation for the Jenkins theme picker https://github.com/jenkinsci/theme-manager-plugin/pull/350
- 2026-01-27 [role] OWASP Nest collaborator, added to the GSoC 2026 mentor list https://github.com/OWASP/Nest/pull/3605
- 2026-01-07 [merge] Copyright agent URL regex fix in FOSSology https://github.com/fossology/fossology/pull/3212
- 2025-12-17 [merge] First merge into the Jenkins project https://github.com/jenkins-infra/jenkins.io/pull/8629
- 2025-09 [win] Completed Google Summer of Code 2025 at FOSSology https://summerofcode.withgoogle.com/archive/2025/projects/MjOyiOj7
- 2025-07 [win] Linux Foundation LiFT scholarship for Kubernetes LFD259
- 2025-06-03 [write] My Google Summer of Code 2025 journey https://medium.com/@msamdev/my-google-summer-of-code-2025-journey-be42c1d27d7f
- 2025-05-29 [merge] Four FOSSology fixes merged before GSoC began: nomos, tests, regex, logging https://github.com/search?q=author%3ASalmanDeveloperz+repo%3Afossology%2Ffossology+is%3Amerged&type=pullrequests
- 2025-05 [win] Selected for Google Summer of Code 2025, under 5% acceptance
- 2025-03 [win] Byte & Battle hackathon: 1st university-wide, 3rd at district level
- 2024-12-26 [merge] NumFOCUS DISCOVER Cookbook edits https://github.com/numfocus/DISCOVER-Cookbook/pull/73
- 2024-10-06 [merge] Hacktoberfest: first merges into other people’s code https://github.com/TYPO3BestPractices/tea/pull/1480
- 2023-10 [role] Started freelancing: full-stack apps and CI/CD for 8 to 10 clients
- 2023-05 [role] Software Engineer Intern at Hywiz Technologies

## Writing

- [Closing a 2017 issue in the official Jenkins Docker image](https://salman-ch.netlify.app/writing/jenkins-docker-env-var-substitution/): Opt-in environment variable substitution for containerized Jenkins, now shipping in Weekly 2.565 and LTS 2.568.1, on Linux and Windows.
- [Cutting CI trace volume by 81% with tail sampling](https://salman-ch.netlify.app/writing/cutting-ci-trace-volume-81-percent/): How an OpenTelemetry Collector in front of Jenkins keeps every failure and slow build while dropping most of the noise.
- [GSoC 2025 at FOSSology, week by week](https://salman-ch.netlify.app/writing/gsoc-2025-week-by-week/): Thirteen weeks of reviving a 2021 microservices branch: CrashLoopBackOff, a Make to CMake migration, and 26 Kustomize manifests.
- [My Google Summer of Code 2025 journey](https://medium.com/@msamdev/my-google-summer-of-code-2025-journey-be42c1d27d7f): How I got selected for Google Summer of Code 2025 at FOSSology: Hacktoberfest, first merged PRs, picking the right org, writing the proposal, and tips for new applicants.

## Links

- GitHub: https://github.com/SalmanDeveloperz
- LinkedIn: https://www.linkedin.com/in/msalman199/
- X: https://x.com/sam_env
- Medium: https://medium.com/@msamdev
- Email: mailto:chsalmanramzan422@gmail.com