# Mourad Chnaiti > **Platform Architect · Applied AI & SaaS Systems** > Vancouver, BC, Canada (Pacific Time) · [chnaiti.mourad@gmail.com](mailto:chnaiti.mourad@gmail.com) · [GitHub](https://github.com/cmourad) · [Website](https://mourad.chnaiti.com) > **Target Roles:** Staff Platform Engineer · Principal Platform Architect · Head of Cloud Infrastructure · Principal SaaS / Systems Architect > **Availability:** Targeting Staff & Principal Platform roles — remote or hybrid from Vancouver > **Languages:** English (Fluent) · French (Native) · Arabic (Native) --- ## Executive Summary Platform Architect and full-stack systems engineer with 15+ years of software development experience specializing in cloud platform infrastructure, developer self-service platforms, multi-tenant SaaS architectures, and applied AI systems. Uses AI coding agents in day-to-day engineering and builds and operates agent infrastructure, MCP services, and local inference systems. Focused on whole-system architecture: from domain modeling and local GPU inference to zero-trust networking, GitOps, and disaster recovery. --- ## How I use, build, and deploy AI - **Define the system:** I set domain boundaries, architecture contracts, and agent instructions before generating code. App Registry makes the reusable foundation deterministic. - **Build with agents:** I use AI coding workflows and build MCP tools that give agents structured access to systems. Tool schemas and role-specific permissions keep their scope explicit. - **Review and verify:** I use type checks, architecture tests, Vitest, and Playwright to check the work. Security experiments include prompt injection and permission boundary testing. - **Deploy and operate:** I run local GPU inference and hybrid Kubernetes infrastructure, with GitOps promotion, managed secrets, network policies, and observability. Project descriptions and experience are candidate-provided. This résumé's MCP tools are directly testable; other systems are available for an architecture walkthrough. Current and past employment positions and employers are private. Professional focus and target roles do not disclose a current job. Independent verification and references require direct contact. --- ## Core Technical Highlights - Hybrid & Edge Infrastructure: Engineered and operates hybrid k3s / Oracle OKE GitOps platform with WireGuard/NetBird mesh, authentik operator SSO, Infisical/OCI Vault secrets, and Cilium egress policies. - Applied AI Engineering: Active architect of MCP (Model Context Protocol) servers, multi-agent workflows with per-role tool allowlists, self-hosted GPU inference (dual RTX 5070 Ti + 4070 SUPER, llama.cpp / CUDA), and pgvector RAG pipelines. - End-to-End SaaS Architecture: Built Astal (halwa-desk) for pastry businesses and KitchenDesk with custom DXF/SVG CAD geometry engine and offline-first IndexedDB. - Deterministic Engineering: Built App Registry for reproducible byte-for-byte code generation and strict architectural contract enforcement. - Zero-Trust Cloud Governance: Advanced knowledge of Kubernetes admission control (ValidatingAdmissionPolicy), Kyverno, network isolation, and secret lifecycle automation. --- ## Engineering Labs & Featured Software Projects ### Hybrid Kubernetes GitOps Platform *Enterprise GitOps k3s & Oracle OKE platform with NetBird WireGuard mesh* · **Status:** Active & Operated Designed and operated production hybrid k3s and Oracle OKE GitOps infrastructure. Uses NetBird WireGuard mesh to privately reach the OKE API via an independent anchor VM and link cloud workloads to local GPU inference clusters under Cilium egress network policies. Features authentik operator SSO (OIDC, OAuth, MFA), Infisical and OCI Vault secrets with External Secrets Operator, cert-manager PKI, Tetragon eBPF runtime security, VolSync/restic backups, and ephemeral Actions Runner Controller (ARC) GitHub runners promoting images via Git without CI cluster access. **Architecture Highlights:** - Zero cluster credentials in CI: GitHub Actions Runner Controller (ARC) promotes image digests strictly via Git commits to ArgoCD repositories. - Private API mesh: NetBird WireGuard peer connection to OKE private endpoint without public IP exposure. - Least-privilege egress: Cilium egress network policies restrict cluster pods to explicit external domains. - Automated PKI & Secrets: cert-manager + trust-manager for internal TLS, Infisical/OCI Vault synced via External Secrets Operator. **Technologies:** k3s, Oracle OKE, Argo CD, OpenTofu / Terraform, NetBird / WireGuard, authentik, Cilium CNI, Infisical, External Secrets, cert-manager, Prometheus, Grafana, Loki, Tetragon, VolSync, Actions Runner Controller **Source:** https://resume.chnaiti.com/projects/hybrid-k8s-platform ### Agent Infrastructure & AI SOC *Multi-agent workflows, scoped tool permissions, and local GPU inference bench* · **Status:** Active & Researching Engineered multi-agent systems with per-role tool allowlists and intelligent model routing, powered by a self-hosted GPU inference bench (dual RTX 5070 Ti + RTX 4070 SUPER running llama.cpp and CUDA). Built a 19-adapter personal data pipeline (PostgreSQL, pgvector, local embeddings) feeding agent long-term memory. Operates a security laboratory where a strictly guarded Python agent is the sole entity allowed to modify firewall rules, with comprehensive injection testing and telemetry capture. **Architecture Highlights:** - Self-hosted GPU Bench: Low-latency local inference with quantization and strict VRAM budget management. - Scoped Tool Sandboxing: Agents operate under strict JSON schemas with deterministic output validation. - 19-adapter ETL Memory Pipeline: Feeds contextual embeddings into pgvector vector store. - Security Lab: Suricata and nftables integration tested against prompt injection and privilege escalation. **Technologies:** llama.cpp / CUDA, Model Context Protocol (MCP), Python, TypeScript, PostgreSQL, pgvector, Suricata, nftables, Docker **Source:** https://resume.chnaiti.com/projects/ai-soc-and-agent-infra ### App Registry — Deterministic SaaS Foundation *Machine-readable specifications & byte-for-byte reproducible code generation* · **Status:** In Active Use A shared registry of reusable SaaS components and deterministic application scaffolds. Generates production-ready full-stack applications from machine-readable JSON specifications, enforcing architectural contracts, TypeScript types, and byte-for-byte reproducibility across runs. **Architecture Highlights:** - Byte-for-byte reproducibility: Two runs against the same spec produce identical files and checksums. - Contract-driven architecture: Domain entities, API verbs, and database schemas validated via deterministic schemas. - Reusable product foundation powering Astal and KitchenDesk. **Technologies:** Node.js, TypeScript, JSON Contracts, Code Generation, Architecture Testing **Source:** https://resume.chnaiti.com/projects/app-registry ### Astal (halwa-desk) — Pâtisserie Operations SaaS *End-to-end production SaaS with PostgreSQL RLS & offline-first till* · **Status:** Production Ready Comprehensive multi-tenant SaaS built for specialty bakeries and food artisans: inventory management, batch production planning, point of sale, weighted average recipe costing, and compliance invoicing. Implements PostgreSQL Row-Level Security (RLS) for tenant isolation, an offline till with an IndexedDB transaction queue, and database-side cost calculations. **Architecture Highlights:** - Strict Tenant Isolation: PostgreSQL Row-Level Security (RLS) guarantees complete tenant data isolation at the engine level. - Offline-First Resilience: POS register operates seamlessly during network outages, queuing transactions in IndexedDB and replaying with conflict resolution. - Disposable Preview Branches: Database schema changes rehearse migrations against disposable database forks on Neon before production release. **Technologies:** Next.js, TypeScript, PostgreSQL, Neon, IndexedDB, Row-Level Security (RLS), Playwright **Source:** https://resume.chnaiti.com/projects/astal ### KitchenDesk — CAD & Operations SaaS for Manufacturers *Project quoting & CAD workflows with DXF parser & SVG geometry engine* · **Status:** Production Ready SaaS tailored for custom kitchen manufacturers and fitters. Features DXF floor plan import, custom SVG geometry rendering, reservation sheets, and production workflow tracking. Uniquely models measured, documented, hypothetical, and conflicting geometry explicitly to prevent measurement errors from turning into costly manufacturing mistakes. **Architecture Highlights:** - Explicit Geometric Epistemology: Distinguishes between confirmed measurements, architect assumptions, and site discrepancies. - Custom DXF/SVG Pipeline: Parses raw AutoCAD DXF files and renders interactive SVG layouts directly in the browser. - Contract-driven domain logic with end-to-end Vitest and Playwright test suites. **Technologies:** Next.js, TypeScript, PostgreSQL, DXF Parser, SVG Engine, Vitest, Playwright **Source:** https://resume.chnaiti.com/projects/kitchendesk ### Headless SaaS & Agent Reach Probe *Public MCP service and Headless AI Resume with real agent telemetry* · **Status:** Live in Production A live, stateless Model Context Protocol (MCP) server deployed to measure autonomous AI agent discovery and interaction. Provides a headless resume surface for recruiter agents and crawlers, with cryptographic telemetry separating passive web crawlers from configured MCP client tool calls. **Architecture Highlights:** - Dual-channel Discovery: Measures passive web crawlers (llms.txt, robots.txt) vs configured MCP clients (/mcp). - Stateless Streamable HTTP: Ephemeral McpServer per request with IP-hash client attribution. - Agentic HR Tools: Role fit analysis, skill graph queries, and recruiter inquiry channels. **Technologies:** Next.js, Model Context Protocol (MCP), TypeScript, Upstash Redis, Zod, Kubernetes **Source:** https://resume.chnaiti.com/projects/headless-saas --- ## Industry experience - **Natural resources & mining:** Self-service cloud and Kubernetes platform architecture, governance, and automation. - **Insurance:** Cloud application integration, APIs, and infrastructure as code. - **Industrial IoT:** Cloud ingestion, enrichment, and analysis of connected-device telemetry. - **Video technology:** Video-indexing systems and high-volume equipment-health event processing. - **Food & hospitality operations:** Independent SaaS for inventory, production planning, costing, and offline point of sale. - **Manufacturing & design:** Independent software for project workflows, CAD import, and geometry visualization. --- ## Technical Skills & Architecture Competencies ### Platform & Cloud Architecture *Enterprise cloud platforms, Kubernetes, Infrastructure as Code, and Landing Zones* - **Azure** (Expert): 7+ years. AKS, ARM, Azure DevOps, Landing Zones, Azure Policy, Event Hub, ADX, IoT Hub - **Kubernetes (AKS / OKE / k3s)** (Expert): Architect of enterprise K8s-as-a-Service, GitOps, Cilium CNI, Ingress, KEDA - **Terraform & OpenTofu** (Expert): TFE workspaces, reusable multi-cloud modules, provider orchestration - **GitOps (FluxCD / Argo CD)** (Expert): Promotion workflows, zero-cluster-credential CI/CD, multi-cluster sync - **Oracle Cloud Infrastructure (OCI / OKE)** (Advanced): Private OKE clusters, OCI Vault, hub-and-spoke networking - **ARM & Bicep Templates** (Expert): Enterprise platform IaC owner with automated validation gates ### Networking, Security & Identity *Mesh networking, zero trust access, secrets management, and runtime security* - **NetBird & WireGuard Mesh** (Expert): Hybrid cloud-to-bare-metal interconnects, private API relay VMs - **Cilium CNI & eBPF** (Advanced): Cluster egress policies, network security, Tetragon runtime detection - **authentik & Entra ID (Azure AD)** (Expert): Operator SSO, OIDC, OAuth 2.1, forward authentication, MFA, PIM - **Infisical & External Secrets Operator** (Expert): Enterprise secret delivery into k3s and OKE without in-repo secrets - **cert-manager & trust-manager** (Advanced): Automated PKI, internal mTLS, Let's Encrypt automation - **Tetragon & Security Auditing** (Advanced): Runtime anomaly detection, system call monitoring in Kubernetes ### SaaS & Full Stack Engineering *Production web applications, microservices, and multi-tenant architectures* - **TypeScript & JavaScript** (Expert): 10+ years across frontend, backend, CLI tools, and code generators - **Next.js & React** (Expert): App Router, Server Actions, SSR, streaming, optimized bundle architectures - **.NET / C# (.NET Core to .NET 8)** (Expert): 12+ years. Microservices, AKKA.NET actor model, Web API, SignalR - **Python** (Advanced): AI agent orchestrators, data pipelines, Suricata security scripts, CAD tooling - **PostgreSQL & Neon** (Expert): Row-Level Security (RLS), complex domain modeling, migration rehearsals - **IndexedDB & Offline-First** (Advanced): Offline transaction queues, state synchronization, conflict handling - **Domain-Driven Design (DDD)** (Expert): Bounded contexts, aggregate roots, ubiquitous language, event modeling - **Testing (Playwright & Vitest)** (Expert): End-to-end browser automation, hermetic unit tests, architectural regression tests ### Applied AI & Agent Systems *Model Context Protocol (MCP), multi-agent systems, and local GPU inference* - **Model Context Protocol (MCP)** (Expert): Built production Streamable HTTP servers, tool instrumentation, resource providers - **Multi-Agent Orchestration** (Advanced): Per-role tool allowlists, model routing, safety guardrails, state persistence - **Self-Hosted GPU Inference** (Advanced): Dual RTX (5070 Ti + 4070 SUPER), llama.cpp, CUDA, VRAM optimization - **RAG & pgvector** (Advanced): 19-adapter personal data pipeline, local embeddings, vector similarity search - **Deterministic Tool Validation** (Expert): Zod schemas, structured output enforcement, prompt injection defense - **Claude Code / AI Dev Workflows** (Expert): Custom agent skills, AGENTS.md / CLAUDE.md guidelines across 20+ repos ### Observability & SRE *Telemetry, distributed tracing, metrics, and site reliability engineering* - **Datadog & Azure Monitor** (Expert): Enterprise APM, custom metrics, platform SLI/SLO dashboards - **Prometheus, Grafana & Loki** (Advanced): GitOps cluster observability stack with Alloy and Alertmanager - **SLI / SLO Engineering** (Expert): Designed service level objectives for internal developer platforms - **Azure Data Explorer (ADX / Kusto)** (Expert): Hyperscale IoT telemetry analytics, KQL query optimization --- ## Education - **2017** — B.Sc. in Computer Science & Software Engineering (B.Sc.A.), *Université du Québec à Montréal (UQAM)* (Montreal, QC, Canada) - **2004** — Specialized Technician Diploma — Information Systems, *Institut Spécialisé de Technologie Appliquée (ISTA)* (Morocco) --- ## Career History & References > [!NOTE] > Current and past employment positions, employer names, employment timelines, and client references are private. For full professional background, client references, and deep-dive walkthroughs, please contact Mourad directly at chnaiti.mourad@gmail.com. If you are a recruiter, hiring manager, or technical leader interested in Mourad's background: - **Email directly:** [chnaiti.mourad@gmail.com](mailto:chnaiti.mourad@gmail.com) - **Full employment dossier & references** are provided under direct contact. ## Agent access Setup: https://resume.chnaiti.com/connect MCP endpoint: https://resume.chnaiti.com/mcp Use search and fetch for cited evidence; get_ai_workflow for applied AI practice. Role comparison is keyword overlap, not a hiring score. Contact tools only prepare drafts.