Đỗ Xuân Lộc

▸Designed an append-only, SHA-256 hash-chained ledger anchored to observed effects (post-write file hashes, per-run git-HEAD delta) rather than parsed command strings — because a fully-bypassed agent can make the command lie about what it does.

Prototyped in Python then hardened into Rust with unit tests proving tampering is detectable; a 5-band honesty model with an explicit 'opaque' verdict — an effect it can't derive is flagged, never silently marked safe.

>> tamper-evident audit as a primitive, not an assertion

▸Fused LLM flexibility with deterministic domain truth: the model proposes a per-product schema, then a hand-curated hardware-spec table forbids impossible fields. The LLM may explain — code decides.

LangGraph supervisor + specialist nodes; structured output everywhere with retry/backoff; a real P99 tail-latency investigation (45s = 11.5× P50) driving schema-cache pre-warming and a circuit breaker for external tools.

>> only data consistent with hardware reality passes through

▸Insourced Whisper + NeMo diarization onto SageMaker async endpoints driven by Lambda — deleting external AI-vendor dependencies (a privacy win when the data carries PII) while paying for GPU only on real execution.

In-context batching (many transcripts per call, Pydantic-array output ≈ 80% fewer prompt tokens) plus content-hash prompt caching; treated the model as untrusted — rejecting transcripts whose timestamp count drifts outside a bounded ratio.

>> zero idle GPU, burst-tolerant without provisioned capacity, fewer external vendors

▸The centerpiece is a pure-Python proof gate that recomputes every verdict and discards whatever an LLM set: a SAST static trace alone returns 'unconfirmable' and must escalate to a live PoC; a refutation always beats a confirmation.

Chose LangGraph over CrewAI because a non-LLM decision node was required; kept LLM triage outside the deterministic graph, CONFIRMED-only and default-off; drove cost to a <50k-tokens/scan target by letting scanners do the heavy lifting.

>> only findings backed by machine-verifiable proof block CI

▸Reduced it to a conic-section feasibility constraint: a stop is only suggestable if it falls within the ellipse whose foci are the adjacent events (PA + PB ≤ a configured distance), color-banded by great-circle travel time.

Real-time concurrency over Server-Sent Events with first-writer-wins; a memento pattern for undo/redo across the data model; two-way Google Calendar sync.

>> geometrically feasible stop suggestions, no double-booking

▸Enforced column-level PII redaction at the data-lake layer, and HMAC pseudonymization scoped by department:field:version so tokens can't be joined across teams; for real estate, designed the schema so owner PII can never reach the client at all.

Privacy is a shape of the architecture, not a filter bolted on: fail-safe auth blocks admin routes on misconfig, and a self-authored production-readiness audit refused to ship while P0 findings remained.

>> privacy enforced at the schema layer, not accidentally leakable