kwanele@dev:~

whoami --verbose

# USER

Kwanele Ntshangase

AI Engineer & .NET Fullstack Developer

Two things, and they keep meeting. Software engineering in C# and .NET: APIs, auth, real-time, and the pipelines that deploy them. AI engineering in Python: RAG, retrieval, and LLM tooling that has to show where its answer came from.

./view-projects ./contact --now

which --all skills

C#/.NET
ASP.NET Core
Entity Framework Core
CQRS/MediatR
Clean Architecture
Python
FastAPI
LangGraph
RAG
Prompt engineering
TypeScript
React
Next.js
Tailwind CSS
SignalR
PostgreSQL
SQL Server
Azure
Docker
GitHub Actions

history --work

Experience

ps aux | grep nhusta

[VOLUNTEER · ACTIVE]

AI Engineer @ Nhusta EduTech

Jun 2026 — present

// gamified mathematics learning, grades 1–12

Contributing to an early-stage South African EdTech building a gamified Mathematics learning ecosystem for Grades 1–12, reporting directly to the CTO.

Benchmarked MzansiLM, a 125M-parameter South African language foundation model, across zero-shot and few-shot generation in English, isiZulu, isiXhosa and Sesotho, then wrapped it in an internal-only FastAPI explanation service with a strict caller-supplied correct-answer boundary — correctness is never inferred by the model. The written assessment drove the go/no-go decision for the Nono AI tutor, and a 20-prompt × 3-language content-safety evaluation became the Sprint 5 model-swap recommendation.
Built a production-grade C# PDF text-extraction prototype on iText7 with latency, CPU and RAM profiling plus scanned-PDF detection, designed behind an IDocumentExtractor interface for clean lift-and-shift into the team’s Clean Architecture solution.
Shipped a full-stack Admin User Management UI in Next.js 14 — App Router, TypeScript, Tailwind, shadcn/ui — with URL-persisted filter, pagination and sort state, dark mode, own-row self-protection, and Playwright smoke tests, delivered through GitHub PRs and handoff docs written for reviewers and non-engineering stakeholders alike.

Python
C#
TypeScript
FastAPI
Next.js 14
React
Tailwind
shadcn/ui
LangGraph
Hugging Face Transformers
iText7
Playwright
Git

ls ./featured-projects

Featured Projects

Seven shipped systems. Each links to its source, a write-up of the decisions behind it, and a running deployment where one is still up.

cat ./projects/lexasa.md

[LIVE · VERCEL]

01 /

LexaSA

South African regulatory intelligence that cites the actual Act.

FastAPI
LangGraph
React 19
pgvector
Supabase
Azure

// PROBLEM: Ask a model about POPIA, the BCEA or the Companies Act and it answers confidently without showing its working. In a regulatory context a plausible wrong answer is worse than no answer — and legislation that was current last year may not be current now.
// SOLUTION: Hybrid retrieval — vector similarity plus keyword search, combined by reciprocal rank fusion — feeding a LangGraph agent that searches iteratively before answering. Every claim traces back to a specific chunk of a specific document version, with citations carrying the Act, the section, and the snapshot date.
// OUTCOME: A system honest about its own limits: it separates "current in this corpus" from "current in law", refuses to fabricate a citation, and returns insufficient_evidence as a real outcome instead of guessing. 432 backend tests, all offline by default.

cat ./projects/raptorreview-ai.md

[PUBLISHED · GITHUB MARKETPLACE]

02 /

RaptorReview AI

AI code review, straight from the GitHub Marketplace.

Python
GitHub Actions
Groq
LLM
tiktoken

// PROBLEM: PR reviews under deadline pressure get skimmed. Security issues, N+1 queries and hardcoded secrets slip through because reading a 400-line diff for subtle problems is exhausting — and every existing AI review tool wants a paid API key, a hosted service, or both.
// SOLUTION: A GitHub Action that reviews every pull request with an LLM and posts line-specific security, performance and readability comments directly into the PR diff. No hosted infrastructure, no paid API key, installable by any repository in one step.
// OUTCOME: Published on the GitHub Marketplace and installable with a single addition to a workflow file — an automated security and quality pass on every PR, at zero cost to the team running it.

cat ./projects/scrapflow-sa.md

[PRODUCTION]

03 /

ScrapFlow SA

A SAPS/ITAC-compliant scrap yard platform, digitised end to end.

React 18
ASP.NET Core 8
SignalR
PostgreSQL
PWA
Docker

// PROBLEM: South African scrap yards must log every transaction for SAPS/ITAC compliance, yet most still run on carbon-copy paper tickets. One lost ticket is an unprovable chain-of-custody gap, and multi-site operators had no shared view of stock.
// SOLUTION: A six-step digitised ticket workflow — arrival, weighing, grading, tare, payment, completion — with SignalR broadcasting live inventory to every connected yard, 5-role RBAC, weighbridge integration over the Web Serial API, and an HMAC-SHA256 signed webhook engine feeding Zapier and n8n.
// OUTCOME: Every completed ticket becomes an immutable audit record, and compliance reports reach the accountant automatically. For a yard processing 50+ tickets a day, that removes an entire admin function.

cat ./projects/supportos.md

[SOURCE AVAILABLE]

04 /

SupportOS

A CQRS-driven support platform built on .NET.

ASP.NET Core 8
MediatR
CQRS
EF Core 8
Azure
xUnit

// PROBLEM: Controller → service → repository wiring leaves nowhere to enforce cross-cutting concerns without touching every handler, and validation that throws exceptions makes every controller responsible for formatting its own errors.
// SOLUTION: A four-stage MediatR pipeline — idempotency, logging, validation, performance — applied once, in order, before any handler runs. Result<T> across all twelve commands and queries so no endpoint contains a try/catch, plus an SLA engine, a ticket state machine, and an EF Core audit interceptor.
// OUTCOME: Deployed to Azure App Service through GitHub Actions with OIDC and zero stored credentials. Every status change, assignment and comment is an immutable record, and SLA breach rate, first response time and resolution time are exposed on one endpoint.

cat ./projects/wardcare-plus.md

[SOURCE AVAILABLE]

05 /

WardCare+

POPIA-audited hospital ward management, deployed on Azure.

ASP.NET Core 8
MVC
Azure
EF Core
GitHub Actions

// PROBLEM: Under POPIA, every patient record access, update or deletion is a legal event that must be traceable. A team of four needed a system where no developer could bypass auditing under time pressure — and a cloud pipeline holding no stored credentials at all.
// SOLUTION: An EF Core SaveChangesInterceptor capturing before/after JSON snapshots on every write across 25+ entities, with soft-delete on every table and 7-role policy-based authorization. The Azure pipeline authenticates via OIDC workload identity federation.
// OUTCOME: A complete forensic trail on every patient record change, and no secrets in GitHub to rotate if the repository were ever compromised. The test suite fails in CI if a refactor removes the audit behaviour.

cat ./projects/libraryos.md

[PRODUCTION · AZURE]

06 /

LibraryOS

Clean Architecture and live availability for a community library.

ASP.NET Core 8
React 19
SignalR
Clean Architecture
Azure

// PROBLEM: A community library replacing manual card cataloguing needed patrons and librarians to see real-time availability without refreshing, and an auth layer that would not fail silently under concurrent use.
// SOLUTION: 35+ endpoints across 7 controllers in Clean Architecture, with JWT access and refresh rotation, fixed-window rate limiting, and SignalR group notifications driven by a background service that probes active loans daily.
// OUTCOME: A JWT refresh race condition fixed with a subscriber queue, N+1 queries eliminated with eager loading, and PostgreSQL health probes wired as Azure liveness and readiness checks so traffic never reaches an instance with a dead database.

cat ./projects/doclens.md

[LIVE]

07 /

DocLens

RAG document intelligence that actually cites its sources.

Python
FastAPI
ChromaDB
BM25
RAG
RAGAS

// PROBLEM: Cosine similarity on dense embeddings is where most RAG tutorials stop, and it consistently misses passages that use different terminology from the query — exactly the failure mode that matters in keyword-heavy legal and technical text.
// SOLUTION: Hybrid retrieval combining BM25 keyword matching with dense vectors from BAAI/bge-large-en-v1.5, fused by reciprocal rank fusion, then filtered by a cross-encoder reranking pass before the LLM sees any context.
// OUTCOME: Measured against a 20-question RAGAS evaluation set: Faithfulness +25%, Answer Relevancy +24%, Context Recall +29%, Context Precision +31% over the cosine-similarity baseline.

cat ./principles.md

How I actually work

Not a methodology. Four real things I have learned from shipping systems that have to stay up, stay compliant, and stay maintainable.

Compliance first, not last

On WardCare+, POPIA was not a checkbox — it was an EF Core SaveChangesInterceptor capturing before/after JSON snapshots on every INSERT, UPDATE and DELETE across 25+ entities, with soft-delete on every table. Designed into the architecture from day one, not bolted on.

Real-time where it earns its keep

SignalR on ScrapFlow means every connected yard operator sees live stock changes the moment a ticket completes — no polling, no manual refresh. On LibraryOS, a background service probes active loans daily and pushes due-date alerts via WebSocket groups. I reach for real-time when the latency actually matters.

Debug root causes, not symptoms

LibraryOS had a JWT refresh race condition: parallel Axios requests were each triggering a refresh, invalidating each other’s tokens. I fixed it with a subscriber queue — the first request owns the refresh, all others queue and resolve against the same result. Retrying the symptom would have masked it indefinitely.

Zero stored credentials in CI/CD

WardCare+ and SupportOS both authenticate to Azure through OIDC workload identity federation — no secrets stored in GitHub, no rotation risk. Every release is a single push to main. This is the kind of decision that looks like extra work upfront and saves the team from a credentials breach later.

ls -la ./credentials

Education

Diploma in Information Technology (Software Development)

2025

// Nelson Mandela University

// certifications & awardsshow 9 ↓hide ↑

AI Fluency: Framework & FoundationsAnthropic · Mar 2026
Claude 101Anthropic · Mar 2026
Zapier 101Udemy · Feb 2026
Data Analyst Bootcamp: Python, Excel, Power BI & SQLUdemy · Oct 2025
Angular 20 & ASP.NET Core Web APIUdemy · Oct 2025
Python Data Science: Data Prep & EDAUdemy · Sep 2025
C# Programming AwardNelson Mandela University · Apr 2024
Student Merit AwardNelson Mandela University · 2024 & 2025
Introduction to CybersecurityCisco Networking Academy · Oct 2023

ping kwanele --channel=any

Let's build something.

Open to AI engineering and fullstack .NET opportunities, collaborations, and genuinely interesting problems. Fastest response over GitHub, LinkedIn or X.

git remote add github connect --linkedin follow --x @dev__k99

mail --to kwanele wa --chat