Systems & AI Infrastructure Architect • Open-Source Builder
Engineering resilient distributed data systems, verifiable autonomous agent runtimes, and high-performance ACID architectures.

I architect and build enterprise software with a focus on eliminating operational debt, ensuring non-repudiation, and replacing bloated infrastructure with sound systems design:

• Database Consolidation Over Vector Sprawl: Solving enterprise RAG directly on battle-tested relational engines (PostgreSQL with pgvector HNSW + BM25 full-text search) instead of introducing costly, un-audited secondary vector databases.
• Deterministic Action Contracts for Autonomous AI: Probabilistic models should draft plans; deterministic, out-of-band policy engines with HMAC-SHA256 signatures must govern and execute them.
• Zero-Trust Enterprise Ingestion: Guaranteeing that enterprise data pipelines automatically scrub secrets, API keys, and PII before chunks ever enter an embedding or vector index.

A cohesive, open-source infrastructure stack designed for enterprise-grade generative AI, retrieval, and agent governance.

Vendor-neutral, governance-first hybrid evidence retrieval for AI systems.

• PostgreSQL-Native Hybrid Retrieval: Combines pgvector HNSW indexing with native PostgreSQL full-text search (tsvector) via Reciprocal Rank Fusion (RRF, k=60).
• Dual-Mode Multi-Tenancy: Application-level isolation by default, with opt-in PostgreSQL Row-Level Security (RLS) for HIPAA and SOC 2 compliance.
• Model Context Protocol (FastMCP): Native MCP tools (retrieve_evidence, get_document, explain_retrieval) enabling plug-and-play memory for Claude Desktop, Cursor, and enterprise agent workflows.
• Turnkey Production Ops: Multi-arch Docker containers, official Helm chart with external secret injection, and sub-10ms query latency.

Policy-governed autonomous agent planning and non-repudiation execution framework.

• Deterministic Action Contracts: Decouples probabilistic LLM reasoning from API execution by enforcing strict typed step definitions.
• Out-of-Band Policy Engine: Hot-reloadable YAML policy rules that independently inspect and gate every proposed agent mutation.
• Cryptographic HMAC-SHA256 Approvals: Human-in-the-loop sign-offs produce tamper-evident cryptographic approval tokens, providing end-to-end non-repudiation.
• Indirect Prompt Injection Defense: Sandboxes untrusted retrieved data within strict <retrieved_evidence> XML boundaries with regex-enforced identifiers.

Enterprise SaaS connectors, automated DLP secret scrubbing, and cryptographic write gates.

• Automated DLP Secret Scrubbing: Real-time SecretScrubber detecting AWS keys, private RSA keys, JWT tokens, Bearer tokens, and email PII prior to chunk indexing.
• Bi-Directional SaaS Connectors: Pre-built, production-tested adapters for Jira, Confluence, Slack, GitHub, and PostgreSQL.
• Cryptographic Write Gates: Enforces HMAC-SHA256 signature verification before any SaaS adapter can mutate production systems (e.g., ticket creation or comment updates).

I am always interested in discussing high-concurrency systems architecture, enterprise AI data governance, and open-source infrastructure:

• LinkedIn: linkedin.com/in/vinaykumar-ksheerasagar-92270024
• Email: sagarv.kumar48@gmail.com
• GitHub: @sagarv48