Aziz Ali

01FLAGSHIP WORK

Flagship work

SHIPPED — iOS APP STORE

Kap

AI grocery-deals app for Sweden — weekly deals from 2,900+ stores, live on the App Store.

Expo / React NativeBun + HonoDockerHetzner

            App Store ↗
          

01Function-calling AI agent with structural citation safety — it cannot cite a price it didn't fetch

02Reconciliation harness proves ingestion is complete, not merely running — nightly, against source APIs

03Price history built to comply with Swedish price law

Zero to App Store in 48 hours — v1 built in one day, Apple approval in ~24 hours; iterated through 1.2.0 across store-review cycles since.

Structural citation safety — the agent validates every claim against a per-request registry of what its tools actually fetched; it cannot cite a price it never retrieved.

Reconciliation harness — asks the source what should exist, the database what does, and names every difference; caught five real defects, including an entire store chain silently missing.

Survived a real production incident — a 4-day silent ingest outage root-caused overnight by a 9-agent forensic fleet; hardening shipped the same night.

Swedish price law as a data model — jämförpris, multi-buy decomposition, and member pricing are first-class fields, never parsed prose.

PRIVATE INFRA — RUNNING 24/7

HQ

Self-built agentic OS — the production dashboard every one of my Claude Code sessions reports into.

WebSocketsSQLiteCloudflare AccessTailscale

            See it mapped in the hero ↑
          

01Live telemetry from every session via a custom hook pipeline

02WebSockets + SQLite; zero open ports — Cloudflare Access + Tailscale

03The hero above is its map — same nodes, same edges

Built by a 15-agent fleet — researchers → planners → adversarial checkers → 15 executors → verifiers; the checker stage caught three integration gaps that 948 passing tests missed.

A human gate on AI memory — the Learning Layer reads session transcripts and proposes knowledge entries; a human approve-click is the only path that writes anything.

Hardened web terminal — a phone-driven tmux session behind a CVE-threat-modeled spawn: single-use 45-second challenges, fail-closed with no default secret.

Privacy-first vault graph — renders the whole second brain as a live force graph while note bodies never leave the machine.

Zero open ports — Cloudflare Access → gate VPS → Tailscale → the machine that actually runs things.

FULLY LOCAL — CV + AUDIO ML

sleep-watch

Privacy-first computer-vision sleep monitor — motion and voice-activity ML with zero cloud dependency.

OpenCVSilero VADONNX Runtimeffmpeg

01Adaptive frame-differencing motion detection, tuned for night footage

02Voice-activity model scoring live audio 31 times per second

03Auto-generated night reports with event clips — everything stays local

Shipped in one evening — spec → tests (a fake camera and fake clock simulate whole nights in milliseconds) → dashboard, verified before the first real night ran.

Tuned on reality, not theory — event semantics rebuilt from five real nights of false positives and negatives; one physical turn now counts as one event, not three.

Two independent senses — pixel-change physics for motion, a voice-activity model scoring audio 31 times per second for sound; ML kept out of the reliability-critical path on purpose.

    ALSO BUILT
  

iOS — ON-DEVICE · IN DEVELOPMENT · BUILT SOLO

Speakly

iOS keyboard running an on-device 1.7B LLM via MLX for live transcript cleanup.

MLX1.7B on-deviceiOS keyboard

An LLM inside a keyboard's 70MB ceiling — the extension loads no ML at all; the main app runs the model and streams results across the process boundary.

IPC that survives reality — staleness-checked payloads, per-ping response slots, and an audio-session heartbeat standing in for a liveness API Apple doesn't provide.

A five-root-cause debugging saga — streaming speech-to-text failed for five stacked reasons; the last was one wrong enum silently resetting the recognizer after every audio buffer.

Pragmatic model choice — dropped Apple's safety-tuned on-device model when it refused ordinary cleanup prompts; swapped in an open-weight MLX model mid-build.

IN PRODUCTION — CLIENT WORK

FlowStaff

Production website + CRM for a real Swedish staffing company.

AuthRate limitingSecurity headers

        flowstaff.se ↗
      

Real client, real outage, same-day recovery — a live login failure traced to three compounding causes, fixed in one PR, then written into standing engineering rules.

14 production PRs in one day — security headers, rate limiting, magic-byte upload verification, secret scanning on every commit.

Process where tooling was missing — hook-enforced branch protection standing in for an unavailable paid GitHub feature.

02THE SYSTEM

Most people use AI coding tools. I built infrastructure around mine.

SKILLS18

Skill library

18 custom skills, including an anti-generic-design suite.

HOOKS→ HQ

Hook telemetry

9 lifecycle events stream every session into HQ, live.

MEMORYgated

Governed memory

Typed files with explicit write-gates.

QMD863

Local retrieval

Hybrid RAG wired over my second brain — BM25 + embeddings + HyDE, 863 documents.

FLEET3→15

Fleet orchestration

Investigator, builder, reviewer, verifier — scaled from 3 to 15 parallel agents across the year.

SESSIONS183

Session log

183 build sessions, logged and searchable.

GSD12

Phase pipeline

12 specialized agents drive plan→execute→verify on infrastructure builds.

CONTENT→ KAP

Content pipeline

AI video-production skills (third-party engine) — built Kap's App Store marketing kit.

    
    same nodes as the hero — the map is the system
  