Available for freelance work

I build AI-powered products, automation systems & developer infrastructure.

Nine systems shipped before my first day of college — a Supabase RLS-secured campus operations platform, a 123-command Discord automation bot, and a local-first RAG document assistant among them, backed by 355 automated tests. Self-taught; now a BCA student at Malda College.

View Selected Work
Inquire / Contact GitHub
09 Systems Shipped & Verified
355 Automated Tests Passing*
53 RLS Policies in MaldaOS

*MaldaOS 165 + AI-gateway 33 + Pixel 147 + Readstacks 10. Excludes suites needing live credentials (local Supabase, bot tokens). Breakdown in §07.

faijal.profile.ts ready 
export const engineer = {
  name: "Md Faijal Eaqbal",
  role: "Software Developer",
  location: "Malda, WB, India (UTC+5:30)",
  education: "BCA @ Malda College ('26–'29)",
  systemsShipped: [
    "MaldaOS (Campus Ops, RLS + Audit)",
    "Pixel-Assistor (123-Cmd Discord Bot)",
    "Picfix (59-Page Image & PDF Suite)",
    "Alya AI Bot (MCP & Rasa Agent)",
    "Readstacks (Local RAG AI Chat)",
    "LifeOS Bot (Telegram Daily Assistant)",
    "Malda Portal (62-Page Platform)",
    "Malda College Notification Bot",
    "Blitz Game Zone (TON Mini-App)"
  ],
  coreStack: ["Python", "JavaScript", "Next.js", "Node.js"],
  workflow: "AI-Assisted (OpenCode Agent)",
  openForWork: true
};
main branch · 9 systems verified containerized / docker
Scroll to explore
[ 02 // PHILOSOPHY & FOUNDATION ]

Engineering with intent.
Built by shipping.

Short version: I learn by shipping, and everything on this page is verifiable in a repository.

Portrait of Md Faijal Eaqbal
Md Faijal Eaqbal Self-taught developer · Malda, West Bengal, India

I learn by shipping real software. Since 2023 that has meant full-stack platforms, Telegram and Discord bots, Python automation pipelines, and a private local RAG system — each with tests, documentation and a containerized deploy, because unverifiable software doesn't count as finished.

My workflow is AI-assisted (OpenCode agent): it accelerates implementation, while architectural discipline — reviewed schemas, automated tests, CI on every push — stays non-negotiable.

Status Available for Freelance & Projects
Location & Timezone Malda, West Bengal, India (IST UTC+5:30)
Now BCA @ Malda College ('26–'29)
[ 03 // ARCHITECTURAL SCOPE ]

Targeted capabilities.
Clean execution.

Clear deliverables, production-ready architecture, containerized deployments, and 30-day post-launch support.

AI Systems

RAG pipelines with hybrid BM25 + vector search, multi-provider LLM gateways (Groq → OpenRouter → NVIDIA → Google → deterministic fallback), streaming chat, and zero-cost local inference. Proof: Readstacks, MaldaOS AI triage.

Backend Systems

APIs, PostgreSQL/SQLite, JWT auth, RBAC and Supabase RLS, SECURITY DEFINER RPCs, audit logging, BullMQ queues and Redis rate limiting. Proof: MaldaOS (53 RLS policies, 27 RPC functions, 8 migrations), Picfix (BullMQ + Redis).

Real-time Systems

SSE token streaming with mid-stream provider failover, Discord gateway event dispatch, Lavalink audio streaming, polling schedulers. Proof: Readstacks SSE chat, Pixel-Assistor.

Automation

Telegram and Discord bots, headless scraping (BeautifulSoup4, Playwright), cron daemons, expense/habit schedulers, payment QR flows. Proof: Alya (40-skill registry, 41 Rasa intents), LifeOS, college notification bot, Blitz Game Zone.

Infrastructure

Docker and Compose, Nginx reverse proxy with TLS, PM2 process management, GitHub Actions CI, systemd/cron daemons. Proof: every flagship repo ships a Dockerfile or Compose stack; live today at readstacks.duckdns.org.

How I Build

  1. Idea
  2. Architecture
  3. Implementation
  4. Testing
  5. Security
  6. Deployment
  7. Monitoring

I work across the full lifecycle — not just UI. MaldaOS, Picfix and Pixel-Assistor each carry tests, security controls, containerized deployment and production process management to back that claim.

[ 04 // SELECTED SHIPPED WORK ]

Shipped systems.
Built from the ground up.

Six flagship systems — every one designed, written, tested, secured and deployed by me. Metrics below are measured from each repository, not marketing copy.

Flagship · 01 Campus Operations & Verified Issue Resolution

MaldaOS

Campus Operations & Issue Resolution Platform with Supabase RLS, role-based workflows, AI triage, audit logging and 3D campus visualization.

17 pages + API route 198 automated tests 53 RLS policies CI on every push

Problem: campus issues (broken infrastructure, maintenance requests, safety hazards) get reported through informal channels, get lost, and have no verifiable resolution trail. Solution: an institutional command ledger — students file structured reports with evidence and location, department staff get dispatched work orders, and every lifecycle transition is database-enforced and audit-logged. Result: a resolution trail anyone can audit — 198 automated tests, 53 RLS policies and fail-closed production guards, verifiable in the repo today.

  • Next.js 14 App Router: 17 pages (student, report, map, 8 admin views) + 1 server-side AI triage API route
  • Supabase Postgres with 53 RLS policies across 8 migrations — direct table mutations blocked by guard triggers
  • 27 RPC functions (SECURITY DEFINER) govern every privileged write: transitions, assignments, endorsements
  • Provider-agnostic AI gateway (Groq → OpenRouter → NVIDIA → Google → deterministic fallback), server-only keys, advisory-only output
  • Fail-closed production guards: mock layer can never activate in production builds, verified by dedicated guard tests + CI
  • 3D campus twin (Three.js) + 2D Leaflet GIS map, WebGL safety fallbacks, reduced-motion support
How do you stop students modifying another student's issue?

Supabase RLS + SECURITY DEFINER RPC + database role enforcement. Roles come from profiles.role in the database — never browser metadata. Seeded demo logins are hard-blocked in production and eliminated from the client bundle at build time.

How do you keep AI triage honest?

AI output is advisory-only (category, severity, priority, summary, confidence) that a human operator accepts or rejects. The deterministic fallback is always labelled and never claims to be a model response; the core report → assign → resolve → verify workflow works with zero providers configured.

How is every action verifiable?

Every mutation writes to audit_logs (super-admin view at /admin/audit with CSV export). Status transitions are database-enforced: OPEN → ASSIGNED → IN_PROGRESS → RESOLVED → CLOSED, with a 7-day student reopen window.

Next.js 14 Supabase RLS Postgres RPC AI Gateway Three.js Vitest CI
Explore this project
Case Study GitHub
Proof · Real product screens VERIFIED REPO ASSET
MaldaOS student dashboard screenshot
Student dashboard — live progress tracking
MaldaOS admin command console screenshot
Admin command console — triage queue + health
MaldaOS 4-step report workflow screenshot
4-step report workflow with AI advisory
> 53 RLS policies · 27 RPC functions · fail-closed prod guards
Flagship · 02 Discord Automation Platform

Pixel-Assistor

Self-hosted Discord automation platform replacing multiple single-purpose bots — moderation, Lavalink audio, multi-chain crypto, games and utilities.

123 commands · 8 categories 147 tests passing Self-hosted · PM2

Problem: communities juggle five single-purpose bots with conflicting permissions and downtime. Solution: one hardened bot — 123 commands across 8 categories (admin 13 · crypto 4 · extra 3 · fun 3 · games 5 · moderation 52 · upi 5 · utility 38), with a pluggable storage layer and enterprise security guardrails. Result: five bots collapsed into one — 147 green tests and a hierarchy engine that blocks privilege escalation, covered by red-team security tests.

  • Discord.js v14 slash-command parsing with dynamic filesystem loader (hot-reload per command, no restarts)
  • Multi-chain crypto: EVM (Polygon, Ethereum, BNB, Arbitrum, Base, Optimism), Solana SPL, Tron TRC-20, Litecoin UTXO
  • Remote Lavalink audio node — demuxing/Opus encoding offloaded, Node event loop stays fast
  • Dual-database abstraction: SQLite (better-sqlite3, WAL) default, MongoDB when MONGO_URI is set — same command interfaces
  • Security: role/member hierarchy engine, secret redaction, anti-SSRF validation, zero-eval Shunting-Yard calculator
How do 123 commands stay maintainable?

Dynamic filesystem loader + metadata contracts. The registry smoke test asserts every command exports name/execute/category and blocks duplicate aliases — 147 tests pass on every run.

How do you prevent privilege escalation?

Centralized hierarchy engine: no action against guild owners, higher roles, or the bot itself; server co-owner locked to the actual guild owner. Covered by red-team security tests.

How does it stay running?

PM2 process management with crash recovery, background reminder/timer pollers, auto-mod rate limiting — running live on this host right now (pixel-discord-bot: online).

Discord.js v14 Lavalink SQLite MongoDB PM2 Node --test
Explore this project
Case Study GitHub
Flagship · 03 Private Local RAG Document Assistant

Readstacks

Private local RAG document assistant — per-user isolated vector search, multi-provider fallback, JWT-secured, streaming chat. Live now.

7 doc formats 10 tests passing SSE streaming Live demo

Problem: RAG demos either ship your documents to a third-party SaaS or lock you to one cloud vendor. Solution: local-first, multi-tenant RAG — upload PDF/DOCX/TXT/MD/XLS/XLSX/CSV and chat with private, cited answers. SQLite + Vectra indexes are namespaced per user, so cross-user leakage is structurally impossible. Result: private, cited answers from your own documents — with mid-stream failover that keeps chat alive through provider outages.

  • Hybrid retrieval: MiniSearch BM25 keyword + Vectra cosine vector, fused at query time
  • Token-bucket fallback engine: Gemini → Groq → NVIDIA NIM → local Ollama, with mid-stream SSE failover
  • Paragraph-aware chunking with page citations ([doc.pdf p.7]) on grounded claims
  • JWT in HttpOnly SameSite Secure cookies, bcrypt hashing, signup password policy, rate-limited auth
  • One-command ops: docker compose up brings backend + local Ollama model server online
How is per-user isolation guaranteed?

Databases and vector indexes are namespaced per user on the host they own; transactional uploads roll back files, metadata rows and vector entries atomically — never orphaned chunks.

What happens when a provider dies mid-answer?

The backend re-opens the SSE stream against the next provider in AI_PROVIDER_ORDER and the UI keeps rendering tokens — chat never dies from a single provider outage.

Where do the tokens live?

Nowhere in localStorage. JWT travels in HttpOnly cookies; auth endpoints are express-rate-limit throttled against credential stuffing.

Node.js Express Vectra MiniSearch Ollama JWT SSE Docker
Explore this project
Live Demo Case Study GitHub
Flagship · 04 Full-Stack Web & AI Microservices

Picfix

59-page image & PDF processing suite — exam photo resizing, PDF engine, and local open-source AI microservices with queued workers.

59 tool pages 12 API route groups BullMQ + Redis workers Local AI · zero paid APIs

Problem: government exam portals (SSC, UPSC, Passport, PAN) reject photos on dimension or file-size grounds, and PDF/image tools either cost money or upload your documents to someone else's cloud. Solution: a privacy-first suite — 59 tool pages covering image manipulation, calibrated KB compressors, a full PDF utility engine, and local AI (background removal, OCR) with zero paid cloud subscriptions. Result: exam photos that pass SSC, PAN and passport checks on the first upload — compressors calibrated from the actual rejection rules.

  • Next.js 14 App Router frontend paired with an Express API gateway (12 route groups, 11 controllers)
  • FastAPI AI microservice: rembg/U2Net segmentation, EasyOCR, MediaPipe, OpenCV — models held in memory
  • BullMQ + Redis async image workers with inline timeout handling and shared-connection lifecycle
  • Sharp processing pipeline, Multer binary streams, node-cron temp-file hygiene
  • Calibrated target-size compressors (20KB–500KB images; 100KB–1MB PDFs) and PDF password unlocker
How do heavy AI jobs avoid blocking the API?

BullMQ queue + Redis-backed workers absorb image jobs asynchronously; retries are handled inline with AI_TIMEOUT semantics instead of blind queue retries.

How do exam specs stop being guesswork?

Algorithmic dimension, aspect-ratio and strict KB compressors for SSC CGL, PAN and passport requirements — built from the actual rejection rules, not generic resize sliders.

What keeps it abuse-resistant?

Redis-backed rate limiting (rate-limit-redis), trust-proxy hardening (covered by unit test), and cron-purged temp buffers so disk never accumulates uploads.

Next.js 14 Express FastAPI Sharp BullMQ Redis U2Net EasyOCR
Explore this project
Case Study Source Code
Flagship · 05 Autonomous AI Agent & Model Context Protocol

Alya

Autonomous Hinglish AI assistant on Telegram — Rasa NLU plus Groq fallback, 40-skill registry, MCP tool servers, OAuth workspace pipelines. Live on Telegram.

40-skill registry 41 Rasa intents MCP tool servers Live on Telegram

Problem: personal assistants either answer trivia or execute tools — rarely both, and almost never in Hinglish with real workspace access. Solution: a dual-tier conversational agent — Rasa Core/NLU for intent classification, a custom action server for execution, Groq LLM for generative fallback, and MCP servers for headless tool use — across 40 registered skills. Result: an assistant that both chats and executes — planner metadata means unknown goals return None instead of hallucinated actions.

  • Dual-tier runtime: Rasa agent (port 5005) decoupled from async action server (port 5055)
  • 40-command registry with planner metadata layer — unknown skills resolve to None, never hallucinated
  • MCP clients for official GitHub MCP (port 4097) and headless OpenCode MCP (port 4096)
  • Groq hardware-accelerated inference as conversational fallback when NLU rules need generative reasoning
  • Document synthesis engines (ReportLab PDF, openpyxl, python-docx) + Google OAuth 2.0 / MS Graph pipelines
  • Nginx reverse proxy, Docker packaging, and unit test suites over the skill registry, authorization and webhook boundaries
Why split NLU from execution?

Rasa handles intent confidence and slot extraction while the action server executes non-blocking I/O and external APIs — slow tools never stall conversation state.

How do you stop the agent inventing tools?

The skill registry derives planner metadata from descriptions; unregistered goals return None instead of guessed actions. Authorization, container isolation and webhook-auth tests guard the boundary.

Why Groq as fallback?

Hardware-accelerated inference keeps Telegram round-trips fast when pre-trained NLU rules need generative reasoning — with Rasa intents still owning structured flows.

Rasa 3.6 Groq LLM MCP Python 3.10 OAuth 2.0 MS Graph Docker
Explore this project
Try Live on Telegram Case Study GitHub
Flagship · 06 Web Platform & Design System

Malda Portal

62-page institutional web portal for Malda College — academics, administration, facilities — with zero runtime framework overhead.

62 HTML pages 19 departments Zero framework Multi-target deploy

Problem: institutional information scattered across outdated pages with no coherent navigation. Solution: a complete static portal — 62 pages spanning 20 root institutional pages, 19 academic departments, 6 administrative cells and 5 campus facilities — under one information architecture. Result: instant dark/light theming across all pages via CSS tokens, and fast first render on low-end phones with zero runtime dependencies.

  • 31 root pages + 6 cell pages + 5 facility pages + 20 subject pages = 62 verified HTML pages
  • Token-based CSS custom-properties architecture — instant dark/light theming across all pages, no duplicate bundles
  • Zero client-side framework: pure HTML5, modern CSS Grid, vanilla JS — fast first render, high Lighthouse headroom
  • Multi-target packaging: Nginx, Vercel and Docker deployment configurations
Why no framework for 62 pages?

Content pages don't need hydration. Static HTML keeps hosting trivial, renders fast on low-end phones, and removes an entire class of runtime failure.

How is theming consistent at this scale?

A CSS custom-properties token hierarchy — one variable change propagates across all 62 pages without rebuilding per-page bundles.

How does it deploy anywhere?

Dual Docker alpine + Nginx configs with gzip and static-asset caching headers — the same directory serves from any static host.

HTML5 CSS Grid Vanilla JS Nginx Docker
Explore this project
Case Study GitHub

Also shipped & maintained

LifeOS Bot

Telegram daily assistant — aiogram v3, APScheduler, SQLite + Notion/Sheets sync, Matplotlib expense analytics.

GitHub

Malda College Notification Bot

Portal scraper + Telegram dispatcher — SHA-256 change detection, per-department subscriptions, Sheets control plane. Live via PM2.

GitHub

Blitz Game Zone

TON blockchain Telegram mini-app — 60/40 revenue ledger, Tonkeeper verification, anti-fraud velocity engine.

GitHub
[ 05 // TECHNICAL DEEP-DIVE · OPTIONAL ]

Full-stack pipeline.
From client to bare metal.

Optional reading — if you're scanning, jump to the stack matrix below. For engineers: click any tier to inspect what runs there and the trade-offs behind it. Every tier maps to code in a shipped repository.

Tier 01 // Edge Client

Client & TMA Interface

Telegram Mini App, Web Clients, Discord Gateway
200 OK Inspect
Tier 02 // Security & Edge

Nginx Reverse Proxy & SSL

TLS 1.3 Termination, Certbot, Rate Limiting, DuckDNS
TLS 1.3 Inspect
Tier 03 // Routing & Bus

API & Bot Gateways

Express.js, FastAPI, aiogram v3, Discord.js v14
ROUTED Inspect
Tier 04 // Async Compute

Worker Engines & Daemons

Node.js Clusters, Python Asyncio, BeautifulSoup Scrapers
ACTIVE Inspect
Tier 05 // Persistence

Relational & Vector Stores

PostgreSQL, SQLite, MongoDB, vectra Vector Indices
SYNCED Inspect
Tier 06 // Local AI

Ollama & Local Inference

Llama 3.2, Token Budgeting, OpenCode AI Workflow
0% COST Inspect
Tier 07 // Bare Metal & Host

Host Linux & Docker Core

Ubuntu LTS VPS, PM2 Daemon Manager, Systemd Cron
DAEMON Inspect
[ 06 // SYSTEM STACK MATRIX ]

Tools of the trade.
Verified proficiency.

No arbitrary percentage bars. Only technologies actively used across shipped repositories.

JavaScript / TypeScript

proof
  • Next.js 14 App Router (MaldaOS · Picfix)
  • Discord.js v14 — 123 commands (Pixel-Assistor)
  • Express gateways + BullMQ workers (Picfix)

Python

proof
  • Rasa 3.6 + 49 action modules (Alya)
  • aiogram v3 async bots (LifeOS · notif-bot)
  • FastAPI AI microservice — U2Net/EasyOCR (Picfix)

Data & Auth

proof
  • Supabase RLS — 53 policies, 27 RPCs (MaldaOS)
  • JWT HttpOnly cookies + bcrypt (Readstacks)
  • SQLite · Postgres · MongoDB · Vectra

AI Systems

proof
  • RAG: BM25 + Vectra hybrid, page cites (Readstacks)
  • Gateway: Groq → OpenRouter → NVIDIA → Google (MaldaOS)
  • Ollama local inference · SSE failover

Infra & Realtime

proof
  • Docker/Compose · Nginx TLS · PM2 (all flagships)
  • GitHub Actions CI (MaldaOS · Readstacks)
  • SSE streaming · Lavalink audio · cron daemons

Full language list

07
  • Python
  • JavaScript (ES6+)
  • TypeScript
  • SQL
  • C / C++
  • HTML5
  • CSS3
[ 07 // CHRONOLOGY & PROOF ]

The road so far.
Documented progress.

A verifiable timeline of self-directed learning, shipped projects, and academic grounding.

First Lines of Code

Began the self-taught software engineering path. Mastered Python and JavaScript fundamentals, Linux system administration, Git version control, and the daily habit of building real projects.

Nine Systems Shipped

Designed, built, and shipped nine independent systems before starting college: MaldaOS (RLS-secured campus ops), Picfix (59-page image & PDF suite), Readstacks (local RAG chat, live), Alya (MCP & Rasa agent, live on Telegram), LifeOS automation bot, college notification bot (live via PM2), Pixel-Assistor (123-command Discord bot, live via PM2), Blitz Game Zone (TON mini-app), and malda-portal (62 pages).

BCA Commences — Malda College

First-year Bachelor of Computer Applications student under Gour Banga University. Gaining formal academic depth in Data Structures & Algorithms, Database Systems, Computer Networks, and Operating Systems.

[ COMPLETE DOSSIER ]

Looking for a structured resume?

Educational background, verified technical proficiencies, project architectures, and contact details condensed into a single, printable PDF.

Download Resume (PDF)
View in Browser
[ 08 // TRANSMISSION & INQUIRY ]

Need an automation, AI system,
or a full-stack product built?

Telegram/Discord bots, RAG systems, and full-stack web apps — shipped with tests, CI and Docker. Send scope, timeline, or just the idea; my inbox is open.

Send a Direct Transmission

Direct to my inbox — no third-party spam filters.

Please enter at least 2 characters.
Please enter a valid email address.
Message must be at least 10 characters long.