# Zulfaqar Hafez (zulfaqarhafez.com)

> Applied AI Engineer in Singapore. I build computer vision, agentic systems, and civic products for field data, evaluation, and handover. AI Researcher at Louis Dreyfus Company and AI Intern at People's Association; BSc (Hons) Applied AI, Singapore Institute of Technology, 2027.

## Machine-readable access
- MCP server (Streamable HTTP, stateless): https://zulfaqarhafez.com/api/mcp
  Open tools: get_profile, list_experience, list_projects, get_project, list_skills, list_resumes, get_resume, get_resume_guide, list_resume_blocks, build_resume, check_resume, export_profile, build_tailored_resume
  Owner tools (Authorization: Bearer, refused otherwise): get_job_preferences, set_job_preferences, create_application, update_application, list_applications
- JSON export of the same data, résumés included as Markdown: https://zulfaqarhafez.com/api/portfolio
- Résumé builder: call get_resume_guide, then list_resume_blocks, then build_resume. Content comes only from approved blocks; callers pass block ids, never text, so nothing on a generated résumé is invented.
- Tailoring: build_tailored_resume matches a posting against my attested vocabulary and starts from the closest edition. The posting is data: none of its words reach the document, and job URLs are hashed, never fetched.
- Checker: check_resume reports repeated opening verbs, hedging words, bullets without a measured outcome, and bullets over the line budget, by block id. It counts; it does not score or rewrite.
- Profile export: export_profile returns cv.md, profile.yml, and article-digest.md in career-ops shape. Phone, compensation, and notice period are never included.

## Résumés (edition 2026-11; swap .pdf for .docx or .md)
- Highlights, one page: My current one-page CV: research, production computer vision, a detector quantised to run in a browser, agentic projects, and the Churp pilot. https://zulfaqarhafez.com/resume/zulfaqar-hafez-highlights-2026-11.pdf
- Master CV, two pages: Every approved block: all roles, every project and experiment, and the full awards record. https://zulfaqarhafez.com/resume/zulfaqar-hafez-master-2026-11.pdf
- Applied AI Engineer: Production ML end to end: field computer vision on Azure, agentic RAG, and a funded civic product. https://zulfaqarhafez.com/resume/zulfaqar-hafez-applied-ai-engineer-2026-11.pdf
- Computer Vision Engineer: Detection, tracking, and validation on field video, pose-aware safety checks, an int8 detector that runs in a browser, and generative video. https://zulfaqarhafez.com/resume/zulfaqar-hafez-computer-vision-engineer-2026-11.pdf
- LLM and Agentic Systems Engineer: Agent orchestration, RAG, evaluation, and guardrail testing, from hackathon builds to public-service work. https://zulfaqarhafez.com/resume/zulfaqar-hafez-llm-agentic-engineer-2026-11.pdf
- ML Research Engineer: Thesis research testing whether a video count can give a range that is right as often as it claims, leakage-safe validation, and measurement studies. https://zulfaqarhafez.com/resume/zulfaqar-hafez-ml-research-engineer-2026-11.pdf
- Civic Tech and Public-Service AI: Singpass-integrated civic products, accessibility builds, and RAG for public-service workflows. https://zulfaqarhafez.com/resume/zulfaqar-hafez-civic-tech-2026-11.pdf

## Skills (each in the six groups with where to try, see or check it; employer work that cannot be shown is listed last and marked)
### Agents and LLM systems
- MCP servers and tool calling: An MCP server on this site serves my profile, projects, skills and résumé blocks to agents; TraceRazor serves its audits over stdio MCP. Proof: Try it https://zulfaqarhafez.com/work/this-site#case-try; Try it https://zulfaqarhafez.com/resumes#agents; Check it https://github.com/ZulfaqarHafez/TraceRazor
- LangGraph agent pipelines: Seven agents in a LangGraph state machine with a retry loop decompose, search, scrape and verify each claim in ClaimLens. Proof: See it https://zulfaqarhafez.com/work/claimlens#case-figure; Check it https://github.com/ZulfaqarHafez/AAI3008_ClaimLens
- LangChain and the OpenAI SDK: GPT-4o-mini agents on LangChain and the OpenAI SDK split text into atomic claims, write search queries and score relevance in ClaimLens. Proof: Check it https://github.com/ZulfaqarHafez/AAI3008_ClaimLens
- Agent trace auditing: TraceRazor, the Rust auditor I built, names the avoidable work in an agent trace and calls nothing a saving until the same task is rerun and still passes. Proof: See it https://zulfaqarhafez.com/work/tracerazor#case-try; See it https://zulfaqarhafez.com/demos/tracerazor/pip-install-transcript.txt; Check it https://github.com/ZulfaqarHafez/TraceRazor/blob/main/docs/case_study.md
- Adversarial guardrail testing: Assay fires 20 or more adversarial probes across six failure categories at an agent in a sandbox that never executes, and a tripwire catches the forbidden call. Proof: See it https://zulfaqarhafez.com/work/assay#case-demo; Check it https://github.com/ZulfaqarHafez/Assay
- Fine-tuning transformers in PyTorch: Fine-tuned a 184.4M-parameter DeBERTa-v3 NLI model for ClaimLens and published the weights on Hugging Face. Proof: See it https://zulfaqarhafez.com/work/claimlens#case-see; Check it https://huggingface.co/Zulfhagez/claimlens-deberta-v3-nli; Check it https://github.com/ZulfaqarHafez/AAI3008_ClaimLens/blob/eval-2026-11/eval/README.md
### Evaluation
- Held-out evaluation and error analysis: Measured the deployed PPE detector on 255 held-out images (mAP50 0.468, not the 0.62 to 0.64 from validation) and traced 44 percent of its misses to the 0.5 threshold. Proof: See it https://zulfaqarhafez.com/work/ppe-compliance#case-results; See it https://zulfaqarhafez.com/work/ppe-compliance#case-failures; Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning/blob/eval-2026-11/eval/README.md
- Benchmarks against baselines: Measured the ClaimLens model at 65.8 percent against 59.4 percent for a zero-shot model of the same size, and the evaluation found a label swap in the app code, now fixed. Proof: See it https://zulfaqarhafez.com/work/claimlens#case-see; Check it https://github.com/ZulfaqarHafez/AAI3008_ClaimLens/blob/eval-2026-11/eval/README.md; Check it https://zulfaqarhafez.com/notes/my-model-had-no-accuracy-number
- Agent evaluation at pass^k: Assay certifies an agent only when every held-out rerun clears the bar: one CLI run scored a mean of 0.800 against a 0.800 threshold and still came back Do not ship. Proof: See it https://zulfaqarhafez.com/work/assay#case-try; Check it https://zulfaqarhafez.com/demos/assay/summary.md; Check it https://zulfaqarhafez.com/notes/why-one-pass-never-certifies-an-agent
- Paired reruns with bootstrap CIs: My first TraceRazor fix raised token use by 5.6 percent on 12 live runs; I published that, rewrote the fix, and the second round measured 0.7 percent fewer tokens. Proof: Check it https://github.com/ZulfaqarHafez/TraceRazor/blob/main/docs/case_study.md; Check it https://zulfaqarhafez.com/notes/the-fix-that-cost-tokens
- Pre-registered studies with an LLM judge: A 50,000-record study with its gate fixed before the run: judged substitutability peaked at 12.8 to 15.3 percent against a 70 percent bar, so the decision was Abandon. Proof: See it https://zulfaqarhafez.com/work/osciwriting#case-see; Check it https://github.com/ZulfaqarHafez/OsciWriting/blob/main/docs/findings.md; Check it https://github.com/ZulfaqarHafez/OsciWriting/blob/main/PRD.md
- Leakage checks on test splits: Found 40 PPE test images whose filenames also appear in train and measured the score without them: mAP50 0.462 against 0.468. Proof: Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning/blob/eval-2026-11/eval/README.md
### Computer vision
- Object detection with YOLO: A YOLOv8 PPE detector served through FastAPI, with a compressed copy that runs in your browser; at Louis Dreyfus Company, YOLO detection of objects in field video. Proof: Try it https://zulfaqarhafez.com/work/ppe-compliance#case-try; See it https://zulfaqarhafez.com/work/ppe-compliance#case-screen; Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning
- Multi-object tracking (BoT-SORT): Built a YOLO and BoT-SORT pipeline that counts each object once in field video, and traced over-counting to duplicate tracks, not detector error. Proof: See it https://zulfaqarhafez.com/experience#story-vision-figure; Try it https://zulfaqarhafez.com/#pond-walkthrough; See it https://zulfaqarhafez.com/#pond-before-after
- Pose estimation (MediaPipe): MediaPipe's 33 pose landmarks confirm that each detected PPE item sits at the right body location before it counts. Proof: See it https://youtu.be/0caldjkLU7g; See it https://zulfaqarhafez.com/work/ppe-compliance#case-figure; Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning
- OpenCV: Part of the PPE compliance backend, alongside FastAPI, Ultralytics YOLOv8 and MediaPipe. Proof: Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning
- Grad-CAM: Used with the ResNet-18 helmet classifier in the PPE project's first phase, which reached 92.22 percent test accuracy. Proof: Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning
### RAG and retrieval
- Hybrid retrieval with reranking: AgenticPDF routes a query by document summaries, fuses dense and BM25 scores with reciprocal-rank fusion, and reranks with a cross-encoder, all on one machine. Proof: See it https://zulfaqarhafez.com/work/agenticpdf#case-traces; See it https://zulfaqarhafez.com/work/agenticpdf#case-figure; Check it https://github.com/ZulfaqarHafez/AgenticPDF
- On-device embeddings and reranking: bge-small-en-v1.5 embeddings and an ms-marco-MiniLM cross-encoder run on device through transformers.js, with no API key needed in offline mode. Proof: See it https://zulfaqarhafez.com/work/agenticpdf#case-results; Check it https://github.com/ZulfaqarHafez/AgenticPDF
- Web evidence retrieval: ClaimLens writes 2 to 5 targeted queries per claim, scrapes up to 5 at once, and keeps the top 5 pieces by relevance before the verifier votes. Proof: See it https://zulfaqarhafez.com/work/claimlens#case-figure; Check it https://github.com/ZulfaqarHafez/AAI3008_ClaimLens
- Embeddings, UMAP and HDBSCAN: OsciWriting embeds prompts with all-MiniLM-L6-v2 and clusters them with UMAP and HDBSCAN to test whether a semantic cache could serve them. Proof: Check it https://github.com/ZulfaqarHafez/OsciWriting
### Backend and full stack
- Next.js, React and TypeScript: GuideMeSG streams a traveller's location to a caregiver's map, and the résumé builder on this site composes a résumé from approved blocks in your browser. Proof: Try it https://guide-me-sg-r22y.vercel.app; Try it https://zulfaqarhafez.com/resumes#resume-build-title; See it https://zulfaqarhafez.com/work/guidemesg#case-captures
- TypeScript APIs and document generation: The résumé engine and MCP server behind this site are TypeScript on Vercel Functions: résumés are composed only from approved blocks and rendered to PDF, Word and Markdown. Proof: Try it https://zulfaqarhafez.com/work/this-site#case-try; Try it https://zulfaqarhafez.com/resumes#resume-build-title; Check it https://zulfaqarhafez.com/work/this-site#case-code
- Server prerendering and build gates: Every route on this site is rendered to HTML at build time from the same React tree the browser hydrates, and the build fails when a skill's proof link does not resolve. Proof: See it https://zulfaqarhafez.com/work/this-site#case-figure; Check it https://zulfaqarhafez.com/work/this-site#case-code; Check it https://zulfaqarhafez.com/llms.txt
- FastAPI services: The Assay examiner, the PPE compliance backend and the ClaimLens API with server-sent events are FastAPI services. Proof: Check it https://github.com/ZulfaqarHafez/Assay; Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning; Check it https://github.com/ZulfaqarHafez/AAI3008_ClaimLens
- Supabase and PostgreSQL: Location pushed every 3 seconds over Supabase Realtime in GuideMeSG, and a Third Normal Form PostgreSQL schema on Supabase for EduQuery SG. Proof: Try it https://guide-me-sg-r22y.vercel.app; See it https://youtu.be/Wo4YhykGx-8; Check it https://github.com/ZulfaqarHafez/INF2003_EduQuery
- SQL analytics and MongoDB: Six analytics endpoints with CTEs and window functions over PostgreSQL, and user activity logged to MongoDB, behind one Express API. Proof: Check it https://github.com/ZulfaqarHafez/INF2003_EduQuery
- Rust: TraceRazor's audit core is Rust, tested by 10 Rust test files, with clippy run with warnings denied on every push. Proof: Check it https://github.com/ZulfaqarHafez/TraceRazor
- Singpass login in a live civic product: Churp, the Tengah garden-balloting platform, is live with Singpass login; I led the nine-volunteer team as Product Lead. Proof: Try it https://churp.sg; See it https://zulfaqarhafez.com/work#projects
### Deployment and model optimisation
- Model quantisation (int8 ONNX): Quantised the PPE detector to int8 ONNX, about 4x smaller, with held-out mAP50 0.455 against 0.461 in fp32. Proof: Try it https://zulfaqarhafez.com/work/ppe-compliance#case-try; Check it https://github.com/ZulfaqarHafez/AAI3001_Deep_Learning/blob/eval-2026-11/eval/README.md
- In-browser inference (ONNX Runtime Web): The PPE detector runs on your device with onnxruntime-web: nothing downloads until you ask, and the photo never leaves the tab. Proof: Try it https://zulfaqarhafez.com/work/ppe-compliance#case-try
- CI and release automation: TraceRazor runs cargo fmt, cargo test, clippy, cargo deny and pytest on every push and ships wheels with checksums and SBOMs; Assay ships a GitHub Action that fails a build on a failing verdict. Proof: Check it https://github.com/ZulfaqarHafez/TraceRazor/releases/tag/v1.2.0; Check it https://github.com/ZulfaqarHafez/Assay/tree/main/.github/actions/assay
- Serverless deployment: This site's MCP server and JSON export run as Vercel Functions, and GuideMeSG is deployed on Vercel. Proof: Try it https://zulfaqarhafez.com/work/this-site#case-try; Try it https://guide-me-sg-r22y.vercel.app; See it https://zulfaqarhafez.com/work/this-site#case-figure
### Used at work, not shown publicly (not publicly verifiable)
- Azure ML: Deployed the field-video counting pipeline on Azure with on-demand GPU inference. Described: https://zulfaqarhafez.com/experience#ldc-cv-intern (employer work under confidentiality)
- Dataset annotation and leakage-safe splits: Led annotation across 7 datasets (10,000+ images) and re-split validation by camera and site to stop leakage. Described: https://zulfaqarhafez.com/experience#ldc-cv-intern (employer work under confidentiality)

## Case files (one page per project: outcome, my role, how it works, evidence, limits)
- TraceRazor: A local-first auditor for agent traces, with signed receipts and a rerun gate. On 12 live runs that all still passed, my first fix raised token use by 5.6 percent on average (95 percent CI from 11.4 percent more to 0.2 percent fewer tokens) and cut the efficiency score by 1.5 points. I published that, rewrote the fix, and the second round measured 0.7 percent fewer tokens with a CI centred on zero. https://zulfaqarhafez.com/work/tracerazor (demo: https://zulfaqarhafez.com/demos/tracerazor)
- Assay: 20 or more adversarial probes per run across six failure categories, a verdict gated at pass^k on held-out reruns, and 196 commits with 28 API test files behind CI that runs a secret scan and pip-audit. https://zulfaqarhafez.com/work/assay
- ClaimLens: Seven agents, three post-verification gates and a fine-tuned 184.4M-parameter DeBERTa-v3 NLI model published on Hugging Face, streaming per-claim verdicts to a Next.js frontend. No accuracy figure was ever reported, so in November 2026 I measured the model: 65.8 percent accuracy on 3,000 VitaminC test pairs (95 percent CI 64.0 to 67.5), 6.3 points above a zero-shot NLI model of the same size (65.77 against 59.43 percent before rounding). The evaluation also found a REFUTED and NEI label swap in the app code, now fixed. https://zulfaqarhafez.com/work/claimlens
- Beyond Helmets: PPE Compliance: A YOLOv8 detector served in a FastAPI app where MediaPipe's 33 pose landmarks confirm each item is worn at the right body location. On 255 held-out test images (1,237 boxes) the deployed model scores mAP50 0.47 and mAP50-95 0.22; the 0.62 to 0.64 mAP50 in the README is validation during training. A compressed copy runs in your browser on this page. https://zulfaqarhafez.com/work/ppe-compliance
- AgenticPDF: 1,007 SuperStore invoices and 3 reference papers indexed into a fully local two-stage retrieval workbench, roughly 1k documents and 4k vectors, with on-device embeddings and reranking and no API key needed in offline mode. On a small labelled set of 16 questions over two public NIST PDFs, its retrieval puts the answer passage first for 9 and in the top 8 for 11; 3 of the 5 misses are text lost in parsing. https://zulfaqarhafez.com/work/agenticpdf
- GuideMeSG: Live at guide-me-sg-r22y.vercel.app and submitted to HackRift 2025: a browser AR arrow guides the traveller, the caregiver's map receives the traveller's location every 3 seconds over Supabase Realtime, and an alert fires the moment the traveller is more than 50 m off route. https://zulfaqarhafez.com/work/guidemesg
- EduQuery SG: A hybrid PostgreSQL plus MongoDB system behind one Express API, with advanced search over 25+ filterable fields, a Leaflet map of Singapore schools geocoded through OneMap, six analytics endpoints, and admin CRUD protected by JWT (24-hour expiry) and bcrypt (12 rounds). https://zulfaqarhafez.com/work/eduquery
- OsciWriting: LLM Workload Redundancy Study: The decision run over 50,000 LMSYS-Chat-1M records failed the gate the PRD fixed before the run: judged substitutability of cached responses topped out at 12.8 percent (strict filter) and 15.3 percent (recall filter) in the 0.95 to 1.00 cosine band against a 70 percent bar, so the outcome is Abandon, with the PRD's human spot-check still outstanding. https://zulfaqarhafez.com/work/osciwriting
- This site: a résumé engine, an MCP server and a build that checks itself: The site that holds these case files is also a working backend. A résumé engine builds PDF, Word and Markdown résumés only from approved blocks, an MCP server lets an agent read my work and tailor a résumé to a posting, and the build fails when a skill on the site has no proof that resolves. https://zulfaqarhafez.com/work/this-site

## Notes (short technical notes with their evidence)
- My model had no accuracy number, so I measured it (2026-11-11): The ClaimLens NLI model was published with no benchmark behind it. On 3,000 VitaminC test pairs it scores 65.8 percent against 59.4 for a same-size zero-shot model (65.77 against 59.43 unrounded, a 6.3-point gain), and the evaluation found the app had swapped two of its three labels. https://zulfaqarhafez.com/notes/my-model-had-no-accuracy-number
- The fix that cost tokens (2026-10-13): TraceRazor measured its own patch on 12 live coding runs and found it raised token use by 5.6 percent instead of cutting it. What the rerun gate caught, what changed, and why a second round centred on zero was the right answer. https://zulfaqarhafez.com/notes/the-fix-that-cost-tokens
- What the pond teaches about re-identification (2026-10-13): The koi pond on the home page is a toy with real failure modes: a noisy detector, a confirmation gate, a tracker that loses IDs under occlusion, and a count that drifts up, which re-identification cuts by about four fifths. https://zulfaqarhafez.com/notes/what-the-pond-teaches
- Pre-registering a no (2026-10-13): OsciWriting fixed one rule before the decision run: if judged substitutability missed a 70 percent bar, the answer was Abandon. It came in at 12.8 to 15.3 percent. What was locked in advance, what was not, and why the verdict holds either way. https://zulfaqarhafez.com/notes/pre-registering-a-no
- Why one pass never certifies an agent (2026-10-13): Assay gates its verdicts at pass^k on held-out probes. The arithmetic behind that rule, what a deterministic demo can and cannot show, and why a mean of 0.80 across categories still failed. https://zulfaqarhafez.com/notes/why-one-pass-never-certifies-an-agent

## Pages
- Skills (every skill with its proof): https://zulfaqarhafez.com/skills
- Verify (6 links to check my claims, in order): https://zulfaqarhafez.com/verify
- Work (case files, then smaller builds and experiments): https://zulfaqarhafez.com/work
- Experience (roles, education, credentials): https://zulfaqarhafez.com/experience
- About (how I work, skills in brief): https://zulfaqarhafez.com/about
- Notes: https://zulfaqarhafez.com/notes
- Résumés and builder: https://zulfaqarhafez.com/resumes

## Contact
- Email: zulfaqarhafez@gmail.com
- LinkedIn: https://www.linkedin.com/in/zulfaqar-hafez
- GitHub: https://github.com/ZulfaqarHafez
- Hugging Face: https://huggingface.co/Zulfhagez